Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Source artifact inventory for distributed and concurrent problems

(authored by agents unless marked 🧑)

  • scope
    • source-only inventory of 1,546 files/directories, not 1,546 verified protocols
    • rows distinguish stated properties, proof text and recorded checking; no verification tools were run here
    • source repositories inspected on 6–7 October 2026; GitHub links pin inspected commits; author bundles use dated source URLs
    • 1,546 source-artifact rows, grouped by tool; variants, encodings, proof modules, model instances and named clients can have separate rows
    • row count includes supporting artifacts; distinct algorithms are not counted; coverage and unlocated sources are recorded below
    • each row records the modeled problem, separate safety/liveness evidence, tool/status, physical source lines and exact source link
    • 78 GitHub repository roots represented by pinned links, plus author source bundles
    • link audit: 4,920 unique commit-pinned file/directory links mapped to source trees; no missing paths found
    • no proof assistant or model checker was run; “proof artifact” means source proof text exists; successful checks are attributed to repository records where available
  • how to read a row
    • safety: bad outcomes never occur, such as two owners of a lock or conflicting chosen values
    • liveness: a requested good outcome eventually occurs; delivery, scheduling, quorum and failure assumptions remain part of the claim
    • deadlock freedom alone does not imply that each waiting client eventually succeeds; state-level enabledness is distinguished where identified
    • stated property, configured check, proof script, successful recorded run and complete proof are different evidence levels
    • “not found” records this inspection’s limit, not a proof of absence; imported modules can supply properties
    • size means measured physical lines, including comments/blanks; generated code is included where stated; overlapping file/directory scopes must not be summed as unique effort
    • short source quotes preserve declaration names/formulas; plain-English interpretations are agent inferences; read linked full statements before reusing assumptions
  • navigation
  • file coverage
    • TLA+ local suites: 365 rows; external TLA+ suites and extra proof files: 115
    • industrial TLA+/P: 74; Ivy/invariant suites/Quint: 534; Coq/Rocq: 200; Dafny/Verus: 60; Isabelle/native Lean/Cadence: 198
  • online discovery and limits
    • both web-search endpoints failed (HTTP 404 or empty error); fallback used curl/Python against GitHub repository search APIs, then git clones and source inspection
    • GitHub search queries included afp mirror, consensus language:Lean, distributed language:Lean, paxos language:Lean, raft language:Lean, SWISS invariant, DuoAI, DistAI, verified-storage, and distributed language:Isabelle; API responses are retained in research_verified
    • reused the 27 supplied clones and local Verus/IronKV/node-replication trees; cloned additional source repositories as needed
    • verus-lang/verified-storage resolved through repository discovery to microsoft/verified-storage, whose source README says “This repository contains code for verified storage systems”
    • Kafka, BookKeeper and Pulsar current inspected checkouts contained no matching source specification files; this does not rule out old branches or separate repositories
    • pure mathematics, sequential data-structure exercises, compiler syntax tests and puzzles were excluded; concurrent resource protocols and crash/storage protocols remain explicitly labeled
    • papers found: 0; PDFs saved: 0 in this source-only slice; neighboring review slices collect papers separately; human effort figures were not found in the inspected source evidence

TLA+ source cases

TLA+, PlusCal, TLAPS and Apalache source inventory

  • measurement and status convention

    • one row per .tla module, including proof and model-instance variants; this deliberately preserves the difference between a problem and its supporting artifacts
    • LOC is the measured number of physical source lines, including comments and generated PlusCal translations; dependent modules and model configuration files are excluded
    • property labels below quote source identifiers/formulas; [] means always, <> means eventually, and ~> means whenever the left side holds the right side eventually holds
    • a manifest proof entry identifies a TLAPS proof target, not a proof run performed for this inventory; model result fields are repository records, not reruns
    • a TLC PROPERTY may be a safety/refinement formula: the formulas, rather than the keyword alone, determine the separation below
    • plain-language reading of recurring source names: TypeOK means state values have the intended types; MutualExclusion means at most one process is in its critical section; Agreement/Consistency means decisions agree; Validity restricts allowable decisions; Integrity excludes spurious/duplicate delivery; StarvationFree means each waiting process eventually enters; Termination means execution eventually ends; Refinement/Implementation means concrete runs obey the abstract specification

  • tlaplus-Examples / specifications/Bakery-Boulangerie/Bakery.tla

    • specified: Bakery/Boulangerie mutual exclusion
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+/PlusCal; TLAPS
    • size: 509 physical lines; exact source
    • safety: MutualExclusion (definition); TypeOK (definition); TypeCorrect (definition); Inv (definition); theorem (definition)
      • source line: “MutualExclusion == \A i,j \in Procs : (i # j) => ~ /\ pc[i] = “cs””
      • source line: “TypeOK == /\ num \in [Procs -> Nat]”
    • liveness: DeadlockFree (definition); StarvationFree (definition)
      • source line: “DeadlockFree == (\E i \in Procs : Trying(i)) ~> (\E i \in Procs : InCS(i))”
      • source line: “StarvationFree == \A i \in Procs : Trying(i) ~> InCS(i)”
    • evidence/status: TLAPS proof target listed; manifest
      • source: "proof": {"maxRuntimeMinutes":2}

  • tlaplus-Examples / specifications/Bakery-Boulangerie/Boulanger.tla

    • specified: Bakery/Boulangerie mutual exclusion
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+/PlusCal; TLAPS
    • size: 659 physical lines; exact source
    • safety: MutualExclusion (definition); TypeOK (definition); TypeCorrect (definition); Inv (definition); theorem (definition)
      • source line: “MutualExclusion == \A i,j \in Procs : (i # j) => ~ /\ pc[i] = “cs””
      • source line: “TypeOK == /\ num \in [Procs -> Nat]”
    • liveness: DeadlockFree (definition); StarvationFree (definition)
      • source line: “DeadlockFree == (\E i \in Procs : Trying(i)) ~> (\E i \in Procs : InCS(i))”
      • source line: “StarvationFree == \A i \in Procs : Trying(i) ~> InCS(i)”
    • evidence/status: TLAPS proof target listed; manifest
      • source: "proof": {"maxRuntimeMinutes":3}

  • tlaplus-Examples / specifications/Bakery-Boulangerie/MCBakery.tla

    • specified: Bakery/Boulangerie mutual exclusion
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 7 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANTS: MutualExclusion TypeOK Inv; configuration

  • tlaplus-Examples / specifications/Bakery-Boulangerie/MCBoulanger.tla

    • specified: Bakery/Boulangerie mutual exclusion
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 8 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANTS: MutualExclusion TypeOK Inv; configuration

  • tlaplus-Examples / specifications/Chameneos/APChameneos.tla

    • specified: concurrent rendezvous game
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 37 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/Chameneos/Chameneos.tla

    • specified: concurrent rendezvous game
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 81 physical lines; exact source
    • safety: TypeOK (definition); theorem (definition)
      • source line: “TypeOK ==”
      • source line: “THEOREM Spec => []SumMet”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANTS: TypeOK SumMet; configuration

  • tlaplus-Examples / specifications/CheckpointCoordination/CheckpointCoordination.tla

    • specified: RingMaster checkpoint coordination
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 533 physical lines; exact source
    • safety: CheckpointVars (definition); LogCheckpoint (definition); CheckpointLease (definition); NoCheckpointLease (definition); TypeInvariant (definition); SafetyInvariant (definition); TemporalInvariant (definition); StartCheckpoint (definition); FinishCheckpoint (definition)
      • source line: “CheckpointVars == <<”
      • source line: “LogCheckpoint == [”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/CheckpointCoordination/MCCheckpointCoordination.tla

    • specified: RingMaster checkpoint coordination
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 21 physical lines; exact source
    • safety: IncorrectlyOptimizedShouldReplaceLease (definition)
      • source line: “IncorrectlyOptimizedShouldReplaceLease(currentLease) ==”
        • next source line: “ LET CC == INSTANCE CheckpointCoordination IN”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANTS: TypeInvariant; INVARIANTS: SafetyInvariant; configuration
    • configured checks: INVARIANTS: TypeInvariant; INVARIANTS: SafetyInvariant; configuration

  • tlaplus-Examples / specifications/CigaretteSmokers/APCigaretteSmokers.tla

    • specified: smoker/agent synchronization
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 26 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking symbolic; manifest
    • configured checks: INVARIANT: TypeOK; INVARIANT: AtMostOne; configuration

  • tlaplus-Examples / specifications/CigaretteSmokers/CigaretteSmokers.tla

    • specified: smoker/agent synchronization
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 58 physical lines; exact source
    • safety: TypeOK (definition)
      • source line: “TypeOK == /\ smokers \in [Ingredients -> [smoking: BOOLEAN]]”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANTS: TypeOK AtMostOne; configuration

  • tlaplus-Examples / specifications/CigaretteSmokers/CigaretteSmokers_proof.tla

    • specified: smoker/agent synchronization
    • artifact kind: proof module
    • tool: TLA+; TLAPS
    • size: 305 physical lines; exact source
    • safety: TypeCorrect (definition); Inv (definition); AtMostOneCorrect (definition)
      • source line: “THEOREM TypeCorrect == Spec => []TypeOK”
      • source line: “Inv == TypeOK /\ AtMostOne”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: TLAPS proof target listed; manifest
      • source: "proof": {"maxRuntimeMinutes":1}

  • tlaplus-Examples / specifications/DiningPhilosophers/APDiningPhilosophers.tla

    • specified: dining-philosopher resource synchronization
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 22 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking symbolic; manifest
    • configured checks: INVARIANT: TypeOK; INVARIANT: ExclusiveAccess; configuration

  • tlaplus-Examples / specifications/DiningPhilosophers/DiningPhilosophers.tla

    • specified: dining-philosopher resource synchronization
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+/PlusCal
    • size: 232 physical lines; exact source
    • safety: TypeOK (definition)
      • source line: “TypeOK ==”
        • next source line: “ /\ forks \in [1..NP -> [holder: 1..NP, clean: BOOLEAN]]”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANT: TypeOK; INVARIANT: ExclusiveAccess; configuration

  • tlaplus-Examples / specifications/Disruptor/APDisruptor_MPMC.tla

    • specified: producer/consumer ring-buffer synchronization
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 50 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking symbolic; manifest
    • configured checks: INVARIANT: NoDataRaces; configuration

  • tlaplus-Examples / specifications/Disruptor/APDisruptor_SPMC.tla

    • specified: producer/consumer ring-buffer synchronization
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 46 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking symbolic; manifest
    • configured checks: INVARIANT: NoDataRaces; configuration

  • tlaplus-Examples / specifications/Disruptor/APRingBuffer.tla

    • specified: producer/consumer ring-buffer synchronization
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 34 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/Disruptor/Disruptor_MPMC.tla

    • specified: producer/consumer ring-buffer synchronization
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 208 physical lines; exact source
    • safety: TypeOk (definition)
      • source line: “TypeOk ==”
        • next source line: “ /\ Buffer!TypeOk”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/Disruptor/MCDisruptor_MPMC.tla

    • specified: producer/consumer ring-buffer synchronization
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 41 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: Liveliness (definition)
      • source line: “Liveliness ==”
        • next source line: “ \A r \in Readers : \A i \in 0..(MaxPublished - 1) :”
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANTS: TypeOk; INVARIANTS: NoDataRaces; configuration
    • configured checks: INVARIANTS: TypeOk; INVARIANTS: NoDataRaces; PROPERTIES: Liveliness; configuration

  • tlaplus-Examples / specifications/Disruptor/Disruptor_SPMC.tla

    • specified: producer/consumer ring-buffer synchronization
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 159 physical lines; exact source
    • safety: TypeOk (definition)
      • source line: “TypeOk ==”
        • next source line: “ /\ Buffer!TypeOk”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/Disruptor/MCDisruptor_SPMC.tla

    • specified: producer/consumer ring-buffer synchronization
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 40 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: Liveliness (definition)
      • source line: “Liveliness ==”
        • next source line: “ \A r \in Readers : \A i \in 0 .. (MaxPublished - 1) :”
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANTS: TypeOk; INVARIANTS: NoDataRaces; PROPERTIES: Liveliness; configuration

  • tlaplus-Examples / specifications/Disruptor/RingBuffer.tla

    • specified: producer/consumer ring-buffer synchronization
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 92 physical lines; exact source
    • safety: TypeOk (definition)
      • source line: “TypeOk ==”
        • next source line: “ ringbuffer \in [”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/FiniteMonotonic/APCRDT.tla

    • specified: bounded abstractions of monotonic systems
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 20 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking symbolic; manifest
    • configured checks: INVARIANT: TypeOK; INVARIANT: Safety; configuration

  • tlaplus-Examples / specifications/FiniteMonotonic/APDistributedReplicatedLog.tla

    • specified: bounded abstractions of monotonic systems
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 29 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/FiniteMonotonic/APReplicatedLog.tla

    • specified: bounded abstractions of monotonic systems
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 25 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking symbolic; manifest
    • configured checks: INVARIANT: Safety; configuration

  • tlaplus-Examples / specifications/FiniteMonotonic/CRDT.tla

    • specified: bounded abstractions of monotonic systems
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 62 physical lines; exact source
    • safety: TypeOK (definition); Safety (definition); Monotonic (definition); Monotonicity (definition)
      • source line: “TypeOK == counter \in [Node -> [Node -> Nat]]”
      • source line: “Safety == \A n, o \in Node : counter[n][n] >= counter[o][n]”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/FiniteMonotonic/CRDT_proof.tla

    • specified: bounded abstractions of monotonic systems
    • artifact kind: proof module
    • tool: TLA+; TLAPS
    • size: 653 physical lines; exact source
    • safety: TypeCorrect (definition); Safe (definition); SumWeaklyMonotonic (definition); SumStronglyMonotonic (definition); theorem (definition)
      • source line: “THEOREM TypeCorrect == Spec => []TypeOK”
      • source line: “THEOREM Safe == Spec => []Safety”
    • liveness: OGLiveness (definition); OGLiveness (definition)
      • source line: “THEOREM OGLiveness == OGSpec => <>(\A n, o \in Node : counter[n] = counter[o])”
      • source line: “THEOREM OGLiveness == OGSpec => <>(\A n, o \in Node : counter[n] = counter[o])”
    • evidence/status: TLAPS proof target listed; manifest
      • source: "proof": {"maxRuntimeMinutes":1}

  • tlaplus-Examples / specifications/FiniteMonotonic/DistributedReplicatedLog.tla

    • specified: bounded abstractions of monotonic systems
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 74 physical lines; exact source
    • safety: TypeOK (definition); theorem (definition)
      • source line: “TypeOK ==”
        • next source line: “ /\ cLogs \in [Servers -> Seq(Values)]”
      • source line: “THEOREM Spec => []BoundedLag”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/FiniteMonotonic/MCCRDT.tla

    • specified: bounded abstractions of monotonic systems
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 32 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANTS: TypeOK; INVARIANTS: Safety; PROPERTIES: Convergence; PROPERTIES: (* Cannot check Monotonicity because the reset of the; PROPERTIES: counter values of our technique violates this property. *); configuration

  • tlaplus-Examples / specifications/FiniteMonotonic/MCDistributedReplicatedLog.tla

    • specified: bounded abstractions of monotonic systems
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 23 physical lines; exact source
    • safety: DropCommonPrefix (definition)
      • source line: “DropCommonPrefix ==”
        • next source line: “ LET commonPrefixBound == Len(LongestCommonPrefix(Range(cLogs)))”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANTS: TypeOK; INVARIANTS: BoundedLag; PROPERTIES: AllExtending; PROPERTIES: InSync; configuration

  • tlaplus-Examples / specifications/FiniteMonotonic/MCReplicatedLog.tla

    • specified: bounded abstractions of monotonic systems
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 35 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANTS: TypeOK; INVARIANTS: Safety; PROPERTIES: Convergence; configuration

  • tlaplus-Examples / specifications/FiniteMonotonic/ReplicatedLog.tla

    • specified: bounded abstractions of monotonic systems
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 100 physical lines; exact source
    • safety: TypeOK (definition); Safety (definition); theorem (definition); theorem (definition)
      • source line: “TypeOK ==”
        • next source line: “ /\ log \in Seq(Transaction)”
      • source line: “Safety ==”
        • next source line: “ \A n \in Node : executed[n] <= Len(log)”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/FlashProtocol/FlashWithMutex.tla

  • tlaplus-Examples / specifications/FlashProtocol/FlashWithMutexCMP.tla

    • specified: Flash cache coherence
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 410 physical lines; exact source
    • safety: ABS_TypeOK (definition); ABS_TypeCorrect (definition); CMPFairness (definition); ABS_ReqProgressCorrect (definition); ABS_DirProgressCorrect (definition); ABS_UniProgressCorrect (definition); ABS_InvProgressCorrect (definition); ABS_RpProgressCorrect (definition); ABS_WbProgressCorrect (definition); ABS_ShWbProgressCorrect (definition); ABS_NakcProgressCorrect (definition); ABS_CacheStateCorrect (definition); ABS_CacheDataCorrect (definition); ABS_MemDataCorrect (definition); ABS_Lemma_1_Correct (definition); ABS_Lemma_2_Correct (definition); ABS_Lemma_3_Correct (definition); ABS_Lemma_4_Correct (definition); ABS_Lemma_5_Correct (definition)
      • source line: “ABS_TypeOK ==”
        • next source line: “ /\ Home \in NODE”
      • source line: “THEOREM ABS_TypeCorrect == CMPSpec => []ABS_TypeOK”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/FlashProtocol/APFlashWithMutex.tla

    • specified: Flash cache coherence
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 78 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking symbolic; manifest
    • configured checks: INVARIANT: TypeOK; INVARIANT: CacheStateProp; INVARIANT: CacheDataProp; INVARIANT: MemDataProp; INVARIANT: Lemma_1; INVARIANT: Lemma_2; INVARIANT: Lemma_3; INVARIANT: Lemma_4; INVARIANT: Lemma_5; configuration

  • tlaplus-Examples / specifications/FlashProtocol/MCFlashWithMutex.tla

    • specified: Flash cache coherence
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 8 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANT: TypeOK; INVARIANT: CacheStateProp; INVARIANT: CacheDataProp; INVARIANT: MemDataProp; INVARIANT: Lemma_1; INVARIANT: Lemma_2; INVARIANT: Lemma_3; INVARIANT: Lemma_4; INVARIANT: Lemma_5; configuration

  • tlaplus-Examples / specifications/FlashProtocol/MCFlashWithMutexLive.tla

    • specified: Flash cache coherence
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 9 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: PROPERTIES: ReqProgress; PROPERTIES: DirProgress; PROPERTIES: UniProgress; PROPERTIES: InvProgress; PROPERTIES: RpProgress; PROPERTIES: WbProgress; PROPERTIES: ShWbProgress; PROPERTIES: NakcProgress; configuration

  • tlaplus-Examples / specifications/GermanProtocol/APGermanCMPWithMutex.tla

    • specified: German cache-coherence protocol; repository labels these as agentic translations
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 49 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking symbolic; manifest
    • configured checks: INVARIANT: TypeOK; INVARIANT: Coherence; INVARIANT: Lemma_1; configuration

  • tlaplus-Examples / specifications/GermanProtocol/APGermanControl.tla

    • specified: German cache-coherence protocol; repository labels these as agentic translations
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 46 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking symbolic; manifest
    • configured checks: INVARIANT: TypeOK; INVARIANT: Coherence; configuration

  • tlaplus-Examples / specifications/GermanProtocol/APGermanData.tla

    • specified: German cache-coherence protocol; repository labels these as agentic translations
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 58 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking symbolic; manifest
    • configured checks: INVARIANT: TypeOK; INVARIANT: Coherence; INVARIANT: DataProp; INVARIANT: TransactionConsistency; INVARIANT: DirectoryAccurate; INVARIANT: ExclusiveIsolation; INVARIANT: WritebackCarriesLatest; configuration

  • tlaplus-Examples / specifications/GermanProtocol/GermanCMPWithMutex.tla

    • specified: German cache-coherence protocol; repository labels these as agentic translations
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 175 physical lines; exact source
    • safety: TypeOK (definition)
      • source line: “TypeOK ==”
        • next source line: “ /\ cache \in [NODE -> CacheState]”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/GermanProtocol/GermanControl.tla

    • specified: German cache-coherence protocol; repository labels these as agentic translations
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 128 physical lines; exact source
    • safety: TypeOK (definition)
      • source line: “TypeOK ==”
        • next source line: “ /\ cache \in [NODE -> CacheState]”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/GermanProtocol/GermanData.tla

    • specified: German cache-coherence protocol; repository labels these as agentic translations
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 230 physical lines; exact source
    • safety: TypeOK (definition); TransactionConsistency (definition)
      • source line: “TypeOK ==”
        • next source line: “ /\ cache \in [NODE -> [state : CacheState, data : Payload]]”
      • source line: “TransactionConsistency ==”
        • next source line: “ (curCmd = “Empty”) <=> (curPtr = NoNode)”
    • liveness: RequestEventuallyServed (definition); SharedRequestEventuallyGranted (definition); ExclusiveRequestEventuallyGranted (definition)
      • source line: “RequestEventuallyServed ==”
        • next source line: “ \A i \in NODE :”
      • source line: “SharedRequestEventuallyGranted ==”
        • next source line: “ \A i \in NODE :”
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/GermanProtocol/MCGermanCMPWithMutex.tla

    • specified: German cache-coherence protocol; repository labels these as agentic translations
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 8 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANT: TypeOK; INVARIANT: Coherence; INVARIANT: Lemma_1; configuration

  • tlaplus-Examples / specifications/GermanProtocol/MCGermanControl.tla

    • specified: German cache-coherence protocol; repository labels these as agentic translations
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 16 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANT: TypeOK; INVARIANT: Coherence; configuration

  • tlaplus-Examples / specifications/GermanProtocol/MCGermanData.tla

    • specified: German cache-coherence protocol; repository labels these as agentic translations
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 8 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANT: TypeOK; INVARIANT: Coherence; INVARIANT: DataProp; INVARIANT: TransactionConsistency; INVARIANT: DirectoryAccurate; INVARIANT: ExclusiveIsolation; INVARIANT: WritebackCarriesLatest; configuration

  • tlaplus-Examples / specifications/Huang/Huang.tla

    • specified: Huang distributed termination detection
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 132 physical lines; exact source
    • safety: TypeOK (definition); TerminationDetected (definition); Safe (definition); theorem (definition); theorem (definition)
      • source line: “TypeOK ==”
        • next source line: “ /\ active \in [ Procs -> BOOLEAN ]”
      • source line: “TerminationDetected ==”
        • next source line: “ /\ ~active[Leader]”
    • liveness: Live (definition)
      • source line: “Live == ”
        • next source line: “ Terminated ~> TerminationDetected”
    • interpretation: termination/detection identifiers in the safety field are state predicates; the separately stated leads-to formula supplies eventual detection
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANTS: TypeOK; configuration

  • tlaplus-Examples / specifications/KeyValueStore/APKeyValueStore.tla

    • specified: key-value-store snapshot isolation
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 32 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/KeyValueStore/ClientCentric.tla

    • specified: key-value-store snapshot isolation
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 185 physical lines; exact source
    • safety: TypeOKT (definition); TypeOK (definition)
      • source line: “TypeOKT(transactions) ==”
      • source line: “TypeOK(transactions, execution) == ”
        • next source line: “ /\ TypeOKT(transactions)”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/KeyValueStore/KVsnap.tla

    • specified: key-value-store snapshot isolation
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+/PlusCal
    • size: 168 physical lines; exact source
    • safety: TypeOK (definition)
      • source line: “TypeOK == * type invariant”
    • liveness: Termination (definition)
      • source line: “Termination == <>(\A self \in ProcSet: pc[self] = “Done”)”
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/KeyValueStore/KeyValueStore.tla

    • specified: key-value-store snapshot isolation
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 107 physical lines; exact source
    • safety: TypeInvariant (definition); theorem (definition)
      • source line: “TypeInvariant == * The type invariant.”
      • source line: “THEOREM Spec => [](TypeInvariant /\ TxLifecycle)”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/KeyValueStore/KeyValueStore_proof.tla

    • specified: key-value-store snapshot isolation
    • artifact kind: proof module
    • tool: TLA+; TLAPS
    • size: 43 physical lines; exact source
    • safety: Inv (definition); theorem (definition)
      • source line: “Inv == TypeInvariant /\ TxLifecycle”
      • source line: “THEOREM TypeAndLifecycle == Spec => []Inv”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: TLAPS proof target listed; manifest
      • source: "proof": {"maxRuntimeMinutes":1}

  • tlaplus-Examples / specifications/KeyValueStore/MCKVS.tla

    • specified: key-value-store snapshot isolation
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 5 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANTS: TypeInvariant; INVARIANTS: TxLifecycle; configuration
    • configured checks: INVARIANTS: TypeInvariant; INVARIANTS: TxLifecycle; configuration
    • configured checks: INVARIANTS: TypeInvariant; INVARIANTS: TxLifecycle; configuration

  • tlaplus-Examples / specifications/KeyValueStore/MCKVsnap.tla

    • specified: key-value-store snapshot isolation
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 9 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANTS: TypeOK; INVARIANTS: SnapshotIsolation; PROPERTIES: Termination; configuration

  • tlaplus-Examples / specifications/KeyValueStore/Util.tla

    • specified: key-value-store snapshot isolation
    • artifact kind: support definitions or abstract interface
    • tool: TLA+
    • size: 45 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/MisraReachability/APParReach.tla

    • specified: sequential and multiprocess graph reachability variants
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 39 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking symbolic; manifest
    • configured checks: INVARIANT: Inv; configuration

  • tlaplus-Examples / specifications/MisraReachability/APReachable.tla

    • specified: sequential and multiprocess graph reachability variants
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 31 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/MisraReachability/MCParReach.tla

    • specified: sequential and multiprocess graph reachability variants
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 14 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANT: Inv; configuration

  • tlaplus-Examples / specifications/MisraReachability/MCReachabilityTest.tla

    • specified: sequential and multiprocess graph reachability variants
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 15 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest

  • tlaplus-Examples / specifications/MisraReachability/MCReachable.tla

    • specified: sequential and multiprocess graph reachability variants
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 14 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANTS: TypeOK Inv1 Inv2 Inv3 PartialCorrectness; configuration

  • tlaplus-Examples / specifications/MisraReachability/ParReach.tla

    • specified: sequential and multiprocess graph reachability variants
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+/PlusCal
    • size: 241 physical lines; exact source
    • safety: Inv (definition)
      • source line: “Inv == /\ marked \in SUBSET Nodes”
    • liveness: Termination (definition)
      • source line: “Termination == <>(\A self \in ProcSet: pc[self] = “Done”)”
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/MisraReachability/ParReachProofs.tla

    • specified: sequential and multiprocess graph reachability variants
    • artifact kind: proof module
    • tool: TLA+; TLAPS
    • size: 70 physical lines; exact source
    • safety: TypeInvariant (definition)
      • source line: “LEMMA TypeInvariant == Spec => []Inv”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: TLAPS proof target listed; manifest
      • source: "proof": {"maxRuntimeMinutes":1}

  • tlaplus-Examples / specifications/MisraReachability/Reachability.tla

    • specified: sequential and multiprocess graph reachability variants
    • artifact kind: support definitions or abstract interface
    • tool: TLA+
    • size: 67 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/MisraReachability/ReachabilityProofs.tla

    • specified: sequential and multiprocess graph reachability variants
    • artifact kind: proof module
    • tool: TLA+; TLAPS
    • size: 315 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: TLAPS proof target listed; manifest
      • source: "proof": {"maxRuntimeMinutes":1}

  • tlaplus-Examples / specifications/MisraReachability/ReachabilityTest.tla

    • specified: sequential and multiprocess graph reachability variants
    • artifact kind: support definitions or abstract interface
    • tool: TLA+
    • size: 123 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/MisraReachability/Reachable.tla

    • specified: sequential and multiprocess graph reachability variants
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+/PlusCal
    • size: 243 physical lines; exact source
    • safety: TypeOK (definition); Inv1 (definition); Inv2 (definition); Inv3 (definition); PartialCorrectness (definition); theorem (definition)
      • source line: “TypeOK == /\ marked \in SUBSET Nodes”
      • source line: “Inv1 == /\ TypeOK ”
    • liveness: Termination (definition)
      • source line: “Termination == <>(pc = “Done”)”
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/MisraReachability/ReachableProofs.tla

    • specified: sequential and multiprocess graph reachability variants
    • artifact kind: proof module
    • tool: TLA+; TLAPS
    • size: 215 physical lines; exact source
    • safety: theorem (definition); theorem (definition); theorem (definition); theorem (definition)
      • source line: “THEOREM Thm1 == Spec => []Inv1”
      • source line: “THEOREM Thm2 == Spec => [](TypeOK /\ Inv2)”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: TLAPS proof target listed; manifest
      • source: "proof": {"maxRuntimeMinutes":1}

  • tlaplus-Examples / specifications/MultiCarElevator/Elevator.tla

    • specified: concurrent elevator control
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 238 physical lines; exact source
    • safety: TypeInvariant (definition); SafetyInvariant (definition); theorem (definition)
      • source line: “TypeInvariant == * Statements about the variables which we expect to hold in every system state”
      • source line: “SafetyInvariant == * Some more comprehensive checks beyond the type invariant”
    • liveness: TemporalInvariant (definition)
      • source line: “TemporalInvariant == * Expectations about elevator system capabilities”
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANTS: TypeInvariant; INVARIANTS: SafetyInvariant; configuration
    • configured checks: INVARIANTS: TypeInvariant; INVARIANTS: SafetyInvariant; configuration
    • configured checks: INVARIANTS: TypeInvariant; INVARIANTS: SafetyInvariant; configuration
    • configured checks: INVARIANTS: TypeInvariant; INVARIANTS: SafetyInvariant; configuration
    • configured checks: INVARIANTS: TypeInvariant; INVARIANTS: SafetyInvariant; configuration

  • tlaplus-Examples / specifications/MultiCarElevator/Elevator_proof.tla

    • specified: concurrent elevator control
    • artifact kind: proof module
    • tool: TLA+; TLAPS
    • size: 484 physical lines; exact source
    • safety: Inv1 (definition); TypeCorrect (definition); Inv2 (definition); SafetyCorrect (definition)
      • source line: “Inv1 == TypeInvariant /\ WaitingFloor”
      • source line: “THEOREM TypeCorrect == Spec => []TypeInvariant”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: TLAPS proof target listed; manifest
      • incomplete-source warning: 6 OMITTED occurrences; proof targets alone do not establish completeness
      • source: "proof": {"maxRuntimeMinutes":1}

  • tlaplus-Examples / specifications/MultiPaxos-SMR/MultiPaxos.tla

    • specified: MultiPaxos replicated state machine
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+/PlusCal
    • size: 585 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: Termination (definition)
      • source line: “Termination == <>(\A self \in ProcSet: pc[self] = “Done”)”
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/MultiPaxos-SMR/MultiPaxos_MC.tla

    • specified: MultiPaxos replicated state machine
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 75 physical lines; exact source
    • safety: TypeOK (definition); Linearizability (definition); theorem (definition); theorem (definition)
      • source line: “TypeOK == /\ \A m \in msgs: m \in Messages”
      • source line: “Linearizability ==”
        • next source line: “ terminated => ”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANTS: TypeOK; INVARIANTS: Linearizability; configuration
    • configured checks: INVARIANTS: TypeOK; INVARIANTS: Linearizability; configuration

  • tlaplus-Examples / specifications/NanoBlockchain/MCNano.tla

    • specified: Nano blockchain consensus
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 122 physical lines; exact source
    • safety: TypeInvariant (definition); SafetyInvariant (definition); Safety (definition)
      • source line: “TypeInvariant ==”
        • next source line: “ /\ hashFunction \in [Hash -> N!Block \cup {N!NoBlock}]”
      • source line: “SafetyInvariant ==”
        • next source line: “ /\ N!SafetyInvariant”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANTS: TypeInvariant; INVARIANTS: SafetyInvariant; configuration
    • configured checks: INVARIANTS: TypeInvariant; INVARIANTS: SafetyInvariant; configuration
    • configured checks: INVARIANTS: TypeInvariant; INVARIANTS: SafetyInvariant; configuration

  • tlaplus-Examples / specifications/NanoBlockchain/Nano.tla

    • specified: Nano blockchain consensus
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 491 physical lines; exact source
    • safety: TypeInvariant (definition); CryptographicInvariant (definition); BalanceInvariant (definition); SafetyInvariant (definition); Safety (definition)
      • source line: “TypeInvariant ==”
        • next source line: “ /\ lastHash \in Hash \cup {NoHash}”
      • source line: “CryptographicInvariant ==”
        • next source line: “ /\ \A node \in Node :”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/Paxos/Consensus.tla

    • specified: consensus, voting and Paxos refinements
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+; TLAPS
    • size: 69 physical lines; exact source
    • safety: TypeOK (definition); Inv (definition); theorem (definition)
      • source line: “TypeOK == /\ chosen \subseteq Value”
      • source line: “Inv == /\ TypeOK”
    • liveness: Success (definition)
      • source line: “Success == <>(chosen # {})”
    • evidence/status: TLAPS proof target listed; manifest
      • source: "proof": {"maxRuntimeMinutes":1}

  • tlaplus-Examples / specifications/Paxos/MCConsensus.tla

    • specified: consensus, voting and Paxos refinements
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 23 physical lines; exact source
    • safety: ITypeOK (definition)
      • source line: “ITypeOK == chosen \in SUBSET Value”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANT: Inv; configuration

  • tlaplus-Examples / specifications/Paxos/MCPaxos.tla

    • specified: consensus, voting and Paxos refinements
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 74 physical lines; exact source
    • safety: ITypeOK (definition); Inv1 (definition); Inv2 (definition); Inv3 (definition); Inv4 (definition)
      • source line: “ITypeOK == /\ maxBal \in [Acceptor -> Ballot \cup {-1}]”
      • source line: “Inv1 == Inv!1”
    • liveness: MCLiveness (definition)
      • source line: “MCLiveness == <>(V!chosen # {})”
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANT: Inv1 Inv2 Inv3 Inv4; configuration

  • tlaplus-Examples / specifications/Paxos/MCVoting.tla

    • specified: consensus, voting and Paxos refinements
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 55 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANT: Inv; configuration

  • tlaplus-Examples / specifications/Paxos/Paxos.tla

    • specified: consensus, voting and Paxos refinements
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 217 physical lines; exact source
    • safety: TypeOK (definition); Inv (definition)
      • source line: “TypeOK == /\ maxBal \in [Acceptor -> Ballot \cup {-1}]”
      • source line: “Inv == /\ TypeOK”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/Paxos/Voting.tla

    • specified: consensus, voting and Paxos refinements
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+; TLAPS
    • size: 197 physical lines; exact source
    • safety: TypeOK (definition); SafeAt (definition); AllSafeAtZero (definition); VotesSafe (definition); VotesSafeImpliesConsistency (definition); ShowsSafeAt (definition); ShowsSafety (definition); Inv (definition); theorem (definition)
      • source line: “TypeOK == /\ votes \in [Acceptor -> SUBSET (Ballot \X Value)]”
      • source line: “SafeAt(b, v) == \A c \in 0..(b-1) : NoneOtherChoosableAt(c, v)”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: TLAPS proof target listed; manifest
      • source: "proof": {"maxRuntimeMinutes":1}

  • tlaplus-Examples / specifications/PaxosHowToWinATuringAward/Consensus.tla

    • specified: consensus/voting/Paxos tutorial variants
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+; TLAPS
    • size: 117 physical lines; exact source
    • safety: TypeOK (definition); Inv (definition); theorem (definition)
      • source line: “TypeOK == /\ chosen \subseteq Value”
      • source line: “Inv == /\ TypeOK”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: TLAPS proof target listed; manifest
      • source: "proof": {"maxRuntimeMinutes":1}

  • tlaplus-Examples / specifications/PaxosHowToWinATuringAward/MCConsensus.tla

    • specified: consensus/voting/Paxos tutorial variants
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 16 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANT: Inv; configuration

  • tlaplus-Examples / specifications/PaxosHowToWinATuringAward/MCPaxos.tla

    • specified: consensus/voting/Paxos tutorial variants
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 45 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANT: Inv; configuration
    • configured checks: INVARIANT: Inv; configuration

  • tlaplus-Examples / specifications/PaxosHowToWinATuringAward/MCVoting.tla

    • specified: consensus/voting/Paxos tutorial variants
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 39 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANT: Inv; configuration

  • tlaplus-Examples / specifications/PaxosHowToWinATuringAward/Paxos.tla

    • specified: consensus/voting/Paxos tutorial variants
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 395 physical lines; exact source
    • safety: TypeOK (definition); Inv (definition); theorem (definition)
      • source line: “TypeOK == /\ maxBal \in [Acceptor -> Ballot \cup {-1}]”
      • source line: “Inv == ”
        • next source line: “ /\ TypeOK”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/PaxosHowToWinATuringAward/Voting.tla

    • specified: consensus/voting/Paxos tutorial variants
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+; TLAPS
    • size: 316 physical lines; exact source
    • safety: TypeOK (definition); SafeAt (definition); AllSafeAtZero (definition); VotesSafe (definition); Inv (definition); ShowsSafeAt (definition); ShowsSafety (definition); theorem (definition)
      • source line: “TypeOK == ”
        • next source line: “ /\ votes \in [Acceptor -> SUBSET (Ballot \X Value)]”
      • source line: “SafeAt(b, v) == \A c \in 0..(b-1) : NoneOtherChoosableAt(c, v)”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: TLAPS proof target listed; manifest
      • source: "proof": {"maxRuntimeMinutes":1}

  • tlaplus-Examples / specifications/PaxosHowToWinATuringAward/Voting_proof.tla

    • specified: consensus/voting/Paxos tutorial variants
    • artifact kind: proof module
    • tool: TLA+; TLAPS
    • size: 142 physical lines; exact source
    • safety: AllSafeAtZero_T (definition); ShowsSafety_T (definition)
      • source line: “THEOREM AllSafeAtZero_T == \A v \in Value : SafeAt(0, v)”
      • source line: “THEOREM ShowsSafety_T ==”
        • next source line: “ Inv => \A Q \in Quorum, b \in Ballot, v \in Value :”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: TLAPS proof target listed; manifest
      • source: "proof": {"maxRuntimeMinutes":1}

  • tlaplus-Examples / specifications/Prisoners/APPrisoners.tla

    • specified: prisoner coordination puzzle
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 29 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/Prisoners/MCPrisoners.tla

    • specified: prisoner coordination puzzle
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 27 physical lines; exact source
    • safety: InductiveInvariant (definition)
      • source line: “InductiveInvariant == TypeOK /\ CountInvariant”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/Prisoners/Prisoners.tla

    • specified: prisoner coordination puzzle
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 206 physical lines; exact source
    • safety: TypeOK (definition); Safety (definition); CountInvariant (definition); theorem (definition)
      • source line: “TypeOK == ”
      • source line: “Safety == ”
    • liveness: Liveness (definition)
      • source line: “Liveness == <>Done”
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANT: TypeOK CountInvariant; PROPERTIES: Safety Liveness; configuration

  • tlaplus-Examples / specifications/Prisoners_Single_Switch/APPrisoner.tla

    • specified: prisoner coordination through one shared switch
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 30 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/Prisoners_Single_Switch/Prisoner.tla

    • specified: prisoner coordination through one shared switch
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 184 physical lines; exact source
    • safety: TypeOK (definition)
      • source line: “TypeOK ==”
        • next source line: “ /\ count \in 1 .. VictoryThreshold + 1”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANT: TypeOK; INVARIANT: VictoryOK; configuration
    • configured checks: INVARIANT: TypeOK; INVARIANT: VictoryOK; configuration
    • configured checks: INVARIANT: TypeOK; INVARIANT: VictoryOK; configuration
    • configured checks: INVARIANT: TypeOK; INVARIANT: VictoryOK; configuration

  • tlaplus-Examples / specifications/ReadersWriters/APReadersWriters.tla

    • specified: reader/writer synchronization
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 39 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking symbolic; manifest
    • configured checks: INVARIANT: Safety; configuration

  • tlaplus-Examples / specifications/ReadersWriters/MC.tla

    • specified: reader/writer synchronization
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 13 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANT: TypeOK; INVARIANT: Safety; configuration

  • tlaplus-Examples / specifications/ReadersWriters/ReadersWriters.tla

    • specified: reader/writer synchronization
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 123 physical lines; exact source
    • safety: TypeOK (definition); Safety (definition)
      • source line: “TypeOK ==”
        • next source line: “ /\ readers \subseteq Actors”
      • source line: “Safety ==”
        • next source line: “ /\ ~(readers /= {} /\ writers /= {})”
    • liveness: Liveness (definition)
      • source line: “Liveness ==”
        • next source line: “ /\ \A actor \in Actors : []<>(actor \in readers)”
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/ReadersWriters/ReadersWriters_proof.tla

    • specified: reader/writer synchronization
    • artifact kind: proof module
    • tool: TLA+; TLAPS
    • size: 219 physical lines; exact source
    • safety: TypeOKStep (definition); TypeCorrect (definition); SafetyStep (definition); SafetyCorrect (definition)
      • source line: “LEMMA TypeOKStep == TypeOK /\ [Next]_vars => TypeOK’”
      • source line: “THEOREM TypeCorrect == Spec => []TypeOK”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: TLAPS proof target listed; manifest
      • source: "proof": {"maxRuntimeMinutes":1}

  • tlaplus-Examples / specifications/SDP_Verification/SDP_Attack_New_Solution_Spec/MC.tla

    • specified: software-defined perimeter authentication/attack models
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 51 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANT: SPASafeLaw; INVARIANT: DataAccessSafeLaw; configuration

  • tlaplus-Examples / specifications/SDP_Verification/SDP_Attack_New_Solution_Spec/SPA_Attack_New.tla

    • specified: software-defined perimeter authentication/attack models
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 1,318 physical lines; exact source
    • safety: DataAccessSafeLaw (definition); SPASafeLaw (definition); FwCorrectProperty (definition)
      • source line: “DataAccessSafeLaw == * attacker can not find target server service at anytime”
      • source line: “SPASafeLaw == * attacker can not launch a successful SPA auth at anytime”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/SDP_Verification/SDP_Attack_Spec/MC.tla

    • specified: software-defined perimeter authentication/attack models
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 51 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANT: SPASafeLaw; INVARIANT: DataAccessSafeLaw; configuration

  • tlaplus-Examples / specifications/SDP_Verification/SDP_Attack_Spec/SPA_Attack.tla

    • specified: software-defined perimeter authentication/attack models
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 1,320 physical lines; exact source
    • safety: DataAccessSafeLaw (definition); SPASafeLaw (definition)
      • source line: “DataAccessSafeLaw == * attacker can not find target server service at anytime”
      • source line: “SPASafeLaw == * attacker can not launch a successful SPA auth at anytime”
    • liveness: FwCorrectProperty (definition)
      • source line: “FwCorrectProperty ==*to simplify the model, we don’t consider TCP packets re-transport mechanism, so established TCP links without packet dropping.”
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/SimplifiedFastPaxos/FastPaxos.tla

    • specified: simplified Fast Paxos consensus
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 158 physical lines; exact source
    • safety: FastTypeOK (definition)
      • source line: “FastTypeOK == /\ PaxosTypeOK”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANTS: FastTypeOK FastNontriviality; configuration

  • tlaplus-Examples / specifications/SimplifiedFastPaxos/Paxos.tla

    • specified: simplified Fast Paxos consensus
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 219 physical lines; exact source
    • safety: PaxosTypeOK (definition); PaxosConsistency (definition)
      • source line: “PaxosTypeOK == /\ messages \subseteq Message”
      • source line: “PaxosConsistency == [][decision = none]_<>”
    • liveness: PaxosLiveness (definition)
      • source line: “PaxosLiveness == FALSE”
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANTS: PaxosTypeOK PaxosNontriviality; configuration

  • tlaplus-Examples / specifications/SingleLaneBridge/APSingleLaneBridge.tla

    • specified: single-lane bridge synchronization
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 32 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/SingleLaneBridge/MC.tla

    • specified: single-lane bridge synchronization
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 26 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANT: Invariants; configuration

  • tlaplus-Examples / specifications/SingleLaneBridge/SingleLaneBridge.tla

    • specified: single-lane bridge synchronization
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 122 physical lines; exact source
    • safety: Invariants (definition); TypeOK (definition); theorem (definition); theorem (definition)
      • source line: “Invariants ==”
      • source line: “TypeOK ==”
        • next source line: “ /\ Location \in [ Cars -> Positions ]”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/SlushProtocol/Slush.tla

    • specified: Slush probabilistic blockchain consensus
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+/PlusCal
    • size: 433 physical lines; exact source
    • safety: TerminationMessageType (definition); TerminationMessage (definition); TypeInvariant (definition); TerminationMessageType (definition); TerminationMessage (definition); TypeInvariant (definition); WaitForQueryMessageOrTermination (definition); SlushLoopTermination (definition)
      • source line: “ TerminationMessageType == “TerminationMessageType””
      • source line: “ TerminationMessage == [”
    • liveness: Termination (definition)
      • source line: “Termination == <>(\A self \in ProcSet: pc[self] = “Done”)”
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANTS: TypeInvariant; configuration
    • configured checks: INVARIANTS: TypeInvariant; configuration
    • configured checks: INVARIANTS: TypeInvariant; configuration

  • tlaplus-Examples / specifications/SpanningTree/APSpanTree.tla

    • specified: distributed spanning-tree construction
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 31 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking symbolic; manifest
    • configured checks: INVARIANT: TypeOK; configuration

  • tlaplus-Examples / specifications/SpanningTree/SpanTree.tla

    • specified: distributed spanning-tree construction
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 168 physical lines; exact source
    • safety: TypeOK (definition); Safety (definition)
      • source line: “TypeOK == /\ mom \in [Nodes -> Nodes]”
      • source line: “Safety == []((~ ENABLED Next) => PostCondition)”
    • liveness: Liveness (definition)
      • source line: “Liveness == <>(~ ENABLED Next) ”
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANT: TypeOK; PROPERTIES: Liveness Safety; configuration

  • tlaplus-Examples / specifications/SpanningTree/SpanTreeRandom.tla

    • specified: distributed spanning-tree construction
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 91 physical lines; exact source
    • safety: TypeOK (definition); Safety (definition)
      • source line: “TypeOK == /\ mom \in [Nodes -> Nodes]”
      • source line: “Safety == []((~ ENABLED Next) => PostCondition)”
    • liveness: Liveness (definition)
      • source line: “Liveness == <>PostCondition”
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANT: TypeOK; configuration

  • tlaplus-Examples / specifications/SpanningTree/SpanTreeTest.tla

    • specified: distributed spanning-tree construction
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 73 physical lines; exact source
    • safety: TypeOK (definition); Safety (definition)
      • source line: “TypeOK == /\ mom \in [Nodes -> Nodes]”
      • source line: “Safety == []((~ ENABLED Next) => PostCondition)”
    • liveness: Liveness (definition)
      • source line: “Liveness == <>PostCondition”
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANT: TypeOK; PROPERTIES: Liveness Safety; configuration
    • configured checks: INVARIANT: TypeOK; PROPERTIES: Liveness Safety; configuration

  • tlaplus-Examples / specifications/SpanningTree/SpanTree_proof.tla

    • specified: distributed spanning-tree construction
    • artifact kind: proof module
    • tool: TLA+; TLAPS
    • size: 60 physical lines; exact source
    • safety: TypeCorrect (definition)
      • source line: “THEOREM TypeCorrect == Spec => []TypeOK”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: TLAPS proof target listed; manifest
      • source: "proof": {"maxRuntimeMinutes":1}

  • tlaplus-Examples / specifications/SpecifyingSystems/AdvancedExamples/InnerSequential.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant AdvancedExamples
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 75 physical lines; exact source
    • safety: DataInvariant (definition); theorem (definition)
      • source line: “DataInvariant == ”
        • next source line: “ /\ RegFileTypeInvariant”
      • source line: “THEOREM Spec => []DataInvariant”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/SpecifyingSystems/AdvancedExamples/InnerSerial.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant AdvancedExamples
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 122 physical lines; exact source
    • safety: DataInvariant (definition)
      • source line: “DataInvariant == ”
        • next source line: “ /\ RegFileTypeInvariant”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/SpecifyingSystems/AdvancedExamples/MCInnerSequential.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant AdvancedExamples
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 15 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANT: DataInvariant; INVARIANT: (*************************************************************************); INVARIANT: (* We have TLC check DataInvariant. *); INVARIANT: (*************************************************************************); configuration

  • tlaplus-Examples / specifications/SpecifyingSystems/AdvancedExamples/MCInnerSerial.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant AdvancedExamples
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 46 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANT: DataInvariant; INVARIANT: (*************************************************************************); INVARIANT: (* We have TLC check DataInvariant. *); INVARIANT: (*************************************************************************); configuration

  • tlaplus-Examples / specifications/SpecifyingSystems/AdvancedExamples/RegisterInterface.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant AdvancedExamples
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 12 physical lines; exact source
    • safety: RegFileTypeInvariant (definition)
      • source line: “RegFileTypeInvariant == regFile \in [Proc -> [Reg -> RegValue]]”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/SpecifyingSystems/AdvancedExamples/SerialMemory.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant AdvancedExamples
    • artifact kind: support definitions or abstract interface
    • tool: TLA+
    • size: 8 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/SpecifyingSystems/AsynchronousInterface/APAsynchInterface.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant AsynchronousInterface
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 24 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking symbolic; manifest
    • configured checks: INVARIANT: TypeInvariant; configuration

  • tlaplus-Examples / specifications/SpecifyingSystems/AsynchronousInterface/APChannel.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant AsynchronousInterface
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 20 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking symbolic; manifest
    • configured checks: INVARIANT: TypeInvariant; configuration

  • tlaplus-Examples / specifications/SpecifyingSystems/AsynchronousInterface/AsynchInterface.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant AsynchronousInterface
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 28 physical lines; exact source
    • safety: TypeInvariant (definition); theorem (definition)
      • source line: “TypeInvariant == /\ val \in Data”
      • source line: “THEOREM Spec => []TypeInvariant”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANT: TypeInvariant; INVARIANT: (***************************************************************************); INVARIANT: (* TLC requires that every declared constant in the specification be *); INVARIANT: (* assigned a value by a CONSTANT statement in the configuration file. *); INVARIANT: (***************************************************************************); configuration

  • tlaplus-Examples / specifications/SpecifyingSystems/AsynchronousInterface/AsynchInterface_proof.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant AsynchronousInterface
    • artifact kind: proof module
    • tool: TLA+; TLAPS
    • size: 14 physical lines; exact source
    • safety: TypeCorrect (definition)
      • source line: “THEOREM TypeCorrect == Spec => []TypeInvariant”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: TLAPS proof target listed; manifest
      • source: "proof": {"maxRuntimeMinutes":1}

  • tlaplus-Examples / specifications/SpecifyingSystems/AsynchronousInterface/Channel.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant AsynchronousInterface
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 22 physical lines; exact source
    • safety: TypeInvariant (definition); theorem (definition)
      • source line: “TypeInvariant == chan \in [val : Data, rdy : {0, 1}, ack : {0, 1}]”
      • source line: “THEOREM Spec => []TypeInvariant”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANT: TypeInvariant; INVARIANT: (***************************************************************************); INVARIANT: (* TLC requires that every declared constant in the specification be *); INVARIANT: (* assigned a value by a CONSTANT statement in the configuration file. *); INVARIANT: (***************************************************************************); configuration

  • tlaplus-Examples / specifications/SpecifyingSystems/AsynchronousInterface/Channel_proof.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant AsynchronousInterface
    • artifact kind: proof module
    • tool: TLA+; TLAPS
    • size: 14 physical lines; exact source
    • safety: TypeCorrect (definition)
      • source line: “THEOREM TypeCorrect == Spec => []TypeInvariant”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: TLAPS proof target listed; manifest
      • source: "proof": {"maxRuntimeMinutes":1}

  • tlaplus-Examples / specifications/SpecifyingSystems/AsynchronousInterface/PrintValues.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant AsynchronousInterface
    • artifact kind: support definitions or abstract interface
    • tool: TLA+
    • size: 55 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest

  • tlaplus-Examples / specifications/SpecifyingSystems/CachingMemory/InternalMemory.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant CachingMemory
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 43 physical lines; exact source
    • safety: TypeInvariant (definition); theorem (definition)
      • source line: “TypeInvariant == ”
        • next source line: “ /\ mem \in [Adr->Val]”
      • source line: “THEOREM ISpec => []TypeInvariant”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/SpecifyingSystems/CachingMemory/InternalMemory_proof.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant CachingMemory
    • artifact kind: proof module
    • tool: TLA+; TLAPS
    • size: 76 physical lines; exact source
    • safety: Inv (definition); TypeCorrect (definition)
      • source line: “Inv == TypeInvariant /\ BufConsistent”
      • source line: “THEOREM TypeCorrect == ISpec => []TypeInvariant”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: TLAPS proof target listed; manifest
      • source: "proof": {"maxRuntimeMinutes":1}

  • tlaplus-Examples / specifications/SpecifyingSystems/CachingMemory/MCInternalMemory.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant CachingMemory
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 45 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANT: TypeInvariant; configuration

  • tlaplus-Examples / specifications/SpecifyingSystems/CachingMemory/MCWriteThroughCache.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant CachingMemory
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 91 physical lines; exact source
    • safety: LM_Inner_TypeInvariant (definition); theorem (definition)
      • source line: “LM_Inner_TypeInvariant == ”
        • next source line: “ /\ omem \in [Adr->Val]”
      • source line: “THEOREM LM_Inner_ISpec => []LM_Inner_TypeInvariant”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANTS: TypeInvariant Coherence LM_Inner_TypeInvariant; configuration

  • tlaplus-Examples / specifications/SpecifyingSystems/CachingMemory/Memory.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant CachingMemory
    • artifact kind: support definitions or abstract interface
    • tool: TLA+
    • size: 6 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/SpecifyingSystems/CachingMemory/MemoryInterface.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant CachingMemory
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 23 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/SpecifyingSystems/CachingMemory/WriteThroughCache.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant CachingMemory
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 93 physical lines; exact source
    • safety: TypeInvariant (definition); theorem (definition)
      • source line: “TypeInvariant == ”
        • next source line: “ /\ wmem \in [Adr -> Val]”
      • source line: “THEOREM Spec => [](TypeInvariant /\ Coherence)”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/SpecifyingSystems/CachingMemory/WriteThroughCacheInstanced.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant CachingMemory
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 163 physical lines; exact source
    • safety: M_TypeInvariant (definition); TypeInvariant (definition); theorem (definition); theorem (definition)
      • source line: “M_TypeInvariant == ”
        • next source line: “ /\ wmem \in [Adr->Val]”
      • source line: “TypeInvariant == ”
        • next source line: “ /\ wmem \in [Adr -> Val]”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/SpecifyingSystems/Composing/APChannel.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant Composing
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 23 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking symbolic; manifest
    • configured checks: INVARIANT: TypeInvariant; configuration

  • tlaplus-Examples / specifications/SpecifyingSystems/Composing/Channel.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant Composing
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 22 physical lines; exact source
    • safety: TypeInvariant (definition); theorem (definition)
      • source line: “TypeInvariant == chan \in [val : Data, rdy : {0, 1}, ack : {0, 1}]”
      • source line: “THEOREM Spec => []TypeInvariant”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/SpecifyingSystems/Composing/ChannelRefinement.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant Composing
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 42 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/SpecifyingSystems/Composing/Channel_proof.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant Composing
    • artifact kind: proof module
    • tool: TLA+; TLAPS
    • size: 14 physical lines; exact source
    • safety: TypeCorrect (definition)
      • source line: “THEOREM TypeCorrect == Spec => []TypeInvariant”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: TLAPS proof target listed; manifest
      • source: "proof": {"maxRuntimeMinutes":1}

  • tlaplus-Examples / specifications/SpecifyingSystems/Composing/CompositeFIFO.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant Composing
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 41 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/SpecifyingSystems/Composing/InternalMemory.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant Composing
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 43 physical lines; exact source
    • safety: TypeInvariant (definition); theorem (definition)
      • source line: “TypeInvariant == ”
        • next source line: “ /\ mem \in [Adr->Val]”
      • source line: “THEOREM ISpec => []TypeInvariant”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/SpecifyingSystems/Composing/InternalMemory_proof.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant Composing
    • artifact kind: proof module
    • tool: TLA+; TLAPS
    • size: 76 physical lines; exact source
    • safety: Inv (definition); TypeCorrect (definition)
      • source line: “Inv == TypeInvariant /\ BufConsistent”
      • source line: “THEOREM TypeCorrect == ISpec => []TypeInvariant”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: TLAPS proof target listed; manifest
      • source: "proof": {"maxRuntimeMinutes":1}

  • tlaplus-Examples / specifications/SpecifyingSystems/Composing/JointActionMemory.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant Composing
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 40 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/SpecifyingSystems/Composing/MemoryInterface.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant Composing
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 23 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/SpecifyingSystems/FIFO/APChannel.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant FIFO
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 23 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking symbolic; manifest
    • configured checks: INVARIANT: TypeInvariant; configuration

  • tlaplus-Examples / specifications/SpecifyingSystems/FIFO/APInnerFIFO.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant FIFO
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 30 physical lines; exact source
    • safety: ChannelTypeInvariants (definition)
      • source line: “ChannelTypeInvariants ==”
        • next source line: “ /\ InChan!TypeInvariant”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking symbolic; manifest
    • configured checks: INVARIANT: ChannelTypeInvariants; configuration

  • tlaplus-Examples / specifications/SpecifyingSystems/FIFO/APInnerFIFOInstanced.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant FIFO
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 33 physical lines; exact source
    • safety: ChannelTypeInvariants (definition)
      • source line: “ChannelTypeInvariants ==”
        • next source line: “ /\ InChan_TypeInvariant”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking symbolic; manifest
    • configured checks: INVARIANT: ChannelTypeInvariants; configuration

  • tlaplus-Examples / specifications/SpecifyingSystems/FIFO/APMCInnerFIFO.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant FIFO
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 36 physical lines; exact source
    • safety: ChannelTypeInvariants (definition)
      • source line: “ChannelTypeInvariants ==”
        • next source line: “ /\ InChan_TypeInvariant”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking symbolic; manifest
    • configured checks: INVARIANT: ChannelTypeInvariants; configuration

  • tlaplus-Examples / specifications/SpecifyingSystems/FIFO/Channel.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant FIFO
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 22 physical lines; exact source
    • safety: TypeInvariant (definition); theorem (definition)
      • source line: “TypeInvariant == chan \in [val : Data, rdy : {0, 1}, ack : {0, 1}]”
      • source line: “THEOREM Spec => []TypeInvariant”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/SpecifyingSystems/FIFO/Channel_proof.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant FIFO
    • artifact kind: proof module
    • tool: TLA+; TLAPS
    • size: 14 physical lines; exact source
    • safety: TypeCorrect (definition)
      • source line: “THEOREM TypeCorrect == Spec => []TypeInvariant”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: TLAPS proof target listed; manifest
      • source: "proof": {"maxRuntimeMinutes":1}

  • tlaplus-Examples / specifications/SpecifyingSystems/FIFO/FIFO.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant FIFO
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 6 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/SpecifyingSystems/FIFO/InnerFIFO.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant FIFO
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 40 physical lines; exact source
    • safety: TypeInvariant (definition); theorem (definition)
      • source line: “TypeInvariant == /\ InChan!TypeInvariant”
      • source line: “THEOREM Spec => []TypeInvariant”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/SpecifyingSystems/FIFO/InnerFIFOInstanced.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant FIFO
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 104 physical lines; exact source
    • safety: InChan_TypeInvariant (definition); OutChan_TypeInvariant (definition); TypeInvariant (definition); theorem (definition)
      • source line: “InChan_TypeInvariant == in \in [val : Message, rdy : {0, 1}, ack : {0, 1}]”
      • source line: “OutChan_TypeInvariant == out \in [val : Message, rdy : {0, 1}, ack : {0, 1}]”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/SpecifyingSystems/FIFO/InnerFIFO_proof.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant FIFO
    • artifact kind: proof module
    • tool: TLA+; TLAPS
    • size: 35 physical lines; exact source
    • safety: TypeCorrect (definition)
      • source line: “THEOREM TypeCorrect == Spec => []TypeInvariant”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: TLAPS proof target listed; manifest
      • source: "proof": {"maxRuntimeMinutes":1}

  • tlaplus-Examples / specifications/SpecifyingSystems/FIFO/MCInnerFIFO.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant FIFO
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 32 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANT: TypeInvariant; configuration

  • tlaplus-Examples / specifications/SpecifyingSystems/Liveness/InternalMemory.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant Liveness
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 43 physical lines; exact source
    • safety: TypeInvariant (definition); theorem (definition)
      • source line: “TypeInvariant == ”
        • next source line: “ /\ mem \in [Adr->Val]”
      • source line: “THEOREM ISpec => []TypeInvariant”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/SpecifyingSystems/Liveness/InternalMemory_proof.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant Liveness
    • artifact kind: proof module
    • tool: TLA+; TLAPS
    • size: 76 physical lines; exact source
    • safety: Inv (definition); TypeCorrect (definition)
      • source line: “Inv == TypeInvariant /\ BufConsistent”
      • source line: “THEOREM TypeCorrect == ISpec => []TypeInvariant”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: TLAPS proof target listed; manifest
      • source: "proof": {"maxRuntimeMinutes":1}

  • tlaplus-Examples / specifications/SpecifyingSystems/Liveness/LiveInternalMemory.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant Liveness
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 45 physical lines; exact source
    • safety: theorem (definition)
      • source line: “THEOREM LISpec => LivenessProperty”
    • liveness: LivenessProperty (definition)
      • source line: “LivenessProperty == ”
        • next source line: “ \A p \in Proc : (ctl[p] = “busy”) ~> (ctl[p] = “rdy”)”
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/SpecifyingSystems/Liveness/LiveWriteThroughCache.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant Liveness
    • artifact kind: support definitions or abstract interface
    • tool: TLA+
    • size: 28 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/SpecifyingSystems/Liveness/MCInternalMemory.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant Liveness
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 45 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/SpecifyingSystems/Liveness/MCLiveInternalMemory.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant Liveness
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 48 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest

  • tlaplus-Examples / specifications/SpecifyingSystems/Liveness/MCLiveWriteThroughCache.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant Liveness
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 145 physical lines; exact source
    • safety: LM_Inner_TypeInvariant (definition)
      • source line: “LM_Inner_TypeInvariant == ”
        • next source line: “ /\ omem \in [Adr->Val]”
    • liveness: LM_Inner_Liveness (definition); LM_Inner_Liveness2 (definition); LM_Inner_LivenessProperty (definition)
      • source line: “LM_Inner_Liveness == ”
        • next source line: “ \A p \in Proc : ”
      • source line: “LM_Inner_Liveness2 == ”
        • next source line: “ \A p \in Proc : ”
    • evidence/status: model checking exhaustive search; manifest

  • tlaplus-Examples / specifications/SpecifyingSystems/Liveness/Memory.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant Liveness
    • artifact kind: support definitions or abstract interface
    • tool: TLA+
    • size: 6 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/SpecifyingSystems/Liveness/MemoryInterface.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant Liveness
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 23 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/SpecifyingSystems/Liveness/WriteThroughCacheInstanced.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant Liveness
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 163 physical lines; exact source
    • safety: M_TypeInvariant (definition); TypeInvariant (definition); theorem (definition); theorem (definition)
      • source line: “M_TypeInvariant == ”
        • next source line: “ /\ wmem \in [Adr->Val]”
      • source line: “TypeInvariant == ”
        • next source line: “ /\ wmem \in [Adr -> Val]”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/SpecifyingSystems/RealTime/InternalMemory.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant RealTime
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 43 physical lines; exact source
    • safety: TypeInvariant (definition); theorem (definition)
      • source line: “TypeInvariant == ”
        • next source line: “ /\ mem \in [Adr->Val]”
      • source line: “THEOREM ISpec => []TypeInvariant”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/SpecifyingSystems/RealTime/InternalMemory_proof.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant RealTime
    • artifact kind: proof module
    • tool: TLA+; TLAPS
    • size: 76 physical lines; exact source
    • safety: Inv (definition); TypeCorrect (definition)
      • source line: “Inv == TypeInvariant /\ BufConsistent”
      • source line: “THEOREM TypeCorrect == ISpec => []TypeInvariant”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: TLAPS proof target listed; manifest
      • source: "proof": {"maxRuntimeMinutes":1}

  • tlaplus-Examples / specifications/SpecifyingSystems/RealTime/MCRealTime.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant RealTime
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 31 physical lines; exact source
    • safety: RTFairness (definition)
      • source line: “RTFairness(v) == \A r \in Real : WF_now((now’ > (r\div 0)) /\ RTNext(v))”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/SpecifyingSystems/RealTime/Memory.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant RealTime
    • artifact kind: support definitions or abstract interface
    • tool: TLA+
    • size: 6 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/SpecifyingSystems/RealTime/MemoryInterface.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant RealTime
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 23 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/SpecifyingSystems/RealTime/RTMemory.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant RealTime
    • artifact kind: support definitions or abstract interface
    • tool: TLA+
    • size: 16 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/SpecifyingSystems/RealTime/RTWriteThroughCache.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant RealTime
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 51 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/SpecifyingSystems/RealTime/WriteThroughCache.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant RealTime
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 93 physical lines; exact source
    • safety: TypeInvariant (definition); theorem (definition)
      • source line: “TypeInvariant == ”
        • next source line: “ /\ wmem \in [Adr -> Val]”
      • source line: “THEOREM Spec => [](TypeInvariant /\ Coherence)”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/SpecifyingSystems/TLC/ABCorrectness.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant TLC
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 40 physical lines; exact source
    • safety: ABCFairness (definition)
      • source line: “ABCFairness == WF_cvars(CRcvMsg) /\ WF_cvars(CRcvAck) ”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANT: TypeInv; configuration

  • tlaplus-Examples / specifications/SpecifyingSystems/TLC/AlternatingBit.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant TLC
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 78 physical lines; exact source
    • safety: ABFairness (definition); theorem (definition)
      • source line: “ABFairness == /\ WF_abvars(ReSndMsg) /\ WF_abvars(SndAck) ”
      • source line: “THEOREM ABSpec => []ABTypeInv”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/SpecifyingSystems/TLC/AlternatingBit_proof.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant TLC
    • artifact kind: proof module
    • tool: TLA+; TLAPS
    • size: 62 physical lines; exact source
    • safety: TypeCorrect (definition)
      • source line: “THEOREM TypeCorrect == ABSpec => []ABTypeInv”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: TLAPS proof target listed; manifest
      • source: "proof": {"maxRuntimeMinutes":1}

  • tlaplus-Examples / specifications/SpecifyingSystems/TLC/MCAlternatingBit.tla

    • specified: concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant TLC
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 22 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANT: ABTypeInv; PROPERTIES: ABCSpec SentLeadsToRcvd; configuration

  • tlaplus-Examples / specifications/TeachingConcurrency/Simple.tla

    • specified: shared-register concurrency/mutual exclusion
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+/PlusCal; TLAPS
    • size: 176 physical lines; exact source
    • safety: PCorrect (definition); TypeOK (definition); Inv (definition); Correctness (definition); Correctness2 (definition)
      • source line: “PCorrect == (\A i \in 0..(N-1) : pc[i] = “Done”) => ”
      • source line: “TypeOK == /\ x \in [0..(N-1) -> {0,1}]”
    • liveness: Termination (definition)
      • source line: “Termination == <>(\A self \in ProcSet: pc[self] = “Done”)”
    • evidence/status: TLAPS proof target listed; model checking exhaustive search; manifest
      • source: "proof": {"maxRuntimeMinutes":1}
      • source: "result": "success", "mode": "exhaustive search"; model configuration
    • configured checks: INVARIANTS: PCorrect TypeOK Inv; configuration

  • tlaplus-Examples / specifications/TeachingConcurrency/SimpleRegular.tla

    • specified: shared-register concurrency/mutual exclusion
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+/PlusCal; TLAPS
    • size: 198 physical lines; exact source
    • safety: PCorrect (definition); TypeOK (definition); Inv (definition); Correctness (definition); Correctness2 (definition)
      • source line: “PCorrect == (\A i \in 0..(N-1) : pc[i] = “Done”) => ”
      • source line: “TypeOK == /\ x \in [0..(N-1) -> (SUBSET {0, 1}) \ {{}}]”
    • liveness: Termination (definition)
      • source line: “Termination == <>(\A self \in ProcSet: pc[self] = “Done”)”
    • evidence/status: TLAPS proof target listed; model checking exhaustive search; manifest
      • source: "proof": {"maxRuntimeMinutes":1}
      • source: "result": "success", "mode": "exhaustive search"; model configuration
    • configured checks: INVARIANTS: PCorrect TypeOK Inv; configuration

  • tlaplus-Examples / specifications/TeachingConcurrency/SimpleRegular_proof.tla

    • specified: shared-register concurrency/mutual exclusion
    • artifact kind: proof module
    • tool: TLA+; TLAPS
    • size: 63 physical lines; exact source
    • safety: TypeCorrect (definition); InvInvariant (definition)
      • source line: “THEOREM TypeCorrect == Spec => []TypeOK”
      • source line: “THEOREM InvInvariant == Spec => []Inv”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: TLAPS proof target listed; manifest
      • source: "proof": {"maxRuntimeMinutes":1}

  • tlaplus-Examples / specifications/TeachingConcurrency/Simple_proof.tla

    • specified: shared-register concurrency/mutual exclusion
    • artifact kind: proof module
    • tool: TLA+; TLAPS
    • size: 25 physical lines; exact source
    • safety: TypeCorrect (definition); InvInvariant (definition)
      • source line: “THEOREM TypeCorrect == Spec => []TypeOK”
      • source line: “THEOREM InvInvariant == Spec => []Inv”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: TLAPS proof target listed; manifest
      • source: "proof": {"maxRuntimeMinutes":1}

  • tlaplus-Examples / specifications/TwoPhase/Alternate.tla

    • specified: two-phase handshake and abstract alternation
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 34 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/TwoPhase/MCTwoPhase.tla

    • specified: two-phase handshake and abstract alternation
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 7 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANT: Inv; configuration

  • tlaplus-Examples / specifications/TwoPhase/TwoPhase.tla

    • specified: two-phase handshake and abstract alternation
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+; TLAPS
    • size: 96 physical lines; exact source
    • safety: Inv (definition)
      • source line: “Inv == (p \in {0,1}) /\ (c \in {0,1})”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: TLAPS proof target listed; manifest
      • source: "proof": {"maxRuntimeMinutes":1}

  • tlaplus-Examples / specifications/TwoPhase/TwoPhase_proof.tla

    • specified: two-phase handshake and abstract alternation
    • artifact kind: proof module
    • tool: TLA+; TLAPS
    • size: 35 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: TLAPS proof target listed; manifest
      • source: "proof": {"maxRuntimeMinutes":1}

  • tlaplus-Examples / specifications/YoYo/MCYoYoNoPruning.tla

    • specified: Yo-Yo leader election
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 18 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANTS: TypeOK; INVARIANTS: NeighborInv; PROPERTIES: NoNewSource; PROPERTIES: Liveness; configuration

  • tlaplus-Examples / specifications/YoYo/MCYoYoPruning.tla

    • specified: Yo-Yo leader election
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 18 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANTS: TypeOK; INVARIANTS: NeighborInv; INVARIANTS: FinishIffTerminated; PROPERTIES: Liveness; configuration

  • tlaplus-Examples / specifications/YoYo/YoYoAllGraphs.tla

    • specified: Yo-Yo leader election
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 240 physical lines; exact source
    • safety: TypeOK (definition); Termination (definition)
      • source line: “TypeOK == ”
        • next source line: “ /\ active \in [Nodes -> BOOLEAN]”
      • source line: “Termination == \A n \in Nodes :”
    • liveness: Liveness (definition)
      • source line: “Liveness == <>Termination”
    • interpretation: Termination itself is a final-state predicate; Liveness == <>Termination is the eventual-election guarantee; disabledness alone is a state condition, not eventual progress
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANTS: TypeOK; INVARIANTS: NeighborInv; INVARIANTS: FinishIffTerminated; PROPERTIES: Liveness; configuration

  • tlaplus-Examples / specifications/YoYo/YoYoNoPruning.tla

    • specified: Yo-Yo leader election
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 251 physical lines; exact source
    • safety: TypeOK (definition)
      • source line: “TypeOK == ”
        • next source line: “ /\ phase \in [Nodes -> {“down”, “up”}]”
    • liveness: Liveness (definition)
      • source line: “Liveness == <>[]Stabilization”
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/YoYo/YoYoPruning.tla

    • specified: Yo-Yo leader election
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 266 physical lines; exact source
    • safety: TypeOK (definition); Termination (definition)
      • source line: “TypeOK == ”
        • next source line: “ /\ active \in [Nodes -> BOOLEAN]”
      • source line: “Termination == \A n \in Nodes :”
    • liveness: Liveness (definition)
      • source line: “Liveness == <>Termination”
    • interpretation: Termination itself is a final-state predicate; Liveness == <>Termination is the eventual-election guarantee; disabledness alone is a state condition, not eventual progress
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/aba-asyn-byz/aba_asyn_byz.tla

    • specified: asynchronous Byzantine agreement
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 160 physical lines; exact source
    • safety: TypeOK (definition)
      • source line: “TypeOK == ”
        • next source line: “ /\ pc \in [ Proc -> Location ] ”
    • liveness: Agreement_Ltl (definition)
      • source line: “Agreement_Ltl ==”
        • next source line: “ []((\E i \in Proc : pc[i] = “AC”) => <>(\A i \in Proc : pc[i] = “AC” / pc[i] = “BYZ” ))”
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANTS: TypeOK; PROPERTIES: Unforg_Ltl Corr_Ltl Agreement_Ltl; configuration

  • tlaplus-Examples / specifications/acp/ACP_NB.tla

    • specified: atomic commitment
    • artifact kind: support definitions or abstract interface
    • tool: TLA+
    • size: 177 physical lines; exact source
    • safety: fairnessNB (definition)
      • source line: “fairnessNB == /\ \A i \in participants : WF_<<coordinator, participant>>(\E j \in participants : parProgNB(i,j))”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/acp/ACP_NB_TLC.tla

    • specified: atomic commitment
    • artifact kind: support definitions or abstract interface
    • tool: TLA+
    • size: 18 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: PROPERTIES: AC1 AC2 AC3_1 AC4_alt; PROPERTIES: AC3_2 AC5; configuration

  • tlaplus-Examples / specifications/acp/ACP_NB_WRONG_TLC.tla

    • specified: atomic commitment
    • artifact kind: support definitions or abstract interface
    • tool: TLA+
    • size: 121 physical lines; exact source
    • safety: fairnessNB (definition)
      • source line: “fairnessNB == /\ \A i \in participants : WF_<<coordinator, participant>>(\E j \in participants : parProgNB(i,j))”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: PROPERTIES: AC1; configuration

  • tlaplus-Examples / specifications/acp/ACP_SB.tla

    • specified: atomic commitment
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 402 physical lines; exact source
    • safety: fairness (definition)
      • source line: “fairness == /\ \A i \in participants : WF_<<coordinator, participant>>(parProg(i))”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/acp/ACP_SB_TLC.tla

    • specified: atomic commitment
    • artifact kind: support definitions or abstract interface
    • tool: TLA+
    • size: 18 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest

  • tlaplus-Examples / specifications/acp/APACP_SB.tla

    • specified: atomic commitment
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 38 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking symbolic; manifest
    • configured checks: INVARIANTS: TypeInv; configuration

  • tlaplus-Examples / specifications/allocator/AllocatorImplementation.tla

    • specified: resource-allocation protocol
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 204 physical lines; exact source
    • safety: TypeInvariant (definition); Invariant (definition); ResourceMutex (definition); theorem (definition); theorem (definition); theorem (definition); theorem (definition)
      • source line: “TypeInvariant ==”
        • next source line: “ /\ Sched!TypeInvariant”
      • source line: “Invariant == ** a lower-level invariant”
    • liveness: InfOftenSatisfied (definition)
      • source line: “InfOftenSatisfied == ”
        • next source line: “ \A c \in Clients : []<>(requests[c] = {})”
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANTS: TypeInvariant ResourceMutex; INVARIANTS: Invariant; PROPERTIES: SchedAllocator; configuration

  • tlaplus-Examples / specifications/allocator/AllocatorImplementation_proof.tla

    • specified: resource-allocation protocol
    • artifact kind: proof module
    • tool: TLA+; TLAPS
    • size: 271 physical lines; exact source
    • safety: TypeCorrect (definition)
      • source line: “THEOREM TypeCorrect == Specification => []TypeInvariant”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: TLAPS proof target listed; manifest
      • incomplete-source warning: 2 OMITTED occurrences; proof targets alone do not establish completeness
      • source: "proof": {"maxRuntimeMinutes":2}

  • tlaplus-Examples / specifications/allocator/AllocatorRefinement.tla

    • specified: resource-allocation protocol
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 13 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: PROPERTIES: SimpleAllocator; configuration

  • tlaplus-Examples / specifications/allocator/SchedulingAllocator.tla

    • specified: resource-allocation protocol
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 177 physical lines; exact source
    • safety: TypeInvariant (definition); ResourceMutex (definition); AllocatorInvariant (definition); theorem (definition); theorem (definition); theorem (definition); theorem (definition)
      • source line: “TypeInvariant ==”
        • next source line: “ /\ unsat \in [Clients -> SUBSET Resources]”
      • source line: “ResourceMutex == ** resources are allocated exclusively”
    • liveness: InfOftenSatisfied (definition)
      • source line: “InfOftenSatisfied == ”
        • next source line: “ \A c \in Clients : []<>(unsat[c] = {})”
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANTS: TypeInvariant ResourceMutex; INVARIANTS: AllocatorInvariant; PROPERTIES: ClientsWillReturn InfOftenSatisfied ClientsWillObtain; configuration

  • tlaplus-Examples / specifications/allocator/SchedulingAllocator_proof.tla

    • specified: resource-allocation protocol
    • artifact kind: proof module
    • tool: TLA+; TLAPS
    • size: 342 physical lines; exact source
    • safety: TypeCorrect (definition); Inv (definition); Mutex (definition)
      • source line: “THEOREM TypeCorrect == Allocator => []TypeInvariant”
      • source line: “Inv == TypeInvariant /\ ResourceMutex”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: TLAPS proof target listed; manifest
      • source: "proof": {"maxRuntimeMinutes":2}

  • tlaplus-Examples / specifications/allocator/SimpleAllocator.tla

    • specified: resource-allocation protocol
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 118 physical lines; exact source
    • safety: TypeInvariant (definition); ResourceMutex (definition); theorem (definition); theorem (definition); theorem (definition)
      • source line: “TypeInvariant ==”
        • next source line: “ /\ unsat \in [Clients -> SUBSET Resources]”
      • source line: “ResourceMutex ==”
        • next source line: “ \A c1,c2 \in Clients : c1 # c2 => alloc[c1] \cap alloc[c2] = {}”
    • liveness: InfOftenSatisfied (definition)
      • source line: “InfOftenSatisfied == ”
        • next source line: “ \A c \in Clients : []<>(unsat[c] = {})”
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANTS: TypeInvariant ResourceMutex; PROPERTIES: ClientsWillReturn ClientsWillObtain InfOftenSatisfied; configuration

  • tlaplus-Examples / specifications/allocator/SimpleAllocator_proof.tla

    • specified: resource-allocation protocol
    • artifact kind: proof module
    • tool: TLA+; TLAPS
    • size: 122 physical lines; exact source
    • safety: TypeCorrect (definition); Inv (definition); Mutex (definition)
      • source line: “THEOREM TypeCorrect == SimpleAllocator => []TypeInvariant”
      • source line: “Inv == TypeInvariant /\ ResourceMutex”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: TLAPS proof target listed; manifest
      • source: "proof": {"maxRuntimeMinutes":1}

  • tlaplus-Examples / specifications/barriers/APBarrier.tla

    • specified: barrier synchronization
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 22 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking symbolic; manifest
    • configured checks: INVARIANT: TypeOK; configuration

  • tlaplus-Examples / specifications/barriers/Barrier.tla

    • specified: barrier synchronization
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 40 physical lines; exact source
    • safety: TypeOK (definition)
      • source line: “TypeOK ==”
        • next source line: “ /\ pc \in [ProcSet -> {“b0”, “b1”}]”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANT: TypeOK; configuration

  • tlaplus-Examples / specifications/barriers/Barriers.tla

    • specified: barrier synchronization
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+/PlusCal; TLAPS
    • size: 1,311 physical lines; exact source
    • safety: TypeOK (definition); Inv (definition); Invariant (definition); FlushInvariant (definition)
      • source line: “TypeOK ==”
        • next source line: “ /\ lock \in {0, 1}”
      • source line: “Inv == ”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: TLAPS proof target listed; model checking exhaustive search; manifest
      • source: "proof": {"maxRuntimeMinutes":10}
      • source: "result": "success", "mode": "exhaustive search"; model configuration
    • configured checks: INVARIANTS: TypeOK LockInv Inv FlushInv; configuration

  • tlaplus-Examples / specifications/bcastByz/bcastByz.tla

    • specified: Byzantine broadcast
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+; TLAPS
    • size: 1,146 physical lines; exact source
    • safety: ReceiveFromCorrectSender (definition); TypeOK (definition); FCConstraints_TypeOK_InitNoBcast (definition); FCConstraints_TypeOK_Init (definition); FCConstraints_TypeOK_IndInv_Unforg_NoBcast (definition); FCConstraints_TypeOK_IndInv_Unforg_NoBcast_TLC (definition); FCConstraints_TypeOK_Next (definition); FCConstraints_TypeOK_SpecNoBcast (definition); theorem (definition)
      • source line: “ReceiveFromCorrectSender(self) == Receive(self, FALSE)”
      • source line: “TypeOK == ”
        • next source line: “ /\ pc \in [ Proc -> {“V0”, “V1”, “SE”, “AC”} ] ”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: TLAPS proof target listed; model checking exhaustive search; manifest
      • source: "proof": {"maxRuntimeMinutes":5}
      • source: "result": "success", "mode": "exhaustive search"; model configuration
      • source: "result": "success", "mode": "exhaustive search"; model configuration
    • configured checks: INVARIANTS: TypeOK FCConstraints; PROPERTIES: CorrLtl RelayLtl UnforgLtl; configuration
    • configured checks: INVARIANTS: TypeOK FCConstraints Unforg; PROPERTIES: CorrLtl RelayLtl; configuration

  • tlaplus-Examples / specifications/bcastFolklore/APbcastFolklore.tla

    • specified: reliable broadcast
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 29 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking symbolic; manifest
    • configured checks: INVARIANT: TypeOK; configuration

  • tlaplus-Examples / specifications/bcastFolklore/bcastFolklore.tla

    • specified: reliable broadcast
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 152 physical lines; exact source
    • safety: TypeOK (definition)
      • source line: “TypeOK == ”
        • next source line: “ /\ sent \in SUBSET (Proc \times M)”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANTS: TypeOK; PROPERTIES: UnforgLtl CorrLtl RelayLtl ReliableChan; configuration

  • tlaplus-Examples / specifications/bosco/APbosco.tla

    • specified: Bosco Byzantine consensus
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 25 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking symbolic; manifest
    • configured checks: INVARIANT: TypeOK; INVARIANT: Lemma3_0; INVARIANT: Lemma3_1; INVARIANT: Lemma4_0; INVARIANT: Lemma4_1; configuration

  • tlaplus-Examples / specifications/bosco/bosco.tla

    • specified: Bosco Byzantine consensus
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 231 physical lines; exact source
    • safety: TypeOK (definition)
      • source line: “TypeOK == ”
        • next source line: “ /\ sent \subseteq P \times M”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANTS: TypeOK Lemma3_0 Lemma3_1 Lemma4_0 Lemma4_1; configuration

  • tlaplus-Examples / specifications/byihive/VoucherCancel.tla

    • specified: voucher transaction system
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 286 physical lines; exact source
    • safety: VTPTypeOK (definition); theorem (definition)
      • source line: “VTPTypeOK ==”
      • source line: “THEOREM VTPSpec => [](VTPTypeOK /\ VTPConsistent)”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANTS: VTPTypeOK VTPConsistent; configuration

  • tlaplus-Examples / specifications/byihive/VoucherIssue.tla

    • specified: voucher transaction system
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 287 physical lines; exact source
    • safety: VTPTypeOK (definition); theorem (definition)
      • source line: “VTPTypeOK ==”
      • source line: “THEOREM VTPSpec => [](VTPTypeOK /\ VTPConsistent)”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANTS: VTPTypeOK VTPConsistent; configuration

  • tlaplus-Examples / specifications/byihive/VoucherLifeCycle.tla

    • specified: voucher transaction system
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 107 physical lines; exact source
    • safety: VTypeOK (definition); theorem (definition)
      • source line: “VTypeOK ==”
      • source line: “THEOREM VSpec => [](VTypeOK /\ VConsistent)”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANTS: VTypeOK VConsistent; configuration

  • tlaplus-Examples / specifications/byihive/VoucherLifeCycle_proof.tla

    • specified: voucher transaction system
    • artifact kind: proof module
    • tool: TLA+; TLAPS
    • size: 19 physical lines; exact source
    • safety: Inv (definition); Spec_TypeOK_Consistent (definition)
      • source line: “Inv == VTypeOK /\ VConsistent”
      • source line: “THEOREM Spec_TypeOK_Consistent == VSpec => []Inv”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: TLAPS proof target listed; manifest
      • source: "proof": {"maxRuntimeMinutes":1}

  • tlaplus-Examples / specifications/byihive/VoucherRedeem.tla

    • specified: voucher transaction system
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 284 physical lines; exact source
    • safety: VTPTypeOK (definition); theorem (definition)
      • source line: “VTPTypeOK ==”
      • source line: “THEOREM VTPSpec => [](VTPTypeOK /\ VTPConsistent)”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANTS: VTPTypeOK VTPConsistent; configuration

  • tlaplus-Examples / specifications/byihive/VoucherTransfer.tla

    • specified: voucher transaction system
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 293 physical lines; exact source
    • safety: VTPTypeOK (definition); theorem (definition)
      • source line: “VTPTypeOK ==”
      • source line: “THEOREM VTPSpec => [](VTPTypeOK /\ VTPConsistent)”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANTS: VTPTypeOK VTPConsistent; configuration

  • tlaplus-Examples / specifications/byzpaxos/BPConProof.tla

    • specified: Byzantine Paxos refinement
    • artifact kind: proof module
    • tool: TLA+/PlusCal; TLAPS
    • size: 2,173 physical lines; exact source
    • safety: KnowsSafeAt (definition); KnowsSafeAt (definition); TypeOK (definition); Inv (definition); KnowsSafeAtDef (definition); theorem (definition)
      • source line: “ KnowsSafeAt(ac, b, v) ==”
      • source line: “KnowsSafeAt(ac, b, v) ==”
        • next source line: “ LET S == {m \in knowsSent[ac] : m.bal = b}”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: TLAPS proof target listed; model checking exhaustive search; manifest
      • source: "proof": {"maxRuntimeMinutes":45}
      • source: "result": "unknown", "mode": "exhaustive search"; model configuration
    • configured checks: INVARIANT: Inv; configuration

  • tlaplus-Examples / specifications/byzpaxos/Consensus.tla

    • specified: Byzantine Paxos refinement
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+/PlusCal; TLAPS
    • size: 209 physical lines; exact source
    • safety: TypeOK (definition); Inv (definition); theorem (definition)
      • source line: “TypeOK == /\ chosen \subseteq Value”
      • source line: “Inv == /\ TypeOK”
    • liveness: Success (definition); Liveness (definition); LiveSpecEquals (definition)
      • source line: “Success == <>(chosen # {})”
      • source line: “THEOREM Liveness == LiveSpec => Success”
    • evidence/status: TLAPS proof target listed; model checking exhaustive search; manifest
      • source: "proof": {"maxRuntimeMinutes":1}
      • source: "result": "success", "mode": "exhaustive search"; model configuration
    • configured checks: INVARIANTS: TypeOK Inv; configuration

  • tlaplus-Examples / specifications/byzpaxos/PConProof.tla

    • specified: Byzantine Paxos refinement
    • artifact kind: proof module
    • tool: TLA+/PlusCal; TLAPS
    • size: 612 physical lines; exact source
    • safety: ShowsSafeAt (definition); ShowsSafeAt (definition); TypeOK (definition); theorem (definition); theorem (definition); theorem (definition)
      • source line: “ ShowsSafeAt(Q, b, v) ==”
        • next source line: “ LET Q1b == {m \in sentMsgs(“1b”, b) : m.acc \in Q}”
      • source line: “ShowsSafeAt(Q, b, v) ==”
        • next source line: “ LET Q1b == {m \in sentMsgs(“1b”, b) : m.acc \in Q}”
    • liveness: Liveness (definition); CLiveness (definition)
      • source line: “THEOREM Liveness ==”
        • next source line: “ Spec => \A b \in Ballot, Q \in Quorum :”
      • source line: “CLiveness == (\A m \in msgs : (m.type = “1a”) => (m.bal < bb))~>(chosen # {})”
    • evidence/status: TLAPS proof target listed; model checking exhaustive search; manifest
      • source: "proof": {"maxRuntimeMinutes":1}
      • source: "result": "success", "mode": "exhaustive search"; model configuration
    • configured checks: INVARIANTS: TypeOK PAccInv P1bInv P1cInv P2aInv; configuration

  • tlaplus-Examples / specifications/byzpaxos/VoteProof.tla

    • specified: Byzantine Paxos refinement
    • artifact kind: proof module
    • tool: TLA+/PlusCal; TLAPS
    • size: 1,473 physical lines; exact source
    • safety: SafeAt (definition); SafeAt (definition); SafeAtProp (definition); TypeOK (definition); SafeLemma (definition); SafeAtPropPrime (definition); theorem (definition); theorem (definition); theorem (definition)
      • source line: “ SafeAt(b, v) ==”
        • next source line: “ LET SA[bb \in Ballot] ==”
      • source line: “SafeAt(b, v) ==”
        • next source line: “ LET SA[bb \in Ballot] ==”
    • liveness: Liveness (definition); LiveSpec (definition) (assumption-bearing liveness specification, not a safety property)
      • source line: “THEOREM Liveness == LiveSpec => C!LiveSpec”
    • evidence/status: TLAPS proof target listed; model checking exhaustive search; manifest
      • source: "proof": {"maxRuntimeMinutes":3}
      • source: "result": "success", "mode": "exhaustive search"; model configuration
    • configured checks: INVARIANTS: TypeOK VInv1 VInv2 VInv3 VInv4; PROPERTIES: Refines; configuration

  • tlaplus-Examples / specifications/c1cs/APc1cs.tla

    • specified: one-communication-step consensus
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 47 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking symbolic; manifest
    • configured checks: INVARIANT: TypeOK; INVARIANT: Validity; INVARIANT: Agreement; INVARIANT: WeakAgreement; configuration

  • tlaplus-Examples / specifications/c1cs/c1cs.tla

    • specified: one-communication-step consensus
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 193 physical lines; exact source
    • safety: TypeOK (definition); Validity (definition); Agreement (definition); WeakAgreement (definition)
      • source line: “TypeOK == ”
        • next source line: “ /\ v \in [ Proc -> Values ] ”
      • source line: “Validity == \A i \in Proc : ((dValue[i] # Bottom) => (\E j \in Proc : dValue[i] = v[j]))”
    • liveness: Termination (definition)
      • source line: “Termination == <>(\A i \in Proc : pc[i] = “CRASH” / pc[i] = “DONE” / pc[i] = “CALL”)”
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANTS: TypeOK Validity Agreement WeakAgreement IndStrengthens; PROPERTIES: Termination; configuration

  • tlaplus-Examples / specifications/cbc_max/cbc_max.tla

    • specified: condition-based consensus
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 179 physical lines; exact source
    • safety: decisions use an initial proposal (Validity); no two processes decide differently (Agreement); state values have intended types (TypeOK); definitions
      • source: “Agreement == \A i, j \in Proc: (dval[i] # Bottom /\ dval[j] # Bottom) => dval[i] = dval[j]”
    • liveness: Termination says every noncrashed process eventually reaches DONE; RealTermination requires Condition1, meaning more than F processes initially hold the maximum proposed value; conditional guarantee
      • source: “Termination == <>(\A i \in Proc: pc[i] = “CRASH” / pc[i] = “DONE”)”
      • source: “RealTermination == Condition1 => Termination ”
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/cf1s-folklore/APcf1s_folklore.tla

    • specified: one-step consensus
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 35 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/cf1s-folklore/cf1s_folklore.tla

    • specified: one-step consensus
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 157 physical lines; exact source
    • safety: TypeOK (definition)
      • source line: “TypeOK == ”
        • next source line: “ /\ pc \in [ Proc -> Status ] ”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANTS: TypeOK; PROPERTIES: OneStep0_Ltl OneStep1_Ltl; configuration

  • tlaplus-Examples / specifications/chang_roberts/APChangRoberts.tla

    • specified: Chang-Roberts ring leader election
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 31 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking symbolic; manifest
    • configured checks: INVARIANT: TypeOK; INVARIANT: Correctness; configuration

  • tlaplus-Examples / specifications/chang_roberts/ChangRoberts.tla

    • specified: Chang-Roberts ring leader election
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+/PlusCal
    • size: 143 physical lines; exact source
    • safety: TypeOK (definition); Correctness (definition)
      • source line: “TypeOK ==”
        • next source line: “ /\ pc \in [Node -> {“n0”, “n1”, “Done”}]”
      • source line: “Correctness ==”
        • next source line: “ \A n \in Node : state[n] = “won” =>”
    • liveness: Termination (definition); Liveness (definition)
      • source line: “Termination == <>(\A self \in ProcSet: pc[self] = “Done”)”
      • source line: “Liveness == (\E n \in Node : state[n] = “cand”) => <>(\E n \in Node : state[n] = “won”)”
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/chang_roberts/MCChangRoberts.tla

    • specified: Chang-Roberts ring leader election
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 9 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANTS: TypeOK Correctness; configuration

  • tlaplus-Examples / specifications/dag-consensus/BlockDag.tla

    • specified: DAG-based consensus
    • artifact kind: support definitions or abstract interface
    • tool: TLA+
    • size: 75 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/dag-consensus/BlockDagTest.tla

    • specified: DAG-based consensus
    • artifact kind: support definitions or abstract interface
    • tool: TLA+
    • size: 54 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest

  • tlaplus-Examples / specifications/dag-consensus/Digraph.tla

    • specified: DAG-based consensus
    • artifact kind: support definitions or abstract interface
    • tool: TLA+
    • size: 35 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/dag-consensus/Sailfish.tla

    • specified: DAG-based consensus
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+/PlusCal
    • size: 231 physical lines; exact source
    • safety: TypeOK is the type invariant; Agreement says correct nodes have compatible logs; correctNode is a protocol action, not a property; definitions
      • source: “Agreement == \A n1,n2 \in N \ F : Compatible(log[n1], log[n2])”
    • liveness-related condition: after GST, for a round whose leader is nonfaulty, each correct node that has reached two rounds later has committed that leader vertex; definition
      • source: “Liveness == \A r \in R : r >= GST /\ Leader(r) \notin F =>”
        • next line: “ \A n \in N \ F : round[n] >= r+2 =>”
      • limitation: this named Liveness formula is a state predicate checked as an invariant; it does not assert that nodes eventually advance two rounds or eventually reach GST
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/dag-consensus/TLCSailfish1.tla

    • specified: DAG-based consensus
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 69 physical lines; exact source
    • safety: instantiated TypeOK and compatible-log Agreement; both enabled as TLC invariants
    • liveness-related condition: imports Sailfish Liveness, conditional on round >= GST and a nonfaulty leader; nodes that reach two later rounds must have committed the leader vertex
      • checking scope: configured as a TLC invariant, not a temporal eventual-progress property; inherited definition
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANT: TypeOK; INVARIANT: Agreement; INVARIANT: Liveness; configuration

  • tlaplus-Examples / specifications/dag-consensus/TLCSailfish2.tla

    • specified: DAG-based consensus
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 46 physical lines; exact source
    • safety: instantiated TypeOK and compatible-log Agreement; both enabled as TLC invariants
    • liveness-related condition: imports Sailfish Liveness, conditional on round >= GST and a nonfaulty leader; nodes that reach two later rounds must have committed the leader vertex
      • checking scope: configured as a TLC invariant, not a temporal eventual-progress property; inherited definition
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANT: TypeOK; INVARIANT: Agreement; INVARIANT: Liveness; configuration

  • tlaplus-Examples / specifications/dag-consensus/Utils.tla

    • specified: DAG-based consensus
    • artifact kind: support definitions or abstract interface
    • tool: TLA+
    • size: 8 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/detector_chan96/Age_Channel.tla

    • specified: failure detection
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 64 physical lines; exact source
    • safety: Deliver (definition); TypeOK (definition)
      • source line: “Deliver(rcver) ==”
        • next source line: “ \E boxes \in SUBSET inTransit :”
      • source line: “TypeOK ==”
        • next source line: “ /\ inTransit \subseteq Boxes”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/detector_chan96/EPFailureDetector.tla

    • specified: failure detection
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 153 physical lines; exact source
    • safety: MakeAliveMsgsForAll (definition); SendAlive (definition); TypeOK (definition)
      • source line: “MakeAliveMsgsForAll(snder) == { [ from |-> snder, to |-> rcver, type |-> “alive” ] : ”
      • source line: “SendAlive(i) == ”
        • next source line: “ /\ localClock[i] % PredictPoint # 0”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/detector_chan96/EnvironmentController.tla

    • specified: failure detection
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 340 physical lines; exact source
    • safety: OnlyMessagesForCorrectProcesses (definition); TypeOK (definition)
      • source line: “OnlyMessagesForCorrectProcesses(msgs) == { m \in msgs : failed[m.to] = FALSE } ”
      • source line: “TypeOK ==”
        • next source line: “ /\ CommChan!TypeOK”
    • liveness: EventuallyStrongAccuracy (definition)
      • source line: “EventuallyStrongAccuracy == ”
        • next source line: “ <>[] ( \A i, j \in Proc : (failed[i] = FALSE /\ failed[j] = FALSE) ”
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANT: TypeOK; PROPERTIES: StrongCompleteness EventuallyStrongAccuracy; configuration

  • tlaplus-Examples / specifications/dijkstra-mutex/DijkstraMutex.tla

    • specified: Dijkstra mutual exclusion
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+/PlusCal
    • size: 336 physical lines; exact source
    • safety: MutualExclusion (definition)
      • source line: “MutualExclusion == \A i, j \in Proc : ”
    • liveness: DeadlockFree (definition); StarvationFree (definition); DeadlockFreedom (definition)
      • source line: “DeadlockFree == \A i \in Proc : ”
      • source line: “StarvationFree == \A i \in Proc : ”
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/dijkstra-mutex/DijkstraMutex.toolbox/LSpec-model/DijkstraMutex.tla

    • specified: Dijkstra mutual exclusion
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+/PlusCal
    • size: 330 physical lines; exact source
    • safety: MutualExclusion (definition)
      • source line: “MutualExclusion == \A i, j \in Proc : ”
    • liveness: DeadlockFree (definition); StarvationFree (definition); DeadlockFreedom (definition)
      • source line: “DeadlockFree == \A i \in Proc : ”
      • source line: “StarvationFree == \A i \in Proc : ”
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/dijkstra-mutex/DijkstraMutex.toolbox/LSpec-model/MC.tla

    • specified: Dijkstra mutual exclusion
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 28 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANT: inv_1293897152959430000; configuration

  • tlaplus-Examples / specifications/dijkstra-mutex/DijkstraMutex.toolbox/Safety-4-processors/DijkstraMutex.tla

    • specified: Dijkstra mutual exclusion
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+/PlusCal
    • size: 330 physical lines; exact source
    • safety: MutualExclusion (definition)
      • source line: “MutualExclusion == \A i, j \in Proc : ”
    • liveness: DeadlockFree (definition); StarvationFree (definition); DeadlockFreedom (definition)
      • source line: “DeadlockFree == \A i \in Proc : ”
      • source line: “StarvationFree == \A i \in Proc : ”
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/dijkstra-mutex/DijkstraMutex.toolbox/Safety-4-processors/MC.tla

    • specified: Dijkstra mutual exclusion
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 24 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANT: inv_1293897508027437000; configuration

  • tlaplus-Examples / specifications/diskpaxos/DiskSynod.tla

    • specified: Disk Paxos
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 132 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/diskpaxos/HDiskSynod.tla

    • specified: Disk Paxos
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 119 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/diskpaxos/MC_HDiskSynod.tla

    • specified: Disk Paxos
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 9 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANTS: HInv1 HInv2 HInv3 HInv4 HInv6; configuration

  • tlaplus-Examples / specifications/diskpaxos/Synod.tla

    • specified: Disk Paxos
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 53 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/echo/Echo.tla

    • specified: distributed echo/termination detection
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+/PlusCal
    • size: 200 physical lines; exact source
    • safety: TypeOK (definition)
      • source line: “TypeOK ==”
        • next source line: “ /\ parent \in [Node -> (Node \cup {NoNode})]”
    • liveness: Termination (definition)
      • source line: “Termination == <>(\A self \in ProcSet: pc[self] = “Done”)”
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/echo/MCEcho.tla

    • specified: distributed echo/termination detection
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 36 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANT: TypeOK; INVARIANT: AncestorProperties; configuration

  • tlaplus-Examples / specifications/echo/Relation.tla

    • specified: distributed echo/termination detection
    • artifact kind: support definitions or abstract interface
    • tool: TLA+
    • size: 63 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/ewd426/APTokenRing.tla

    • specified: Dijkstra self-stabilization
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 22 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking symbolic; manifest
    • configured checks: INVARIANT: TypeOK; configuration

  • tlaplus-Examples / specifications/ewd426/SimTokenRing.tla

    • specified: Dijkstra self-stabilization
    • artifact kind: support definitions or abstract interface
    • tool: TLA+
    • size: 31 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking generate; manifest
    • configured checks: INVARIANT: TypeOK; configuration

  • tlaplus-Examples / specifications/ewd426/TokenRing.tla

    • specified: Dijkstra self-stabilization
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 63 physical lines; exact source
    • safety: TypeOK (definition)
      • source line: “TypeOK ==”
        • next source line: “ /\ c \in [ Node -> 0 .. M-1 ]”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANT: TypeOK; PROPERTIES: Stab; configuration

  • tlaplus-Examples / specifications/ewd687a/EWD687a.tla

    • specified: Dijkstra-Scholten termination detection
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 471 physical lines; exact source
    • safety: TypeOK (definition); theorem (definition); theorem (definition); theorem (definition)
      • source line: “TypeOK == /\ active \in [Procs -> BOOLEAN]”
      • source line: “THEOREM Spec => []CountersConsistent”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/ewd687a/EWD687aPlusCal.tla

    • specified: Dijkstra-Scholten termination detection
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+/PlusCal
    • size: 185 physical lines; exact source
    • safety: TypeOK (definition); TerminationDetection (definition)
      • source line: “TypeOK ==”
        • next source line: “ /\ terminationDetected \in BOOLEAN”
      • source line: “TerminationDetection == terminationDetected => Quiescence”
    • liveness: Liveness (definition)
      • source line: “Liveness == Quiescence ~> terminationDetected”
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/ewd687a/EWD687a_anim.tla

    • specified: Dijkstra-Scholten termination detection
    • artifact kind: support definitions or abstract interface
    • tool: TLA+
    • size: 199 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking {‘simulate’: {‘traceCount’: 100}}; manifest
      • source: "result": "safety failure", "mode": "{'simulate': {'traceCount': 100}}"; model configuration
    • configured checks: INVARIANT: TypeOK; INVARIANT: DT1Inv; INVARIANT: InterestingBehavior; configuration

  • tlaplus-Examples / specifications/ewd687a/EWD687a_proof.tla

    • specified: Dijkstra-Scholten termination detection
    • artifact kind: proof module
    • tool: TLA+; TLAPS
    • size: 399 physical lines; exact source
    • safety: Inv1 (definition); Invariant1 (definition); TypeCorrect (definition); TreeInvariant (definition); Safety (definition)
      • source line: “Inv1 == TypeOK /\ CountersConsistent”
      • source line: “THEOREM Invariant1 == Spec => []Inv1 ”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: TLAPS proof target listed; manifest
      • source: "proof": {"maxRuntimeMinutes":3}

  • tlaplus-Examples / specifications/ewd687a/MCEWD687a.tla

    • specified: Dijkstra-Scholten termination detection
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 20 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANTS: TypeOK; INVARIANTS: CountersConsistent; INVARIANTS: TreeWithRoot; INVARIANTS: DT1Inv; configuration

  • tlaplus-Examples / specifications/ewd840/APEWD840.tla

    • specified: Dijkstra ring termination detection
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 23 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking symbolic; manifest
    • configured checks: INVARIANT: TypeOK; INVARIANT: TerminationDetection; configuration

  • tlaplus-Examples / specifications/ewd840/APSyncTerminationDetection.tla

    • specified: Dijkstra ring termination detection
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 20 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking symbolic; manifest
    • configured checks: INVARIANT: TypeOK; INVARIANT: TDCorrect; configuration

  • tlaplus-Examples / specifications/ewd840/EWD840.tla

    • specified: Dijkstra ring termination detection
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 176 physical lines; exact source
    • safety: TypeOK (definition); terminationDetected (definition); TerminationDetection (definition); Inv (definition)
      • source line: “TypeOK ==”
        • next source line: “ /\ active \in [Node -> BOOLEAN] * status of nodes (active or passive)”
      • source line: “terminationDetected ==”
        • next source line: “ /\ tpos = 0 /\ tcolor = “white””
    • liveness: Liveness (definition); FalseLiveness (definition)
      • source line: “Liveness == terminated ~> terminationDetected”
      • source line: “FalseLiveness ==”
        • next source line: “ (\A i \in Node : []<> ~ active[i]) ~> terminationDetected”
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANTS: TypeOK; INVARIANTS: TerminationDetection; INVARIANTS: Inv; PROPERTIES: Liveness; PROPERTIES: TDSpec; configuration

  • tlaplus-Examples / specifications/ewd840/EWD840_anim.tla

    • specified: Dijkstra ring termination detection
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 209 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking {‘simulate’: {‘traceCount’: 100}}; manifest
      • source: "result": "safety failure", "mode": "{'simulate': {'traceCount': 100}}"; model configuration
    • configured checks: INVARIANT: AnimInv; configuration

  • tlaplus-Examples / specifications/ewd840/EWD840_json.tla

    • specified: Dijkstra ring termination detection
    • artifact kind: support definitions or abstract interface
    • tool: TLA+
    • size: 29 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANT: JsonInv; configuration

  • tlaplus-Examples / specifications/ewd840/EWD840_proof.tla

    • specified: Dijkstra ring termination detection
    • artifact kind: proof module
    • tool: TLA+; TLAPS
    • size: 316 physical lines; exact source
    • safety: TypeCorrect (definition); Invariant (definition); Safety (definition)
      • source line: “LEMMA TypeCorrect == Spec => []TypeOK”
      • source line: “THEOREM Invariant == Spec => []Inv”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: TLAPS proof target listed; manifest
      • source: "proof": {"maxRuntimeMinutes":1}

  • tlaplus-Examples / specifications/ewd840/SyncTerminationDetection.tla

    • specified: Dijkstra ring termination detection
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 66 physical lines; exact source
    • safety: TypeOK (definition); DetectTermination (definition); TDCorrect (definition)
      • source line: “TypeOK ==”
        • next source line: “ /\ active \in [Node -> BOOLEAN]”
      • source line: “DetectTermination ==”
        • next source line: “ /\ terminated”
    • liveness: Liveness (definition)
      • source line: “Liveness == terminated ~> terminationDetected”
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANTS: TypeOK; INVARIANTS: TDCorrect; PROPERTIES: Quiescence; PROPERTIES: Liveness; configuration

  • tlaplus-Examples / specifications/ewd840/SyncTerminationDetection_proof.tla

    • specified: Dijkstra ring termination detection
    • artifact kind: proof module
    • tool: TLA+; TLAPS
    • size: 57 physical lines; exact source
    • safety: TypeCorrect (definition); CorrectDetection (definition)
      • source line: “THEOREM TypeCorrect == Spec => []TypeOK”
      • source line: “THEOREM CorrectDetection == Spec => TDCorrect”
    • liveness: Live (definition)
      • source line: “THEOREM Live == Spec => Liveness”
    • evidence/status: TLAPS proof target listed; manifest
      • source: "proof": {"maxRuntimeMinutes":1}

  • tlaplus-Examples / specifications/ewd998/AsyncTerminationDetection.tla

    • specified: Safra/Dijkstra ring termination detection
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 123 physical lines; exact source
    • safety: TypeOK (definition); DetectTermination (definition); Safe (definition); StableActionInvariant (definition)
      • source line: “TypeOK ==”
        • next source line: “ /\ active \in [Node -> BOOLEAN]”
      • source line: “DetectTermination ==”
        • next source line: “ /\ terminated”
    • liveness: Live (definition)
      • source line: “Live == terminated ~> terminationDetected”
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANTS: TypeOK; INVARIANTS: Safe; PROPERTIES: Quiescence; PROPERTIES: Live; configuration

  • tlaplus-Examples / specifications/ewd998/AsyncTerminationDetection_proof.tla

    • specified: Safra/Dijkstra ring termination detection
    • artifact kind: proof module
    • tool: TLA+; TLAPS
    • size: 59 physical lines; exact source
    • safety: TypeCorrect (definition); Safety (definition)
      • source line: “LEMMA TypeCorrect == Init /\ [][Next]_vars => []TypeOK”
      • source line: “THEOREM Safety == Init /\ [][Next]_vars => []Safe”
    • liveness: Liveness (definition)
      • source line: “THEOREM Liveness == Spec => Live”
    • evidence/status: TLAPS proof target listed; manifest
      • source: "proof": {"maxRuntimeMinutes":1}

  • tlaplus-Examples / specifications/ewd998/EWD998.tla

    • specified: Safra/Dijkstra ring termination detection
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 216 physical lines; exact source
    • safety: TypeOK (definition); terminationDetected (definition); Termination (definition); TerminationDetection (definition); Inv (definition)
      • source line: “TypeOK ==”
        • next source line: “ /\ active \in [Node -> BOOLEAN]”
      • source line: “terminationDetected ==”
        • next source line: “ /\ token.pos = 0”
    • liveness: Liveness (definition)
      • source line: “Liveness ==”
        • next source line: “ Termination ~> terminationDetected”
    • interpretation: termination/detection identifiers in the safety field are state predicates; the separately stated leads-to formula supplies eventual detection
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANT: TerminationDetection; INVARIANT: Inv; INVARIANT: TypeOK; PROPERTIES: Liveness; PROPERTIES: TDSpec; configuration
    • configured checks: INVARIANT: TerminationDetection; INVARIANT: Inv; INVARIANT: TypeOK; configuration

  • tlaplus-Examples / specifications/ewd998/EWD998Chan.tla

    • specified: Safra/Dijkstra ring termination detection
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 194 physical lines; exact source
    • safety: TypeOK (definition)
      • source line: “TypeOK ==”
        • next source line: “ /\ counter \in [Node -> Int]”
    • liveness: the EWD998Spec refinement target includes eventual detection under its fairness assumptions; no separate local liveness alias defined; refinement; abstract progress
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANT: TypeOK; PROPERTIES: EWD998Spec; configuration

  • tlaplus-Examples / specifications/ewd998/EWD998ChanID.tla

    • specified: Safra/Dijkstra ring termination detection
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 274 physical lines; exact source
    • safety: EWD998Safe imports the termination-detector safety property: reported termination is correct; terminationDetected is a state predicate, not itself a progress guarantee; alias
      • source: “EWD998Safe == EWD998Chan!EWD998!TD!Safe”
    • liveness: EWD998Live imports eventual detection after actual termination; the combined theorem states safety and liveness; alias
      • source: “EWD998Live == EWD998Chan!EWD998!TD!Live”
      • source: “THEOREM Spec => EWD998Safe /\ EWD998Live”
      • underlying source: “Live == terminated ~> terminationDetected”; definition
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANT: EWD998Safe; INVARIANT: Max3TokenRounds; PROPERTIES: EWD998ChanSpec; PROPERTIES: EWD998Live; configuration

  • tlaplus-Examples / specifications/ewd998/EWD998ChanID_export.tla

    • specified: Safra/Dijkstra ring termination detection
    • artifact kind: support definitions or abstract interface
    • tool: TLA+
    • size: 58 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: inherits EWD998Live, eventual detection after actual termination, from EWD998ChanID; this trace-export instance does not list that liveness check in its own configuration; alias
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANT: PostInv; configuration

  • tlaplus-Examples / specifications/ewd998/EWD998ChanID_shiviz.tla

    • specified: Safra/Dijkstra ring termination detection
    • artifact kind: support definitions or abstract interface
    • tool: TLA+
    • size: 83 physical lines; exact source
    • safety: Inv (definition)
      • source line: “Inv ==”
    • liveness: inherits EWD998Live, eventual detection after actual termination, from EWD998ChanID; this trace-export instance does not list that liveness check in its own configuration; alias
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANT: Inv; configuration

  • tlaplus-Examples / specifications/ewd998/EWD998ChanTrace.tla

    • specified: Safra/Dijkstra ring termination detection
    • artifact kind: support definitions or abstract interface
    • tool: TLA+
    • size: 318 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest

  • tlaplus-Examples / specifications/ewd998/EWD998Chan_opts.tla

    • specified: Safra/Dijkstra ring termination detection
    • artifact kind: support definitions or abstract interface
    • tool: TLA+
    • size: 138 physical lines; exact source
    • safety: AtTermination (definition); AtTerminationDetected (definition)
      • source line: “AtTermination ==”
        • next source line: “ IF EWD998!Termination # EWD998!Termination’”
      • source line: “AtTerminationDetected ==”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/ewd998/EWD998PCal.tla

    • specified: Safra/Dijkstra ring termination detection
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+/PlusCal
    • size: 170 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: PROPERTIES: EWD998Spec; configuration

  • tlaplus-Examples / specifications/ewd998/EWD998PCal_proof.tla

    • specified: Safra/Dijkstra ring termination detection
    • artifact kind: proof module
    • tool: TLA+; TLAPS
    • size: 1,443 physical lines; exact source
    • safety: PCalTypeOK (definition); InitTypeOK (definition); TypeOK_Step (definition); TypeCorrect (definition)
      • source line: “PCalTypeOK ==”
        • next source line: “ /\ active \in [Node -> BOOLEAN]”
      • source line: “LEMMA InitTypeOK == Init => PCalTypeOK”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: TLAPS proof target listed; manifest
      • incomplete-source warning: 3 OMITTED occurrences; proof targets alone do not establish completeness
      • source: "proof": {"maxRuntimeMinutes":10}

  • tlaplus-Examples / specifications/ewd998/EWD998_anim.tla

    • specified: Safra/Dijkstra ring termination detection
    • artifact kind: support definitions or abstract interface
    • tool: TLA+
    • size: 541 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/ewd998/EWD998_opts.tla

    • specified: Safra/Dijkstra ring termination detection
    • artifact kind: support definitions or abstract interface
    • tool: TLA+
    • size: 156 physical lines; exact source
    • safety: AtTermination (definition); AtTerminationDetected (definition)
      • source line: “AtTermination ==”
      • source line: “AtTerminationDetected ==”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/ewd998/EWD998_optsSC.tla

    • specified: Safra/Dijkstra ring termination detection
    • artifact kind: support definitions or abstract interface
    • tool: TLA+
    • size: 59 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/ewd998/EWD998_proof.tla

    • specified: Safra/Dijkstra ring termination detection
    • artifact kind: proof module
    • tool: TLA+; TLAPS
    • size: 882 physical lines; exact source
    • safety: TypeCorrect (definition); Safety (definition); TerminationDetectionInv (definition); theorem (definition)
      • source line: “THEOREM TypeCorrect == Init /\ [][Next]_vars => []TypeOK”
      • source line: “THEOREM Safety ==”
        • next source line: “ /\ TypeOK /\ Inv /\ terminationDetected => Termination”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: TLAPS proof target listed; manifest
      • source: "proof": {"maxRuntimeMinutes":6}

  • tlaplus-Examples / specifications/ewd998/Folds.tla

    • specified: Safra/Dijkstra ring termination detection
    • artifact kind: support definitions or abstract interface
    • tool: TLA+
    • size: 30 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/ewd998/SmokeEWD998.tla

    • specified: Safra/Dijkstra ring termination detection
    • artifact kind: support definitions or abstract interface
    • tool: TLA+
    • size: 46 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking {‘simulate’: {‘traceCount’: 100}}; manifest
    • configured checks: INVARIANT: Inv; configuration

  • tlaplus-Examples / specifications/ewd998/SmokeEWD998_SC.tla

    • specified: Safra/Dijkstra ring termination detection
    • artifact kind: support definitions or abstract interface
    • tool: TLA+
    • size: 35 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest

  • tlaplus-Examples / specifications/ewd998/Utils.tla

    • specified: Safra/Dijkstra ring termination detection
    • artifact kind: support definitions or abstract interface
    • tool: TLA+
    • size: 16 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/lamport_mutex/APLamportMutex.tla

    • specified: Lamport distributed mutual exclusion
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 27 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking symbolic; manifest
    • configured checks: INVARIANT: Mutex; configuration

  • tlaplus-Examples / specifications/lamport_mutex/LamportMutex.tla

    • specified: Lamport distributed mutual exclusion
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 184 physical lines; exact source
    • safety: TypeOK (definition); Mutex (definition)
      • source line: “TypeOK ==”
      • source line: “Mutex == \A p,q \in crit : p = q”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/lamport_mutex/LamportMutex_proofs.tla

    • specified: Lamport distributed mutual exclusion
    • artifact kind: proof module
    • tool: TLA+; TLAPS
    • size: 943 physical lines; exact source
    • safety: TypeCorrect (definition); BasicInvariant (definition); ClockInvariant (definition); Safety (definition); theorem (definition)
      • source line: “LEMMA TypeCorrect == Spec => []TypeOK”
      • source line: “THEOREM BasicInvariant == Spec => []BasicInv”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: TLAPS proof target listed; manifest
      • source: "proof": {"maxRuntimeMinutes":5}

  • tlaplus-Examples / specifications/lamport_mutex/MCLamportMutex.tla

    • specified: Lamport distributed mutual exclusion
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 7 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANTS: TypeOK BoundedNetwork Mutex; configuration

  • tlaplus-Examples / specifications/locks_auxiliary_vars/Lock.tla

    • specified: lock refinement with auxiliary variables
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+/PlusCal; TLAPS
    • size: 119 physical lines; exact source
    • safety: TypeOK (definition); MutualExclusion (definition)
      • source line: “TypeOK ==”
        • next source line: “ /\ lock \in {0, 1}”
      • source line: “THEOREM MutualExclusion == Spec => []LockInv”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: TLAPS proof target listed; model checking exhaustive search; manifest
      • source: "proof": {"maxRuntimeMinutes":1}
      • source: "result": "success", "mode": "exhaustive search"; model configuration
    • configured checks: INVARIANTS: TypeOK LockInv; configuration

  • tlaplus-Examples / specifications/locks_auxiliary_vars/LockHS.tla

    • specified: lock refinement with auxiliary variables
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+; TLAPS
    • size: 403 physical lines; exact source
    • safety: TypeOKHS (definition); MutualExclusionHS (definition)
      • source line: “TypeOKHS == ”
        • next source line: “ /\ TypeOK”
      • source line: “LEMMA MutualExclusionHS == SpecHS => []LockInv”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: TLAPS proof target listed; model checking exhaustive search; manifest
      • source: "proof": {"maxRuntimeMinutes":2}
      • source: "result": "success", "mode": "exhaustive search"; model configuration
    • configured checks: INVARIANTS: TypeOKHS InvHS LockInv; PROPERTIES: Spec PSpec; configuration

  • tlaplus-Examples / specifications/locks_auxiliary_vars/Peterson.tla

    • specified: lock refinement with auxiliary variables
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+/PlusCal; TLAPS
    • size: 191 physical lines; exact source
    • safety: TypeOK (definition); Inv (definition); IndInvariant (definition)
      • source line: “TypeOK ==”
        • next source line: “ /\ c \in [ProcSet -> BOOLEAN]”
      • source line: “Inv ==”
        • next source line: “ /\ \A p \in ProcSet : c[p] <=> pc[p] \in {“a2”, “a3”, “cs”, “a4”}”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: TLAPS proof target listed; model checking exhaustive search; manifest
      • source: "proof": {"maxRuntimeMinutes":1}
      • source: "result": "success", "mode": "exhaustive search"; model configuration
    • configured checks: INVARIANTS: TypeOK Inv; configuration

  • tlaplus-Examples / specifications/locks_auxiliary_vars/Stuttering.tla

    • specified: lock refinement with auxiliary variables
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 192 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/nbacc_ray97/nbacc_ray97.tla

    • specified: nonblocking atomic commitment
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 135 physical lines; exact source
    • safety: TypeOK (definition); Validity (definition)
      • source line: “TypeOK == ”
        • next source line: “ /\ sent \subseteq Proc \times M”
      • source line: “Validity == ”
        • next source line: “ / \A i \in Proc : pc[i] = “YES””
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANT: TypeOK; configuration

  • tlaplus-Examples / specifications/nbacg_guer01/APnbacg_guer01.tla

    • specified: nonblocking atomic commitment
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 31 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking symbolic; manifest
    • configured checks: INVARIANT: TypeOK; configuration

  • tlaplus-Examples / specifications/nbacg_guer01/nbacg_guer01.tla

    • specified: nonblocking atomic commitment
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 213 physical lines; exact source
    • safety: TypeOK (definition); AbortValidityLtl (definition); CommitValidityLtl (definition)
      • source line: “TypeOK == ”
        • next source line: “ /\ nSntNo \in 0..N”
      • source line: “AbortValidityLtl ==”
        • next source line: “ (\E i \in Proc : pc[i] = “NO”) => [](\A i \in Proc : pc[i] # “COMMIT”)”
    • liveness: TerminationLtl (definition)
      • source line: “TerminationLtl ==”
        • next source line: “ ([](\A i \in Proc : pc[i] # “BYZ” /\ someFail[i] = FALSE)) => <>(\A i \in Proc : pc[i] = “COMMIT” / pc[i] = “ABORT”) ”
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANT: TypeOK; PROPERTIES: AgrrLtl AbortValidityLtl CommitValidityLtl TerminationLtl; configuration

  • tlaplus-Examples / specifications/spanning/APspanning.tla

    • specified: distributed spanning-tree construction
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 35 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking symbolic; manifest
    • configured checks: INVARIANT: TypeOK; configuration

  • tlaplus-Examples / specifications/spanning/MC_spanning.tla

    • specified: distributed spanning-tree construction
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 4 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANTS: TypeOK SntMsg; configuration

  • tlaplus-Examples / specifications/spanning/spanning.tla

    • specified: distributed spanning-tree construction
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 48 physical lines; exact source
    • safety: TypeOK (definition)
      • source line: “TypeOK == /\ \A i \in Proc : prnt[i] = NoPrnt / <<i, prnt[i]>> \in nbrs ”
    • liveness: Termination (definition)
      • source line: “Termination == <>(\A i \in Proc : i = root / (prnt[i] # NoPrnt /\ <<i, prnt[i]>> \in nbrs)) ”
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/spanning/spanning_proof.tla

    • specified: distributed spanning-tree construction
    • artifact kind: proof module
    • tool: TLA+; TLAPS
    • size: 157 physical lines; exact source
    • safety: Inv (definition); theorem (definition)
      • source line: “Inv == PrntDomain /\ SntMsg /\ SentMeansCanSend”
      • source line: “THEOREM SntMsgInv == Spec => []SntMsg”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: TLAPS proof target listed; manifest
      • source: "proof": {"maxRuntimeMinutes":1}

  • tlaplus-Examples / specifications/tcp/APtcp.tla

    • specified: TCP connection/protocol model
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 24 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking symbolic; manifest
    • configured checks: INVARIANT: Inv; configuration

  • tlaplus-Examples / specifications/tcp/IndInv_apa.tla

    • specified: TCP connection/protocol model
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 220 physical lines; exact source
    • safety: TypeOKBounded (definition)
      • source line: “TypeOKBounded ==”
        • next source line: “ /\ tcb \in [Peers -> BOOLEAN]”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/tcp/MCtcp.tla

    • specified: TCP connection/protocol model
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 32 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANT: TypeOK; INVARIANT: Inv; configuration

  • tlaplus-Examples / specifications/tcp/tcp.tla

    • specified: TCP connection/protocol model
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 330 physical lines; exact source
    • safety: TypeOK (definition); Inv (definition)
      • source line: “TypeOK ==”
        • next source line: “ /\ tcb \in [ Peers -> BOOLEAN ]”
      • source line: “Inv ==”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification/support module; no proof target or model result attached to this module in manifest; manifest

  • tlaplus-Examples / specifications/tcp/tcp_proof.tla

    • specified: TCP connection/protocol model
    • artifact kind: proof module
    • tool: TLA+; TLAPS
    • size: 5,661 physical lines; exact source
    • safety: PrefixOneNonEmpty (definition); PrefixTwoNonEmpty (definition); TypeOKInductive (definition); TypeCorrect (definition); theorem (definition); theorem (definition)
      • source line: “LEMMA PrefixOneNonEmpty ==”
        • next source line: “ ASSUME NEW T, NEW e \in T, NEW s \in Seq(T), IsPrefix(<>, s)”
      • source line: “LEMMA PrefixTwoNonEmpty ==”
        • next source line: “ ASSUME NEW T, NEW e1 \in T, NEW e2 \in T, NEW s \in Seq(T),”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: TLAPS proof target listed; manifest
      • source: "proof": {"maxRuntimeMinutes":60}

  • tlaplus-Examples / specifications/transaction_commit/2PCwithBTM.tla

    • specified: transaction commit: abstract commit, two-phase and Paxos commit
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+/PlusCal
    • size: 199 physical lines; exact source
    • safety: TypeOK (definition); Consistency (definition)
      • source line: “TypeOK == ”
      • source line: “Consistency == ”
    • liveness: Termination (definition)
      • source line: “Termination == <>(\A self \in ProcSet: pc[self] = “Done”)”
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANTS: TypeOK Consistency; configuration

  • tlaplus-Examples / specifications/transaction_commit/APTCommit.tla

    • specified: transaction commit: abstract commit, two-phase and Paxos commit
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 18 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking symbolic; manifest
    • configured checks: INVARIANT: TCTypeOK; INVARIANT: TCConsistent; configuration

  • tlaplus-Examples / specifications/transaction_commit/PaxosCommit.tla

    • specified: transaction commit: abstract commit, two-phase and Paxos commit
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 281 physical lines; exact source
    • safety: PCTypeOK (definition); theorem (definition)
      • source line: “PCTypeOK == ”
      • source line: “THEOREM PCSpec => PCTypeOK”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANT: PCTypeOK; configuration

  • tlaplus-Examples / specifications/transaction_commit/PaxosCommit_proof.tla

    • specified: transaction commit: abstract commit, two-phase and Paxos commit
    • artifact kind: proof module
    • tool: TLA+; TLAPS
    • size: 529 physical lines; exact source
    • safety: Inv (definition); TypeOK_Invariant (definition); TypeOK_Init (definition)
      • source line: “Inv == PCTypeOK /\ AccInv /\ MsgInv1b /\ IsFiniteSet(msgs)”
      • source line: “THEOREM TypeOK_Invariant == PCSpec => []PCTypeOK”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: TLAPS proof target listed; manifest
      • source: "proof": {"maxRuntimeMinutes":5}

  • tlaplus-Examples / specifications/transaction_commit/TCommit.tla

    • specified: transaction commit: abstract commit, two-phase and Paxos commit
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 66 physical lines; exact source
    • safety: TCTypeOK (definition); theorem (definition)
      • source line: “TCTypeOK == ”
      • source line: “THEOREM TCSpec => [](TCTypeOK /\ TCConsistent)”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANTS: TCTypeOK TCConsistent; configuration

  • tlaplus-Examples / specifications/transaction_commit/TCommit_proof.tla

    • specified: transaction commit: abstract commit, two-phase and Paxos commit
    • artifact kind: proof module
    • tool: TLA+; TLAPS
    • size: 31 physical lines; exact source
    • safety: Inv (definition); TCorrect (definition)
      • source line: “Inv == TCTypeOK /\ TCConsistent”
      • source line: “THEOREM TCorrect == TCSpec => []Inv”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: TLAPS proof target listed; manifest
      • source: "proof": {"maxRuntimeMinutes":1}

  • tlaplus-Examples / specifications/transaction_commit/TwoPhase.tla

    • specified: transaction commit: abstract commit, two-phase and Paxos commit
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 176 physical lines; exact source
    • safety: TPTypeOK (definition); theorem (definition)
      • source line: “TPTypeOK == ”
      • source line: “THEOREM TPSpec => []TPTypeOK”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: model checking exhaustive search; manifest
    • configured checks: INVARIANT: TPTypeOK; configuration

  • tlaplus-Examples / specifications/transaction_commit/TwoPhase_proof.tla

    • specified: transaction commit: abstract commit, two-phase and Paxos commit
    • artifact kind: proof module
    • tool: TLA+; TLAPS
    • size: 154 physical lines; exact source
    • safety: TypeCorrect (definition); Inv (definition); Consistency (definition)
      • source line: “THEOREM TypeCorrect == TPSpec => []TPTypeOK”
      • source line: “Inv ==”
        • next source line: “ /\ TPTypeOK”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: TLAPS proof target listed; manifest
      • source: "proof": {"maxRuntimeMinutes":1}

  • tlaplus-tlapm / examples/Allocator.tla

    • specified: resource allocation
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+; TLAPS
    • size: 297 physical lines; exact source
    • safety: TypeInvariant (definition); Mutex (definition); InitTypeInvariant (definition); RequestTypeInvariant (definition); AllocateTypeInvariant (definition); ReturnTypeInvariant (definition); NextTypeInvariant (definition); TypeOK (definition); InitMutex (definition); RequestMutexBis (definition); ReturnMutex (definition); AllocateMutex (definition); NextMutex (definition); MutualExclusion (definition); theorem (definition)
      • source line: “TypeInvariant ==”
        • next source line: “ /\ unsat \in [Client -> SUBSET Resource]”
      • source line: “Mutex ==”
        • next source line: “ \A c1,c2 \in Client : \A r \in Resource :”
    • liveness: InfOftenSatisfied (definition)
      • source line: “InfOftenSatisfied ==”
        • next source line: “ \A c \in Client : []<>(unsat[c] = {})”
    • evidence/status: proof-language content present; completion and successful machine checking not independently established

  • tlaplus-tlapm / examples/AtomicBakery.tla

    • specified: Bakery mutual exclusion variant
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+/PlusCal; TLAPS
    • size: 279 physical lines; exact source
    • safety: MutualExclusion (definition); TypeOK (definition); Inv (definition); theorem (definition); theorem (definition)
      • source line: “MutualExclusion == \A i,j \in P : (i # j) => ~ /\ pc[i] = “cs””
      • source line: “TypeOK == /\ num \in [P -> Nat]”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: proof-language content present; completion and successful machine checking not independently established

  • tlaplus-tlapm / examples/AtomicBakeryWithoutSMT.tla

    • specified: Bakery mutual exclusion variant
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+/PlusCal; TLAPS
    • size: 651 physical lines; exact source
    • safety: MutualExclusion (definition); TypeOK (definition); Inv (definition); InitImpliesTypeOK (definition); TypeOKInvariant (definition); InductiveInvariant (definition); Safety (definition); theorem (definition)
      • source line: “MutualExclusion == \A i,j \in P : (i # j) => ~ /\ pc[i] = “p7””
      • source line: “TypeOK == /\ num \in [P -> Nat]”
    • liveness: Termination (definition)
      • source line: “Termination == <>(\A self \in P: pc[self] = “Done”)”
    • evidence/status: proof-language content present; completion and successful machine checking not independently established

  • tlaplus-tlapm / examples/Bakery.tla

    • specified: Bakery mutual exclusion variant
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+/PlusCal; TLAPS
    • size: 383 physical lines; exact source
    • safety: MutualExclusion (definition); TypeOK (definition); Inv (definition); theorem (definition)
      • source line: “MutualExclusion == \A i,j \in P : (i # j) => ~ /\ pc[i] = “cs””
      • source line: “TypeOK == /\ num \in [P -> Nat]”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: proof-language content present; completion and successful machine checking not independently established

  • tlaplus-tlapm / examples/ByzPaxos/BPConProof.tla

    • specified: Byzantine/Paxos consensus refinement and voting proof
    • artifact kind: proof module
    • tool: TLA+/PlusCal; TLAPS
    • size: 2,191 physical lines; exact source
    • safety: KnowsSafeAt (definition); KnowsSafeAt (definition); TypeOK (definition); Inv (definition); KnowsSafeAtDef (definition); theorem (definition)
      • source line: “ KnowsSafeAt(ac, b, v) ==”
      • source line: “KnowsSafeAt(ac, b, v) ==”
        • next source line: “ LET S == {m \in knowsSent[ac] : m.bal = b}”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: proof-language content present; completion and successful machine checking not independently established

  • tlaplus-tlapm / examples/ByzPaxos/Consensus.tla

    • specified: Byzantine/Paxos consensus refinement and voting proof
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+/PlusCal; TLAPS
    • size: 246 physical lines; exact source
    • safety: TypeOK (definition); Inv (definition); theorem (definition); theorem (definition)
      • source line: “TypeOK == /\ chosen \subseteq Value”
      • source line: “Inv == /\ TypeOK”
    • liveness: Success (definition); LiveSpecEquals (definition)
      • source line: “Success == <>(chosen # {})”
      • source line: “THEOREM LiveSpecEquals ==”
        • next source line: “ LiveSpec <=> Spec /\ ([]<><>_vars / []<>(chosen # {}))”
    • evidence/status: proof-language content present; completion and successful machine checking not independently established

  • tlaplus-tlapm / examples/ByzPaxos/PConProof.tla

    • specified: Byzantine/Paxos consensus refinement and voting proof
    • artifact kind: proof module
    • tool: TLA+/PlusCal; TLAPS
    • size: 612 physical lines; exact source
    • safety: ShowsSafeAt (definition); ShowsSafeAt (definition); TypeOK (definition); theorem (definition); theorem (definition); theorem (definition)
      • source line: “ ShowsSafeAt(Q, b, v) ==”
        • next source line: “ LET Q1b == {m \in sentMsgs(“1b”, b) : m.acc \in Q}”
      • source line: “ShowsSafeAt(Q, b, v) ==”
        • next source line: “ LET Q1b == {m \in sentMsgs(“1b”, b) : m.acc \in Q}”
    • liveness: Liveness (definition); CLiveness (definition)
      • source line: “THEOREM Liveness ==”
        • next source line: “ Spec => \A b \in Ballot, Q \in Quorum :”
      • source line: “CLiveness == (\A m \in msgs : (m.type = “1a”) => (m.bal < bb))~>(chosen # {})”
    • evidence/status: proof-language content present; completion and successful machine checking not independently established

  • tlaplus-tlapm / examples/ByzPaxos/VoteProof.tla

    • specified: Byzantine/Paxos consensus refinement and voting proof
    • artifact kind: proof module
    • tool: TLA+/PlusCal; TLAPS
    • size: 1,494 physical lines; exact source
    • safety: SafeAt (definition); SafeAt (definition); SafeAtProp (definition); TypeOK (definition); SafeLemma (definition); SafeAtPropPrime (definition); theorem (definition); theorem (definition); theorem (definition)
      • source line: “ SafeAt(b, v) ==”
        • next source line: “ LET SA[bb \in Ballot] ==”
      • source line: “SafeAt(b, v) ==”
        • next source line: “ LET SA[bb \in Ballot] ==”
    • liveness: EventuallyAlwaysForall (definition); Liveness (definition); LiveSpec (definition) (assumption-bearing liveness specification, not a safety property)
      • source line: “LEMMA EventuallyAlwaysForall ==”
        • next source line: “ ASSUME NEW CONSTANT S, IsFiniteSet(S),”
      • source line: “THEOREM Liveness == LiveSpec => C!LiveSpec”
    • evidence/status: proof-language content present; 6 OMITTED occurrences; incomplete proof steps present; completion and successful machine checking not independently established

  • tlaplus-tlapm / examples/Dekker/Dekker.tla

    • specified: Dekker two-process mutex with starvation freedom
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+; TLAPS
    • size: 978 physical lines; exact source
    • safety: Inv (definition); MutualExclusion (definition); Enabledness (definition); NotStuck (definition)
      • source line: “Inv == pc1 # 6 / pc2 # 6”
      • source line: “THEOREM MutualExclusion ==”
        • next source line: “ Sys => []Inv”
    • liveness: StFr1 (definition); StFr2 (definition); StarvationFreedom (definition)
      • source line: “StFr1 == (pc1 = 2) ~> (pc1 = 6)”
      • source line: “StFr2 == (pc2 = 2) ~> (pc2 = 6)”
    • evidence/status: proof-language content present; 2 OMITTED occurrences; incomplete proof steps present; completion and successful machine checking not independently established

  • tlaplus-tlapm / examples/EWD840.tla

    • specified: ring termination detection
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+; TLAPS
    • size: 199 physical lines; exact source
    • safety: TypeOK (definition); terminationDetected (definition); TerminationDetection (definition); Inv (definition); TypeOK_inv (definition); Inv_implies_Termination (definition); theorem (definition)
      • source line: “TypeOK ==”
        • next source line: “ /\ active \in [Nodes -> BOOLEAN] * status of nodes (active or passive)”
      • source line: “terminationDetected ==”
        • next source line: “ /\ tpos = 0 /\ tcolor = “white””
    • liveness: Liveness (definition)
      • source line: “Liveness ==”
        • next source line: “ (\A i \in Nodes : ~ active[i]) ~> terminationDetected”
    • evidence/status: proof-language content present; completion and successful machine checking not independently established

  • tlaplus-tlapm / examples/Peterson.tla

    • specified: Peterson two-process mutex
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+/PlusCal; TLAPS
    • size: 199 physical lines; exact source
    • safety: MutualExclusion (definition); TypeOK (definition); Inv (definition); theorem (definition); theorem (definition)
      • source line: “MutualExclusion == ~(pc[0] = “cs” /\ pc[1] = “cs”)”
      • source line: “TypeOK == /\ pc \in [{0,1} -> {“a0”, “a1”, “a2”, “a3a”, “a3b”, “cs”, “a4”}]”
    • liveness: Liveness1 (definition); Liveness (definition)
      • source line: “Liveness1 == []<>CS(0)”
      • source line: “Liveness == (Wait(0) ~> CS(0)) /\ (Wait(1) ~> CS(1))”
    • evidence/status: proof-language content present; completion and successful machine checking not independently established

  • tlaplus-tlapm / examples/SimpleEventually.tla

    • specified: small temporal-progress proof example
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+; TLAPS
    • size: 73 physical lines; exact source
    • safety: TypeOK (definition); TypeCorrect (definition)
      • source line: “TypeOK ==”
        • next source line: “ /\ x \in BOOLEAN”
      • source line: “LEMMA TypeCorrect == System => []TypeOK”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: proof-language content present; completion and successful machine checking not independently established

  • tlaplus-tlapm / examples/SimpleEventuallyInt.tla

    • specified: small temporal-progress proof example
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+; TLAPS
    • size: 77 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: proof-language content present; completion and successful machine checking not independently established

  • tlaplus-tlapm / examples/SimpleMutex.tla

    • specified: mutual exclusion
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+/PlusCal; TLAPS
    • size: 180 physical lines; exact source
    • safety: TypeOK (definition); Inv (definition); MutualExclusion (definition); Mutex (definition); Safety (definition); theorem (definition); theorem (definition); theorem (definition); theorem (definition)
      • source line: “TypeOK ==”
        • next source line: “ /\ trying \in [{0,1} -> BOOLEAN]”
      • source line: “Inv == \A i \in {0,1} :”
    • liveness: Termination (definition)
      • source line: “Termination == <>(\A self \in ProcSet: pc[self] = “Done”)”
    • evidence/status: proof-language content present; completion and successful machine checking not independently established

  • tlaplus-tlapm / examples/paxos/Consensus.tla

    • specified: Paxos consensus safety/refinement
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 22 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification or model-checking instance; no TLAPS proof-language content found in this file

  • tlaplus-tlapm / examples/paxos/Paxos.tla

    • specified: Paxos consensus safety/refinement
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+; TLAPS
    • size: 530 physical lines; exact source
    • safety: Consistency (definition); TypeOK (definition); SafeAt (definition); Inv (definition); SafeAtStable (definition); Invariant (definition); theorem (definition)
      • source line: “Consistency == \A v1, v2 \in Values : Chosen(v1) /\ Chosen(v2) => (v1 = v2)”
      • source line: “TypeOK == /\ msgs \in SUBSET Messages”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: proof-language content present; completion and successful machine checking not independently established

  • tlaplus-tlapm / examples/two_phase/Alternate.tla

    • specified: two-phase handshake/abstract alternation
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 34 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification or model-checking instance; no TLAPS proof-language content found in this file

  • tlaplus-tlapm / examples/two_phase/TwoPhase.tla

    • specified: two-phase handshake/abstract alternation
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+; TLAPS
    • size: 128 physical lines; exact source
    • safety: Inv (definition)
      • source line: “Inv == (p \in {0,1}) /\ (c \in {0,1})”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: proof-language content present; completion and successful machine checking not independently established

  • ongardie-raft.tla / raft.tla

    • specified: Raft leader election, log replication, restart and lossy/duplicating network
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 471 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification or model-checking instance; no TLAPS proof-language content found in this file

  • pingcap-tla-plus / CollapseRollbacks/CollapseRollbacks.tla

    • specified: TiDB/TiKV CollapseRollbacks protocol
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 507 physical lines; exact source
    • safety: TypeInvariant (definition); WriteConsistency (definition); LockConsistency (definition); CommittedConsistency (definition); AbortedConsistency (definition); RollbackConsistency (definition); Safety (definition)
      • source line: “TypeInvariant ==”
        • next source line: “ /\ NextTsTypeInv”
      • source line: “WriteConsistency ==”
        • next source line: “ /\ \A k \in KEY :”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification or model-checking instance; no TLAPS proof-language content found in this file

  • pingcap-tla-plus / CollapseRollbacks/Test1.tla

    • specified: TiDB/TiKV CollapseRollbacks protocol model-checking instance
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 16 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification or model-checking instance; no TLAPS proof-language content found in this file
    • configured checks: INVARIANT: TypeInvariant; INVARIANT: WriteConsistency; INVARIANT: LockConsistency; INVARIANT: CommittedConsistency; INVARIANT: AbortedConsistency; INVARIANT: RollbackConsistency; INVARIANT: UniqueWrite; INVARIANT: SnapshotIsolation; configuration

  • pingcap-tla-plus / CollapseRollbacks/Test2.tla

    • specified: TiDB/TiKV CollapseRollbacks protocol model-checking instance
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 14 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification or model-checking instance; no TLAPS proof-language content found in this file
    • configured checks: INVARIANT: TypeInvariant; INVARIANT: WriteConsistency; INVARIANT: LockConsistency; INVARIANT: CommittedConsistency; INVARIANT: AbortedConsistency; INVARIANT: RollbackConsistency; INVARIANT: UniqueWrite; INVARIANT: SnapshotIsolation; configuration

  • pingcap-tla-plus / ConcurrentPercolator/ConcurrentPercolator.tla

    • specified: TiDB/TiKV ConcurrentPercolator protocol
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 455 physical lines; exact source
    • safety: TypeInvariant (definition); WriteConsistency (definition); LockConsistency (definition); CommittedConsistency (definition); AbortedConsistency (definition); RollbackConsistency (definition); Safety (definition)
      • source line: “TypeInvariant ==”
        • next source line: “ /\ NextTsTypeInv”
      • source line: “WriteConsistency ==”
        • next source line: “ /\ \A k \in KEY :”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification or model-checking instance; no TLAPS proof-language content found in this file

  • pingcap-tla-plus / ConcurrentPercolator/Test1.tla

    • specified: TiDB/TiKV ConcurrentPercolator protocol model-checking instance
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 16 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification or model-checking instance; no TLAPS proof-language content found in this file
    • configured checks: INVARIANT: TypeInvariant; INVARIANT: WriteConsistency; INVARIANT: LockConsistency; INVARIANT: CommittedConsistency; INVARIANT: AbortedConsistency; INVARIANT: RollbackConsistency; INVARIANT: UniqueWrite; INVARIANT: SnapshotIsolation; configuration

  • pingcap-tla-plus / ConcurrentPercolator/Test2.tla

    • specified: TiDB/TiKV ConcurrentPercolator protocol model-checking instance
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 14 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification or model-checking instance; no TLAPS proof-language content found in this file
    • configured checks: INVARIANT: TypeInvariant; INVARIANT: WriteConsistency; INVARIANT: LockConsistency; INVARIANT: CommittedConsistency; INVARIANT: AbortedConsistency; INVARIANT: RollbackConsistency; INVARIANT: UniqueWrite; INVARIANT: SnapshotIsolation; configuration

  • pingcap-tla-plus / DistributedTransaction/DistributedTransaction.tla

    • specified: TiDB/TiKV DistributedTransaction protocol
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 891 physical lines; exact source
    • safety: TypeOK (definition); CommitConsistency (definition); AbortConsistency (definition); WriteConsistency (definition); MsgTsConsistency (definition); Safety (definition)
      • source line: “TypeOK == /\ req_msgs \in SUBSET ReqMessages”
      • source line: “CommitConsistency ==”
        • next source line: “ \A resp \in resp_msgs :”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification or model-checking instance; no TLAPS proof-language content found in this file

  • pingcap-tla-plus / DistributedTransaction/Test1.tla

    • specified: TiDB/TiKV DistributedTransaction protocol model-checking instance
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 13 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification or model-checking instance; no TLAPS proof-language content found in this file
    • configured checks: INVARIANT: TypeOK; INVARIANT: UniqueCommitOrAbort; INVARIANT: CommitConsistency; INVARIANT: AbortConsistency; INVARIANT: WriteConsistency; INVARIANT: UniqueLockOrWrite; INVARIANT: UniqueWrite; INVARIANT: OptimisticReadSnapshotIsolation; INVARIANT: PessimisticReadSnapshotIsolation; INVARIANT: MsgTsConsistency; configuration

  • pingcap-tla-plus / DistributedTransaction/Test2.tla

    • specified: TiDB/TiKV DistributedTransaction protocol model-checking instance
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 13 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification or model-checking instance; no TLAPS proof-language content found in this file
    • configured checks: INVARIANT: TypeOK; INVARIANT: UniqueCommitOrAbort; INVARIANT: CommitConsistency; INVARIANT: AbortConsistency; INVARIANT: WriteConsistency; INVARIANT: UniqueLockOrWrite; INVARIANT: UniqueWrite; INVARIANT: OptimisticReadSnapshotIsolation; INVARIANT: PessimisticReadSnapshotIsolation; INVARIANT: MsgTsConsistency; configuration

  • pingcap-tla-plus / DistributedTransaction/Test3.tla

    • specified: TiDB/TiKV DistributedTransaction protocol model-checking instance
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 13 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification or model-checking instance; no TLAPS proof-language content found in this file
    • configured checks: INVARIANT: TypeOK; INVARIANT: UniqueCommitOrAbort; INVARIANT: CommitConsistency; INVARIANT: AbortConsistency; INVARIANT: WriteConsistency; INVARIANT: UniqueLockOrWrite; INVARIANT: UniqueWrite; INVARIANT: OptimisticReadSnapshotIsolation; INVARIANT: PessimisticReadSnapshotIsolation; INVARIANT: MsgTsConsistency; configuration

  • pingcap-tla-plus / DistributedTransaction/Test4.tla

    • specified: TiDB/TiKV DistributedTransaction protocol model-checking instance
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 13 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification or model-checking instance; no TLAPS proof-language content found in this file
    • configured checks: INVARIANT: TypeOK; INVARIANT: UniqueCommitOrAbort; INVARIANT: CommitConsistency; INVARIANT: AbortConsistency; INVARIANT: WriteConsistency; INVARIANT: UniqueLockOrWrite; INVARIANT: UniqueWrite; INVARIANT: OptimisticReadSnapshotIsolation; INVARIANT: PessimisticReadSnapshotIsolation; INVARIANT: MsgTsConsistency; configuration

  • pingcap-tla-plus / DistributedTransaction/Test5.tla

    • specified: TiDB/TiKV DistributedTransaction protocol model-checking instance
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 13 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification or model-checking instance; no TLAPS proof-language content found in this file
    • configured checks: INVARIANT: TypeOK; INVARIANT: UniqueCommitOrAbort; INVARIANT: CommitConsistency; INVARIANT: AbortConsistency; INVARIANT: WriteConsistency; INVARIANT: UniqueLockOrWrite; INVARIANT: UniqueWrite; INVARIANT: OptimisticReadSnapshotIsolation; INVARIANT: PessimisticReadSnapshotIsolation; INVARIANT: MsgTsConsistency; configuration

  • pingcap-tla-plus / OptimizedCommitTS/OptimizedCommitTS.tla

    • specified: TiDB/TiKV OptimizedCommitTS protocol
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 459 physical lines; exact source
    • safety: TypeInvariant (definition); WriteConsistency (definition); LockConsistency (definition); CommittedConsistency (definition); AbortedConsistency (definition); RollbackConsistency (definition); Safety (definition)
      • source line: “TypeInvariant ==”
        • next source line: “ /\ NextTsTypeInv”
      • source line: “WriteConsistency ==”
        • next source line: “ /\ \A k \in KEY :”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification or model-checking instance; no TLAPS proof-language content found in this file

  • pingcap-tla-plus / OptimizedCommitTS/Test1.tla

    • specified: TiDB/TiKV OptimizedCommitTS protocol model-checking instance
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 16 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification or model-checking instance; no TLAPS proof-language content found in this file
    • configured checks: INVARIANT: TypeInvariant; INVARIANT: WriteConsistency; INVARIANT: LockConsistency; INVARIANT: CommittedConsistency; INVARIANT: AbortedConsistency; INVARIANT: RollbackConsistency; INVARIANT: UniqueWrite; INVARIANT: SnapshotIsolation; configuration

  • pingcap-tla-plus / OptimizedCommitTS/Test2.tla

    • specified: TiDB/TiKV OptimizedCommitTS protocol model-checking instance
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 14 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification or model-checking instance; no TLAPS proof-language content found in this file
    • configured checks: INVARIANT: TypeInvariant; INVARIANT: WriteConsistency; INVARIANT: LockConsistency; INVARIANT: CommittedConsistency; INVARIANT: AbortedConsistency; INVARIANT: RollbackConsistency; INVARIANT: UniqueWrite; INVARIANT: SnapshotIsolation; configuration

  • pingcap-tla-plus / Percolator/Percolator.tla

    • specified: TiDB/TiKV Percolator protocol
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 415 physical lines; exact source
    • safety: TypeInvariant (definition); WriteConsistency (definition); LockConsistency (definition); CommittedConsistency (definition); AbortedConsistency (definition); Safety (definition)
      • source line: “TypeInvariant ==”
        • next source line: “ /\ NextTsTypeInv”
      • source line: “WriteConsistency ==”
        • next source line: “ /\ \A k \in KEY :”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification or model-checking instance; no TLAPS proof-language content found in this file

  • pingcap-tla-plus / Percolator/Test1.tla

    • specified: TiDB/TiKV Percolator protocol model-checking instance
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 16 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification or model-checking instance; no TLAPS proof-language content found in this file
    • configured checks: INVARIANT: TypeInvariant; INVARIANT: WriteConsistency; INVARIANT: LockConsistency; INVARIANT: CommittedConsistency; INVARIANT: AbortedConsistency; INVARIANT: SnapshotIsolation; configuration

  • pingcap-tla-plus / Percolator/Test2.tla

    • specified: TiDB/TiKV Percolator protocol model-checking instance
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 14 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification or model-checking instance; no TLAPS proof-language content found in this file
    • configured checks: INVARIANT: TypeInvariant; INVARIANT: WriteConsistency; INVARIANT: LockConsistency; INVARIANT: CommittedConsistency; INVARIANT: AbortedConsistency; INVARIANT: SnapshotIsolation; configuration

  • pingcap-tla-plus / Raft/Raft.tla

    • specified: TiDB/TiKV Raft protocol
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 469 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification or model-checking instance; no TLAPS proof-language content found in this file

  • pingcap-tla-plus / RaftMerge/RaftMerge.tla

    • specified: TiDB/TiKV RaftMerge protocol
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 538 physical lines; exact source
    • safety: TypeInvariant (definition); OneLeaderInvariant (definition); AppendEntriesMessageInvariant (definition); LogInvariant (definition); ApplyIndexInvariant (definition); SimpliedRaftInvariant (definition); RegionApplyInvariant (definition); MergeLogInvariant (definition); RaftMergeInvariant (definition)
      • source line: “TypeInvariant ==”
        • next source line: “ /\ raft \in [Store -> [Region -> RaftType]]”
      • source line: “OneLeaderInvariant ==”
        • next source line: “ \A r \in Region : Cardinality({s \in Store : raft[s][r].is_leader}) = 1”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification or model-checking instance; no TLAPS proof-language content found in this file

  • pingcap-tla-plus / ResolvedTS/MC.tla

    • specified: TiDB/TiKV ResolvedTS protocol model-checking instance
    • artifact kind: model-checking instance
    • tool: TLA+
    • size: 20 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification or model-checking instance; no TLAPS proof-language content found in this file
    • configured checks: INVARIANT: RTTypeOK; INVARIANT: CommitConsistency; INVARIANT: ResolvedConsistency; configuration

  • pingcap-tla-plus / ResolvedTS/ResolvedTS.tla

    • specified: TiDB/TiKV ResolvedTS protocol
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 240 physical lines; exact source
    • safety: RTTypeOK (definition); CommitConsistency (definition); ResolvedConsistency (definition); Safety (definition)
      • source line: “RTTypeOK ==”
        • next source line: “ /\ rmState \in [RM -> [state: {“prewrited”, “committed”},”
      • source line: “CommitConsistency ==”
        • next source line: “ \A rm \in RM:”
    • liveness: ResolveLiveness (definition)
      • source line: “ResolveLiveness ==”
        • next source line: “ (/\ \A rm \in RM: /\ reState[rm].minPTS = 0”
    • evidence/status: specification or model-checking instance; no TLAPS proof-language content found in this file

  • pingcap-tla-plus / TwoPC/TLAPS/TwoPC.tla

    • specified: TiDB/TiKV TwoPC protocol
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 178 physical lines; exact source
    • safety: RMStateTypeInvariant (definition); TMStateTypeInvariant (definition); TMPreparedTypeInvariant (definition); MsgsTypeInvariant (definition); TypeInvariant (definition); Consistency (definition); Invariant (definition); InvariantImpliesConsistency (definition); InitStateSatisfiesInvariant (definition); StateStepKeepsInvariant (definition); Safety (definition)
      • source line: “RMStateTypeInvariant ==”
        • next source line: “ /\ rmState \in [RM -> RMState]”
      • source line: “TMStateTypeInvariant ==”
        • next source line: “ /\ tmState \in TMState”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification or model-checking instance; no TLAPS proof-language content found in this file

  • Azure-azure-cosmos-tla / general-model/cosmos_client.tla

    • specified: Cosmos DB consistency with multiple clients/regions
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+/PlusCal
    • size: 384 physical lines; exact source
    • safety: TypeOK (definition); Monotonic (definition); MonotonicReadPerRegion (definition); MonotonicReadPerClient (definition); MonotonicWritePerRegion (definition); ReadYourWrite (definition); ReadAfterWrite (definition); Linearizability (definition); BoundedStaleness (definition); ConsistentPrefix (definition); Strong (definition); Session (definition); Eventual (definition); Invariant (definition)
      • source line: “TypeOK == {History[i] : i \in DOMAIN History} \subseteq Operations”
      • source line: “Monotonic(h) == \A i, j \in DOMAIN h : i <= j => h[i].data <= h[j].data”
    • liveness: Liveness (definition)
      • source line: “Liveness == <>[] (\A i, j \in Regions : Database[i] = Database[j])”
    • evidence/status: specification or model-checking instance; no TLAPS proof-language content found in this file

  • Azure-azure-cosmos-tla / scenario1/swscop.tla

    • specified: Cosmos DB single-client counter writes
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+/PlusCal
    • size: 212 physical lines; exact source
    • safety: Eventual (definition); Consistent_Prefix (definition); Session (definition); Bounded_Staleness (definition); Strong (definition)
      • source line: “Eventual== chistory[1][Len(chistory[1])] \in {Database[Cloud][i]:i \in 1..Len(Database[Cloud])}”
      • source line: “Consistent_Prefix == chistory[1][Len(chistory[1])] \in {Database[Cloud][i]:i \in 1..Len(Database[Cloud])}”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification or model-checking instance; no TLAPS proof-language content found in this file

  • Azure-azure-cosmos-tla / scenario2/swscrw.tla

    • specified: Cosmos DB single-client read/increment/write
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+/PlusCal
    • size: 215 physical lines; exact source
    • safety: Eventual (definition); Consistent_Prefix (definition); Session (definition); Bounded_Staleness (definition); Strong (definition)
      • source line: “Eventual== chistory[1][Len(chistory[1])] \in {Database[Cloud][i]:i \in 1..Len(Database[Cloud])}”
      • source line: “Consistent_Prefix == chistory[1][Len(chistory[1])] \in {Database[Cloud][i]:i \in 1..Len(Database[Cloud])}”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification or model-checking instance; no TLAPS proof-language content found in this file

  • elastic-elasticsearch-formal-models / ReplicaEngine/tla/ReplicaEngine.tla

    • specified: concurrent replica-engine request processing
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+/PlusCal
    • size: 972 physical lines; exact source
    • safety: SafeAccessEnablerLoop (definition); SafeAccessEnablerProcess (definition); UnsafePutterLoop (definition); UnsafePutterProcess (definition); MaxUnsafeAutoIdTimestampIncreaserLoop (definition); MaxUnsafeAutoIdTimestampIncreaserProcess (definition); LocalCheckpointTrackerLoop (definition); LocalCheckpointTrackerProcess (definition); UnsafeSeqnoIncreaserProcessLoop (definition); UnsafeSeqnoIncreaserProcess (definition); Invariant (definition)
      • source line: “SafeAccessEnablerLoop == /\ pc[“SafeAccessEnabler”] = “SafeAccessEnablerLoop””
      • source line: “SafeAccessEnablerProcess == SafeAccessEnablerLoop”
    • liveness: Termination (definition)
      • source line: “Termination == <>(\A self \in ProcSet: pc[self] = “Done”)”
    • evidence/status: specification or model-checking instance; no TLAPS proof-language content found in this file
    • TLC enabled invariant checks: Invariant; enabled temporal-property checks: Invariant; Toolbox model

  • elastic-elasticsearch-formal-models / Storage/tla/Storage.tla

    • specified: metadata/manifest storage update protocol
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 179 physical lines; exact source
    • safety: no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification or model-checking instance; no TLAPS proof-language content found in this file
    • TLC enabled invariant checks: MetadataFileReferencedByManifestExists, MetadataReferencedByManifestIsValid; enabled temporal-property checks: none; Toolbox model

  • elastic-elasticsearch-formal-models / ZenWithTerms/tla/ZenWithTerms.tla

    • specified: Elasticsearch cluster coordination with terms/reconfiguration
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 370 physical lines; exact source
    • safety: SingleNodeInvariant (definition); OneMasterPerTerm (definition); LogMatching (definition); P2bInvariant (definition)
      • source line: “SingleNodeInvariant ==”
        • next source line: “ \A n \in Nodes :”
      • source line: “OneMasterPerTerm ==”
        • next source line: “ \A m1, m2 \in messages:”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification or model-checking instance; no TLAPS proof-language content found in this file
    • TLC enabled invariant checks: OneMasterPerTerm, LogMatching, SingleNodeInvariant, CommittedValuesDescendantsFromCommittedValues, CommittedValuesDescendantsFromInitialValue, DescendantRelationIsStrictlyOrdered, NewerOpsBasedOnOlderCommittedOps, CommitHasQuorumVsPreviousCommittedConfiguration, P2bInvariant, DescendantRelationIsTransitive; enabled temporal-property checks: none; Toolbox model

  • elastic-elasticsearch-formal-models / cluster/tla/consensus.tla

    • specified: alternative Elasticsearch cluster consensus
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 329 physical lines; exact source
    • safety: StateMachineSafety (definition); OneMasterPerTerm (definition); LogMatching (definition); SingleNodeInvariant (definition); LogMatchingMessages (definition); SafeCatchupMessages (definition)
      • source line: “StateMachineSafety ==”
        • next source line: “ \A n1, n2 \in Nodes :”
      • source line: “OneMasterPerTerm ==”
        • next source line: “ \A n1, n2 \in Nodes :”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification or model-checking instance; no TLAPS proof-language content found in this file
    • TLC enabled invariant checks: StateMachineSafety, OneMasterPerTerm, LogMatching, SingleNodeInvariant, LogMatchingMessages, SafeCatchupMessages; enabled temporal-property checks: none; Toolbox model

  • elastic-elasticsearch-formal-models / data/tla/replication.tla

    • specified: Elasticsearch sequence-number data replication
    • artifact kind: specification/proof variant; separate artifact, not automatically a distinct problem
    • tool: TLA+
    • size: 860 physical lines; exact source
    • safety: newLocalCheckPoint (definition); AllCopiesSameContents (definition); SameTranslogUpToGlobalCheckPoint (definition); AllCopiesSameContentsOnQuietDown (definition); AllAckedResponsesStored (definition); GlobalCheckPointBelowLocalCheckPoints (definition); LocalCheckPointMatchesMaxConfirmedSeq (definition)
      • source line: “ newLocalCheckPoint == [localCheckPoint EXCEPT ![n][rn] = m.localCP]”
      • source line: “AllCopiesSameContents ==”
        • next source line: “ \A n1, n2 \in Nodes:”
    • liveness: no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it
    • evidence/status: specification or model-checking instance; no TLAPS proof-language content found in this file
    • TLC enabled invariant checks: AllCopiesSameContentsOnQuietDown, WellFormedRoutingTable(clusterStateOnMaster.routingTable), GlobalCheckPointBelowLocalCheckPoints, SameTranslogUpToGlobalCheckPoint, AllAckedResponsesStored, LocalCheckPointMatchesMaxConfirmedSeq; enabled temporal-property checks: <>AllCopiesSameContents, <>NoActiveMessages, <>AllAckedResponsesStored; Toolbox model

Isabelle: Elasticsearch alternative cluster-coordination proof

  • Elasticsearch alternative cluster coordination / Implementation

    • specified: functional cluster-consensus implementation
    • safety: consistency/equivalence proof artifact; inspect linked theorem statements for exact hypotheses
    • liveness: no progress guarantee claimed here
    • tool: Isabelle/HOL; machine-checkable proof source, not rerun
    • size: 384 physical lines; exact source
      • source: “lemma NO_TERM_le [simp]: “NO_TERM <le> t” by (cases t, simp_all add: less_eq_TermOption_def)”; statement
      • source: “lemma le_NO_TERM [simp]: “(t <le> NO_TERM) = (t = NO_TERM)” by (cases t, simp_all add: less_eq_TermOption_def)”; statement
      • source: “lemma le_SomeTerm [simp]: “(SomeTerm t<^sub>1 <le> SomeTerm t<^sub>2) = (t<^sub>1 <le> t<^sub>2)” by (auto simp add: less_eq_TermOption_def)”; statement

  • Elasticsearch alternative cluster coordination / Monadic

    • specified: monadic implementation and equivalence to functional implementation
    • safety: consistency/equivalence proof artifact; inspect linked theorem statements for exact hypotheses
    • liveness: no progress guarantee claimed here
    • tool: Isabelle/HOL; machine-checkable proof source, not rerun
    • size: 830 physical lines; exact source
      • source: “lemma runM_Action[simp]: “runM (Action f) = f” by (simp add: runM_def)”; statement
      • source: “lemma runM_inject[intro]: “(<And>nd. runM ma nd = runM mb nd) <Longrightarrow> ma = mb” by (cases ma, cases mb, auto simp add: runM_def)”; statement
      • source: “lemma runM_return[simp]: “runM (return a) nd = (nd, [], Success a)” unfolding runM_def return_def by simp”; statement

  • Elasticsearch alternative cluster coordination / OneSlot

    • specified: consistency of each consensus slot
    • safety: consistency/equivalence proof artifact; inspect linked theorem statements for exact hypotheses
    • liveness: no progress guarantee claimed here
    • tool: Isabelle/HOL; machine-checkable proof source, not rerun
    • size: 127 physical lines; exact source
      • source: “lemma (in oneSlot) prevAccepted_proposed: “prevAccepted t ns <subseteq> {t. proposed t}””; statement
      • source: “lemma (in oneSlot) prevAccepted_finite: “finite (prevAccepted p ns)””; statement
      • source: “lemma (in oneSlot) Q_nonempty: “<And>q. q <in> Q <Longrightarrow> q <noteq> {}””; statement

  • Elasticsearch alternative cluster coordination / Preliminaries

    • specified: definitions supporting the cluster-consensus proof
    • safety: consistency/equivalence proof artifact; inspect linked theorem statements for exact hypotheses
    • liveness: no progress guarantee claimed here
    • tool: Isabelle/HOL; machine-checkable proof source, not rerun
    • size: 167 physical lines; exact source
      • source: “lemma natOfNode_Node[simp]: “natOfNode (Node n) = n” by (simp add: natOfNode_def)”; statement
      • source: “lemma Node_natOfNode[simp]: “Node (natOfNode n) = n” by (cases n, simp add: natOfNode_def)”; statement
      • source: “lemma natOfNode_inj[simp]: “(natOfNode n<^sub>1 = natOfNode n<^sub>2) = (n<^sub>1 = n<^sub>2)” by (metis Node_natOfNode)”; statement

  • Elasticsearch alternative cluster coordination / Zen

    • specified: consistency of the full cluster-consensus implementation
    • safety: consistency/equivalence proof artifact; inspect linked theorem statements for exact hypotheses
    • liveness: no progress guarantee claimed here
    • tool: Isabelle/HOL; machine-checkable proof source, not rerun
    • size: 3,319 physical lines; exact source
      • source: “lemma (in zenMessages) votedFor_unique:”; statement
      • source: “lemma (in zenMessages) V_simps[simp]:”; statement
      • source: “lemma (in zenMessages) lastCommittedClusterStateBefore_simps[simp]:”; statement

Repository scope evidence

  • TiDB/TiKV: “To verify the implementation of distributed transaction.”; PingCAP README
  • Cosmos DB: “We refrain from modeling the Cosmos DB internals”; Azure README
  • Elasticsearch: “The models in this repository might represent past, current and future designs of Elasticsearch and can differ to their implementations in substantial ways.”; Elastic README

Coverage and gaps

  • TLA+ artifact rows: 360; distinct problem count not asserted; per repository: tlaplus-Examples 310, tlaplus-tlapm 18, ongardie-raft.tla 1, pingcap-tla-plus 23, Azure-azure-cosmos-tla 3, elastic-elasticsearch-formal-models 5
  • included the complete local manifest module list for retained tlaplus/Examples families; mathematical examples, sequential-only examples and ordinary puzzles are excluded below
  • excluded module paths:
    • specifications/CarTalkPuzzle/CarTalkPuzzle.tla
    • specifications/CarTalkPuzzle/CarTalkPuzzle.toolbox/Model_1/CarTalkPuzzle.tla
    • specifications/CarTalkPuzzle/CarTalkPuzzle.toolbox/Model_1/MC.tla
    • specifications/CarTalkPuzzle/CarTalkPuzzle.toolbox/Model_2/CarTalkPuzzle.tla
    • specifications/CarTalkPuzzle/CarTalkPuzzle.toolbox/Model_2/MC.tla
    • specifications/CarTalkPuzzle/CarTalkPuzzle.toolbox/Model_3/CarTalkPuzzle.tla
    • specifications/CarTalkPuzzle/CarTalkPuzzle.toolbox/Model_3/MC.tla
    • specifications/CoffeeCan/APCoffeeCan.tla
    • specifications/CoffeeCan/CoffeeCan.tla
    • specifications/CoffeeCan/CoffeeCan_proof.tla
    • specifications/DieHard/APADieHardest.tla
    • specifications/DieHard/APDieHarder.tla
    • specifications/DieHard/DieHard.tla
    • specifications/DieHard/DieHard_proof.tla
    • specifications/DieHard/DieHarder.tla
    • specifications/DieHard/DieHardest.tla
    • specifications/DieHard/MCDieHarder.tla
    • specifications/DieHard/MCDieHardest.tla
    • specifications/EinsteinRiddle/Einstein.tla
    • specifications/GameOfLife/GameOfLife.tla
    • specifications/KnuthYao/KnuthYao.tla
    • specifications/KnuthYao/Prob.tla
    • specifications/KnuthYao/SimKnuthYao.tla
    • specifications/LearnProofs/AddTwo.tla
    • specifications/LearnProofs/FindHighest.tla
    • specifications/LearnProofs/MCFindHighest.tla
    • specifications/LeastCircularSubstring/LeastCircularSubstring.tla
    • specifications/LeastCircularSubstring/MCLeastCircularSubstring.tla
    • specifications/LeastCircularSubstring/ZSequences.tla
    • specifications/LevelChecking/LevelSpec.tla
    • specifications/LoopInvariance/BinarySearch.tla
    • specifications/LoopInvariance/MCBinarySearch.tla
    • specifications/LoopInvariance/MCQuicksort.tla
    • specifications/LoopInvariance/Quicksort.tla
    • specifications/LoopInvariance/SumSequence.tla
    • specifications/Majority/APMajority.tla
    • specifications/Majority/MCMajority.tla
    • specifications/Majority/Majority.tla
    • specifications/Majority/MajorityProof.tla
    • specifications/MissionariesAndCannibals/APMissionariesAndCannibals.tla
    • specifications/MissionariesAndCannibals/MissionariesAndCannibals.tla
    • specifications/MissionariesAndCannibals/MissionariesAndCannibals_proof.tla
    • specifications/Moving_Cat_Puzzle/APCat.tla
    • specifications/Moving_Cat_Puzzle/Cat.tla
    • specifications/N-Queens/Queens.tla
    • specifications/N-Queens/Queens.toolbox/FourQueens/MC.tla
    • specifications/N-Queens/Queens.toolbox/FourQueens/Queens.tla
    • specifications/N-Queens/QueensPluscal.tla
    • specifications/N-Queens/QueensPluscal.toolbox/FourQueens/MC.tla
    • specifications/N-Queens/QueensPluscal.toolbox/FourQueens/QueensPluscal.tla
    • specifications/SlidingPuzzles/SlidingPuzzles.tla
    • specifications/SlidingPuzzles/SlidingPuzzles_anim.tla
    • specifications/SpecifyingSystems/AdvancedExamples/BNFGrammars.tla
    • specifications/SpecifyingSystems/AdvancedExamples/DifferentialEquations.tla
    • specifications/SpecifyingSystems/AdvancedExamples/Graphs.tla
    • specifications/SpecifyingSystems/Composing/APHourClock.tla
    • specifications/SpecifyingSystems/Composing/BinaryHourClock.tla
    • specifications/SpecifyingSystems/Composing/HourClock.tla
    • specifications/SpecifyingSystems/Composing/HourClock_proof.tla
    • specifications/SpecifyingSystems/HourClock/APHourClock.tla
    • specifications/SpecifyingSystems/HourClock/APHourClock2.tla
    • specifications/SpecifyingSystems/HourClock/HourClock.tla
    • specifications/SpecifyingSystems/HourClock/HourClock2.tla
    • specifications/SpecifyingSystems/HourClock/HourClock_proof.tla
    • specifications/SpecifyingSystems/Liveness/APHourClock.tla
    • specifications/SpecifyingSystems/Liveness/APLiveHourClock.tla
    • specifications/SpecifyingSystems/Liveness/HourClock.tla
    • specifications/SpecifyingSystems/Liveness/HourClock_proof.tla
    • specifications/SpecifyingSystems/Liveness/LiveHourClock.tla
    • specifications/SpecifyingSystems/RealTime/HourClock.tla
    • specifications/SpecifyingSystems/RealTime/HourClock_proof.tla
    • specifications/SpecifyingSystems/RealTime/MCRealTimeHourClock.tla
    • specifications/SpecifyingSystems/RealTime/RealTimeHourClock.tla
    • specifications/SpecifyingSystems/RealTime/RealTime_SS.tla
    • specifications/SpecifyingSystems/SimpleMath/SimpleMath.tla
    • specifications/SpecifyingSystems/Standard/Bags.tla
    • specifications/SpecifyingSystems/Standard/FiniteSets.tla
    • specifications/SpecifyingSystems/Standard/Integers.tla
    • specifications/SpecifyingSystems/Standard/Naturals.tla
    • specifications/SpecifyingSystems/Standard/Peano.tla
    • specifications/SpecifyingSystems/Standard/ProtoReals.tla
    • specifications/SpecifyingSystems/Standard/Reals.tla
    • specifications/SpecifyingSystems/Standard/Sequences.tla
    • specifications/SpecifyingSystems/Syntax/BNFGrammars.tla
    • specifications/SpecifyingSystems/Syntax/TLAPlusGrammar.tla
    • specifications/SpecifyingSystems/TLC/BNFGrammars.tla
    • specifications/SpecifyingSystems/TLC/ConfigFileGrammar.tla
    • specifications/Stones/Stones.tla
    • specifications/TLC/MCReachability.tla
    • specifications/TLC/StateGraphs.tla
    • specifications/TLC/TLCMC.tla
    • specifications/TLC/TestGraphs.tla
    • specifications/TLC/TestMCReachability.tla
    • specifications/TransitiveClosure/TransitiveClosure.tla
    • specifications/braf/BufferedRandomAccessFile.tla
    • specifications/btree/btree.tla
    • specifications/btree/MCbtree.tla
    • specifications/btree/kvstore.tla
    • specifications/glowingRaccoon/APclean.tla
    • specifications/glowingRaccoon/APstages.tla
    • specifications/glowingRaccoon/clean.tla
    • specifications/glowingRaccoon/clean_proof.tla
    • specifications/glowingRaccoon/product.tla
    • specifications/glowingRaccoon/stages.tla
    • specifications/glowingRaccoon/stages_proof.tla
    • specifications/sums_even/MC_sums_even.tla
    • specifications/sums_even/sums_even.tla
    • specifications/tower_of_hanoi/Bits.tla
    • specifications/tower_of_hanoi/Hanoi.tla
    • specifications/tower_of_hanoi/Hanoi.toolbox/Model_1/Bits.tla
    • specifications/tower_of_hanoi/Hanoi.toolbox/Model_1/Hanoi.tla
    • specifications/tower_of_hanoi/Hanoi.toolbox/Model_1/MC.tla
    • specifications/tower_of_hanoi/HanoiSeq.tla
    • specifications/tower_of_hanoi/Hanoi_anim.tla
    • tlapm/examples/BubbleSort.tla
    • tlapm/examples/Euclid.tla
    • tlapm/examples/GraphTheorem.tla
    • tlapm/examples/SumAndMax.tla
    • tlapm/examples/cantor/Cantor1.tla
    • tlapm/examples/cantor/Cantor10.tla
    • tlapm/examples/cantor/Cantor2.tla
    • tlapm/examples/cantor/Cantor3.tla
    • tlapm/examples/cantor/Cantor4.tla
    • tlapm/examples/cantor/Cantor5.tla
    • tlapm/examples/cantor/Cantor6.tla
    • tlapm/examples/cantor/Cantor7.tla
    • tlapm/examples/cantor/Cantor8.tla
    • tlapm/examples/cantor/Cantor9.tla
  • README-only external references in tlaplus/Examples, with no local manifest/source inventory: BlockingQueue, CASPaxos, CCF, Caesar, DataPort, HLC, L1, MultiPaxos, ParalleRaft, SnapshotIsolation, SyncConsensus, TencentPaxos, Termination, Tla-tortoise-hare, VoldemortKV, async-comm, azure-cosmos-tla, egalitarian-paxos, fastpaxos, fpaxos, leaderless, losa_ap, losa_rda, m2paxos, microwave, mongo-repl-tla, naiad, nfc04, raft
  • elastic/elasticsearch-tla duplicates the five TLA+ model paths in elastic/elasticsearch-formal-models; counted once above, rather than as five new problems
  • property extraction is a first pass over named local definitions and theorem statements, supplemented by exact model configuration checks; arbitrary unnamed assertions and indirectly imported properties need manual follow-up
  • no model checker or proof assistant was executed; repository status evidence should not be read as independent verification
  • no papers downloaded for this source-only inventory

TLA+ external sources and extra proof artifacts

TLA+ external source repositories and author source archives

  • added repositories discovered through the README-only references in tlaplus/Examples; downloaded author source files/archives are labeled separately and have stable author URLs rather than Git commit URLs

  • one row is one source artifact, including model instances, proof modules and support definitions; physical line counts include comments and generated PlusCal

  • safety/liveness fields identify locally stated properties; configured-check fields separately identify enabled model checks; neither implies a model checker/prover was rerun

  • in plain words: agreement/consistency means nodes do not decide conflicting results; validity excludes inadmissible decisions; type invariants keep states well formed; termination means eventual completion; always-enabledness only rules out stuck states

  • nano-o-MultiPaxos / DiskPaxos.tla

    • specified: MultiPaxos/Distributed MultiPaxos/Disk Paxos consensus and abstract multi-consensus
    • artifact kind: protocol/specification variant
    • tool: TLA+/PlusCal
    • size: 214 physical lines; exact source
    • safety: Inv1 (statement); Inv2 (statement); Agreement (statement); Inv3 (statement); Inv4 (statement)
      • source line: “Inv1 == \A p \in P : dblock[p].bal # NotABallot => dblock[p].bal <= dblock[p].mbal”
      • source line: “Inv2 == \A p \in P : rs[p].mbal = rs[p].bal /\ rs[p].mbal # NotABallot => phase[p] = 2 ”
    • liveness: Termination (statement)
      • source line: “Termination == <>(\A self \in ProcSet: pc[self] = “Done”)”
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • nano-o-MultiPaxos / DistributedMultiPaxos.tla

    • specified: MultiPaxos/Distributed MultiPaxos/Disk Paxos consensus and abstract multi-consensus
    • artifact kind: protocol/specification variant
    • tool: TLA+
    • size: 127 physical lines; exact source
    • safety: TypeInv (statement)
      • source line: “TypeInv ==”
        • next line: “ /\ ballot \in [Acceptors -> {-1} \cup Ballots]”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • nano-o-MultiPaxos / MCDiskPaxos.tla

    • specified: MultiPaxos/Distributed MultiPaxos/Disk Paxos consensus and abstract multi-consensus
    • artifact kind: model instance
    • tool: TLA+
    • size: 22 physical lines; exact source
    • safety: no named local property found; support/instance modules may inherit properties
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • nano-o-MultiPaxos / MultiConsensus.tla

    • specified: MultiPaxos/Distributed MultiPaxos/Disk Paxos consensus and abstract multi-consensus
    • artifact kind: support module
    • tool: TLA+
    • size: 30 physical lines; exact source
    • safety: no named local property found; support/instance modules may inherit properties
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • nano-o-MultiPaxos / MultiPaxos.tla

    • specified: MultiPaxos/Distributed MultiPaxos/Disk Paxos consensus and abstract multi-consensus
    • artifact kind: protocol/specification variant
    • tool: TLA+
    • size: 212 physical lines; exact source
    • safety: TypeInv (statement); ProvedSafeAt (statement); WellFormed (statement); SafeAt (statement); SafeInstanceVoteArray (statement); SafeVoteArray (statement); Correctness (statement); theorem (statement)
      • source line: “TypeInv ==”
        • next line: “ /\ ballot \in [Acceptors -> {-1} \cup Ballots]”
      • source line: “ProvedSafeAt(i, Q, b) ==”
        • next line: “ IF HighestVote(i, b-1, Q) # None”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • fpaxos-fpaxos-tlaplus / FPaxos.tla

    • specified: Flexible Paxos with different phase-one and phase-two quorums
    • artifact kind: protocol/specification variant
    • tool: TLA+
    • size: 128 physical lines; exact source
    • safety: TypeOK (statement); NoFutureProposal (statement); SafeValue (statement); Safety (statement)
      • source line: “TypeOK ==”
        • next line: “ /\ maxBal \in [Acceptor -> Ballot \cup {-1}]”
      • source line: “NoFutureProposal(v,b) ==”
        • next line: “ \A v2 \in Value:”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified
    • configured checks: INVARIANT: SafeValue TypeOK; configuration

  • fpaxos-fpaxos-tlaplus / MCFPaxosFourAcc.tla

    • specified: Flexible Paxos with different phase-one and phase-two quorums
    • artifact kind: model instance
    • tool: TLA+
    • size: 11 physical lines; exact source
    • safety: no named local property found; support/instance modules may inherit properties
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified
    • configured checks: INVARIANT: SafeValue TypeOK; configuration

  • fpaxos-fpaxos-tlaplus / MCFPaxosFourAccLarge.tla

    • specified: Flexible Paxos with different phase-one and phase-two quorums
    • artifact kind: model instance
    • tool: TLA+
    • size: 11 physical lines; exact source
    • safety: no named local property found; support/instance modules may inherit properties
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified
    • configured checks: INVARIANT: SafeValue TypeOK; configuration

  • fpaxos-fpaxos-tlaplus / MCFPaxosThreeAcc.tla

    • specified: Flexible Paxos with different phase-one and phase-two quorums
    • artifact kind: model instance
    • tool: TLA+
    • size: 11 physical lines; exact source
    • safety: no named local property found; support/instance modules may inherit properties
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified
    • configured checks: INVARIANT: SafeValue TypeOK; configuration

  • fpaxos-fpaxos-tlaplus / MCFPaxosTwoAcc.tla

    • specified: Flexible Paxos with different phase-one and phase-two quorums
    • artifact kind: model instance
    • tool: TLA+
    • size: 11 physical lines; exact source
    • safety: no named local property found; support/instance modules may inherit properties
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified
    • configured checks: INVARIANT: SafeValue TypeOK; configuration

  • Starydark-Tencent-Paxos-TLA / Consensus.tla

    • specified: Tencent Paxos with voting abstractions/refinements
    • artifact kind: protocol/specification variant
    • tool: TLA+; TLAPS proof language
    • size: 30 physical lines; exact source
    • safety: Inv (statement); theorem (statement)
      • source line: “Inv == ”
        • next line: “ /\ chosen \subseteq Value”
      • source line: “THEOREM Invariance == Spec => []Inv”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: TLAPS proof content present; successful checking not independently established

  • Starydark-Tencent-Paxos-TLA / EagerVoting.tla

    • specified: Tencent Paxos with voting abstractions/refinements
    • artifact kind: protocol/specification variant
    • tool: TLA+; TLAPS proof language
    • size: 264 physical lines; exact source
    • safety: TypeOK (statement); ShowsSafeAt (statement); Consistency (statement); SafeAt (statement); VotesSafe (statement); Inv (statement); AllSafeAtZero (statement); VotesSafeImpliesConsistency (statement); ShowsSafety (statement); SafeAtStable (statement); Invariant (statement); theorem (statement)
      • source line: “TypeOK == /\ votes \in [Acceptor -> SUBSET (Ballot \X Value)]”
      • source line: “ShowsSafeAt(Q, b, v) ==”
        • next line: “ /\ \A a \in Q : maxBal[a] \geq b * have promised”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: TLAPS proof content present; successful checking not independently established; 1 OMITTED occurrences, so completeness cannot be assumed

  • Starydark-Tencent-Paxos-TLA / TPaxos.tla

    • specified: Tencent Paxos with voting abstractions/refinements
    • artifact kind: protocol/specification variant
    • tool: TLA+
    • size: 169 physical lines; exact source
    • safety: TypeOK (statement); Consistency (statement); theorem (statement)
      • source line: “TypeOK == ”
        • next line: “ /\ state \in [Participant -> [Participant -> State]]”
      • source line: “Consistency == Cardinality(chosen) <= 1 ”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • Starydark-Tencent-Paxos-TLA / TPaxosAP.tla

    • specified: Tencent Paxos with voting abstractions/refinements
    • artifact kind: protocol/specification variant
    • tool: TLA+
    • size: 169 physical lines; exact source
    • safety: TypeOK (statement); Consistency (statement); theorem (statement)
      • source line: “TypeOK == ”
        • next line: “ /\ state \in [Participant -> [Participant -> State]]”
      • source line: “Consistency == Cardinality(chosen) <= 1 ”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • Starydark-Tencent-Paxos-TLA / TPaxosAPWithVotes.tla

    • specified: Tencent Paxos with voting abstractions/refinements
    • artifact kind: protocol/specification variant
    • tool: TLA+
    • size: 51 physical lines; exact source
    • safety: no named local property found; support/instance modules may inherit properties
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • Starydark-Tencent-Paxos-TLA / TPaxosWithProof.tla

    • specified: Tencent Paxos with voting abstractions/refinements
    • artifact kind: proof module
    • tool: TLA+; TLAPS proof language
    • size: 2,285 physical lines; exact source
    • safety: TypeOK (statement); Consistency (statement); SafeAt (statement); Inv (statement); MaxTypeOK (statement); UpdateStateTypeOKProperty (statement); SafeAtStable (statement); Invariant (statement); theorem (statement)
      • source line: “TypeOK == ”
        • next line: “ /\ state \in [Participant -> [Participant -> State]]”
      • source line: “Consistency == *Cardinality(chosen) <= 1 ”
    • liveness: Liveness (statement)
      • source line: “Liveness == <>(chosen # {})”
    • evidence/status: TLAPS proof content present; successful checking not independently established

  • Starydark-Tencent-Paxos-TLA / TPaxosWithVotes.tla

    • specified: Tencent Paxos with voting abstractions/refinements
    • artifact kind: protocol/specification variant
    • tool: TLA+
    • size: 51 physical lines; exact source
    • safety: no named local property found; support/instance modules may inherit properties
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • Starydark-Tencent-Paxos-TLA / Voting.tla

    • specified: Tencent Paxos with voting abstractions/refinements
    • artifact kind: protocol/specification variant
    • tool: TLA+; TLAPS proof language
    • size: 256 physical lines; exact source
    • safety: TypeOK (statement); ShowsSafeAt (statement); Consistency (statement); SafeAt (statement); VotesSafe (statement); Inv (statement); AllSafeAtZero (statement); VotesSafeImpliesConsistency (statement); ShowsSafety (statement); SafeAtStable (statement); Invariant (statement); theorem (statement)
      • source line: “TypeOK == /\ votes \in [Acceptor -> SUBSET (Ballot \X Value)]”
      • source line: “ShowsSafeAt(Q, b, v) ==”
        • next line: “ /\ \A a \in Q : maxBal[a] \geq b * have promised”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: TLAPS proof content present; successful checking not independently established; 1 OMITTED occurrences, so completeness cannot be assumed

  • muratdem-PlusCal-examples / 2PCTM/2PCwithBTM.tla

    • specified: two-phase transaction commit
    • artifact kind: protocol/specification variant
    • tool: TLA+/PlusCal
    • size: 196 physical lines; exact source
    • safety: TypeOK (statement); Consistency (statement)
      • source line: “TypeOK == ”
      • source line: “Consistency == ”
    • liveness: Termination (statement)
      • source line: “Termination == <>(\A self \in ProcSet: pc[self] = “Done”)”
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • muratdem-PlusCal-examples / BenOr/benor.tla

    • specified: Ben-Or randomized consensus
    • artifact kind: protocol/specification variant
    • tool: TLA+/PlusCal
    • size: 139 physical lines; exact source
    • safety: Terminating (statement); Agreement (statement); BaitProgress (statement)
      • source line: “Terminating == /\ \A self \in ProcSet: pc[self] = “Done””
      • source line: “Agreement == \A j,k \in Procs: ”
    • liveness: Termination (statement); Progress (statement)
      • source line: “Termination == <>(\A self \in ProcSet: pc[self] = “Done”)”
      • source line: “Progress == <> (\A j \in Procs: decided[j]#-1) ”
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • muratdem-PlusCal-examples / DAO/dao.tla

    • specified: decentralized autonomous-organization protocol
    • artifact kind: protocol/specification variant
    • tool: TLA+/PlusCal
    • size: 187 physical lines; exact source
    • safety: SafeWithdrawal (statement); SafeWithdrawal1 (statement)
      • source line: “SafeWithdrawal ==”
        • next line: “ / bankBalance=BALANCE /\ malloryBalance=0”
      • source line: “ SafeWithdrawal1 ==”
        • next line: “ / accountAlice=BALANCE /\ accountBob=0”
    • liveness: Termination (statement)
      • source line: “Termination == <>(\A self \in ProcSet: pc[self] = “Done”)”
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • muratdem-PlusCal-examples / DAO/dao2.tla

    • specified: decentralized autonomous-organization protocol
    • artifact kind: protocol/specification variant
    • tool: TLA+/PlusCal
    • size: 192 physical lines; exact source
    • safety: SafeWithdrawal (statement); Invariant (statement); SafeWithdrawal1 (statement)
      • source line: “SafeWithdrawal ==”
        • next line: “ / bankBalance=BALANCE /\ malloryBalance=0”
      • source line: “Invariant == bankBalance+malloryBalance <= BALANCE”
    • liveness: SafeWithdrawal (statement); Invariant (statement); Termination (statement)
      • source line: “ SafeWithdrawal == ”
        • next line: “ / bankBalance=BALANCE /\ malloryBalance=0”
      • source line: “ Invariant == bankBalance+malloryBalance <= BALANCE ”
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • muratdem-PlusCal-examples / DiningPhil/diningHygenic0.tla

    • specified: dining-philosopher synchronization
    • artifact kind: protocol/specification variant
    • tool: TLA+/PlusCal
    • size: 200 physical lines; exact source
    • safety: TypeOkFork (statement); TypeOkReq (statement)
      • source line: “TypeOkFork == \A k,l \in Procs: Forkat(k,l) => ~Forkat(l,k)”
      • source line: “TypeOkReq == \A k,l \in Procs: Reqat(k,l) => ~Reqat(l,k)”
    • liveness: NoStarvation (statement)
      • source line: “NoStarvation == \A p \in Procs: [] (state[p]=“Hungry” => <> (state[p]=“Eating”))”
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • muratdem-PlusCal-examples / DiningPhil/diningHygienic.tla

    • specified: dining-philosopher synchronization
    • artifact kind: protocol/specification variant
    • tool: TLA+/PlusCal
    • size: 190 physical lines; exact source
    • safety: TypeOkFork (statement); TypeOkReq (statement)
      • source line: “TypeOkFork == \A k,l \in Procs: Forkat(k,l) => ~Forkat(l,k)”
      • source line: “TypeOkReq == \A k,l \in Procs: Reqat(k,l) => ~Reqat(l,k)”
    • liveness: NoStarvation (statement)
      • source line: “NoStarvation == \A p \in Procs: [] (state[p]=“Hungry” => <> (state[p]=“Eating”))”
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • muratdem-PlusCal-examples / DiningPhil/diningRound0.tla

    • specified: dining-philosopher synchronization
    • artifact kind: protocol/specification variant
    • tool: TLA+/PlusCal
    • size: 130 physical lines; exact source
    • safety: no named local property found; support/instance modules may inherit properties
    • liveness: NoStarvation (statement)
      • source line: “NoStarvation == \A p \in Procs: [] (state[p]=“Hungry” => <> (state[p]=“Eating”))”
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • muratdem-PlusCal-examples / DiningPhil/diningRound1.tla

    • specified: dining-philosopher synchronization
    • artifact kind: protocol/specification variant
    • tool: TLA+/PlusCal
    • size: 149 physical lines; exact source
    • safety: no named local property found; support/instance modules may inherit properties
    • liveness: NoStarvation (statement)
      • source line: “NoStarvation == \A p \in Procs: [] (state[p]=“Hungry” => <> (state[p]=“Eating”))”
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • muratdem-PlusCal-examples / Paxos/fpax1.tla

    • specified: Paxos/Fast Paxos
    • artifact kind: protocol/specification variant
    • tool: TLA+/PlusCal
    • size: 295 physical lines; exact source
    • safety: Agreement (statement); Agreement2 (statement); Agreement3 (statement)
      • source line: “Agreement == \A a1,a2 \in Acceptor: ”
      • source line: “Agreement2 == \A i \in Acceptor: ”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • muratdem-PlusCal-examples / Paxos/pax2.tla

    • specified: Paxos/Fast Paxos
    • artifact kind: protocol/specification variant
    • tool: TLA+/PlusCal
    • size: 281 physical lines; exact source
    • safety: Agreement (statement); Agreement2 (statement); Agreement3 (statement)
      • source line: “Agreement == \A a1,a2 \in Acceptor: ”
      • source line: “Agreement2 == \A i \in Acceptor: ”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • muratdem-PlusCal-examples / Streamlet/str0.tla

    • specified: Streamlet blockchain consensus
    • artifact kind: protocol/specification variant
    • tool: TLA+/PlusCal
    • size: 117 physical lines; exact source
    • safety: Consistency (statement)
      • source line: “Consistency == \A i,j \in Nodes: ThreeCons(nChain[i]) /\ ThreeCons(nChain[j]) /\ Len(nChain[i])=< Len(nChain[j]) ”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • muratdem-PlusCal-examples / Streamlet/str1.tla

    • specified: Streamlet blockchain consensus
    • artifact kind: protocol/specification variant
    • tool: TLA+/PlusCal
    • size: 128 physical lines; exact source
    • safety: Terminating (statement); Consistency (statement)
      • source line: “Terminating == /\ \A self \in ProcSet: pc[self] = “Done””
      • source line: “Consistency == \A i,j \in Nodes: ThreeCons(nChain[i]) /\ ThreeCons(nChain[j]) /\ Len(nChain[i])=< Len(nChain[j]) ”
    • liveness: Termination (statement)
      • source line: “Termination == <>(\A self \in ProcSet: pc[self] = “Done”)”
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • muratdem-PlusCal-examples / Streamlet/str2.tla

    • specified: Streamlet blockchain consensus
    • artifact kind: protocol/specification variant
    • tool: TLA+/PlusCal
    • size: 156 physical lines; exact source
    • safety: Terminating (statement); Consistency (statement)
      • source line: “Terminating == /\ \A self \in ProcSet: pc[self] = “Done””
      • source line: “Consistency == \A i,j \in Nodes: ThreeCons(nChain[i]) /\ ThreeCons(nChain[j]) /\ Len(nChain[i])=< Len(nChain[j]) ”
    • liveness: Termination (statement)
      • source line: “Termination == <>(\A self \in ProcSet: pc[self] = “Done”)”
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • muratdem-PlusCal-examples / SyncConsensus/syncCon1.tla

    • specified: synchronous-round consensus
    • artifact kind: protocol/specification variant
    • tool: TLA+/PlusCal
    • size: 148 physical lines; exact source
    • safety: Agreement (statement)
      • source line: “Agreement == \A i,j \in Nodes: t[i] /\ t[j] => (d[i]=d[j] /\ d[i]#-1)”
    • liveness: Termination (statement); Term (statement)
      • source line: “Termination == <>(\A self \in ProcSet: pc[self] = “Done”)”
      • source line: “Term == <> \A i \in Nodes: up[i] =>t[i]”
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • muratdem-PlusCal-examples / SyncConsensus/syncCon3.tla

    • specified: synchronous-round consensus
    • artifact kind: protocol/specification variant
    • tool: TLA+/PlusCal
    • size: 162 physical lines; exact source
    • safety: Agreement (statement); SyncTerm (statement)
      • source line: “Agreement == \A i,j \in Nodes: t[i] /\ t[j] => (d[i]=d[j] /\ d[i]#-1)”
      • source line: “SyncTerm == \A i,j \in Nodes: t[i] /\ t[j] => pt[i]=pt[j]”
    • liveness: Termination (statement); Term (statement)
      • source line: “Termination == <>(\A self \in ProcSet: pc[self] = “Done”)”
      • source line: “Term == <> \A i \in Nodes: up[i] =>t[i]”
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • muratdem-PlusCal-examples / VoldemortKV/voldchain.tla

    • specified: replicated key-value storage, including chain replication
    • artifact kind: protocol/specification variant
    • tool: TLA+/PlusCal
    • size: 238 physical lines; exact source
    • safety: no named local property found; support/instance modules may inherit properties
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • muratdem-PlusCal-examples / VoldemortKV/voldemortSimple.tla

    • specified: replicated key-value storage, including chain replication
    • artifact kind: protocol/specification variant
    • tool: TLA+/PlusCal
    • size: 163 physical lines; exact source
    • safety: no named local property found; support/instance modules may inherit properties
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • HappyCS-Gu-Parallel-Raft-tla / MultiPaxos.tla

    • specified: Parallel Raft and refinement to MultiPaxos
    • artifact kind: protocol/specification variant
    • tool: TLA+
    • size: 175 physical lines; exact source
    • safety: TypeInv (statement); WellFormed (statement); SafeAt (statement); SafeInstanceVoteArray (statement); SafeVoteArray (statement); Inv (statement); Correctness (statement)
      • source line: “TypeInv ==”
        • next line: “ /\ ballot \in [Acceptors -> {-1} \cup Ballots]”
      • source line: “WellFormed == \A a \in Acceptors : \A i \in Instances : \A b \in Ballots :”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • HappyCS-Gu-Parallel-Raft-tla / ParallelRaftCE.tla

    • specified: Parallel Raft and refinement to MultiPaxos
    • artifact kind: protocol/specification variant
    • tool: TLA+
    • size: 473 physical lines; exact source
    • safety: Term (statement); TypeSafety (statement)
      • source line: “Term == Nat”
      • source line: “TypeSafety == /\ allLogs \in SUBSET (SUBSET allEntries)”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • HappyCS-Gu-Parallel-Raft-tla / ParallelRaftSE.tla

    • specified: Parallel Raft and refinement to MultiPaxos
    • artifact kind: protocol/specification variant
    • tool: TLA+
    • size: 254 physical lines; exact source
    • safety: Term (statement); TypeInv (statement); Inv (statement)
      • source line: “Term == Nat”
      • source line: “TypeInv == /\ currentTerm \in [Server -> Nat]”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • tschottdorf-caspaxos-tla / CASPaxos.tla

    • specified: compare-and-set Paxos consensus
    • artifact kind: protocol/specification variant
    • tool: TLA+
    • size: 322 physical lines; exact source
    • safety: TypeOK (statement); OnlyOneValuePerBallot (statement); MutationsLineUp (statement); DesiredProperties (statement)
      • source line: “TypeOK == /\ prepared \in [ Acceptors -> Ballot ]”
      • source line: “OnlyOneValuePerBallot == \A b \in Ballot : Cardinality(ValuesAt(b)) \leq 1”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified
    • interpretation: the state predicates ask for one value per ballot and for each mutation to use the previous committed value; the repository explicitly supplies a counterexample target
      • source: “In our case, there will be behaviors that violate MutationsLineUp.”; source

  • tschottdorf-caspaxos-tla / CASPaxos.toolbox/Model_1/MC.tla

    • specified: compare-and-set Paxos consensus
    • artifact kind: model instance
    • tool: TLA+
    • size: 38 physical lines; exact source
    • safety: no named local property found; support/instance modules may inherit properties
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified
    • configured checks: INVARIANT: inv_14915459371617000; configuration
    • interpretation: the state predicates ask for one value per ballot and for each mutation to use the previous committed value; the repository explicitly supplies a counterexample target
      • source: “In our case, there will be behaviors that violate MutationsLineUp.”; source

  • sanjosh-tlaplus / amazon/serializableSnapshotIsolation.tla

    • specified: snapshot/serializable transaction isolation
    • artifact kind: protocol/specification variant
    • tool: TLA+
    • size: 1,584 physical lines; exact source
    • safety: TypeInv (statement); LegitimateTermination (statement); WellFormedTransactionsInHistory (statement); UnitTest_WellFormedTransactionsInHistory (statement); CorrectReadView (statement); FirstCommitterWins (statement); SemanticsOfSnapshotIsolation (statement); CorrectnessOfHoldingXLocks (statement); CorrectnessOfWaitingForXLock (statement); CahillSerializable (statement); BernsteinSerializable (statement); theorem (statement)
      • source line: “TypeInv == /\ history \in Seq(EventsT)”
      • source line: “LegitimateTermination == FinalizedTxns(history) = TxnId”
    • liveness: theorem (statement)
      • source line: “THEOREM Spec => <>LegitimateTermination”
    • evidence/status: specification/model-checking source; no local machine-checked proof identified
    • plain-language safety: transactions obey snapshot-read and first-committer-wins rules; the two serializability predicates rule out cycles in their transaction dependency graphs

  • sanjosh-tlaplus / amazon/textbookSnapshotIsolation.tla

    • specified: snapshot/serializable transaction isolation
    • artifact kind: protocol/specification variant
    • tool: TLA+
    • size: 1,297 physical lines; exact source
    • safety: TypeInv (statement); LegitimateTermination (statement); WellFormedTransactionsInHistory (statement); UnitTest_WellFormedTransactionsInHistory (statement); CorrectReadView (statement); FirstCommitterWins (statement); SemanticsOfSnapshotIsolation (statement); CorrectnessOfHoldingXLocks (statement); CorrectnessOfWaitingForXLock (statement); CahillSerializable (statement); BernsteinSerializable (statement); theorem (statement)
      • source line: “TypeInv == /\ history \in Seq(EventsT)”
      • source line: “LegitimateTermination == FinalizedTxns(history) = TxnId”
    • liveness: theorem (statement)
      • source line: “THEOREM Spec => <>LegitimateTermination”
    • evidence/status: specification/model-checking source; no local machine-checked proof identified
    • plain-language safety: transactions obey snapshot-read and first-committer-wins rules; the two serializability predicates rule out cycles in their transaction dependency graphs

  • sanjosh-tlaplus / pluscal/alternating_bit/AltBitProtocol.tla

    • specified: alternating-bit message transfer
    • artifact kind: protocol/specification variant
    • tool: TLA+/PlusCal
    • size: 149 physical lines; exact source
    • safety: no named local property found; support/instance modules may inherit properties
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • sanjosh-tlaplus / pluscal/childcare/childcare.tla

    • specified: concurrent staff/child ratio enforcement
    • artifact kind: protocol/specification variant
    • tool: TLA+/PlusCal
    • size: 101 physical lines; exact source
    • safety: IsEnvSafe (statement)
      • source line: “IsEnvSafe(num_children, num_adults) == (num_children = 0) ”
    • liveness: Termination (statement)
      • source line: “Termination == <>(\A self \in ProcSet: pc[self] = “Done”)”
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • sanjosh-tlaplus / pluscal/childcare/childcare2.tla

    • specified: concurrent staff/child ratio enforcement
    • artifact kind: protocol/specification variant
    • tool: TLA+/PlusCal
    • size: 95 physical lines; exact source
    • safety: IsEnvSafe (statement)
      • source line: “IsEnvSafe(num_children, num_adults) == (num_children = 0) ”
    • liveness: Termination (statement)
      • source line: “Termination == <>(\A self \in ProcSet: pc[self] = “Done”)”
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • sanjosh-tlaplus / pluscal/childcare/childcare2_fail.tla

    • specified: concurrent staff/child ratio enforcement
    • artifact kind: protocol/specification variant
    • tool: TLA+/PlusCal
    • size: 97 physical lines; exact source
    • safety: IsEnvSafe (statement)
      • source line: “IsEnvSafe(num_children, num_adults) == (num_children = 0) ”
    • liveness: Termination (statement)
      • source line: “Termination == <>(\A self \in ProcSet: pc[self] = “Done”)”
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • sanjosh-tlaplus / pluscal/dining_philosophers/dining_deadlock.tla

    • specified: dining-philosopher synchronization
    • artifact kind: protocol/specification variant
    • tool: TLA+/PlusCal
    • size: 101 physical lines; exact source
    • safety: no named local property found; support/instance modules may inherit properties
    • liveness: Termination (statement)
      • source line: “Termination == <>(\A self \in ProcSet: pc[self] = “Done”)”
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • sanjosh-tlaplus / pluscal/dining_philosophers/dining_no_deadlock.tla

    • specified: dining-philosopher synchronization
    • artifact kind: protocol/specification variant
    • tool: TLA+/PlusCal
    • size: 116 physical lines; exact source
    • safety: no named local property found; support/instance modules may inherit properties
    • liveness: Termination (statement)
      • source line: “Termination == <>(\A self \in ProcSet: pc[self] = “Done”)”
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • nano-o-Distributed-termination-detection / ApaTermination.tla

    • specified: channel-counting distributed termination detection
    • artifact kind: model instance
    • tool: TLA+
    • size: 26 physical lines; exact source
    • safety: no named local property found; support/instance modules may inherit properties
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified
    • configured checks: INVARIANTS: Canary1; configuration
    • configured checks: INVARIANTS: Canary1; configuration
    • scope: safety means a reported termination is correct, not that termination is eventually reported

  • nano-o-Distributed-termination-detection / Termination.tla

    • specified: channel-counting distributed termination detection
    • artifact kind: protocol/specification variant
    • tool: TLA+
    • size: 157 physical lines; exact source
    • safety: Safety (statement); TypeOK (statement); Inv1 (statement); Inv2 (statement); Inv3 (statement); Safety_ (statement)
      • source line: “Safety == terminated => \A p,q \in P : NumPending(p,q) = 0”
      • source line: “TypeOK ==”
        • next line: “ /\ s \in [P\times P -> Int]”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified
    • configured checks: INVARIANTS: Canary1; configuration
    • scope: safety means a reported termination is correct, not that termination is eventually reported

  • nano-o-Distributed-termination-detection / TerminationPlusCal.tla

    • specified: channel-counting distributed termination detection
    • artifact kind: protocol/specification variant
    • tool: TLA+/PlusCal
    • size: 123 physical lines; exact source
    • safety: Correctness (statement); Terminating (statement)
      • source line: “Correctness == pc[d] = “Done” => msgs = EmptyBag”
      • source line: “Terminating == /\ \A self \in ProcSet: pc[self] = “Done””
    • liveness: Termination (statement)
      • source line: “Termination == <>(\A self \in ProcSet: pc[self] = “Done”)”
    • evidence/status: specification/model-checking source; no local machine-checked proof identified
    • configured checks: INVARIANTS: Canary1; configuration
    • scope: safety means a reported termination is correct, not that termination is eventually reported

  • nano-o-Distributed-termination-detection / Termination_proof.tla

    • specified: channel-counting distributed termination detection
    • artifact kind: proof module
    • tool: TLA+; TLAPS proof language
    • size: 240 physical lines; exact source
    • safety: TypeCorrect (statement); Invariant1 (statement); Invariant2 (statement); Invariant3 (statement); theorem (statement)
      • source line: “LEMMA TypeCorrect == Spec => []TypeOK”
      • source line: “LEMMA Invariant1 == Spec => []Inv1”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: TLAPS proof content present; successful checking not independently established
    • scope: safety means a reported termination is correct, not that termination is eventually reported

  • nano-o-Caesar / AbstractLeaderlessPaxos.tla

    • specified: Caesar/leaderless generalized consensus and dependency ordering
    • artifact kind: protocol/specification variant
    • tool: TLA+/PlusCal
    • size: 602 physical lines; exact source
    • safety: TypeInvariant (statement); Inv1 (statement); Inv3 (statement); Inv2 (statement); Inv4 (statement); GraphInvariant (statement); Agreement (statement)
      • source line: “TypeInvariant ==”
        • next line: “ /\ \A p \in P, c \in C : ballot[p][c] \in Ballot”
      • source line: “Inv1 == \A p \in P : \A c \in C : LastBal(c, Max(Ballot), p) \preceq ballot[p][c]”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • nano-o-Caesar / Ballots.tla

    • specified: Caesar/leaderless generalized consensus and dependency ordering
    • artifact kind: support module
    • tool: TLA+
    • size: 48 physical lines; exact source
    • safety: no named local property found; support/instance modules may inherit properties
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • nano-o-Caesar / Caesar.tla

    • specified: Caesar/leaderless generalized consensus and dependency ordering
    • artifact kind: protocol/specification variant
    • tool: TLA+
    • size: 238 physical lines; exact source
    • safety: TypeInvariant (statement); Inv1 (statement)
      • source line: “TypeInvariant ==”
        • next line: “ /\ time \in [P -> Nat]”
      • source line: “Inv1 == \A c1,c2 \in DOMAIN stable : c1 # c2 /\ stable[c1].ts \prec stable[c2].ts =>”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • nano-o-Caesar / Caesar2.tla

    • specified: Caesar/leaderless generalized consensus and dependency ordering
    • artifact kind: protocol/specification variant
    • tool: TLA+/PlusCal
    • size: 794 physical lines; exact source
    • safety: TypeInvariant (statement); Inv1 (statement); Inv2 (statement); Inv3 (statement); GraphInvariant (statement); Agreement (statement)
      • source line: “TypeInvariant ==”
        • next line: “ /\ \A p \in P, c \in C : ballot[p][c] \in Ballot”
      • source line: “Inv1 == \A p \in P : \A c \in C : ballot[p][c] >= LastBal(c, Max(Ballot), p)”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • nano-o-Caesar / Caesar3.tla

    • specified: Caesar/leaderless generalized consensus and dependency ordering
    • artifact kind: protocol/specification variant
    • tool: TLA+/PlusCal
    • size: 683 physical lines; exact source
    • safety: TypeInvariant (statement); Inv3 (statement); Inv1 (statement); Inv2 (statement); GraphInvariant (statement); Agreement (statement)
      • source line: “TypeInvariant ==”
        • next line: “ /\ \A p \in P, c \in C : ballot[p][c] \in Ballot”
      • source line: “Inv3 == \A p \in P :”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • nano-o-Caesar / Caesar4.tla

    • specified: Caesar/leaderless generalized consensus and dependency ordering
    • artifact kind: protocol/specification variant
    • tool: TLA+/PlusCal
    • size: 869 physical lines; exact source
    • safety: TypeInvariant (statement); GraphInvariant (statement); Agreement (statement)
      • source line: “TypeInvariant ==”
        • next line: “ /\ \A p \in P, c \in C : ballot[p][c] \in Ballot”
      • source line: “GraphInvariant == \A c1, c2 \in C : \A b1, b2 \in Ballot :”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • nano-o-Caesar / CaesarPlusCal.tla

    • specified: Caesar/leaderless generalized consensus and dependency ordering
    • artifact kind: protocol/specification variant
    • tool: TLA+/PlusCal
    • size: 465 physical lines; exact source
    • safety: Disagreement (statement); TypeInvariant (statement); Inv1 (statement); Inv2 (statement); Inv3 (statement)
      • source line: “Disagreement(c, q1, q2) ==”
        • next line: “ LET deps1 == UNION {phase1Ack[p2][c].pred : p2 \in q1}”
      • source line: “TypeInvariant ==”
        • next line: “ /\ time \in [P -> Nat]”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • nano-o-Caesar / Commands.tla

    • specified: Caesar/leaderless generalized consensus and dependency ordering
    • artifact kind: support module
    • tool: TLA+
    • size: 40 physical lines; exact source
    • safety: no named local property found; support/instance modules may inherit properties
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • nano-o-Caesar / EPaxosLight.tla

    • specified: Caesar/leaderless generalized consensus and dependency ordering
    • artifact kind: protocol/specification variant
    • tool: TLA+/PlusCal
    • size: 513 physical lines; exact source
    • safety: TypeInvariant (statement); Inv1 (statement); Inv3 (statement); Inv2 (statement); Inv4 (statement); GraphInvariant (statement); Agreement (statement)
      • source line: “TypeInvariant ==”
        • next line: “ /\ \A p \in P, c \in C : ballot[p][c] \in Ballot”
      • source line: “Inv1 == \A p \in P : \A c \in C : LastBal(c, Max(Ballot), p) \preceq ballot[p][c]”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • nano-o-Caesar / LeaderlessPaxos.tla

    • specified: Caesar/leaderless generalized consensus and dependency ordering
    • artifact kind: protocol/specification variant
    • tool: TLA+/PlusCal
    • size: 589 physical lines; exact source
    • safety: TypeInvariant (statement); Inv1 (statement); Inv3 (statement); Inv2 (statement); Inv4 (statement); GraphInvariant (statement); Agreement (statement)
      • source line: “TypeInvariant ==”
        • next line: “ /\ \A p \in P, c \in C : ballot[p][c] \in Ballot”
      • source line: “Inv1 == \A p \in P : \A c \in C : LastBal(c, Max(Ballot), p) \preceq ballot[p][c]”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • nano-o-Caesar / Maps.tla

    • specified: Caesar/leaderless generalized consensus and dependency ordering
    • artifact kind: support module
    • tool: TLA+
    • size: 18 physical lines; exact source
    • safety: no named local property found; support/instance modules may inherit properties
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • nano-o-Caesar / Quorums.tla

    • specified: Caesar/leaderless generalized consensus and dependency ordering
    • artifact kind: support module
    • tool: TLA+
    • size: 21 physical lines; exact source
    • safety: no named local property found; support/instance modules may inherit properties
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • muratdem-HLC / hlc.tla

    • specified: hybrid logical/vector clocks; naive counterexample variant
    • artifact kind: protocol/specification variant
    • tool: TLA+/PlusCal
    • size: 108 physical lines; exact source
    • safety: TypeOK (statement); Sync (statement); Boundedl (statement); Boundedc (statement)
      • source line: “TypeOK == (\A k \in Procs: l[k] >= pt[k])”
      • source line: “Sync == (\A k,m \in Procs: pt[k] <= pt[m]+EPS)”
    • liveness: Termination (statement)
      • source line: “Termination == <>(\A self \in ProcSet: pc[self] = “Done”)”
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • muratdem-HLC / hlcnaive2.tla

    • specified: hybrid logical/vector clocks; naive counterexample variant
    • artifact kind: protocol/specification variant
    • tool: TLA+/PlusCal
    • size: 92 physical lines; exact source
    • safety: TypeOK (statement); Sync (statement); Bounded (statement)
      • source line: “TypeOK == (\A k \in Procs: lc[k] >= pt[k])”
      • source line: “Sync == (\A k,l \in Procs: pt[k] <= pt[l]+EPSILON)”
    • liveness: Termination (statement)
      • source line: “Termination == <>(\A self \in ProcSet: pc[self] = “Done”)”
    • evidence/status: specification/model-checking source; no local machine-checked proof identified
    • counterexample status: source says “this is violated!!! in general unbounded!” beside Bounded; this is an intentionally flawed variant

  • muratdem-HLC / vc.tla

    • specified: hybrid logical/vector clocks; naive counterexample variant
    • artifact kind: protocol/specification variant
    • tool: TLA+/PlusCal
    • size: 110 physical lines; exact source
    • safety: VCCOK (statement); TypeOK (statement); Sync (statement); VCprop (statement)
      • source line: “VCCOK == (\A k \in Procs: VCget(vc[k],k).val >= pt[k] /\ VCget(vc[k],k).val <= pt[k] +EPSILON)”
      • source line: “TypeOK == (\A k \in Procs: (\A v \in vc[k]: v.val >= pt[k] -EPSILON))”
    • liveness: Termination (statement)
      • source line: “Termination == <>(\A self \in ProcSet: pc[self] = “Done”)”
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • efficient-epaxos / tla+/EgalitarianPaxos.tla

    • specified: Egalitarian Paxos consensus
    • artifact kind: protocol/specification variant
    • tool: TLA+
    • size: 718 physical lines; exact source
    • safety: TypeOK (statement); Nontriviality (statement); Stability (statement); Consistency (statement); theorem (statement)
      • source line: “TypeOK ==”
        • next line: “ /\ cmdLog \in [Replicas -> SUBSET [inst: Instances, ”
      • source line: “Nontriviality ==”
        • next line: “ \A i \in Instances :”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified
    • plain-language safety: only proposed/no-op commands commit; committed/executed commands remain so; each instance commits at most one command

  • losa-leaderless / CStruct.tla

    • specified: leaderless generalized consensus, command-order and graph-processing support
    • artifact kind: support module
    • tool: TLA+
    • size: 71 physical lines; exact source
    • safety: no named local property found; support/instance modules may inherit properties
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • losa-leaderless / Common.tla

    • specified: leaderless generalized consensus, command-order and graph-processing support
    • artifact kind: support module
    • tool: TLA+
    • size: 17 physical lines; exact source
    • safety: no named local property found; support/instance modules may inherit properties
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • losa-leaderless / Consensus.tla

    • specified: leaderless generalized consensus, command-order and graph-processing support
    • artifact kind: protocol/specification variant
    • tool: TLA+
    • size: 27 physical lines; exact source
    • safety: theorem (statement)
      • source line: “THEOREM Spec => [](\A v \in V : state.decided = v => [](state.decided = v))”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • losa-leaderless / ConsensusInterface.tla

    • specified: leaderless generalized consensus, command-order and graph-processing support
    • artifact kind: support module
    • tool: TLA+
    • size: 25 physical lines; exact source
    • safety: no named local property found; support/instance modules may inherit properties
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • losa-leaderless / DiGraph.tla

    • specified: leaderless generalized consensus, command-order and graph-processing support
    • artifact kind: protocol/specification variant
    • tool: TLA+
    • size: 159 physical lines; exact source
    • safety: Prefix (statement)
      • source line: “Prefix(s1,s2) == ”
        • next line: “ /\ Len(s1) <= Len(s2)”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • losa-leaderless / GraphProcessing2.tla

    • specified: leaderless generalized consensus, command-order and graph-processing support
    • artifact kind: protocol/specification variant
    • tool: TLA+
    • size: 277 physical lines; exact source
    • safety: DependencyGraphInvariant (statement); PrefixUpTo (statement)
      • source line: “DependencyGraphInvariant(m, R) ==”
        • next line: “ LET G == ConvertMap(m)”
      • source line: “PrefixUpTo(s1, s2, R) ==”
        • next line: “ /\ Len(s1) <= Len(s2)”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • losa-leaderless / ModularLeaderless.tla

    • specified: leaderless generalized consensus, command-order and graph-processing support
    • artifact kind: protocol/specification variant
    • tool: TLA+
    • size: 117 physical lines; exact source
    • safety: Consistency (statement); theorem (statement)
      • source line: “Consistency == \A l1,l2 \in linearizations : l1 # l2 =>”
      • source line: “THEOREM Spec => []Consistency”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • losa-leaderless / OrderRelations.tla

    • specified: leaderless generalized consensus, command-order and graph-processing support
    • artifact kind: support module
    • tool: TLA+
    • size: 57 physical lines; exact source
    • safety: no named local property found; support/instance modules may inherit properties
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • losa-leaderless / SimpleDependencySetAlgorithm.tla

    • specified: leaderless generalized consensus, command-order and graph-processing support
    • artifact kind: protocol/specification variant
    • tool: TLA+/PlusCal
    • size: 143 physical lines; exact source
    • safety: Correctness (statement); theorem (statement)
      • source line: “Correctness == \A p1,p2 \in P : \A c1,c2 \in C :”
      • source line: “THEOREM Spec => []Correctness”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • losa-assignment / Allocation.tla

    • specified: one-shot/long-lived distributed assignment and allocation
    • artifact kind: support module
    • tool: TLA+/PlusCal
    • size: 54 physical lines; exact source
    • safety: Correctness (statement)
      • source line: “ Correctness == ”
        • next line: “ /\ \A p,q \in P : D[p] # Bot /\ D[q] # Bot /\ p # q”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • losa-assignment / Assignment.tla

    • specified: one-shot/long-lived distributed assignment and allocation
    • artifact kind: support module
    • tool: TLA+/PlusCal
    • size: 102 physical lines; exact source
    • safety: Correctness (statement)
      • source line: “ Correctness == Prop1 /\ Prop2 /\ Prop3”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • losa-assignment / LongLivedAssignment.tla

    • specified: one-shot/long-lived distributed assignment and allocation
    • artifact kind: support module
    • tool: TLA+/PlusCal
    • size: 114 physical lines; exact source
    • safety: Correctness (statement)
      • source line: “ Correctness == Prop1 /\ Prop2 /\ Prop3”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • losa-M2Paxos / DistributedM2Paxos.tla

    • specified: M2Paxos replicated object/consensus variants and MultiPaxos refinement
    • artifact kind: protocol/specification variant
    • tool: TLA+
    • size: 217 physical lines; exact source
    • safety: TypeInv (statement)
      • source line: “TypeInv ==”
        • next line: “ /\ ballots \in [Objects -> [Acceptors -> {-1} \cup Ballots]]”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • losa-M2Paxos / DistributedMultiPaxos.tla

    • specified: M2Paxos replicated object/consensus variants and MultiPaxos refinement
    • artifact kind: protocol/specification variant
    • tool: TLA+
    • size: 126 physical lines; exact source
    • safety: TypeInv (statement)
      • source line: “TypeInv ==”
        • next line: “ /\ ballot \in [Acceptors -> {-1} \cup Ballots]”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • losa-M2Paxos / M2Paxos.tla

    • specified: M2Paxos replicated object/consensus variants and MultiPaxos refinement
    • artifact kind: protocol/specification variant
    • tool: TLA+
    • size: 207 physical lines; exact source
    • safety: Prefix (statement); Correctness (statement); theorem (statement)
      • source line: “ Prefix(s1,s2) ==”
        • next line: “ /\ Len(s1) <= Len(s2)”
      • source line: “Correctness == \A o1,o2 \in Objects : o1 # o2 =>”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • losa-M2Paxos / MultiConsensus.tla

    • specified: M2Paxos replicated object/consensus variants and MultiPaxos refinement
    • artifact kind: support module
    • tool: TLA+
    • size: 35 physical lines; exact source
    • safety: no named local property found; support/instance modules may inherit properties
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • losa-M2Paxos / MultiPaxos.tla

    • specified: M2Paxos replicated object/consensus variants and MultiPaxos refinement
    • artifact kind: protocol/specification variant
    • tool: TLA+
    • size: 203 physical lines; exact source
    • safety: TypeInv (statement); WellFormed (statement); SafeAt (statement); SafeInstanceVoteArray (statement); SafeVoteArray (statement); ProvedSafeAt (statement); Correctness (statement); theorem (statement)
      • source line: “TypeInv ==”
        • next line: “ /\ ballot \in [Acceptors -> {-1} \cup Ballots]”
      • source line: “WellFormed == \A a \in Acceptors : \A i \in Instances : \A b \in Ballots :”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • losa-M2Paxos / Objects.tla

    • specified: M2Paxos replicated object/consensus variants and MultiPaxos refinement
    • artifact kind: support module
    • tool: TLA+
    • size: 16 physical lines; exact source
    • safety: no named local property found; support/instance modules may inherit properties
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified

  • YUH-Z-lmgpa / benchmarks/distributed_ind_inv/10_lockserv.tla

    • specified: distributed-protocol inductive-invariant benchmark: lockserv
    • artifact kind: protocol/specification variant
    • tool: TLA+
    • size: 97 physical lines; exact source
    • safety: TypeOK (statement); Mutex (statement); IndAuto (statement); Inductiveness (statement)
      • source line: “TypeOK == ”
        • next line: “ /\ lock_msg \in [Node -> BOOLEAN]”
      • source line: “Mutex == \A x,y \in Node : (holds_lock[x] /\ holds_lock[y]) => (x = y)”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified
    • benchmark status: supplied IndAuto candidate and inductiveness obligation; this source is a proof task, not evidence that the theorem was proved
    • proof coverage limit: preservation of an invariant candidate is distinct from proving initialization and deriving the desired system guarantee

  • YUH-Z-lmgpa / benchmarks/distributed_ind_inv/11_TwoPhase.tla

    • specified: distributed-protocol inductive-invariant benchmark: TwoPhase
    • artifact kind: protocol/specification variant
    • tool: TLA+
    • size: 201 physical lines; exact source
    • safety: TypeOK (statement); IndAuto (statement); Inductiveness (statement)
      • source line: “TypeOK == ”
      • source line: “IndAuto ==”
        • next line: “ /\ TypeOK”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified
    • benchmark status: supplied IndAuto candidate and inductiveness obligation; this source is a proof task, not evidence that the theorem was proved
    • proof coverage limit: preservation of an invariant candidate is distinct from proving initialization and deriving the desired system guarantee

  • YUH-Z-lmgpa / benchmarks/distributed_ind_inv/13_simple_decentralized_lock.tla

    • specified: distributed-protocol inductive-invariant benchmark: simple decentralized lock
    • artifact kind: protocol/specification variant
    • tool: TLA+
    • size: 71 physical lines; exact source
    • safety: TypeOK (statement); Inv (statement); IndAuto (statement); Inductiveness (statement)
      • source line: “TypeOK == ”
        • next line: “ /\ message \in SUBSET (Node \X Node)”
      • source line: “Inv == \A x,y \in Node : (x \in has_lock /\ y \in has_lock) => (x = y)”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified
    • benchmark status: supplied IndAuto candidate and inductiveness obligation; this source is a proof task, not evidence that the theorem was proved
    • proof coverage limit: preservation of an invariant candidate is distinct from proving initialization and deriving the desired system guarantee

  • YUH-Z-lmgpa / benchmarks/distributed_ind_inv/14_two_phase_commit.tla

    • specified: distributed-protocol inductive-invariant benchmark: two phase commit
    • artifact kind: protocol/specification variant
    • tool: TLA+
    • size: 138 physical lines; exact source
    • safety: TypeOK (statement); Safety (statement); IndAuto (statement); Inductiveness (statement)
      • source line: “TypeOK ==”
        • next line: “ /\ vote_yes \in SUBSET Node”
      • source line: “Safety == ”
        • next line: “ /\ \A n,n2 \in Node : (n \in decide_commit) => (n2 \notin decide_abort) ”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified
    • benchmark status: supplied IndAuto candidate and inductiveness obligation; this source is a proof task, not evidence that the theorem was proved
    • proof coverage limit: preservation of an invariant candidate is distinct from proving initialization and deriving the desired system guarantee

  • YUH-Z-lmgpa / benchmarks/distributed_ind_inv/15_consensus_wo_decide.tla

    • specified: distributed-protocol inductive-invariant benchmark: consensus wo decide
    • artifact kind: protocol/specification variant
    • tool: TLA+
    • size: 158 physical lines; exact source
    • safety: TypeOK (statement); Safety (statement); IndAuto (statement); Inductiveness (statement)
      • source line: “TypeOK == ”
        • next line: “ /\ vote_request_msg \in [Node \X Node -> BOOLEAN]”
      • source line: “Safety == \A i,j \in Node : (leader[i] /\ leader[j]) => (i = j)”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified
    • benchmark status: supplied IndAuto candidate and inductiveness obligation; this source is a proof task, not evidence that the theorem was proved
    • proof coverage limit: preservation of an invariant candidate is distinct from proving initialization and deriving the desired system guarantee

  • YUH-Z-lmgpa / benchmarks/distributed_ind_inv/16_consensus_forall.tla

    • specified: distributed-protocol inductive-invariant benchmark: consensus forall
    • artifact kind: protocol/specification variant
    • tool: TLA+
    • size: 136 physical lines; exact source
    • safety: TypeOK (statement); Safety (statement); IndAuto (statement); Inductiveness (statement)
      • source line: “TypeOK == ”
        • next line: “ /\ vote_request_msg \in SUBSET (Node \X Node)”
      • source line: “Safety == ”
        • next line: “ \A n1,n2 \in Node : \A v1,v2 \in Value : ”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified
    • benchmark status: supplied IndAuto candidate and inductiveness obligation; this source is a proof task, not evidence that the theorem was proved
    • proof coverage limit: preservation of an invariant candidate is distinct from proving initialization and deriving the desired system guarantee

  • YUH-Z-lmgpa / benchmarks/distributed_ind_inv/19_sharded_kv_no_lost_keys.tla

    • specified: distributed-protocol inductive-invariant benchmark: sharded kv no lost keys
    • artifact kind: protocol/specification variant
    • tool: TLA+
    • size: 86 physical lines; exact source
    • safety: TypeOK (statement); Safety (statement); IndAuto (statement); Inductiveness (statement)
      • source line: “TypeOK ==”
        • next line: “ /\ table \in [Node -> [Key -> Value \cup {Nil}]]”
      • source line: “Safety == ”
        • next line: “ / \E n \in Node, k \in Key, v \in Value : <<n,k,v>> \in transfer_msg ”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified
    • benchmark status: supplied IndAuto candidate and inductiveness obligation; this source is a proof task, not evidence that the theorem was proved
    • proof coverage limit: preservation of an invariant candidate is distinct from proving initialization and deriving the desired system guarantee

  • YUH-Z-lmgpa / benchmarks/distributed_ind_inv/1_Consensus.tla

    • specified: distributed-protocol inductive-invariant benchmark: Consensus
    • artifact kind: protocol/specification variant
    • tool: TLA+
    • size: 40 physical lines; exact source
    • safety: TypeOK (statement); Inv (statement); IndAuto (statement); Inductiveness (statement)
      • source line: “TypeOK == /\ chosen \in SUBSET Value”
      • source line: “Inv == /\ TypeOK”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified
    • benchmark status: supplied IndAuto candidate and inductiveness obligation; this source is a proof task, not evidence that the theorem was proved
    • proof coverage limit: preservation of an invariant candidate is distinct from proving initialization and deriving the desired system guarantee

  • YUH-Z-lmgpa / benchmarks/distributed_ind_inv/20_naive_consensus.tla

    • specified: distributed-protocol inductive-invariant benchmark: naive consensus
    • artifact kind: protocol/specification variant
    • tool: TLA+
    • size: 80 physical lines; exact source
    • safety: TypeOK (statement); Safety (statement); IndAuto (statement); Inductiveness (statement)
      • source line: “TypeOK == ”
        • next line: “ /\ vote \in SUBSET (Node \X Value)”
      • source line: “Safety == \A v1,v2 \in Value : (v1 \in decision /\ v2 \in decision) => (v1=v2)”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified
    • benchmark status: supplied IndAuto candidate and inductiveness obligation; this source is a proof task, not evidence that the theorem was proved
    • proof coverage limit: preservation of an invariant candidate is distinct from proving initialization and deriving the desired system guarantee

  • YUH-Z-lmgpa / benchmarks/distributed_ind_inv/21_client_server_ae.tla

    • specified: distributed-protocol inductive-invariant benchmark: client server ae
    • artifact kind: protocol/specification variant
    • tool: TLA+
    • size: 72 physical lines; exact source
    • safety: TypeOK (statement); Safety (statement); IndAuto (statement); Inductiveness (statement)
      • source line: “TypeOK ==”
        • next line: “ /\ match \in SUBSET (Request \X Response)”
      • source line: “Safety == \A n \in Node, p \in Response : (<<n,p>> \in response_received) => ResponseMatched(n,p)”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified
    • benchmark status: supplied IndAuto candidate and inductiveness obligation; this source is a proof task, not evidence that the theorem was proved
    • proof coverage limit: preservation of an invariant candidate is distinct from proving initialization and deriving the desired system guarantee

  • YUH-Z-lmgpa / benchmarks/distributed_ind_inv/22_simple_election.tla

    • specified: distributed-protocol inductive-invariant benchmark: simple election
    • artifact kind: protocol/specification variant
    • tool: TLA+
    • size: 79 physical lines; exact source
    • safety: TypeOK (statement); Safety (statement); IndAuto (statement); Inductiveness (statement)
      • source line: “TypeOK ==”
        • next line: “ /\ start \in SUBSET Proposer”
      • source line: “Safety == \A pi,pj \in Proposer : (pi \in leader /\ pj \in leader) => (pi = pj)”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified
    • benchmark status: supplied IndAuto candidate and inductiveness obligation; this source is a proof task, not evidence that the theorem was proved
    • proof coverage limit: preservation of an invariant candidate is distinct from proving initialization and deriving the desired system guarantee

  • YUH-Z-lmgpa / benchmarks/distributed_ind_inv/23_toy_consensus_epr.tla

    • specified: distributed-protocol inductive-invariant benchmark: toy consensus epr
    • artifact kind: protocol/specification variant
    • tool: TLA+
    • size: 75 physical lines; exact source
    • safety: TypeOK (statement); Safety (statement); IndAuto (statement); Inductiveness (statement)
      • source line: “TypeOK == ”
        • next line: “ /\ voted \in SUBSET Node”
      • source line: “Safety == \A vi,vj \in decided : vi = vj”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified
    • benchmark status: supplied IndAuto candidate and inductiveness obligation; this source is a proof task, not evidence that the theorem was proved
    • proof coverage limit: preservation of an invariant candidate is distinct from proving initialization and deriving the desired system guarantee

  • YUH-Z-lmgpa / benchmarks/distributed_ind_inv/24_toy_consensus.tla

    • specified: distributed-protocol inductive-invariant benchmark: toy consensus
    • artifact kind: protocol/specification variant
    • tool: TLA+
    • size: 69 physical lines; exact source
    • safety: TypeOK (statement); Inv (statement); IndAuto (statement); Inductiveness (statement)
      • source line: “TypeOK == ”
        • next line: “ /\ vote \in [Node -> Value \cup {Nil}]”
      • source line: “Inv == \A vi, vj \in decision : vi = vj”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified
    • benchmark status: supplied IndAuto candidate and inductiveness obligation; this source is a proof task, not evidence that the theorem was proved
    • proof coverage limit: preservation of an invariant candidate is distinct from proving initialization and deriving the desired system guarantee

  • YUH-Z-lmgpa / benchmarks/distributed_ind_inv/25_client_server_db_ae.tla

    • specified: distributed-protocol inductive-invariant benchmark: client server db ae
    • artifact kind: protocol/specification variant
    • tool: TLA+
    • size: 124 physical lines; exact source
    • safety: TypeOK (statement); Safety (statement); IndAuto (statement); Inductiveness (statement)
      • source line: “TypeOK ==”
        • next line: “ /\ match \in SUBSET (Request \X Response)”
      • source line: “Safety == \A n \in Node, p \in Response : (<<n,p>> \in response_received) => ResponseMatched(n,p)”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified
    • benchmark status: supplied IndAuto candidate and inductiveness obligation; this source is a proof task, not evidence that the theorem was proved
    • proof coverage limit: preservation of an invariant candidate is distinct from proving initialization and deriving the desired system guarantee

  • YUH-Z-lmgpa / benchmarks/distributed_ind_inv/27_firewall.tla

    • specified: distributed-protocol inductive-invariant benchmark: firewall
    • artifact kind: protocol/specification variant
    • tool: TLA+
    • size: 70 physical lines; exact source
    • safety: Inv (statement); TypeOK (statement); IndAuto (statement); Inductiveness (statement)
      • source line: “Inv == ”
        • next line: “ \A s,d \in Node:”
      • source line: “TypeOK ==”
        • next line: “ /\ internal \in [Node -> BOOLEAN]”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified
    • benchmark status: supplied IndAuto candidate and inductiveness obligation; this source is a proof task, not evidence that the theorem was proved
    • proof coverage limit: preservation of an invariant candidate is distinct from proving initialization and deriving the desired system guarantee

  • YUH-Z-lmgpa / benchmarks/distributed_ind_inv/28_majorityset_leader_election.tla

    • specified: distributed-protocol inductive-invariant benchmark: majorityset leader election
    • artifact kind: protocol/specification variant
    • tool: TLA+
    • size: 86 physical lines; exact source
    • safety: TypeOK (statement); Safety (statement); IndAuto (statement); Inductiveness (statement)
      • source line: “TypeOK ==”
        • next line: “ /\ vote \in [Node -> SUBSET Node]”
      • source line: “Safety == \A x,y \in Node : (x \in leader) /\ (y \in leader) => (x = y)”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified
    • benchmark status: supplied IndAuto candidate and inductiveness obligation; this source is a proof task, not evidence that the theorem was proved
    • proof coverage limit: preservation of an invariant candidate is distinct from proving initialization and deriving the desired system guarantee

  • YUH-Z-lmgpa / benchmarks/distributed_ind_inv/29_consensus_epr.tla

    • specified: distributed-protocol inductive-invariant benchmark: consensus epr
    • artifact kind: protocol/specification variant
    • tool: TLA+
    • size: 154 physical lines; exact source
    • safety: TypeOK (statement); Safety (statement); SafetyWithTypeOK (statement); IndAuto (statement); Inductiveness (statement)
      • source line: “TypeOK == ”
        • next line: “ /\ vote_request_msg \in SUBSET(Node \X Node)”
      • source line: “Safety ==”
        • next line: “ \A n1,n2 \in Node, v1,v2 \in Value : ”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified
    • benchmark status: supplied IndAuto candidate and inductiveness obligation; this source is a proof task, not evidence that the theorem was proved
    • proof coverage limit: preservation of an invariant candidate is distinct from proving initialization and deriving the desired system guarantee

  • YUH-Z-lmgpa / benchmarks/distributed_ind_inv/2_TCommit.tla

    • specified: distributed-protocol inductive-invariant benchmark: TCommit
    • artifact kind: protocol/specification variant
    • tool: TLA+
    • size: 72 physical lines; exact source
    • safety: TCTypeOK (statement); IndAuto (statement); Inductiveness (statement)
      • source line: “TCTypeOK == ”
      • source line: “IndAuto ==”
        • next line: “ /\ TCTypeOK”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified
    • benchmark status: supplied IndAuto candidate and inductiveness obligation; this source is a proof task, not evidence that the theorem was proved
    • proof coverage limit: preservation of an invariant candidate is distinct from proving initialization and deriving the desired system guarantee

  • YUH-Z-lmgpa / benchmarks/distributed_ind_inv/30_MongoLoglessDynamicRaft.tla

    • specified: distributed-protocol inductive-invariant benchmark: MongoLoglessDynamicRaft
    • artifact kind: protocol/specification variant
    • tool: TLA+
    • size: 249 physical lines; exact source
    • safety: Safety (statement); BoundedSeq (statement); TypeOK (statement); IndAuto (statement); Inductiveness (statement)
      • source line: “Safety == ”
        • next line: “ /\ OnePrimaryPerTerm”
      • source line: “BoundedSeq(S, n) == SeqOf(S, n)”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified
    • benchmark status: supplied IndAuto candidate and inductiveness obligation; this source is a proof task, not evidence that the theorem was proved
    • proof coverage limit: preservation of an invariant candidate is distinct from proving initialization and deriving the desired system guarantee

  • YUH-Z-lmgpa / benchmarks/distributed_ind_inv/3_lockserver.tla

    • specified: distributed-protocol inductive-invariant benchmark: lockserver
    • artifact kind: protocol/specification variant
    • tool: TLA+
    • size: 76 physical lines; exact source
    • safety: TypeOK (statement); Inv (statement); IndAuto (statement); Inductiveness (statement)
      • source line: “TypeOK == ”
        • next line: “ /\ semaphore \in [Server -> BOOLEAN]”
      • source line: “Inv == \A ci,cj \in Client : (clientlocks[ci] \cap clientlocks[cj] # {}) => (ci = cj)”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified
    • benchmark status: supplied IndAuto candidate and inductiveness obligation; this source is a proof task, not evidence that the theorem was proved
    • proof coverage limit: preservation of an invariant candidate is distinct from proving initialization and deriving the desired system guarantee

  • YUH-Z-lmgpa / benchmarks/distributed_ind_inv/4_quorum_leader_election.tla

    • specified: distributed-protocol inductive-invariant benchmark: quorum leader election
    • artifact kind: protocol/specification variant
    • tool: TLA+
    • size: 64 physical lines; exact source
    • safety: Inv (statement); TypeOK (statement); IndAuto (statement); Inductiveness (statement)
      • source line: “Inv == \A i,j \in Node : (isleader[i] /\ isleader[j]) => (i=j)”
      • source line: “TypeOK ==”
        • next line: “ /\ isleader \in [Node -> BOOLEAN]”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified
    • benchmark status: supplied IndAuto candidate and inductiveness obligation; this source is a proof task, not evidence that the theorem was proved
    • proof coverage limit: preservation of an invariant candidate is distinct from proving initialization and deriving the desired system guarantee

  • YUH-Z-lmgpa / benchmarks/distributed_ind_inv/5_toy_consensus_forall.tla

    • specified: distributed-protocol inductive-invariant benchmark: toy consensus forall
    • artifact kind: protocol/specification variant
    • tool: TLA+
    • size: 100 physical lines; exact source
    • safety: Inv (statement); TypeOK (statement); IndAuto (statement); Inductiveness (statement)
      • source line: “Inv == \A vi,vj \in decided : vi = vj”
      • source line: “TypeOK == ”
        • next line: “ /\ vote \in [Node -> Value \cup {Nil}]”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified
    • benchmark status: supplied IndAuto candidate and inductiveness obligation; this source is a proof task, not evidence that the theorem was proved
    • proof coverage limit: preservation of an invariant candidate is distinct from proving initialization and deriving the desired system guarantee

  • YUH-Z-lmgpa / benchmarks/distributed_ind_inv/6_Simple.tla

    • specified: distributed-protocol inductive-invariant benchmark: Simple
    • artifact kind: protocol/specification variant
    • tool: TLA+
    • size: 137 physical lines; exact source
    • safety: Terminating (statement); PCorrect (statement); TypeOK (statement); IndAuto (statement); Inductiveness (statement)
      • source line: “Terminating == /\ \A self \in ProcSet: pc[self] = “Done””
      • source line: “PCorrect == (\A i \in 0..(N-1) : pc[i] = “Done”) => ”
    • liveness: Termination (statement)
      • source line: “Termination == <>(\A self \in ProcSet: pc[self] = “Done”)”
    • evidence/status: specification/model-checking source; no local machine-checked proof identified
    • benchmark status: supplied IndAuto candidate and inductiveness obligation; this source is a proof task, not evidence that the theorem was proved
    • proof coverage limit: preservation of an invariant candidate is distinct from proving initialization and deriving the desired system guarantee

  • YUH-Z-lmgpa / benchmarks/distributed_ind_inv/7_lockserv_automaton.tla

    • specified: distributed-protocol inductive-invariant benchmark: lockserv automaton
    • artifact kind: protocol/specification variant
    • tool: TLA+
    • size: 100 physical lines; exact source
    • safety: TypeOK (statement); Mutex (statement); IndAuto (statement); Inductiveness (statement)
      • source line: “TypeOK == ”
        • next line: “ /\ lock_msg \in [Node -> BOOLEAN]”
      • source line: “Mutex == \A x,y \in Node : (holds_lock[x] /\ holds_lock[y]) => (x = y)”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified
    • benchmark status: supplied IndAuto candidate and inductiveness obligation; this source is a proof task, not evidence that the theorem was proved
    • proof coverage limit: preservation of an invariant candidate is distinct from proving initialization and deriving the desired system guarantee

  • YUH-Z-lmgpa / benchmarks/distributed_ind_inv/8_SimpleRegular.tla

    • specified: distributed-protocol inductive-invariant benchmark: SimpleRegular
    • artifact kind: protocol/specification variant
    • tool: TLA+
    • size: 150 physical lines; exact source
    • safety: PCorrect (statement); TypeOK (statement); IndAuto (statement); Inductiveness (statement)
      • source line: “PCorrect == (\A i \in 0..(N-1) : pc[i] = “Done”) => ”
      • source line: “TypeOK == /\ x \in [0..(N-1) -> {{0}, {1}, {0,1}}]”
    • liveness: Termination (statement)
      • source line: “Termination == <>(\A self \in ProcSet: pc[self] = “Done”)”
    • evidence/status: specification/model-checking source; no local machine-checked proof identified
    • benchmark status: supplied IndAuto candidate and inductiveness obligation; this source is a proof task, not evidence that the theorem was proved
    • proof coverage limit: preservation of an invariant candidate is distinct from proving initialization and deriving the desired system guarantee

  • YUH-Z-lmgpa / benchmarks/distributed_ind_inv/9_sharded_kv.tla

    • specified: distributed-protocol inductive-invariant benchmark: sharded kv
    • artifact kind: protocol/specification variant
    • tool: TLA+
    • size: 95 physical lines; exact source
    • safety: TypeOK (statement); Safety (statement); IndAuto (statement); Inductiveness (statement)
      • source line: “TypeOK ==”
        • next line: “ /\ table \in [Node -> [Key -> Value \cup {Nil}]]”
      • source line: “Safety == ”
        • next line: “ \A n1,n2 \in Node, k \in Key, v1,v2 \in Value : ”
    • liveness: no named local property found; support/instance modules may inherit properties
    • evidence/status: specification/model-checking source; no local machine-checked proof identified
    • benchmark status: supplied IndAuto candidate and inductiveness obligation; this source is a proof task, not evidence that the theorem was proved
    • proof coverage limit: preservation of an invariant candidate is distinct from proving initialization and deriving the desired system guarantee

Additional Lean and Isabelle proof artifacts

  • Flexible Paxos inductive transition system

    • specified: acceptor promise/accept actions with separate phase-one and phase-two quorums
    • tool: Lean 4; machine-checkable proof source, not rerun
    • size: 190 physical lines; exact source
    • safety: state/actions defined here; SafeValue and agreement are proved in Proof.lean
    • liveness: no progress guarantee claimed
    • source scan: no literal sorry or axiom found; compilation not rerun

  • Flexible Paxos reachable-state safety proof

    • specified: inductive safety argument for the Flexible Paxos state/actions model
    • tool: Lean 4; machine-checkable proof source, not rerun
    • size: 598 physical lines; exact source
    • safety: reachable_safeValue and reachable_safety; every reachable state allows at most one agreed value
    • liveness: no progress guarantee claimed
      • source: “private theorem certificate_safe”; statement
      • source: “theorem safeValue”; statement
      • source: “theorem reachable_safeValue”; statement
      • source: “theorem safety”; statement
      • source: “theorem reachable_safety”; statement
    • source scan: no literal sorry or axiom found; compilation not rerun

  • channel-counting termination-detector correctness proof

    • specified: reports of global termination from per-channel message counts
    • tool: Isabelle/HOL; machine-checkable proof source, not rerun
    • size: 283 physical lines; exact source
    • safety: every reported termination has no messages still in flight
    • liveness: no progress guarantee claimed

Scope evidence and discovery limits

  • Flexible Paxos README: “The proof covers the literal TLA+ NoFutureProposal, SafeValue, and Safety definitions.”; repository README
  • distributed termination README: “The proof is checked by TLAPS, the TLA+ Proof System”; repository README
  • added TLA+ artifact rows: 112; Lean/Isabelle artifact rows: 3; per-repository TLA+ counts: nano-o-MultiPaxos 5, fpaxos-fpaxos-tlaplus 5, Starydark-Tencent-Paxos-TLA 8, muratdem-PlusCal-examples 17, HappyCS-Gu-Parallel-Raft-tla 3, tschottdorf-caspaxos-tla 2, sanjosh-tlaplus 8, nano-o-Distributed-termination-detection 4, nano-o-Caesar 12, muratdem-HLC 3, efficient-epaxos 1, losa-leaderless 9, losa-assignment 3, losa-M2Paxos 6, YUH-Z-lmgpa 26
  • identical source files omitted from row counts:
    • muratdem-PlusCal-examples/str1.tla duplicates muratdem-PlusCal-examples/Streamlet/str1.tla byte for byte
    • muratdem-PlusCal-examples/str2.tla duplicates muratdem-PlusCal-examples/Streamlet/str2.tla byte for byte
    • HappyCS-Gu-Parallel-Raft-tla/specification/MultiPaxos.tla duplicates HappyCS-Gu-Parallel-Raft-tla/MultiPaxos.tla byte for byte
    • HappyCS-Gu-Parallel-Raft-tla/specification/ParallelRaftCE.tla duplicates HappyCS-Gu-Parallel-Raft-tla/ParallelRaftCE.tla byte for byte
    • HappyCS-Gu-Parallel-Raft-tla/specification/ParallelRaftSE.tla duplicates HappyCS-Gu-Parallel-Raft-tla/ParallelRaftSE.tla byte for byte
    • losa-leaderless/Maps.tla duplicates nano-o-Caesar/Maps.tla byte for byte
    • losa-leaderless/Quorums.tla duplicates nano-o-Caesar/Quorums.tla byte for byte
  • excluded muratdem-PlusCal-examples/Puzzles/CabbageGoatWolf_Pluscal.tla: ordinary sequential puzzle
  • source archives included: leaderless files, assignment files, M2Paxos archive; fetched 2026-10-07, archive files not commit pinned
  • failed discovery: web search tool returned HTTP 404 on /alpha/search; GitHub Naiad tree API returned HTTP 403 rate limit; author asynchronousCommunication HTTPS handshake timed out and HTTP request timed out; NfC04 author page returned HTTP 403; guessed Lamport tla/fast-paxos.html returned HTTP 404; Microsoft Fast Paxos publication page exposed no source archive link in the inspected links
  • residual gaps: original Lamport Fast Paxos source not located beyond existing SimplifiedFastPaxos and Murat Demirbas Paxos/fpax1.tla; DataPort/L1/Naiad references in Examples advertise only PDF files; PDF-only entries are not counted as repository source problems
  • Naiad source search: shallow clone of MicrosoftResearch/Naiad contains no .tla or .thy; source claim remains unlocated
  • LMGPA: inventoried all 26 files in benchmarks/distributed_ind_inv; excluded mathematical benchmarks and generated attempt/result copies; README
  • all 11 protocol/source GitHub clones succeeded; an additional MicrosoftResearch/Naiad clone succeeded but contained no .tla or .thy source in the inspected checkout; no proof assistant or model checker was executed

Industrial specifications and P

TLA+ / PlusCal: industrial source specifications

  • scope and measurement
    • primary modules get separate rows; model-checking configuration, trace-validation wrappers, and imported helpers stay with their underlying problem unless they define a different model
    • property names are verbatim source quotations; plain descriptions of their intent are inferences from the definitions
    • these files and configurations show intended checks, not successful reruns; no model checker or proof checker was run for this inventory
  • MongoDB exploratory Raft single-member reconfiguration
    • specifies: Raft replication with original Raft single-server membership changes
    • safety: no separate property configuration found; transition/state definitions present
    • liveness: Liveness supplies strong/weak scheduling fairness only; no separate eventual outcome is stated
    • tool and evidence: TLA+; TLC configurations, no TLAPS proof found
    • measured size: 263 physical lines in RaftMongoWithRaftReconfig.tla; comments and blank lines included
    • fairness premises: the operator Liveness restricts scheduling so enabled replication, rollback and selected write actions cannot be postponed forever; these are assumptions used to check progress, not independently proved eventual outcomes
  • MongoDB Raft replication
    • source caveat: “NeverRollbackCommitted and NeverRollbackBeforeCommitPoint can be violated”; the configuration points to SERVER-39626 and says the required five-server state space is larger than easily checked
    • specifies: primary elections, oplog replication, rollback and commit-point propagation
    • safety: at most one primary per election term; committed log entries and entries before the local commit point cannot be rolled back; source: NoTwoPrimariesInSameTerm, NeverRollbackCommitted, NeverRollbackBeforeCommitPoint
    • liveness: nodes with different commit points eventually agree after rollback stops; source: CommitPointEventuallyPropagates
    • tool and evidence: TLA+; TLC configurations, no TLAPS proof found
    • measured size: 331 physical lines in RaftMongo.tla; comments and blank lines included; MCRaftMongo.cfg states the enabled checks
    • fairness premises: the operator Liveness restricts scheduling so enabled replication, rollback and selected write actions cannot be postponed forever; these are assumptions used to check progress, not independently proved eventual outcomes
  • MongoDB Raft replication timestamps
    • specifies: replication with persistence, application, restart and failover
    • safety: at most one primary per term; committed entries and the committed storage snapshot must survive rollback; source: NoTwoPrimariesInSameTerm, NeverRollbackCommitted, NeverRollbackBeforeCommitPoint, CommittedSnapshotNeverRollback
    • liveness: commit-point agreement is the intended target, but its check is disabled; source: CommitPointEventuallyPropagates is commented out; fairness remains in Liveness
    • tool and evidence: TLA+; TLC configurations, no TLAPS proof found
    • measured size: 445 physical lines in RaftMongoReplTimestamp.tla; comments and blank lines included; MCRaftMongoReplTimestamp.cfg states the enabled checks
    • fairness premises: the operator Liveness restricts scheduling so enabled replication, rollback and selected write actions cannot be postponed forever; these are assumptions used to check progress, not independently proved eventual outcomes
  • MongoDB replica-set reconfiguration
    • specifies: single-node membership changes
    • safety: at most one primary per term, and committed entries are never rolled back; source: ElectionSafety, NeverRollbackCommitted (temporal safety; PROPERTY does not itself mean liveness)
    • liveness: eventually, either rollback becomes possible or live configuration members agree on their configuration; eventually, either rollback becomes possible or a leader exists; source: ConfigEventuallyPropagates, ElectableNodeEventuallyExists are defined but not enabled in shipped configuration
    • tool and evidence: TLA+; TLC configurations, no TLAPS proof found
    • measured size: 492 physical lines in MongoReplReconfig.tla; comments and blank lines included; MCMongoReplReconfig.cfg states the enabled checks
    • fairness premises: Liveness assumes weak fairness for election, configuration propagation, term updates, replication, rollback and commits; the named eventual outcomes above are separate obligations
  • MongoDB range migration and reads
    • specifies: range migration commit, query routing and ownership filtering
    • safety: queries return no duplicate keys; routing and shard-ownership ranges do not overlap outside the allowed critical section; placement versions reflect ownership; source: RoutingUntimestampedReads, RoutingTableConsistent, ShardOwnershipConsistent, UniqueKeysReturned, OwningShardsHaveNonZeroPlacementVersion, NotOwningShardsHaveZeroPlacementVersion
    • liveness: the query eventually returns every key; source: PropertyAllKeysReturned is defined but disabled in shipped configuration
    • tool and evidence: TLA+; TLC configurations, no TLAPS proof found
    • measured size: 487 physical lines in MoveRange.tla; comments and blank lines included; MCMoveRange.cfg states the enabled checks
    • fairness premises: Fairness restricts action scheduling; fairness assumptions alone do not establish the eventual properties above
  • MongoDB transactions during range migration
    • specifies: multi-statement transactions and placement-conflict protocol
    • safety: a committed transaction has successful statements and can see every requested key; source: TypeOK, CommittedTxnImpliesAllStmtsSuccessful, CommittedTxnImpliesKeysAreVisible
    • liveness: each transaction eventually commits or aborts, and its locks are eventually released; source: AllTxnsEventuallyDone, AllLocksEventuallyRescinded are defined but disabled
    • tool and evidence: TLA+; TLC configurations, no TLAPS proof found
    • measured size: 315 physical lines in TxnsMoveRange.tla; comments and blank lines included; MCTxnsMoveRange.cfg states the enabled checks
    • fairness premises: Fairness restricts action scheduling; fairness assumptions alone do not establish the eventual properties above
  • MongoDB transactions and collection incarnation
    • specifies: transactions concurrent with collection/database metadata changes
    • safety: a committed transaction has successful statements and a consistent key set; responses for namespaces unknown to the router come from the primary shard; source: CommittedTxnImpliesAllStmtsSuccessful, CommittedTxnImpliesConsistentKeySet, ResponseForUntrackedNameSpaceIsFromPrimaryShard (temporal safety)
    • liveness: each transaction eventually commits or aborts and releases acquired resources; source: AllTxnsEventuallyDone, AcquiredTxnResourcesEventuallyReleased are defined but disabled
    • tool and evidence: TLA+; TLC configurations, no TLAPS proof found
    • measured size: 566 physical lines in TxnsCollectionIncarnation.tla; comments and blank lines included; MCTxnsCollectionIncarnation.cfg states the enabled checks
    • fairness premises: Fairness restricts action scheduling; fairness assumptions alone do not establish the eventual properties above
  • MongoDB secondary-node range deletion
    • specifies: range deletion concurrent with query snapshot advancement
    • safety: a query that finishes normally reads all documents; the range-preservation guard is invalidated before deletion becomes visible; source: TypeOK, QueryShouldReadAllDocs, RangePreserverShouldBeInvalidatedBeforeRangeDeletionGetsVisible
    • liveness: the deletion executes, the guard is invalidated, and the query eventually finishes or is killed; source: RangeDeletionIsExecuted, RangePreserverIsInvalidated, Termination
    • tool and evidence: TLA+; TLC configurations, no TLAPS proof found
    • measured size: 187 physical lines in RangeDeletionsSecondaryNodes.tla; comments and blank lines included; MCRangeDeletionsSecondaryNodes.cfg states the enabled checks
    • fairness premises: Fairness restricts action scheduling; fairness assumptions alone do not establish the eventual properties above
  • MongoDB ordered ticket semaphore
    • specifies: concurrent acquire/release and resize; source says “demonstrate a deadlock”
    • safety: the count of held tickets stays nonnegative and matches actual holdings; each client appears once in the wait queue and awakened clients precede sleeping clients; source: TypeOK, TakenNonNegative, TakenMatchesHolding, UniqueWaiters, AwakeBeforeNonAwake
    • liveness: an uninterruptible waiter eventually gets a ticket; any waiter eventually acquires a ticket or leaves the queue; source: WaitingLeadsToHolding, NeverWaitsIndefinitely
    • tool and evidence: TLA+; TLC configurations, no TLAPS proof found
    • measured size: 210 physical lines in OrderedTicketSemaphore.tla; comments and blank lines included; MCOrderedTicketSemaphore.cfg states the enabled checks
    • fairness premises: WF_vars(Next), WF_vars(WakeAndConsume(t)) and WF_vars(DoRelease(t)) restrict scheduling; they are premises for the two progress checks
  • CCF Raft consensus
    • source includes the assertion THEOREM Spec => RefinementToAbsProp; it has no accompanying TLAPS PROOF block
    • specifies: Raft, signatures, membership retirement and pre-voting
    • safety: at most one leader per term; matching log positions agree; committed log prefixes only grow; later leaders retain committed entries; membership transitions and refinement to the abstract log are checked; source: LogInv, MoreThanOneLeaderInv, CandidateTermNotInLogInv, ElectionSafetyInv, LogMatchingInv, QuorumLogInv, LeaderCompletenessInv, SignatureInv, TypeInv, MonoTermInv, MonoLogInv, NoLeaderBeforeInitialTerm, LogConfigurationConsistentInv, MembershipStateConsistentInv, CommitCommittableIndices, ReplicationInv, RetiredCommittedInv, RetirementCompletedNotInConfigsInv, RetirementCompletedAreRetirementCompletedInv, MatchIndexBoundedByLogInv, CommittedLogAppendOnlyProp, MonotonicTermProp, MonotonicMatchIndexProp, PermittedLogChangesProp, StateTransitionsProp, MembershipStateTransitionsProp, PendingBecomesFollowerProp, NeverCommitEntryPrevTermsProp, RefinementToAbsProp
    • liveness: no eventual-progress obligation found in its shipped configuration
    • tool and evidence: TLA+; TLC model checking; no TLAPS proof found
    • measured size: 1793 physical lines in ccfraft.tla; comments and blank lines included; MCccfraft.cfg supplies check names
    • related artifacts: simulation configuration, trace validation; temporal properties here include log monotonicity and refinement, which are safety
  • CCF abstract consensus
    • specifies: abstract append-only log refinement target
    • safety: nodes do not commit conflicting entries, and committed log prefixes only grow; source: NoConflicts, TypeOK, AppendOnlyProp
    • liveness: no eventual-progress obligation found in its shipped configuration
    • tool and evidence: TLA+; TLC model checking; no TLAPS proof found
    • measured size: 116 physical lines in abs.tla; comments and blank lines included; MCabs.cfg supplies check names
  • CCF single-node external history
    • specifies: client read/write transaction history without view changes
    • safety: responses refer to requested transactions; committed histories can be ordered consistently; invalid transactions are excluded from committed observations; each response observes a transaction at most once; source: AllReceivedIsFirstSentInv, AllCommittedObservedInv, OnlyObserveSentRequestsInv, UniqueTxsInv, UniqueTxIdsInv, UniqueSeqNumsInv, CommittedOrInvalidStrongInv, RwSerializableInv, CommittedRwSerializableInv, InvalidNotObservedInv, InvalidNotObservedByCommittedInv, AtMostOnceObservedInv
    • liveness: no eventual-progress obligation found in its shipped configuration
    • tool and evidence: TLA+; TLC model checking; no TLAPS proof found
    • measured size: 141 physical lines in SingleNode.tla; comments and blank lines included; MCSingleNode.cfg supplies check names
  • CCF single-node history with reads
    • specifies: single-node history with explicit read-only observations
    • safety: responses refer to requested transactions; committed histories can be ordered consistently; invalid transactions are excluded from committed observations; each response observes a transaction at most once; source: AllReceivedIsFirstSentInv, AllCommittedObservedInv, OnlyObserveSentRequestsInv, UniqueTxsInv, UniqueTxIdsInv, UniqueSeqNumsInv, CommittedOrInvalidStrongInv, RwSerializableInv, CommittedRwSerializableInv, InvalidNotObservedInv, InvalidNotObservedByCommittedInv, AtMostOnceObservedInv, AllCommittedObservedRoInv
    • liveness: no eventual-progress obligation found in its shipped configuration
    • tool and evidence: TLA+; TLC model checking; no TLAPS proof found
    • measured size: 42 physical lines in SingleNodeReads.tla; comments and blank lines included; MCSingleNodeReads.cfg supplies check names
  • CCF multi-node external history
    • specifies: ledger branches across leader/view changes
    • safety: responses refer to requested transactions; committed histories can be ordered consistently; invalid transactions are excluded from committed observations; each response observes a transaction at most once; committed read/write operations also respect real-time order; source: AllReceivedIsFirstSentInv, AllCommittedObservedInv, OnlyObserveSentRequestsInv, UniqueTxsInv, SameObservationsInv, UniqueTxIdsInv, UniqueTxRequestsInv, UniqueSeqNumsCommittedInv, CommittedOrInvalidStrongInv, CommittedRwSerializableInv, InvalidNotObservedByCommittedInv, AtMostOnceObservedInv, CommittedRwOrderedSpecLinearizableInv
    • liveness: no eventual-progress obligation found in its shipped configuration
    • tool and evidence: TLA+; TLC model checking; no TLAPS proof found
    • measured size: 56 physical lines in MultiNode.tla; comments and blank lines included; MCMultiNode.cfg supplies check names
  • CCF multi-node history with reads
    • specifies: transaction history and read-only observations across views
    • safety: responses refer to requested transactions; committed histories can be ordered consistently; invalid transactions are excluded from committed observations; each response observes a transaction at most once; committed read/write operations also respect real-time order; source: AllReceivedIsFirstSentInv, AllCommittedObservedInv, OnlyObserveSentRequestsInv, UniqueTxsInv, SameObservationsInv, UniqueTxIdsInv, UniqueTxRequestsInv, UniqueSeqNumsCommittedInv, CommittedOrInvalidStrongInv, CommittedRwSerializableInv, InvalidNotObservedByCommittedInv, AtMostOnceObservedInv, CommittedRwOrderedSpecLinearizableInv
    • liveness: no eventual-progress obligation found in its shipped configuration
    • tool and evidence: TLA+; TLC model checking; no TLAPS proof found
    • measured size: 13 physical lines in MultiNodeReads.tla; comments and blank lines included; MCMultiNodeReads.cfg supplies check names
  • CCF alternative multi-node read model
    • specifies: alternate finite model wrapper for multi-node read history
    • safety: responses refer to requested transactions; committed histories can be ordered consistently; invalid transactions are excluded from committed observations; each response observes a transaction at most once; source: AllReceivedIsFirstSentInv, AllCommittedObservedInv, OnlyObserveSentRequestsInv, UniqueTxsInv, SameObservationsInv, UniqueTxIdsInv, UniqueTxRequestsInv, UniqueSeqNumsCommittedInv, CommittedOrInvalidStrongInv, CommittedRwSerializableInv, InvalidNotObservedByCommittedInv, AtMostOnceObservedInv
    • liveness: no eventual-progress obligation found in its shipped configuration
    • tool and evidence: TLA+; TLC model checking; no TLAPS proof found
    • measured size: 24 physical lines in MCMultiNodeReadsAlt.tla; comments and blank lines included; MCMultiNodeReadsAlt.cfg supplies check names
  • CCF abstract consistency
    • specifies: abstract transaction-observation consistency relations
    • safety: no checked invariant listed in its configuration
    • liveness: no eventual-progress obligation found in its shipped configuration
    • tool and evidence: TLA+; TLC model checking; no TLAPS proof found
    • measured size: 360 physical lines in Consistency.tla; comments and blank lines included; Consistency.cfg supplies check names
  • etcd Raft with membership changes
    • specifies: Raft library core algorithm and joint-consensus membership changes
    • safety: at most one leader per term; matching log entries have matching prefixes; later leaders retain committed entries; committed entries remain durable; source: LogInv, MoreThanOneLeaderInv, ElectionSafetyInv, LogMatchingInv, QuorumLogInv, MoreUpToDateCorrectInv, LeaderCompletenessInv, CommittedIsDurableInv
    • liveness: no eventual-progress property configured
    • tool and evidence: TLA+; TLC model checking and implementation-trace validation; no TLAPS proof found
    • measured size: 926 physical lines in etcdraft.tla; comments and blank lines included; configuration; trace validator
  • ZooKeeper Zab protocol
    • specifies: atomic broadcast and leader recovery
    • safety: servers agree on committed history prefixes and delivery order; leaders obey epoch and primary-order rules; transactions are not delivered spuriously or twice; source: Leadership1, Leadership2, PrefixConsistency, Integrity, Agreement, TotalOrder, LocalPrimaryOrder, GlobalPriamryOrder, PrimaryIntegrity, ShouldNotBeTriggered
    • liveness: no eventual-progress/fairness property found
    • tool and evidence: TLA+; model-checking workflow documented for Zab; no TLAPS proof found
    • measured size: 1251 physical lines in Zab.tla; comments and blank lines included
  • ZooKeeper 3.7 system model
    • specifies: Zab as implemented in ZooKeeper 3.7 with election, crash/restart, synchronization and snapshots
    • safety: servers agree on committed history prefixes and delivery order; leader and primary-order rules hold across recovery; source: TypeOK, CheckDuringAction, PrefixConsistency, Agreement, TotalOrder plus leader/primary-order invariants
    • liveness: no eventual-progress/fairness property found
    • tool and evidence: TLA+; model-checking workflow documented for Zab; no TLAPS proof found
    • measured size: 2050 physical lines in ZkV3_7_0.tla; comments and blank lines included
  • ZooKeeper fast leader election
    • specifies: standalone election algorithm module imported by ZooKeeper 3.7 model
    • safety: no standalone checked correctness invariant found; TotalOrderPredicate is an election comparison function
    • liveness: no eventual-progress/fairness property found
    • tool and evidence: TLA+; model-checking workflow documented for Zab; no TLAPS proof found
    • measured size: 553 physical lines in FastLeaderElection.tla; comments and blank lines included
  • CockroachDB store liveness fabric
    • specifies: heartbeat support below Raft, including crash/restart, clock regression and message reordering
    • safety: a node cannot withdraw its promised support before the promised end time; epoch bookkeeping makes support assumptions safe across restarts; source: DurableSupportInvariant, SupportProvidedLeadsSupportAssumedInvariant, CurrentEpochLeadsSupportedEpochsInvariant, WithdrawnSupportMinimumEpochInvariant
    • liveness: no progress property configured; the product name does not imply a liveness proof
    • tool and evidence: PlusCal translated to TLA+; TLC configuration; no TLAPS proof found
    • measured size: 517 physical lines in StoreLiveness.tla; comments and blank lines included; line count includes both PlusCal source and generated translation
  • CockroachDB parallel transaction commits
    • specifies: parallel writes and transaction commit using one distributed-consensus round
    • safety: a success acknowledgement implies the transaction is committed; records, write intents and timestamp-cache updates obey allowed transitions; source: TypeInvariants, AckImpliesCommit, TemporalTxnRecordProperties, TemporalIntentProperties, TemporalTSCacheProperties
    • liveness: an implicit commit or success acknowledgement eventually results in an explicit committed record; source: ImplicitCommitLeadsToExplicitCommit, AckLeadsToExplicitCommit
    • tool and evidence: PlusCal translated to TLA+; TLC configuration; no TLAPS proof found
    • measured size: 919 physical lines in ParallelCommits.tla; comments and blank lines included; line count includes both PlusCal source and generated translation

P: tutorials, proof examples and protocol benchmarks

  • evidence rules
    • repository tutorial states: “we will rely on proofs by induction”; the same introduction names “UCLID5 and Z3” (P verification tutorial)
    • portfolio README: “This folder contains P model checking problems for well-known distributed protocols” (source); it counts 12 Paxos and 8 two-phase-commit problems, but this inventory counts source model variants rather than test parameter settings
    • Proof blocks are proof artifacts; this inventory did not execute the verifier, so successful machine checking is unconfirmed
    • hot state marks a progress monitor; ordinary assertions and invariants are safety obligations
    • portfolio models without assertions remain useful protocol inputs, but do not establish a stated guarantee
  • P tutorial 1 ClientServer
    • specifies: concurrent event-driven ClientServer model
    • safety: successful withdrawals deduct exactly the requested amount while preserving the minimum bank balance; source: BankBalanceIsAlwaysCorrect
    • liveness: every withdrawal request eventually receives a response; source: GuaranteedWithDrawProgress
    • tool and evidence: P; systematic testing/model checking; no proof script found
    • measured size: 115 physical lines in BankBalanceCorrect.p; comments and blank lines included; 445 physical lines across 7 .p files in tutorial directory; excludes imported Common helpers
    • source example: “assert wReq.accountId in balance, “Invalid accountId received in the withdraw request!”;“
  • P tutorial 2 TwoPhaseCommit
    • specifies: concurrent event-driven TwoPhaseCommit model
    • safety: a successful transaction response requires all participants to vote yes; an error response requires a no vote; source: AtomicityInvariant
    • liveness: every submitted write transaction eventually receives a response; source: Progress
    • tool and evidence: P; systematic testing/model checking; no proof script found
    • measured size: 83 physical lines in Atomicity.p; comments and blank lines included; 550 physical lines across 7 .p files in tutorial directory; excludes imported Common helpers
    • source example: “assert transId in pendingWriteTrans,”
  • P tutorial 3 EspressoMachine
    • specifies: concurrent event-driven EspressoMachine model
    • safety: the coffee maker follows WarmUp → Ready → GrindBeans → MakeCoffee → Ready; after an error, it stays in Error until reset; source: EspressoMachineModesOfOperation
    • liveness: no progress monitor found
    • tool and evidence: P; systematic testing/model checking; no proof script found
    • measured size: 53 physical lines in Safety.p; comments and blank lines included; 658 physical lines across 7 .p files in tutorial directory; excludes imported Common helpers
    • source example: “assert coffeeMakerState != NotWarmedUp;”
  • P tutorial 4 FailureDetector
    • specifies: concurrent event-driven FailureDetector model
    • safety: inline assertions only; no separate monitor
    • liveness: every node that has been shut down is eventually reported down; source: ReliableFailureDetector
    • tool and evidence: P; systematic testing/model checking; no proof script found
    • measured size: 57 physical lines in ReliableFailureDetector.p; comments and blank lines included; 293 physical lines across 7 .p files in tutorial directory; excludes imported Common helpers
    • source example: “assert ReliableFailureDetector in”
  • P tutorial 5 Paxos
    • specifies: concurrent event-driven Paxos model
    • safety: once a value is learned, later learned values must be the same; source: OneValueTaught
    • liveness: no progress monitor found
    • tool and evidence: P; systematic testing/model checking; no proof script found
    • measured size: 63 physical lines in common.p; comments and blank lines included; 385 physical lines across 6 .p files in tutorial directory; excludes imported Common helpers
    • source example: “assert OneValueTaught in (union Paxos, { BasicPaxos3on5 });”
  • P tutorial 6 Raft
    • specifies: concurrent event-driven Raft model
    • safety: one leader per term; matching logs share their prefix; new leaders retain committed entries; all replicas apply the same value at each log position; client results match the reference application; source: SafetySynchronization, SafetyLogMatching, SafetyOneLeader, SafetyStateMachine, SafetyLeaderCompleteness
    • liveness: all clients eventually finish, and pending client requests eventually receive responses; source: LivenessClientsDone, LivenessProgress
    • tool and evidence: P; systematic testing/model checking; no proof script found
    • measured size: 94 physical lines in SafetySynchronization.p; comments and blank lines included; 1789 physical lines across 16 .p files in tutorial directory; excludes imported Common helpers
    • source example: “assert this in setup.cluster, “Server should be in the cluster”;“
  • P tutorial PriorityQueue
    • specifies: concurrent event-driven PriorityQueue model
    • safety: inline assertions only; no separate monitor
    • liveness: no progress monitor found
    • tool and evidence: P; systematic testing/model checking; no proof script found
    • measured size: 20 physical lines in PriorityQueue.p; comments and blank lines included; 70 physical lines across 3 .p files in tutorial directory; excludes imported Common helpers
    • source example: “assert element == “Hello” || element == “World” || element == “!!”;“
  • P generated BasicPaxos BasicPaxos_2026_02_23_19_03_15
    • specifies: Paxos acceptor/proposer/learner variant
    • safety: all learned values agree; source: OnlyOneValueChosen; source: “assert chosenValue == payload.learnedValue,”
    • liveness: no progress monitor found
    • tool and evidence: P; model/checking input, no proof artifact found
    • measured size: 19 physical lines in OnlyOneValueChosen.p; comments and blank lines included; 246 lines across 6 .p files
  • P generated BasicPaxos BasicPaxos_2026_02_23_20_05_17
    • specifies: Paxos acceptor/proposer/learner variant
    • safety: all learned values agree; source: OnlyOneValueChosen; source: “assert chosenValue == payload.learnedValue,”
    • liveness: no progress monitor found
    • tool and evidence: P; model/checking input, no proof artifact found
    • measured size: 27 physical lines in OnlyOneValueChosen.p; comments and blank lines included; 300 lines across 6 .p files
  • P advanced 1 ChainReplicationVerification
    • specifies: unbounded protocol model and inductive invariants
    • safety: a successful read returns the value most recently recorded by the reference key-value map; source: StrongConsistency plus auxiliary invariants
    • liveness: no progress proof/monitor found
    • tool and evidence: P symbolic verifier (UCLID5/Z3 backend); invariants/monitor present, no explicit Proof script found
    • measured size: 128 physical lines in System.p; comments and blank lines included
  • P advanced 2 TwoPhaseCommitVerification / KeyValue
    • specifies: unbounded protocol model and inductive invariants
    • safety: a participant commits only when all participants voted yes for the same key/value transaction; source: Consistency plus auxiliary invariants
    • liveness: no progress proof/monitor found
    • tool and evidence: P symbolic verifier (UCLID5/Z3 backend); invariants/monitor present, no explicit Proof script found
    • measured size: 246 physical lines in System.p; comments and blank lines included
  • P advanced 2 TwoPhaseCommitVerification / Rounds
    • specifies: unbounded protocol model and inductive invariants
    • safety: a participant commits only when all participants voted yes for the same round; source: invariant safety: forall (c: Coordinator, p1: Participant, r: Round) :: (r in p1.commited ==> (forall (p2: Participant) :: preference(p2, r) == YES));
    • liveness: no progress proof/monitor found
    • tool and evidence: P symbolic verifier (UCLID5/Z3 backend); invariants/monitor present, no explicit Proof script found
    • measured size: 136 physical lines in System.p; comments and blank lines included
  • P advanced 2 TwoPhaseCommitVerification / Single
    • specifies: unbounded protocol model and inductive invariants
    • safety: a participant commits only when all participants voted yes; source: invariant safety: forall (p1: Participant) :: p1 is Accepted ==> (forall (p2: Participant) :: preference(p2));
    • liveness: no progress proof/monitor found
    • tool and evidence: P symbolic verifier (UCLID5/Z3 backend); explicit Proof script present; successful machine checking not rerun
    • measured size: 129 physical lines in System.p; comments and blank lines included
  • P advanced 3 RingLeaderVerification
    • specifies: unbounded protocol model and inductive invariants
    • safety: at most one node wins the election; source: invariant UniqueLeader: forall (x: machine, y: machine) :: (x is Won && y is Won) ==> x == y;
    • liveness: no progress proof/monitor found
    • tool and evidence: P symbolic verifier (UCLID5/Z3 backend); explicit Proof script present; successful machine checking not rerun
    • measured size: 93 physical lines in System.p; comments and blank lines included
  • P advanced 4 Paxos
    • specifies: unbounded protocol model and inductive invariants
    • safety: all learned values agree; source: invariant unique_proposal:; invariant unique_learned_value:
    • liveness: no progress proof/monitor found
    • tool and evidence: P symbolic verifier (UCLID5/Z3 backend); explicit Proof script present; successful machine checking not rerun
    • measured size: 394 physical lines in System.p; comments and blank lines included
  • P advanced 5 Consensus
    • specifies: unbounded protocol model and inductive invariants
    • safety: at most one node becomes leader; source: invariant unique_leader:
    • liveness: no progress proof/monitor found
    • tool and evidence: P symbolic verifier (UCLID5/Z3 backend); explicit Proof script present; successful machine checking not rerun
    • measured size: 68 physical lines in System.p; comments and blank lines included
  • P advanced 6 DistributedLock
    • specifies: unbounded protocol model and inductive invariants
    • safety: at most one node holds the distributed lock; source: invariant unique_holder: forall (n1: Node, n2: Node) :: n1.held && n2.held ==> n1 == n2;; invariant unique_accept:
    • liveness: no progress proof/monitor found
    • tool and evidence: P symbolic verifier (UCLID5/Z3 backend); explicit Proof script present; successful machine checking not rerun
    • measured size: 41 physical lines in System.p; comments and blank lines included
  • P advanced 7 ShardedKV
    • specifies: unbounded protocol model and inductive invariants
    • safety: each key has at most one owner, including while ownership is transferred; source: invariant unique_key_transfer:; invariant unique_owner:
    • liveness: no progress proof/monitor found
    • tool and evidence: P symbolic verifier (UCLID5/Z3 backend); explicit Proof script present; successful machine checking not rerun
    • measured size: 47 physical lines in System.p; comments and blank lines included
  • P advanced 8 LockServer
    • specifies: unbounded protocol model and inductive invariants
    • safety: at most one node holds a granted lock; source: invariant unique_server: forall (m1: machine, m2: machine) ::; invariant unique_lock_holder:; invariant unique_grant:; invariant unique_unlock:
    • liveness: no progress proof/monitor found
    • tool and evidence: P symbolic verifier (UCLID5/Z3 backend); explicit Proof script present; successful machine checking not rerun
    • measured size: 96 physical lines in System.p; comments and blank lines included
  • P portfolio 2PC/2PCwithBTM/TwoPC
    • specifies: two-phase commit with broadcast transaction manager
    • safety: no assertion, safety monitor or theorem found in this standalone file
    • liveness: no progress monitor found
    • tool and evidence: P; model-checking benchmark input, no proof artifact found
    • measured size: 180 physical lines in TwoPC.p; comments and blank lines included
  • P portfolio BenOr/BenOr
    • specifies: Ben-Or randomized consensus
    • safety: no assertion, safety monitor or theorem found in this standalone file
    • liveness: no progress monitor found
    • tool and evidence: P; model-checking benchmark input, no proof artifact found
    • measured size: 237 physical lines in BenOr.p; comments and blank lines included
  • P portfolio ChangRob/ChangRoberts
    • specifies: Chang–Roberts ring leader election
    • safety: no assertion, safety monitor or theorem found in this standalone file
    • liveness: no progress monitor found
    • tool and evidence: P; model-checking benchmark input, no proof artifact found
    • measured size: 120 physical lines in ChangRoberts.p; comments and blank lines included
  • P portfolio DAO/DAO
    • specifies: decentralized autonomous organization transition model
    • safety: no assertion, safety monitor or theorem found in this standalone file
    • liveness: no progress monitor found
    • tool and evidence: P; model-checking benchmark input, no proof artifact found
    • measured size: 59 physical lines in DAO.p; comments and blank lines included
  • P portfolio German/German
    • identical source also occurs in Integration/Correct/German; counted once
    • specifies: German cache-coherence protocol
    • safety: no assertion, safety monitor or theorem found in this standalone file
    • liveness: no progress monitor found
    • tool and evidence: P; model-checking benchmark input, no proof artifact found
    • measured size: 282 physical lines in German.p; comments and blank lines included
  • P portfolio HClock/HLC
    • specifies: hybrid logical clock
    • safety: no assertion, safety monitor or theorem found in this standalone file
    • liveness: no progress monitor found
    • tool and evidence: P; model-checking benchmark input, no proof artifact found
    • measured size: 128 physical lines in HLC.p; comments and blank lines included
  • P portfolio Paxos/Paxos/Paxos
    • specifies: Paxos consensus variant
    • safety: no assertion, safety monitor or theorem found in this standalone file
    • liveness: no progress monitor found
    • tool and evidence: P; model-checking benchmark input, no proof artifact found
    • measured size: 456 physical lines in Paxos.p; comments and blank lines included
  • P portfolio Paxos/Paxos_map/Paxos_map
    • specifies: Paxos consensus variant
    • safety: no assertion, safety monitor or theorem found in this standalone file
    • liveness: no progress monitor found
    • tool and evidence: P; model-checking benchmark input, no proof artifact found
    • measured size: 508 physical lines in Paxos_map.p; comments and blank lines included
  • P portfolio Paxos/Paxos_seq/Paxos_seq
    • specifies: Paxos consensus variant
    • safety: no assertion, safety monitor or theorem found in this standalone file
    • liveness: no progress monitor found
    • tool and evidence: P; model-checking benchmark input, no proof artifact found
    • measured size: 471 physical lines in Paxos_seq.p; comments and blank lines included
  • P portfolio Paxos/paxosV2/PaxosV2
    • specifies: Paxos consensus variant
    • safety: no assertion, safety monitor or theorem found in this standalone file
    • liveness: no progress monitor found
    • tool and evidence: P; model-checking benchmark input, no proof artifact found
    • measured size: 410 physical lines in PaxosV2.p; comments and blank lines included
  • P portfolio Paxos/paxosV3/PaxosV3
    • specifies: Paxos consensus variant
    • safety: no assertion, safety monitor or theorem found in this standalone file
    • liveness: no progress monitor found
    • tool and evidence: P; model-checking benchmark input, no proof artifact found
    • measured size: 465 physical lines in PaxosV3.p; comments and blank lines included
  • P portfolio Paxos/paxosV4/PaxosV4
    • specifies: Paxos consensus variant
    • safety: no assertion, safety monitor or theorem found in this standalone file
    • liveness: no progress monitor found
    • tool and evidence: P; model-checking benchmark input, no proof artifact found
    • measured size: 571 physical lines in PaxosV4.p; comments and blank lines included
  • P portfolio Paxos/paxosV5/PaxosV5
    • specifies: Paxos consensus variant
    • safety: no assertion, safety monitor or theorem found in this standalone file
    • liveness: no progress monitor found
    • tool and evidence: P; model-checking benchmark input, no proof artifact found
    • measured size: 425 physical lines in PaxosV5.p; comments and blank lines included
  • P portfolio Paxos/paxosV5_no_requires/PaxosV5
    • specifies: Paxos consensus variant
    • safety: no assertion, safety monitor or theorem found in this standalone file
    • liveness: no progress monitor found
    • tool and evidence: P; model-checking benchmark input, no proof artifact found
    • measured size: 260 physical lines in PaxosV5.p; comments and blank lines included
  • P portfolio Streamlet/str0
    • specifies: Streamlet Byzantine consensus
    • safety: no assertion, safety monitor or theorem found in this standalone file
    • liveness: no progress monitor found
    • tool and evidence: P; model-checking benchmark input, no proof artifact found
    • measured size: 164 physical lines in str0.p; comments and blank lines included
  • P portfolio TokenRing/TokenRing
    • specifies: token-ring communication
    • safety: no assertion, safety monitor or theorem found in this standalone file
    • liveness: no progress monitor found
    • tool and evidence: P; model-checking benchmark input, no proof artifact found
    • measured size: 164 physical lines in TokenRing.p; comments and blank lines included
  • P portfolio VoldKV/VoldChain
    • specifies: chain-replicated key-value store
    • safety: no assertion, safety monitor or theorem found in this standalone file
    • liveness: no progress monitor found
    • tool and evidence: P; model-checking benchmark input, no proof artifact found
    • measured size: 320 physical lines in VoldChain.p; comments and blank lines included
  • P portfolio two-phase commit with failures
    • specifies: two-phase commit, client readback and injected node failures
    • safety: a successful transaction requires affirmative votes from all participants; source: AtomicityInvariant; source: “assert participantsResponse[resp.transId][SUCCESS] == numParticipants,”
    • liveness: pending write transactions eventually receive responses; source: Progress; source: “hot state WaitForResponses”
    • tool and evidence: P; systematic testing/model-checking monitors
    • measured size: 83 physical lines in Atomicity.p; comments and blank lines included; 827 lines across 11 .p files including local helpers
  • P shared object with exclusive lock
    • specifies: asynchronous read/modify/write guarded by a lock
    • safety: no standalone safety monitor found
    • liveness: no progress monitor found
    • tool and evidence: P; model-checking input; no proof artifact found
    • measured size: 90 physical lines in LBSharedObject.p; comments and blank lines included; 370 lines across 4 .p files
  • P shared object with reader/writer lock
    • specifies: reader/writer admission and serialized mutations
    • safety: inline assertion: “assert sizeof(waitingReaders) == 0 && sizeof(waitingWriters) == 0, “Logic for picking readers and writers is incorrect!”;“
    • liveness: no progress monitor found
    • tool and evidence: P; model-checking input; no proof artifact found
    • measured size: 187 physical lines in RWLBSharedObject.p; comments and blank lines included; 370 lines across 4 .p files
  • P operating-system resource protocol
    • specifies: concurrent operating-system resource request/response model
    • safety: no standalone safety monitor found
    • liveness: no progress monitor found
    • tool and evidence: P; model-checking input; no proof artifact found
    • measured size: 132 physical lines in OS.p; comments and blank lines included; 426 lines across 5 .p files
  • P regression Feature5ModuleSystem/Correct/Elevator
    • specifies: concurrent protocol regression variant; correct-case fixture
    • safety: no stated safety assertion found
    • liveness: no progress monitor found
    • tool and evidence: P; test/model-checking fixture, no proof artifact found
    • measured size: 278 physical lines in Elevator.p; comments and blank lines included
  • P regression Feature5ModuleSystem/Correct/ElevatorMod
    • specifies: concurrent protocol regression variant; correct-case fixture
    • safety: no stated safety assertion found
    • liveness: no progress monitor found
    • tool and evidence: P; test/model-checking fixture, no proof artifact found
    • measured size: 291 physical lines in Elevator.p; comments and blank lines included
  • P regression Integration/Correct/TokenRing
    • specifies: concurrent protocol regression variant; correct-case fixture
    • safety: no stated safety assertion found
    • liveness: no progress monitor found
    • tool and evidence: P; test/model-checking fixture, no proof artifact found
    • measured size: 166 physical lines in TokenRing.p; comments and blank lines included
  • P regression Integration/Correct/openwsn1
    • specifies: concurrent protocol regression variant; correct-case fixture
    • safety: no stated safety assertion found
    • liveness: no progress monitor found
    • tool and evidence: P; test/model-checking fixture, no proof artifact found
    • measured size: 288 physical lines in openwsn1.p; comments and blank lines included
  • P regression Integration/Correct/two-phase-commit
    • specifies: concurrent protocol regression variant; correct-case fixture
    • safety: M
    • liveness: no progress monitor found
    • tool and evidence: P; test/model-checking fixture, no proof artifact found
    • measured size: 299 physical lines in two-phase-commit.p; comments and blank lines included
  • P regression Integration/DynamicError/Multi_Paxos_3
    • specifies: concurrent protocol regression variant; expected runtime-error case
    • safety: BasicPaxosInvariant_P2b, ValmachineityCheck
    • liveness: no progress monitor found
    • tool and evidence: P; test/model-checking fixture, no proof artifact found
    • measured size: 576 physical lines in Multi_Paxos_3.p; comments and blank lines included
  • P regression Integration/DynamicError/Multi_Paxos_4
    • specifies: concurrent protocol regression variant; expected runtime-error case
    • safety: BasicPaxosInvariant_P2b, ValmachineityCheck
    • liveness: no progress monitor found
    • tool and evidence: P; test/model-checking fixture, no proof artifact found
    • measured size: 579 physical lines in Multi_Paxos_4.p; comments and blank lines included
  • P regression Integration/DynamicError/two-phase-commit_1
    • specifies: concurrent protocol regression variant; expected runtime-error case
    • safety: inline assertions: “assert (pendingWriteReq.seqNum > lastSeqNum);”
    • liveness: no progress monitor found
    • tool and evidence: P; test/model-checking fixture, no proof artifact found
    • measured size: 313 physical lines in two-phase-commit_1.p; comments and blank lines included
  • P resource variant Paxos
    • specifies: additional resource/example model; exact-identical Tutorial/Portfolio files excluded
    • safety: only one value is chosen; proposal numbers increase; accepted values remain consistent; source: SafetyOnlyOneValueChosen, SafetyMonotonicProposalNumbers, SafetyConsistentAcceptedValues
    • liveness: no progress monitor found in nonduplicate files
    • tool and evidence: P; monitor/model input; checker success unconfirmed
    • measured size: 137 physical lines in Safety.p; comments and blank lines included; 601 lines across 7 nonduplicate .p files
  • P resource variant TwoPhaseCommit
    • specifies: additional resource/example model; exact-identical Tutorial/Portfolio files excluded
    • safety: the transaction result agrees with participant votes; source: Atomicity
    • liveness: every transaction request eventually receives a response; source: Progress
    • tool and evidence: P; monitor/model input; checker success unconfirmed
    • measured size: 101 physical lines in Safety.p; comments and blank lines included; 602 lines across 7 nonduplicate .p files
  • P resource variant LockServerPObserve
    • specifies: additional resource/example model; exact-identical Tutorial/Portfolio files excluded
    • safety: only one client holds the lock; grant responses correspond to requests; source: MutualExclusion, ResponseOnlyOnRequest
    • liveness: no progress monitor found in nonduplicate files
    • tool and evidence: P; monitor/model input; checker success unconfirmed
    • measured size: 95 physical lines in LockServerCorrect.p; comments and blank lines included; 95 lines across 1 nonduplicate .p files

searched source repositories with no matching protocol spec found in this checkout

  • apache-kafka: recursive source-file scan found no .tla, .ivy, .qnt, or .p model; this is a checkout finding, not a claim that no public spec exists
  • apache-bookkeeper: recursive source-file scan found no .tla, .ivy, .qnt, or .p model; this is a checkout finding, not a claim that no public spec exists
  • apache-pulsar: recursive source-file scan found no .tla, .ivy, .qnt, or .p model; this is a checkout finding, not a claim that no public spec exists

Invariant and modeling tools

  • scope: one row per source specification/encoding; variants and deliberately buggy models stay separate, so row count is not a count of distinct algorithms

    • size: physical lines, including comments/blanks, of the linked file; excludes imported dependencies unless separately stated
    • evidence: source declarations and proof/checking commands inspected; verification was not executed
    • safety/liveness labels identify stated or attempted targets, not established guarantees; every filename marked bad/buggy/unsafe/error/err/warn has a negative-test warning
    • plain-language readings are inferences from the full nearby formulas; fairness/specification premises and explicitly false targets are separated from intended progress targets
    • property labels below are the repository authors’ names; a state invariant states safety; formulas that contain eventuality state progress, sometimes under fairness assumptions
    • when a row says no declaration found, the protocol may import its contract from another module
    • names describing the system are inferred from filenames and source declarations; linked code is the primary evidence

  • Veil proof boundary: README says “proving safety (and, in the future, liveness)”

    • Base.lean declares veil.smt.trust with defValue := true and explains: “If false, veil_smt asks the SMT backend to reconstruct Lean proofs.”
    • #check_invariants with the default setting is SMT-backed invariant checking; native Lean theorem text is identified separately; no completed Lean-kernel check is claimed here

  • SWISS benchmark README says: “the other one was translated by hand.”; .ivy and .pyv rows are alternative source encodings

  • Ivy: kenmcmil/ivy source cases

    • pingpong (doc/examples/MSV/pingpong.ivy)
      • specifies: ping-pong message exchange
      • safety: assert side = left; (source); assert side = right; (source)
        • plain reading (inference from declaration): the left player acts only when the abstract ball/turn is on the left
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 128 lines in this file; exact source
    • pingpong_bad (doc/examples/MSV/pingpong_bad.ivy)
      • specifies: ping-pong message exchange
      • safety: conjecture left_player.ball -> spec.side = left (source); conjecture right_player.ball -> spec.side = right (source)
        • plain reading (inference from declaration): the left player acts only when the abstract ball/turn is on the left
      • liveness: no active temporal/progress declaration found in this file
      • negative-test warning: the filename marks this as a bad/buggy/unsafe/error variant; displayed properties are attempted checks, not established guarantees
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 64 lines in this file; exact source
    • pingpong_ex (doc/examples/MSV/pingpong_ex.ivy)
      • specifies: ping-pong message exchange
      • safety: assert side = left & ...; (source); assert side = right & ...; (source)
        • plain reading (inference from declaration): the left player acts only when the abstract ball/turn is on the left
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 114 lines in this file; exact source
    • pingpong_soln (doc/examples/MSV/pingpong_soln.ivy)
      • specifies: ping-pong message exchange
      • safety: assert side = left & (val/2)*2 = val; (source); assert side = right & (val/2)*2+1 = val; (source)
        • plain reading (inference from declaration): the left player acts only when the abstract ball/turn is on the left
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 117 lines in this file; exact source
    • repstore1 (doc/examples/MSV/repstore1.ivy)
      • specifies: replicated store
      • safety: assert 0 <= tx & tx < next; (source); assert ~committed(tx); (source); assert committed(tx); (source)
        • plain reading (inference from declaration): the referenced transaction identifier is within the allocated range; an action contract
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 387 lines in this file; exact source
    • repstore2 (doc/examples/MSV/repstore2.ivy)
      • specifies: replicated store
      • safety: assert 0 <= tx & tx < next; (source); assert ~committed(tx); (source); assert committed(tx); (source)
        • plain reading (inference from declaration): the referenced transaction identifier is within the allocated range; an action contract
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 546 lines in this file; exact source
    • repstore2bug (doc/examples/MSV/repstore2bug.ivy)
      • specifies: replicated store
      • safety: assert 0 <= tx & tx < next; (source); assert ~committed(tx); (source); assert committed(tx); (source)
        • plain reading (inference from declaration): the referenced transaction identifier is within the allocated range; an action contract
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • negative-test warning: the filename marks this as a bad/buggy/unsafe/error variant; displayed properties are attempted checks, not established guarantees
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 530 lines in this file; exact source
    • repstore2ex (doc/examples/MSV/repstore2ex.ivy)
      • specifies: replicated store
      • safety: assert 0 <= tx & tx < next; (source); assert ~committed(tx); (source); assert committed(tx); (source)
        • plain reading (inference from declaration): the referenced transaction identifier is within the allocated range; an action contract
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 538 lines in this file; exact source
    • repstore2ex_soln (doc/examples/MSV/repstore2ex_soln.ivy)
      • specifies: replicated store
      • safety: assert 0 <= tx & tx < next; (source); assert ~committed(tx); (source); assert committed(tx); (source)
        • plain reading (inference from declaration): the referenced transaction identifier is within the allocated range; an action contract
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 562 lines in this file; exact source
    • repstore3 (doc/examples/MSV/repstore3.ivy)
      • specifies: replicated store
      • safety: assert 0 <= tx & tx < next; (source); assert ~committed(tx); (source); assert committed(tx); (source)
        • plain reading (inference from declaration): the referenced transaction identifier is within the allocated range; an action contract
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 465 lines in this file; exact source
    • repstore3_soln (doc/examples/MSV/repstore3_soln.ivy)
      • specifies: replicated store
      • safety: assert 0 <= tx & tx < next; (source); assert ~committed(tx); (source); assert committed(tx); (source)
        • plain reading (inference from declaration): the referenced transaction identifier is within the allocated range; an action contract
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 531 lines in this file; exact source
    • repstore_variant (doc/examples/MSV/repstore_variant.ivy)
      • specifies: replicated store
      • safety: assert 0 <= tx & tx < next; (source); assert ~serialized(tx); (source); assert 0 <= tx & tx < next; (source)
        • plain reading (inference from declaration): the referenced transaction identifier is within the allocated range; an action contract
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 248 lines in this file; exact source
    • token_ring (doc/examples/MSV/token_ring.ivy)
      • specifies: ring protocol
      • safety: assert ~lock(X); (source); assert lock(v); (source)
        • plain reading (inference from declaration): the listed action preconditions/postconditions constrain individual protocol operations; they are not a separately identified global safety theorem
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 112 lines in this file; exact source
    • token_ring_buggy (doc/examples/MSV/token_ring_buggy.ivy)
      • specifies: ring protocol
      • safety: assert ~sent(dst,pkt); (source); assert sent(dst,pkt); (source); assert ~lock(X); (source)
        • plain reading (inference from declaration): the listed action preconditions/postconditions constrain individual protocol operations; they are not a separately identified global safety theorem
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • negative-test warning: the filename marks this as a bad/buggy/unsafe/error variant; displayed properties are attempted checks, not established guarantees
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 273 lines in this file; exact source
    • account (doc/examples/account.ivy)
      • specifies: account concurrency
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 29 lines in this file; exact source
    • account2 (doc/examples/account2.ivy)
      • specifies: account concurrency
      • safety: assert balance + x >= balance (source); assert x <= balance (source)
        • plain reading (inference from declaration): the listed action preconditions/postconditions constrain individual protocol operations; they are not a separately identified global safety theorem
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 39 lines in this file; exact source
    • account3 (doc/examples/account3.ivy)
      • specifies: account concurrency
      • safety: assert balance + x >= balance (source); assert x <= balance (source)
        • plain reading (inference from declaration): the listed action preconditions/postconditions constrain individual protocol operations; they are not a separately identified global safety theorem
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 46 lines in this file; exact source
    • bcast (doc/examples/bcast.ivy)
      • specifies: Byzantine broadcast
      • safety: invariant net.sent(M,D) -> sent(M,D) (source)
        • plain reading (inference from declaration): the named state invariants restrict legal reachable states; the excerpt is not sufficient to give a more specific guarantee without reading the complete formula
        • 2 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 85 lines in this file; exact source
    • flash_inv (doc/examples/cav2020/cav-18/flash_inv.ivy)
      • specifies: FLASH cache coherence
      • safety: invariant [coherent1] cache(X).state = exclusive -> X = real_owner (source)
        • plain reading (inference from declaration): an exclusive cache copy belongs to the recorded owner
        • 37 state invariant declarations: coherent1, coherent2
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 577 lines in this file; exact source
    • flash_mc (doc/examples/cav2020/cav-18/flash_mc.ivy)
      • specifies: FLASH cache coherence
      • safety: invariant [coherent] cache(X).state = exclusive -> X = real_owner (source)
        • plain reading (inference from declaration): an exclusive cache copy belongs to the recorded owner
        • 5 state invariant declarations: coherent, coherent2
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun; model-checking variant indicated by filename
      • measured size: 484 lines in this file; exact source
    • german_inv (doc/examples/cav2020/cav-18/german_inv.ivy)
      • specifies: German cache coherence
      • safety: invariant forall C1, C2. C1 ~= C2 & s.cache(C1) = exclusive -> s.cache(C2) = invalid (source)
        • plain reading (inference from declaration): an exclusive cache owner excludes other valid cache copies
        • 9 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 143 lines in this file; exact source
    • german_mc (doc/examples/cav2020/cav-18/german_mc.ivy)
      • specifies: German cache coherence
      • safety: invariant forall C1, C2. C1 ~= C2 & s.cache(C1) = exclusive -> s.cache(C2) = invalid (source)
        • plain reading (inference from declaration): an exclusive cache owner excludes other valid cache copies
        • 2 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun; model-checking variant indicated by filename
      • measured size: 133 lines in this file; exact source
    • vs_paxos_inv (doc/examples/cav2020/cav-18/vs_paxos_inv.ivy)
      • specifies: Paxos consensus variant
      • safety: conjecture ~wedge_msg(E,0) (source); conjecture ~accept_msg(E,0,C) (source); conjecture ~accepted_msg(E,N,0,C) (source); conjecture accept_msg(E,S,C1) & accept_msg(E,S,C2) -> C1 = C2 (source); conjecture accepted_msg(E,N,S,C) -> accept_msg(E,S,C) (source); conjecture joined_stake(E,N,S2) & (S2 > S1) -> left_stake(E,N,S1) (source); conjecture (S2 > S1) & accept_msg(E,S2,C2) & C1 ~= C2 & nodeset.majority(NSET) -> (source); conjecture config_decided(E,C) (source); conjecture config_decided(E,C1) & config_decided(E,C2) -> C1 = C2 (source); conjecture joined_stake(E,N,S) -> started(E,N) (source); conjecture wedged(E,N) -> started(E,N) (source); conjecture leader_of(N,E) & proposal(E,I,V1) -> started(E,N) (source); conjecture vote(E,N,I,V) -> started(E,N) (source); conjecture decision(E,N,I,V) -> started(E,N) (source); conjecture transferral(E,N,I,V) -> started(E,N) (source); conjecture proposal(E,I,V1) & proposal(E,I,V2) -> V1 = V2 (source); conjecture vote(E,N,I,V) -> proposal(E,I,V) (source); conjecture joined_stake(E,N,S) -> wedged(E,N) (source); conjecture transferral(E,N,I,V) -> decision(E,N,I,V) (source); conjecture decision(E,N1,I,V) & nodeset.majority(NSET) -> transferral(E,N1,I,V) (source); conjecture accept_msg(E,S,C) & val_at(C,I,V) -> exists N. vote(E,N,I,V) | transferral(E,N,I,V) (source); conjecture decision(E,N,I,V) & accept_msg(E,S,C) -> val_at(C,I,V) (source); conjecture accept_msg(E,S,C) & nodeset.majority(NSET) (source); conjecture started(E,N1) & started(E,N2) -> (transferral(E,N1,I,V) <-> transferral(E,N2,I,V)) (source); conjecture (exists E2,N2. epoch.succ(E1,E2) & started(E2,N2)) -> exists C. config_decided(E1,C) (source); conjecture epoch.succ(E1,E2) & started(E2,N) & config_decided(E1,C) -> ( transferral(E2,N,I,V) <-> val_at(C,I,V) (source); conjecture transferral(E,N,I1,V1) & proposal(E,I2,V2) -> ~(I2 <= I1) (source); conjecture (exists E2,N2. (E2 > E1) & started(E2,N2)) -> exists C. config_decided(E1,C) (source); conjecture config_decided(E1,C1) & (E2 > E1) & val_at(C1,I,V) & started(E2,N2) (source); conjecture (decision(E1,N1,I,V1) & decision(E2,N2,I,V2)) -> V1 = V2 (source); conjecture any_decision(I,V) -> exists E,N. decision(E,N,I,V) (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 299 lines in this file; exact source
    • vs_paxos_mc (doc/examples/cav2020/cav-18/vs_paxos_mc.ivy)
      • specifies: Paxos consensus variant
      • safety: require s ~= 0; (source); require s ~= 0; (source); require started(e,n); (source)
        • plain reading (inference from declaration): the listed action preconditions/postconditions constrain individual protocol operations; they are not a separately identified global safety theorem
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun; model-checking variant indicated by filename
      • measured size: 262 lines in this file; exact source
    • german_bmc_bug (doc/examples/cav2020/german_bmc_bug.ivy)
      • specifies: German cache coherence
      • safety: invariant forall C1, C2. C1 ~= C2 & s.cache(C1) = exclusive -> s.cache(C2) = invalid (source)
        • plain reading (inference from declaration): an exclusive cache owner excludes other valid cache copies
        • 1 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • negative-test warning: the filename marks this as a bad/buggy/unsafe/error variant; displayed properties are attempted checks, not established guarantees
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun; model-checking variant indicated by filename
      • measured size: 159 lines in this file; exact source
    • german_mc_bug (doc/examples/cav2020/german_mc_bug.ivy)
      • specifies: German cache coherence
      • safety: invariant forall C1, C2. C1 ~= C2 & s.cache(C1) = exclusive -> s.cache(C2) = invalid (source)
        • plain reading (inference from declaration): an exclusive cache owner excludes other valid cache copies
        • 1 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • negative-test warning: the filename marks this as a bad/buggy/unsafe/error variant; displayed properties are attempted checks, not established guarantees
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun; model-checking variant indicated by filename
      • measured size: 159 lines in this file; exact source
    • leader_tutorial (doc/examples/cav2020/leader_tutorial.ivy)
      • specifies: leader election
      • safety: invariant ~(pid(N) < pid(P) & sent(pid(N),N)) (source)
        • plain reading (inference from declaration): the named state invariants restrict legal reachable states; the excerpt is not sufficient to give a more specific guarantee without reading the complete formula
        • 7 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 167 lines in this file; exact source
    • leader_tutorial_without_proof (doc/examples/cav2020/leader_tutorial_without_proof.ivy)
      • specifies: leader election
      • safety: invariant net.sent(V,N) -> abstract_model.sent(V,N) (source)
        • plain reading (inference from declaration): the named state invariants restrict legal reachable states; the excerpt is not sufficient to give a more specific guarantee without reading the complete formula
        • 3 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 161 lines in this file; exact source
    • ticket (doc/examples/cav2020/liveness/ticket.ivy)
      • specifies: ticket lock
      • safety: invariant pc1(T) | pc2(T) | pc3(T) (source)
        • plain reading (inference from declaration): at most one process is in the encoded critical section
        • 42 state invariant declarations; all clauses in source
      • liveness: temporal property [nonstarvation] (forall T:thread. globally (~globally (~scheduled(T)))) -> (source)
        • plain reading (inference from formula): requests eventually reach the modeled granted/critical state under the encoded scheduling fairness and other premises; proof witness clauses are auxiliary
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 231 lines in this file; exact source
    • ticket_nested (doc/examples/cav2020/liveness/ticket_nested.ivy)
      • specifies: ticket lock
      • safety: invariant [safety] pc3(T1) & pc3(T2) -> T1 = T2 (source)
        • plain reading (inference from declaration): at most one process is in the encoded critical section
        • 61 state invariant declarations: safety
      • liveness: temporal property [nonstarvation] ( ((exists T0. ~(globally ~(pc2(T0) & globally ~pc3(T0)))) -> ~(globally ~(pc2(sk0) & globally ~pc3(sk0)))) & (source)
        • plain reading (inference from formula): requests eventually reach the modeled granted/critical state under the encoded scheduling fairness and other premises; proof witness clauses are auxiliary
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 291 lines in this file; exact source
    • multi_paxos_protocol (doc/examples/cav2020/pldi-18/multi_paxos/multi_paxos_protocol.ivy)
      • specifies: Paxos consensus variant
      • safety: invariant [agreement] decision(I,V1) & decision(I,V2) -> V1 = V2 (source)
        • plain reading (inference from declaration): decisions agree
        • 8 state invariant declarations: agreement
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 120 lines in this file; exact source
    • multi_paxos_system (doc/examples/cav2020/pldi-18/multi_paxos/multi_paxos_system.ivy)
      • specifies: Paxos consensus variant
      • safety: invariant ~init_status.decided & ~nset.member(N,init_status.voters) & ~init_status.active (source)
        • plain reading (inference from declaration): the named state invariants restrict legal reachable states; the excerpt is not sufficient to give a more specific guarantee without reading the complete formula
        • 51 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 718 lines in this file; exact source
    • toy_consensus (doc/examples/cav2020/pldi-18/toy_consensus.ivy)
      • specifies: consensus/agreement protocol
      • safety: invariant [one_leader] isleader(N) & isleader(M) -> N = M (source)
        • plain reading (inference from declaration): at most one node is elected leader
        • 10 state invariant declarations: one_leader, one_vote_per_node, leader_has_majority, safe
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 431 lines in this file; exact source
    • token_ring (doc/examples/cav2020/token_ring.ivy)
      • specifies: ring protocol
      • safety: assert ~lock(X); (source); assert lock(v); (source)
        • plain reading (inference from declaration): the listed action preconditions/postconditions constrain individual protocol operations; they are not a separately identified global safety theorem
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 192 lines in this file; exact source
    • client_server_example (doc/examples/client_server_example.ivy)
      • specifies: client/server request protocol
      • safety: invariant ~(X ~= Z & link(X,Y) & link(Z,Y)) (source)
        • plain reading (inference from declaration): a link/ownership destination cannot have conflicting sources
        • 2 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 35 lines in this file; exact source
    • client_server_example_mc2 (doc/examples/client_server_example_mc2.ivy)
      • specifies: client/server request protocol
      • safety: invariant link(X,Y) & link(Z,Y) -> X = Z (source)
        • plain reading (inference from declaration): a link/ownership destination cannot have conflicting sources
        • 1 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun; model-checking variant indicated by filename
      • measured size: 32 lines in this file; exact source
    • client_server_example_mv (doc/examples/client_server_example_mv.ivy)
      • specifies: client/server request protocol
      • safety: invariant link(X,Y) & link(Z,Y) -> X = Z (source)
        • plain reading (inference from declaration): a link/ownership destination cannot have conflicting sources
        • 1 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 35 lines in this file; exact source
    • client_server_example_new (doc/examples/client_server_example_new.ivy)
      • specifies: client/server request protocol
      • safety: invariant ~(X ~= Z & link(X,Y) & link(Z,Y)) (source)
        • plain reading (inference from declaration): a link/ownership destination cannot have conflicting sources
        • 1 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 35 lines in this file; exact source
    • echo (doc/examples/echo.ivy)
      • specifies: echo message protocol
      • safety: invariant response_sent(X,S,D) -> request_sent(X,D,S) (source)
        • plain reading (inference from declaration): responses are sent only for matching requests
        • 5 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 174 lines in this file; exact source
    • interference (doc/examples/interference.ivy)
      • specifies: concurrent interference
      • safety: conjecture left_player.ball -> spec.side = left (source); conjecture right_player.ball -> spec.side = right (source)
        • plain reading (inference from declaration): the left player acts only when the abstract ball/turn is on the left
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 66 lines in this file; exact source
    • interference2 (doc/examples/interference2.ivy)
      • specifies: concurrent interference
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 15 lines in this file; exact source
    • interference3 (doc/examples/interference3.ivy)
      • specifies: concurrent interference
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 15 lines in this file; exact source
    • interference4 (doc/examples/interference4.ivy)
      • specifies: concurrent interference
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 15 lines in this file; exact source
    • lamport_mutex (doc/examples/lamport_mutex.ivy)
      • specifies: mutual exclusion
      • safety: invariant idx <= self (source)
        • plain reading (inference from declaration): the named state invariants restrict legal reachable states; the excerpt is not sufficient to give a more specific guarantee without reading the complete formula
        • 21 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 428 lines in this file; exact source
    • leader_election_ring (doc/examples/leader_election_ring.ivy)
      • specifies: leader election
      • safety: ensure (y <= X & X <= x) | (x < y & ~ (x < Z & Z < y)) (source); require sent(v,dst) (source); ensure me.pid >= node.pid(X) # only the max pid can be elected (source)
        • plain reading (inference from declaration): identifier-order/message-path invariants support leader uniqueness; the quoted clause is auxiliary
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 147 lines in this file; exact source
    • leader_election_ring2 (doc/examples/leader_election_ring2.ivy)
      • specifies: leader election
      • safety: conjecture ~(pid(N1) <= pid(N0) & trans.pending(pid(N1),N1) & pid(N1) ~= pid(N0)) (source); conjecture ~(pid(N2) <= pid(N0) & trans.pending(pid(N2),N1) & N0 <= N1 & N2 <= N0 & N0 ~= N2 & N1 ~= N0) (source); conjecture ~(pid(N2) <= pid(N0) & trans.pending(pid(N2),N1) & N0 <= N1 & N1 <= N2 & N1 ~= N0) (source); conjecture ~(pid(N2) <= pid(N0) & trans.pending(pid(N2),N1) & N1 <= N2 & N2 <= N0 & N0 ~= N2) (source)
        • plain reading (inference from declaration): identifier-order/message-path invariants support leader uniqueness; the quoted clause is auxiliary
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 175 lines in this file; exact source
    • leader_election_ring_btw (doc/examples/leader_election_ring_btw.ivy)
      • specifies: leader election
      • safety: assert ~btw(x,Z,y) (source); require sent(v,dst) (source); ensure me.pid >= node.pid(X) # only the max pid can be elected (source)
        • plain reading (inference from declaration): identifier-order/message-path invariants support leader uniqueness; the quoted clause is auxiliary
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 149 lines in this file; exact source
    • leader_election_ring_repl (doc/examples/leader_election_ring_repl.ivy)
      • specifies: leader election
      • safety: conjecture ~(asgn.pid(N) < asgn.pid(P) & trans.sent(asgn.pid(N),N)) (source); conjecture ~(asgn.pid(P) < asgn.pid(Q) & N:node.t < P & P < Q & trans.sent(asgn.pid(P),N)) (source); conjecture ~(asgn.pid(N) < asgn.pid(P) & N < P & P < Q & trans.sent(asgn.pid(N),Q)) (source); conjecture ~(asgn.pid(Q) < asgn.pid(N) & N < P & P < Q & trans.sent(asgn.pid(Q),P)) (source)
        • plain reading (inference from declaration): identifier-order/message-path invariants support leader uniqueness; the quoted clause is auxiliary
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 191 lines in this file; exact source
    • leader_election_ring_repl_err (doc/examples/leader_election_ring_repl_err.ivy)
      • specifies: leader election
      • safety: conjecture ~(asgn.pid(N) < asgn.pid(P) & trans.sent(asgn.pid(N),N)) (source); conjecture ~(asgn.pid(P) < asgn.pid(Q) & N:node.t < P & P < Q & trans.sent(asgn.pid(P),N)) (source); conjecture ~(asgn.pid(N) < asgn.pid(P) & N < P & P < Q & trans.sent(asgn.pid(N),Q)) (source); conjecture ~(asgn.pid(Q) < asgn.pid(N) & N < P & P < Q & trans.sent(asgn.pid(Q),P)) (source)
        • plain reading (inference from declaration): identifier-order/message-path invariants support leader uniqueness; the quoted clause is auxiliary
      • liveness: no active temporal/progress declaration found in this file
      • negative-test warning: the filename marks this as a bad/buggy/unsafe/error variant; displayed properties are attempted checks, not established guarantees
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 191 lines in this file; exact source
    • leader_election_ring_repl_err2 (doc/examples/leader_election_ring_repl_err2.ivy)
      • specifies: leader election
      • safety: conjecture ~(asgn.pid(N) < asgn.pid(P) & trans.sent(asgn.pid(N),N)) (source); conjecture ~(asgn.pid(P) < asgn.pid(Q) & N:node.t < P & P < Q & trans.sent(asgn.pid(P),N)) (source); conjecture ~(asgn.pid(N) < asgn.pid(P) & N < P & P < Q & trans.sent(asgn.pid(N),Q)) (source); conjecture ~(asgn.pid(Q) < asgn.pid(N) & N < P & P < Q & trans.sent(asgn.pid(Q),P)) (source)
        • plain reading (inference from declaration): identifier-order/message-path invariants support leader uniqueness; the quoted clause is auxiliary
      • liveness: no active temporal/progress declaration found in this file
      • negative-test warning: the filename marks this as a bad/buggy/unsafe/error variant; displayed properties are attempted checks, not established guarantees
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 191 lines in this file; exact source
    • leader_election_ring_udp (doc/examples/leader_election_ring_udp.ivy)
      • specifies: leader election
      • safety: conjecture ~(asgn.pid(N) < asgn.pid(P) & trans.spec.sent(asgn.pid(N),N)) (source); conjecture ~(asgn.pid(P) < asgn.pid(Q) & N:node.t < P & P < Q & trans.spec.sent(asgn.pid(P),N)) (source); conjecture ~(asgn.pid(N) < asgn.pid(P) & N < P & P < Q & trans.spec.sent(asgn.pid(N),Q)) (source); conjecture ~(asgn.pid(Q) < asgn.pid(N) & N < P & P < Q & trans.spec.sent(asgn.pid(Q),P)) (source)
        • plain reading (inference from declaration): identifier-order/message-path invariants support leader uniqueness; the quoted clause is auxiliary
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 175 lines in this file; exact source
    • leader_election_ring_udp2 (doc/examples/leader_election_ring_udp2.ivy)
      • specifies: leader election
      • safety: conjecture ~(asgn.pid(N) < asgn.pid(P) & trans.spec.sent(asgn.pid(N),N)) (source); conjecture ~(asgn.pid(P) < asgn.pid(Q) & N:node.t < P & P < Q & trans.spec.sent(asgn.pid(P),N)) (source); conjecture ~(asgn.pid(N) < asgn.pid(P) & N < P & P < Q & trans.spec.sent(asgn.pid(N),Q)) (source); conjecture ~(asgn.pid(Q) < asgn.pid(N) & N < P & P < Q & trans.spec.sent(asgn.pid(Q),P)) (source)
        • plain reading (inference from declaration): identifier-order/message-path invariants support leader uniqueness; the quoted clause is auxiliary
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 177 lines in this file; exact source
    • leader_election_ring_udp2_warn (doc/examples/leader_election_ring_udp2_warn.ivy)
      • specifies: leader election
      • safety: conjecture ~(asgn.pid(N) < asgn.pid(P) & trans.spec.sent(asgn.pid(N),N)) (source); conjecture ~(asgn.pid(P) < asgn.pid(Q) & N:node.t < P & P < Q & trans.spec.sent(asgn.pid(P),N)) (source); conjecture ~(asgn.pid(N) < asgn.pid(P) & N < P & P < Q & trans.spec.sent(asgn.pid(N),Q)) (source); conjecture ~(asgn.pid(Q) < asgn.pid(N) & N < P & P < Q & trans.spec.sent(asgn.pid(Q),P)) (source)
        • plain reading (inference from declaration): identifier-order/message-path invariants support leader uniqueness; the quoted clause is auxiliary
      • liveness: no active temporal/progress declaration found in this file
      • negative-test warning: the filename marks this as a bad/buggy/unsafe/error variant; displayed properties are attempted checks, not established guarantees
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 177 lines in this file; exact source
    • leader_tutorial (doc/examples/leader_tutorial.ivy)
      • specifies: leader election
      • safety: invariant ~(pid(N) < pid(P) & sent(pid(N),N)) (source)
        • plain reading (inference from declaration): the named state invariants restrict legal reachable states; the excerpt is not sufficient to give a more specific guarantee without reading the complete formula
        • 7 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 167 lines in this file; exact source
    • leader_tutorial_liveness (doc/examples/leader_tutorial_liveness.ivy)
      • specifies: leader election
      • safety: invariant ~(pid(N) < pid(P) & sent(pid(N),N)) (source)
        • plain reading (inference from declaration): the named state invariants restrict legal reachable states; the excerpt is not sufficient to give a more specific guarantee without reading the complete formula
        • 7 state invariant declarations; all clauses in source
      • liveness: temporal property (forall P,N. (source); temporal property eventualy exists L. call elect(L) (source); temporal axiom forall N. globally eventually call timer.timeout(N) (source); temporal axiom forall P,N. (eventually net.sent(P,N)) -> (eventually call net.recv(N,P)) (source)
        • plain reading (inference from formula): the modeled message/election operation eventually completes under the encoded fairness assumptions; proof witness clauses are auxiliary
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 173 lines in this file; exact source
    • lesstrivnet (doc/examples/lesstrivnet.ivy)
      • specifies: small asynchronous network
      • safety: conjecture protocol.full -> spec.sent(protocol.contents) (source)
        • plain reading (inference from declaration): a full protocol buffer contains a previously sent message
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 48 lines in this file; exact source
    • 1queue_bounded (doc/examples/liveness/1queue_bounded.ivy)
      • specifies: queue concurrency/progress
      • safety: invariant ~now (source)
        • plain reading (inference from declaration): the transient event flag is false between actions; an auxiliary modeling invariant
        • 2 state invariant declarations; all clauses in source
      • liveness: temporal property [lpq] forall X. ((globally eventually recv_trying.now) (source); temporal property [nb] ((globally eventually recv_trying.now) (source)
        • plain reading (inference from formula): queued work eventually advances to the modeled receive/completion point under the encoded fairness premises; proof witness clauses are auxiliary
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 169 lines in this file; exact source
    • 1queuelive (doc/examples/liveness/1queuelive.ivy)
      • specifies: queue concurrency/progress
      • safety: invariant ~now (source)
        • plain reading (inference from declaration): the transient event flag is false between actions; an auxiliary modeling invariant
        • 1 state invariant declarations; all clauses in source
      • liveness: temporal property forall X. ((globally eventually receiving.now) (source)
        • plain reading (inference from formula): queued work eventually advances to the modeled receive/completion point under the encoded fairness premises; proof witness clauses are auxiliary
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 86 lines in this file; exact source
    • 1queuelive_mc1 (doc/examples/liveness/1queuelive_mc1.ivy)
      • specifies: queue concurrency/progress
      • safety: invariant ~now (source)
        • plain reading (inference from declaration): the transient event flag is false between actions; an auxiliary modeling invariant
        • 1 state invariant declarations; all clauses in source
      • liveness: temporal property forall X. (source)
        • plain reading (inference from formula): queued work eventually advances to the modeled receive/completion point under the encoded fairness premises; proof witness clauses are auxiliary
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun; model-checking variant indicated by filename
      • measured size: 92 lines in this file; exact source
    • 1queuelive_mc2 (doc/examples/liveness/1queuelive_mc2.ivy)
      • specifies: queue concurrency/progress
      • safety: invariant ~now (source)
        • plain reading (inference from declaration): the transient event flag is false between actions; an auxiliary modeling invariant
        • 1 state invariant declarations; all clauses in source
      • liveness: temporal property [lemma1] forall X. (source); temporal property forall X. (source)
        • plain reading (inference from formula): queued work eventually advances to the modeled receive/completion point under the encoded fairness premises; proof witness clauses are auxiliary
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun; model-checking variant indicated by filename
      • measured size: 120 lines in this file; exact source
    • 1queuelive_prophecy3 (doc/examples/liveness/1queuelive_prophecy3.ivy)
      • specifies: queue concurrency/progress
      • safety: invariant ~now (source)
        • plain reading (inference from declaration): the transient event flag is false between actions; an auxiliary modeling invariant
        • 1 state invariant declarations; all clauses in source
      • liveness: temporal property forall X. ((globally eventually receiving.now) (source)
        • plain reading (inference from formula): queued work eventually advances to the modeled receive/completion point under the encoded fairness premises; proof witness clauses are auxiliary
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 106 lines in this file; exact source
    • 2queuelive (doc/examples/liveness/2queuelive.ivy)
      • specifies: queue concurrency/progress
      • safety: invariant ~now (source)
        • plain reading (inference from declaration): the transient event flag is false between actions; an auxiliary modeling invariant
        • 3 state invariant declarations; all clauses in source
      • liveness: temporal property [lpq] forall X. ((globally eventually trying.now) (source); temporal property [poll_lemma] forall X. (eventually q1.receiving.now & q1.receiving.value = X) (source); temporal property forall X. ((globally eventually q1.trying.now) (source)
        • plain reading (inference from formula): queued work eventually advances to the modeled receive/completion point under the encoded fairness premises; proof witness clauses are auxiliary
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 199 lines in this file; exact source
    • 2queuelive_bounded (doc/examples/liveness/2queuelive_bounded.ivy)
      • specifies: queue concurrency/progress
      • safety: invariant ~now (source)
        • plain reading (inference from declaration): the transient event flag is false between actions; an auxiliary modeling invariant
        • 3 state invariant declarations; all clauses in source
      • liveness: temporal property [lpq] forall X. ((globally eventually head < tail -> recv_trying.now) (source); temporal property [nb] ((globally eventually head < tail -> recv_trying.now) (source); temporal property [fpull] (globally eventually q2.head < q2.tail -> q2.recv_trying.now) & (source); temporal property [poll_lemma] forall X. (eventually q1.receiving.now & q1.receiving.value = X) (source); temporal property [live] forall X. (source)
        • plain reading (inference from formula): queued work eventually advances to the modeled receive/completion point under the encoded fairness premises; proof witness clauses are auxiliary
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 252 lines in this file; exact source
    • 2queuelive_noncomp (doc/examples/liveness/2queuelive_noncomp.ivy)
      • specifies: queue concurrency/progress
      • safety: invariant ~now (source)
        • plain reading (inference from declaration): the transient event flag is false between actions; an auxiliary modeling invariant
        • 3 state invariant declarations: foo
      • liveness: temporal property forall X. ((globally eventually q1.trying.now) (source)
        • plain reading (inference from formula): queued work eventually advances to the modeled receive/completion point under the encoded fairness premises; proof witness clauses are auxiliary
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 159 lines in this file; exact source
    • liveness_refinement (doc/examples/liveness/liveness_refinement.ivy)
      • specifies: queue liveness refinement
      • safety: invariant ~now (source)
        • plain reading (inference from declaration): the transient event flag is false between actions; an auxiliary modeling invariant
        • 14 state invariant declarations; all clauses in source
      • liveness: temporal property [lemma1] (globally eventually trying1.now) & (source); temporal property [gf1] (globally eventually trying1.now) -> (source); temporal property [gf2] (globally eventually trying2.now) -> (source); temporal property [lemma1] (globally eventually trying1.now) & (source)
        • plain reading (inference from formula): these are temporal targets or proof lemmas; progress holds only under the premises in each complete formula, and success was not independently checked
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 308 lines in this file; exact source
    • llqueue1 (doc/examples/liveness/llqueue1.ivy)
      • specifies: queue concurrency/progress
      • safety: invariant ~now (source)
        • plain reading (inference from declaration): the transient event flag is false between actions; an auxiliary modeling invariant
        • 21 state invariant declarations; all clauses in source
      • liveness: temporal property forall X. ((globally eventually receiving.now) (source)
        • plain reading (inference from formula): queued work eventually advances to the modeled receive/completion point under the encoded fairness premises; proof witness clauses are auxiliary
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 196 lines in this file; exact source
    • llqueue2_bounded (doc/examples/liveness/llqueue2_bounded.ivy)
      • specifies: queue concurrency/progress
      • safety: invariant ~now (source)
        • plain reading (inference from declaration): the transient event flag is false between actions; an auxiliary modeling invariant
        • 18 state invariant declarations; all clauses in source
      • liveness: temporal property [lpq] forall X. ((globally eventually receiving.now) (source); temporal property [nb] ((globally eventually recv_trying.now) (source)
        • plain reading (inference from formula): queued work eventually advances to the modeled receive/completion point under the encoded fairness premises; proof witness clauses are auxiliary
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 280 lines in this file; exact source
    • progress1 (doc/examples/liveness/progress1.ivy)
      • specifies: unbounded queue delivery progress
      • safety: invariant ~now (source)
        • plain reading (inference from declaration): the transient event flag is false between actions; an auxiliary modeling invariant
        • 1 state invariant declarations; all clauses in source
      • liveness: temporal property forall X. (source)
        • plain reading (inference from formula): queued work eventually advances to the modeled receive/completion point under the encoded fairness premises; proof witness clauses are auxiliary
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 93 lines in this file; exact source
    • progress2 (doc/examples/liveness/progress2.ivy)
      • specifies: unbounded queue delivery progress
      • safety: invariant ~now (source)
        • plain reading (inference from declaration): the transient event flag is false between actions; an auxiliary modeling invariant
        • 1 state invariant declarations; all clauses in source
      • liveness: temporal property forall X. (source)
        • plain reading (inference from formula): queued work eventually advances to the modeled receive/completion point under the encoded fairness premises; proof witness clauses are auxiliary
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 95 lines in this file; exact source
    • ticket_l2s_auto (doc/examples/liveness/ticket_l2s_auto.ivy)
      • specifies: ticket lock
      • safety: invariant ~now (source)
        • plain reading (inference from declaration): the transient event flag is false between actions; an auxiliary modeling invariant
        • 17 state invariant declarations; all clauses in source
      • liveness: temporal property [lemma1] (forall T. globally (eventually scheduled.now & scheduled.value = T)) (source)
        • plain reading (inference from formula): requests eventually reach the modeled granted/critical state under the encoded scheduling fairness and other premises; proof witness clauses are auxiliary
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 207 lines in this file; exact source
    • ticket_mc (doc/examples/liveness/ticket_mc.ivy)
      • specifies: ticket lock
      • safety: invariant ~now (source)
        • plain reading (inference from declaration): the transient event flag is false between actions; an auxiliary modeling invariant
        • 15 state invariant declarations; all clauses in source
      • liveness: temporal property [lemma1] (forall T. globally (eventually scheduled.emits(T))) -> (source); temporal property [live] (forall T. globally (eventually scheduled.emits(T))) -> (source)
        • plain reading (inference from formula): requests eventually reach the modeled granted/critical state under the encoded scheduling fairness and other premises; proof witness clauses are auxiliary
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun; model-checking variant indicated by filename
      • measured size: 181 lines in this file; exact source
    • ticket_ranking (doc/examples/liveness/ticket_ranking.ivy)
      • specifies: ticket lock
      • safety: invariant ~now (source)
        • plain reading (inference from declaration): the transient event flag is false between actions; an auxiliary modeling invariant
        • 17 state invariant declarations; all clauses in source
      • liveness: temporal property [lemma1] (forall T. globally (eventually scheduled.now & scheduled.value = T)) (source)
        • plain reading (inference from formula): requests eventually reach the modeled granted/critical state under the encoded scheduling fairness and other premises; proof witness clauses are auxiliary
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 207 lines in this file; exact source
    • ip_spec (doc/examples/networking/ip_spec.ivy)
      • specifies: network protocol
      • safety: invariant intf(H1,N1,A) & intf(H2,N2,A) -> H1 = H2 & N1 = N2 (source)
        • plain reading (inference from declaration): the named state invariants restrict legal reachable states; the excerpt is not sufficient to give a more specific guarantee without reading the complete formula
        • 1 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 301 lines in this file; exact source
    • ip_spec1 (doc/examples/networking/ip_spec1.ivy)
      • specifies: network protocol
      • safety: invariant intf(H1,N1,A) & intf(H2,N2,A) -> H1 = H2 & N1 = N2 (source)
        • plain reading (inference from declaration): the named state invariants restrict legal reachable states; the excerpt is not sufficient to give a more specific guarantee without reading the complete formula
        • 1 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 310 lines in this file; exact source
    • pingpong (doc/examples/pingpong.ivy)
      • specifies: ping-pong message exchange
      • safety: invariant ball -> side = left (source)
        • plain reading (inference from declaration): the left player acts only when the abstract ball/turn is on the left
        • 2 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 71 lines in this file; exact source
    • pingpongclock (doc/examples/pingpongclock.ivy)
      • specifies: lock protocol
      • safety: invariant ball -> (intf.side = intf.left & intf.time <= time) (source)
        • plain reading (inference from declaration): the named state invariants restrict legal reachable states; the excerpt is not sufficient to give a more specific guarantee without reading the complete formula
        • 2 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 116 lines in this file; exact source
    • byte_stream (doc/examples/quic/byte_stream.ivy)
      • specifies: QUIC transport protocol
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 19 lines in this file; exact source
    • quic_application (doc/examples/quic/quic_application.ivy)
      • specifies: QUIC transport protocol
      • safety: require conn_requested(dst,src,dcid); # [1] require ~connected(dcid) & ~connected(scid); # [2] (source); require ~connected(dcid) & ~connected(scid); # [2] ... (source); require ~(send_end > stream_app_data_end(dcid,s) & stream_app_data_finished(dcid,s)); # [4] var end := stream_app_data(dcid,s).end; (source)
        • plain reading (inference from declaration): the listed action preconditions/postconditions constrain individual protocol operations; they are not a separately identified global safety theorem
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 169 lines in this file; exact source
    • quic_connection (doc/examples/quic/quic_connection.ivy)
      • specifies: QUIC transport protocol
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 38 lines in this file; exact source
    • quic_monitor (doc/examples/quic/quic_monitor.ivy)
      • specifies: QUIC transport protocol
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 57 lines in this file; exact source
    • quic_packet (doc/examples/quic/quic_packet.ivy)
      • specifies: QUIC transport protocol
      • safety: require pkt.token.end ~= 0 -> (pkt.ptype = quic_packet_type.initial); (source); require pkt.ptype ~= quic_packet_type.zero_rtt; (source); require connected(dcid) | (source)
        • plain reading (inference from declaration): the listed action preconditions/postconditions constrain individual protocol operations; they are not a separately identified global safety theorem
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 586 lines in this file; exact source
    • quic_protection (doc/examples/quic/quic_protection.ivy)
      • specifies: QUIC transport protocol
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 403 lines in this file; exact source
    • quic_security (doc/examples/quic/quic_security.ivy)
      • specifies: QUIC transport protocol
      • safety: require crypto_data_present(scid,e,cpos) -> crypto_data(scid,e).value(cpos) = byte; (source); require connected(dcid) & connected_to(dcid) = scid; # [1] require lo < hi & lo = crypto_pos(dcid,e) & hi <= crypto_length(scid,e); # [2] (source); require lo < hi & lo = crypto_pos(dcid,e) & hi <= crypto_length(scid,e); # [2] ... (source)
        • plain reading (inference from declaration): the listed action preconditions/postconditions constrain individual protocol operations; they are not a separately identified global safety theorem
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 267 lines in this file; exact source
    • quic_server_test_connection_close (doc/examples/quic/quic_server_test_connection_close.ivy)
      • specifies: QUIC transport protocol
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 8 lines in this file; exact source
    • quic_server_test_reset_stream (doc/examples/quic/quic_server_test_reset_stream.ivy)
      • specifies: QUIC transport protocol
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 6 lines in this file; exact source
    • quic_server_test_stream (doc/examples/quic/quic_server_test_stream.ivy)
      • specifies: QUIC transport protocol
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 6 lines in this file; exact source
    • quic_stream (doc/examples/quic/quic_stream.ivy)
      • specifies: QUIC transport protocol
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 20 lines in this file; exact source
    • tls_protocol (doc/examples/quic/tls_protocol.ivy)
      • specifies: QUIC transport protocol
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 49 lines in this file; exact source
    • tls_record (doc/examples/quic/tls_record.ivy)
      • specifies: QUIC transport protocol
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 244 lines in this file; exact source
    • proto (doc/examples/sht/proto.ivy)
      • specifies: sharded hash table
      • safety: conjecture impl.dm.map(K,me) -> hash.hash(K) = ref.map(K) (source); conjecture impl.dm.map(K,me) & X ~= me -> ~proto.impl.dm(X).map(K,X) (source); conjecture impl.dm.map(K,me) -> ~(trans.delegated(X,S) & key.iter.between(shard.lo(S),K,shard.hi(S))) (source); conjecture trans.delegated(X,S) & key.iter.between(shard.lo(S),K,shard.hi(S)) (source); conjecture trans.requested(D,R) & L = req.rtxid(R)-> (source); conjecture trans.replied(D,R) & L = req.rtxid(R)-> (source); conjecture trans.requested(D,R) -> ref.generated(req.rtxid(R)) & ~ref.committed(req.rtxid(R)) (source); conjecture trans.replied(D,R) -> ref.generated(req.rtxid(R)) & ref.committed(req.rtxid(R)) (source); conjecture trans.requested(D1,R1) & trans.requested(D2,R2) & req.rtxid(R1) = req.rtxid(R2) (source); conjecture trans.replied(D1,R1) & trans.replied(D2,R2) & req.rtxid(R1) = req.rtxid(R2) (source); conjecture trans.delegated(X,S) & key.iter.between(shard.lo(S),K,shard.hi(S)) -> shard.value(S,K) = ref.map(K) (source); conjecture trans.delegated(D,S) -> shard.valid(S) (source)
        • plain reading (inference from declaration): a node’s key map agrees with the reference mapping
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 188 lines in this file; exact source
    • reference (doc/examples/sht/reference.ivy)
      • specifies: sharded hash table
      • safety: conjecture committed(T) -> generated(T) (source)
        • plain reading (inference from declaration): every committed transaction was generated
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 100 lines in this file; exact source
    • shard (doc/examples/sht/shard.ivy)
      • specifies: sharded key-value storage
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 29 lines in this file; exact source
    • sht (doc/examples/sht/sht.ivy)
      • specifies: sharded hash table
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 52 lines in this file; exact source
    • trans (doc/examples/sht/trans.ivy)
      • specifies: sharded hash table
      • safety: conjecture mq(D).contents(M) & impl(D).recv_seq(me) <= net_msg.num(M) (source); conjecture mq(D).contents(M) & impl(D).recv_seq(me) <= net_msg.num(M) (source); conjecture mq(D).contents(M) & impl(D).recv_seq(me) <= net_msg.num(M) (source); conjecture impl(S1).mq(D).contents(M1) & impl(D).recv_seq(S1) <= net_msg.num(M1) (source); conjecture impl(S1).mq(D).contents(M1) & impl(D).recv_seq(S1) <= net_msg.num(M1) (source); conjecture impl(S1).mq(D).contents(M1) & impl(D).recv_seq(S1) <= net_msg.num(M1) (source); conjecture mq(D).contents(M) -> ~(send_seq(D) <= net_msg.num(M)) (source); conjecture mq(D).contents(M1) & mq(D).contents(M2) & M1 ~= M2 (source); conjecture lower.spec.sent(M,D) & net_msg.src(M) = me (source); conjecture lower.spec.sent(M,D) & net_msg.src(M) = S (source); conjecture lower.spec.sent(M,D) & net_msg.src(M) = S (source); conjecture lower.spec.sent(M,D) & net_msg.src(M) = me & net_msg.mty(M) ~= ack_t (source); conjecture mq(D).contents(M) -> net_msg.src(M) = me & net_msg.mty(M) ~= ack_t (source)
        • plain reading (inference from declaration): buffered messages satisfy the receiver sequence-number ordering invariant
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 279 lines in this file; exact source
    • chain (doc/examples/testing/chain.ivy)
      • specifies: chain-replicated database
      • safety: assert 0 <= tx & tx < next; (source); assert ~committed(tx); (source); assert committed(tx); (source)
        • plain reading (inference from declaration): the referenced transaction identifier is within the allocated range; an action contract
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 173 lines in this file; exact source
    • chain2 (doc/examples/testing/chain2.ivy)
      • specifies: chain-replicated database
      • safety: assert 0 <= tx & tx < next; (source); assert ~serialized(tx); (source); assert 0 <= tx & tx < next; (source)
        • plain reading (inference from declaration): the referenced transaction identifier is within the allocated range; an action contract
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 184 lines in this file; exact source
    • chain3 (doc/examples/testing/chain3.ivy)
      • specifies: chain-replicated database
      • safety: assert 0 <= tx & tx < next; (source); assert ~serialized(tx); (source); assert 0 <= tx & tx < next; (source)
        • plain reading (inference from declaration): the referenced transaction identifier is within the allocated range; an action contract
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 224 lines in this file; exact source
    • interference (doc/examples/testing/interference.ivy)
      • specifies: concurrent interference
      • safety: assert side = left; (source); assert side = right; (source)
        • plain reading (inference from declaration): the left player acts only when the abstract ball/turn is on the left
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 64 lines in this file; exact source
    • leader_election_ring (doc/examples/testing/leader_election_ring.ivy)
      • specifies: leader election
      • safety: assert asgn.pid(v) >= asgn.pid(X) # only the max pid can be elected (source)
        • plain reading (inference from declaration): identifier-order/message-path invariants support leader uniqueness; the quoted clause is auxiliary
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 114 lines in this file; exact source
    • pingpong (doc/examples/testing/pingpong.ivy)
      • specifies: ping-pong message exchange
      • safety: assert side = left; (source); assert side = right; (source)
        • plain reading (inference from declaration): the left player acts only when the abstract ball/turn is on the left
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 128 lines in this file; exact source
    • pingpong_bad (doc/examples/testing/pingpong_bad.ivy)
      • specifies: ping-pong message exchange
      • safety: conjecture left_player.ball -> spec.side = left (source); conjecture right_player.ball -> spec.side = right (source)
        • plain reading (inference from declaration): the left player acts only when the abstract ball/turn is on the left
      • liveness: no active temporal/progress declaration found in this file
      • negative-test warning: the filename marks this as a bad/buggy/unsafe/error variant; displayed properties are attempted checks, not established guarantees
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 64 lines in this file; exact source
    • pingpong_ex (doc/examples/testing/pingpong_ex.ivy)
      • specifies: ping-pong message exchange
      • safety: assert side = left & ...; (source); assert side = right & ...; (source)
        • plain reading (inference from declaration): the left player acts only when the abstract ball/turn is on the left
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 114 lines in this file; exact source
    • pingpong_soln (doc/examples/testing/pingpong_soln.ivy)
      • specifies: ping-pong message exchange
      • safety: assert side = left & (val/2)*2 = val; (source); assert side = right & (val/2)*2+1 = val; (source)
        • plain reading (inference from declaration): the left player acts only when the abstract ball/turn is on the left
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 114 lines in this file; exact source
    • repstore1 (doc/examples/testing/repstore1.ivy)
      • specifies: replicated store
      • safety: assert 0 <= tx & tx < next; (source); assert ~committed(tx); (source); assert committed(tx); (source)
        • plain reading (inference from declaration): the referenced transaction identifier is within the allocated range; an action contract
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 388 lines in this file; exact source
    • repstore2 (doc/examples/testing/repstore2.ivy)
      • specifies: replicated store
      • safety: assert 0 <= tx & tx < next; (source); assert ~committed(tx); (source); assert committed(tx); (source)
        • plain reading (inference from declaration): the referenced transaction identifier is within the allocated range; an action contract
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 546 lines in this file; exact source
    • repstore2_orig (doc/examples/testing/repstore2_orig.ivy)
      • specifies: replicated store
      • safety: assert 0 <= tx & tx < next; (source); assert ~committed(tx); (source); assert committed(tx); (source)
        • plain reading (inference from declaration): the referenced transaction identifier is within the allocated range; an action contract
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 549 lines in this file; exact source
    • repstore2bug (doc/examples/testing/repstore2bug.ivy)
      • specifies: replicated store
      • safety: assert 0 <= tx & tx < next; (source); assert ~committed(tx); (source); assert committed(tx); (source)
        • plain reading (inference from declaration): the referenced transaction identifier is within the allocated range; an action contract
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • negative-test warning: the filename marks this as a bad/buggy/unsafe/error variant; displayed properties are attempted checks, not established guarantees
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 531 lines in this file; exact source
    • repstore2ex (doc/examples/testing/repstore2ex.ivy)
      • specifies: replicated store
      • safety: assert 0 <= tx & tx < next; (source); assert ~committed(tx); (source); assert committed(tx); (source)
        • plain reading (inference from declaration): the referenced transaction identifier is within the allocated range; an action contract
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 539 lines in this file; exact source
    • repstore3 (doc/examples/testing/repstore3.ivy)
      • specifies: replicated store
      • safety: assert 0 <= tx & tx < next; (source); assert ~committed(tx); (source); assert committed(tx); (source)
        • plain reading (inference from declaration): the referenced transaction identifier is within the allocated range; an action contract
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 466 lines in this file; exact source
    • repstore3_soln (doc/examples/testing/repstore3_soln.ivy)
      • specifies: replicated store
      • safety: assert 0 <= tx & tx < next; (source); assert ~committed(tx); (source); assert committed(tx); (source)
        • plain reading (inference from declaration): the referenced transaction identifier is within the allocated range; an action contract
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 532 lines in this file; exact source
    • repstore_variant (doc/examples/testing/repstore_variant.ivy)
      • specifies: replicated store
      • safety: assert 0 <= tx & tx < next; (source); assert ~serialized(tx); (source); assert 0 <= tx & tx < next; (source)
        • plain reading (inference from declaration): the referenced transaction identifier is within the allocated range; an action contract
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 249 lines in this file; exact source
    • token_ring (doc/examples/testing/token_ring.ivy)
      • specifies: ring protocol
      • safety: assert ~lock(X); (source); assert lock(v); (source)
        • plain reading (inference from declaration): the listed action preconditions/postconditions constrain individual protocol operations; they are not a separately identified global safety theorem
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 112 lines in this file; exact source
    • token_ring_buggy (doc/examples/testing/token_ring_buggy.ivy)
      • specifies: ring protocol
      • safety: assert ~sent(dst,pkt); (source); assert sent(dst,pkt); (source); assert ~lock(X); (source)
        • plain reading (inference from declaration): the listed action preconditions/postconditions constrain individual protocol operations; they are not a separately identified global safety theorem
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • negative-test warning: the filename marks this as a bad/buggy/unsafe/error variant; displayed properties are attempted checks, not established guarantees
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 276 lines in this file; exact source
    • trivnet (doc/examples/testing/trivnet.ivy)
      • specifies: small asynchronous network
      • safety: assert sent(x) (source)
        • plain reading (inference from declaration): the listed action preconditions/postconditions constrain individual protocol operations; they are not a separately identified global safety theorem
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 37 lines in this file; exact source
    • trivnet2 (doc/examples/testing/trivnet2.ivy)
      • specifies: small asynchronous network
      • safety: assert sent(x) (source)
        • plain reading (inference from declaration): the listed action preconditions/postconditions constrain individual protocol operations; they are not a separately identified global safety theorem
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 50 lines in this file; exact source
    • trivnet3 (doc/examples/testing/trivnet3.ivy)
      • specifies: small asynchronous network
      • safety: assert sent(x) (source)
        • plain reading (inference from declaration): the listed action preconditions/postconditions constrain individual protocol operations; they are not a separately identified global safety theorem
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 56 lines in this file; exact source
    • toy_consensus (doc/examples/toy_consensus.ivy)
      • specifies: consensus/agreement protocol
      • safety: invariant [majorities_intersect] (majority(S) & majority(T)) -> exists N. member(N,S) & member(N,T) (source)
        • plain reading (inference from declaration): any two majority sets share a member; this is an auxiliary quorum invariant
        • 14 state invariant declarations: majorities_intersect, one_leader, one_vote_per_node, leader_has_majority, safe
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 271 lines in this file; exact source
    • trivnet (doc/examples/trivnet.ivy)
      • specifies: small asynchronous network
      • safety: require sent(x) (source)
        • plain reading (inference from declaration): the listed action preconditions/postconditions constrain individual protocol operations; they are not a separately identified global safety theorem
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 34 lines in this file; exact source
    • trivnet2 (doc/examples/trivnet2.ivy)
      • specifies: small asynchronous network
      • safety: require sent(x) (source)
        • plain reading (inference from declaration): the listed action preconditions/postconditions constrain individual protocol operations; they are not a separately identified global safety theorem
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 51 lines in this file; exact source
    • window (doc/examples/window.ivy)
      • specifies: sliding-window protocol
      • safety: invariant begin <= end (source)
        • plain reading (inference from declaration): the named state invariants restrict legal reachable states; the excerpt is not sufficient to give a more specific guarantee without reading the complete formula
        • 9 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 289 lines in this file; exact source
    • window_adt (doc/examples/window_adt.ivy)
      • specifies: sliding-window protocol
      • safety: invariant i <= j & j <= bound (source)
        • plain reading (inference from declaration): the named state invariants restrict legal reachable states; the excerpt is not sufficient to give a more specific guarantee without reading the complete formula
        • 6 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 403 lines in this file; exact source
    • abp (examples/ivy/abp.ivy)
      • specifies: alternating-bit message delivery
      • safety: assert ~pending & v ~= state; (source); assert pending & v = state; (source)
        • plain reading (inference from declaration): the listed action preconditions/postconditions constrain individual protocol operations; they are not a separately identified global safety theorem
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 115 lines in this file; exact source
    • abp2 (examples/ivy/abp2/abp2.ivy)
      • specifies: alternating-bit message delivery
      • safety: assert vr = tape(round.val); # correctness property! (source)
        • plain reading (inference from declaration): the listed action preconditions/postconditions constrain individual protocol operations; they are not a separately identified global safety theorem
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 162 lines in this file; exact source
    • abp2_proof (examples/ivy/abp2/abp2_proof.ivy)
      • specifies: alternating-bit message delivery
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 80 lines in this file; exact source
    • bakery (examples/ivy/bakery.ivy)
      • specifies: Bakery mutual exclusion
      • safety: conjecture (pc7(I) & pc7(J) & public_n(I,X) & public_n(J, X)) -> I = J # the safety property (source)
        • plain reading (inference from declaration): at most one process is in the encoded critical section
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 301 lines in this file; exact source
    • chord2s (examples/ivy/chord2s.ivy)
      • specifies: Chord ring maintenance
      • safety: invariant (a(X) | p.map(Y, X) | ~s1.map(X, Y)) (source)
        • plain reading (inference from declaration): the named state invariants restrict legal reachable states; the excerpt is not sufficient to give a more specific guarantee without reading the complete formula
        • 9 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 254 lines in this file; exact source
    • chord2s_demo (examples/ivy/chord2s_demo.ivy)
      • specifies: Chord ring maintenance
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 241 lines in this file; exact source
    • chord2sbd (examples/ivy/chord2sbd.ivy)
      • specifies: Chord ring maintenance
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 251 lines in this file; exact source
    • client_server (examples/ivy/client_server.ivy)
      • specifies: client/server request protocol
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 33 lines in this file; exact source
    • client_server_fp (examples/ivy/client_server_fp.ivy)
      • specifies: client/server request protocol
      • safety: conjecture (X = Z | ~c(X,Y) | ~c(Z,Y)) (source)
        • plain reading (inference from declaration): a client/server relation cannot associate the same destination with distinct sources
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 37 lines in this file; exact source
    • client_server_sorted (examples/ivy/client_server_sorted.ivy)
      • specifies: client/server request protocol
      • safety: conjecture (X = Z | ~c(X,Y) | ~c(Z,Y)) (source)
        • plain reading (inference from declaration): a client/server relation cannot associate the same destination with distinct sources
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 39 lines in this file; exact source
    • flash (examples/ivy/flash.ivy)
      • specifies: FLASH cache coherence
      • safety: assert reached -> (source)
        • plain reading (inference from declaration): an exclusive cache owner excludes other valid cache copies
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 537 lines in this file; exact source
    • flash2 (examples/ivy/flash2.ivy)
      • specifies: FLASH cache coherence
      • safety: conjecture [coherent] ~(cache(X).state_ = exclusive & cache(X).wait = none & (source)
        • plain reading (inference from declaration): cache states satisfy the listed coherence/ownership constraints
        • 78 state invariant declarations: aux
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 642 lines in this file; exact source
    • flash3 (examples/ivy/flash3.ivy)
      • specifies: FLASH cache coherence
      • safety: invariant [coherent] cache(X).state = exclusive -> X = real_owner (source)
        • plain reading (inference from declaration): an exclusive cache copy belongs to the recorded owner
        • 7 state invariant declarations: coherent, nodups
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 493 lines in this file; exact source
    • gc_abs (examples/ivy/gc_abs.ivy)
      • specifies: garbage collector concurrency
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 28 lines in this file; exact source
    • gc_abs2 (examples/ivy/gc_abs2.ivy)
      • specifies: garbage collector concurrency
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 31 lines in this file; exact source
    • gc_copy (examples/ivy/gc_copy.ivy)
      • specifies: garbage collector concurrency
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 240 lines in this file; exact source
    • gc_copy.save (examples/ivy/gc_copy.save.ivy)
      • specifies: garbage collector concurrency
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 302 lines in this file; exact source
    • gc_copy_oded (examples/ivy/gc_copy_oded.ivy)
      • specifies: garbage collector concurrency
      • safety: conjecture repr(hroot, mroot) (source); conjecture taddr(mroot) (source); conjecture tlo <= tnext & tnext <= talloc (source); conjecture tnext < thi (source); conjecture tlo <= talloc & talloc <= thi (source); conjecture mroot = tlo (source); conjecture repr(O1, A) & repr(O2, A) -> O1 = O2 (source); conjecture repr(O, A) -> ((faddr(A) & ~copied_to(A, X)) | (tlo <= A & A < talloc)) (source); conjecture (repr(O1,A1) & h0(O1,O2) -> dom[m0](A1)) (source); conjecture (repr(O1, A1) & h0(O1, O2) & repr(O2, A2) & m0(A1, A3)) -> (A2 = A3 | copied_to(A3, A2)) (source); conjecture (taddr(A1) & m0(A1,A2) & A1 < tnext) -> (taddr(A2) & A2 < talloc) (source); conjecture (tnext <= A1 & A1 < talloc & m0(A1,A2)) -> faddr(A2) (source); conjecture (repr(O1, A1) & repr(O2, A2) & m0(A1, A2)) -> h0(O1, O2) (source); conjecture (faddr(A1) & m0(A1,A2)) -> faddr(A2) (source); conjecture (repr(O1, A1) & repr(O2, A3) & m0(A1, A2) & copied_to(A2, A3)) -> h0(O1, O2) (source); conjecture (repr(O1,A1) & h0(O1,O2) & m0(A1,A2) & taddr(A2)) -> repr(O2,A2) (source); conjecture (repr(O1,A1) & h0(O1,O2) & m0(A1,A2) & copied_to(A2, A3)) -> repr(O2,A3) (source); conjecture ~(m0(A1,A2) & faddr(A1) & ~faddr(A2)) (source); conjecture copied_to(A1,A2) -> faddr(A1) (source); conjecture copied_to(A1,A2) -> tlo <= A2 (source); conjecture (copied_to(A,A1) & copied_to(A,A2)) -> A1 = A2 (source); conjecture (copied_to(A1,A) & copied_to(A2,A)) -> A1 = A2 (source)
        • plain reading (inference from declaration): heap representation and reachability relations stay consistent with the reference heap
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 305 lines in this file; exact source
    • gc_temp_abs (examples/ivy/gc_temp_abs.ivy)
      • specifies: garbage collector concurrency
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 34 lines in this file; exact source
    • gc_test (examples/ivy/gc_test.ivy)
      • specifies: garbage collector concurrency
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 240 lines in this file; exact source
    • toy_lock (examples/ivy/ironfleet_toy_lock/toy_lock.ivy)
      • specifies: lock protocol
      • safety: conjecture l.sent(P) -> an.transfer(af.ep(P),af.dst(P)) (source); conjecture locked(E, N1) & locked(E, N2) -> N1 = N2 (source); conjecture an.transfer(E, N1) & an.transfer(E, N2) -> N1 = N2 (source); conjecture locked(E, N) -> (E <= ep(N)) (source); conjecture held(N) & N ~= M -> ~(ep(N) <= ep(M)) (source); conjecture held(N) & an.transfer(E, M) -> (E <= ep(N)) (source); conjecture an.transfer(E, N) & ~(E <= ep(N)) -> ~(E <= ep(M)) (source); conjecture an.transfer(E, N) & ~(E <= ep(N)) & an.transfer(F, M) -> (F <= E) (source)
        • plain reading (inference from declaration): two nodes cannot simultaneously own the same lock/lock epoch
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 321 lines in this file; exact source
    • ironfleet_toy_lock_refined (examples/ivy/ironfleet_toy_lock_refined.ivy)
      • specifies: lock protocol
      • safety: conjecture l.sent(P) -> an.transfer(f.ep(P),f.dst(P)) (source); conjecture locked(E, N1) & locked(E, N2) -> N1 = N2 (source); conjecture an.transfer(E, N1) & an.transfer(E, N2) -> N1 = N2 (source); conjecture locked(E, N) -> (E <= ep(N)) (source); conjecture held(N) & N ~= M -> ~(ep(N) <= ep(M)) (source); conjecture held(N) & an.transfer(E, M) -> (E <= ep(N)) (source); conjecture an.transfer(E, N) & ~(E <= ep(N)) -> ~(E <= ep(M)) (source); conjecture an.transfer(E, N) & ~(E <= ep(N)) & an.transfer(F, M) -> (F <= E) (source)
        • plain reading (inference from declaration): two nodes cannot simultaneously own the same lock/lock epoch
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 287 lines in this file; exact source
    • learning (examples/ivy/learning.ivy)
      • specifies: learning network switch
      • safety: conjecture ~(route(S).dom(V0) & ~route(S).tc(V0, S)) (source); conjecture ~route(V0).dom(V0) (source); conjecture ~(pending(P, V0, V1) & dst(P) = V0) (source); conjecture ~(pending(P, V0, V1) & ~route(src(P)).dom(V0) & V0 ~= src(P)) (source); conjecture ~(route(S).tc(V0, V1) & ~V0 = V1 & ~route(S).dom(V0)) (source); conjecture ~(route(S).tc(V0, V1) & ~V0 = V1 & S ~= V1 & ~route(S).dom(V1)) # TODO: needed? (source); conjecture ~(~V0 = S & route(S).tc(S, V0)) (source)
        • plain reading (inference from declaration): forwarding/learning relations satisfy the stated route/tree consistency constraints
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 124 lines in this file; exact source
    • learning_sorted_e (examples/ivy/learning_sorted_e.ivy)
      • specifies: learning network switch
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 132 lines in this file; exact source
    • learning_sorted_non_epr (examples/ivy/learning_sorted_non_epr.ivy)
      • specifies: learning network switch
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 135 lines in this file; exact source
    • learning_switch (examples/ivy/learning_switch.ivy)
      • specifies: learning network switch
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 77 lines in this file; exact source
    • learning_un (examples/ivy/learning_un.ivy)
      • specifies: learning network switch
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 98 lines in this file; exact source
    • learning_un_e (examples/ivy/learning_un_e.ivy)
      • specifies: learning network switch
      • safety: conjecture ~(e(S, V0) & ~rp(S, V0, S)) (source); conjecture e(V0,V0) (source); conjecture ~(pending(P, V0, V1) & dst(P,D) & D = V0) (source); conjecture ~(pending(P, V0, V1) & src(P,S) & ~e(S, V0)) (source); conjecture ~(~V0 = S & rp(S, S, V0)) (source)
        • plain reading (inference from declaration): forwarding/learning relations satisfy the stated route/tree consistency constraints
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 125 lines in this file; exact source
    • learning_un_ins (examples/ivy/learning_un_ins.ivy)
      • specifies: learning network switch
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 103 lines in this file; exact source
    • learning_with_count (examples/ivy/learning_with_count.ivy)
      • specifies: learning network switch
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 186 lines in this file; exact source
    • learning_withcount (examples/ivy/learning_withcount.ivy)
      • specifies: learning network switch
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 177 lines in this file; exact source
    • spanning_tree (examples/ivy/spanning_tree.ivy)
      • specifies: spanning-tree protocol
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 45 lines in this file; exact source
    • toy_consensus (examples/ivy/toy_consensus.ivy)
      • specifies: consensus/agreement protocol
      • safety: conjecture decision(V1) & decision(V2) -> V1 = V2 (source); conjecture vote(N,V1) & vote(N,V2) -> V1 = V2 (source); conjecture decision(V) -> exists Q:quorum. forall N:node. member(N, Q) -> vote(N,V) (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 39 lines in this file; exact source
    • toy_consensus2 (examples/ivy/toy_consensus2.ivy)
      • specifies: consensus/agreement protocol
      • safety: conjecture decision(V1) & decision(V2) -> V1 = V2 (source); conjecture vote(N,V1) & vote(N,V2) -> V1 = V2 (source); conjecture decision(V) -> exists Q:quorum. nodeset.majority(Q) & (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 69 lines in this file; exact source
    • toy_lock (examples/ivy/toy_lock_udp/toy_lock.ivy)
      • specifies: lock protocol
      • safety: conjecture l.sent(D,P) & get_tg(P) = xfer -> an.transfer(get_ep(P),D) (source); conjecture pend(S) & P = pend_pkt(S) & succ(S,D) -> get_tg(P) = xfer & an.transfer(get_ep(P),D) (source); conjecture an.transfer(E, N1) & an.transfer(E, N2) -> N1 = N2 (source); conjecture held(N) & N ~= M -> ~(ep(N) <= ep(M)) (source); conjecture held(N) & an.transfer(E, M) -> (E <= ep(N)) (source); conjecture an.transfer(E, N) & ~(E <= ep(N)) -> ~(E <= ep(M)) (source); conjecture an.transfer(E, N) & ~(E <= ep(N)) & an.transfer(F, M) -> (F <= E) (source)
        • plain reading (inference from declaration): two nodes cannot simultaneously own the same lock/lock epoch
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 433 lines in this file; exact source
    • alternating_bit_protocol (examples/liveness/alternating_bit_protocol.ivy)
      • specifies: alternating-bit message delivery
      • safety: invariant le(X, Y) & le(Y, Z) -> le(X, Z) # Transitivity (source)
        • plain reading (inference from declaration): the named state invariants restrict legal reachable states; the excerpt is not sufficient to give a more specific guarantee without reading the complete formula
        • 82 state invariant declarations; all clauses in source
      • liveness: temporal property [liveness] ( ((exists I. ~ globally (sender_array(I ) ~= bot -> (eventually receiver_array(I ) ~= bot))) -> (source)
        • plain reading (inference from formula): the modeled message/election operation eventually completes under the encoded fairness assumptions; proof witness clauses are auxiliary
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 486 lines in this file; exact source
    • hybrid_reliable_broadcast_cisa (examples/liveness/hybrid_reliable_broadcast_cisa.ivy)
      • specifies: reliable broadcast
      • safety: invariant (exists N. obedient(N) & accept(N)) -> (exists M. obedient(M) & rcv_init(M)) # unforgebility (source)
        • plain reading (inference from declaration): a correct accepting node implies some correct node received an initiating broadcast; no spontaneous forged delivery
        • 77 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 433 lines in this file; exact source
    • split_queue_2_new (examples/liveness/split_queue_2_new.ivy)
      • specifies: queue concurrency/progress
      • safety: invariant ~now (source)
        • plain reading (inference from declaration): the transient event flag is false between actions; an auxiliary modeling invariant
        • 7 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 189 lines in this file; exact source
    • ticket (examples/liveness/ticket.ivy)
      • specifies: ticket lock
      • safety: invariant pc1(T) | pc2(T) | pc3(T) (source)
        • plain reading (inference from declaration): at most one process is in the encoded critical section
        • 42 state invariant declarations; all clauses in source
      • liveness: temporal property [nonstarvation] ( ((exists T0. ~(globally ~(pc2(T0) & globally ~pc3(T0)))) -> ~(globally ~(pc2(t0) & globally ~pc3(t0)))) (source)
        • plain reading (inference from formula): requests eventually reach the modeled granted/critical state under the encoded scheduling fairness and other premises; proof witness clauses are auxiliary
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 243 lines in this file; exact source
    • ticket_nested (examples/liveness/ticket_nested.ivy)
      • specifies: ticket lock
      • safety: invariant [safety] pc3(T1) & pc3(T2) -> T1 = T2 (source)
        • plain reading (inference from declaration): at most one process is in the encoded critical section
        • 61 state invariant declarations: safety
      • liveness: temporal property [nonstarvation] ( ((exists T0. ~(globally ~(pc2(T0) & globally ~pc3(T0)))) -> ~(globally ~(pc2(sk0) & globally ~pc3(sk0)))) & (source)
        • plain reading (inference from formula): requests eventually reach the modeled granted/critical state under the encoded scheduling fairness and other premises; proof witness clauses are auxiliary
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 294 lines in this file; exact source
    • tlb (examples/liveness/tlb.ivy)
      • specifies: TLB coherence
      • safety: invariant pc_i3(P) | pc_i4(P) | pc_i5(P) | pc_i6(P) | pc_i7(P) | pc_i8(P) | pc_i9(P) | pc_i11(P) | pc_i12(P) | pc_i14(P) -> plock(writepmap(P)) (source)
        • plain reading (inference from declaration): the named state invariants restrict legal reachable states; the excerpt is not sufficient to give a more specific guarantee without reading the complete formula
        • 664 state invariant declarations; all clauses in source
      • liveness: temporal property [nonstarvation] ( ((exists P. ~ globally ~ globally ~ (pc_m2(P) | pc_r6(P))) -> ~ globally ~ globally ~ (pc_m2(sk0) | pc_r6(sk0))) & (source)
        • plain reading (inference from formula): requests eventually reach the modeled granted/critical state under the encoded scheduling fairness and other premises; proof witness clauses are auxiliary
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 1592 lines in this file; exact source
    • chord (examples/pldi16/chord.ivy)
      • specifies: Chord ring maintenance
      • safety: conjecture ~(final & err(X)) (source); conjecture (a(X) | p(Y, X) | ~s1(X, Y)) (source); conjecture (a(X) | X ~= q) (source); conjecture (a(X) | ~p(Y, X) | ~s1(X, Y)) (source); conjecture (a(X) | ~s2(X, Y)) (source); conjecture (a(Y) | a(Z) | ~s1(X, Y) | ~s2(X, Z)) (source); conjecture (a(Y) | dom[s2](X) | ~a(X) | ~s1(X, Y)) (source); conjecture (a(Y) | ~a(X) | ~p(Y, X) | ~s1(X, Y)) (source); conjecture (dom[s1](X) | ~a(X)) (source); conjecture (~btw(X, q, Y) | ~s1(X, Y)) (source); conjecture ~(down(S1, q) & down(S2, q) & down(S2, S1) & s1(S2, S1) & s2(S2, S2) & S1 ~= q & S2 ~= q) (source); conjecture ~(down(S0, q) & down(S0, S1) & down(S0, S2) & down(S1, q) & down(S2, q) & down(S2, S1) & s1(S2, S1) & s2(S2, S0) & S0 ~= q & S1 ~= q & S2 ~= q) (source)
        • plain reading (inference from declaration): the final Chord state has no modeled error
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 289 lines in this file; exact source
    • database_chain_replication (examples/pldi16/database_chain_replication.ivy)
      • specifies: chain-replicated database
      • safety: conjecture ~(TX1 ~= TX2 & (source); conjecture commit_tx(T) & op_in_tx(T, O) & op_node(O, N) -> precommit_tx(T, N) (source); conjecture depends_tx(T1, K, T2) -> (le(T2, T1) & (T1 ~= T2 | T1 = zero)) (source); conjecture ~abort_tx(Tx) | ~commit_tx(Tx) # Abort and commit are disjoint (source); conjecture (~precommit_tx(T, N) & ~abort_tx(T) & node_for_key(K, N)) -> ~write_tx(T, K) (source); conjecture (~precommit_tx(T, N) & ~abort_tx(T) & node_for_key(K, N)) -> ~depends_tx(T, K, T2) (source); conjecture commit_tx(zero) (source); conjecture ~(~read_tx(T1, K0) & depends_tx(T1, K0, T0)) (source); conjecture ~(T0 ~= T2 & le(T0, T1) & le(T2, T0) & (~abort_tx(T0)) & (~abort_tx(T1))& depends_tx(T1, K0, T2) & write_tx(T0, K0)) (source)
        • plain reading (inference from declaration): transaction order and key dependencies satisfy the chain-replication consistency clauses
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 236 lines in this file; exact source
    • leader_election_ring (examples/pldi16/leader_election_ring.ivy)
      • specifies: leader election
      • safety: conjecture leader(X) & leader(Y) -> X = Y # at most one leader (source); conjecture leader(X) -> le(idn(Y), idn(X)) # leader has highest id (source)
        • plain reading (inference from declaration): at most one node is elected leader
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 125 lines in this file; exact source
    • leader_election_ring_btw (examples/pldi16/leader_election_ring_btw.ivy)
      • specifies: leader election
      • safety: conjecture leader(X) & leader(Y) -> X = Y # at most one leader (source); conjecture leader(X) -> le(idn(Y), idn(X)) # leader has highest id (source)
        • plain reading (inference from declaration): at most one node is elected leader
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 132 lines in this file; exact source
    • leader_election_ring_bug (examples/pldi16/leader_election_ring_bug.ivy)
      • specifies: leader election
      • safety: conjecture leader(X) & leader(Y) -> X = Y # at most one leader (source)
        • plain reading (inference from declaration): at most one node is elected leader
      • liveness: no active temporal/progress declaration found in this file
      • negative-test warning: the filename marks this as a bad/buggy/unsafe/error variant; displayed properties are attempted checks, not established guarantees
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 118 lines in this file; exact source
    • learning_switch (examples/pldi16/learning_switch.ivy)
      • specifies: learning network switch
      • safety: conjecture tc(X,X) # Reflexivity (source); conjecture tc(X, Y) & tc(Y, Z) -> tc(X, Z) # Transitivity (source); conjecture tc(X, Y) & tc(Y, X) -> X = Y # Anti-symmetry (source); conjecture tc(X, Y) & tc(X, Z) -> (tc(Y, Z) | tc(Z, Y)) # Semi-linearity (source); conjecture ~(route.tc(N1,N1,N0) & N1 ~= N0) (source); conjecture ~(route.tc(N2,N0,N2) & N0 ~= N2 & ~route.dom(N2,N0)) # this is actually not needed (source); conjecture ~(route.tc(N0,N2,N1) & N1 ~= N2 & ~route.dom(N0,N2)) (source); conjecture ~(route.tc(N2,N1,N0) & N0 ~= N2 & N1 ~= N0 & ~route.dom(N2,N0)) (source); conjecture ~(pending(P0,N1,N0) & N1 ~= src(P0) & ~route.dom(src(P0),N1)) (source)
        • plain reading (inference from declaration): forwarding/learning relations satisfy the stated route/tree consistency constraints
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 121 lines in this file; exact source
    • raft_logs (examples/raft/raft_logs.ivy)
      • specifies: Raft replicated log
      • safety: conjecture committed(L,S) -> maj(S) (source); conjecture committed(L,S) & mem(N,S) -> (L < node_logs(N) | L = node_logs(N)) (source); conjecture committed(L:log,S:node_set) & mem(N:node,S) & ~(L < node_logs(M:node) | L = node_logs(M:node)) -> meas(node_logs(M:node)) < meas(node_logs(N:node)) (source); conjecture ~(meas(node_logs(NO0)) < meas(LO1) & abs_net.sent(NO0,LO1)) (source); conjecture committed(L:log,S:node_set) & mem(N:node,S) & abs_net.sent(M,L2) & ~(L < L2 | L = L2) -> meas(L2) < meas(node_logs(N:node)) (source)
        • plain reading (inference from declaration): a committed Raft log entry has majority support
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 139 lines in this file; exact source
    • proto (examples/sht/proto.ivy)
      • specifies: sharded hash table
      • safety: conjecture p.impl.dm(me).map(K,me) -> hash.hash(K) = ref.hash(K) (source); conjecture p.impl.dm(me).map(K,me) & X ~= me -> ~p.impl.dm(X).map(K,X) (source); conjecture p.impl.dm(me).map(K,me) -> ~(trans.delegated(X,S) & shard.lo(S) <= K & K <= shard.hi(S)) (source); conjecture trans.delegated(X,S) & shard.lo(S) <= K & K <= shard.hi(S) (source); conjecture trans.requested(D,R) & L = req.ltime(R)-> (source); conjecture trans.replied(D,R) & L = req.ltime(R)-> (source); conjecture trans.requested(D,R) -> ref.generated(req.ltime(R)) & ~ref.evs(req.ltime(R)).serialized (source); conjecture trans.replied(D,R) -> ref.generated(req.ltime(R)) & ref.evs(req.ltime(R)).serialized (source); conjecture trans.requested(D1,R1) & trans.requested(D2,R2) & req.ltime(R1) = req.ltime(R2) (source); conjecture trans.replied(D1,R1) & trans.replied(D2,R2) & req.ltime(R1) = req.ltime(R2) (source); conjecture trans.delegated(X,S) & shard.lo(S) <= K & K <= shard.hi(S) -> shard.value(S,K) = ref.hash(K) (source); conjecture ref.evs(T).serialized -> ref.generated(T) (source)
        • plain reading (inference from declaration): a node’s key map agrees with the reference mapping
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 182 lines in this file; exact source
    • reference (examples/sht/reference.ivy)
      • specifies: sharded hash table
      • safety: assert ~evs(lt).serialized; (source); assert evs(lt).serialized (source)
        • plain reading (inference from declaration): the listed action preconditions/postconditions constrain individual protocol operations; they are not a separately identified global safety theorem
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 114 lines in this file; exact source
    • shard (examples/sht/shard.ivy)
      • specifies: sharded key-value storage
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 51 lines in this file; exact source
    • sht (examples/sht/sht.ivy)
      • specifies: sharded hash table
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 54 lines in this file; exact source
    • sht_abs (examples/sht/sht_abs.ivy)
      • specifies: sharded hash table
      • safety: conjecture map(K,V) & map(K,W) -> V = W (source); conjecture has.s(K) & has.succ.map(K,L) & K <= M & (L = 0 | ~(L <= M)) -> dma.map(me,M,entries(K)) (source); conjecture has.s(0) (source); conjecture dma(me).map(K,me) -> hash.hash(K) = ref.hash(K) (source); conjecture dma(me).map(K,me) & X ~= me -> ~dma(X).map(K,X) (source); conjecture dma(me).map(K,me) -> ~(net.delegated(X,S) & shard_lo(S) <= K & K <= shard_hi(S)) (source); conjecture net.delegated(X,S) & shard_lo(S) <= K & K <= shard_hi(S) (source); conjecture net.requested(D,R) & L = req_ltime(R)-> (source); conjecture net.requested(D,R) -> io_spec.generated(req_ltime(R)) & ~ref.evs(req_ltime(R)).serialized (source); conjecture net.requested(D1,R1) & net.requested(D2,R2) & req_ltime(R1) = req_ltime(R2) (source); conjecture net.delegated(X,S) & shard_lo(S) <= K & K <= shard_hi(S) -> shard_value(S,K) = ref.hash(K) (source); conjecture ref.evs(T).serialized -> io_spec.generated(T) (source); conjecture mq(D).contents(M) & neti(D).recv_seq(me) <= net_msg_seq_num(M) (source); conjecture mq(D).contents(M) & neti(D).recv_seq(me) <= net_msg_seq_num(M) (source); conjecture neti(S1).mq(D).contents(M1) & neti(D).recv_seq(S1) <= net_msg_seq_num(M1) (source); conjecture neti(S1).mq(D).contents(M1) & neti(D).recv_seq(S1) <= net_msg_seq_num(M1) (source); conjecture mq(D).contents(M) -> ~(send_seq(D) <= net_msg_seq_num(M)) (source); conjecture mq(D).contents(M1) & mq(D).contents(M2) & M1 ~= M2 (source); conjecture low.sent(M) & net_msg_src(M) = me & net_msg_dst(M) = D (source); conjecture low.sent(M) & net_msg_src(M) = S & net_msg_dst(M) = D (source); conjecture low.sent(M) & net_msg_src(M) = S & net_msg_dst(M) = D (source); conjecture low.sent(M) & net_msg_src(M) = me & net_msg_mtype(M) ~= ack_t (source); conjecture mq(D).contents(M) -> net_msg_src(M) = me & net_msg_dst(M) = D & net_msg_mtype(M) ~= ack_t (source)
        • plain reading (inference from declaration): a node’s key map agrees with the reference mapping
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 734 lines in this file; exact source
    • sht_abs_v1 (examples/sht/sht_abs_v1.ivy)
      • specifies: sharded hash table
      • safety: conjecture dm.map(K,me) -> hash.hash(K) = ref.hash(K) (source); conjecture dm.map(K,me) & X ~= me -> ~servers(X).dm.map(K,X) (source); conjecture dm.map(K,me) -> ~(net.delegated(X,S) & shard_lo(S) <= K & K <= shard_hi(S)) (source); conjecture net.delegated(X,S) & shard_lo(S) <= K & K <= shard_hi(S) (source); conjecture net.requested(D,R) & L = req_ltime(R)-> (source); conjecture net.requested(D,R) -> net.generated(req_ltime(R)) (source); conjecture net.requested(D1,R1) & net.requested(D2,R2) & req_ltime(R1) = req_ltime(R2) (source); conjecture net.delegated(X,S) & shard_lo(S) <= K & K <= shard_hi(S) -> shard_value(S,K) = ref.hash(K) (source); conjecture mq(D).contents(M) & neti(D).recv_seq(me) <= net_msg_seq_num(M) (source); conjecture mq(D).contents(M) & neti(D).recv_seq(me) <= net_msg_seq_num(M) (source); conjecture neti(S1).mq(D).contents(M1) & neti(D).recv_seq(S1) <= net_msg_seq_num(M1) (source); conjecture neti(S1).mq(D).contents(M1) & neti(D).recv_seq(S1) <= net_msg_seq_num(M1) (source); conjecture mq(D).contents(M) -> ~(send_seq(D) <= net_msg_seq_num(M)) (source); conjecture mq(D).contents(M1) & mq(D).contents(M2) (source); conjecture low.sent(M) & net_msg_src(M) = me & net_msg_dst(M) = D (source); conjecture low.sent(M) & net_msg_mtype(M) = request_t & net_msg_dst(M) = D (source); conjecture low.sent(M) & net_msg_mtype(M) = delegate_t & net_msg_dst(M) = D (source)
        • plain reading (inference from declaration): a node’s key map agrees with the reference mapping
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 642 lines in this file; exact source
    • sht_abs_v2 (examples/sht/sht_abs_v2.ivy)
      • specifies: sharded hash table
      • safety: conjecture dm.map(K,me) -> hash.hash(K) = ref.hash(K) (source); conjecture dm.map(K,me) & X ~= me -> ~servers(X).dm.map(K,X) (source); conjecture dm.map(K,me) -> ~(net.delegated(X,S) & shard_lo(S) <= K & K <= shard_hi(S)) (source); conjecture net.delegated(X,S) & shard_lo(S) <= K & K <= shard_hi(S) (source); conjecture net.requested(D,R) & L = req_ltime(R)-> (source); conjecture net.requested(D,R) -> net.generated(req_ltime(R)) (source); conjecture net.requested(D1,R1) & net.requested(D2,R2) & req_ltime(R1) = req_ltime(R2) (source); conjecture net.delegated(X,S) & shard_lo(S) <= K & K <= shard_hi(S) -> shard_value(S,K) = ref.hash(K) (source); conjecture mq(D).contents(M) & neti(D).recv_seq(me) <= net_msg_seq_num(M) (source); conjecture mq(D).contents(M) & neti(D).recv_seq(me) <= net_msg_seq_num(M) (source); conjecture neti(S1).mq(D).contents(M1) & neti(D).recv_seq(S1) <= net_msg_seq_num(M1) (source); conjecture neti(S1).mq(D).contents(M1) & neti(D).recv_seq(S1) <= net_msg_seq_num(M1) (source); conjecture mq(D).contents(M) -> ~(send_seq(D) <= net_msg_seq_num(M)) (source); conjecture mq(D).contents(M1) & mq(D).contents(M2) (source); conjecture low.sent(M) & net_msg_src(M) = me & net_msg_dst(M) = D (source); conjecture low.sent(M) & net_msg_src(M) = S & net_msg_dst(M) = D (source); conjecture low.sent(M) & net_msg_src(M) = S & net_msg_dst(M) = D (source)
        • plain reading (inference from declaration): a node’s key map agrees with the reference mapping
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 648 lines in this file; exact source
    • sht_abs_v3 (examples/sht/sht_abs_v3.ivy)
      • specifies: sharded hash table
      • safety: conjecture dm.map(K,me) -> hash.hash(K) = ref.hash(K) (source); conjecture dm.map(K,me) & X ~= me -> ~servers(X).dm.map(K,X) (source); conjecture dm.map(K,me) -> ~(net.delegated(X,S) & shard_lo(S) <= K & K <= shard_hi(S)) (source); conjecture net.delegated(X,S) & shard_lo(S) <= K & K <= shard_hi(S) (source); conjecture net.requested(D,R) & L = req_ltime(R)-> (source); conjecture net.requested(D,R) -> net.generated(req_ltime(R)) (source); conjecture net.requested(D1,R1) & net.requested(D2,R2) & req_ltime(R1) = req_ltime(R2) (source); conjecture net.delegated(X,S) & shard_lo(S) <= K & K <= shard_hi(S) -> shard_value(S,K) = ref.hash(K) (source); conjecture mq(D).contents(M) & neti(D).recv_seq(me) <= net_msg_seq_num(M) (source); conjecture mq(D).contents(M) & neti(D).recv_seq(me) <= net_msg_seq_num(M) (source); conjecture neti(S1).mq(D).contents(M1) & neti(D).recv_seq(S1) <= net_msg_seq_num(M1) (source); conjecture neti(S1).mq(D).contents(M1) & neti(D).recv_seq(S1) <= net_msg_seq_num(M1) (source); conjecture mq(D).contents(M) -> ~(send_seq(D) <= net_msg_seq_num(M)) (source); conjecture mq(D).contents(M1) & mq(D).contents(M2) (source); conjecture low.sent(M) & net_msg_src(M) = me & net_msg_dst(M) = D (source); conjecture low.sent(M) & net_msg_src(M) = S & net_msg_dst(M) = D (source); conjecture low.sent(M) & net_msg_src(M) = S & net_msg_dst(M) = D (source)
        • plain reading (inference from declaration): a node’s key map agrees with the reference mapping
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 653 lines in this file; exact source
    • sht_abs_v4 (examples/sht/sht_abs_v4.ivy)
      • specifies: sharded hash table
      • safety: conjecture dm.map(K,me) -> hash.hash(K) = ref.hash(K) (source); conjecture dm.map(K,me) & X ~= me -> ~servers(X).dm.map(K,X) (source); conjecture dm.map(K,me) -> ~(net.delegated(X,S) & shard_lo(S) <= K & K <= shard_hi(S)) (source); conjecture net.delegated(X,S) & shard_lo(S) <= K & K <= shard_hi(S) (source); conjecture net.requested(D,R) & L = req_ltime(R)-> (source); conjecture net.requested(D,R) -> net.generated(req_ltime(R)) (source); conjecture net.requested(D1,R1) & net.requested(D2,R2) & req_ltime(R1) = req_ltime(R2) (source); conjecture net.delegated(X,S) & shard_lo(S) <= K & K <= shard_hi(S) -> shard_value(S,K) = ref.hash(K) (source); conjecture mq(D).contents(M) & neti(D).recv_seq(me) <= net_msg_seq_num(M) (source); conjecture mq(D).contents(M) & neti(D).recv_seq(me) <= net_msg_seq_num(M) (source); conjecture neti(S1).mq(D).contents(M1) & neti(D).recv_seq(S1) <= net_msg_seq_num(M1) (source); conjecture neti(S1).mq(D).contents(M1) & neti(D).recv_seq(S1) <= net_msg_seq_num(M1) (source); conjecture mq(D).contents(M) -> ~(send_seq(D) <= net_msg_seq_num(M)) (source); conjecture mq(D).contents(M1) & mq(D).contents(M2) (source); conjecture low.sent(M) & net_msg_src(M) = me & net_msg_dst(M) = D (source); conjecture low.sent(M) & net_msg_src(M) = S & net_msg_dst(M) = D (source); conjecture low.sent(M) & net_msg_src(M) = S & net_msg_dst(M) = D (source)
        • plain reading (inference from declaration): a node’s key map agrees with the reference mapping
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 656 lines in this file; exact source
    • trans (examples/sht/trans.ivy)
      • specifies: sharded hash table
      • safety: conjecture mq(D).contents(M) & impl(D).recv_seq(me) <= net_msg.num(M) (source); conjecture mq(D).contents(M) & impl(D).recv_seq(me) <= net_msg.num(M) (source); conjecture mq(D).contents(M) & impl(D).recv_seq(me) <= net_msg.num(M) (source); conjecture impl(S1).mq(D).contents(M1) & impl(D).recv_seq(S1) <= net_msg.num(M1) (source); conjecture impl(S1).mq(D).contents(M1) & impl(D).recv_seq(S1) <= net_msg.num(M1) (source); conjecture impl(S1).mq(D).contents(M1) & impl(D).recv_seq(S1) <= net_msg.num(M1) (source); conjecture mq(D).contents(M) -> ~(send_seq(D) <= net_msg.num(M)) (source); conjecture mq(D).contents(M1) & mq(D).contents(M2) & M1 ~= M2 (source); conjecture lower.spec.sent(M,D) & net_msg.src(M) = me (source); conjecture lower.spec.sent(M,D) & net_msg.src(M) = S (source); conjecture lower.spec.sent(M,D) & net_msg.src(M) = S (source); conjecture lower.spec.sent(M,D) & net_msg.src(M) = me & net_msg.mty(M) ~= ack_t (source); conjecture mq(D).contents(M) -> net_msg.src(M) = me & net_msg.mty(M) ~= ack_t (source)
        • plain reading (inference from declaration): buffered messages satisfy the receiver sequence-number ordering invariant
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 249 lines in this file; exact source
    • tilelink1 (examples/tilelink/tilelink1.ivy)
      • specifies: TileLink cache coherence
      • safety: assert own(a) ~= none & lleq(lt,nlt); (source); assert mem(nlt,a,d) (source); assert own(a) = none & lleq(lt,nlt); (source)
        • plain reading (inference from declaration): cache ownership, dirty-data, probe, and interface states satisfy the listed coherence/refinement clauses
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 284 lines in this file; exact source
    • tilelink2 (examples/tilelink/tilelink2.ivy)
      • specifies: TileLink cache coherence
      • safety: assert cached(a); (source); assert own(a) ~= none; (source); assert mem(a,d) (source)
        • plain reading (inference from declaration): cache ownership, dirty-data, probe, and interface states satisfy the listed coherence/refinement clauses
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 623 lines in this file; exact source
    • tilelink_abstract_spec (examples/tilelink/tilelink_abstract_spec.ivy)
      • specifies: TileLink cache coherence
      • safety: conjecture dirt_p(A) -> excl_p(A) (source); conjecture (excl_p(A) | shrd_p(A)) -> cached(A) (source); conjecture ~(to_ser(T) & cached(ref.evs(T).addr_)) (source); conjecture ~(ref.prevents(T1,T2) & ~to_ser(T1) & to_ser(T2)) (source); conjecture to_ser(T) -> side(ref.evs(T).id_) = client (source)
        • plain reading (inference from declaration): cache ownership, dirty-data, probe, and interface states satisfy the listed coherence/refinement clauses
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 518 lines in this file; exact source
    • tilelink_concrete_directory (examples/tilelink/tilelink_concrete_directory.ivy)
      • specifies: TileLink cache coherence
      • safety: conjecture b.pend_prb(H,W) <-> intf.prb_addr(H,W) (source); conjecture ~intf.none_r(H,W) (source); conjecture b.cache_excl(H,W) <-> intf.excl_p(addr_cons(H,W)) (source); conjecture b.cache_shrd(H,W) <-> intf.shrd_p(addr_cons(H,W)) (source); conjecture b.pend_excl(H,W) -> intf.excl_r(H) | intf.excl_a(H) (source); conjecture intf.excl_r(H) -> b.pend_excl(H,W) (source); conjecture intf.excl_a(H) -> exists W. b.pend_excl(H,W) (source); conjecture b.pend_shrd(H,W) -> intf.shrd_r(H) | intf.shrd_a(H) (source); conjecture intf.shrd_r(H) -> b.pend_shrd(H,W) (source); conjecture intf.shrd_a(H) -> exists W. b.pend_shrd(H,W) (source); conjecture ((intf.excl_f(H) <-> b.pend_fnse(H)) & (intf.shrd_f(H) <-> b.pend_fnss(H))) (source); conjecture (b.pend_excl(H,W) -> ~b.pend_fnse(H)) & (b.pend_shrd(H,W) -> ~b.pend_fnss(H)) (source); conjecture (~intf.excl_f(H) & b.pend_fnse(H) -> intf.excl_p(addr_cons(H,W))) (source); conjecture (intf.excl_r(H) | intf.shrd_r(H)) -> intf.addr_rid(H) = b.addr_id(H) (source); conjecture (intf.excl_a(H) | intf.shrd_a(H) | intf.excl_f(H) | intf.shrd_f(H)) -> intf.addr_id(H) = b.addr_id(H) (source); conjecture ~(b.cache_shrd(H,W) & b.pend_shrd(H,W)) & ~(b.cache_excl(H,W) & b.pend_excl(H,W)) (source); conjecture b.pend_excl(H,W1) & ~b.cache_excl(H,W2) -> b.pend_excl(H,W2) (source); conjecture b.pend_shrd(H,W1) & ~b.cache_shrd(H,W2) -> b.pend_shrd(H,W2) (source); conjecture ~(b.pend_prb(H,W1) & (b.pend_excl(H,W2) | b.pend_fnse(H) | b.pend_shrd(H,W2) | b.pend_fnss(H))) (source); conjecture ~((b.pend_excl(H1,W1) | b.pend_shrd(H1,W1) | b.pend_fnse(H1) | b.pend_fnss(H1)) (source); conjecture ~b.dir0.cache_excl(H,W) & ~b.dir1.cache_excl(H,W) -> b.mem(addr_cons(H,W)) = ref.mem(addr_cons(H,W)) (source); conjecture ~intf0.dirt_p(A) & ~intf1.dirt_p(A) -> b.mem(A) = ref.mem(A) (source); conjecture ~(b.dir0.cache_excl(H,W) & b.dir1.cache_excl(H,W)) (source)
        • plain reading (inference from declaration): cache ownership, dirty-data, probe, and interface states satisfy the listed coherence/refinement clauses
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 309 lines in this file; exact source
    • tilelink_concrete_snoopy (examples/tilelink/tilelink_concrete_snoopy.ivy)
      • specifies: TileLink cache coherence
      • safety: conjecture b.pend_prb(H,W) <-> back.prb_addr(H,W) (source); conjecture b.pend_rls(H,W) <-> back.none_r(H,W) (source); conjecture b.cache_excl(H,W) <-> back.excl_p(addr_cons(H,W)) (source); conjecture b.pend_excl(H,W) -> back.excl_r(H) | back.excl_a(H) (source); conjecture back.excl_r(H) -> b.pend_excl(H,W) (source); conjecture back.excl_a(H) -> exists W. b.pend_excl(H,W) (source); conjecture b.pend_shrd(H,W) -> back.shrd_r(H) | back.shrd_a(H) (source); conjecture back.shrd_r(H) -> b.pend_shrd(H,W) (source); conjecture back.shrd_a(H) -> exists W. b.pend_shrd(H,W) (source); conjecture ~back.excl_f(H) & ~back.shrd_f(H) (source); conjecture ~back.unc_r(H,W) & ~back.unc_a(H,W) & ~back.unc_f(H,W) (source); conjecture ~front.unc_r(H,W) & ~front.unc_a(H,W) (source); conjecture ~front.excl_r(H) & ~front.excl_a(H) & ~front.excl_f(H) (source); conjecture ~front.shrd_r(H) & ~front.shrd_a(H) & ~front.shrd_f(H) (source); conjecture front.unc_f(H,W) -> b.wait_finish (source); conjecture front.unc_f(H1,W1) & front.unc_f(H2,W2) -> (H1 = H2 & W1 = W2) (source); conjecture (b.cache_excl(H,W) | b.cache_shrd(H,W)) -> b.cache_data(addr_cons(H,W)) = ref.mem(addr_cons(H,W)) (source); conjecture ~(b.pend_rls(H1,W1) & b.pend_rls(H2,W2) & H1 ~= H2) (source); conjecture ~(b.pend_excl(H1,W1) & b.pend_excl(H2,W2) & H1 ~= H2) (source); conjecture ~(b.pend_shrd(H1,W1) & b.pend_shrd(H2,W2) & H1 ~= H2) (source); conjecture (back.excl_r(H) | back.shrd_r(H)) -> back.addr_rid(H) = buf_id (source); conjecture (back.excl_a(H) | back.shrd_a(H) | back.excl_f(H) | back.shrd_f(H)) -> back.addr_id(H) = buf_id (source); conjecture back.none_r(H,W) -> back.addr_nid(H) = buf_id (source); conjecture ~(b.cache_shrd(H,W) & b.pend_shrd(H,W)) & ~(b.cache_excl(H,W) & b.pend_excl(H,W)) (source); conjecture b.pend_excl(H,W1) & ~b.cache_excl(H,W2) -> b.pend_excl(H,W2) (source); conjecture b.pend_shrd(H,W1) & ~b.cache_shrd(H,W2) -> b.pend_shrd(H,W2) (source)
        • plain reading (inference from declaration): cache ownership, dirty-data, probe, and interface states satisfy the listed coherence/refinement clauses
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 418 lines in this file; exact source
    • tilelink_concrete_spec (examples/tilelink/tilelink_concrete_spec.ivy)
      • specifies: TileLink cache coherence
      • safety: conjecture (excl_r(H) | excl_a(H) | excl_f(H) | (source); conjecture (unc_r(H,L) | unc_a(H,L) | unc_f(H,L)) -> ~cached_hi(H) (source); conjecture ~(excl_r(H) & excl_a(H)) & ~(excl_r(H) & excl_f(H)) & ~(excl_a(H) & excl_f(H)) (source); conjecture ~(shrd_r(H) & shrd_a(H)) & ~(shrd_r(H) & shrd_f(H)) & ~(shrd_a(H) & shrd_f(H)) (source); conjecture ~unc_a(H,L) (source); conjecture excl_a(H) -> exists W. ~excl_p(addr_cons(H,W)) (source); conjecture shrd_a(H) -> exists W. ~shrd_p(addr_cons(H,W)) (source); conjecture none_r(H,W) -> cached_hi(H) (source); conjecture none_r(H,W) -> ~excl_r(H) & ~excl_a(H) & ~shrd_r(H) & ~shrd_a(H) (source); conjecture none_r(H,W) & A = addr_cons(H,W) -> ~excl_p(A) & ~shrd_p(A) (source); conjecture prb_addr(H,W) -> cached_hi(H) (source); conjecture excl_f(H) & ~none_r(H,W) -> excl_p(addr_cons(H,W)) (source); conjecture shrd_f(H) & ~none_r(H,W) -> shrd_p(addr_cons(H,W)) (source); conjecture prb_addr(H,W) -> ~excl_a(H) & ~excl_f(H) & ~shrd_a(H) & ~shrd_f(H) (source); conjecture excl_r(H) & ~none_r(H,W) & ~prb_addr(H,W) -> ~excl_p(addr_cons(H,W)) (source); conjecture shrd_r(H) & ~none_r(H,W) & ~prb_addr(H,W) -> ~shrd_p(addr_cons(H,W)) (source); conjecture granted(E) -> ref.evs(E).serialized (source); conjecture granted(E) -> to_ser(E) (source); conjecture to_ser(E2) & ref.prevents(E1,E2) -> granted(E1) (source); conjecture ~(to_ser(E1) & to_ser(E2) & ~granted(E1) & ~granted(E2) & E1 ~= E2 & (source); conjecture ~(to_ser(E1) & to_ser(E2) & ~granted(E1) & ~granted(E2) & E1 ~= E2 & (source); conjecture (excl_a(H) | shrd_a(H) | unc_a(H,W)) -> addr_id(H) = addr_rid(H) (source); conjecture (excl_a(H1) | excl_f(H1) | shrd_a(H1) | shrd_f(H1) | unc_a(H1,W1) | unc_f(H1,W1)) (source); conjecture (excl_r(H1) | shrd_r(H1) | unc_r(H1,W1)) (source); conjecture none_r(H1,W1) & none_r(H2,W2) (source)
        • plain reading (inference from declaration): cache ownership, dirty-data, probe, and interface states satisfy the listed coherence/refinement clauses
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 984 lines in this file; exact source
    • tilelink_concrete_two_client_testbench (examples/tilelink/tilelink_concrete_two_client_testbench.ivy)
      • specifies: TileLink cache coherence
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 66 lines in this file; exact source
    • tilelink_concrete_two_port_testbench (examples/tilelink/tilelink_concrete_two_port_testbench.ivy)
      • specifies: TileLink cache coherence
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 88 lines in this file; exact source
    • tilelink_concrete_unordered_channel (examples/tilelink/tilelink_concrete_unordered_channel.ivy)
      • specifies: TileLink cache coherence
      • safety: conjecture front.excl_p(A) -> back.excl_p(A) (source); conjecture front.shrd_p(A) -> back.shrd_p(A) (source); conjecture back.to_ser(E) -> front.to_ser(E) (source); conjecture front.granted(E) -> back.granted(E) (source); conjecture front.to_ser(T) & ref.evs(T).serialized -> back.to_ser(T) (source); conjecture back.excl_r(H) -> front.excl_r(H) (source); conjecture back.shrd_r(H) -> front.shrd_r(H) (source); conjecture back.unc_r(H,L) -> front.unc_r(H,L) (source); conjecture back.excl_a(H) -> front.excl_r(H) | front.excl_a(H) (source); conjecture back.shrd_a(H) -> front.shrd_r(H) | front.shrd_a(H) (source); conjecture back.unc_a(H,L) -> front.unc_r(H,L) | front.unc_a(H,L) (source); conjecture front.excl_a(H) -> back.excl_a(H) | back.excl_f(H) (source); conjecture front.shrd_a(H) -> back.shrd_a(H) | back.shrd_f(H) (source); conjecture front.unc_a(H,L) -> back.unc_a(H,L) | back.unc_f(H,L) (source); conjecture front.excl_f(H) -> back.excl_f(H) (source); conjecture front.shrd_f(H) -> back.shrd_f(H) (source); conjecture front.unc_f(H,L) -> back.unc_f(H,L) (source); conjecture back.none_r(H,W) -> front.none_r(H,W) (source); conjecture front.prb_addr(H,W) -> back.prb_addr(H,W) (source); conjecture (back.excl_a(H1) | back.shrd_a(H1) | back.unc_a(H1,W1)) (source); conjecture (back.excl_r(H1) | back.shrd_r(H1) | back.unc_r(H1,W1)) (source); conjecture (front.excl_a(H1) | front.shrd_a(H1) | front.unc_a(H1,W1) (source); conjecture back.none_r(H,W) -> back.addr_nid(H) = front.addr_nid(H) (source); conjecture A = addr_cons(H,W) & ~front.dirt_p(A) & back.dirt_p(A) (source); conjecture front.excl_r(H) & ~back.excl_r(H) & ~back.excl_a(H) & ~back.excl_f(H) (source); conjecture front.shrd_r(H) & ~back.shrd_r(H) & ~back.shrd_a(H) & ~back.shrd_f(H) (source); conjecture ~front.excl_r(H) & ~front.excl_a(H) & ~back.excl_r(H) & ~back.excl_a(H) (source); conjecture ~front.shrd_r(H) & ~front.shrd_a(H) & ~back.shrd_r(H) & ~back.shrd_a(H) (source); conjecture ~front.excl_a(H) & ~back.excl_a(H) (source); conjecture ~front.shrd_a(H) & ~back.shrd_a(H) (source); conjecture ~front.excl_r(H) & ~front.excl_a(H) & ~back.excl_r(H) & ~back.excl_a(H) (source); conjecture ~front.shrd_r(H) & ~front.shrd_a(H) & ~back.shrd_r(H) & ~back.shrd_a(H) (source); conjecture b.acqs(I1,M1) & H = acqs(M1).addr_hi & acqs(M1).own = excl -> (source); conjecture b.acqs(I1,M1) & H = acqs(M1).addr_hi & acqs(M1).own = shrd -> (source); conjecture b.acqs(I1,M1) & H = acqs(M1).addr_hi & W = acqs(M1).word & acqs(M1).own = none -> (source); conjecture b.acqs(I1,M1) & acqs(M1).own = none & E = acqs(M1).ltime_ -> (source); conjecture b.acqs(I1,M1) -> front.addr_rid(acqs(M1).addr_hi) = acqs(M1).id_ (source); conjecture b.acqs(I1,M1) & acqs(M1).own = none & E = acqs(M1).ltime_ -> (source); conjecture b.acqs(I1,M1) & b.acqs(I2,M2) & (I1 ~= I2 | M1 ~= M2) -> (source); conjecture ~(b.acqs(I1,M1) & b.gnts(I2,M2) & gnts(M2).own = acqs(M1).own & (source); conjecture b.gnts(I1,M1) & ~gnts(M1).relack & H = gnts(M1).addr_hi & W = gnts(M1).word & gnts(M1).own = none (source); conjecture b.gnts(I1,M1) & ~gnts(M1).relack & H = gnts(M1).addr_hi & W = gnts(M1).word & gnts(M1).own = excl (source); conjecture b.gnts(I1,M1) & ~gnts(M1).relack & H = gnts(M1).addr_hi & W = gnts(M1).word & gnts(M1).own = shrd (source); conjecture b.gnts(I1,M1) & ~gnts(M1).relack & H = gnts(M1).addr_hi -> front.addr_rid(H) = gnts(M1).id_ (source); conjecture b.gnts(I1,M1) & gnts(M1).relack & H = gnts(M1).addr_hi -> front.addr_nid(H) = gnts(M1).id_ (source); conjecture b.gnts(I1,M1) & ~gnts(M1).relack & H = gnts(M1).addr_hi -> back.addr_id(H) = gnts(M1).id_ (source); conjecture b.gnts(I1,M1) & gnts(M1).relack & H = gnts(M1).addr_hi & W = gnts(M1).word -> (source); conjecture b.gnts(I1,M1) & b.gnts(I2,M2) & (I1 ~= I2 | M1 ~= M2) -> (source); conjecture b.rlss(I1,M1) & rlss(M1).voluntary & H = rlss(M1).addr_hi & W = rlss(M1).word -> (source); conjecture b.rlss(I1,M1) & rlss(M1).voluntary & A = addr_cons(rlss(M1).addr_hi,rlss(M1).word) -> (source); conjecture b.rlss(I1,M1) & A = addr_cons(rlss(M1).addr_hi,rlss(M1).word) -> (source); conjecture b.rlss(I1,M1) & A = addr_cons(rlss(M1).addr_hi,rlss(M1).word) & (source); conjecture b.rlss(I1,M1) & ~rlss(M1).voluntary & H = rlss(M1).addr_hi & W = rlss(M1).word -> (source); conjecture b.rlss(I1,M1) & rlss(M1).voluntary & H = rlss(M1).addr_hi -> (source); conjecture b.rlss(I1,M1) & b.rlss(I2,M2) & (I1 ~= I2 | M1 ~= M2) -> (source); conjecture b.prbs(I1,M1) & H = prbs(M1).addr_hi -> back.prb_addr(H,W) & ~front.prb_addr(H,W) (source); conjecture ~(b.prbs(I1,M1) & b.rlss(I2,M2) (source); conjecture b.prbs(I1,M1) & b.prbs(I2,M2) & (I1 ~= I2 | M1 ~= M2) -> (source); conjecture b.fnss(I1,M1) & H = fnss(M1).addr_hi & W = fnss(M1).word & fnss(M1).own = excl -> (source); conjecture b.fnss(I1,M1) & H = fnss(M1).addr_hi & W = fnss(M1).word & fnss(M1).own = shrd -> (source); conjecture b.fnss(I1,M1) & H = fnss(M1).addr_hi & W = fnss(M1).word & fnss(M1).own = none -> (source); conjecture b.fnss(I1,M1) -> back.addr_id(fnss(M1).addr_hi) = fnss(M1).id_ (source); conjecture ~(b.fnss(I1,M1) & b.gnts(I2,M2) & ~gnts(M2).relack & gnts(M2).own = fnss(M1).own & (source); conjecture b.fnss(I1,M1) & b.fnss(I2,M2) & (I1 ~= I2 | M1 ~= M2) -> (source)
        • plain reading (inference from declaration): cache ownership, dirty-data, probe, and interface states satisfy the listed coherence/refinement clauses
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 518 lines in this file; exact source
    • tilelink_concrete_unordered_channel_tests (examples/tilelink/tilelink_concrete_unordered_channel_tests.ivy)
      • specifies: TileLink cache coherence
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 216 lines in this file; exact source
    • tilelink_rcsc_snoopy (examples/tilelink/tilelink_rcsc_snoopy.ivy)
      • specifies: TileLink cache coherence
      • safety: assert evs(e2):id_(eid); (source); assert e1 ~= e2 & lleq(e1,e2) & evs(e1):type_ = write & evs(e2):type_ = read; (source); assert evs(e2):addr_(a); (source)
        • plain reading (inference from declaration): cache ownership, dirty-data, probe, and interface states satisfy the listed coherence/refinement clauses
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 600 lines in this file; exact source
    • tilelink_rcsc_store_buffer (examples/tilelink/tilelink_rcsc_store_buffer.ivy)
      • specifies: TileLink cache coherence
      • safety: assert cached(a); (source); assert own(a) ~= none; (source); assert mem(a,d) (source)
        • plain reading (inference from declaration): cache ownership, dirty-data, probe, and interface states satisfy the listed coherence/refinement clauses
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 687 lines in this file; exact source
    • tilelink_rcsc_store_buffer2 (examples/tilelink/tilelink_rcsc_store_buffer2.ivy)
      • specifies: TileLink cache coherence
      • safety: assert evs(e2):id_(eid); (source); assert e1 ~= e2 & lleq(e1,e2) & evs(e1):type_ = write & evs(e2):type_ = read; (source); assert evs(e2):addr_(a); (source)
        • plain reading (inference from declaration): cache ownership, dirty-data, probe, and interface states satisfy the listed coherence/refinement clauses
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 735 lines in this file; exact source
    • tilelink_rcsc_store_buffer2_save (examples/tilelink/tilelink_rcsc_store_buffer2_save.ivy)
      • specifies: TileLink cache coherence
      • safety: assert evs(e2):id_(eid); (source); assert e1 ~= e2 & lleq(e1,e2) & evs(e1):type_ = write & evs(e2):type_ = read; (source); assert evs(e2):addr_(a); (source)
        • plain reading (inference from declaration): cache ownership, dirty-data, probe, and interface states satisfy the listed coherence/refinement clauses
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 735 lines in this file; exact source
    • tilelink_rcsc_store_buffer2_temp (examples/tilelink/tilelink_rcsc_store_buffer2_temp.ivy)
      • specifies: TileLink cache coherence
      • safety: assert evs(e2):id_(eid); (source); assert e1 ~= e2 & lleq(e1,e2) & evs(e1):type_ = write & evs(e2):type_ = read; (source); assert evs(e2):addr_(a); (source)
        • plain reading (inference from declaration): cache ownership, dirty-data, probe, and interface states satisfy the listed coherence/refinement clauses
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 733 lines in this file; exact source
    • tilelink_snoopy (examples/tilelink/tilelink_snoopy.ivy)
      • specifies: TileLink cache coherence
      • safety: assert false # block it (source)
        • plain reading (inference from declaration): cache ownership, dirty-data, probe, and interface states satisfy the listed coherence/refinement clauses
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
        • a property name marks a buggy/false test target; it must not be interpreted as an established guarantee
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 127 lines in this file; exact source
    • tilelink_store_buffer (examples/tilelink/tilelink_store_buffer.ivy)
      • specifies: TileLink cache coherence
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 258 lines in this file; exact source
    • tilelink_two_port_test_bench (examples/tilelink/tilelink_two_port_test_bench.ivy)
      • specifies: TileLink cache coherence
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 71 lines in this file; exact source
    • tilelink_abstract_spec (examples/tilelink/unit_test/single_client/tilelink_abstract_spec.ivy)
      • specifies: TileLink cache coherence
      • safety: conjecture dirt_p(A) -> excl_p(A) (source); conjecture (excl_p(A) | shrd_p(A)) -> cached(A) (source); conjecture ~(to_ser(T) & cached(ref.evs(T).addr_)) (source); conjecture ~(ref.prevents(T1,T2) & ~to_ser(T1) & to_ser(T2)) (source); conjecture to_ser(T) -> side(ref.evs(T).id_) = client (source)
        • plain reading (inference from declaration): cache ownership, dirty-data, probe, and interface states satisfy the listed coherence/refinement clauses
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 498 lines in this file; exact source
    • tilelink_coherence_manager_tester (examples/tilelink/unit_test/single_client/tilelink_coherence_manager_tester.ivy)
      • specifies: TileLink cache coherence
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 265 lines in this file; exact source
    • tilelink_concrete_spec (examples/tilelink/unit_test/single_client/tilelink_concrete_spec.ivy)
      • specifies: TileLink cache coherence
      • safety: conjecture (excl_r(H) | excl_a(H) | excl_f(H) | (source); conjecture (unc_r(H,L) | unc_a(H,L) | unc_f(H,L)) -> ~cached_hi(H) (source); conjecture ~(excl_r(H) & excl_a(H)) & ~(excl_r(H) & excl_f(H)) & ~(excl_a(H) & excl_f(H)) (source); conjecture ~(shrd_r(H) & shrd_a(H)) & ~(shrd_r(H) & shrd_f(H)) & ~(shrd_a(H) & shrd_f(H)) (source); conjecture ~unc_a(H,L) (source); conjecture excl_a(H) -> exists W. ~excl_p(addr_cons(H,W)) (source); conjecture shrd_a(H) -> exists W. ~shrd_p(addr_cons(H,W)) (source); conjecture none_r(H,W) -> cached_hi(H) (source); conjecture none_r(H,W) -> ~excl_r(H) & ~excl_a(H) & ~shrd_r(H) & ~shrd_a(H) (source); conjecture none_r(H,W) & A = addr_cons(H,W) -> ~excl_p(A) & ~shrd_p(A) (source); conjecture prb_addr(H,W) -> cached_hi(H) (source); conjecture excl_f(H) & ~none_r(H,W) -> excl_p(addr_cons(H,W)) (source); conjecture shrd_f(H) & ~none_r(H,W) -> shrd_p(addr_cons(H,W)) (source); conjecture prb_addr(H,W) -> ~excl_a(H) & ~excl_f(H) & ~shrd_a(H) & ~shrd_f(H) (source); conjecture excl_r(H) & ~none_r(H,W) & ~prb_addr(H,W) -> ~excl_p(addr_cons(H,W)) (source); conjecture shrd_r(H) & ~none_r(H,W) & ~prb_addr(H,W) -> ~shrd_p(addr_cons(H,W)) (source); conjecture granted(E) -> ref.evs(E).serialized (source); conjecture granted(E) -> to_ser(E) (source); conjecture to_ser(E2) & ref.prevents(E1,E2) -> granted(E1) (source); conjecture ~(to_ser(E1) & to_ser(E2) & ~granted(E1) & ~granted(E2) & E1 ~= E2 & (source); conjecture ~(to_ser(E1) & to_ser(E2) & ~granted(E1) & ~granted(E2) & E1 ~= E2 & (source); conjecture (excl_a(H) | shrd_a(H) | unc_a(H,W)) -> addr_gid(H) = addr_rid(H) (source); conjecture (excl_a(H1) | excl_f(H1) | shrd_a(H1) | shrd_f(H1) | unc_a(H1,W1) | unc_f(H1,W1)) (source); conjecture (excl_r(H1) | shrd_r(H1) | unc_r(H1,W1)) (source); conjecture none_r(H1,W1) & none_r(H2,W2) (source)
        • plain reading (inference from declaration): cache ownership, dirty-data, probe, and interface states satisfy the listed coherence/refinement clauses
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 1260 lines in this file; exact source
    • tilelink_two_port_tester (examples/tilelink/unit_test/single_client/tilelink_two_port_tester.ivy)
      • specifies: TileLink cache coherence
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 262 lines in this file; exact source
    • tilelink_abstract_spec (examples/tilelink/unit_test/tilelink_abstract_spec.ivy)
      • specifies: TileLink cache coherence
      • safety: conjecture dirt_p(C,A) -> excl_p(C,A) (source); conjecture (excl_p(C,A) | shrd_p(C,A)) -> cached(C,A) (source); conjecture ~(ref.prevents(T1,T2) & ~to_ser(T1) & to_ser(T2)) (source); conjecture to_ser(T) -> side(ref.evs(T).id_) = client (source)
        • plain reading (inference from declaration): cache ownership, dirty-data, probe, and interface states satisfy the listed coherence/refinement clauses
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 504 lines in this file; exact source
    • tilelink_coherence_manager_tester (examples/tilelink/unit_test/tilelink_coherence_manager_tester.ivy)
      • specifies: TileLink cache coherence
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 351 lines in this file; exact source
    • tilelink_concrete_spec (examples/tilelink/unit_test/tilelink_concrete_spec.ivy)
      • specifies: TileLink cache coherence
      • safety: conjecture (excl_r(C,H) | excl_a(C,H) | excl_f(C,H) | (source); conjecture (unc_r(C,H,L) | unc_a(C,H,L) | unc_f(C,H,L)) -> ~cached_hi(C,H) (source); conjecture ~(excl_r(C,H) & excl_a(C,H)) & ~(excl_r(C,H) & excl_f(C,H)) & ~(excl_a(C,H) & excl_f(C,H)) (source); conjecture ~(shrd_r(C,H) & shrd_a(C,H)) & ~(shrd_r(C,H) & shrd_f(C,H)) & ~(shrd_a(C,H) & shrd_f(C,H)) (source); conjecture ~unc_a(C,H,L) (source); conjecture excl_a(C,H) -> exists W. ~excl_p(C,addr_cons(H,W)) (source); conjecture shrd_a(C,H) -> exists W. ~shrd_p(C,addr_cons(H,W)) (source); conjecture none_r(C,H,W) -> cached_hi(C,H) (source); conjecture none_r(C,H,W) -> ~excl_r(C,H) & ~excl_a(C,H) & ~shrd_r(C,H) & ~shrd_a(C,H) (source); conjecture none_r(C,H,W) & A = addr_cons(H,W) -> ~excl_p(C,A) & ~shrd_p(C,A) (source); conjecture prb_addr(C,H,W) -> cached_hi(C,H) (source); conjecture excl_f(C,H) & ~none_r(C,H,W) -> excl_p(C,addr_cons(H,W)) (source); conjecture shrd_f(C,H) & ~none_r(C,H,W) -> shrd_p(C,addr_cons(H,W)) (source); conjecture prb_addr(C,H,W) -> ~excl_a(C,H) & ~excl_f(C,H) & ~shrd_a(C,H) & ~shrd_f(C,H) (source); conjecture excl_r(C,H) & ~none_r(C,H,W) & ~prb_addr(C,H,W) -> ~excl_p(C,addr_cons(H,W)) (source); conjecture shrd_r(C,H) & ~none_r(C,H,W) & ~prb_addr(C,H,W) -> ~shrd_p(C,addr_cons(H,W)) (source); conjecture granted(E) -> ref.evs(E).serialized (source); conjecture granted(E) -> to_ser(E) (source); conjecture ~(to_ser(E1) & to_ser(E2) & ~granted(E1) & ~granted(E2) & E1 ~= E2 & (source); conjecture ~(to_ser(E1) & to_ser(E2) & ~granted(E1) & ~granted(E2) & E1 ~= E2 & (source); conjecture (excl_a(C,H) | shrd_a(C,H) | unc_a(C,H,W)) -> addr_gid(C,H) = addr_rid(C,H) (source); conjecture (excl_a(C,H1) | excl_f(C,H1) | shrd_a(C,H1) | shrd_f(C,H1) | unc_a(C,H1,W1) | unc_f(C,H1,W1)) (source); conjecture (excl_r(C,H1) | shrd_r(C,H1) | unc_r(C,H1,W1)) (source); conjecture none_r(C,H1,W1) & none_r(C,H2,W2) (source)
        • plain reading (inference from declaration): cache ownership, dirty-data, probe, and interface states satisfy the listed coherence/refinement clauses
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 1400 lines in this file; exact source
    • client_server_mc (test/client_server_mc.ivy)
      • specifies: client/server request protocol
      • safety: invariant [safety] ~(x ~= z & link(x,y) & link(z,y)) (source)
        • plain reading (inference from declaration): a link/ownership destination cannot have conflicting sources
        • 1 state invariant declarations: safety
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun; model-checking variant indicated by filename
      • measured size: 38 lines in this file; exact source
    • client_server_mc2 (test/client_server_mc2.ivy)
      • specifies: client/server request protocol
      • safety: invariant [safety] ~(X ~= Z & link(X,Y) & link(Z,Y)) (source)
        • plain reading (inference from declaration): a link/ownership destination cannot have conflicting sources
        • 1 state invariant declarations: safety
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun; model-checking variant indicated by filename
      • measured size: 36 lines in this file; exact source
    • client_server_mc3 (test/client_server_mc3.ivy)
      • specifies: client/server request protocol
      • safety: invariant [safety] ~(X ~= Z & link(X,Y) & link(Z,Y)) (source)
        • plain reading (inference from declaration): a link/ownership destination cannot have conflicting sources
        • 1 state invariant declarations: safety
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun; model-checking variant indicated by filename
      • measured size: 60 lines in this file; exact source
    • client_server_mc_finite1 (test/client_server_mc_finite1.ivy)
      • specifies: client/server request protocol
      • safety: invariant [safety] ~(X ~= Z & link(X,Y) & link(Z,Y)) (source)
        • plain reading (inference from declaration): a link/ownership destination cannot have conflicting sources
        • 1 state invariant declarations: safety
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun; model-checking variant indicated by filename
      • measured size: 36 lines in this file; exact source
    • disk_token_ring (test/disk_token_ring.ivy)
      • specifies: ring protocol
      • safety: invariant proto(X).token & proto(Y).token -> X = Y (source)
        • plain reading (inference from declaration): the named state invariants restrict legal reachable states; the excerpt is not sufficient to give a more specific guarantee without reading the complete formula
        • 5 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 272 lines in this file; exact source
    • fba (test/fba.ivy)
      • specifies: Stellar federated Byzantine agreement
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 206 lines in this file; exact source
    • flash (test/flash.ivy)
      • specifies: FLASH cache coherence
      • safety: invariant [coherent] cache(X).state = exclusive -> X = real_owner (source)
        • plain reading (inference from declaration): an exclusive cache copy belongs to the recorded owner
        • 7 state invariant declarations: coherent, nodups
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 498 lines in this file; exact source
    • flash.save (test/flash.save.ivy)
      • specifies: FLASH cache coherence
      • safety: invariant [coherent] cache(X).state = exclusive -> X = real_owner (source)
        • plain reading (inference from declaration): an exclusive cache copy belongs to the recorded owner
        • 2 state invariant declarations: coherent, nodups
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 492 lines in this file; exact source
    • flash2 (test/flash2.ivy)
      • specifies: FLASH cache coherence
      • safety: invariant [coherent1] cache(X).state = exclusive -> X = real_owner (source)
        • plain reading (inference from declaration): an exclusive cache copy belongs to the recorded owner
        • 37 state invariant declarations: coherent1, coherent2, nodups
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 575 lines in this file; exact source
    • flash2_finite_mc (test/flash2_finite_mc.ivy)
      • specifies: FLASH cache coherence
      • safety: invariant [coherent2] cache(X).state = shared & ~cache.invmarked(X) & ~dir.pending -> real_owner = home & cache.state(home) ~= exclusive (source)
        • plain reading (inference from declaration): an exclusive cache copy belongs to the recorded owner
        • 1 state invariant declarations: coherent2
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun; model-checking variant indicated by filename
      • measured size: 490 lines in this file; exact source
    • flash2_mc (test/flash2_mc.ivy)
      • specifies: FLASH cache coherence
      • safety: invariant [coherent] cache(X).state = exclusive -> X = real_owner (source)
        • plain reading (inference from declaration): an exclusive cache copy belongs to the recorded owner
        • 5 state invariant declarations: coherent, coherent2, nodups, l5, l6
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun; model-checking variant indicated by filename
      • measured size: 517 lines in this file; exact source
    • flash_cubicle (test/flash_cubicle.ivy)
      • specifies: FLASH cache coherence
      • safety: invariant ~(cache(home).state = exclusive & (source)
        • plain reading (inference from declaration): the named state invariants restrict legal reachable states; the excerpt is not sufficient to give a more specific guarantee without reading the complete formula
        • 37 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 594 lines in this file; exact source
    • flash_mc (test/flash_mc.ivy)
      • specifies: FLASH cache coherence
      • safety: invariant [coherent] cache(X).state = exclusive -> X = real_owner (source)
        • plain reading (inference from declaration): an exclusive cache copy belongs to the recorded owner
        • 2 state invariant declarations: coherent, nodups
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun; model-checking variant indicated by filename
      • measured size: 560 lines in this file; exact source
    • ibm-cache-N (test/ibm-cache-N.ivy)
      • specifies: cache/memory coherence
      • safety: invariant forall C1, C2. C1 ~= C2 & s.cache(C1) = exclusive -> s.cache(C2) = invalid (source)
        • plain reading (inference from declaration): an exclusive cache owner excludes other valid cache copies
        • 9 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 143 lines in this file; exact source
    • ibm-cache-N_mc (test/ibm-cache-N_mc.ivy)
      • specifies: cache/memory coherence
      • safety: invariant forall C1, C2. C1 ~= C2 & s.cache(C1) = exclusive -> s.cache(C2) = invalid (source)
        • plain reading (inference from declaration): an exclusive cache owner excludes other valid cache copies
        • 2 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun; model-checking variant indicated by filename
      • measured size: 131 lines in this file; exact source
    • ibm-cache-N_mc_error (test/ibm-cache-N_mc_error.ivy)
      • specifies: cache/memory coherence
      • safety: invariant forall C1, C2. C1 ~= C2 & s.cache(C1) = exclusive -> s.cache(C2) = invalid (source)
        • plain reading (inference from declaration): an exclusive cache owner excludes other valid cache copies
        • 1 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • negative-test warning: the filename marks this as a bad/buggy/unsafe/error variant; displayed properties are attempted checks, not established guarantees
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun; model-checking variant indicated by filename
      • measured size: 131 lines in this file; exact source
    • ibm-cache-finite_mc (test/ibm-cache-finite_mc.ivy)
      • specifies: cache/memory coherence
      • safety: invariant forall C1, C2. C1 ~= C2 & s.cache(C1) = exclusive -> s.cache(C2) = invalid (source)
        • plain reading (inference from declaration): an exclusive cache owner excludes other valid cache copies
        • 1 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun; model-checking variant indicated by filename
      • measured size: 129 lines in this file; exact source
    • leader_election_ring_repl (test/leader_election_ring_repl.ivy)
      • specifies: leader election
      • safety: conjecture ~(asgn.pid(N) < asgn.pid(P) & trans.sent(asgn.pid(N),N)) (source); conjecture ~(asgn.pid(P) < asgn.pid(Q) & N:node.t < P & P < Q & trans.sent(asgn.pid(P),N)) (source); conjecture ~(asgn.pid(N) < asgn.pid(P) & N < P & P < Q & trans.sent(asgn.pid(N),Q)) (source); conjecture ~(asgn.pid(Q) < asgn.pid(N) & N < P & P < Q & trans.sent(asgn.pid(Q),P)) (source)
        • plain reading (inference from declaration): identifier-order/message-path invariants support leader uniqueness; the quoted clause is auxiliary
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 191 lines in this file; exact source
    • learning_switch1 (test/learning_switch1.ivy)
      • specifies: learning network switch
      • safety: conjecture tc(X,X) # Reflexivity (source); conjecture tc(X, Y) & tc(Y, Z) -> tc(X, Z) # Transitivity (source); conjecture tc(X, Y) & tc(Y, X) -> X = Y # Anti-symmetry (source); conjecture tc(X, Y) & tc(X, Z) -> (tc(Y, Z) | tc(Z, Y)) # Semi-linearity (source); conjecture ~(route.tc(N1,N1,N0) & N1 ~= N0) (source); conjecture ~(route.tc(N2,N0,N2) & N0 ~= N2 & ~route.dom(N2,N0)) # this is actually not needed (source); conjecture ~(route.tc(N0,N2,N1) & N1 ~= N2 & ~route.dom(N0,N2)) (source); conjecture ~(route.tc(N2,N1,N0) & N0 ~= N2 & N1 ~= N0 & ~route.dom(N2,N0)) (source)
        • plain reading (inference from declaration): forwarding/learning relations satisfy the stated route/tree consistency constraints
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 121 lines in this file; exact source
    • paxos-fol (test/paxos-fol.ivy)
      • specifies: Paxos consensus variant
      • safety: conjecture ( decision(N1,R1,V1) & (source); conjecture proposal(R,V1) & proposal(R,V2) -> V1 = V2 (source); conjecture vote(N,R,V) -> proposal(R,V) (source); conjecture forall R:round, V:value. (exists N:node. decision(N,R,V)) -> exists Q:quorum. forall N:node. member(N, Q) -> vote(N,R,V) (source); conjecture one_b_max_vote(N,R2,none,V1) & ~le(R2,R1) -> ~vote(N,R1,V2) (source); conjecture one_b_max_vote(N,R,RMAX,V) & RMAX ~= none -> ~le(R,RMAX) & vote(N,RMAX,V) (source); conjecture one_b_max_vote(N,R,RMAX,V) & RMAX ~= none & ~le(R,ROTHER) & ~le(ROTHER,RMAX) -> ~vote(N,ROTHER,VOTHER) (source); conjecture ~vote(N,none,V) (source); conjecture forall R1:round, R2:round, V1:value, V2:value, Q:quorum. ~le(R2,R1) & proposal(R2,V2) & V1 ~= V2 -> (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 154 lines in this file; exact source
    • toy_consensus_mc (test/toy_consensus_mc.ivy)
      • specifies: consensus/agreement protocol
      • safety: invariant [majorities_intersect] (majority(S) & majority(T)) -> exists N. member(N,S) & member(N,T) (source)
        • plain reading (inference from declaration): any two majority sets share a member; this is an auxiliary quorum invariant
        • 14 state invariant declarations: majorities_intersect, one_leader, one_vote_per_node, leader_has_majority, safe
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun; model-checking variant indicated by filename
      • measured size: 302 lines in this file; exact source
    • vsync_paxos (test/vsync_paxos.ivy)
      • specifies: Paxos consensus variant
      • safety: require s ~= 0; (source); require s ~= 0; (source); require started(e,n); (source)
        • plain reading (inference from declaration): the listed action preconditions/postconditions constrain individual protocol operations; they are not a separately identified global safety theorem
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; proof/isolation/refinement structure present; checker success not rerun
      • measured size: 283 lines in this file; exact source
    • vsync_paxos_save (test/vsync_paxos_save.ivy)
      • specifies: Paxos consensus variant
      • safety: require s ~= 0; (source); require s ~= 0; (source); require started(e,n); (source)
        • plain reading (inference from declaration): the listed action preconditions/postconditions constrain individual protocol operations; they are not a separately identified global safety theorem
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 407 lines in this file; exact source
    • vsync_paxos_temp (test/vsync_paxos_temp.ivy)
      • specifies: Paxos consensus variant
      • safety: require s ~= 0; (source); require s ~= 0; (source); require started(e,n); (source)
        • plain reading (inference from declaration): the listed action preconditions/postconditions constrain individual protocol operations; they are not a separately identified global safety theorem
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 403 lines in this file; exact source
    • vsync_paxos_test (test/vsync_paxos_test.ivy)
      • specifies: Paxos consensus variant
      • safety: require s ~= 0; (source); require s ~= 0; (source); require started(e,n); (source)
        • plain reading (inference from declaration): the listed action preconditions/postconditions constrain individual protocol operations; they are not a separately identified global safety theorem
        • these are action pre/postcondition contracts; no separate global safety declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Ivy; specification/invariant obligations present; checker success not rerun
      • measured size: 405 lines in this file; exact source

  • Ivy: DuoAI benchmark inputs

    • chord_ring_maintenance (protocols/chord_ring_maintenance/chord_ring_maintenance.ivy)
      • specifies: ring protocol
      • safety: invariant [1000000] ~error(N) (source)
        • plain reading (inference from declaration): the model never enters its error state
        • 1 state invariant declarations: 1000000
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 147 lines in this file; exact source
    • client_server_ae (protocols/client_server_ae/client_server_ae.ivy)
      • specifies: client/server request protocol
      • safety: invariant [1000000] forall N,P. response_received(N,P) -> exists R. request_sent(N,R) & match(R,P) (source)
        • plain reading (inference from declaration): every received response matches a previously sent request
        • 1 state invariant declarations: 1000000
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 39 lines in this file; exact source
    • client_server_db_ae (protocols/client_server_db_ae/client_server_db_ae.ivy)
      • specifies: client/server request protocol
      • safety: invariant [1000000] forall N,P. response_received(N,P) -> exists R. request_sent(N,R) & match(R,P) (source)
        • plain reading (inference from declaration): every received response matches a previously sent request
        • 1 state invariant declarations: 1000000
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 63 lines in this file; exact source
    • consensus_epr (protocols/consensus_epr/consensus_epr.ivy)
      • specifies: consensus/agreement protocol
      • safety: invariant [1000000] decided(N1, V1) & decided(N2, V2) -> V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 1 state invariant declarations: 1000000
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 67 lines in this file; exact source
    • consensus_forall (protocols/consensus_forall/consensus_forall.ivy)
      • specifies: consensus/agreement protocol
      • safety: invariant [1000000] decided(N1, V1) & decided(N2, V2) -> V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 1 state invariant declarations: 1000000
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 81 lines in this file; exact source
    • consensus_wo_decide (protocols/consensus_wo_decide/consensus_wo_decide.ivy)
      • specifies: consensus/agreement protocol
      • safety: invariant [1000000] leader(N1) & leader(N2) -> N1 = N2 (source)
        • plain reading (inference from declaration): at most one node is elected leader
        • 1 state invariant declarations: 1000000
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 68 lines in this file; exact source
    • database_chain_replication (protocols/database_chain_replication/database_chain_replication.ivy)
      • specifies: chain-replicated database
      • safety: invariant [1000000] (~(TX1 ~= TX2 & commit_tx(TX1) & commit_tx(TX2) & le(TX1,TX2) & write_tx(TX1, K) & depends_tx(TX2, K, T3) & ~le(TX1, T3))) & (source)
        • plain reading (inference from declaration): transaction order and key dependencies satisfy the chain-replication consistency clauses
        • 1 state invariant declarations: 1000000
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 160 lines in this file; exact source
    • decentralized_lock (protocols/decentralized_lock/decentralized_lock.ivy)
      • specifies: lock protocol
      • safety: invariant [1000000] X ~= Y -> ~(has_lock(X) & has_lock(Y)) (source)
        • plain reading (inference from declaration): two nodes cannot simultaneously own the same lock/lock epoch
        • 1 state invariant declarations: 1000000
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 32 lines in this file; exact source
    • distributed_lock (protocols/distributed_lock/distributed_lock.ivy)
      • specifies: lock protocol
      • safety: invariant [1000000] locked(E, N1) & locked(E, N2) -> N1 = N2 (source)
        • plain reading (inference from declaration): two nodes cannot simultaneously own the same lock/lock epoch
        • 1 state invariant declarations: 1000000
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 85 lines in this file; exact source
    • fast_paxos (protocols/fast_paxos/fast_paxos.ivy)
      • specifies: Paxos consensus variant
      • safety: invariant [1000000] decision(N1,R1,V1) & decision(N2,R2,V2) -> V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 1 state invariant declarations: 1000000
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 163 lines in this file; exact source
    • flexible_paxos (protocols/flexible_paxos/flexible_paxos.ivy)
      • specifies: Paxos consensus variant
      • safety: invariant [1000000] (decision(N1,R1,V1) & decision(N2,R2,V2)) -> V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 1 state invariant declarations: 1000000
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 129 lines in this file; exact source
    • hybrid_reliable_broadcast (protocols/hybrid_reliable_broadcast/hybrid_reliable_broadcast.ivy)
      • specifies: reliable broadcast
      • safety: invariant [1000000] (exists N. ~member_fs(N) & ~member_fa(N) & accept(N)) -> (exists M. ~member_fs(M) & ~member_fa(M) & rcv_init(M)) (source)
        • plain reading (inference from declaration): a correct accepting node implies some correct node received an initiating broadcast; no spontaneous forged delivery
        • 1 state invariant declarations: 1000000
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 207 lines in this file; exact source
    • learning_switch_quad (protocols/learning_switch_quad/learning_switch_quad.ivy)
      • specifies: learning network switch
      • safety: invariant [1000000] (forall T, X. table(T,X,X)) & (forall T, X, Y, Z. table(T,X,Y) & table(T,Y,Z) -> table(T,X,Z)) & (forall T, X, Y. table(T,X,Y) & table(T,Y,X) -> X = Y) & (forall T, X, Y, Z. table(T,X,Y) & table(T,X,Z) -> table(T,Y,Z) | table(T,Z,Y)) (source)
        • plain reading (inference from declaration): forwarding/learning relations satisfy the stated route/tree consistency constraints
        • 1 state invariant declarations: 1000000
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 48 lines in this file; exact source
    • learning_switch_ternary (protocols/learning_switch_ternary/learning_switch_ternary.ivy)
      • specifies: learning network switch
      • safety: invariant [1000000] route_tc(N, X, X) & (route_tc(N, X, Y) & route_tc(N, Y, Z) -> route_tc(N, X, Z)) & (route_tc(N, X, Y) & route_tc(N, Y, X) -> X = Y) & (route_tc(N, X, Y) & route_tc(N, X, Z) -> (route_tc(N, Y, Z) | route_tc(N, Z, Y))) (source)
        • plain reading (inference from declaration): forwarding/learning relations satisfy the stated route/tree consistency constraints
        • 1 state invariant declarations: 1000000
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 64 lines in this file; exact source
    • lock_server_async (protocols/lock_server_async/lock_server_async.ivy)
      • specifies: lock protocol
      • safety: invariant [1000000] holds_lock(N1, L) & holds_lock(N2, L) -> N1 = N2 (source)
        • plain reading (inference from declaration): two nodes cannot simultaneously own the same lock/lock epoch
        • 1 state invariant declarations: 1000000
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 57 lines in this file; exact source
    • lock_server_sync (protocols/lock_server_sync/lock_server_sync.ivy)
      • specifies: lock protocol
      • safety: invariant [1000000] link(C1, S) & link(C2, S) -> C1 = C2 (source)
        • plain reading (inference from declaration): a link/ownership destination cannot have conflicting sources
        • 1 state invariant declarations: 1000000
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 29 lines in this file; exact source
    • multi_paxos (protocols/multi_paxos/multi_paxos.ivy)
      • specifies: Paxos consensus variant
      • safety: invariant [1000000] decision(N1,I,R1,V1) & decision(N2,I,R2,V2) -> V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 1 state invariant declarations: 1000000
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 149 lines in this file; exact source
    • paxos (protocols/paxos/paxos.ivy)
      • specifies: Paxos consensus variant
      • safety: invariant [1000000] (decision(N1,R1,V1) & decision(N2,R2,V2)) -> V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 1 state invariant declarations: 1000000
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 124 lines in this file; exact source
    • ring_leader_election (protocols/ring_leader_election/ring_leader_election.ivy)
      • specifies: leader election
      • safety: invariant [1000000] forall X: node, Y:node. leader(X) & leader(Y) -> X = Y # at most one leader (source)
        • plain reading (inference from declaration): at most one node is elected leader
        • 1 state invariant declarations: 1000000
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 108 lines in this file; exact source
    • sharded_key_value_store (protocols/sharded_key_value_store/sharded_key_value_store.ivy)
      • specifies: sharded key-value storage
      • safety: invariant [1000000] table(N1, K, V1) & table(N2, K, V2) -> N1 = N2 & V1 = V2 (source)
        • plain reading (inference from declaration): a stored key has a unique node and value
        • 1 state invariant declarations: 1000000
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 50 lines in this file; exact source
    • sharded_kv_no_lost_keys (protocols/sharded_kv_no_lost_keys/sharded_kv_no_lost_keys.ivy)
      • specifies: sharded key-value storage
      • safety: invariant [1000000] (exists N,K,V. transfer_msg(N,K,V)) | (forall K. exists N. owner(N,K)) (source)
        • plain reading (inference from declaration): either a transfer message exists or every key has an owner; this is the precise modeled no-loss condition
        • 1 state invariant declarations: 1000000
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 43 lines in this file; exact source
    • stoppable_paxos (protocols/stoppable_paxos/stoppable_paxos.ivy)
      • specifies: Paxos consensus variant
      • safety: invariant [1000000] decision(N1,I1,R1,VA1) & decision(N2,I1,R2,VA2) -> VA1 = VA2 (source)
        • plain reading (inference from declaration): the named state invariants restrict legal reachable states; the excerpt is not sufficient to give a more specific guarantee without reading the complete formula
        • 1 state invariant declarations: 1000000
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 186 lines in this file; exact source
    • ticket_lock (protocols/ticket_lock/ticket_lock.ivy)
      • specifies: lock protocol
      • safety: invariant [1000000] pc3(T1) & pc3(T2) -> T1 = T2 (source)
        • plain reading (inference from declaration): at most one process is in the encoded critical section
        • 1 state invariant declarations: 1000000
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 70 lines in this file; exact source
    • toy_consensus_epr (protocols/toy_consensus_epr/toy_consensus_epr.ivy)
      • specifies: consensus/agreement protocol
      • safety: invariant [1000000] decided(V1) & decided(V2) -> V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 1 state invariant declarations: 1000000
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 34 lines in this file; exact source
    • toy_consensus_forall (protocols/toy_consensus_forall/toy_consensus_forall.ivy)
      • specifies: consensus/agreement protocol
      • safety: invariant [1000000] (decided(V1) & decided(V2) -> V1 = V2) (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 1 state invariant declarations: 1000000
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 43 lines in this file; exact source
    • two_phase_commit (protocols/two_phase_commit/two_phase_commit.ivy)
      • specifies: two-phase atomic commit
      • safety: invariant [1000000] (decide_commit(N0) -> ~decide_abort(N1)) & (decide_commit(N0) -> vote_yes(N1)) & (decide_abort(N0) -> abort_flag) (source)
        • plain reading (inference from declaration): commit and abort decisions do not conflict, and commit requires the stated yes votes
        • 1 state invariant declarations: 1000000
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 97 lines in this file; exact source
    • vertical_paxos (protocols/vertical_paxos/vertical_paxos.ivy)
      • specifies: Paxos consensus variant
      • safety: invariant [1000000] (decision(N1,R1,V1) & decision(N2,R2,V2)) -> V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 1 state invariant declarations: 1000000
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 165 lines in this file; exact source

  • Ivy: DistAI benchmark inputs and generated invariant files

    • Ricart-Agrawala (protocols/Ricart-Agrawala/Ricart-Agrawala.ivy)
      • specifies: Ricart–Agrawala mutual exclusion
      • safety: invariant [1000000] holds(N1) & holds(N2) -> N1 = N2 (source)
        • plain reading (inference from declaration): the named state invariants restrict legal reachable states; the excerpt is not sufficient to give a more specific guarantee without reading the complete formula
        • 1 state invariant declarations: 1000000
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: DistAI input / Ivy invariant synthesis; generated invariant artifact source (54 lines); checker success not rerun
      • measured size: 48 lines in this file; exact source
    • blockchain (protocols/blockchain/blockchain.ivy)
      • specifies: blockchain protocol
      • safety: invariant [1000000] (honest(N1) & honest(N2) -> (block_confirmed(N1,B,T) & block_confirmed(N2,B,T)) | (~block_confirmed(N1,B,T) & ~block_confirmed(N2,B,T))) (source)
        • plain reading (inference from declaration): transaction order and key dependencies satisfy the chain-replication consistency clauses
        • 1 state invariant declarations: 1000000
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: DistAI input / Ivy invariant synthesis; generated invariant artifact source (105 lines); checker success not rerun
      • measured size: 92 lines in this file; exact source
    • chord (protocols/chord/chord.ivy)
      • specifies: Chord ring maintenance
      • safety: invariant [1000000] ~error(N) (source)
        • plain reading (inference from declaration): the model never enters its error state
        • 1 state invariant declarations: 1000000
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: DistAI input / Ivy invariant synthesis; generated invariant artifact source (310 lines); checker success not rerun
      • measured size: 147 lines in this file; exact source
    • consensus (protocols/consensus/consensus.ivy)
      • specifies: consensus/agreement protocol
      • safety: invariant [1000000] decided(N1, Q1, V1) & decided(N2, Q2, V2) -> V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 1 state invariant declarations: 1000000
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: DistAI input / Ivy invariant synthesis; generated invariant artifact source (116 lines); checker success not rerun
      • measured size: 66 lines in this file; exact source
    • database_chain_replication (protocols/database_chain_replication/database_chain_replication.ivy)
      • specifies: chain-replicated database
      • safety: invariant [1000000] (~(TX1 ~= TX2 & commit_tx(TX1) & commit_tx(TX2) & le(TX1,TX2) & write_tx(TX1, K) & depends_tx(TX2, K, T3) & ~le(TX1, T3))) & (source)
        • plain reading (inference from declaration): transaction order and key dependencies satisfy the chain-replication consistency clauses
        • 1 state invariant declarations: 1000000
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: DistAI input / Ivy invariant synthesis; generated invariant artifact source (184 lines); checker success not rerun
      • measured size: 160 lines in this file; exact source
    • decentralized_lock (protocols/decentralized_lock/decentralized_lock.ivy)
      • specifies: lock protocol
      • safety: invariant [1000000] X ~= Y -> ~(has_lock(X) & has_lock(Y)) (source)
        • plain reading (inference from declaration): two nodes cannot simultaneously own the same lock/lock epoch
        • 1 state invariant declarations: 1000000
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: DistAI input / Ivy invariant synthesis; generated invariant artifact source (48 lines); checker success not rerun
      • measured size: 32 lines in this file; exact source
    • distributed_lock (protocols/distributed_lock/distributed_lock.ivy)
      • specifies: lock protocol
      • safety: invariant [1000000] locked(E, N1) & locked(E, N2) -> N1 = N2 (source)
        • plain reading (inference from declaration): two nodes cannot simultaneously own the same lock/lock epoch
        • 1 state invariant declarations: 1000000
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: DistAI input / Ivy invariant synthesis; generated invariant artifact source (130 lines); checker success not rerun
      • measured size: 85 lines in this file; exact source
    • leader (protocols/leader/leader.ivy)
      • specifies: leader election
      • safety: invariant [1000000] forall X: node, Y:node. leader(X) & leader(Y) -> X = Y # at most one leader (source)
        • plain reading (inference from declaration): at most one node is elected leader
        • 1 state invariant declarations: 1000000
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: DistAI input / Ivy invariant synthesis; generated invariant artifact source (125 lines); checker success not rerun
      • measured size: 108 lines in this file; exact source
    • lock_server (protocols/lock_server/lock_server.ivy)
      • specifies: lock protocol
      • safety: invariant [1000000] link(C1, S) & link(C2, S) -> C1 = C2 (source)
        • plain reading (inference from declaration): a link/ownership destination cannot have conflicting sources
        • 1 state invariant declarations: 1000000
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: DistAI input / Ivy invariant synthesis; generated invariant artifact source (30 lines); checker success not rerun
      • measured size: 29 lines in this file; exact source
    • multi_lock_server (protocols/multi_lock_server/multi_lock_server.ivy)
      • specifies: lock protocol
      • safety: invariant [1000000] holds_lock(N1, L) & holds_lock(N2, L) -> N1 = N2 (source)
        • plain reading (inference from declaration): two nodes cannot simultaneously own the same lock/lock epoch
        • 1 state invariant declarations: 1000000
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: DistAI input / Ivy invariant synthesis; generated invariant artifact source (69 lines); checker success not rerun
      • measured size: 57 lines in this file; exact source
    • paxos (protocols/paxos/paxos.ivy)
      • specifies: Paxos consensus variant
      • safety: invariant [1000000] (decision(N1,R1,V1) & decision(N2,R2,V2)) -> V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 1 state invariant declarations: 1000000
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: DistAI input / Ivy invariant synthesis; no matching generated invariant artifact found
      • measured size: 158 lines in this file; exact source
    • shard (protocols/shard/shard.ivy)
      • specifies: sharded key-value storage
      • safety: invariant [1000000] table(N1, K, V1) & table(N2, K, V2) -> N1 = N2 & V1 = V2 (source)
        • plain reading (inference from declaration): a stored key has a unique node and value
        • 1 state invariant declarations: 1000000
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: DistAI input / Ivy invariant synthesis; generated invariant artifact source (56 lines); checker success not rerun
      • measured size: 41 lines in this file; exact source
    • switch (protocols/switch/switch.ivy)
      • specifies: learning network switch
      • safety: invariant [1000000] route_tc(N, X, X) & (route_tc(N, X, Y) & route_tc(N, Y, Z) -> route_tc(N, X, Z)) & (route_tc(N, X, Y) & route_tc(N, Y, X) -> X = Y) & (route_tc(N, X, Y) & route_tc(N, X, Z) -> (route_tc(N, Y, Z) | route_tc(N, Z, Y))) (source)
        • plain reading (inference from declaration): forwarding/learning relations satisfy the stated route/tree consistency constraints
        • 1 state invariant declarations: 1000000
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: DistAI input / Ivy invariant synthesis; generated invariant artifact source (135 lines); checker success not rerun
      • measured size: 64 lines in this file; exact source
    • two_phase_commit (protocols/two_phase_commit/two_phase_commit.ivy)
      • specifies: two-phase atomic commit
      • safety: invariant [1000000] (decide_commit(N0) -> ~decide_abort(N1)) & (decide_commit(N0) -> vote_yes(N1)) & (decide_abort(N0) -> abort_flag) (source)
        • plain reading (inference from declaration): commit and abort decisions do not conflict, and commit requires the stated yes votes
        • 1 state invariant declarations: 1000000
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: DistAI input / Ivy invariant synthesis; generated invariant artifact source (127 lines); checker success not rerun
      • measured size: 97 lines in this file; exact source

  • mypyvy: protocol specifications and encoding variants

    • block_cache_system (examples/block_cache_system.pyv)
      • specifies: block cache coherence
      • safety: safety forall R. ((forall N. !cache(R, N)) & (forall L. !ephemeral_clean(R, L))) -> (forall N. !spec_ephemeral(R, N)) (source); safety sync_in_progress & frozen_indirection_table_loc_some & (forall I. !outstanding_indirection_table_write(I)) -> spec_sync_in_progress (source); safety forall R, N. cache(R, N) -> spec_ephemeral(R, N) (source)
        • plain reading (inference from declaration): the concrete cache state preserves the abstract block-cache specification
        • 44 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 316 lines in this file; exact source
    • bosco_3t_safety (examples/bosco_3t_safety.pyv)
      • specifies: Bosco Byzantine consensus
      • safety: safety [agreement1] forall N1, N2, V1, V2. !member_f(N1) & !member_f(N2) & dec(N1,V1) & dec(N2,V2) -> V1 = V2 # agreement (lemma 3) (source); safety [agreement2] forall N, V1, V2. !member_f(N) & dec(N,V1) & und_cons_dec(V2) -> V1 = V2 # ultimate agreement (source); safety [validity1] forall V1, V2. ((forall N:node. !member_f(N) -> input(N,V1)) & V1 != V2) -> (forall M. !member_f(M) -> !dec(M,V2)) # validity (source); safety [validity2] forall V1, V2. (forall N:node. !member_f(N) -> input(N,V1)) & V1 != V2 -> !und_cons_dec(V2) # validity (source)
        • plain reading (inference from declaration): decisions agree; decisions satisfy the stated validity condition
        • 10 state invariant declarations: lemma1, lemma2, lemma3, lemma4, lemma5, lemma6, lemma7, lemma8
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 220 lines in this file; exact source
    • cache (examples/cache.pyv)
      • specifies: cache/memory coherence
      • safety: safety !invalid(C, A) & !modified(C, A) -> cache(C, A) = memory(A) (source)
        • plain reading (inference from declaration): an exclusive cache owner excludes other valid cache copies
        • 36 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 345 lines in this file; exact source
    • client_server_ae (examples/client_server_ae.pyv)
      • specifies: client/server request protocol
      • safety: safety forall N,P. response_received(N,P) -> exists R. request_sent(N,R) & match(R,P) (source)
        • plain reading (inference from declaration): every received response matches a previously sent request
        • 1 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 42 lines in this file; exact source
    • client_server_db_ae (examples/client_server_db_ae.pyv)
      • specifies: client/server request protocol
      • safety: safety forall N,P. response_received(N,P) -> exists R. request_sent(N,R) & match(R,P) (source)
        • plain reading (inference from declaration): every received response matches a previously sent request
        • 4 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 66 lines in this file; exact source
    • fast_paxos_epr (examples/fast_paxos_epr.pyv)
      • specifies: Paxos consensus variant
      • safety: safety decision(R1, V1) & decision(R2, V2) -> V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 11 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 158 lines in this file; exact source
    • fast_paxos_forall_choosable (examples/fast_paxos_forall_choosable.pyv)
      • specifies: Paxos consensus variant
      • safety: safety decision(R1, V1) & decision(R2, V2) -> V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 13 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 179 lines in this file; exact source
    • fast_paxos_epr_rv_sk (examples/fbii/fast_paxos_epr/fast_paxos_epr_rv_sk.pyv)
      • specifies: Paxos consensus variant
      • safety: safety decision(r1, v1) & decision(r2, v2) -> v1 = v2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 41 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 209 lines in this file; exact source
    • fast_paxos_epr_rv_sk_proph (examples/fbii/fast_paxos_epr/fast_paxos_epr_rv_sk_proph.pyv)
      • specifies: Paxos consensus variant
      • safety: safety decision(r1, v1) & decision(r2, v2) -> v1 = v2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 41 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 216 lines in this file; exact source
    • fast_paxos_epr_v_sk_proph (examples/fbii/fast_paxos_epr/fast_paxos_epr_v_sk_proph.pyv)
      • specifies: Paxos consensus variant
      • safety: safety decision(v1) & decision(v2) -> v1 = v2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 39 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 212 lines in this file; exact source
    • flexible_paxos_epr_rv_sk (examples/fbii/flexible_paxos_epr/flexible_paxos_epr_rv_sk.pyv)
      • specifies: Paxos consensus variant
      • safety: safety decision(r1, v1) & decision(r2, v2) -> v1 = v2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 19 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 134 lines in this file; exact source
    • flexible_paxos_epr_rv_sk_proph (examples/fbii/flexible_paxos_epr/flexible_paxos_epr_rv_sk_proph.pyv)
      • specifies: Paxos consensus variant
      • safety: safety decision(r1, v1) & decision(r2, v2) -> v1 = v2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 19 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 141 lines in this file; exact source
    • flexible_paxos_epr_rvq_sk (examples/fbii/flexible_paxos_epr/flexible_paxos_epr_rvq_sk.pyv)
      • specifies: Paxos consensus variant
      • safety: safety decision(r1, v1, q1) & decision(r2, v2, q2) -> v1 = v2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 20 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 137 lines in this file; exact source
    • flexible_paxos_epr_v_sk_proph (examples/fbii/flexible_paxos_epr/flexible_paxos_epr_v_sk_proph.pyv)
      • specifies: Paxos consensus variant
      • safety: safety decision(v1) & decision(v2) -> v1 = v2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 19 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 139 lines in this file; exact source
    • multi_paxos_epr_nirv_sk (examples/fbii/multi_paxos_epr/multi_paxos_epr_nirv_sk.pyv)
      • specifies: Paxos consensus variant
      • safety: safety ( decision(n1,i0,r1,v1) & (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 24 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 181 lines in this file; exact source
    • multi_paxos_epr_nirv_sk_proph (examples/fbii/multi_paxos_epr/multi_paxos_epr_nirv_sk_proph.pyv)
      • specifies: Paxos consensus variant
      • safety: safety ( decision(n1,i0,r1,v1) & (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 24 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 188 lines in this file; exact source
    • paxos_epr_rv_sk (examples/fbii/paxos_epr/paxos_epr_rv_sk.pyv)
      • specifies: Paxos consensus variant
      • safety: safety decision(r1, v1) & decision(r2, v2) -> v1 = v2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 19 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 131 lines in this file; exact source
    • paxos_epr_rv_sk_proph (examples/fbii/paxos_epr/paxos_epr_rv_sk_proph.pyv)
      • specifies: Paxos consensus variant
      • safety: safety decision(r1, v1) & decision(r2, v2) -> v1 = v2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 19 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 138 lines in this file; exact source
    • paxos_epr_rvq_sk (examples/fbii/paxos_epr/paxos_epr_rvq_sk.pyv)
      • specifies: Paxos consensus variant
      • safety: safety decision(r1, v1, q1) & decision(r2, v2, q2) -> v1 = v2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 20 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 134 lines in this file; exact source
    • paxos_epr_v_sk_proph (examples/fbii/paxos_epr/paxos_epr_v_sk_proph.pyv)
      • specifies: Paxos consensus variant
      • safety: safety decision(v1) & decision(v2) -> v1 = v2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 19 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 136 lines in this file; exact source
    • paxos_fol_rv_sk (examples/fbii/paxos_fol/paxos_fol_rv_sk.pyv)
      • specifies: Paxos consensus variant
      • safety: safety [decisions_unique] decision(r1, v1) & decision(r2, v2) -> v1 = v2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 32 state invariant declarations: proposal_partial_function, votes_proposed1, votes_proposed2, decision_quorum1, decision_quorum2, proposals_choosable1, proposals_choosable2, oneb_vote1, oneb_vote2, oneb_never_vote1, oneb_never_vote2, oneb_vote_max1, oneb_vote_max2, oneb_never_vote_current_round, oneb_vote_current_round
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 176 lines in this file; exact source
    • paxos_fol_rv_sk_proph (examples/fbii/paxos_fol/paxos_fol_rv_sk_proph.pyv)
      • specifies: Paxos consensus variant
      • safety: safety [decisions_unique] decision(r1, v1) & decision(r2, v2) -> v1 = v2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 32 state invariant declarations: proposal_partial_function, votes_proposed1, votes_proposed2, decision_quorum1, decision_quorum2, proposals_choosable1, proposals_choosable2, oneb_vote1, oneb_vote2, oneb_never_vote1, oneb_never_vote2, oneb_vote_max1, oneb_vote_max2, oneb_never_vote_current_round, oneb_vote_current_round
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 183 lines in this file; exact source
    • paxos_fol_rvq_sk (examples/fbii/paxos_fol/paxos_fol_rvq_sk.pyv)
      • specifies: Paxos consensus variant
      • safety: safety [decisions_unique] decision(r1, v1, q1) & decision(r2, v2, q2) -> v1 = v2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 32 state invariant declarations: proposal_partial_function, votes_proposed1, votes_proposed2, decision_quorum1, decision_quorum2, proposals_choosable1, proposals_choosable2, oneb_vote1, oneb_vote2, oneb_never_vote1, oneb_never_vote2, oneb_vote_max1, oneb_vote_max2, oneb_never_vote_current_round, oneb_vote_current_round
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 155 lines in this file; exact source
    • paxos_fol_v_sk_proph (examples/fbii/paxos_fol/paxos_fol_v_sk_proph.pyv)
      • specifies: Paxos consensus variant
      • safety: safety [decisions_unique] decision(v1) & decision(v2) -> v1 = v2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 32 state invariant declarations: proposal_partial_function, votes_proposed1, votes_proposed2, decision_quorum1, decision_quorum2, proposals_choosable1, proposals_choosable2, oneb_vote1, oneb_vote2, oneb_never_vote1, oneb_never_vote2, oneb_vote_max1, oneb_vote_max2, oneb_never_vote_current_round, oneb_vote_current_round
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 162 lines in this file; exact source
    • raft_epr_sk_proph (examples/fbii/raft_epr/raft_epr_sk_proph.pyv)
      • specifies: Raft replicated log
      • safety: safety [consensus] committed(i_sk, v1_sk) & committed(i_sk, v2_sk) -> v1_sk = v2_sk (source)
        • plain reading (inference from declaration): at most one node is elected leader
        • 98 state invariant declarations: vote_msg_voted, vote_msg_partial_func, voting_quorum_vote_msg, one_leader_per_term, RV_option_wf, RV_partial_func, RV_term, RV_some_index_term_at, RV_some_index_no_bigger, RV_none_index_not_used, voters_left_term, AE_option_wf, AE_none_means_init, AE_some_succ, AE_prev_term_log, AE_term_log, AER_term_log, valid_term_log, valid_current_log, log_matching, index_used_downward_closed, term_at_index_used, entries_from_term_in_term_log, current_term_partial_func; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 532 lines in this file; exact source
    • firewall_ae (examples/firewall_ae.pyv)
      • specifies: network firewall
      • safety: safety sent(S,D) & internal(D) -> exists I. internal(I) & sent(I,S) (source)
        • plain reading (inference from declaration): traffic to an internal destination requires the stated prior traffic initiated internally
        • 1 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 45 lines in this file; exact source
    • flexible_paxos_epr (examples/flexible_paxos_epr.pyv)
      • specifies: Paxos consensus variant
      • safety: safety decision(R1, V1) & decision(R2, V2) -> V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 5 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 101 lines in this file; exact source
    • flexible_paxos_forall_choosable (examples/flexible_paxos_forall_choosable.pyv)
      • specifies: Paxos consensus variant
      • safety: safety decision(R1, V1) & decision(R2, V2) -> V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 6 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 143 lines in this file; exact source
    • hybrid_reliable_broadcast_cisa (examples/hybrid_reliable_broadcast_cisa.pyv)
      • specifies: reliable broadcast
      • safety: safety [unforgebility] (exists N. !member_fs(N) & !member_fa(N) & accept(N)) -> (exists M. !member_fs(M) & !member_fa(M) & rcv_init(M)) (source)
        • plain reading (inference from declaration): a correct accepting node implies some correct node received an initiating broadcast; no spontaneous forged delivery
        • 7 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 256 lines in this file; exact source
    • ironfleet_distributed_lock (examples/ironfleet_distributed_lock.pyv)
      • specifies: lock protocol
      • safety: safety [mutual_exclusion] forall H1, H2. holds_lock(H1) & holds_lock(H2) -> H1 = H2 (source)
        • plain reading (inference from declaration): at most one process occupies the critical section
        • 4 state invariant declarations: unique_msg_in_flight, in_flight_precludes_lock_held, loc_holder_has_freshest_epoch, in_flight_has_freshest_epoch
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 63 lines in this file; exact source
    • ironfleet_distributed_lock_valid_hosts (examples/ironfleet_distributed_lock_valid_hosts.pyv)
      • specifies: lock protocol
      • safety: safety [mutual_exclusion] forall H1, H2. valid(H1) & valid(H2) & holds_lock(H1) & holds_lock(H2) -> H1 = H2 (source)
        • plain reading (inference from declaration): at most one process occupies the critical section
        • 4 state invariant declarations: unique_msg_in_flight, in_flight_precludes_lock_held, loc_holder_has_freshest_epoch, in_flight_has_freshest_epoch
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 78 lines in this file; exact source
    • learning_switch_ae (examples/learning_switch_ae.pyv)
      • specifies: learning network switch
      • safety: safety table(T,X,X) (source); safety table(T,X,Y) & table(T,Y,Z) -> table(T,X,Z) (source); safety table(T,X,Y) & table(T,Y,X) -> X = Y (source); safety table(T,X,Y) & table(T,X,Z) -> table(T,Y,Z) | table(T,Z,Y) (source)
        • plain reading (inference from declaration): forwarding/learning relations satisfy the stated route/tree consistency constraints
        • 2 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 54 lines in this file; exact source
    • learning_switch_ae_projected (examples/learning_switch_ae_projected.pyv)
      • specifies: learning network switch
      • safety: safety table(X,X) (source); safety table(X,Y) & table(Y,Z) -> table(X,Z) (source); safety table(X,Y) & table(Y,X) -> X = Y (source); safety table(X,Y) & table(X,Z) -> table(Y,Z) | table(Z,Y) (source)
        • plain reading (inference from declaration): forwarding/learning relations satisfy the stated route/tree consistency constraints
        • 2 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 58 lines in this file; exact source
    • learning_switch_forall (examples/learning_switch_forall.pyv)
      • specifies: learning network switch
      • safety: safety table(T,X,X) (source); safety table(T,X,Y) & table(T,Y,Z) -> table(T,X,Z) (source); safety table(T,X,Y) & table(T,Y,X) -> X = Y (source); safety table(T,X,Y) & table(T,X,Z) -> table(T,Y,Z) | table(T,Z,Y) (source)
        • plain reading (inference from declaration): forwarding/learning relations satisfy the stated route/tree consistency constraints
        • 2 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 54 lines in this file; exact source
    • lockserv (examples/lockserv.pyv)
      • specifies: lock protocol
      • safety: safety [mutex] holds_lock(N1) & holds_lock(N2) -> N1 = N2 (source)
        • plain reading (inference from declaration): at most one process holds the lock/critical section
        • 8 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 136 lines in this file; exact source
    • message_passing_litmus (examples/message_passing_litmus.pyv)
      • specifies: message-passing memory model
      • safety: safety & current_pc(t1) = pc2 (source)
        • plain reading (inference from declaration): when both threads finish and the flag a is observed, b must also be observed; a memory-ordering target
        • 3 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 91 lines in this file; exact source
    • bank (examples/misc/bank.pyv)
      • specifies: bank state transitions
      • safety: safety balance(A) >= 0 (source)
        • plain reading (inference from declaration): account balances do not become negative
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 25 lines in this file; exact source
    • cache_one (examples/misc/cache_one.pyv)
      • specifies: cache/memory coherence
      • safety: safety !invalid(C) & !modified(C) -> cache(C) = memory (source)
        • plain reading (inference from declaration): an exclusive cache owner excludes other valid cache copies
        • 33 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 322 lines in this file; exact source
    • chain_replication (examples/misc/chain_replication.pyv)
      • specifies: chain-replicated database
      • safety: invariant le(state(head), state(client)) (source)
        • plain reading (inference from declaration): transaction order and key dependencies satisfy the chain-replication consistency clauses
        • 8 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 130 lines in this file; exact source
    • paxos_autorelaxed (examples/misc/derived-relations/paxos_autorelaxed.pyv)
      • specifies: Paxos consensus variant
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 135 lines in this file; exact source
    • paxos_relaxed (examples/misc/derived-relations/paxos_relaxed.pyv)
      • specifies: Paxos consensus variant
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 212 lines in this file; exact source
    • paxos_unrelaxed (examples/misc/derived-relations/paxos_unrelaxed.pyv)
      • specifies: Paxos consensus variant
      • safety: safety decision(R1, V1) & decision(R2, V2) -> V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 134 lines in this file; exact source
    • lockserv (examples/misc/lockserv.pyv)
      • specifies: lock protocol
      • safety: safety [mutex] holds_lock(N1) & holds_lock(N2) -> N1 = N2 (source)
        • plain reading (inference from declaration): at most one process holds the lock/critical section
        • 8 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 128 lines in this file; exact source
    • lockserv_clean (examples/misc/lockserv_clean.pyv)
      • specifies: lock protocol
      • safety: safety [mutex] holds_lock(N1) & holds_lock(N2) -> N1 = N2 (source)
        • plain reading (inference from declaration): at most one process holds the lock/critical section
        • 8 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 66 lines in this file; exact source
    • lockserv_multi (examples/misc/lockserv_multi.pyv)
      • specifies: lock protocol
      • safety: safety [mutex] holds_lock(N1, L) & holds_lock(N2, L) -> N1 = N2 (source)
        • plain reading (inference from declaration): at most one process holds the lock/critical section
        • 8 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 67 lines in this file; exact source
    • lockserv_prime (examples/misc/lockserv_prime.pyv)
      • specifies: lock protocol
      • safety: safety [mutex] holds_lock(N1) & holds_lock(N2) -> N1 = N2 (source)
        • plain reading (inference from declaration): at most one process holds the lock/critical section
        • 8 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 68 lines in this file; exact source
    • paxos (examples/misc/paxos/abstract_cex/paxos.pyv)
      • specifies: Paxos consensus variant
      • safety: safety decision(R1, V1) & decision(R2, V2) -> V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 5 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 118 lines in this file; exact source
    • paxos (examples/misc/paxos/updr_successful/paxos.pyv)
      • specifies: Paxos consensus variant
      • safety: safety decision(R1, V1) & decision(R2, V2) -> V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 5 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 121 lines in this file; exact source
    • cache (examples/misc/pd/cache.pyv)
      • specifies: cache/memory coherence
      • safety: safety !invalid(C, A) & !modified(C, A) -> cache(C, A) = memory(A) (source)
        • plain reading (inference from declaration): an exclusive cache owner excludes other valid cache copies
        • 36 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 263 lines in this file; exact source
    • cache_unsafe (examples/misc/pd/cache_unsafe.pyv)
      • specifies: cache/memory coherence
      • safety: safety !invalid(C, A) & !modified(C, A) -> cache(C, A) = memory(A) (source)
        • plain reading (inference from declaration): an exclusive cache owner excludes other valid cache copies
        • 36 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • negative-test warning: the filename marks this as a bad/buggy/unsafe/error variant; displayed properties are attempted checks, not established guarantees
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 263 lines in this file; exact source
    • consensus_epr (examples/misc/pd/consensus_epr.pyv)
      • specifies: consensus/agreement protocol
      • safety: safety decided(N1, V1) & decided(N2, V2) -> V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 6 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 56 lines in this file; exact source
    • consensus_forall (examples/misc/pd/consensus_forall.pyv)
      • specifies: consensus/agreement protocol
      • safety: safety decided(N1, V1) & decided(N2, V2) -> V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 6 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 62 lines in this file; exact source
    • consensus_unsafe (examples/misc/pd/consensus_unsafe.pyv)
      • specifies: consensus/agreement protocol
      • safety: safety !decided(N1, V1) (source)
        • plain reading (inference from declaration): at most one node is elected leader
        • 6 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • negative-test warning: the filename marks this as a bad/buggy/unsafe/error variant; displayed properties are attempted checks, not established guarantees
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 62 lines in this file; exact source
    • consensus_unsafe2 (examples/misc/pd/consensus_unsafe2.pyv)
      • specifies: consensus/agreement protocol
      • safety: safety decided(N1, V1) & decided(N2, V2) -> V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 5 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • negative-test warning: the filename marks this as a bad/buggy/unsafe/error variant; displayed properties are attempted checks, not established guarantees
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 56 lines in this file; exact source
    • fast_paxos_epr (examples/misc/pd/fast_paxos_epr.pyv)
      • specifies: Paxos consensus variant
      • safety: safety decision(R1, V1) & decision(R2, V2) -> V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 11 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 157 lines in this file; exact source
    • fast_paxos_forall (examples/misc/pd/fast_paxos_forall.pyv)
      • specifies: Paxos consensus variant
      • safety: safety decision(R1, V1) & decision(R2, V2) -> V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 15 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 182 lines in this file; exact source
    • fast_paxos_forall_choosable (examples/misc/pd/fast_paxos_forall_choosable.pyv)
      • specifies: Paxos consensus variant
      • safety: safety decision(R1, V1) & decision(R2, V2) -> V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 13 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 172 lines in this file; exact source
    • flexible_paxos_epr (examples/misc/pd/flexible_paxos_epr.pyv)
      • specifies: Paxos consensus variant
      • safety: safety decision(R1, V1) & decision(R2, V2) -> V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 5 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 128 lines in this file; exact source
    • flexible_paxos_forall (examples/misc/pd/flexible_paxos_forall.pyv)
      • specifies: Paxos consensus variant
      • safety: safety decision(R1, V1) & decision(R2, V2) -> V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 7 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 142 lines in this file; exact source
    • flexible_paxos_forall_choosable (examples/misc/pd/flexible_paxos_forall_choosable.pyv)
      • specifies: Paxos consensus variant
      • safety: safety decision(R1, V1) & decision(R2, V2) -> V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 6 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 136 lines in this file; exact source
    • lockserv (examples/misc/pd/lockserv.pyv)
      • specifies: lock protocol
      • safety: safety [mutex] holds_lock(N1) & holds_lock(N2) -> N1 = N2 (source)
        • plain reading (inference from declaration): at most one process holds the lock/critical section
        • 8 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 118 lines in this file; exact source
    • lockserv_cnf (examples/misc/pd/lockserv_cnf.pyv)
      • specifies: lock protocol
      • safety: safety [mutex] !holds_lock(N1) | !holds_lock(N2) | N1 = N2 (source)
        • plain reading (inference from declaration): at most one process holds the lock/critical section
        • 9 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 121 lines in this file; exact source
    • lockserv_unsafe (examples/misc/pd/lockserv_unsafe.pyv)
      • specifies: lock protocol
      • safety: safety [mutex] holds_lock(N1) & holds_lock(N2) -> N1 = N2 (source)
        • plain reading (inference from declaration): at most one process holds the lock/critical section
        • 8 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • negative-test warning: the filename marks this as a bad/buggy/unsafe/error variant; displayed properties are attempted checks, not established guarantees
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 118 lines in this file; exact source
    • paxos_epr (examples/misc/pd/paxos_epr.pyv)
      • specifies: Paxos consensus variant
      • safety: safety decision(R1, V1) & decision(R2, V2) -> V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 5 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 97 lines in this file; exact source
    • paxos_forall (examples/misc/pd/paxos_forall.pyv)
      • specifies: Paxos consensus variant
      • safety: safety decision(R1, V1) & decision(R2, V2) -> V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 7 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 145 lines in this file; exact source
    • paxos_forall_choosable (examples/misc/pd/paxos_forall_choosable.pyv)
      • specifies: Paxos consensus variant
      • safety: safety decision(R1, V1) & decision(R2, V2) -> V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 6 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 134 lines in this file; exact source
    • paxos_forall_choosable_unsafe (examples/misc/pd/paxos_forall_choosable_unsafe.pyv)
      • specifies: Paxos consensus variant
      • safety: safety !decision(R, V) # UNSAFE (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 6 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • negative-test warning: the filename marks this as a bad/buggy/unsafe/error variant; displayed properties are attempted checks, not established guarantees
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 134 lines in this file; exact source
    • paxos_forall_choosable_unsafe2 (examples/misc/pd/paxos_forall_choosable_unsafe2.pyv)
      • specifies: Paxos consensus variant
      • safety: safety decision(R1, V1) & decision(R2, V2) -> V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 6 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • negative-test warning: the filename marks this as a bad/buggy/unsafe/error variant; displayed properties are attempted checks, not established guarantees
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 134 lines in this file; exact source
    • paxos_forall_choosable_unsafe_no_intersection (examples/misc/pd/paxos_forall_choosable_unsafe_no_intersection.pyv)
      • specifies: Paxos consensus variant
      • safety: safety decision(R1, V1) & decision(R2, V2) -> V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 6 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • negative-test warning: the filename marks this as a bad/buggy/unsafe/error variant; displayed properties are attempted checks, not established guarantees
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 134 lines in this file; exact source
    • ring-id (examples/misc/pd/ring-id.pyv)
      • specifies: ring protocol
      • safety: safety [one_leader] leader(L1) & leader(L2) -> L1 = L2 (source)
        • plain reading (inference from declaration): at most one node is elected leader
        • 3 state invariant declarations: leader_max, self_pending_highest_id, no_bypass
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 55 lines in this file; exact source
    • ring (examples/misc/pd/ring.pyv)
      • specifies: ring protocol
      • safety: safety [one_leader] leader(L1) & leader(L2) -> L1 = L2 (source)
        • plain reading (inference from declaration): at most one node is elected leader
        • 3 state invariant declarations: leader_max, self_pending_highest_id, no_bypass
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 51 lines in this file; exact source
    • sharded-kv-retransmit (examples/misc/pd/sharded-kv-retransmit.pyv)
      • specifies: sharded key-value storage
      • safety: safety [keys_unique] table(N1, K, V1) & table(N2, K, V2) -> N1 = N2 & V1 = V2 (source)
        • plain reading (inference from declaration): each key has one owner/value
        • 7 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 97 lines in this file; exact source
    • sharded-kv-retransmit_unsafe (examples/misc/pd/sharded-kv-retransmit_unsafe.pyv)
      • specifies: sharded key-value storage
      • safety: safety [keys_unique] table(N1, K, V1) & table(N2, K, V2) -> N1 = N2 & V1 = V2 (source)
        • plain reading (inference from declaration): each key has one owner/value
        • 7 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • negative-test warning: the filename marks this as a bad/buggy/unsafe/error variant; displayed properties are attempted checks, not established guarantees
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 97 lines in this file; exact source
    • sharded-kv (examples/misc/pd/sharded-kv.pyv)
      • specifies: sharded key-value storage
      • safety: safety [keys_unique] table(N1, K, V1) & table(N2, K, V2) -> N1 = N2 & V1 = V2 (source)
        • plain reading (inference from declaration): each key has one owner/value
        • 4 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 42 lines in this file; exact source
    • sharded-kv_unsafe (examples/misc/pd/sharded-kv_unsafe.pyv)
      • specifies: sharded key-value storage
      • safety: safety [keys_unique] table(N1, K, V1) & table(N2, K, V2) -> N1 = N2 & V1 = V2 (source)
        • plain reading (inference from declaration): each key has one owner/value
        • 4 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • negative-test warning: the filename marks this as a bad/buggy/unsafe/error variant; displayed properties are attempted checks, not established guarantees
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 42 lines in this file; exact source
    • sharded-kv_unsafe2 (examples/misc/pd/sharded-kv_unsafe2.pyv)
      • specifies: sharded key-value storage
      • safety: safety [keys_unique] table(N1, K, V1) & table(N2, K, V2) -> N1 = N2 & V1 = V2 (source)
        • plain reading (inference from declaration): each key has one owner/value
        • 4 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • negative-test warning: the filename marks this as a bad/buggy/unsafe/error variant; displayed properties are attempted checks, not established guarantees
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 42 lines in this file; exact source
    • stoppable_paxos_dnf_epr (examples/misc/pd/stoppable_paxos_dnf_epr.pyv)
      • specifies: Paxos consensus variant
      • safety: safety forall N1,N2,I,R1,R2,V1,V2. decision(N1,I,R1,V1) & decision(N2,I,R2,V2) -> V1 = V2 (source); safety forall N1,N2,I1,I2,R1,R2. decision(N1,I1,R1,stop) & !inst_le(I2,I1) -> !decision(N2,I2,R2,V) (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 16 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 223 lines in this file; exact source
    • stoppable_paxos_dnf_forall (examples/misc/pd/stoppable_paxos_dnf_forall.pyv)
      • specifies: Paxos consensus variant
      • safety: safety forall N1,N2,I,R1,R2,V1,V2. decision(N1,I,R1,V1) & decision(N2,I,R2,V2) -> V1 = V2 (source); safety forall N1,N2,I1,I2,R1,R2. decision(N1,I1,R1,stop) & !inst_le(I2,I1) -> !decision(N2,I2,R2,V) (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 17 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 236 lines in this file; exact source
    • stoppable_paxos_dnf_forall_choosable (examples/misc/pd/stoppable_paxos_dnf_forall_choosable.pyv)
      • specifies: Paxos consensus variant
      • safety: safety forall N1,N2,I,R1,R2,V1,V2. decision(N1,I,R1,V1) & decision(N2,I,R2,V2) -> V1 = V2 (source); safety forall N1,N2,I1,I2,R1,R2. decision(N1,I1,R1,stop) & !inst_le(I2,I1) -> !decision(N2,I2,R2,V) (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 16 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 228 lines in this file; exact source
    • stoppable_paxos_epr (examples/misc/pd/stoppable_paxos_epr.pyv)
      • specifies: Paxos consensus variant
      • safety: safety forall N1,N2,I,R1,R2,V1,V2. decision(N1,I,R1,V1) & decision(N2,I,R2,V2) -> V1 = V2 (source); safety forall N1,N2,I1,I2,R1,R2. decision(N1,I1,R1,stop) & !inst_le(I2,I1) -> !decision(N2,I2,R2,V) (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 16 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 191 lines in this file; exact source
    • stoppable_paxos_forall (examples/misc/pd/stoppable_paxos_forall.pyv)
      • specifies: Paxos consensus variant
      • safety: safety forall N1,N2,I,R1,R2,V1,V2. decision(N1,I,R1,V1) & decision(N2,I,R2,V2) -> V1 = V2 (source); safety forall N1,N2,I1,I2,R1,R2. decision(N1,I1,R1,stop) & !inst_le(I2,I1) -> !decision(N2,I2,R2,V) (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 17 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 203 lines in this file; exact source
    • stoppable_paxos_forall_choosable (examples/misc/pd/stoppable_paxos_forall_choosable.pyv)
      • specifies: Paxos consensus variant
      • safety: safety forall N1,N2,I,R1,R2,V1,V2. decision(N1,I,R1,V1) & decision(N2,I,R2,V2) -> V1 = V2 (source); safety forall N1,N2,I1,I2,R1,R2. decision(N1,I1,R1,stop) & !inst_le(I2,I1) -> !decision(N2,I2,R2,V) (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 16 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 196 lines in this file; exact source
    • tlb_safety (examples/misc/pd/tlb_safety.pyv)
      • specifies: TLB coherence
      • safety: safety !error (source)
        • plain reading (inference from declaration): the model never enters its error state
        • 21 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 470 lines in this file; exact source
    • tlb_safety_prime (examples/misc/pd/tlb_safety_prime.pyv)
      • specifies: TLB coherence
      • safety: safety !error (source)
        • plain reading (inference from declaration): the model never enters its error state
        • 21 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 474 lines in this file; exact source
    • vertical_paxos_epr (examples/misc/pd/vertical_paxos_epr.pyv)
      • specifies: Paxos consensus variant
      • safety: safety decision(R1, V1) & decision(R2, V2) -> V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 10 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 164 lines in this file; exact source
    • vertical_paxos_forall (examples/misc/pd/vertical_paxos_forall.pyv)
      • specifies: Paxos consensus variant
      • safety: safety decision(R1, V1) & decision(R2, V2) -> V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 14 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 188 lines in this file; exact source
    • vertical_paxos_forall_choosable (examples/misc/pd/vertical_paxos_forall_choosable.pyv)
      • specifies: Paxos consensus variant
      • safety: safety decision(R1, V1) & decision(R2, V2) -> V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 13 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 183 lines in this file; exact source
    • primary_backup (examples/misc/primary_backup.pyv)
      • specifies: primary/backup replication
      • safety: safety le(backup, primary) (source)
        • plain reading (inference from declaration): the backup’s progress does not exceed the primary’s progress
        • 2 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 49 lines in this file; exact source
    • primary_backup_relational (examples/misc/primary_backup_relational.pyv)
      • specifies: primary/backup replication
      • safety: safety exists X, Y. primary(X) & backup(Y) & le(Y, X) (source)
        • plain reading (inference from declaration): the backup’s progress does not exceed the primary’s progress
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 48 lines in this file; exact source
    • multi_paxos_epr (examples/multi_paxos_epr.pyv)
      • specifies: Paxos consensus variant
      • safety: safety ( decision(N1,I,R1,V1) & (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 7 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 140 lines in this file; exact source
    • paxos_epr (examples/paxos_epr.pyv)
      • specifies: Paxos consensus variant
      • safety: safety decision(R1, V1) & decision(R2, V2) -> V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 5 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 98 lines in this file; exact source
    • paxos_fol (examples/paxos_fol.pyv)
      • specifies: Paxos consensus variant
      • safety: safety [decisions_unique] decision(R1, V1) & decision(R2, V2) -> V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 9 state invariant declarations: proposal_partial_function, votes_proposed, decision_quorum, proposals_choosable, oneb_vote, oneb_never_vote, oneb_vote_max, oneb_never_vote_current_round, oneb_vote_current_round
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 134 lines in this file; exact source
    • paxos_forall (examples/paxos_forall.pyv)
      • specifies: Paxos consensus variant
      • safety: safety decision(R1, V1) & decision(R2, V2) -> V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 11 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 156 lines in this file; exact source
    • paxos_forall_choosable (examples/paxos_forall_choosable.pyv)
      • specifies: Paxos consensus variant
      • safety: safety decision(R1, V1) & decision(R2, V2) -> V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 6 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 141 lines in this file; exact source
    • peterson (examples/peterson.pyv)
      • specifies: Peterson mutual exclusion
      • safety: safety [mutex] ((pc(P) = cs) & (pc(Q) = cs)) -> (P = Q) (source)
        • plain reading (inference from declaration): at most one process holds the lock/critical section
        • 2 state invariant declarations: A1, A2
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 183 lines in this file; exact source
    • raft_epr (examples/raft_epr.pyv)
      • specifies: Raft replicated log
      • safety: safety committed(I, V1) & committed(I, V2) -> V1 = V2 (source)
        • plain reading (inference from declaration): committed log values agree for a given log index
        • 45 state invariant declarations: vote_msg_voted, vote_msg_partial_func, voting_quorum_vote_msg, one_leader_per_term, RV_option_wf, RV_partial_func, RV_term, RV_some_index_term_at, RV_some_index_no_bigger, RV_none_index_not_used, voters_left_term, AE_option_wf, AE_none_means_init, AE_some_succ, AE_prev_term_log, AE_term_log, AER_term_log, valid_term_log, valid_current_log, valid_commit_log, log_matching, index_used_downward_closed, term_at_index_used, entries_from_term_in_term_log; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 478 lines in this file; exact source
    • ring_leader_election (examples/ring_leader_election.pyv)
      • specifies: leader election
      • safety: safety [leader_unique] leader(X) & leader(Y) -> X = Y (source)
        • plain reading (inference from declaration): at most one node is elected leader
        • 3 state invariant declarations: leader_max, self_pending_max, no_bypass
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 66 lines in this file; exact source
    • ring_leader_election_no_deadlock (examples/ring_leader_election_no_deadlock.pyv)
      • specifies: leader election
      • safety: safety [leader_unique] leader(X) & leader(Y) -> X = Y (source); safety [not_dead] (exists L. leader(L)) | (exists M,N. pending(M, N)) | (exists N. !sent(N)) (source)
        • plain reading (inference from declaration): at most one node is elected leader
        • 4 state invariant declarations: leader_max, seflf_pending_max, no_bypass, for_not_dead
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 84 lines in this file; exact source
    • ring_leader_election_single_sort (examples/ring_leader_election_single_sort.pyv)
      • specifies: leader election
      • safety: safety [leader_unique] leader(X) & leader(Y) -> X = Y (source)
        • plain reading (inference from declaration): at most one node is elected leader
        • 3 state invariant declarations: leader_max, seflf_pending_max, no_bypass
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 72 lines in this file; exact source
    • sharded_kv (examples/sharded_kv.pyv)
      • specifies: sharded key-value storage
      • safety: safety [keys_unique] table(N1, K, V1) & table(N2, K, V2) -> N1 = N2 & V1 = V2 (source)
        • plain reading (inference from declaration): each key has one owner/value
        • 4 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 66 lines in this file; exact source
    • sharded_kv_no_lost_keys (examples/sharded_kv_no_lost_keys.pyv)
      • specifies: sharded key-value storage
      • safety: safety [no_lost_keys] (exists N,K,V. transfer_msg(N,K,V)) | (forall K. exists N. owner(N,K)) (source)
        • plain reading (inference from declaration): either a transfer message exists or every key has an owner; this is the precise modeled no-loss condition
        • 1 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 68 lines in this file; exact source
    • sharded_kv_retransmit (examples/sharded_kv_retransmit.pyv)
      • specifies: sharded key-value storage
      • safety: safety [keys_unique] table(N1, K, V1) & table(N2, K, V2) -> N1 = N2 & V1 = V2 (source)
        • plain reading (inference from declaration): each key has one owner/value
        • 7 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 146 lines in this file; exact source
    • stoppable_paxos_epr (examples/stoppable_paxos_epr.pyv)
      • specifies: Paxos consensus variant
      • safety: safety forall N1,N2,I,R1,R2,V1,V2. decision(N1,I,R1,V1) & decision(N2,I,R2,V2) -> V1 = V2 (source); safety forall N1,N2,I1,I2,R1,R2. decision(N1,I1,R1,stop) & !inst_le(I2,I1) -> !decision(N2,I2,R2,V) (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 16 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 199 lines in this file; exact source
    • stoppable_paxos_forall (examples/stoppable_paxos_forall.pyv)
      • specifies: Paxos consensus variant
      • safety: safety forall N1,N2,I,R1,R2,V1,V2. decision(N1,I,R1,V1) & decision(N2,I,R2,V2) -> V1 = V2 (source); safety forall N1,N2,I1,I2,R1,R2. decision(N1,I1,R1,stop) & !inst_le(I2,I1) -> !decision(N2,I2,R2,V) (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 19 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 229 lines in this file; exact source
    • stoppable_paxos_forall_choosable (examples/stoppable_paxos_forall_choosable.pyv)
      • specifies: Paxos consensus variant
      • safety: safety forall N1,N2,I,R1,R2,V1,V2. decision(N1,I,R1,V1) & decision(N2,I,R2,V2) -> V1 = V2 (source); safety forall N1,N2,I1,I2,R1,R2. decision(N1,I1,R1,stop) & !inst_le(I2,I1) -> !decision(N2,I2,R2,V) (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 16 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 207 lines in this file; exact source
    • ticket (examples/ticket.pyv)
      • specifies: ticket lock
      • safety: safety [mutex] pc3(T1) & pc3(T2) -> T1 = T2 (source)
        • plain reading (inference from declaration): at most one process holds the lock/critical section
        • 13 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 101 lines in this file; exact source
    • toy_consensus_cav24 (examples/toy_consensus_cav24.pyv)
      • specifies: consensus/agreement protocol
      • safety: safety [agreement] forall X, Y. d(X) & d(Y) -> X = Y (source)
        • plain reading (inference from declaration): decisions agree
        • 3 state invariant declarations: decision_quorums, unique_votes, voting_bit
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 65 lines in this file; exact source
    • toy_consensus_epr (examples/toy_consensus_epr.pyv)
      • specifies: consensus/agreement protocol
      • safety: safety decided(V1) & decided(V2) -> V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 3 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 37 lines in this file; exact source
    • toy_consensus_forall (examples/toy_consensus_forall.pyv)
      • specifies: consensus/agreement protocol
      • safety: safety decided(V1) & decided(V2) -> V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 3 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 44 lines in this file; exact source
    • toy_leader_consensus_epr (examples/toy_leader_consensus_epr.pyv)
      • specifies: consensus/agreement protocol
      • safety: safety decided(N1, V1) & decided(N2, V2) -> V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 6 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 79 lines in this file; exact source
    • toy_leader_consensus_forall (examples/toy_leader_consensus_forall.pyv)
      • specifies: consensus/agreement protocol
      • safety: safety decided(N1, V1) & decided(N2, V2) -> V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 6 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 91 lines in this file; exact source
    • toy_leader_consensus_forall_without_decide (examples/toy_leader_consensus_forall_without_decide.pyv)
      • specifies: consensus/agreement protocol
      • safety: safety leader(N1) & leader(N2) -> N1 = N2 (source)
        • plain reading (inference from declaration): at most one node is elected leader
        • 4 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 72 lines in this file; exact source
    • vertical_paxos_epr (examples/vertical_paxos_epr.pyv)
      • specifies: Paxos consensus variant
      • safety: safety decision(R1, V1) & decision(R2, V2) -> V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 10 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 168 lines in this file; exact source
    • vertical_paxos_forall_choosable (examples/vertical_paxos_forall_choosable.pyv)
      • specifies: Paxos consensus variant
      • safety: safety decision(R1, V1) & decision(R2, V2) -> V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 13 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun
      • measured size: 189 lines in this file; exact source

  • SWISS: Ivy and mypyvy benchmark encodings

    • 2PC (benchmarks/2PC.ivy)
      • specifies: two-phase atomic commit
      • safety: conjecture (decide_commit(N) -> ~decide_abort(N2)) (source); conjecture (decide_commit(N) -> vote_yes(N2)) (source); conjecture (decide_abort(N) -> abort_flag) (source)
        • plain reading (inference from declaration): commit and abort decisions do not conflict, and commit requires the stated yes votes
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 137 lines in this file; exact source
    • 2PC (benchmarks/2PC.pyv)
      • specifies: two-phase atomic commit
      • safety: safety (decide_commit(N) -> !decide_abort(N2)) (source); safety (decide_commit(N) -> vote_yes(N2)) (source); safety (decide_abort(N) -> abort_flag) (source)
        • plain reading (inference from declaration): commit and abort decisions do not conflict, and commit requires the stated yes votes
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 106 lines in this file; exact source
    • chain (benchmarks/chain.ivy)
      • specifies: chain-replicated database
      • safety: conjecture (~(TX1 ~= TX2 & (source)
        • plain reading (inference from declaration): transaction order and key dependencies satisfy the chain-replication consistency clauses
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 212 lines in this file; exact source
    • chain (benchmarks/chain.pyv)
      • specifies: chain-replicated database
      • safety: safety (!(TX1 != TX2 & (source)
        • plain reading (inference from declaration): transaction order and key dependencies satisfy the chain-replication consistency clauses
        • 7 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 166 lines in this file; exact source
    • chord-gimme-1 (benchmarks/chord-gimme-1.ivy)
      • specifies: Chord ring maintenance
      • safety: conjecture (~btw(X, org, Y) | ~s1(X, Y)) (source); conjecture ~error(N) (source)
        • plain reading (inference from declaration): the model never enters its error state
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 232 lines in this file; exact source
    • chord-last-2 (benchmarks/chord-last-2.ivy)
      • specifies: Chord ring maintenance
      • safety: conjecture s1(X,Y) -> in_s1(X) (source); conjecture s2(X,Y) -> in_s2(X) (source); conjecture reach(org) (source); conjecture s1(X,Y) & s1(X,Z) -> Y=Z (source); conjecture s2(X,Y) & s2(X,Z) -> Y=Z (source); conjecture p(X,Y) & p(X,Z) -> Y=Z (source); conjecture (a(X) | X ~= org) (source); conjecture (a(X) | ~p(Y, X) | ~s1(X, Y)) (source); conjecture (a(X) | p(Y, X) | ~s1(X, Y)) (source); conjecture (a(X) | ~s2(X, Y)) (source); conjecture (in_s1(X) | ~a(X)) (source); conjecture (a(Y) | a(Z) | ~s1(X, Y) | ~s2(X, Z)) (source); conjecture (a(Y) | in_s2(X) | ~a(X) | ~s1(X, Y)) (source); conjecture p(A,B) -> a(A) (source); conjecture a(X) & p(Y,X) & s1(X,Y) -> a(Y) (source); conjecture ~error(N) (source)
        • plain reading (inference from declaration): the model never enters its error state
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 232 lines in this file; exact source
    • chord (benchmarks/chord.ivy)
      • specifies: Chord ring maintenance
      • safety: conjecture ~error(N) (source)
        • plain reading (inference from declaration): the model never enters its error state
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 245 lines in this file; exact source
    • chord (benchmarks/chord.pyv)
      • specifies: Chord ring maintenance
      • safety: safety !error(N) (source)
        • plain reading (inference from declaration): the model never enters its error state
        • 17 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 175 lines in this file; exact source
    • client_server_ae (benchmarks/client_server_ae.ivy)
      • specifies: client/server request protocol
      • safety: conjecture forall N,P. response_received(N,P) -> exists R. request_sent(N,R) & match(R,P) (source)
        • plain reading (inference from declaration): every received response matches a previously sent request
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 43 lines in this file; exact source
    • client_server_ae (benchmarks/client_server_ae.pyv)
      • specifies: client/server request protocol
      • safety: safety forall N,P. response_received(N,P) -> exists R. request_sent(N,R) & match(R,P) (source)
        • plain reading (inference from declaration): every received response matches a previously sent request
        • 1 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 42 lines in this file; exact source
    • client_server_db_ae (benchmarks/client_server_db_ae.ivy)
      • specifies: client/server request protocol
      • safety: conjecture forall N,P. response_received(N,P) -> exists R. request_sent(N,R) & match(R,P) (source)
        • plain reading (inference from declaration): every received response matches a previously sent request
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 74 lines in this file; exact source
    • client_server_db_ae (benchmarks/client_server_db_ae.pyv)
      • specifies: client/server request protocol
      • safety: safety forall N,P. response_received(N,P) -> exists R. request_sent(N,R) & match(R,P) (source)
        • plain reading (inference from declaration): every received response matches a previously sent request
        • 4 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 66 lines in this file; exact source
    • consensus_epr (benchmarks/consensus_epr.ivy)
      • specifies: consensus/agreement protocol
      • safety: conjecture decided(N1, V1) & decided(N2, V2) -> V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 82 lines in this file; exact source
    • consensus_epr (benchmarks/consensus_epr.pyv)
      • specifies: consensus/agreement protocol
      • safety: safety decided(N1, V1) & decided(N2, V2) -> V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 6 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 58 lines in this file; exact source
    • consensus_forall (benchmarks/consensus_forall.ivy)
      • specifies: consensus/agreement protocol
      • safety: conjecture decided(N1, V1) & decided(N2, V2) -> V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 78 lines in this file; exact source
    • consensus_forall (benchmarks/consensus_forall.pyv)
      • specifies: consensus/agreement protocol
      • safety: safety decided(N1, V1) & decided(N2, V2) -> V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 6 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 65 lines in this file; exact source
    • consensus_wo_decide (benchmarks/consensus_wo_decide.ivy)
      • specifies: consensus/agreement protocol
      • safety: conjecture leader(N1) & leader(N2) -> N1 = N2 (source)
        • plain reading (inference from declaration): at most one node is elected leader
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 64 lines in this file; exact source
    • consensus_wo_decide (benchmarks/consensus_wo_decide.pyv)
      • specifies: consensus/agreement protocol
      • safety: safety leader(N1) & leader(N2) -> N1 = N2 (source)
        • plain reading (inference from declaration): at most one node is elected leader
        • 4 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 55 lines in this file; exact source
    • decentralized-lock-gimme-1 (benchmarks/decentralized-lock-gimme-1.ivy)
      • specifies: lock protocol
      • safety: conjecture ~(X ~= Y & ( has_lock(X) | (msg(X1, X, T) & ~le(T, epoch(X))) ) & ( has_lock(Y) | (msg(Y1, Y, S) & ~le(S, epoch(Y))) )) (source); conjecture ~(X ~= Y & has_lock(X) & has_lock(Y)) (source)
        • plain reading (inference from declaration): two nodes cannot simultaneously own the same lock/lock epoch
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 59 lines in this file; exact source
    • decentralized-lock (benchmarks/decentralized-lock.ivy)
      • specifies: lock protocol
      • safety: conjecture ~(X ~= Y & has_lock(X) & has_lock(Y)) (source)
        • plain reading (inference from declaration): two nodes cannot simultaneously own the same lock/lock epoch
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 59 lines in this file; exact source
    • distributed_lock (benchmarks/distributed_lock.ivy)
      • specifies: lock protocol
      • safety: conjecture locked(E, N1) & locked(E, N2) -> N1 = N2 (source)
        • plain reading (inference from declaration): two nodes cannot simultaneously own the same lock/lock epoch
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 84 lines in this file; exact source
    • distributed_lock (benchmarks/distributed_lock.pyv)
      • specifies: lock protocol
      • safety: safety locked(E, N1) & locked(E, N2) -> N1 = N2 (source)
        • plain reading (inference from declaration): two nodes cannot simultaneously own the same lock/lock epoch
        • 8 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 101 lines in this file; exact source
    • fast_paxos (benchmarks/fast_paxos.ivy)
      • specifies: Paxos consensus variant
      • safety: conjecture ( decision(N1,R1,V1) & (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 186 lines in this file; exact source
    • fast_paxos (benchmarks/fast_paxos.pyv)
      • specifies: Paxos consensus variant
      • safety: safety ( decision(N1,R1,V1) & (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 16 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 172 lines in this file; exact source
    • fast_paxos_epr (benchmarks/fast_paxos_epr.ivy)
      • specifies: Paxos consensus variant
      • safety: conjecture ~proposal(R,V) (source); conjecture ( decision(N1,R1,V1) & (source); conjecture proposal(R,V1) & proposal(R,V2) -> V1 = V2 (source); conjecture any_msg(R) -> fast(R) (source); conjecture ~fast(R) & (exists N. decision(N,R,V)) -> exists Q:c_quorum . forall N:node . c_member(N, Q) -> vote(N,R,V) (source); conjecture fast(R) & (exists N. decision(N,R,V)) -> exists Q:f_quorum . forall N:node . f_member(N, Q) -> vote(N,R,V) (source); conjecture ~fast(R) & vote(N,R,V) -> proposal(R,V) (source); conjecture fast(R) & vote(N,R,V) -> (proposal(R,V) | any_msg(R)) (source); conjecture ~(any_msg(R) & proposal(R,V)) (source); conjecture fast(R) & vote(N,R,V1) & vote(N,R,V2) -> V1 = V2 (source); conjecture forall R1:round, R2:round, V1:value, V2:value, Q:c_quorum. (source); conjecture forall R1:round, R2:round, V1:value, V2:value, Q:f_quorum. (source); conjecture one_b_max_vote(N,R2,none,V1) & ~le(R2,R1) -> ~vote(N,R1,V2) (source); conjecture one_b_max_vote(N,R,RMAX,V) & RMAX ~= none -> ~le(R,RMAX) & vote(N,RMAX,V) (source); conjecture one_b_max_vote(N,R,RMAX,V) & RMAX ~= none & ~le(R,ROTHER) & ~le(ROTHER,RMAX) -> ~vote(N,ROTHER,VOTHER) (source); conjecture one_b_max_vote(N,R,RMAX,V) -> one_b(N,R) (source); conjecture one_b(N,R2) & ~le(R2,R1) -> left_rnd(N,R1) (source); conjecture ~vote(N,none,V) (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 226 lines in this file; exact source
    • fast_paxos_start_with_hard (benchmarks/fast_paxos_start_with_hard.ivy)
      • specifies: Paxos consensus variant
      • safety: conjecture ( decision(N1,R1,V1) & (source); conjecture forall R1:round, R2:round, V1:value, V2:value, Q:c_quorum. (source); conjecture forall R1:round, R2:round, V1:value, V2:value, Q:f_quorum. (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 190 lines in this file; exact source
    • flexible_paxos (benchmarks/flexible_paxos.ivy)
      • specifies: Paxos consensus variant
      • safety: conjecture ( decision(N1,R1,V1) & (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 150 lines in this file; exact source
    • flexible_paxos (benchmarks/flexible_paxos.pyv)
      • specifies: Paxos consensus variant
      • safety: safety ( decision(N1,R1,V1) & (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 10 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 121 lines in this file; exact source
    • hybrid_reliable_broadcast_cisa (benchmarks/hybrid_reliable_broadcast_cisa.ivy)
      • specifies: reliable broadcast
      • safety: conjecture (exists N. ~member_fs(N) & ~member_fa(N) & accept(N)) -> (exists M. ~member_fs(M) & ~member_fa(M) & rcv_init(M)) (source)
        • plain reading (inference from declaration): a correct accepting node implies some correct node received an initiating broadcast; no spontaneous forged delivery
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 238 lines in this file; exact source
    • hybrid_reliable_broadcast_cisa (benchmarks/hybrid_reliable_broadcast_cisa.pyv)
      • specifies: reliable broadcast
      • safety: safety [unforgebility] (exists N. !member_fs(N) & !member_fa(N) & accept(N)) -> (exists M. !member_fs(M) & !member_fa(M) & rcv_init(M)) (source)
        • plain reading (inference from declaration): a correct accepting node implies some correct node received an initiating broadcast; no spontaneous forged delivery
        • 7 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 254 lines in this file; exact source
    • leader-election (benchmarks/leader-election.ivy)
      • specifies: leader election
      • safety: conjecture ~(leader(N) & leader(M) & N ~= M) (source)
        • plain reading (inference from declaration): at most one node is elected leader
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 74 lines in this file; exact source
    • leader-election (benchmarks/leader-election.pyv)
      • specifies: leader election
      • safety: safety [leader_unique] leader(X) & leader(Y) -> X = Y (source)
        • plain reading (inference from declaration): at most one node is elected leader
        • 3 state invariant declarations: leader_max, self_pending_max, no_bypass
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 57 lines in this file; exact source
    • learning-switch-quad (benchmarks/learning-switch-quad.ivy)
      • specifies: learning network switch
      • safety: conjecture table(T,X,X) (source); conjecture table(T,X,Y) & table(T,Y,Z) -> table(T,X,Z) (source); conjecture table(T,X,Y) & table(T,Y,X) -> X = Y (source); conjecture table(T,X,Y) & table(T,X,Z) -> table(T,Y,Z) | table(T,Z,Y) (source)
        • plain reading (inference from declaration): forwarding/learning relations satisfy the stated route/tree consistency constraints
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 44 lines in this file; exact source
    • learning-switch-quad (benchmarks/learning-switch-quad.pyv)
      • specifies: learning network switch
      • safety: safety table(T,X,X) (source); safety table(T,X,Y) & table(T,Y,Z) -> table(T,X,Z) (source); safety table(T,X,Y) & table(T,Y,X) -> X = Y (source); safety table(T,X,Y) & table(T,X,Z) -> table(T,Y,Z) | table(T,Z,Y) (source)
        • plain reading (inference from declaration): forwarding/learning relations satisfy the stated route/tree consistency constraints
        • 2 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 41 lines in this file; exact source
    • learning-switch-ternary (benchmarks/learning-switch-ternary.ivy)
      • specifies: learning network switch
      • safety: conjecture ((pending(P0, SW0, SW1) | S0 = SW1 & SW0 = SW1) & (~dom(S0,SW1) & SW0 ~= SW1 & S0 ~= SW1)) -> ~tc(S0,SW0,SW1) (source)
        • plain reading (inference from declaration): forwarding/learning relations satisfy the stated route/tree consistency constraints
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 161 lines in this file; exact source
    • learning-switch-ternary (benchmarks/learning-switch-ternary.pyv)
      • specifies: learning network switch
      • safety: safety ((pending(P0, SW0, SW1) | S0 = SW1 & SW0 = SW1) & (!dom(S0,SW1) & SW0 != SW1 & S0 != SW1)) -> !tc(S0,SW0,SW1) (source)
        • plain reading (inference from declaration): forwarding/learning relations satisfy the stated route/tree consistency constraints
        • 14 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 143 lines in this file; exact source
    • lock-server-async (benchmarks/lock-server-async.ivy)
      • specifies: lock protocol
      • safety: conjecture holds_lock(N1) & holds_lock(N2) -> N1 = N2 (source)
        • plain reading (inference from declaration): two nodes cannot simultaneously own the same lock/lock epoch
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 72 lines in this file; exact source
    • lock-server-async (benchmarks/lock-server-async.pyv)
      • specifies: lock protocol
      • safety: safety [mutex] holds_lock(N1) & holds_lock(N2) -> N1 = N2 (source)
        • plain reading (inference from declaration): at most one process holds the lock/critical section
        • 8 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 58 lines in this file; exact source
    • lock-server-sync (benchmarks/lock-server-sync.ivy)
      • specifies: lock protocol
      • safety: conjecture link(C1, S) & link(C2, S) -> C1 = C2 (source)
        • plain reading (inference from declaration): a link/ownership destination cannot have conflicting sources
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 35 lines in this file; exact source
    • lock-server-sync (benchmarks/lock-server-sync.pyv)
      • specifies: lock protocol
      • safety: safety link(C1, S) & link(C2, S) -> C1 = C2 (source)
        • plain reading (inference from declaration): a link/ownership destination cannot have conflicting sources
        • 1 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 24 lines in this file; exact source
    • multi_paxos (benchmarks/multi_paxos.ivy)
      • specifies: Paxos consensus variant
      • safety: conjecture ( decision(N1,I,R1,V1) & (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 167 lines in this file; exact source
    • multi_paxos (benchmarks/multi_paxos.pyv)
      • specifies: Paxos consensus variant
      • safety: safety ( decision(N1,I,R1,V1) & (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 11 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 150 lines in this file; exact source
    • multi_paxos_missing1 (benchmarks/multi_paxos_missing1.ivy)
      • specifies: Paxos consensus variant
      • safety: conjecture ( decision(N1,I,R1,V1) & (source); conjecture proposal(I,R,V) -> active(R) (source); conjecture proposal(I,R,V1) & proposal(I,R,V2) -> V1 = V2 (source); conjecture vote(N,I,R,V) -> proposal(I,R,V) (source); conjecture forall R:round, V:value. (exists N:node. decision(N,I,R,V)) -> exists Q:quorum. forall N:node. member(N, Q) -> vote(N,I,R,V) (source); conjecture ~vote(N,I,none,V) (source); conjecture joined_round(N,R2) & ~le(R2,R1) -> left_round(N,R1) (source); conjecture one_b_msg(N,R,M) -> joined_round(N,R) (source); conjecture one_b_msg(N,R2,M) & maxr(M,I) = none & ~le(R2,R1) -> ~vote(N,I,R1,V2) (source); conjecture one_b_msg(N,R, M) & maxr(M,I) ~= none -> ~le(R,maxr(M,I)) & vote(N,I,maxr(M,I),maxv(M,I)) (source); conjecture one_b_msg(N,R, M) & ~le(R,ROTHER) & ~le(ROTHER,maxr(M,I)) -> ~vote(N,I,ROTHER,VOTHER) (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 199 lines in this file; exact source
    • paxos (benchmarks/paxos.ivy)
      • specifies: Paxos consensus variant
      • safety: conjecture ( decision(N1,R1,V1) & (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 151 lines in this file; exact source
    • paxos (benchmarks/paxos.pyv)
      • specifies: Paxos consensus variant
      • safety: safety ( decision(N1,R1,V1) & (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 10 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 117 lines in this file; exact source
    • paxos_epr_missing1 (benchmarks/paxos_epr_missing1.ivy)
      • specifies: Paxos consensus variant
      • safety: conjecture ( decision(N1,R1,V1) & (source); conjecture proposal(R,V1) & proposal(R,V2) -> V1 = V2 (source); conjecture vote(N,R,V) -> proposal(R,V) (source); conjecture forall R:round, V:value. (exists N:node. decision(N,R,V)) -> exists Q:quorum. forall N:node. member(N, Q) -> vote(N,R,V) (source); conjecture one_b_max_vote(N,R2,none,V1) & ~le(R2,R1) -> ~vote(N,R1,V2) (source); conjecture one_b_max_vote(N,R,RMAX,V) & RMAX ~= none -> ~le(R,RMAX) & vote(N,RMAX,V) (source); conjecture one_b_max_vote(N,R,RMAX,V) & RMAX ~= none & ~le(R,ROTHER) & ~le(ROTHER,RMAX) -> ~vote(N,ROTHER,VOTHER) (source); conjecture ~vote(N,none,V) (source); conjecture one_b_max_vote(N,R,RMAX,V) -> one_b(N,R) (source); conjecture one_b(N,R2) & ~le(R2,R1) -> left_rnd(N,R1) (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 169 lines in this file; exact source
    • sharded_kv (benchmarks/sharded_kv.ivy)
      • specifies: sharded key-value storage
      • safety: conjecture table(N1, K, V1) & table(N2, K, V2) -> N1 = N2 & V1 = V2 (source)
        • plain reading (inference from declaration): a stored key has a unique node and value
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 51 lines in this file; exact source
    • sharded_kv (benchmarks/sharded_kv.pyv)
      • specifies: sharded key-value storage
      • safety: safety [keys_unique] table(N1, K, V1) & table(N2, K, V2) -> N1 = N2 & V1 = V2 (source)
        • plain reading (inference from declaration): each key has one owner/value
        • 4 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 45 lines in this file; exact source
    • sharded_kv_no_lost_keys (benchmarks/sharded_kv_no_lost_keys.ivy)
      • specifies: sharded key-value storage
      • safety: conjecture (exists N,K,V. transfer_msg(N,K,V)) | (forall K. exists N. owner(N,K)) (source)
        • plain reading (inference from declaration): either a transfer message exists or every key has an owner; this is the precise modeled no-loss condition
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 48 lines in this file; exact source
    • sharded_kv_no_lost_keys (benchmarks/sharded_kv_no_lost_keys.pyv)
      • specifies: sharded key-value storage
      • safety: safety (exists N,K,V. transfer_msg(N,K,V)) | (forall K. exists N. owner(N,K)) (source)
        • plain reading (inference from declaration): either a transfer message exists or every key has an owner; this is the precise modeled no-loss condition
        • 1 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 40 lines in this file; exact source
    • simple-de-lock (benchmarks/simple-de-lock.ivy)
      • specifies: lock protocol
      • safety: conjecture X ~= Y -> ~(has_lock(X) & has_lock(Y)) (source)
        • plain reading (inference from declaration): two nodes cannot simultaneously own the same lock/lock epoch
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 38 lines in this file; exact source
    • simple-de-lock (benchmarks/simple-de-lock.pyv)
      • specifies: lock protocol
      • safety: safety X != Y -> !(has_lock(X) & has_lock(Y)) (source)
        • plain reading (inference from declaration): two nodes cannot simultaneously own the same lock/lock epoch
        • 3 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 29 lines in this file; exact source
    • stoppable_paxos (benchmarks/stoppable_paxos.ivy)
      • specifies: Paxos consensus variant
      • safety: conjecture ( decision(N1,I,R1,V1) & (source); conjecture decision(N1,I1,R1,stop) & ~inst_le(I2,I1) -> ~decision(N2,I2,R2,V) (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 206 lines in this file; exact source
    • stoppable_paxos (benchmarks/stoppable_paxos.pyv)
      • specifies: Paxos consensus variant
      • safety: safety ( decision(N1,I,R1,V1) & (source); safety decision(N1,I1,R1,stop) & !inst_le(I2,I1) -> !decision(N2,I2,R2,V) (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 14 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 208 lines in this file; exact source
    • stoppable_paxos_start_with_hard (benchmarks/stoppable_paxos_start_with_hard.ivy)
      • specifies: Paxos consensus variant
      • safety: conjecture ( decision(N1,I,R1,V1) & (source); conjecture decision(N1,I1,R1,stop) & ~inst_le(I2,I1) -> ~decision(N2,I2,R2,V) (source); conjecture forall I:inst, R1:round, R2:round, V:value, Q:quorum. ( ~le(R2,R1) & active(R2) & ~proposal(I,R2,V) -> ( (source); conjecture forall I1:inst, I2:inst, R1:round, R2:round, V:value, Q:quorum. ( ~le(R2,R1) & ~inst_le(I2,I1) & proposal(I2,R2,V) -> ( (source); conjecture forall I1:inst, I2:inst, R1:round, R2:round, V:value, Q:quorum. ( ~le(R2,R1) & ~inst_le(I2,I1) & proposal(I1,R2,stop) -> ( (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 218 lines in this file; exact source
    • ticket (benchmarks/ticket.ivy)
      • specifies: ticket lock
      • safety: conjecture pc3(T1) & pc3(T2) -> T1 = T2 (source)
        • plain reading (inference from declaration): at most one process is in the encoded critical section
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 87 lines in this file; exact source
    • ticket (benchmarks/ticket.pyv)
      • specifies: ticket lock
      • safety: safety [mutex] pc3(T1) & pc3(T2) -> T1 = T2 (source)
        • plain reading (inference from declaration): at most one process holds the lock/critical section
        • 13 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 99 lines in this file; exact source
    • toy_consensus_epr (benchmarks/toy_consensus_epr.ivy)
      • specifies: consensus/agreement protocol
      • safety: conjecture decided(V1) & decided(V2) -> V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 40 lines in this file; exact source
    • toy_consensus_epr (benchmarks/toy_consensus_epr.pyv)
      • specifies: consensus/agreement protocol
      • safety: safety decided(V1) & decided(V2) -> V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 3 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 32 lines in this file; exact source
    • toy_consensus_forall (benchmarks/toy_consensus_forall.ivy)
      • specifies: consensus/agreement protocol
      • safety: conjecture decided(V1) & decided(V2) -> V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 41 lines in this file; exact source
    • toy_consensus_forall (benchmarks/toy_consensus_forall.pyv)
      • specifies: consensus/agreement protocol
      • safety: safety decided(V1) & decided(V2) -> V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 3 state invariant declarations; all clauses in source
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 34 lines in this file; exact source
    • vertical_paxos (benchmarks/vertical_paxos.ivy)
      • specifies: Paxos consensus variant
      • safety: conjecture ( decision(N1,R1,V1) & (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 240 lines in this file; exact source
    • vertical_paxos (benchmarks/vertical_paxos.pyv)
      • specifies: Paxos consensus variant
      • safety: safety ( decision(N1,R1,V1) & (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 205 lines in this file; exact source
    • vertical_paxos_start_with_hard (benchmarks/vertical_paxos_start_with_hard.ivy)
      • specifies: Paxos consensus variant
      • safety: conjecture ( decision(N1,R1,V1) & (source); conjecture forall R1:round, R2:round, V1:value, V2:value, Q:quorum, C:config. (source); conjecture complete_msg(RR) & ~le(RR,R) & configure_round_msg(R,C) & quorumin(Q,C) & (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof
      • measured size: 232 lines in this file; exact source

  • Veil / Lean: distributed and concurrent examples

    • AWSBuggy (Examples/AWS/AWSBuggy.lean)
      • specifies: AWS DNS race
      • safety: safety [DnsConsistent] dns_valid = true (source)
        • plain reading (inference from declaration): DNS state remains valid
      • liveness: no active temporal/progress declaration found in this file
      • negative-test warning: the filename marks this as a bad/buggy/unsafe/error variant; displayed properties are attempted checks, not established guarantees
      • tool/evidence: Veil / Lean; finite model-checking command present; #model_check { Enactor := Fin 2 } { max_plan := 3, plan_age_threshold := 2 } (source)
      • measured size: 139 lines in this file; exact source
    • AWSFixed (Examples/AWS/AWSFixed.lean)
      • specifies: AWS DNS race
      • safety: safety [DnsConsistent] dns_valid = true (source)
        • plain reading (inference from declaration): DNS state remains valid
        • 5 state invariant declarations: PlanFacts, QueuedPlansAreGenerated, EnactorShape, ProcessingPlansAreGenerated, CleanupBounds
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Veil / Lean; SMT-backed induction checking command present; #check_invariants (source)
      • measured size: 168 lines in this file; exact source
    • Blockchain (Examples/Ivy/Blockchain.lean)
      • specifies: blockchain protocol
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Veil / Lean; SMT-backed induction checking command present; #check_invariants (source)
      • measured size: 111 lines in this file; exact source
    • ChordRingMaintenance (Examples/Ivy/ChordRingMaintenance.lean)
      • specifies: ring protocol
      • safety: safety [no_error] ¬ error N (source)
        • plain reading (inference from declaration): the model never enters its error state
        • 17 state invariant declarations: manual_1, manual_2, manual_3, manual_4, manual_5, manual_6, manual_7, manual_8, manual_9, manual_10, manual_11, manual_12, manual_13, manual_14, manual_15, manual_16, manual_17
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Veil / Lean; SMT-backed induction checking command present; #check_invariants (source)
      • measured size: 169 lines in this file; exact source
    • DecentralizedLock (Examples/Ivy/DecentralizedLock.lean)
      • specifies: lock protocol
      • safety: safety [mutex] ¬ (has_lock X ∧ has_lock Y ∧ X ≠ Y) (source)
        • plain reading (inference from declaration): at most one process holds the lock/critical section
        • 3 state invariant declarations: manual_1, manual_2, manual_3
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Veil / Lean; SMT-backed induction checking command present; #check_invariants (source)
      • measured size: 63 lines in this file; exact source
    • MultiSigAll (Examples/Ivy/MultiSigAll.lean)
      • specifies: multisignature contract
      • safety: safety [cancelled_after_deadline] cancelled N K V D → expired D (source); safety [paid_if_enough_sigs] paid N K V D → (∀ s, sig N K V D s ∧ sig_auth s) (source); safety [paid_imp_proposed] paid N K V D → proposed N K V D (source)
        • plain reading (inference from declaration): cancellation follows expiry; payment requires sufficient signatures
        • 2 state invariant declarations: ic3po_global2, ic3po_global3
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Veil / Lean; SMT-backed induction checking command present; #check_invariants (source)
      • measured size: 90 lines in this file; exact source
    • MultiSigMajority (Examples/Ivy/MultiSigMajority.lean)
      • specifies: multisignature contract
      • safety: safety [cancelled_after_deadline] cancelled N K V D → expired D (source); safety [paid_if_enough_sigs] paid N K V D → (∃ q, ∀ s, (member s q) → (sig N K V D s ∧ sig_auth s)) (source); safety [paid_imp_proposed] paid N K V D → proposed N K V D (source)
        • plain reading (inference from declaration): cancellation follows expiry; payment requires sufficient signatures
        • 2 state invariant declarations: ic3po_global2, ic3po_global3
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Veil / Lean; SMT-backed induction checking command present; #check_invariants (source)
      • measured size: 99 lines in this file; exact source
    • NOPaxos (Examples/Ivy/NOPaxos.lean)
      • specifies: Paxos consensus variant
      • safety: safety [consistency] gh_committed S V1 ∧ gh_committed S V2 → V1 = V2 (source)
        • plain reading (inference from declaration): committed log values agree for a given log index
        • 21 state invariant declarations: ll_coherence, log_coherence, smn_coherence, cgs_coherence, status_coherence, leader_status_either, only_leader_can_gap_status, m_gap_commit_rep_to_leader_only, client_no_op, log_valid_1, valid_sess_msg_num, log_smn, gh_committed_cause, leader_never_rolls_back, leader_reply_matches_log, lead_gap_commits, log_smn_gap, log_smn_gap_normal, r_gap_commit_reps_source, m_gap_commit_rep_len, m_gap_commit_slot
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Veil / Lean; SMT-backed induction checking command present; #check_invariants (source)
      • measured size: 271 lines in this file; exact source
    • PaxosEPR (Examples/Ivy/PaxosEPR.lean)
      • specifies: Paxos consensus variant
      • safety: safety [coherence] decision N1 R1 V1 ∧ decision N2 R2 V2 → V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 5 state invariant declarations: unique_proposals, vote_proposed, none_prop, choosable_proposal, oneb_leftrnd
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Veil / Lean; SMT-backed induction checking command present; #check_invariants (source)
      • measured size: 125 lines in this file; exact source
    • PaxosFirstOrder (Examples/Ivy/PaxosFirstOrder.lean)
      • specifies: Paxos consensus variant
      • safety: safety [coherence] decision N1 R1 V1 ∧ decision N2 R2 V2 → V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 8 state invariant declarations: unique_proposals, vote_proposal, decision_from_quorum, one_b_max_vote_properties1, one_b_max_vote_properties2, one_b_max_vote_properties3, none_vote, choosable_proposal
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Veil / Lean; SMT-backed induction checking command present; #check_invariants (source)
      • measured size: 132 lines in this file; exact source
    • ReliableBroadcast (Examples/Ivy/ReliableBroadcast.lean)
      • specifies: reliable broadcast
      • safety: safety [vote_integrity] ∀ (src dst : address) (r : round) (v : value), (source); safety [deliver_integrity] ∀ (src dst : address) (r : round) (v : value), (source); safety [agreement] ∀ (src dst₁ dst₂ : address) (r : round) (v₁ v₂ : value), (source)
        • plain reading (inference from declaration): decisions agree
        • 10 state invariant declarations: sent_iff_initial, echoed_iff_echo, echoed_requires_initial, voted_iff_vote, voted_requires_echo_quorum_or_vote_quorum, delivered_requires_vote_quorum, initial_value_iff_initial_msg, honest_non_conflicting_initial_msg, honest_non_conflicting_echoes, honest_non_conflicting_votes
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Veil / Lean; SMT-backed induction checking command present; #check_invariants (source)
      • measured size: 212 lines in this file; exact source
    • RicartAgrawala (Examples/Ivy/RicartAgrawala.lean)
      • specifies: Ricart–Agrawala mutual exclusion
      • safety: safety [mutual_exclusion] (holds N1 ∧ holds N2) → N1 = N2 (source)
        • plain reading (inference from declaration): at most one process occupies the critical section
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Veil / Lean; SMT-backed induction checking command present; #check_invariants (source)
      • measured size: 61 lines in this file; exact source
    • Ring (Examples/Ivy/Ring.lean)
      • specifies: ring protocol
      • safety: safety [single_leader] leader N ∧ leader M → N = M (source)
        • plain reading (inference from declaration): at most one leader
        • 3 state invariant declarations: leader_greatest, self_msg_greatest, drop_smaller
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Veil / Lean; SMT-backed induction checking command present; #check_invariants (source)
      • measured size: 64 lines in this file; exact source
    • SuzukiKasami (Examples/Ivy/SuzukiKasami.lean)
      • specifies: Suzuki–Kasami mutual exclusion
      • safety: invariant [mutex] (crit N ∧ crit M) → N = M (source)
        • plain reading (inference from declaration): at most one process holds the lock/critical section
        • 10 state invariant declarations: mutex, single_privilege, allowed_in_crit, unique_tokens, corresponding_tokens, current_privilege_latest_token_1, current_privilege_latest_token_2, no_request_to_self, no_consecutive_privilege, token_relation
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Veil / Lean; SMT-backed induction checking command present; #check_invariants (source)
      • measured size: 130 lines in this file; exact source
    • TwoPhaseCommit (Examples/Ivy/TwoPhaseCommit.lean)
      • specifies: two-phase atomic commit
      • safety: invariant [manual_1] ¬((¬(alive N) ∧ ¬(abort_flag))) (source)
        • plain reading (inference from declaration): commit and abort decisions do not conflict, and commit requires the stated yes votes
        • 8 state invariant declarations: manual_1, manual_2, manual_3, manual_4, manual_5, manual_6, manual_7, manual_8
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Veil / Lean; SMT-backed induction checking command present; #check_invariants (source)
      • measured size: 103 lines in this file; exact source
    • VerticalPaxosFirstOrder (Examples/Ivy/VerticalPaxosFirstOrder.lean)
      • specifies: Paxos consensus variant
      • safety: safety [coherence] decision N1 R1 V1 ∧ decision N2 R2 V2 → V1 = V2 (source)
        • plain reading (inference from declaration): any two decisions choose the same value; indexed variants impose this per instance
        • 18 state invariant declarations: proposal_unique, unique_config, property1_one_a, property2_one_a, only_vote_proposed, propose_if_lower_configured, master_complete_zero_or_holds, complete_prev_configured, decisions_from_quorums, choosable_proposal, configure_round_msg_bounds, complete_choosable_decision, none_property1, none_property2, none_property3, join_ack_msg_property1, join_ack_msg_property2, join_ack_msg_property3
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Veil / Lean; SMT-backed induction checking command present; #check_invariants (source)
        • explicit Lean proof declaration: theorem propose_choosable_proposal (ρ : Type) (σ : Type) (node : Type) [node_dec_eq : DecidableEq.{1} node] [node_inhabited : Inhabited.{1} node] (value : Type) [value_dec_eq : DecidableEq.{1} value] (source); helper/transition theorem, not independently confirmed as a complete protocol proof
      • measured size: 457 lines in this file; exact source
    • CheckpointLeaseFailover (Examples/Simulate/CheckpointLeaseFailover.lean)
      • specifies: lease renewal/failover
      • safety: safety [checkpointed_expiry_respected] ∀ (l : lease) (expiry now : epoch), (source)
        • plain reading (inference from declaration): failover respects checkpointed expiry
        • 1 state invariant declarations: one_current_epoch
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Veil / Lean; specification/simulation only; no active invariant or model-check command found
      • measured size: 95 lines in this file; exact source
    • LeaseKeepaliveRace (Examples/Simulate/LeaseKeepaliveRace.lean)
      • specifies: lease renewal/failover
      • safety: safety [renewal_keeps_keys_live] ∀ (c : client) (k : key), keepalive_succeeded c ∧ key_attached c k -> key_present k (source)
        • plain reading (inference from declaration): lease renewal preserves keys
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Veil / Lean; specification/simulation only; no active invariant or model-check command found
      • measured size: 87 lines in this file; exact source
    • ReliableBroadcast (Examples/Simulate/ReliableBroadcast.lean)
      • specifies: reliable broadcast
      • safety: safety [agreement] ∀ (n1 n2 : node) (v1 v2 : value), delivered n1 v1 ∧ delivered n2 v2 -> v1 = v2 (source)
        • plain reading (inference from declaration): decisions agree
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Veil / Lean; specification/simulation only; no active invariant or model-check command found
      • measured size: 75 lines in this file; exact source
    • SCP (Examples/StellarConsensus/SCP.lean)
      • specifies: consensus/agreement protocol
      • safety: safety [intertwined_safe] ∀ (n1 n2 : node) (b1 b2 : ballot) (v1 v2 : value), (source)
        • plain reading (inference from declaration): committed log values agree for a given log index
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Veil / Lean; SMT-backed induction checking command present; #time #check_invariants (source)
        • explicit Lean proof declaration: theorem receive_accept_commit_intertwined_safe (ρ : Type) (σ : Type) (value : Type) (source); helper/transition theorem, not independently confirmed as a complete protocol proof
      • measured size: 348 lines in this file; exact source
    • FasterFloodSet (Examples/Synchronous/FasterFloodSet.lean)
      • specifies: synchronous FloodSet consensus
      • safety: safety [agreement] ∀ n1 n2 v1 v2, decision n1 v1 ∧ decision n2 v2 → v1 = v2 (source); safety [validity] ∀ n v, decision n v → (∃ m, initialValue m == v) (source); safety [all_nodes] ∀ n, nset.contains n allnodes (source)
        • plain reading (inference from declaration): decisions agree; decisions satisfy the stated validity condition
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Veil / Lean; finite model-checking command present; #model_check (source)
        • active sorry found; this file cannot be called a complete proof from source inspection
      • measured size: 252 lines in this file; exact source
    • FloodSet (Examples/Synchronous/FloodSet.lean)
      • specifies: synchronous FloodSet consensus
      • safety: safety [agreement] ∀ n1 n2 v1 v2, decision n1 v1 ∧ decision n2 v2 → v1 = v2 (source); safety [validity] ∀ n v, decision n v → (∃ m, initialValue m == v) (source)
        • plain reading (inference from declaration): decisions agree; decisions satisfy the stated validity condition
        • 10 state invariant declarations: seen_decision, crashed_not_alive, seen_is_initial, decided_implies_alive, crash_bound, decision_only_at_end, decision_is_minimum, same_seen_if_synced, crashed_same_seen, crashed_same_when_count_eq_round
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Veil / Lean; SMT-backed induction checking command present; #check_invariants (source)
      • measured size: 247 lines in this file; exact source
    • AWSDnsRace (Examples/TLA/AWSDnsRace.lean)
      • specifies: AWS DNS race
      • safety: invariant [NeverDeleteActive] current_plan > 0 → ¬(plan_deleted current_plan true) (source)
        • plain reading (inference from declaration): the named state invariants restrict legal reachable states; the excerpt is not sufficient to give a more specific guarantee without reading the complete formula
        • 2 state invariant declarations: NeverDeleteActive, uniqueDelete
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Veil / Lean; finite model-checking command present; #model_check {}{ max_plan := 3, plan_age_threshold := 2 } (source)
      • measured size: 98 lines in this file; exact source
    • Bakery (Examples/TLA/Bakery.lean)
      • specifies: Bakery mutual exclusion
      • safety: safety [mutual_exclusion] pc I = cs ∧ pc J = cs → I = J (source)
        • plain reading (inference from declaration): at most one process occupies the critical section
        • 7 state invariant declarations: p1_non_zero_num, p2_flag_e2_e3, p3_nxt_not_self, p4_unchecked_not_self, p5_critical_section, p6_nxt_e2_e3, p7_cs_precedes_all
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Veil / Lean; specification/simulation only; no active invariant or model-check command found
      • measured size: 318 lines in this file; exact source
    • BcastByz (Examples/TLA/BcastByz.lean)
      • specifies: Byzantine broadcast
      • safety: invariant [Corr_cup_faulty_eq_proc] pset.union Corr Faulty == Proc (source)
        • plain reading (inference from declaration): the named state invariants restrict legal reachable states; the excerpt is not sufficient to give a more specific guarantee without reading the complete formula
        • 4 state invariant declarations: Corr_cup_faulty_eq_proc, card_corr, typeOK, card_faulty
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Veil / Lean; finite model-checking command present; #model_check (source)
      • measured size: 227 lines in this file; exact source
    • BuggyCircularBuffer (Examples/TLA/BuggyCircularBuffer.lean)
      • specifies: circular buffer concurrency
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • negative-test warning: the filename marks this as a bad/buggy/unsafe/error variant; displayed properties are attempted checks, not established guarantees
      • tool/evidence: Veil / Lean; finite model-checking command present; #model_check { } { } (source)
      • measured size: 65 lines in this file; exact source
    • EPaxos (Examples/TLA/EPaxos.lean)
      • specifies: Paxos consensus variant
      • safety: invariant [Consistency] ∀ i : Instance replica seqNum, commitSet.count (committedMap i) <= 1 (source)
        • plain reading (inference from declaration): the named state invariants restrict legal reachable states; the excerpt is not sufficient to give a more specific guarantee without reading the complete formula
        • 2 state invariant declarations: Consistency, Nontriviality
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Veil / Lean; specification/simulation only; no active invariant or model-check command found
      • measured size: 1421 lines in this file; exact source
    • EWD840 (Examples/TLA/EWD840.lean)
      • specifies: distributed termination detection
      • safety: invariant [TerminationDetection] (terminationDetected → terminated) (source)
        • plain reading (inference from declaration): a detection signal is raised only when every node is inactive
        • 2 state invariant declarations: TerminationDetection, Inv
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Veil / Lean; finite model-checking command present; #model_check (source)
      • measured size: 135 lines in this file; exact source
    • KVSnap (Examples/TLA/KVSnap.lean)
      • specifies: key-value snapshot protocol
      • safety: invariant [serializability] TransactionsPool.length > 0 → (source)
        • plain reading (inference from declaration): transactions admit a serial ordering
        • 1 state invariant declarations: serializability
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Veil / Lean; specification/simulation only; no active invariant or model-check command found
      • measured size: 327 lines in this file; exact source
    • KVSnapRe (Examples/TLA/KVSnapRe.lean)
      • specifies: key-value snapshot protocol
      • safety: invariant [serializability] TransactionsPool.length > 0 → (source)
        • plain reading (inference from declaration): transactions admit a serial ordering
        • 1 state invariant declarations: serializability
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Veil / Lean; specification/simulation only; no active invariant or model-check command found
      • measured size: 333 lines in this file; exact source
    • KeyValueStore (Examples/TLA/KeyValueStore.lean)
      • specifies: key-value store
      • safety: invariant [unique_store] store K M ∧ store K N → M = N (source)
        • plain reading (inference from declaration): the named state invariants restrict legal reachable states; the excerpt is not sufficient to give a more specific guarantee without reading the complete formula
        • 3 state invariant declarations: unique_store, unique_snapshotStore, Txlifecycle
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Veil / Lean; finite model-checking command present; #model_check {key := key_IndT, value := value_IndT, txId := txId_IndT } {} (source)
      • measured size: 153 lines in this file; exact source
    • MultiPaxos (Examples/TLA/MultiPaxos.lean)
      • specifies: Paxos consensus variant
      • safety: invariant [consistency] ∀ (v1 v2 : value) (s : slot), (source)
        • plain reading (inference from declaration): the named state invariants restrict legal reachable states; the excerpt is not sufficient to give a more specific guarantee without reading the complete formula
        • 1 state invariant declarations: consistency
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Veil / Lean; specification/simulation only; no active invariant or model-check command found
      • measured size: 436 lines in this file; exact source
    • MutexViolation (Examples/TLA/MutexViolation.lean)
      • specifies: mutual exclusion
      • safety: invariant [mutual_exclusion] ∀ I J, I ≠ J → ¬ (pc I cs ∧ pc J cs) (source)
        • plain reading (inference from declaration): at most one process occupies the critical section
        • 1 state invariant declarations: mutual_exclusion
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Veil / Lean; specification/simulation only; no active invariant or model-check command found
      • measured size: 354 lines in this file; exact source
    • NOPaxos (Examples/TLA/NOPaxos.lean)
      • specifies: Paxos consensus variant
      • safety: invariant [linearizability] let mReqReps := mSet.filter messages (fun m => m.mtype == .MRequestReply) (source)
        • plain reading (inference from declaration): the named state invariants restrict legal reachable states; the excerpt is not sufficient to give a more specific guarantee without reading the complete formula
        • 2 state invariant declarations: linearizability, sync_safety
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Veil / Lean; specification/simulation only; no active invariant or model-check command found
      • measured size: 1566 lines in this file; exact source
    • Paxos (Examples/TLA/Paxos.lean)
      • specifies: Paxos consensus variant
      • safety: invariant [Consistency] ∀ v1 v2, Chosen v1 ∧ Chosen v2 → v1 = v2 (source)
        • plain reading (inference from declaration): the named state invariants restrict legal reachable states; the excerpt is not sufficient to give a more specific guarantee without reading the complete formula
        • 1 state invariant declarations: Consistency
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Veil / Lean; specification/simulation only; no active invariant or model-check command found
      • measured size: 401 lines in this file; exact source
    • Peterson (Examples/TLA/Peterson.lean)
      • specifies: Peterson mutual exclusion
      • safety: safety [mutual_exclusion] ∀ i j, i ≠ j → ¬(lockcs i ∧ lockcs j) (source)
        • plain reading (inference from declaration): at most one process occupies the critical section
        • 4 state invariant declarations: pc_total, unique_phase, flag_consistency, progress_critical
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Veil / Lean; finite model-checking command present; #model_check{ }{ } (source)
      • measured size: 129 lines in this file; exact source
    • Raft (Examples/TLA/Raft.lean)
      • specifies: Raft replicated log
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Veil / Lean; specification/simulation only; no active invariant or model-check command found
      • measured size: 1113 lines in this file; exact source
    • Room (Examples/TLA/Room.lean)
      • specifies: room/guest allocation
      • safety: safety [registered_at_most_one] ∀ r g1 g2, guestTset.contains g1 (registered r) ∧ guestTset.contains g2 (registered r) → g1 = g2 (source); safety [guest_in_room_valid] ∀ g, assignedKey g = room → (source); safety [room_occupied_valid] ∀ r, inside r = body → (source)
        • plain reading (inference from declaration): one guest is registered per room, and guest/occupied-room records meet the stated consistency conditions
        • 1 state invariant declarations: key_num
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Veil / Lean; finite model-checking command present; #model_check (source)
      • measured size: 161 lines in this file; exact source
    • SimpleAllocator (Examples/TLA/SimpleAllocator.lean)
      • specifies: resource allocation
      • safety: invariant [resource_mutex] ∀ c1 c2 : client, c1 ≠ c2 → (resSet.intersection (alloc c1) (alloc c2) = resSet.empty) (source)
        • plain reading (inference from declaration): at most one process holds the lock/critical section
        • 1 state invariant declarations: resource_mutex
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Veil / Lean; finite model-checking command present; #model_check (source)
      • measured size: 95 lines in this file; exact source
    • Traffic (Examples/TLA/Traffic.lean)
      • specifies: traffic-light controller
      • safety: safety [puzzle_unsolvable] at_light = true (source)
        • plain reading (inference from declaration): the modeled controller remains at the light; this is a deliberately stated puzzle/test target
        • 1 state invariant declarations: pc_unique
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Veil / Lean; finite model-checking command present; #model_check { ProcSet := ProcSet_IndT, Color := Color_IndT, states := states_IndT } {} (source)
      • measured size: 79 lines in this file; exact source
    • TwoPhaseCommit (Examples/TLA/TwoPhaseCommit.lean)
      • specifies: two-phase atomic commit
      • safety: invariant [TCConsistency] ¬ (∃ rm1 rm2 : RM, (source)
        • plain reading (inference from declaration): the named state invariants restrict legal reachable states; the excerpt is not sufficient to give a more specific guarantee without reading the complete formula
        • 1 state invariant declarations: TCConsistency
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Veil / Lean; finite model-checking command present; #model_check { RM := Fin 3 } (source)
      • measured size: 224 lines in this file; exact source
    • FloodSet (Examples/Tutorial/FloodSet.lean)
      • specifies: synchronous FloodSet consensus
      • safety: safety [agreement] ∀ n₁ n₂ v₁ v₂, decision n₁ v₁ ∧ decision n₂ v₂ → v₁ = v₂ (source); safety [strong_validity] ∀ n v, decision n v → ((∃ m, initialValue m = v)) (source)
        • plain reading (inference from declaration): decisions agree; decisions satisfy the stated validity condition
        • 13 state invariant declarations: every_seen_is_someones_initial, decision_minimum_seen, crash_limit, no_crashes_def, decision_crashed_after_end, decision_only_at_end, crashed_in_round_le_round, initial_value_in_W, decided_in_seen, crashedInRound_default, crash_round_gap, crash_round_gap_or_current, participants_have_equal_W_after_crash_free
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Veil / Lean; SMT-backed induction checking command present; #check_invariants (source)
        • explicit Lean proof declaration: theorem nodeDecide_agreement (ρ : Type) (σ : Type) (node : Type) [node_dec_eq : DecidableEq.{1} node] [node_inhabited : Inhabited.{1} node] (value : Type) [value_dec_eq : DecidableEq.{1} value] (source); helper/transition theorem, not independently confirmed as a complete protocol proof
      • measured size: 483 lines in this file; exact source
    • RingDec (Examples/Tutorial/POPL26/RingDec.lean)
      • specifies: ring protocol
      • safety: safety [single_leader] leader N ∧ leader M → N = M (source)
        • plain reading (inference from declaration): at most one leader
        • 3 state invariant declarations: leader_greatest, self_msg_greatest, drop_smaller
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Veil / Lean; SMT-backed induction checking command present; #check_invariants (source)
      • measured size: 63 lines in this file; exact source
    • RingFin (Examples/Tutorial/POPL26/RingFin.lean)
      • specifies: ring protocol
      • safety: safety [single_leader] leader.length ≤ 1 (source)
        • plain reading (inference from declaration): at most one leader
        • 1 state invariant declarations: messages_nodup
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Veil / Lean; finite model-checking command present; #model_check { node := Fin 4 } { nextNode := fun n => n + 1 } (source)
      • measured size: 60 lines in this file; exact source
    • RingNat (Examples/Tutorial/POPL26/RingNat.lean)
      • specifies: ring protocol
      • safety: safety [single_leader] leader.length ≤ 1 (source)
        • plain reading (inference from declaration): at most one leader
        • 1 state invariant declarations: messages_nodup
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Veil / Lean; finite model-checking command present; #model_check { } (source)
      • measured size: 67 lines in this file; exact source
    • Ring (Examples/Tutorial/Ring.lean)
      • specifies: ring protocol
      • safety: safety [single_leader] leader L1 ∧ leader L2 → L1 = L2 (source)
        • plain reading (inference from declaration): at most one leader
        • 4 state invariant declarations: leader_greatest, receive_self_msg_only_if_greatest, no_bypass, leader_greatest
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Veil / Lean; SMT-backed induction checking command present; #check_invariants (source)
      • measured size: 386 lines in this file; exact source

  • Quint: distributed examples and Cosmos protocols

    • bakery (examples/classic/distributed/Bakery/bakery.qnt)
      • specifies: Bakery mutual exclusion
      • safety: def TypeOK = and { val state_space = (source); def correctness = processes.filter(x => op.get(x) == Critical).size() <= 1 (source); def IndInv = and { TypeOK, (source)
        • plain reading (inference from declaration): critical-section entries satisfy the model’s mutual-exclusion condition
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file
      • measured size: 392 lines in this file; exact source
    • clockSync6 (examples/classic/distributed/ClockSync/clockSync6.qnt)
      • specifies: clock synchronization
      • safety: val skew_inv: bool = { val all_sync = states.values().forall(s => s.control_state == Sync) (source)
        • plain reading (inference from declaration): the named state invariants restrict legal reachable states; the excerpt is not sufficient to give a more specific guarantee without reading the complete formula
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file
      • measured size: 192 lines in this file; exact source
    • ConsensusAlg (examples/classic/distributed/ConsensusAlgorithm/ConsensusAlg.qnt)
      • specifies: consensus/agreement protocol
      • safety: val agreement = Procs.exclude(crashed).forall(process1 => { Procs.exclude(crashed).forall(process2 => { (source); val validity = { val allProposalValues = Procs.map(process => procState.get(process).proposalValue) (source)
        • plain reading (inference from declaration): decisions agree; decisions satisfy the stated validity condition
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file
      • measured size: 317 lines in this file; exact source
    • KSetAgreementConsensus (examples/classic/distributed/ConsensusAlgorithm/KSetAgreementConsensus.qnt)
      • specifies: consensus/agreement protocol
      • safety: val kSetAgreement = { val decidedValues = Procs.exclude(crashed).map(p => procState.get(p).decision).filter(v => v != None) (source)
        • plain reading (inference from declaration): decisions agree
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file
      • measured size: 137 lines in this file; exact source
    • DiningPhilosophers5 (examples/classic/distributed/DiningPhilosophers/DiningPhilosophers5.qnt)
      • specifies: dining philosophers
      • safety: val Safety = and { philosophers.forall(p => (source)
        • plain reading (inference from declaration): neighbors cannot eat simultaneously under the encoded fork constraints
      • liveness: temporal DeadlockProperty = eventually(DeadlockCondition) (source); temporal DeadlockFreedom = weakFair(step, vars) implies always(eventually(not(DeadlockCondition))) (source); temporal LivelockFreedom = weakFair(step, vars) implies philosophers.forall(p => not(always(states.get(p) == Hungry))) (source)
        • plain reading (inference from formula): the targets distinguish eventually finding a deadlock from deadlock/livelock freedom under weak fairness; DeadlockProperty is a bug-search target, not a freedom guarantee
      • tool/evidence: Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file
      • measured size: 151 lines in this file; exact source
    • LamportMutex (examples/classic/distributed/LamportMutex/LamportMutex.qnt)
      • specifies: mutual exclusion
      • safety: val Mutex = crit.forall(p => crit.forall(q => p == q)) (source)
        • plain reading (inference from declaration): at most one process holds the lock/critical section
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file
      • measured size: 183 lines in this file; exact source
    • Paxos (examples/classic/distributed/Paxos/Paxos.qnt)
      • specifies: Paxos consensus variant
      • safety: val TypeOK = and { maxBal.in(Acceptor.setOfMaps(Ballot.union(Set(-1)))), (source); val Inv = and { TypeOK, (source)
        • plain reading (inference from declaration): the named state invariants restrict legal reachable states; the excerpt is not sufficient to give a more specific guarantee without reading the complete formula
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file
      • measured size: 300 lines in this file; exact source
    • Voting (examples/classic/distributed/Paxos/Voting.qnt)
      • specifies: Paxos consensus variant
      • safety: val TypeOK = and { votes.in(Acceptor.setOfMaps(powerset(tuples(Ballot, Value)))), (source); val VotesSafe = tuples(Acceptor, Ballot, Value).forall( ((a, b, v)) => (source); val OneVote = tuples(Acceptor, Ballot, Value, Value).forall( ((a, b, v, w)) => (source); val OneValuePerBallot = tuples(Acceptor, Acceptor, Ballot, Value, Value) (source); val ShowsSafety = all { TypeOK, VotesSafe, OneValuePerBallot } implies (source); val Inv = TypeOK and VotesSafe and OneValuePerBallot (source)
        • plain reading (inference from declaration): votes choose a value safe for that ballot; each acceptor votes for one value per ballot, and votes across acceptors agree within a ballot
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file
      • measured size: 245 lines in this file; exact source
    • ReadersWriters (examples/classic/distributed/ReadersWriters/ReadersWriters.qnt)
      • specifies: readers/writers synchronization
      • safety: val TypeOK = and { readers.subseteq(Actors), (source); val Safety = and { not(readers != Set() and writers != Set()), (source)
        • plain reading (inference from declaration): readers and writers do not overlap, and there is at most one writer
      • liveness: temporal Liveness = and { Actors.forall(actor => always(eventually(actor.in(readers)))), (source)
        • plain reading (inference from formula): every actor repeatedly gets to read and write, and repeatedly stops reading and writing; this is a target temporal formula, with scheduling assumptions stated separately
      • scheduling/specification premises, not standalone guarantees: temporal Fairness = and { Actors.forall(actor => TryRead(actor).weakFair(vars)), (source); temporal Spec = Init and always(Next.orKeep(vars) and Fairness) (source)
      • tool/evidence: Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file
      • measured size: 153 lines in this file; exact source
    • reliablebc (examples/classic/distributed/ReliableBroadcast/reliablebc.qnt)
      • specifies: reliable broadcast
      • safety: def safety = Proc.forall(p => (source); def invariant = safety and reliability (source); def TypeOK = and { network.in(msg_universe), (source); def IndInv = and { TypeOK, (source)
        • plain reading (inference from declaration): delivered values were previously broadcast; the reliability state invariant requires forwarding before delivery, while eventual delivery needs an additional reliable-network premise
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file
      • measured size: 197 lines in this file; exact source
    • mutex (examples/classic/distributed/TeachingConcurrency/mutex.qnt)
      • specifies: mutual exclusion
      • safety: val typeOK = and { counter.in(Int), (source); val inv = and { typeOK, (source); val correctness = processes.forall(p => local_memory.get(p).stage == Done) (source)
        • plain reading (inference from declaration): critical-section entries satisfy the model’s mutual-exclusion condition
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file
      • measured size: 92 lines in this file; exact source
    • teaching (examples/classic/distributed/TeachingConcurrency/teaching.qnt)
      • specifies: garbage collector concurrency
      • safety: val correctness = processes.forall(i => state.get(i).pc == End) (source); def TypeOK = val local_states = tuples(Set(0, 1), domain, Set(Start, Middle, End)).map(((x, y, pc)) => { x: x, y: y, pc: pc }) (source); def IndInv = and { TypeOK, (source)
        • plain reading (inference from declaration): critical-section entries satisfy the model’s mutual-exclusion condition
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file
      • measured size: 82 lines in this file; exact source
    • two_layered_cache (examples/classic/distributed/TwoLayeredCache/two_layered_cache.qnt)
      • specifies: cache/memory coherence
      • safety: val readAfterWrite: bool = { val idx = history.indices() (source); val writeAfterWrite: bool = { val idx = history.indices() (source)
        • plain reading (inference from declaration): reads reflect the stated write order; writes respect the stated order
      • liveness: temporal agreement: bool = eventually({ val a = l1.get(DefaultKey) (source)
        • plain reading (inference from formula): the two cache layers eventually agree under the formula’s premises
      • tool/evidence: Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file
      • measured size: 255 lines in this file; exact source
    • two_phase_commit (examples/classic/distributed/TwoPhaseCommit/two_phase_commit.qnt)
      • specifies: two-phase atomic commit
      • safety: val consistencyInv = tuples(resourceManagers, resourceManagers).forall(((r1, r2)) => (source)
        • plain reading (inference from declaration): the named state invariants restrict legal reachable states; the excerpt is not sufficient to give a more specific guarantee without reading the complete formula
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file
      • measured size: 157 lines in this file; exact source
    • two_phase_commit_modules (examples/classic/distributed/TwoPhaseCommit/two_phase_commit_modules.qnt)
      • specifies: two-phase atomic commit
      • safety: def consistencyInv(resourceManagers) = tuples(resourceManagers, resourceManagers) (source); val inv = RM::consistencyInv(resourceManagers) (source)
        • plain reading (inference from declaration): the named state invariants restrict legal reachable states; the excerpt is not sufficient to give a more specific guarantee without reading the complete formula
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file
      • measured size: 207 lines in this file; exact source
    • ewd426 (examples/classic/distributed/ewd426/ewd426.qnt)
      • specifies: self-stabilizing mutual exclusion
      • safety: def tokenInv = count_tokens(system) > 0 (source); temporal closure = always(count_tokens(system) == 1 implies always(count_tokens(system) == 1)) (source)
        • plain reading (inference from declaration): the ring has at least one token
      • liveness: temporal convergence = step.weakFair(Set(system)) implies eventually(count_tokens(system) == 1) (source); temporal persistence = step.weakFair(Set(system)) implies eventually(always(count_tokens(system) == 1)) (source)
        • plain reading (inference from formula): under weak fairness, the ring eventually reaches and stays in a state with exactly one token
      • tool/evidence: Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file
      • measured size: 84 lines in this file; exact source
    • ewd426_3 (examples/classic/distributed/ewd426/ewd426_3.qnt)
      • specifies: self-stabilizing mutual exclusion
      • safety: def tokenInv = count_tokens(system) > 0 (source); temporal closure = always(count_tokens(system) == 1 implies always(count_tokens(system) == 1)) (source)
        • plain reading (inference from declaration): the ring has at least one token
      • liveness: temporal convergence = step.weakFair(Set(system)) implies eventually(count_tokens(system) == 1) (source); temporal persistence = step.weakFair(Set(system)) implies eventually(always(count_tokens(system) == 1)) (source)
        • plain reading (inference from formula): under weak fairness, the ring eventually reaches and stays in a state with exactly one token
      • tool/evidence: Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file
      • measured size: 101 lines in this file; exact source
    • ewd426_4 (examples/classic/distributed/ewd426/ewd426_4.qnt)
      • specifies: self-stabilizing mutual exclusion
      • safety: def tokenInv = count_tokens(system) > 0 (source); temporal closure = always(count_tokens(system) == 1 implies always(count_tokens(system) == 1)) (source)
        • plain reading (inference from declaration): the ring has at least one token
      • liveness: temporal convergence = step.weakFair(Set(system)) implies eventually(count_tokens(system) == 1) (source); temporal persistence = step.weakFair(Set(system)) implies eventually(always(count_tokens(system) == 1)) (source)
        • plain reading (inference from formula): under weak fairness, the ring eventually reaches and stays in a state with exactly one token
      • tool/evidence: Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file
      • measured size: 108 lines in this file; exact source
    • ewd840 (examples/classic/distributed/ewd840/ewd840.qnt)
      • specifies: distributed termination detection
      • safety: val TypeOK = and { active.in(setOfMaps(Nodes, Bool)), // status of nodes (active or passive) (source); val TerminationDetection = terminationDetected implies Nodes.forall(i => not(active.get(i))) (source); val Inv = or { Nodes.forall(i => tpos < i implies not(active.get(i))), (source); val IndInv = TypeOK and Inv (source)
        • plain reading (inference from declaration): a detection signal is raised only when every node is inactive
      • liveness: temporal liveness = System.weakFair(vars) implies (Nodes.forall(i => not(active.get(i))) leadsTo terminationDetected) (source); temporal AllNodesTerminateIfNoMessagesFairStep = step.weakFair(vars) implies AllNodesTerminateIfNoMessages (source)
        • plain reading (inference from formula): under weak fairness of System, permanent global inactivity leads to eventual termination detection; the stronger all-nodes-stop claim is included only under weak fairness of the entire step action
      • auxiliary temporal restriction, not identified as an intended guarantee: temporal NeverChangeColor = always((color' = color).orKeep(vars)) (source)
      • deliberate negative temporal targets: temporal falseLiveness = System.weakFair(vars) implies Nodes.forall(i => always(eventually(not(active.get(i))))) leadsTo terminationDetected (source); temporal AllNodesTerminateIfNoMessages = eventually(always(Nodes.forall(i => not(SendMsg(i))).orKeep(vars))) (source); temporal AllNodesTerminateIfNoMessagesFairSystem = System.weakFair(vars) implies AllNodesTerminateIfNoMessages (source)
        • author’s warning: “It does not hold” (source); missing global stopping/fairness assumptions make these stronger claims false
        • author on AllNodesTerminateIfNoMessages: “It is not supposed to hold: any node may indefinitely perform local computations.” (source)
        • author on FairSystem/FairStep: “It does not hold.” / “It holds.” (source); these are repository claims, not results rerun here
      • tool/evidence: Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file
      • measured size: 187 lines in this file; exact source
    • bank (examples/cosmos/bank/bank.qnt)
      • specifies: bank state transitions
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file
      • measured size: 207 lines in this file; exact source
    • ics20 (examples/cosmos/ics20/ics20.qnt)
      • specifies: IBC token-transfer protocol
      • safety: val BalanceNonNegative = CHAINS.forall(chain => (source)
        • plain reading (inference from declaration): balances do not become negative
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file
      • measured size: 683 lines in this file; exact source
    • ics23 (examples/cosmos/ics23/ics23.qnt)
      • specifies: IBC Merkle membership proof
      • safety: val TreeProofInv = and { (source); val MemInv = or { not(inputKey.in(tree.leafs.keys())), (source); val NonMemInv = def proofOrNil(key) = { (source)
        • plain reading (inference from declaration): the named state invariants restrict legal reachable states; the excerpt is not sufficient to give a more specific guarantee without reading the complete formula
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file
      • measured size: 885 lines in this file; exact source
    • Blockchain (examples/cosmos/lightclient/Blockchain.qnt)
      • specifies: blockchain protocol
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file
      • measured size: 163 lines in this file; exact source
    • LCVerificationApi (examples/cosmos/lightclient/LCVerificationApi.qnt)
      • specifies: blockchain light-client validation
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file
      • measured size: 192 lines in this file; exact source
    • Lightclient (examples/cosmos/lightclient/Lightclient.qnt)
      • specifies: blockchain light-client validation
      • safety: def TargetHeightOnSuccessInv: bool = state == "finishedSuccess" implies and { (source); def CorrectnessInv: bool = fetchedLightBlocks.keys().forall( h => (source); def NoTrustOnFaultyBlockInv: bool = and { state == "finishedSuccess", (source); def StoredHeadersAreVerifiedInv: bool = state == "finishedSuccess" implies { (source); def StoredHeadersAreVerifiedOrNotTrustedInv: bool = state == "finishedSuccess" implies { (source); def ProofOfChainOfTrustInv: bool = state == "finishedSuccess" implies { (source); def NoFailedBlocksOnSuccessInv: bool= state == "finishedSuccess" implies (source); def PrecisionInv: bool = state == "finishedFailure" implies or { (source); def PrecisionBuggyInv: bool = state == "finishedFailure" implies or { (source); def ApiPostInv: bool = state != "working" implies (source)
        • plain reading (inference from declaration): the named state invariants restrict legal reachable states; the excerpt is not sufficient to give a more specific guarantee without reading the complete formula
      • liveness: no active temporal/progress declaration found in this file
        • a property name marks a buggy/false test target; it must not be interpreted as an established guarantee
      • tool/evidence: Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file
      • measured size: 560 lines in this file; exact source
    • Tendermint (examples/cosmos/tendermint/Tendermint.qnt)
      • specifies: Tendermint Byzantine consensus
      • safety: val Agreement = tuples(Corr, Corr).forall( ((p, q)) => (source); val Validity = Corr.forall(p => (source); val NoAgreement = tuples(Corr, Corr).forall( ((p, q)) => (source)
        • plain reading (inference from declaration): decisions agree; decisions satisfy the stated validity condition
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file
      • measured size: 662 lines in this file; exact source
    • TendermintModels (examples/cosmos/tendermint/TendermintModels.qnt)
      • specifies: Tendermint Byzantine consensus
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file
      • measured size: 35 lines in this file; exact source
    • TendermintTest (examples/cosmos/tendermint/TendermintTest.qnt)
      • specifies: Tendermint Byzantine consensus
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file
      • measured size: 91 lines in this file; exact source
    • utxo (examples/cryptography/utxo/utxo.qnt)
      • specifies: UTXO transaction validity
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file
      • measured size: 225 lines in this file; exact source

  • Quint: CometBFT source specifications

    • dog (spec/mempool/gossip/quint/dog.qnt)
      • specifies: transaction mempool
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file
      • measured size: 219 lines in this file; exact source
    • flood (spec/mempool/gossip/quint/flood.qnt)
      • specifies: synchronous FloodSet consensus
      • safety: no active top-level safety/property declaration found in this file
      • liveness: temporal txInPoolGetsDisseminated = AllTxs.forall(tx => (source)
        • plain reading (inference from formula): transactions in a mempool eventually reach the modeled peers
      • tool/evidence: Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file
      • measured size: 115 lines in this file; exact source
    • mempool (spec/mempool/gossip/quint/mempool.qnt)
      • specifies: transaction mempool
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file
      • measured size: 74 lines in this file; exact source
    • p2p (spec/mempool/gossip/quint/p2p.qnt)
      • specifies: transaction mempool
      • safety: no active top-level safety/property declaration found in this file
      • liveness: temporal allMsgsDelivered = eventually(NodeIDs.forall(node => length(node.IncomingMsgs()) == 0)) (source)
        • plain reading (inference from formula): messages eventually arrive under the model’s delivery assumptions
      • tool/evidence: Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file
      • measured size: 86 lines in this file; exact source
    • spells (spec/mempool/gossip/quint/spells.qnt)
      • specifies: transaction mempool
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file
      • measured size: 135 lines in this file; exact source
    • Consensus (spec/mempool/quint/Consensus.qnt)
      • specifies: consensus/agreement protocol
      • safety: val consensusInvariant = { and { (source)
        • plain reading (inference from declaration): decisions agree; decisions satisfy the stated validity condition
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file
      • measured size: 199 lines in this file; exact source
    • Ledger (spec/mempool/quint/Ledger.qnt)
      • specifies: transaction mempool
      • safety: val ledgerInvariant = { and { (source)
        • plain reading (inference from declaration): decisions satisfy the stated validity condition
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file
      • measured size: 188 lines in this file; exact source
    • Mempool (spec/mempool/quint/Mempool.qnt)
      • specifies: transaction mempool
      • safety: val inv1 = { PROCESSES.forall(p => _state.ledger.getSubmittedFor(p).subseteq(_state.hmempool.get(p))) (source); val inv2 = { PROCESSES.forall(p => 0.to(_state.ledger.heightOf(p)-1).forall(i => _state.ledger.entry(p, i).intersect(_state.txsOf(p)).size()==0)) (source); val inv3 = { PROCESSES.forall(p => _state.txsOf(p).forall(t => _state.ledger.isValid(p, t))) (source); val inv4() = { PROCESSES.forall(p => _state.hmempool.get(p).forall(tx => _state.ledger.isCommittedFor(p, tx) or not(_state.ledger.isValid(p, tx)) or _state.txsOf(p).contains(tx))) (source); val allInv = and { inv1, (source)
        • plain reading (inference from declaration): the named state invariants restrict legal reachable states; the excerpt is not sufficient to give a more specific guarantee without reading the complete formula
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file
      • measured size: 195 lines in this file; exact source
    • Spells (spec/mempool/quint/Spells.qnt)
      • specifies: transaction mempool
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file
      • measured size: 25 lines in this file; exact source
    • System (spec/mempool/quint/System.qnt)
      • specifies: transaction mempool
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file
      • measured size: 9 lines in this file; exact source
    • reactor (spec/p2p/reactor-api/reactor.qnt)
      • specifies: peer-to-peer reactor API
      • safety: no active top-level safety/property declaration found in this file
      • liveness: no active temporal/progress declaration found in this file
      • tool/evidence: Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file
      • measured size: 276 lines in this file; exact source

  • coverage and gaps

    • Ivy scan includes protocol examples, liveness examples, TileLink coherence examples, protocol tutorials/testing variants, QUIC contract modules and selected protocol regression models
    • excludes Ivy language/compiler tests, sequential collection implementations, CPU pipeline/ALU examples, generic tactic tests and puzzle examples; accompanying libraries and harnesses may hold extra contracts
    • mypyvy scan includes protocol encodings, unsafe variants, prophecy/relaxation benchmark variants; excludes unrelated sequential structures and language regressions
    • DuoAI and DistAI: all .ivy files under protocols; DistAI matching generated outputs linked where present
    • SWISS: every .ivy/.pyv benchmark file; paired encodings deliberately remain separate
    • Veil: every non-puzzle Examples/**/*.lean file except SCPTheory.lean, which is a supporting quorum theory rather than a transition-system case
    • Quint: every classic distributed .qnt, Cosmos consensus/IBC/light-client/bank core model, and every CometBFT .qnt; support modules remain separate when they specify subsystem behavior
    • checks were not executed; no successful proof/model-checking result inferred solely from a property or command declaration
    • quoted declaration excerpts are source locators; multi-line formulas and imported assumptions must be read at those links before reusing a case as an evaluation task
    • temporal safety declarations without eventuality are listed under safety; named temporal specifications/fairness assumptions are kept under liveness when they include progress but are not necessarily standalone guarantees

Coq and Rocq

  • measurement and evidence rules

    • LOC counts physical lines, including comments and blank lines, in the named .v file(s) or recursive directory; shared framework dependencies are excluded
    • every link pins the inspected commit; repository source and proof scripts were inspected, but Coq/Rocq builds were not run
    • “proof scripts” means proof artifacts are present, not that this survey independently checked them; admitted statements and commented drafts are identified locally, without a whole dependency audit
    • liveness is recorded only for explicit eventual/progress statements; ordinary partial-correctness Hoare triples do not establish eventual return

  • Coq / Verdi

    • Counter
      • specifies: primary/backup counting server
      • safety: backup count never exceeds primary; number of outputs never exceeds inputs
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 438 LOC in 1 .v file(s), scope theories/Systems/Counter.v
      • source: theories/Systems/Counter.v
      • source words: “Theorem primary_ge_backup : forall net tr, step_async_star (params := Counter_MultiParams) step_async_init net tr -> nwState net backup <= nwState net primary.”; Counter.v, line 259
    • LockServ
      • specifies: message-passing lock server
      • safety: mutual exclusion of client nodes
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 1,236 LOC in 1 .v file(s), scope theories/Systems/LockServ.v
      • source: theories/Systems/LockServ.v
      • source words: “Theorem true_in_reachable_mutual_exclusion : true_in_reachable step_async step_async_init (fun net => mutual_exclusion (nwState net)).”; LockServ.v, line 843
    • LiveLockServ
      • specifies: lock server with labeled network executions
      • safety: mutual exclusion
      • liveness: a requesting client eventually holds the lock under the theorem’s weak-fairness assumption
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 2,329 LOC in 1 .v file(s), scope theories/Systems/LiveLockServ.v
      • source: theories/Systems/LiveLockServ.v
      • source words: “Theorem locking_clients_eventually_receive_lock_st : forall c s, event_step_star step_async step_async_init (hd s) -> lb_step_execution lb_step_async s -> weak_fairness lb_step_async label_silent s -> now (occurred (InputLock c)) s -> eventually (fun s => held (nwState (evt_a (hd s)) (Client c)) = true) s.”; LiveLockServ.v, line 2312
      • liveness source words: “weak_fairness lb_step_async label_silent s ->” and “eventually (fun s => held (nwState (evt_a (hd s)) (Client c)) = true) s.”; full theorem
    • VarD
      • specifies: single-node key-value service used as replication input
      • safety: input/output traces agree with key-value state-machine semantics
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 347 LOC in 1 .v file(s), scope theories/Systems/VarD.v
      • source: theories/Systems/VarD.v
      • source words: “Theorem step_1_star_trace_correct’ : forall st st’ trace, step_1_star st st’ trace -> trace_correct’ st trace.”; VarD.v, line 307
    • VarDPrimaryBackup
      • specifies: primary-backup replication transformer applied to VarD
      • safety: correctness lifted to failure semantics
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 91 LOC in 1 .v file(s), scope theories/Systems/VarDPrimaryBackup.v
      • source: theories/Systems/VarDPrimaryBackup.v
      • source words: “Theorem lifting_applied : forall (net : @network _ PB_multi_params) tr, step_async_star step_async_init net tr -> trace_correct (revert_trace (base_params := vard_base_params) tr).”; VarDPrimaryBackup.v, line 13
    • LockServSeqNum
      • specifies: lock server with sequence-number duplicate suppression
      • safety: mutual exclusion lifted through the sequence-number transformer
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 32 LOC in 1 .v file(s), scope theories/Systems/LockServSeqNum.v
      • source: theories/Systems/LockServSeqNum.v
      • source words: “Theorem transformed_correctness : forall (net : transformed_network) tr, step_dup_star (params := transformed_multi_params) step_async_init net tr -> @mutual_exclusion num_Clients (nwState (revertNetwork net)).”; LockServSeqNum.v, line 17
    • sequence numbering transformer
      • specifies: deduplication wrapper around arbitrary Verdi systems
      • safety: simulation/correctness relation between transformed and original traces
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 718 LOC in 1 .v file(s), scope theories/Systems/SeqNumCorrect.v
      • source: theories/Systems/SeqNumCorrect.v
      • source words: “Theorem true_in_reachable_transform : forall P, true_in_reachable step_async step_async_init P -> true_in_reachable step_dup step_async_init (fun net => P (revertNetwork net)).”; SeqNumCorrect.v, line 705
    • primary-backup transformer
      • specifies: asynchronous primary-backup replication of an arbitrary state machine
      • safety: trace simulation between replicated system and original state machine
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 1,300 LOC in 1 .v file(s), scope theories/Systems/PrimaryBackup.v
      • source: theories/Systems/PrimaryBackup.v
      • source words: “Lemma inputs_1_m_revert : forall net tr, step_async_star (params := PB_multi_params) step_async_init net tr -> inputs_m tr = inputs_1 (revert_trace tr) ++ queue (nwState net Primary).”; PrimaryBackup.v, line 1258
    • logging transformer
      • specifies: disk-backed event log and replay transformer
      • safety: simulation/refinement across logged crash-recovery semantics
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 382 LOC in 1 .v file(s), scope theories/Systems/LogCorrect.v
      • source: theories/Systems/LogCorrect.v
      • source words: “Lemma log_step_failure_star_simulation : forall net failed tr, step_failure_disk_ops_star step_failure_disk_ops_init (failed, net) tr -> step_failure_star step_failure_init (failed, revertLogNetwork net) tr.”; LogCorrect.v, line 359
    • Verdi Raft
      • specifies: Raft consensus implementation, invariant interfaces and proof suite
      • safety: election safety, log matching, leader completeness, state-machine safety, end-to-end linearizability
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 49,436 LOC in 194 .v file(s), scope theories/Raft plus named companion files
      • source: theories/Raft
      • source words: “Theorem raft_linearizable’ : forall failed net tr, input_correct tr -> step_failure_star step_failure_init (failed, net) tr -> exists l tr1 st, equivalent _ (import tr) l /\ exported (get_input tr) (get_output tr) l tr1 /\ step_1_star init st tr1.”; RaftLinearizableProofs.v, line 1056
      • README source words: “uses the proofs of all proof interfaces to show Raft’s linearizability property.”; README
    • VarDRaft
      • specifies: fault-tolerant key-value service built by applying Raft to VarD
      • safety: key-value trace correctness lifted through the named transformer
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 52 LOC in 2 .v file(s), scope theories/Systems/VarDRaft.v plus named companion files
      • source: theories/Systems/VarDRaft.v
      • source words: “Theorem vard_raft_linearizable : forall failed net tr, input_correct tr -> step_failure_star step_failure_init (failed, net) tr -> exists l tr1 st, equivalent _ (import tr) l /\ exported (get_input tr) (get_output tr) l tr1 /\ step_1_star init st tr1.”; VarDRaftCorrect.v, line 21
    • VarDRaftSerialized
      • specifies: VarDRaft with serialized network messages
      • safety: key-value trace correctness lifted through the named transformer
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 232 LOC in 2 .v file(s), scope theories/Systems/VarDRaftSerialized.v plus named companion files
      • source: theories/Systems/VarDRaftSerialized.v
      • source words: “Theorem vard_raft_serialized_linearizable : forall failed net tr, input_correct tr -> step_failure_star step_failure_init (failed, net) tr -> exists l tr1 st, equivalent _ (import tr) l /\ exported (get_input tr) (get_output tr) l tr1 /\ step_1_star init st tr1.”; VarDRaftSerializedCorrect.v, line 185
    • VarDRaftLog
      • specifies: VarDRaft with persisted event log
      • safety: key-value trace correctness lifted through the named transformer
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 50 LOC in 2 .v file(s), scope theories/Systems/VarDRaftLog.v plus named companion files
      • source: theories/Systems/VarDRaftLog.v
      • source words: “Theorem vard_raft_log_linearizable : forall failed net tr, input_correct tr -> step_failure_disk_ops_star step_failure_disk_ops_init (failed, net) tr -> exists l tr1 st, equivalent _ (import tr) l /\ exported (get_input tr) (get_output tr) l tr1 /\ step_1_star init st tr1.”; VarDRaftLogCorrect.v, line 20
    • VarDRaftSerializedLog
      • specifies: VarDRaft with both serialization and persisted log
      • safety: key-value trace correctness lifted through the named transformer
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 58 LOC in 2 .v file(s), scope theories/Systems/VarDRaftSerializedLog.v plus named companion files
      • source: theories/Systems/VarDRaftSerializedLog.v
      • source words: “Theorem vard_raft_log_linearizable : forall failed net tr, input_correct tr -> step_failure_disk_ops_star step_failure_disk_ops_init (failed, net) tr -> exists l tr1 st, equivalent _ (import tr) l /\ exported (get_input tr) (get_output tr) l tr1 /\ step_1_star init st tr1.”; VarDRaftSerializedLogCorrect.v, line 21

  • Coq / DiSeL

    • Greeter
      • specifies: nodes exchanging greetings
      • safety: protocol coherence preserved by send/receive transitions
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 426 LOC in 1 .v file(s), scope theories/Examples/Greeter
      • source: theories/Examples/Greeter
      • source words: “Lemma hcomp l : hook_complete (W l nodes).”; Greeter.v, line 392
    • distributed lock protocol
      • specifies: lock server and clients
      • safety: ownership/coherence of client/server lock states
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 584 LOC in 1 .v file(s), scope theories/Examples/LockResource/LockProtocol.v
      • source: theories/Examples/LockResource/LockProtocol.v
      • source words: “Lemma rc_step_coh : r_step_coh_t client_recv_wf the_tag rc_step.”; LockProtocol.v, line 512
    • resource protocol
      • specifies: remote resource service intended for composition with locking
      • safety: coherence of resources and request/reply transitions
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 571 LOC in 1 .v file(s), scope theories/Examples/LockResource/ResourceProtocol.v
      • source: theories/Examples/LockResource/ResourceProtocol.v
      • source words: “Lemma rc_step_coh : r_step_coh_t client_recv_wf the_tag rc_step.”; ResourceProtocol.v, line 504
    • calculator protocol and client
      • specifies: request/reply arithmetic service, client, batching, memoization and delegation
      • safety: returned results satisfy calculator function and protocol invariants
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 2,032 LOC in 7 .v file(s), scope theories/Examples/Calculator
      • source: theories/Examples/Calculator
      • source words: “Lemma lookup_valid s args : state_wf s -> if lookup_mem_table s args is Some v then f args = Some v else True.”; SimpleCalculatorServers.v, line 358
    • two-phase commit
      • specifies: coordinator/participant atomic commit with rounds
      • safety: participant/coordinator log agreement and invariant preservation
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 6,134 LOC in 7 .v file(s), scope theories/Examples/TwoPhaseCommit
      • source: theories/Examples/TwoPhaseCommit
      • source words: “Lemma rp_step_coh : r_step_coh_t rp_wf rp_tag rp_step.”; TwoPhaseProtocol.v, line 831
    • query protocol
      • specifies: queries of distributed node state
      • safety: unique request identifiers and request/reply coherence
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 415 LOC in 1 .v file(s), scope theories/Examples/Querying/QueryProtocol.v
      • source: theories/Examples/Querying/QueryProtocol.v
      • source words: “Lemma receive_step_coh : r_step_coh_t rc_wf rtag receive_step.”; QueryProtocol.v, line 345
    • query with protocol hooks
      • specifies: query protocol composed with another protocol
      • safety: queries describe coherent stable core state
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 1,227 LOC in 1 .v file(s), scope theories/Examples/Querying/QueryHooked.v
      • source: theories/Examples/Querying/QueryHooked.v
      • source words: “Lemma msg_story_rely req_num to data reqs resp s s2 : msg_story s req_num to data reqs resp -> network_rely W this s s2 -> msg_story s2 req_num to data reqs resp.”; QueryHooked.v, line 869
    • query plus two-phase commit
      • specifies: queries composed with atomic-commit protocol
      • safety: queried coordinator state related to commit-protocol state
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 228 LOC in 1 .v file(s), scope theories/Examples/Querying/QueryPlusTPC.v
      • source: theories/Examples/Querying/QueryPlusTPC.v
      • source words: “Lemma find_empty l i : l \notin dom i -> getStatelet i l = empty_dstatelet.”; QueryPlusTPC.v, line 116
    • simple calculator server
      • specifies: simple calculator server
      • safety: server Hoare contracts preserve calculator function/result invariant
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 420 LOC in 1 .v file(s), scope theories/Examples/Calculator/SimpleCalculatorServers.v
      • source: theories/Examples/Calculator/SimpleCalculatorServers.v
      • source words: “Lemma lookup_valid s args : state_wf s -> if lookup_mem_table s args is Some v then f args = Some v else True.”; SimpleCalculatorServers.v, line 358
    • batching calculator server
      • specifies: batching calculator server
      • safety: server Hoare contracts preserve calculator function/result invariant
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 420 LOC in 1 .v file(s), scope theories/Examples/Calculator/SimpleCalculatorServers.v
      • source: theories/Examples/Calculator/SimpleCalculatorServers.v
      • source words: “Lemma lookup_valid s args : state_wf s -> if lookup_mem_table s args is Some v then f args = Some v else True.”; SimpleCalculatorServers.v, line 358
    • memoizing calculator server
      • specifies: memoizing calculator server
      • safety: server Hoare contracts preserve calculator function/result invariant
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 420 LOC in 1 .v file(s), scope theories/Examples/Calculator/SimpleCalculatorServers.v
      • source: theories/Examples/Calculator/SimpleCalculatorServers.v
      • source words: “Lemma lookup_valid s args : state_wf s -> if lookup_mem_table s args is Some v then f args = Some v else True.”; SimpleCalculatorServers.v, line 358
    • delegating calculator server
      • specifies: delegating calculator server
      • safety: server Hoare contracts preserve calculator function/result invariant
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 181 LOC in 1 .v file(s), scope theories/Examples/Calculator/DelegatingCalculatorServer.v
      • source: theories/Examples/Calculator/DelegatingCalculatorServer.v
      • source words: “Lemma hcomp l : hook_complete (mkWorld l).”; DelegatingCalculatorServer.v, line 113

  • Coq / Aneris and Trillium

    • Paxos
      • specifies: Paxos acceptor, proposer, learner and clients
      • safety: consensus model agreement and implementation/model adequacy
      • liveness: not found
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 3,006 LOC in 9 .v file(s), scope aneris/examples/consensus
      • source: aneris/examples/consensus
      • source words: “Lemma runner_spec : {{{ inv paxosN paxos_inv ∗ ([∗ set] a ∈ acceptors, a ⤇ acceptor_si) ∗ ([∗ set] p ∈ proposers, p ⤇ proposer_si) ∗ ([∗ set] l ∈ learners, l ⤇ learner_si) ∗ c_addr ⤇ client_si ∗ ([∗ set] l ∈ learners, l ⤳ (∅, ∅)) ∗ c_addr ⤳ (∅, ∅) ∗ ([∗ set] ip ∈ ips, free_ip ip) ∗ ([∗ set] a ∈ acceptors, ∃ prf, maxBal_frag (a ↾ prf) None ∗ maxVal_frag (a ↾ prf) None) ∗ pending_class 0 0 ∗ pending_class 1 0 }}} runner 41 42 @[“system”] {{{ v, RET v; True }}}.”; paxos_runner.v, line 51
    • two-phase transaction commit
      • specifies: transaction manager and resource managers
      • safety: transaction-commit state-machine model and adequacy
      • liveness: not found
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 1,293 LOC in 9 .v file(s), scope aneris/examples/transaction_commit
      • source: aneris/examples/transaction_commit
      • source words: “Lemma transaction_manager_spec vRMs : is_set RMs vRMs → free_ports (ip_of_address tm) {[port_of_address tm]} -∗ ([∗ set] rm ∈ RMs, rm ⤇ rm_si) -∗ tm ⤇ tm_si -∗ tm ⤳ (∅, ∅) -∗ pending -∗ WP transaction_manager #tm vRMs @[ip_of_address tm] {{ v, (⌜v = #(“COMMITTED”)⌝ ∗ [∗ set] rm ∈ RMs, rm ↦◯ COMMITTED) ∨ (⌜v = #(“ABORTED”)⌝ ∗ ∃ rm, ⌜rm ∈ RMs⌝ ∗ rm ↦◯ ABORTED) }}.”; two_phase_tm.v, line 61
    • reliable causal broadcast
      • specifies: vector-clock causal broadcast
      • safety: deliver/broadcast contracts and causal history model
      • liveness: not found; name “reliable” alone does not establish eventual delivery
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 5,992 LOC in 36 .v file(s), scope aneris/examples/rcb
      • source: aneris/examples/rcb
      • source words: “Lemma mapi_length {A B} (f : nat -> A -> B) l : length (mapi f l) = length l.”; list_proof_alt.v, line 376
    • causally consistent key-value database
      • specifies: distributed causal-memory key-value store
      • safety: causal histories, read/write model and client contracts
      • liveness: not found
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 7,566 LOC in 49 .v file(s), scope aneris/examples/ccddb
      • source: aneris/examples/ccddb
      • source words: “Lemma Maximum_maximals_val_agree (e1 e2 : ae) i s k h E : nclose DB_InvName ⊆ E → Maximum h = Some (erasure e1) → e1 ∈ restrict_key k s → e2 ∈ Maximals (restrict_key k s) → erasure e2 ∈ h → GlobalInv ⊢ Seen i s -∗ k ↦ᵤ h ={E}=∗ ⌜AE_val e1 = AE_val e2⌝ ∗ k ↦ᵤ h.”; spec_util.v, line 162
    • reliable communication
      • specifies: connection establishment and reliable-session channel send/receive
      • safety: session/API contracts and channel-resource invariants
      • liveness: not found
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 17,511 LOC in 109 .v file(s), scope aneris/examples/reliable_communication
      • source: aneris/examples/reliable_communication
      • source words: “Lemma int_client_two_channels_spec ip v c1 c2 : v = #40 → {{{ c1 ↣{ip, int_serialization} int_proto2 ∗ c2 ↣{ip, int_serialization} int_proto2 }}} int_client_two_channels v c1 c2 @[ip] {{{ RET #42; True }}}.”; proofmode.v, line 604
    • operation-based CRDT library
      • specifies: generic replicated-data library parameterized by datatype
      • safety: generic model/specification and operation-library proof
      • liveness: not found
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 8,261 LOC in 33 .v file(s), scope aneris/examples/crdt/oplib
      • source: aneris/examples/crdt/oplib
      • source words: “Lemma update_spec_implies_simplified_update update repId addr : update_spec update repId addr ⊢ simplified_update_spec update repId addr.”; spec.v, line 226
    • state-based CRDT library
      • specifies: state-based replication library
      • safety: model, events and resource definitions
      • liveness: not found
      • tool and evidence: Coq/Rocq proof scripts with 1 active admission tokens in counted files; incomplete artifact; source inspection only
      • size: 330 LOC in 5 .v file(s), scope aneris/examples/crdt/statelib
      • source: aneris/examples/crdt/statelib
      • source words: “Lemma dep_closed_union (s s’ : gset (Event Op)) : dep_closed s -> dep_closed s’ -> dep_closed (s ∪ s’).”; model.v, line 33
    • G-counter convergence
      • specifies: grow-only counter replicas communicating over network
      • safety: model/implementation relation and monotone counter invariants
      • liveness: eventual consistency after a stability point, assuming explicit send, receive, and sent-to-received network fairness
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 4,301 LOC in 10 .v file(s), scope aneris/examples/gcounter_convergence
      • source: aneris/examples/gcounter_convergence
      • source words: “Lemma elem_of_all_vecs_smaller n (v’ v : vector_clock n) : v’ ∈ all_vecs_smaller v ↔ vc_le v’ v.”; vc.v, line 132
    • snapshot-isolation database
      • specifies: transactional key-value store and client proxy
      • safety: snapshot-isolation model/specification and server/client contracts
      • liveness: not found
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 19,404 LOC in 68 .v file(s), scope aneris/examples/transactional_consistency/snapshot_isolation
      • source: aneris/examples/transactional_consistency/snapshot_isolation
      • source words: “Lemma run_spec : ∀ (c : val) (tbody : val) (sa : socket_address) (E : coPset) (P : gmap Key Hist → iProp Σ) (Q : (gmap Key Hist) -> (gmap Key Hist) -> (gmap Key (option val * bool)) → iProp Σ), ⌜↑KVS_InvName ⊆ E⌝ -∗ start_spec -∗ commit_spec -∗ IsConnected c sa -∗ {{{ ConnectionState c sa CanStart ∗ (|={⊤, E}=> ▷ ∃ m_at_start, P m_at_start ∗ ([∗ map] k ↦ h ∈ m_at_start, k ↦ₖ h) ∗ (([∗ map] k ↦ h ∈ m_at_start, k ↦ₖ h) ={E, ⊤}=∗ emp)) ∗ (∀ (m_snap : gmap Key Hist), {{{ ([∗ map] k ↦ h ∈ m_snap, k ↦{c} (last h) ∗ KeyUpdStatus c k false) ∗ P m_snap }}} tbody c @[ip_of_address sa] {{{ (mc : gmap Key (option val * bool)), RET #(); ⌜dom m_snap = dom mc⌝ ∗ ([∗ map] k ↦ p ∈ mc, k ↦{c} p.1 ∗ KeyUpdStatus c k p.2) ∗ (|={⊤, E}=> ▷ ∃ m_at_commit, ([∗ map] k ↦ h ∈ m_at_commit, k ↦ₖ h) ∗ ⌜dom m_at_commit = dom m_snap⌝ ∗ Q m_at_commit m_snap mc ∗ ((([∗ map] k↦h;p ∈ m_at_commit; mc, k ↦ₖ (commit_event p h)) ∨ ([∗ map] k↦h ∈ m_at_commit, k ↦ₖ h)) ={E, ⊤}=∗ emp)) }}}) }}} run c tbody @[ip_of_address sa] {{{ m ms mc (b : bool), RET #b; ConnectionState c sa CanStart ∗ Q m ms mc ∗ ((⌜b = true⌝ ∗ ⌜can_commit m ms mc⌝ ∗ ([∗ map] k↦ h;p ∈ m; mc, Seen k (commit_event p h))) ∨ (⌜b = false⌝ ∗ ⌜¬ can_commit m ms mc⌝ ∗ [∗ map] k ↦ h ∈ m, Seen k h)) }}}.”; util_proof.v, line 263
    • read-committed specification
      • specifies: weaker transaction model and clients
      • safety: read-committed trace specification; snapshot isolation implies read committed
      • liveness: not found
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 5,325 LOC in 12 .v file(s), scope aneris/examples/transactional_consistency/read_committed
      • source: aneris/examples/transactional_consistency/read_committed
      • source words: “Lemma wait_transaction_spec : ∀ (c cond v : val) (key : Key) (sa : socket_address) (E : coPset), ⌜↑KVS_InvName ⊆ E⌝ -∗ ⌜key ∈ KVS_keys⌝ -∗ IsConnected c sa -∗ GlobalInv -∗ RC_client_toolbox -∗ □ (|={⊤, E}=> ▷ ∃ V, key ↦ₖ V ∗ (key ↦ₖ V ={E, ⊤}=∗ emp)) -∗ (∀ v’, {{{ True }}} cond v’ @[ip_of_address sa] {{{ (b : bool), RET #b; ⌜b → v = v’⌝ }}}) -∗ {{{ ConnectionState c sa CanStart }}} weak_wait_transaction c cond #key @[ip_of_address sa] {{{ V, RET #(); ConnectionState c sa CanStart ∗ Seen key ({[v]} ∪ V) }}}.”; util_proof.v, line 18
    • read-uncommitted specification
      • specifies: weak transaction model and clients
      • safety: read-uncommitted trace specification; read committed implies read uncommitted
      • liveness: not found
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 3,794 LOC in 10 .v file(s), scope aneris/examples/transactional_consistency/read_uncommitted
      • source: aneris/examples/transactional_consistency/read_uncommitted
      • source words: “Lemma wait_transaction_spec : ∀ (c cond v : val) (key : Key) (sa : socket_address) (E : coPset), ⌜↑KVS_InvName ⊆ E⌝ -∗ ⌜key ∈ KVS_keys⌝ -∗ IsConnected c sa -∗ GlobalInv -∗ RU_client_toolbox -∗ □ (|={⊤, E}=> ▷ ∃ V, key ↦ₖ V ∗ (key ↦ₖ V ={E, ⊤}=∗ emp)) -∗ (∀ v’, {{{ True }}} cond v’ @[ip_of_address sa] {{{ (b : bool), RET #b; ⌜b → v = v’⌝ }}}) -∗ {{{ ConnectionState c sa CanStart }}} weak_wait_transaction c cond #key @[ip_of_address sa] {{{ V, RET #(); ConnectionState c sa CanStart ∗ Seen key ({[v]} ∪ V) }}}.”; util_proof.v, line 18
    • DSCM specification and one-server implementation
      • specifies: distributed shared causal memory and one-server client proxy
      • safety: event/resource specification; one client-proxy lemma is admitted
      • liveness: not found
      • tool and evidence: Coq/Rocq proof scripts with 1 active admission tokens in counted files; incomplete artifact; source inspection only
      • size: 2,800 LOC in 18 .v file(s), scope aneris/examples/dscm
      • source: aneris/examples/dscm
      • source words: “Lemma Writes_Obs_origin_frame E s we sa h hf : nclose DB_InvName ⊆ E → Writes sa (s ++ [we]) -∗ Obs (h ++ [we] ++ hf) ={E}=∗ Writes sa (s ++ [we]) ∗ ⌜hist_at_origin sa hf = []⌝.”; utils.v, line 129
    • viewstamped replication
      • specifies: replica, network layer and client proxy
      • safety: implementation definitions; no proof found in this directory
      • liveness: not found
      • tool and evidence: implementation/specification present; no active lemma/theorem found in counted files; source inspection only
      • size: 1,404 LOC in 5 .v file(s), scope aneris/examples/viewstamped_replication
      • source: aneris/examples/viewstamped_replication
      • source words: “Definition wait_for_reply val_ser : val :=”; vr_client_proxy_code.v
    • echo
      • specifies: single echo server/client
      • safety: echo client/server postconditions
      • liveness: not found
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 251 LOC in 2 .v file(s), scope aneris/examples/echo
      • source: aneris/examples/echo
      • source words: “Theorem echo_safe : aneris_adequate echo_runner “system” echo_is (λ _, True).”; echo_proof.v, line 183
    • echo groups
      • specifies: groups of echo server/client nodes
      • safety: group echo postconditions
      • liveness: not found
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 561 LOC in 2 .v file(s), scope aneris/examples/echo_groups
      • source: aneris/examples/echo_groups
      • source words: “Theorem echo_safe : aneris_adequate echo_runner “system” echo_is (λ _, True).”; proof.v, line 500
    • minimal message passing
      • specifies: minimal distributed message example
      • safety: client/server contracts
      • liveness: not found
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 436 LOC in 2 .v file(s), scope aneris/examples/minimal_example
      • source: aneris/examples/minimal_example
      • source words: “Lemma gcounter_adequacy ip : @continued_simulation aneris_lang (aneris_to_trace_model incr_exampleM) (incr_sim ip) {tr[ ([mkExpr ip incr_example], init_state ip) ]} {tr[ 0%nat ]}.”; minimal_example_proof.v, line 239
    • ping-pong
      • specifies: ping/pong communication
      • safety: client/server postconditions
      • liveness: not found
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 211 LOC in 1 .v file(s), scope aneris/examples/ping_pong
      • source: aneris/examples/ping_pong
      • source words: “Theorem ping_pong_safe : aneris_adequate ping_pong_runner “system” ping_pong_is (λ _, True).”; ping_pong.v, line 196
    • ping-pong done
      • specifies: ping/pong with completion message
      • safety: client/server postconditions
      • liveness: not found
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 297 LOC in 3 .v file(s), scope aneris/examples/ping_pong_done
      • source: aneris/examples/ping_pong_done
      • source words: “Lemma ping_pong_runner_spec : {{{ pong_addr ⤇ pong_si ∗ pong_addr ⤳ (∅, ∅) ∗ ping_addr ⤳ (∅, ∅) ∗ unallocated {[ping_addr]} ∗ ([∗ set] ip ∈ ips, free_ip ip) ∗ last_message γpong NONE ∗ last_message γpong NONE }}} ping_pong_runner @[“system”] {{{ v, RET v; True }}}.”; ping_pong_done_proof.v, line 217
    • iterated ping-pong
      • specifies: server and multiple ping/pong clients
      • safety: proof draft is commented out; no active proof claimed
      • liveness: not found
      • tool and evidence: implementation/specification present; no active lemma/theorem found in counted files; source inspection only
      • size: 1,599 LOC in 2 .v file(s), scope aneris/examples/iterated_ping_pong
      • source: aneris/examples/iterated_ping_pong
    • CRDT add wins set
      • specifies: add wins set replicated datatype or CRDT client
      • safety: datatype-specific model/operation contracts; theorem quoted below
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 407 LOC in 2 .v file(s), scope aneris/examples/crdt/oplib/examples/add_wins_set
      • source: aneris/examples/crdt/oplib/examples/add_wins_set
      • source words: “Lemma aws_init_spec : init_spec (oplib_init (s_ser (s_serializer (sum_serialization vl_serialization vl_serialization))) (s_deser (s_serializer (sum_serialization vl_serialization vl_serialization)))) -∗ init_spec_for_specific_crdt (aws_init (s_ser (s_serializer vl_serialization)) (s_deser (s_serializer vl_serialization))).”; add_wins_set_proof.v, line 352
    • CRDT gcounter
      • specifies: gcounter replicated datatype or CRDT client
      • safety: datatype-specific model/operation contracts; theorem quoted below
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 269 LOC in 2 .v file(s), scope aneris/examples/crdt/oplib/examples/gcounter
      • source: aneris/examples/crdt/oplib/examples/gcounter
      • source words: “Lemma Ctr_init_spec : init_spec (oplib_init (s_ser (s_serializer OpLib_Serialization)) (s_deser (s_serializer OpLib_Serialization))) -∗ init_spec_for_specific_crdt counter_init.”; gcounter_proof.v, line 226
    • CRDT grow only set
      • specifies: grow only set replicated datatype or CRDT client
      • safety: datatype-specific model/operation contracts; theorem quoted below
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 183 LOC in 2 .v file(s), scope aneris/examples/crdt/oplib/examples/grow_only_set
      • source: aneris/examples/crdt/oplib/examples/grow_only_set
      • source words: “Lemma prod_init_spec : init_spec (oplib_init (s_ser (s_serializer vl_serialization)) (s_deser (s_serializer vl_serialization))) -∗ init_spec_for_specific_crdt (gos_init (s_ser (s_serializer vl_serialization)) (s_deser (s_serializer vl_serialization))).”; grow_only_set_proof.v, line 141
    • CRDT lwwreg
      • specifies: lwwreg replicated datatype or CRDT client
      • safety: datatype-specific model/operation contracts; theorem quoted below
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 624 LOC in 2 .v file(s), scope aneris/examples/crdt/oplib/examples/lwwreg
      • source: aneris/examples/crdt/oplib/examples/lwwreg
      • source words: “Lemma lww_init_spec : init_spec (oplib_init (s_ser (s_serializer OpLib_Serialization)) (s_deser (s_serializer OpLib_Serialization))) -∗ init_spec_for_specific_crdt (lwwreg_init (s_ser (s_serializer vl_serialization)) (s_deser (s_serializer vl_serialization))).”; lwwreg_proof.v, line 542
    • CRDT map comb
      • specifies: map comb replicated datatype or CRDT client
      • safety: datatype-specific model/operation contracts; theorem quoted below
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 570 LOC in 2 .v file(s), scope aneris/examples/crdt/oplib/examples/map_comb
      • source: aneris/examples/crdt/oplib/examples/map_comb
      • source words: “Lemma map_init_spec crdt : @crdt_fun_spec _ _ _ _ _ _ _ OPP crdt -∗ @init_spec _ _ _ _ _ _ _ map_OpLib_Params _ _ oplib_init’ -∗ ∀ (repId : nat) (addr : socket_address) (addrs_val : val), {{{ ⌜is_list CRDT_Addresses addrs_val⌝ ∗ ⌜CRDT_Addresses !! repId = Some addr⌝ ∗ ([∗ list] i ↦ z ∈ CRDT_Addresses, z ⤇ OpLib_SocketProto i) ∗ addr ⤳ (∅, ∅) ∗ free_ports (ip_of_address addr) {[port_of_address addr]} ∗ OpLib_InitToken repId }}} map_comb_init’ crdt addrs_val #repId @[ip_of_address addr] {{{ get_state_val update_val, RET (get_state_val, update_val); LocState repId ∅ ∅ ∗ @get_state_spec _ _ _ _ _ _ _ map_OpLib_Params _ _ get_state_val repId addr ∗ @update_spec _ _ _ _ _ _ _ map_OpLib_Params _ _ update_val repId addr }}}.”; map_comb_proof.v, line 499
    • CRDT mvreg
      • specifies: mvreg replicated datatype or CRDT client
      • safety: datatype-specific model/operation contracts; theorem quoted below
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 365 LOC in 2 .v file(s), scope aneris/examples/crdt/oplib/examples/mvreg
      • source: aneris/examples/crdt/oplib/examples/mvreg
      • source words: “Lemma Ctr_init_spec : init_spec (oplib_init (s_ser (s_serializer OpLib_Serialization)) (s_deser (s_serializer OpLib_Serialization))) -∗ init_spec_for_specific_crdt mvreg_init.”; mvreg_proof.v, line 317
    • CRDT pncounter
      • specifies: pncounter replicated datatype or CRDT client
      • safety: datatype-specific model/operation contracts; theorem quoted below
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 261 LOC in 2 .v file(s), scope aneris/examples/crdt/oplib/examples/pncounter
      • source: aneris/examples/crdt/oplib/examples/pncounter
      • source words: “Lemma Ctr_init_spec : init_spec (oplib_init (s_ser (s_serializer OpLib_Serialization)) (s_deser (s_serializer OpLib_Serialization))) -∗ init_spec_for_specific_crdt pncounter_init.”; pncounter_proof.v, line 218
    • CRDT pncounter use case
      • specifies: pncounter use case replicated datatype or CRDT client
      • safety: datatype-specific model/operation contracts; theorem quoted below
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 401 LOC in 1 .v file(s), scope aneris/examples/crdt/oplib/examples/pncounter_use_case
      • source: aneris/examples/crdt/oplib/examples/pncounter_use_case
      • source words: “Theorem use_case_program_adequate : aneris_adequate use_case_program “system” init_state (λ v, v = #()).”; pncounter_use_case.v, line 367
    • CRDT prod comb
      • specifies: prod comb replicated datatype or CRDT client
      • safety: datatype-specific model/operation contracts; theorem quoted below
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 412 LOC in 2 .v file(s), scope aneris/examples/crdt/oplib/examples/prod_comb
      • source: aneris/examples/crdt/oplib/examples/prod_comb
      • source words: “Lemma prod_init_spec crdtA crdtB : @crdt_fun_spec _ _ _ _ _ _ _ OPPA crdtA -∗ @crdt_fun_spec _ _ _ _ _ _ _ OPPB crdtB -∗ @init_spec _ _ _ _ _ _ _ prod_OpLib_Params _ _ oplib_init’ -∗ ∀ (repId : nat) (addr : socket_address) (addrs_val : val), {{{ ⌜is_list CRDT_Addresses addrs_val⌝ ∗ ⌜CRDT_Addresses !! repId = Some addr⌝ ∗ ([∗ list] i ↦ z ∈ CRDT_Addresses, z ⤇ OpLib_SocketProto i) ∗ addr ⤳ (∅, ∅) ∗ free_ports (ip_of_address addr) {[port_of_address addr]} ∗ OpLib_InitToken repId }}} prod_comb_init’ crdtA crdtB addrs_val #repId @[ip_of_address addr] {{{ get_state_val update_val, RET (get_state_val, update_val); LocState repId ∅ ∅ ∗ @get_state_spec _ _ _ _ _ _ _ prod_OpLib_Params _ _ get_state_val repId addr ∗ @update_spec _ _ _ _ _ _ _ prod_OpLib_Params _ _ update_val repId addr }}}.”; prod_comb_proof.v, line 340
    • CRDT remove wins set
      • specifies: remove wins set replicated datatype or CRDT client
      • safety: datatype-specific model/operation contracts; theorem quoted below
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 586 LOC in 2 .v file(s), scope aneris/examples/crdt/oplib/examples/remove_wins_set
      • source: aneris/examples/crdt/oplib/examples/remove_wins_set
      • source words: “Lemma rws_init_spec : init_spec (oplib_init (s_ser (s_serializer (sum_serialization vl_serialization vl_serialization))) (s_deser (s_serializer (sum_serialization vl_serialization vl_serialization)))) -∗ init_spec_for_specific_crdt (rws_init (s_ser (s_serializer vl_serialization)) (s_deser (s_serializer vl_serialization))).”; remove_wins_set_proof.v, line 508
    • CRDT table of counters
      • specifies: table of counters replicated datatype or CRDT client
      • safety: datatype-specific model/operation contracts; theorem quoted below
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 101 LOC in 2 .v file(s), scope aneris/examples/crdt/oplib/examples/table_of_counters
      • source: aneris/examples/crdt/oplib/examples/table_of_counters
      • source words: “Lemma table_of_counters_init_spec : @init_spec _ _ _ _ _ _ _ map_OpLib_Params _ _ oplib_init’ -∗ @init_spec_for_specific_crdt _ _ _ _ _ _ _ map_OpLib_Params _ _ table_of_counters_init.”; table_of_counters_proof.v, line 59
    • CRDT table of lwwregs
      • specifies: table of lwwregs replicated datatype or CRDT client
      • safety: datatype-specific model/operation contracts; theorem quoted below
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 111 LOC in 2 .v file(s), scope aneris/examples/crdt/oplib/examples/table_of_lwwregs
      • source: aneris/examples/crdt/oplib/examples/table_of_lwwregs
      • source words: “Lemma table_of_lwwregs_init_spec : @init_spec _ _ _ _ _ _ _ map_OpLib_Params’ _ _ oplib_init’ -∗ @init_spec_for_specific_crdt _ _ _ _ _ _ _ map_OpLib_Params’ _ _ (table_of_lwwregs_init (s_ser (s_serializer vl_serialization)) (s_deser (s_serializer vl_serialization))).”; table_of_lwwregs_proof.v, line 68
    • CRDT two p set
      • specifies: two p set replicated datatype or CRDT client
      • safety: datatype-specific model/operation contracts; theorem quoted below
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 211 LOC in 2 .v file(s), scope aneris/examples/crdt/oplib/examples/two_p_set
      • source: aneris/examples/crdt/oplib/examples/two_p_set
      • source words: “Lemma tps_init_spec : init_spec (oplib_init (s_ser (s_serializer (sum_serialization vl_serialization vl_serialization))) (s_deser (s_serializer (sum_serialization vl_serialization vl_serialization)))) -∗ init_spec_for_specific_crdt (tps_init (s_ser (s_serializer vl_serialization)) (s_deser (s_serializer vl_serialization))).”; two_p_set_proof.v, line 163
    • state-based PN-counter
      • specifies: positive/negative replicated counter implementation
      • safety: implementation only; no local theorem found
      • liveness: not found in this row
      • tool and evidence: implementation/specification present; no active lemma/theorem found in counted files; source inspection only
      • size: 85 LOC in 1 .v file(s), scope aneris/examples/crdt/statelib/examples/pncounter
      • source: aneris/examples/crdt/statelib/examples/pncounter
      • source words: “Definition mutate_side : val :=”; counter_code.v
    • Aneris reliable_communication case: ddb
      • specifies: ddb protocol/library/client case
      • safety: example/API contracts; exact theorem in linked source
      • liveness: not found in this row
      • tool and evidence: implementation/specification present; no active lemma/theorem found in counted files; source inspection only
      • size: 147 LOC in 2 .v file(s), scope aneris/examples/reliable_communication/lib/ddb
      • source: aneris/examples/reliable_communication/lib/ddb
      • source words: “Definition process_request : val :=”; ddb_code.v
    • Aneris reliable_communication case: dlm
      • specifies: dlm protocol/library/client case
      • safety: example/API contracts; exact theorem in linked source
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 596 LOC in 5 .v file(s), scope aneris/examples/reliable_communication/lib/dlm
      • source: aneris/examples/reliable_communication/lib/dlm
      • source words: “Lemma init_setup_holds (E : coPset) (R : iProp Σ) : ↑DL_namespace ⊆ E → ⊢ |={E}=> ∃ (DLRS : DL_resources), dl_service_init ∗ (dl_server_start_service_spec R) ∗ (dl_subscribe_client_spec R).”; dlm_proof.v, line 270
    • Aneris reliable_communication case: mt server
      • specifies: mt server protocol/library/client case
      • safety: example/API contracts; exact theorem in linked source
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 471 LOC in 4 .v file(s), scope aneris/examples/reliable_communication/lib/mt_server
      • source: aneris/examples/reliable_communication/lib/mt_server
      • source words: “Lemma MTS_init_setup_holds (E : coPset) : ↑MTS_mN ⊆ E → ⊢ |={E}=> ∃ (srv_si : message → iProp Σ) (SrvInit : iProp Σ) (MTR : MTS_resources), SrvInit ∗ (run_server_spec SrvInit srv_si) ∗ (init_client_proxy_spec srv_si) ∗ make_request_spec.”; mt_server_proof.v, line 209
    • Aneris reliable_communication case: repdb
      • specifies: repdb protocol/library/client case
      • safety: example/API contracts; exact theorem in linked source
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 4,801 LOC in 32 .v file(s), scope aneris/examples/reliable_communication/lib/repdb
      • source: aneris/examples/reliable_communication/lib/repdb
      • source words: “Lemma filter_subseteq {A : Type} {!EqDecision A} P {! ∀ x : A, Decision (P x)} (xs : list A) : filter P xs ⊆ xs.”; stdpp_utils.v, line 194
    • Aneris reliable_communication case: sharding
      • specifies: sharding protocol/library/client case
      • safety: example/API contracts; exact theorem in linked source
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 1,361 LOC in 9 .v file(s), scope aneris/examples/reliable_communication/lib/sharding
      • source: aneris/examples/reliable_communication/lib/sharding
      • source words: “Lemma rep_ser_is_ser_injective_alt : ser_is_injective_alt rep_ser.”; resources.v, line 303
    • Aneris reliable_communication case: dlm db example
      • specifies: dlm db example protocol/library/client case
      • safety: example/API contracts; exact theorem in linked source
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 584 LOC in 2 .v file(s), scope aneris/examples/reliable_communication/examples/dlm_db_example
      • source: aneris/examples/reliable_communication/examples/dlm_db_example
      • source words: “Theorem adequacy : aneris_adequate main “system” init_state (λ _, True).”; dlm_db_example_proof.v, line 464
    • Aneris reliable_communication case: hello world
      • specifies: hello world protocol/library/client case
      • safety: example/API contracts; exact theorem in linked source
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 272 LOC in 2 .v file(s), scope aneris/examples/reliable_communication/examples/hello_world
      • source: aneris/examples/reliable_communication/examples/hello_world
      • source words: “Theorem adequacy : aneris_adequate main “system” init_state (λ _, True).”; hello_world_proof.v, line 213
    • Aneris reliable_communication case: hello world 2
      • specifies: hello world 2 protocol/library/client case
      • safety: example/API contracts; exact theorem in linked source
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 395 LOC in 2 .v file(s), scope aneris/examples/reliable_communication/examples/hello_world_2
      • source: aneris/examples/reliable_communication/examples/hello_world_2
      • source words: “Theorem adequacy : aneris_adequate main “system” init_state (λ _, True).”; hello_world_2_proof.v, line 309
    • Aneris reliable_communication case: messages in order
      • specifies: messages in order protocol/library/client case
      • safety: example/API contracts; exact theorem in linked source
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 280 LOC in 2 .v file(s), scope aneris/examples/reliable_communication/examples/messages_in_order
      • source: aneris/examples/reliable_communication/examples/messages_in_order
      • source words: “Theorem adequacy : aneris_adequate main “system” init_state (λ _, True).”; messages_in_order_proof.v, line 206
    • Aneris reliable_communication case: messages in order loop
      • specifies: messages in order loop protocol/library/client case
      • safety: example/API contracts; exact theorem in linked source
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 350 LOC in 2 .v file(s), scope aneris/examples/reliable_communication/examples/messages_in_order_loop
      • source: aneris/examples/reliable_communication/examples/messages_in_order_loop
      • source words: “Theorem adequacy : aneris_adequate main “system” init_state (λ _, True).”; messages_in_order_loop_proof.v, line 268
    • Aneris reliable_communication case: repdb leader followers
      • specifies: repdb leader followers protocol/library/client case
      • safety: example/API contracts; exact theorem in linked source
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 574 LOC in 2 .v file(s), scope aneris/examples/reliable_communication/examples/repdb_leader_followers
      • source: aneris/examples/reliable_communication/examples/repdb_leader_followers
      • source words: “Theorem adequacy : aneris_adequate main “system” init_state (λ _, True).”; causality_example_proof.v, line 470
    • Aneris reliable_communication case: sharding examples
      • specifies: sharding examples protocol/library/client case
      • safety: example/API contracts; exact theorem in linked source
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 581 LOC in 2 .v file(s), scope aneris/examples/reliable_communication/examples/sharding_examples
      • source: aneris/examples/reliable_communication/examples/sharding_examples
      • source words: “Theorem main_adequacy : aneris_adequate main “system” init_state (λ _, True).”; causality_example_proof.v, line 458
    • Aneris rcb case: broadcast 1 2
      • specifies: broadcast 1 2 protocol/library/client case
      • safety: example/API contracts; exact theorem in linked source
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 400 LOC in 6 .v file(s), scope aneris/examples/rcb/examples/broadcast_1_2
      • source: aneris/examples/rcb/examples/broadcast_1_2
      • source words: “Lemma exclusive_token γ : token γ -∗ token γ -∗ False.”; proof_resources.v, line 13
    • Aneris ccddb case: message passing
      • specifies: message passing protocol/library/client case
      • safety: example/API contracts; exact theorem in linked source
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 783 LOC in 7 .v file(s), scope aneris/examples/ccddb/examples/message_passing
      • source: aneris/examples/ccddb/examples/message_passing
      • source words: “Lemma token_exclusive (γ : gname) : token γ -∗ token γ -∗ False.”; proof_resources.v, line 25
    • Aneris ccddb case: session guarantees
      • specifies: session guarantees protocol/library/client case
      • safety: example/API contracts; exact theorem in linked source
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 1,869 LOC in 8 .v file(s), scope aneris/examples/ccddb/examples/session_guarantees
      • source: aneris/examples/ccddb/examples/session_guarantees
      • source words: “Theorem wfr_example_spec (ca sa1 : socket_address) (db_id1 : rep_id) : {{{ sa1 ⤇ (db_si db_id1) ∗ unallocated {[ca]} ∗ free_ports (ip_of_address ca) {[ port_of_address ca ]} ∗ ca ⤳ (∅, ∅) }}} wfr_example #ca #sa1 @[ip_of_address ca] {{{ vo, RET vo; ∃ e2 s1, (Seen db_id1 s1) ∗ (⌜AE_key e2 = key2⌝) ∗ (⌜AE_val e2 = dbv2⌝) ∗ (⌜e2 ∈ s1⌝) ∗ ( (⌜vo = NONEV⌝) ∨ (∃ e1 v, (⌜vo = SOMEV v⌝) ∗ (⌜e1 ∈ s1⌝) ∗ (⌜AE_key e1 = key1⌝) ∗ (⌜AE_val e1 = v⌝) ∗ (⌜e1 <ₜ e2⌝) ∗ (∀ e s2 db_id2, ((Seen db_id2 s2) ∗ (⌜e ∈ s2⌝) ∗ (⌜e2 ≤ₜ e⌝)) ={⊤}=∗ ∃ e1’ e2’, (⌜erasure e1’ = erasure e1⌝) ∗ (⌜erasure e2’ = erasure e2⌝) ∗ ⌜e1’ ∈ s2⌝ ∗ ⌜e2’ ∈ s2⌝ ∗ ⌜e1’ <ₜ e2’⌝) ) ) }}}.”; wfr.v, line 39
    • DSCM client 1
      • specifies: distributed causal-memory client program
      • safety: client resource/postcondition contract
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 331 LOC in 2 .v file(s), scope aneris/examples/dscm/clients/example1_proof.v plus named companion files
      • source: aneris/examples/dscm/clients/example1_proof.v
      • source words: “Lemma prog_spec sa wr rd : sa ∉ DB_addresses → GlobalInv -∗ write_spec wr sa -∗ read_spec rd sa -∗ {{{ Obs [] ∗ “x” ↦ₖ None ∗ “y” ↦ₖ None ∗ Writes sa [] }}} par_prog wr rd @[ip_of_address sa] {{{ (v : val), RET v; ⌜v = (SOMEV #0, SOMEV #1)%V⌝ ∨ ⌜v = (SOMEV #1, SOMEV #0)%V⌝ ∨ ⌜v = (SOMEV #1, SOMEV #1)%V⌝}}}.”; example1_proof.v, line 161
    • DSCM client 2
      • specifies: distributed causal-memory client program
      • safety: client resource/postcondition contract
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 450 LOC in 2 .v file(s), scope aneris/examples/dscm/clients/example2_proof.v plus named companion files
      • source: aneris/examples/dscm/clients/example2_proof.v
      • source words: “Lemma prog_spec ip sa1 sa2 init k (n1 n2 : Z) dbsv : is_list DB_addresses dbsv → k ∈ DB_keys → ip_of_address sa1 = ip → ip_of_address sa2 = ip → sa1 ∉ DB_addresses → sa2 ∉ DB_addresses → sa1 ≠ sa2 → GlobalInv -∗ init_spec init -∗ {{{ sa1 ⤳ (∅, ∅) ∗ sa2 ⤳ (∅, ∅) ∗ free_ports (ip_of_address sa1) {[port_of_address sa1]} ∗ free_ports (ip_of_address sa2) {[port_of_address sa2]} ∗ k ↦ₖ None ∗ unallocated {[sa1;sa2]} ∗ ([∗ list] i ↦ z ∈ DB_addresses, z ⤇ DB_socket_proto) }}} prog init sa1 sa2 k n1 n2 dbsv @[ip] {{{ (v : val), RET v; ⌜v = (SOMEV #n1, SOMEV #n1)%V⌝ ∨ ⌜v = (SOMEV #n1, SOMEV #n2)%V⌝ ∨ ⌜v = (SOMEV #n2, SOMEV #n2)%V⌝}}}.”; example2_proof.v, line 287
    • Aneris transactional_consistency case: commit order
      • specifies: commit order protocol/library/client case
      • safety: example/API contracts; exact theorem in linked source
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 935 LOC in 2 .v file(s), scope aneris/examples/transactional_consistency/read_committed/examples/commit_order
      • source: aneris/examples/transactional_consistency/read_committed/examples/commit_order
      • source words: “Theorem runner_safe : aneris_adequate example_runner “system” init_state (λ _, True).”; commit_order_proof.v, line 863
    • Aneris transactional_consistency case: dirty read
      • specifies: dirty read protocol/library/client case
      • safety: example/API contracts; exact theorem in linked source
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 358 LOC in 2 .v file(s), scope aneris/examples/transactional_consistency/read_committed/examples/dirty_read
      • source: aneris/examples/transactional_consistency/read_committed/examples/dirty_read
      • source words: “Theorem runner_safe : aneris_adequate example_runner “system” init_state (λ _, True).”; dirty_read_proof.v, line 307
    • Aneris transactional_consistency case: trace proof of concept
      • specifies: trace proof of concept protocol/library/client case
      • safety: example/API contracts; exact theorem in linked source
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 368 LOC in 2 .v file(s), scope aneris/examples/transactional_consistency/read_committed/examples/trace_proof_of_concept
      • source: aneris/examples/transactional_consistency/read_committed/examples/trace_proof_of_concept
      • source words: “Theorem trace_valid : ∀ σ’ t, rtc step ([(mkExpr “system” example_runner)], init_state) (t, σ’) → valid_trace_rc (state_trace σ’).”; trace_proof_of_concept_proof.v, line 309
    • Aneris transactional_consistency case: read own data
      • specifies: read own data protocol/library/client case
      • safety: example/API contracts; exact theorem in linked source
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 398 LOC in 2 .v file(s), scope aneris/examples/transactional_consistency/read_uncommitted/examples/read_own_data
      • source: aneris/examples/transactional_consistency/read_uncommitted/examples/read_own_data
      • source words: “Theorem runner_safe : aneris_adequate example_runner “system” init_state (λ _, True).”; read_own_data_proof.v, line 345
    • Aneris transactional_consistency case: read uncommitted data
      • specifies: read uncommitted data protocol/library/client case
      • safety: example/API contracts; exact theorem in linked source
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 429 LOC in 2 .v file(s), scope aneris/examples/transactional_consistency/read_uncommitted/examples/read_uncommitted_data
      • source: aneris/examples/transactional_consistency/read_uncommitted/examples/read_uncommitted_data
      • source words: “Theorem runner_safe : aneris_adequate example_runner “system” init_state (λ _, True).”; read_uncommitted_data_proof.v, line 377
    • Aneris transactional_consistency case: bank transfer
      • specifies: bank transfer protocol/library/client case
      • safety: example/API contracts; exact theorem in linked source
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 205 LOC in 2 .v file(s), scope aneris/examples/transactional_consistency/snapshot_isolation/examples/bank_transfer
      • source: aneris/examples/transactional_consistency/snapshot_isolation/examples/bank_transfer
      • source words: “Lemma transfer_transaction (amount : nat) (c : val) (src dst : Key) (client_addr : socket_address) (client_inv_name : namespace) : SI_client_toolbox -∗ {{{ ⌜src ∈ KVS_keys⌝ ∗ ⌜dst ∈ KVS_keys⌝ ∗ ⌜src ≠ dst⌝ ∗ ⌜∀ (n : nat), KVS_Serializable #n ⌝ ∗ ⌜↑KVS_InvName ⊆ (⊤ : coPset) ∖ ↑client_inv_name⌝ ∗ inv client_inv_name (client_inv src dst) ∗ ConnectionState c client_addr CanStart ∗ IsConnected c client_addr }}} transaction c src dst @[ip_of_address client_addr] {{{ v, RET v; True }}}.”; bank_transfer_proof.v, line 32 - Aneris transactional_consistency case: causality example - specifies: causality example protocol/library/client case - safety: example/API contracts; exact theorem in linked source - liveness: not found in this row - tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only - size: 590 LOC in 2 `.v` file(s), scope `aneris/examples/transactional_consistency/snapshot_isolation/examples/causality_example` - source: aneris/examples/transactional_consistency/snapshot_isolation/examples/causality_example - source words: “Theorem runner_safe : aneris_adequate runner "system" init_state (λ _, True).”; causality_example_proof.v, line 529 - Aneris transactional_consistency case: classical example - specifies: classical example protocol/library/client case - safety: example/API contracts; exact theorem in linked source - liveness: not found in this row - tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only - size: 443 LOC in 2 `.v` file(s), scope `aneris/examples/transactional_consistency/snapshot_isolation/examples/classical_example` - source: aneris/examples/transactional_consistency/snapshot_isolation/examples/classical_example - source words: “Theorem runner_safe : aneris_adequate example_runner "system" init_state (λ _, True).”; classical_example_proof.v, line 380 - Aneris deprecated SI client: anomalie - specifies: anomalie transaction client - safety: example postcondition or anomaly witness; exact contract in linked source - liveness: not found in this row - tool and evidence: implementation/specification present; no active lemma/theorem found in counted files; source inspection only - size: 6 LOC in 1 `.v` file(s), scope `aneris/examples/transactional_consistency/snapshot_isolation/examples/deprecated/anomalie` - source: aneris/examples/transactional_consistency/snapshot_isolation/examples/deprecated/anomalie - Aneris deprecated SI client: classical example run - specifies: classical example run transaction client - safety: example postcondition or anomaly witness; exact contract in linked source - liveness: not found in this row - tool and evidence: implementation/specification present; no active lemma/theorem found in counted files; source inspection only - size: 1,154 LOC in 4 `.v` file(s), scope `aneris/examples/transactional_consistency/snapshot_isolation/examples/deprecated/classical_example_run` - source: aneris/examples/transactional_consistency/snapshot_isolation/examples/deprecated/classical_example_run - source words: “Definition transaction1 : val :=”; classical_example_run_code.v - Aneris deprecated SI client: disjoint reads - specifies: disjoint reads transaction client - safety: example postcondition or anomaly witness; exact contract in linked source - liveness: not found in this row - tool and evidence: implementation/specification present; no active lemma/theorem found in counted files; source inspection only - size: 406 LOC in 2 `.v` file(s), scope `aneris/examples/transactional_consistency/snapshot_isolation/examples/deprecated/disjoint_reads` - source: aneris/examples/transactional_consistency/snapshot_isolation/examples/deprecated/disjoint_reads - source words: “Definition transaction1 : val :=”; disjoint_reads_code.v - Aneris deprecated SI client: read your writes - specifies: read your writes transaction client - safety: example postcondition or anomaly witness; exact contract in linked source - liveness: not found in this row - tool and evidence: implementation/specification present; no active lemma/theorem found in counted files; source inspection only - size: 226 LOC in 2 `.v` file(s), scope `aneris/examples/transactional_consistency/snapshot_isolation/examples/deprecated/read_your_writes` - source: aneris/examples/transactional_consistency/snapshot_isolation/examples/deprecated/read_your_writes - source words: “Definition transaction : val :=”; read_your_writes_code.v - Aneris transactional_consistency case: disjoint writes - specifies: disjoint writes protocol/library/client case - safety: example/API contracts; exact theorem in linked source - liveness: not found in this row - tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only - size: 332 LOC in 2 `.v` file(s), scope `aneris/examples/transactional_consistency/snapshot_isolation/examples/disjoint_writes` - source: aneris/examples/transactional_consistency/snapshot_isolation/examples/disjoint_writes - source words: “Theorem runner_safe : aneris_adequate example_runner "system" init_state (λ _, True).”; disjoint_writes_proof.v, line 285 - Aneris transactional_consistency case: function call - specifies: function call protocol/library/client case - safety: example/API contracts; exact theorem in linked source - liveness: not found in this row - tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only - size: 394 LOC in 2 `.v` file(s), scope `aneris/examples/transactional_consistency/snapshot_isolation/examples/function_call` - source: aneris/examples/transactional_consistency/snapshot_isolation/examples/function_call - source words: “Theorem runner_safe : aneris_adequate runner "system" init_state (λ _, True).”; function_call_proof.v, line 346 - Aneris transactional_consistency case: no serializability - specifies: no serializability protocol/library/client case - safety: example/API contracts; exact theorem in linked source - liveness: not found in this row - tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only - size: 896 LOC in 2 `.v` file(s), scope `aneris/examples/transactional_consistency/snapshot_isolation/examples/no_serializability` - source: aneris/examples/transactional_consistency/snapshot_isolation/examples/no_serializability - source words: “Theorem runner_safe : aneris_adequate example_runner "system" init_state (λ _, True).”; no_serializability_proof.v, line 811 - Aneris transactional_consistency case: non repeatable read - specifies: non repeatable read protocol/library/client case - safety: example/API contracts; exact theorem in linked source - liveness: not found in this row - tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only - size: 364 LOC in 2 `.v` file(s), scope `aneris/examples/transactional_consistency/snapshot_isolation/examples/non_repeatable_read` - source: aneris/examples/transactional_consistency/snapshot_isolation/examples/non_repeatable_read - source words: “Theorem runner_safe : aneris_adequate example_runner "system" init_state (λ _, True).”; non_repeatable_read_proof.v, line 315 - Aneris transactional_consistency case: only reads - specifies: only reads protocol/library/client case - safety: example/API contracts; exact theorem in linked source - liveness: not found in this row - tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only - size: 298 LOC in 2 `.v` file(s), scope `aneris/examples/transactional_consistency/snapshot_isolation/examples/only_reads` - source: aneris/examples/transactional_consistency/snapshot_isolation/examples/only_reads - source words: “Theorem runner_safe : aneris_adequate example_runner "system" init_state (λ _, True).”; only_reads_proof.v, line 252 - Aneris transactional_consistency case: read skew - specifies: read skew protocol/library/client case - safety: example/API contracts; exact theorem in linked source - liveness: not found in this row - tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only - size: 383 LOC in 2 `.v` file(s), scope `aneris/examples/transactional_consistency/snapshot_isolation/examples/read_skew` - source: aneris/examples/transactional_consistency/snapshot_isolation/examples/read_skew - source words: “Theorem runner_safe : aneris_adequate example_runner "system" init_state (λ _, True).”; read_skew_proof.v, line 332 - Aneris transactional_consistency case: sequential writes - specifies: sequential writes protocol/library/client case - safety: example/API contracts; exact theorem in linked source - liveness: not found in this row - tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only - size: 339 LOC in 2 `.v` file(s), scope `aneris/examples/transactional_consistency/snapshot_isolation/examples/sequential_writes` - source: aneris/examples/transactional_consistency/snapshot_isolation/examples/sequential_writes - source words: “Theorem runner_safe : aneris_adequate example_runner "system" init_state (λ _, True).”; sequential_writes_proof.v, line 291 - Aneris transactional_consistency case: write skew - specifies: write skew protocol/library/client case - safety: example/API contracts; exact theorem in linked source - liveness: not found in this row - tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only - size: 374 LOC in 2 `.v` file(s), scope `aneris/examples/transactional_consistency/snapshot_isolation/examples/write_skew` - source: aneris/examples/transactional_consistency/snapshot_isolation/examples/write_skew - source words: “Theorem runner_safe : aneris_adequate example_runner "system" init_state (λ _, True).”; write_skew_proof.v, line 324 - causal DB session guarantee: read-your-writes - specifies: read-your-writes session guarantee client - safety: a session reads its preceding write - liveness: not found in this row - tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only - size: 120 LOC in 1 `.v` file(s), scope `aneris/examples/ccddb/examples/session_guarantees/ryw.v` - source: aneris/examples/ccddb/examples/session_guarantees/ryw.v - source words: “Theorem ryw_example_spec (A : gset socket_address) (ca sa : socket_address) (db_id : rep_id) : {{{ sa ⤇ (db_si db_id) ∗ unallocated {[ca]} ∗ free_ports (ip_of_address ca) {[ port_of_address ca ]} ∗ ca ⤳ (∅, ∅) }}} ryw_example #ca #sa @[ip_of_address ca] {{{ vo, RET vo; ∃ s e e' v, ⌜vo = SOMEV v⌝ ∗ ⌜AE_val e = v⌝ ∗ ⌜AE_key e = key⌝ ∗ ⌜AE_val e' = dbv⌝ ∗ ⌜AE_key e' = key⌝ ∗ Seen db_id s ∗ ⌜e ∈ s⌝ ∗ ⌜e' ∈ s⌝ ∗ ⌜¬ (e <ₜ e')⌝ }}}.”; ryw.v, line 38 - causal DB session guarantee: monotonic reads - specifies: monotonic reads session guarantee client - safety: later session reads do not move backward in observed history - liveness: not found in this row - tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only - size: 155 LOC in 1 `.v` file(s), scope `aneris/examples/ccddb/examples/session_guarantees/mr.v` - source: aneris/examples/ccddb/examples/session_guarantees/mr.v - source words: “Theorem mr_example_spec (A : gset socket_address) (ca sa : socket_address) (db_id : rep_id) : {{{ sa ⤇ (db_si db_id) ∗ unallocated {[ca]} ∗ free_ports (ip_of_address ca) {[ port_of_address ca ]} ∗ ca ⤳ (∅, ∅) }}} mr_example #ca #sa @[ip_of_address ca] {{{ p, RET p; ∃ vo1 vo2, (⌜p = (vo1, vo2)%V⌝) ∗ ( (∃ s, (⌜vo1 = NONEV⌝) ∗ (⌜vo2 = NONEV⌝) ∗ Seen db_id s ∗ (⌜restrict_key key s = ∅⌝)) ∨ ( ∃ s v2 e, (⌜vo1 = NONEV⌝) ∗ (⌜vo2 = SOMEV v2⌝) ∗ Seen db_id s ∗ (⌜AE_key e = key⌝) ∗ (⌜AE_val e = v2⌝) ∗ (⌜e ∈ Maximals (restrict_key key s)⌝) ) ∨ ( ∃ s v1 v2 e1 e2, (⌜vo1 = SOMEV v1⌝) ∗ (⌜vo2 = SOMEV v2⌝) ∗ Seen db_id s ∗ (⌜AE_key e1 = key⌝) ∗ (⌜AE_val e1 = v1⌝) ∗ (⌜AE_key e2 = key⌝) ∗ (⌜AE_val e2 = v2⌝) ∗ (⌜e2 ∈ Maximals (restrict_key key s)⌝) ∗ (⌜¬ (e2 <ₜ e1)⌝) ) ) }}}.”; mr.v, line 37 - causal DB session guarantee: monotonic writes - specifies: monotonic writes session guarantee client - safety: session writes preserve their order - liveness: not found in this row - tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only - size: 189 LOC in 1 `.v` file(s), scope `aneris/examples/ccddb/examples/session_guarantees/mw.v` - source: aneris/examples/ccddb/examples/session_guarantees/mw.v - source words: “Theorem mw_example_spec (A : gset socket_address) (ca sa1 : socket_address) (db_id1 : rep_id) : {{{ sa1 ⤇ (db_si db_id1) ∗ unallocated {[ca]} ∗ free_ports (ip_of_address ca) {[ port_of_address ca ]} ∗ ca ⤳ (∅, ∅) }}} mw_example #ca #sa1 @[ip_of_address ca] {{{ RET #(); ∃ s1 e1 e2, (⌜AE_val e1 = dbv1⌝) ∗ (⌜AE_key e1 = key1⌝) ∗ (⌜AE_val e2 = dbv2⌝) ∗ (⌜AE_key e2 = key2⌝) ∗ Seen db_id1 s1 ∗ ⌜e1 ∈ s1⌝ ∗ ⌜e2 ∈ s1⌝ ∗ (⌜e1 <ₜ e2⌝) ∗ (∀ e s2 db_id2, (Seen db_id2 s2 ∗ ⌜e ∈ s2⌝ ∗ ⌜e2 ≤ₜ e⌝) ={⊤}=∗ ∃ e1' e2', (⌜erasure e1' = erasure e1⌝) ∗ (⌜erasure e2' = erasure e2⌝) ∗ ⌜e1' ∈ s2⌝ ∗ ⌜e2' ∈ s2⌝ ∗ ⌜e1' <ₜ e2'⌝) }}}.”; mw.v, line 41 - causal DB session guarantee: writes-follow-reads - specifies: writes-follow-reads session guarantee client - safety: writes depend on session preceding reads - liveness: not found in this row - tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only - size: 211 LOC in 1 `.v` file(s), scope `aneris/examples/ccddb/examples/session_guarantees/wfr.v` - source: aneris/examples/ccddb/examples/session_guarantees/wfr.v - source words: “Theorem wfr_example_spec (ca sa1 : socket_address) (db_id1 : rep_id) : {{{ sa1 ⤇ (db_si db_id1) ∗ unallocated {[ca]} ∗ free_ports (ip_of_address ca) {[ port_of_address ca ]} ∗ ca ⤳ (∅, ∅) }}} wfr_example #ca #sa1 @[ip_of_address ca] {{{ vo, RET vo; ∃ e2 s1, (Seen db_id1 s1) ∗ (⌜AE_key e2 = key2⌝) ∗ (⌜AE_val e2 = dbv2⌝) ∗ (⌜e2 ∈ s1⌝) ∗ ( (⌜vo = NONEV⌝) ∨ (∃ e1 v, (⌜vo = SOMEV v⌝) ∗ (⌜e1 ∈ s1⌝) ∗ (⌜AE_key e1 = key1⌝) ∗ (⌜AE_val e1 = v⌝) ∗ (⌜e1 <ₜ e2⌝) ∗ (∀ e s2 db_id2, ((Seen db_id2 s2) ∗ (⌜e ∈ s2⌝) ∗ (⌜e2 ≤ₜ e⌝)) ={⊤}=∗ ∃ e1' e2', (⌜erasure e1' = erasure e1⌝) ∗ (⌜erasure e2' = erasure e2⌝) ∗ ⌜e1' ∈ s2⌝ ∗ ⌜e2' ∈ s2⌝ ∗ ⌜e1' <ₜ e2'⌝) ) ) }}}.”; wfr.v, line 39 - causal DB transitive message passing - specifies: transitive message passing through causal-memory keys - safety: client assertion supported by transitive causal order - liveness: not found in this row - tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only - size: 330 LOC in 1 `.v` file(s), scope `aneris/examples/ccddb/examples/message_passing/message_passing_transitive.v` - source: aneris/examples/ccddb/examples/message_passing/message_passing_transitive.v - source words: “Theorem z2_spec γ1 γ2 s rd : GlobalInv -∗ read_spec rd 2 z2 -∗ {{{ Seen 2 s ∗ inv Ny (inv_y γ1) ∗ inv Nx (inv_x γ1 γ2) }}} z2_prog rd @[ip_of_address z2] {{{ RET (InjRV #37); True }}}.”; message_passing_transitive.v, line 273 - Coq / Velisarios - PBFT - specifies: Practical Byzantine Fault Tolerance replica protocol - safety: agreement of correct replicas, validity and ordering, under formal fault/authentication assumptions - liveness: not found in this row - tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only - size: 58,013 LOC in 124 `.v` file(s), scope `PBFT` - source: PBFT - source words: “Lemma wf_view_change_state_no_repeats_before_events : forall (eo : EventOrdering) (e : Event) i st, state_sm_before_event (PBFTreplicaSM i) e = Some st -> wf_view_change_state_no_repeats i (view_change_state st).”; PBFTwf_view_change_state_no_repeats.v, line 459 - two-thirds consensus - specifies: two-thirds voting consensus - safety: agreement and validity - liveness: not found in this row - tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only - size: 3,697 LOC in 1 `.v` file(s), scope `TwoThirds/TwoThirds.v` - source: TwoThirds/TwoThirds.v - source words: “Lemma TTCagreement : forall (eo : EventOrdering), authenticated_messages_were_sent_or_byz_usys eo TTCsys -> TTCall_not_byz eo -> TTChold_keys eo -> forall (e1 e2 : Event) (sn : SlotNum) (cmd1 cmd2 : Cmd) (c1 c2 : list name) (dl1 dl2 : nat), In (MkDMsg (TTCnotify (prop sn cmd1)) c1 dl1) (output_system_on_event_ldata TTCsys e1) -> In (MkDMsg (TTCnotify (prop sn cmd2)) c2 dl2) (output_system_on_event_ldata TTCsys e2) -> cmd1 = cmd2.”; TwoThirds.v, line 3667 - two-thirds consensus variant 2 - specifies: second implementation/model of two-thirds voting - safety: agreement and validity - liveness: not found in this row - tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only - size: 3,761 LOC in 1 `.v` file(s), scope `TwoThirds/TwoThirds2.v` - source: TwoThirds/TwoThirds2.v - source words: “Lemma TTCagreement : forall (eo : EventOrdering), sent_byz_usys eo TTCsys -> TTCall_not_byz eo -> TTChold_keys eo -> forall (e1 e2 : Event) (sn : SlotNum) (cmd1 cmd2 : Cmd) (c1 c2 : name), In (MkDMsg c1 (TTCnotify (prop sn cmd1))) (output_system_on_event_ldata TTCsys eo e1) -> In (MkDMsg c2 (TTCnotify (prop sn cmd2))) (output_system_on_event_ldata TTCsys eo e2) -> cmd1 = cmd2.”; TwoThirds2.v, line 3732 - primary-backup - specifies: primary-backup protocol - safety: validity - liveness: not found in this row - tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only - size: 423 LOC in 1 `.v` file(s), scope `PrimaryBackup/PrimaryBackup.v` - source: PrimaryBackup/PrimaryBackup.v - source words: “Lemma PBvalidity : forall (eo : EventOrdering), authenticated_messages_were_sent_or_byz_usys eo PBusys -> PBhold_keys eo -> PBall_correct eo -> forall (e : Event) (n : nat) (dst : list name) (d : nat), In (MkDMsg (PBreply n) dst d) (output_system_on_event_ldata PBusys e) -> exists e', e' ≺ e /\ event_triggered_by_message e' (PBinput n).”; PrimaryBackup.v, line 346 - Coq / Toychain - Toychain - specifies: minimal blockchain consensus protocol - safety: clique global/local block-tree invariant preserved by steps - liveness: conditional eventual consensus when pending blocks are exhausted; this theorem does not itself prove fair delivery - tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only - size: 1,890 LOC in 6 `.v` file(s), scope `Systems` plus named companion files - source: Systems - source words: “Lemma clique_eventual_consensus w : clique_inv w -> (forall n, blocksFor n w == [::]) -> exists bc, largest_chain w bc /\ forall n, holds n w (fun st => (has_chain bc st)).”; InvCliqueTopology.v, line 57 - source words: “clique_inv w -> (forall n, blocksFor n w == [::]) ->” followed by “exists bc, largest_chain w bc”; complete theorem - Coq / Perennial and Grove - historical scope: current Perennial commit `3e3e0a484d61d0a15b578f5d5887ead84f145d71` lacks `src/program_proof`; rows below use repository tag `sosp2023`, commit `820a2a9ab088d298f9854961c55c010d6ea1858d` - source words from current README: “It also includes Grove, an extension for verifying distributed systems”; README - Grove primary-backup replicated key-value store - specifies: replicated state machine with epoch configuration, reconfiguration, leases, crash recovery and KV clients - safety: replicated-state/API correctness and crash-safe recovery contracts - liveness: not found in this row - tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only - size: 21,038 LOC in 36 `.v` file(s), scope `src/program_proof/simplepb` - source: src/program_proof/simplepb - source words: “Lemma wp_MakePbServer smMem own_InMemoryStateMachine fname γ data γsrv confHosts confHosts_sl me : let P := (own_Server_ghost_f γ γsrv) in {{{ "#Hinvs" ∷ is_pb_host me γ γsrv ∗ "#HisConfHost" ∷ config_protocol_proof.is_pb_config_hosts confHosts γ ∗ "#Hconf_sl" ∷ readonly (own_slice_small confHosts_sl uint64T 1 confHosts) ∗ "Hfile_ctx" ∷ crash_borrow (fname f↦ data ∗ file_crash P data) (|C={⊤}=> ∃ data', fname f↦ data' ∗ ▷ file_crash P data') ∗ "#HisMemSm" ∷ is_InMemoryStateMachine (sm_record:=pb_record) smMem own_InMemoryStateMachine ∗ "Hmemstate" ∷ own_InMemoryStateMachine [] }}} MakePbServer #smMem #(LitString fname) (slice_val confHosts_sl) {{{ s, RET #s; pb_definitions.is_Server s γ γsrv }}} .”; proof.v, line 1760 - primary-backup replica draft - specifies: append and become-primary RPCs with replication ghost state - safety: append/epoch protocol invariants; inspect admission status below - liveness: not found in this row - tool and evidence: Coq/Rocq proof scripts with 26 active admission tokens in counted files; incomplete artifact; source inspection only - size: 1,402 LOC in 10 `.v` file(s), scope `src/program_proof/pb` - source: src/program_proof/pb - source words: “Lemma primary_commit m γ r (p:PrimaryExtra) : m ∈ p.(matchIdx) → (∀ n, n ∈ p.(matchIdx) → int.Z m ≤ int.Z n) → int.Z m ≤ length r.(opLog) → pb_inv γ -∗ proposal_lb_fancy γ r.(cn) r.(opLog) -∗ own_Primary_ghost γ r p ={⊤}=∗ own_Primary_ghost γ r p ∗ own_Committer_ghost γ r (mkCommitterExtra m).”; replica_ghost_proof.v, line 234 - Multi-Paxos - specifies: Paxos-backed epoch/leader service and follower replication - safety: protocol invariants, epoch acquisition and weak-read contracts - liveness: not found in this row - tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only - size: 5,404 LOC in 12 `.v` file(s), scope `src/program_proof/mpaxos` - source: src/program_proof/mpaxos - source words: “Lemma wp_Server__withLock (s:loc) γ γsrv (f:val) Φ : is_Server s γ γsrv -∗ (∀ ps pst, ("Hvol" ∷ paxosState.own_vol ps pst ∗ "#HP" ∷ □ Pwf pst.(paxosState.state)) -∗ WP f #ps {{ λ _, ∃ pst', paxosState.own_vol ps pst' ∗ (□ Pwf pst'.(paxosState.state)) ∗ (own_paxosState_ghost γ γsrv pst ={⊤∖↑fileN}=∗ own_paxosState_ghost γ γsrv pst' ∗ Φ #()) }}) -∗ WP Server__withLock #s f {{ Φ }} .”; withlock_proof.v, line 32 - Paxos RSM draft - specifies: Paxos propose/accept/learn API - safety: protocol invariants; some ghost-state lemmas admitted - liveness: not found in this row - tool and evidence: Coq/Rocq proof scripts with 24 active admission tokens in counted files; incomplete artifact; source inspection only - size: 2,552 LOC in 5 `.v` file(s), scope `src/program_proof/rsm` - source: src/program_proof/rsm - source words: “Theorem wp_Paxos__Propose (px : loc) (v : string) nid sc γ : is_paxos px nid sc γ -∗ {{{ True }}} Paxos__Propose #px #(LitString v) {{{ (ok : bool), RET #ok; if ok then is_proposed_decree γ v else True }}}.”; spaxos_propose.v, line 1293 - single-decree Paxos draft - specifies: prepare/propose/election implementation - safety: agreement-related state definitions and partial proof; active admissions - liveness: not found in this row - tool and evidence: Coq/Rocq proof scripts with 26 active admission tokens in counted files; incomplete artifact; source inspection only - size: 1,182 LOC in 4 `.v` file(s), scope `src/program_proof/single` - source: src/program_proof/single - source words: “Lemma wp_TryDecide s pid γ (v:u64) (dummy_v:u64) (outv_ptr:loc) : is_Replica s pid γ (f:=f) -∗ {{{ outv_ptr ↦[uint64T] #dummy_v }}} Replica__TryDecide #s #v #outv_ptr {{{ (b:bool), RET #b; ⌜b = true⌝ ∗ outv_ptr ↦[uint64T] #dummy_v ∨ ∃ (outv:u64), outv_ptr ↦[uint64T] #outv ∗ cmd_is f γ outv }}}.”; try_decide_proof.v, line 93 - replication reconfiguration draft - specifies: ghost model of changing replication configurations - safety: commit/leader invariants; active admissions - liveness: not found in this row - tool and evidence: Coq/Rocq proof scripts with 5 active admission tokens in counted files; incomplete artifact; source inspection only - size: 449 LOC in 1 `.v` file(s), scope `src/program_proof/reconf` - source: src/program_proof/reconf - source words: “Lemma become_leader γ term highestVal highestTerm W: int.nat highestTerm < int.nat term → (get_config highestVal).(is_quorum) W → sys_inv γ -∗ proposed_lb γ highestTerm highestVal -∗ old_term_max γ highestTerm highestVal -∗ old_conf_max γ highestVal -∗ □( [∗ set] srv ∈ W, (∃ srvVal, ⌜mval_le srvVal highestVal⌝ ∗ accepted_ro γ srv highestTerm srvVal) ∗ (∀ term', ⌜int.nat highestTerm < int.nat term'⌝ → ⌜int.nat term' < int.nat term⌝ → accepted_ro_none γ srv term') ) -∗ old_term_max γ term highestVal.”; ghost_proof.v, line 312 - sharded in-memory key-value store - specifies: shards, coordinator, moves, installation, KV operations and clients - safety: shard ownership and KV/API contracts - liveness: not found in this row - tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only - size: 7,584 LOC in 31 `.v` file(s), scope `src/program_proof/memkv` - source: src/program_proof/memkv - source words: “Lemma wp_KVShardServer__Start (s:loc) (host : u64) γ : is_urpc_dom γ.(urpc_gn) {[ U64 0; U64 1; U64 2; U64 3; U64 4; U64 5 ]} -∗ is_shard_server host γ -∗ is_KVShardServer s γ -∗ {{{ True }}} KVShardServer__Start #s #host {{{ RET #(); True }}}.”; memkv_shard_start_proof.v, line 10 - distributed lock service - specifies: RPC locking service plus durable RPC/KV helpers - safety: lock/RPC/API contracts and durable state invariants - liveness: not found in this row - tool and evidence: Coq/Rocq proof scripts with 54 active admission tokens in counted files; incomplete artifact; source inspection only - size: 9,099 LOC in 22 `.v` file(s), scope `src/program_proof/lockservice` - source: src/program_proof/lockservice - source words: “Lemma wp_TransactionCoordinator__doTransfer {Eo Ei} (tc:loc) (tid acc1 acc2 amount v1 v2:u64) : Eo ⊆ ⊤ ∖ ↑txnSingleN → {{{ TransactionCoordinator_own tc ∗ fresh_tid γ1.(ps_tpc) tid ∗ fresh_tid γ2.(ps_tpc) tid ∗ |={Eo,Ei}=> (acc1 [[γ1.(ps_kvs)]]↦{1/4} v1 ∗ acc2 [[γ2.(ps_kvs)]]↦{1/4} v2) ∗ ((acc1 [[γ1.(ps_kvs)]]↦{1/4} (word.add v1 amount) ∗ acc2 [[γ2.(ps_kvs)]]↦{1/4} (word.sub v2 amount)) ={Ei,Eo}=∗ emp) }}} TransactionCoordinator__doTransfer #tc #tid #acc1 #acc2 #amount {{{ RET #(); True }}}.”; two_pc_example.v, line 1137 - lock client - specifies: key-value-backed lock service - safety: lock acquisition/release ownership contracts - liveness: not found in this row - tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only - size: 151 LOC in 1 `.v` file(s), scope `src/program_proof/lock` - source: src/program_proof/lock - source words: “Lemma wp_LockClerk__Unlock ck key γ R : {{{ is_LockClerk ck γ ∗ is_lock N γ key R ∗ R }}} LockClerk__Unlock #ck #(str key) {{{ RET #(); True }}} .”; lock_proof.v, line 117 - bank - specifies: distributed bank clients on KV service - safety: transfer and audit contracts - liveness: not found in this row - tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only - size: 901 LOC in 1 `.v` file(s), scope `src/program_proof/bank` - source: src/program_proof/bank - source words: “Lemma wp_MakeBankClerk (lck kck : loc) γlk kvptsto (acc0 acc1 : string ) E : {{{ is_LockClerk lockN lck γlk ∗ is_Kv kck kvptsto E ∗ is_bank init_flag γlk kvptsto {[ acc0; acc1 ]}∗ ⌜ acc0 ≠ acc1 ⌝ }}} MakeBankClerk #lck #kck #(str init_flag) #(str acc0) #(str acc1) {{{ (ck:loc), RET #ck; own_bank_clerk ck {[acc0; acc1]} }}} .”; bank_proof.v, line 866 - fencing - specifies: epoch-fenced counter frontend and configuration service - safety: epoch/counter/API contracts - liveness: not found in this row - tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only - size: 3,427 LOC in 6 `.v` file(s), scope `src/program_proof/fencing` - source: src/program_proof/fencing - source words: “Lemma ghost_map_points_to_update {γ k v} w : k ⤳[γ] v ==∗ k ⤳[γ] w.”; map.v, line 146 - minimum lease - specifies: lease-bearing server and client - safety: time/lease-aware read and server contracts - liveness: not found in this row - tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only - size: 483 LOC in 1 `.v` file(s), scope `src/program_proof/minlease` - source: src/program_proof/minlease - source words: “Lemma wp_main : {{{ True }}} main #() {{{ RET #(); True }}} .”; proof.v, line 454 - lease KV - specifies: lease cache around key-value operations - safety: get/cache/put contracts - liveness: not found in this row - tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only - size: 640 LOC in 1 `.v` file(s), scope `src/program_proof/leasekv` - source: src/program_proof/leasekv - source words: “Lemma wp_LeaseKv__Put (k:loc) key value γ : ⊢ {{{ is_LeaseKv k γ }}} <<< ∀∀ old_value, key ↪[γ] {#1/2} old_value >>> LeaseKv__Put #k #(str key) #(str value) @ (↑leasekvN ∪ E) <<< key ↪[γ] {#1/2} value >>> {{{ RET #(); True }}}.”; proof.v, line 483 - reconnecting RPC client - specifies: RPC client retry/reconnection wrapper - safety: Call2 API contract - liveness: not found in this row - tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only - size: 262 LOC in 1 `.v` file(s), scope `src/program_proof/reconnectclient` - source: src/program_proof/reconnectclient - source words: “Lemma wp_MakeReconnectingClient (srv:u64): {{{ True }}} MakeReconnectingClient #srv {{{ (cl_ptr:loc), RET #cl_ptr; is_ReconnectingClient cl_ptr srv }}}.”; proof.v, line 228 - vMVCC - specifies: concurrent multi-version transaction library - safety: transaction read/write/commit and garbage-collection contracts - liveness: not found in this row - tool and evidence: Coq/Rocq proof scripts with 4 active admission tokens in counted files; incomplete artifact; source inspection only - size: 11,680 LOC in 52 `.v` file(s), scope `src/program_proof/mvcc` - source: src/program_proof/mvcc - source words: “Theorem wp_wrbuf__UpdateTuples wrbuf (tid : u64) sid mods tpls γ : {{{ own_wrbuf wrbuf mods tpls ∗ own_tuples_updated (int.nat tid) mods tpls γ ∗ active_tid γ tid sid }}} WrBuf__UpdateTuples #wrbuf #tid {{{ RET #(); own_wrbuf_xtpls wrbuf mods ∗ active_tid γ tid sid }}}.”; wrbuf_update_tuples.v, line 11 - two-phase local transaction system - specifies: journal transaction wrapper and two-phase refinement - safety: sequential transaction refinement and crash safety - liveness: not found in this row - tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only - size: 6,816 LOC in 10 `.v` file(s), scope `src/program_proof/txn` - source: src/program_proof/txn - source words: “Lemma twophase_started_step_puredet l γ γ' dinit objs_dom j K0 K `{Hctx: LanguageCtx' (ext := @spec_ffi_op_field _) (ffi := (spec_ffi_model_field)) (ffi_semantics := (spec_ext_semantics_field)) K} e0 e1 e2: (∀ σ g, prim_step' e1 σ g [] e2 σ g []) → is_twophase_started l γ γ' dinit objs_dom j K0 e0 (K e1) -∗ is_twophase_started l γ γ' dinit objs_dom j K0 e0 (K e2).”; wrapper_proof.v, line 1680 - TPCC transactions - specifies: transactional TPCC workload - safety: transaction operation contracts - liveness: not found in this row - tool and evidence: Coq/Rocq proof scripts with 10 active admission tokens in counted files; incomplete artifact; source inspection only - size: 1,872 LOC in 4 `.v` file(s), scope `src/program_proof/tpcc` - source: src/program_proof/tpcc - source words: “Theorem wp_txn__Delete”; tpcc_prelude.v, line 126 - append-only file - specifies: concurrent append and wait-for-durability service - safety: append/durability/close contracts - liveness: not found in this row - tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only - size: 1,499 LOC in 1 `.v` file(s), scope `src/program_proof/aof` - source: src/program_proof/aof - source words: “Lemma accessP_weak aof_ptr fname γ P Pcrash data : is_aof aof_ptr γ fname P Pcrash -∗ aof_log_own γ data -∗ (|NC={⊤,⊤∖↑aofN}=> ∃ durableData, ⌜prefix durableData data⌝ ∗ ▷ P durableData ∗ (▷ P durableData -∗ |NC={⊤∖↑aofN,⊤}=> aof_log_own γ data) ) .”; proof.v, line 1452 - async file - specifies: asynchronous durable file implementation - safety: write/flush crash-safety contracts - liveness: not found in this row - tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only - size: 756 LOC in 1 `.v` file(s), scope `src/program_proof/asyncfile` - source: src/program_proof/asyncfile - source words: “Lemma wp_MakeAsyncFile fname N P data : {{{ "Hfile" ∷ crash_borrow (P data ∗ fname f↦ data) (∃ d, P d ∗ fname f↦ d) }}} asyncfile.MakeAsyncFile #(str fname) {{{ γ sl f, RET (slice_val sl, #f); readonly (own_slice_small sl byteT 1 data) ∗ own_AsyncFile N f γ P data }}} .”; proof.v, line 663 - write-ahead log - specifies: concurrent write-ahead logging and recovery - safety: transaction/log/durability and recovery contracts - liveness: not found in this row - tool and evidence: Coq/Rocq proof scripts with 2 active admission tokens in counted files; incomplete artifact; source inspection only - size: 19,175 LOC in 24 `.v` file(s), scope `src/program_proof/wal` - source: src/program_proof/wal - source words: “Theorem wp_Walog__MemAppend (PreQ : iProp Σ) (Q: u64 -> iProp Σ) l γ dinit bufs bs : {{{ is_wal P l γ dinit ∗ updates_slice bufs bs ∗ (∀ σ σ' pos, ⌜wal_wf σ⌝ -∗ ⌜relation.denote (log_mem_append bs) σ σ' pos⌝ -∗ let txn_id := length σ.(log_state.txns) in (P σ -∗ |NC={⊤ ∖↑ N}=> ⌜addrs_wf bs σ.(log_state.d)⌝ ∗ P σ' ∗ (txn_pos γ txn_id pos -∗ Q pos))) ∧ PreQ }}} Walog__MemAppend #l (slice_val bufs) {{{ pos (ok : bool), RET (#pos, #ok); if ok then Q pos ∗ ∃ txn_id, txn_pos γ txn_id pos else PreQ }}}.”; write_proof.v, line 696 - journal - specifies: transactional journal - safety: journal operation and crash invariants - liveness: not found in this row - tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only - size: 2,825 LOC in 5 `.v` file(s), scope `src/program_proof/jrnl` - source: src/program_proof/jrnl - source words: “Theorem wpc_MkLog d γ dinit logm : {{{ is_txn_durable γ dinit logm }}} obj.MkLog (disk_val d) @ ⊤ {{{ γ' (l: loc), RET #l; is_txn l γ.(jrnl_txn_names) dinit ∗ is_txn_system N γ ∗ txn_cfupd_cancel dinit γ' ∗ txn_cinv N γ γ' }}} {{{ ∃ γ' logm', is_txn_durable γ' dinit logm' ∗ (⌜ γ' = γ ⌝ ∨ txn_cinv N γ γ') }}}.”; sep_jrnl_recovery_proof.v, line 132 - object transaction store - specifies: transactional object/buffer system over WAL - safety: load/commit/recovery contracts - liveness: not found in this row - tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only - size: 2,954 LOC in 6 `.v` file(s), scope `src/program_proof/obj` - source: src/program_proof/obj - source words: “Theorem wpc_MkLog E d dinit (γ:txn_names) : ↑walN ⊆ E → ↑invN ⊆ E → {{{ is_txn_durable γ dinit }}} obj.MkLog (disk_val d) @ ⊤ {{{ γ' (l: loc), RET #l; is_txn l γ dinit ∗ txn_cfupd_cancel E dinit γ' ∗ txn_cfupd_res E γ γ' }}} {{{ ∃ γ' logm', ⌜ txn_kinds γ' = txn_kinds γ ⌝ ∗ is_txn_durable γ' dinit ∗ (⌜ γ' = γ ⌝ ∨ txn_resources γ γ' logm') }}}.”; recovery_proof.v, line 856 - durable counter example - specifies: distributed counter server and client with durability - safety: fetch-and-increment and end-to-end crash-safety theorem - liveness: not found in this row - tool and evidence: Coq/Rocq proof scripts with 12 active admission tokens in counted files; incomplete artifact; source inspection only - size: 803 LOC in 5 `.v` file(s), scope `src/program_proof/ctrexample` - source: src/program_proof/ctrexample - source words: “Lemma wpc_ServerMain γurpc_gn (γ:gname) : is_CtrServer_urpc γurpc_gn γ -∗ crash_cond γ -∗ WPC main #() @ NotStuck; ⊤ {{ v, True }} {{ crash_cond γ }} .”; server.v, line 260 - simple NFS server - specifies: NFS read/write/getattr/setattr and recovery - safety: file API and crash-safe recovery contracts - liveness: not found in this row - tool and evidence: Coq/Rocq proof scripts with 4 active admission tokens in counted files; incomplete artifact; source inspection only - size: 3,746 LOC in 13 `.v` file(s), scope `src/program_proof/simple` - source: src/program_proof/simple - source words: “Theorem wp_NFSPROC3_WRITE γ (nfs : loc) (fh : u64) (fhslice : Slice.t) (offset : u64) (dataslice : Slice.t) (databuf : list u8) (Q : SimpleNFS.res u32 -> iProp Σ) (stab : u32) dinit : {{{ is_fs P γ nfs dinit ∗ is_fh fhslice fh ∗ own_slice dataslice u8T 1%Qp databuf ∗ ⌜ (length databuf < 2^32)%Z ⌝ ∗ ( ∀ σ σ' (r : SimpleNFS.res u32) E, ⌜relation.denote (SimpleNFS.wrapper fh (SimpleNFS.write fh offset databuf)) σ σ' r⌝ -∗ ( P σ -∗ |={E}=> P σ' ∗ Q r ) ) }}} Nfs__NFSPROC3_WRITE #nfs (struct.mk_f nfstypes.WRITE3args [ "File" ::= struct.mk_f nfstypes.Nfs_fh3 [ "Data" ::= slice_val fhslice ]; "Offset" ::= #offset; "Count" ::= #(U32 (length databuf)); "Stable" ::= #stab; "Data" ::= (slice_val dataslice) ])%V {{{ v, RET v; ( ∃ (count : u32) resok, ⌜ getField_f nfstypes.WRITE3res "Status" v = #(U32 0) ⌝ ∗ ⌜ getField_f nfstypes.WRITE3res "Resok" v = resok ⌝ ∗ ⌜ getField_f nfstypes.WRITE3resok "Count" resok = #count ⌝ ∗ Q (SimpleNFS.OK count) ) ∨ ( ∃ (stat : Z), ⌜ getField_f nfstypes.WRITE3res "Status" v = #(U32 stat) ⌝ ∗ ⌜ stat ≠ 0 ⌝ ∗ Q SimpleNFS.Err ) }}}.”; write.v, line 39 - key-value store specification - specifies: crash-safe KV/multiput interface - safety: get and multi-put contracts - liveness: not found in this row - tool and evidence: Coq/Rocq proof scripts with 6 active admission tokens in counted files; incomplete artifact; source inspection only - size: 219 LOC in 1 `.v` file(s), scope `src/program_proof/kvs` - source: src/program_proof/kvs - source words: “Theorem wpc_KVS__MultiPut kvsl kvsblks sz γDisk kvp_ls_before kvp_ls_new kvp_slice: {{{ ptsto_kvs kvsl kvsblks sz γDisk ∗ kvpairs_valid_match kvp_ls_before kvsblks γDisk sz ∗ kvpairs_valid_slice kvp_slice kvp_ls_new sz }}} KVS__MultiPut #kvsl (slice_val kvp_slice) {{{ (ok: bool), RET #ok; ptsto_kvs kvsl kvsblks sz γDisk ∗ kvpairs_valid_match kvp_ls_new kvsblks γDisk sz }}}.”; specs.v, line 177 - replicated journal example - specifies: journal replication client - safety: journal replication contract - liveness: not found in this row - tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only - size: 151 LOC in 1 `.v` file(s), scope `src/program_proof/jrnl_replication` - source: src/program_proof/jrnl_replication - source words: “Theorem wp_RepBlock__Read l Q : txnN ## invariant.walN → txnN ## invN → {{{ "#Hrb" ∷ is_rep_block l ∗ "Hfupd" ∷ (∀ σ, P σ ={⊤}=∗ P σ ∗ Q σ) }}} RepBlock__Read #l {{{ s σ (ok:bool), RET (slice_val s, #ok); own_slice s u8T 1 σ ∗ Q σ }}}.”; jrnl_replication_proof.v, line 73 - buffer cache - specifies: concurrent crash-safe block-buffer subsystem - safety: buffer operation and crash-safety contracts - liveness: not found in this row - tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only - size: 2,039 LOC in 3 `.v` file(s), scope `src/program_proof/buf` - source: src/program_proof/buf - source words: “Theorem list_to_inode_buf_to_vals l : length l = inode_bytes -> inode_to_vals (list_to_inode_buf l) = b2val <> l.”; defs.v, line 61
    • Grove tutorial basics
      • specifies: basics service/client exercise
      • safety: service-specific partial-correctness contracts; partial tutorial drafts may contain admissions
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 397 LOC in 2 .v file(s), scope src/program_proof/tutorial/basics
      • source: src/program_proof/tutorial/basics
      • source words: “Lemma wp_Register (t : loc) (k : u64) (v : u64) : {{{ is_tracker t }}} Tracker__Register #t #k #v {{{ (b : bool), RET #b; True }}}.”; proof.v, line 126
    • Grove tutorial kvservice
      • specifies: kvservice service/client exercise
      • safety: service-specific partial-correctness contracts; partial tutorial drafts may contain admissions
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts with 4 active admission tokens in counted files; incomplete artifact; source inspection only
      • size: 4,337 LOC in 4 .v file(s), scope src/program_proof/tutorial/kvservice
      • source: src/program_proof/tutorial/kvservice
      • source words: “Lemma spec_bad_not_monotonic : ⊢ (∀ n, Φbad n -∗ Ψbad n) ∧ (spec_bad 37%nat Φbad) ∧ ((spec_bad 37%nat Ψbad) -∗ False) .”; rpc_functoriality.v, line 22
    • Grove tutorial lockservice
      • specifies: lockservice service/client exercise
      • safety: service-specific partial-correctness contracts; partial tutorial drafts may contain admissions
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts with 18 active admission tokens in counted files; incomplete artifact; source inspection only
      • size: 372 LOC in 1 .v file(s), scope src/program_proof/tutorial/lockservice
      • source: src/program_proof/tutorial/lockservice
      • source words: “Lemma wp_Locked__Release (l:loc) : {{{ is_Locked l }}} Locked__Release #l {{{ RET #(); True }}} .”; proof.v, line 364
    • Grove tutorial objectstore
      • specifies: objectstore service/client exercise
      • safety: service-specific partial-correctness contracts; partial tutorial drafts may contain admissions
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts with 4 active admission tokens in counted files; incomplete artifact; source inspection only
      • size: 239 LOC in 1 .v file(s), scope src/program_proof/tutorial/objectstore
      • source: src/program_proof/tutorial/objectstore
      • source words: “Lemma wp_Clerk__FinishWrite γd (ck:loc) args chunkhandles (data newdata : list (list u8)) : {{{ is_Clerk ck γd ∗ is_finished_writeId γd args.(FinishWriteArgs.WriteId) chunkhandles ∗ ([∗ list] index ↦ _ ∈ chunkhandles, is_dir_writeId_index_recorded γd args.(FinishWriteArgs.WriteId) index) ∗ ⌜chunkhandles.*2 = newdata⌝ ∗ object_ptsto γd args.(FinishWriteArgs.Keyname) data }}} Clerk__FinishWrite #ck {{{ RET #(); object_ptsto γd args.(FinishWriteArgs.Keyname) newdata }}} .”; proof.v, line 222
    • Grove tutorial queue
      • specifies: queue service/client exercise
      • safety: service-specific partial-correctness contracts; partial tutorial drafts may contain admissions
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 714 LOC in 1 .v file(s), scope src/program_proof/tutorial/queue
      • source: src/program_proof/tutorial/queue
      • source words: “Lemma enqueue_dequeue (q : loc) (gamma : namespace) (lk : val) (P : u64 -> iProp Σ): {{{ is_queue q P }}} Queue__Dequeue #q {{{ (a:u64), RET #a; P a }}}.”; proof.v, line 588
    • Perennial example replicated block
      • specifies: replicated block with distributed adequacy
      • safety: operation and crash-recovery contracts
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 591 LOC in 1 .v file(s), scope src/program_proof/examples/replicated_block_proof.v
      • source: src/program_proof/examples/replicated_block_proof.v
      • source words: “Theorem OpenRead_dist_adequate σ g addr : int.Z addr ∈ dom (σ.(world) : (@ffi_state disk_model)) → int.Z (word.add addr 1) ∈ dom (σ.(world) : (@ffi_state disk_model)) → dist_adequate (CS := goose_crash_lang) [OpenRead_init_cfg () addr σ; OpenRead_init_cfg () addr σ] g (λ _, True).”; replicated_block_proof.v, line 566
    • Perennial example toy
      • specifies: transfer even disk blocks between threads
      • safety: operation and crash-recovery contracts
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 144 LOC in 1 .v file(s), scope src/program_proof/examples/toy_proof.v
      • source: src/program_proof/examples/toy_proof.v
      • source words: “Theorem wpc_TransferEvenBlock (d_ref: loc) (addr: u64) : {{{ EBlk addr }}} TransferEvenBlock #d_ref #addr @ ⊤ {{{ RET #() ; True }}} {{{ EBlk addr }}}.”; toy_proof.v, line 117
    • Perennial example inode
      • specifies: concurrent crash-safe inode
      • safety: operation and crash-recovery contracts
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 988 LOC in 1 .v file(s), scope src/program_proof/examples/inode_proof.v
      • source: src/program_proof/examples/inode_proof.v
      • source words: “Theorem wpc_Inode__Append_triple {l P addr} {Palloc γalloc domain} (Q: iProp Σ) (Qc: iProp Σ) (alloc_ref: loc) q (b_s: Slice.t) (b0: Block) : inodeN ## allocN → {{{ “Hinode” ∷ is_inode l P addr ∗ “Hbdata” ∷ is_block b_s q b0 ∗ “HQc” ∷ (Q -∗ Qc) ∗ “#Halloc” ∷ is_allocator Palloc Ψ allocN alloc_ref domain γalloc ∗ “#Halloc_fupd” ∷ □ reserve_fupd (⊤ ∖ ↑allocN) Palloc ∗ “#Hfree_fupd” ∷ □ (∀ a, free_fupd (⊤ ∖ ↑allocN) Palloc a) ∗ “Hfupd” ∷ (Qc ∧ (∀ σ σ’ addr’, ⌜σ’ = set inode.blocks (λ bs, bs ++ [b0]) (set inode.addrs ({[addr’]} ∪.) σ)⌝ -∗ ⌜inode.wf σ⌝ -∗ ∀ s, ⌜s !! addr’ = Some block_reserved⌝ -∗ P σ ∗ ▷ Palloc s ={⊤ ∖ ↑allocN}=∗ P σ’ ∗ ▷ Palloc (<[addr’ := block_used]> s) ∗ Q)) }}} Inode__Append #l (slice_val b_s) #alloc_ref @ ⊤ {{{ (ok: bool), RET #ok; if ok then Q else emp }}} {{{ Qc }}}.”; inode_proof.v, line 920
    • Perennial example async inode
      • specifies: asynchronous inode flushing
      • safety: operation and crash-recovery contracts
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts with 15 active admission tokens in counted files; incomplete artifact; source inspection only
      • size: 1,414 LOC in 1 .v file(s), scope src/program_proof/examples/async_inode_proof.v
      • source: src/program_proof/examples/async_inode_proof.v
      • source words: “Theorem wpc_Inode__Flush {k} {l k’ P addr} {Palloc γalloc domain n} (alloc_ref: loc) : (S k < n)%nat → (S k < k’)%nat → inodeN ## allocN → ∀ Φ Φc, “Hinode” ∷ is_inode l (S k’) P addr ∗ “#Halloc” ∷ is_allocator Palloc Ψ allocN alloc_ref domain γalloc n ∗ “#Halloc_fupd” ∷ □ reserve_fupd (⊤ ∖ ↑allocN) Palloc ∗ “#Hfree_fupd” ∷ □ (∀ a, free_fupd (⊤ ∖ ↑allocN) Palloc a) ∗ “Hfupd” ∷ ( ▷ Φc ∧ (∀ σ, flush_fupd P Palloc σ Φ Φc σ.(inode.buffered_blocks))) -∗ WPC Inode__Flush #l #alloc_ref @ (S k); ⊤ {{ Φ }} {{ Φc }}.”; async_inode_proof.v, line 1184
    • Perennial example single inode
      • specifies: single inode append with crash safety
      • safety: operation and crash-recovery contracts
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 482 LOC in 1 .v file(s), scope src/program_proof/examples/single_inode_proof.v
      • source: src/program_proof/examples/single_inode_proof.v
      • source words: “Theorem wpc_SingleInode__Append_triple (Q: iProp Σ) l sz b_s b0 : {{{ “Hinode” ∷ is_single_inode l sz ∗ “Hb” ∷ is_block b_s 1 b0 ∗ “Hfupd” ∷ ((∀ σ σ’, ⌜σ’ = s_inode.mk (σ.(s_inode.blocks) ++ [b0])⌝ -∗ ▷ P σ ={⊤ ∖ ↑N}=∗ ▷ P σ’ ∗ Q)) }}} SingleInode__Append #l (slice_val b_s) @ ⊤ {{{ (ok: bool), RET #ok; if ok then Q else emp }}} {{{ True }}}.”; single_inode_proof.v, line 458
    • Perennial example single async inode
      • specifies: single asynchronous inode append/flush
      • safety: operation and crash-recovery contracts
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 764 LOC in 1 .v file(s), scope src/program_proof/examples/single_async_inode_proof.v
      • source: src/program_proof/examples/single_async_inode_proof.v
      • source words: “Theorem wpc_SingleInode__Flush1 {k} (Q: iProp Σ) γdur γbuf blks l sz k’ : (S k < k’)%nat → {{{ “Hinode” ∷ is_single_inode γdur γbuf l sz k’ ∗ “Hlb” ∷ inode_current_lb γbuf blks }}} SingleInode__Flush #l @ (S k); ⊤ {{{ (ok: bool), RET #ok; if ok then inode_durable_lb γdur γbuf blks else emp }}} {{{ True }}}.”; single_async_inode_proof.v, line 739
    • Perennial example dir
      • specifies: concurrent crash-safe directory
      • safety: operation and crash-recovery contracts
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 1,227 LOC in 1 .v file(s), scope src/program_proof/examples/dir_proof.v
      • source: src/program_proof/examples/dir_proof.v
      • source words: “Theorem wpr_Open (d: ()) (sz: u64) σ0: (5 ≤ int.Z sz)%Z → dir_cinv (int.Z sz) σ0 true -∗ wpr NotStuck ⊤ (Open (disk_val d) #sz) (Open (disk_val d) #sz) (λ _, True%I) (λ _, True%I) (λ _ _, True%I).”; dir_proof.v, line 1202
    • Perennial example async mem alloc inode
      • specifies: inode using asynchronous in-memory allocation
      • safety: operation and crash-recovery contracts
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 1,111 LOC in 1 .v file(s), scope src/program_proof/examples/async_mem_alloc_inode_proof.v
      • source: src/program_proof/examples/async_mem_alloc_inode_proof.v
      • source words: “Theorem wpc_Inode__Append_triple {l P addr} {Palloc γalloc domain} (Q: iProp Σ) (Qc: iProp Σ) (alloc_ref: loc) q (b_s: Slice.t) (b0: Block) : inodeN ## allocN → {{{ “Hinode” ∷ is_inode l P addr ∗ “Hbdata” ∷ is_block b_s q b0 ∗ “HQc” ∷ (Q -∗ Qc) ∗ “#Halloc” ∷ is_allocator Palloc Ψ allocN alloc_ref domain γalloc ∗ “#Halloc_fupd” ∷ □ reserve_fupd (⊤ ∖ ↑allocN) Palloc ∗ “#Hfree_fupd” ∷ □ (∀ a, free_fupd (⊤ ∖ ↑allocN) Palloc a) ∗ “Hfupd” ∷ (Qc ∧ (∀ σ σ’ addr’, ⌜σ’ = set inode.blocks (λ bs, bs ++ [b0]) (set inode.addrs ({[addr’]} ∪.) σ)⌝ -∗ ⌜inode.wf σ⌝ -∗ ∀ s, ⌜s !! addr’ = Some block_reserved⌝ -∗ P σ ∗ ▷ Palloc s ={⊤ ∖ ↑allocN}=∗ P σ’ ∗ ▷ Palloc (<[addr’ := block_used]> s) ∗ Q)) }}} Inode__Append #l (slice_val b_s) #alloc_ref @ ⊤ {{{ (ok: bool), RET #ok; if ok then Q else emp }}} {{{ Qc }}}.”; async_mem_alloc_inode_proof.v, line 1030
    • Perennial example async mem alloc dir
      • specifies: directory using asynchronous in-memory allocation
      • safety: operation and crash-recovery contracts
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 1,273 LOC in 1 .v file(s), scope src/program_proof/examples/async_mem_alloc_dir_proof.v
      • source: src/program_proof/examples/async_mem_alloc_dir_proof.v
      • source words: “Theorem wpr_Open (d: ()) (sz: u64) σ0: (5 ≤ int.Z sz)%Z → dir_cinv (int.Z sz) σ0 true -∗ wpr NotStuck ⊤ (Open (disk_val d) #sz) (Open (disk_val d) #sz) (λ _, True%I) (λ _, True%I) (λ _ _, True%I).”; async_mem_alloc_dir_proof.v, line 1248
    • Perennial example indirect inode
      • specifies: indirect inode read/write protocol
      • safety: operation and crash-recovery contracts
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts with 13 active admission tokens in counted files; incomplete artifact; source inspection only
      • size: 1,354 LOC in 1 .v file(s), scope src/program_proof/examples/indirect_inode_proof.v
      • source: src/program_proof/examples/indirect_inode_proof.v
      • source words: “Theorem wp_Inode__mkHdr {Stk E} l (sz numInd : Z) allocedDirAddrs allocedIndAddrs direct_s indirect_s: (length(allocedDirAddrs) <= int.nat maxDirect ∧ (Z.of_nat (length(allocedIndAddrs))) = numInd ∧ sz <= MaxBlocks ∧ numInd <= maxIndirect) -> {{{ “direct” ∷ l ↦[Inode :: “direct”] (slice_val direct_s) ∗ “indirect” ∷ l ↦[Inode :: “indirect”] (slice_val indirect_s) ∗ “size” ∷ l ↦[Inode :: “size”] #sz ∗ “Hdirect” ∷ own_slice direct_s uint64T 1 allocedDirAddrs ∗ “Hindirect” ∷ own_slice indirect_s uint64T 1 allocedIndAddrs }}} Inode__mkHdr #l @ Stk; E {{{ s hdr, RET (slice_val s); is_block s 1 hdr ∗ “%Hencoded” ∷ ⌜block_encodes hdr ([EncUInt64 sz] ++ (EncUInt64 <> (replicate (int.nat (maxDirect - length allocedDirAddrs)) (U64 0))) ++ (EncUInt64 <> (replicate (int.nat (maxIndirect - length allocedIndAddrs)) (U64 0))) ++ [EncUInt64 numInd])⌝ ∗ “direct” ∷ l ↦[Inode :: “direct”] (slice_val direct_s) ∗ “indirect” ∷ l ↦[Inode :: “indirect”] (slice_val indirect_s) ∗ “size” ∷ l ↦[Inode :: “size”] #sz ∗ “Hdirect” ∷ own_slice direct_s uint64T 1 allocedDirAddrs ∗ “Hindirect” ∷ own_slice indirect_s uint64T 1 allocedIndAddrs }}}.”; indirect_inode_proof.v, line 1237
    • Perennial example indirect inode append
      • specifies: indirect inode append protocol
      • safety: operation and crash-recovery contracts
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts with 1 active admission tokens in counted files; incomplete artifact; source inspection only
      • size: 1,145 LOC in 1 .v file(s), scope src/program_proof/examples/indirect_inode_append_proof.v
      • source: src/program_proof/examples/indirect_inode_append_proof.v
      • source words: “Theorem wpc_Inode__Append {k} {l k’ P addr} {Palloc γalloc domain n} (alloc_ref: loc) q (b_s: Slice.t) (b0: Block) : (k < k’)%nat → nroot.@“readonly” ## allocN → nroot.@“readonly” ## inodeN → inodeN ## allocN → ∀ Φ Φc, “Hinode” ∷ is_inode inodeN l k’ P addr ∗ “Hbdata” ∷ is_block b_s q b0 ∗ “#Halloc” ∷ is_allocator Palloc Ψ allocN alloc_ref domain γalloc n ∗ “#Halloc_fupd” ∷ □ reserve_fupd (⊤ ∖ ↑allocN) Palloc ∗ “#Hfree_fupd” ∷ □ (∀ a, free_fupd (⊤ ∖ ↑allocN) Palloc a) ∗ “Hfupd” ∷ (Φc ∧ ▷ (Φ #false ∧ ∀ σ σ’ addr’, ⌜σ’ = set inode.blocks (λ bs, bs ++ [b0]) (set inode.addrs ({[addr’]} ∪.) σ)⌝ -∗ ⌜inode.wf σ⌝ -∗ ∀ s, ⌜s !! addr’ = Some block_reserved⌝ -∗ ▷ P σ ∗ ▷ Palloc s ={⊤ ∖ ↑allocN ∖ ↑inodeN}=∗ ▷ P σ’ ∗ ▷ Palloc (<[addr’ := block_used]> s) ∗ (Φc ∧ Φ #true))) -∗ WPC Inode__Append #l (slice_val b_s) #alloc_ref @ ⊤ {{ Φ }} {{ Φc }}.”; indirect_inode_append_proof.v, line 1113
    • Perennial example alloc crash
      • specifies: crash-safe allocation protocol
      • safety: operation and crash-recovery contracts
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 1,162 LOC in 1 .v file(s), scope src/program_proof/examples/alloc_crash_proof.v
      • source: src/program_proof/examples/alloc_crash_proof.v
      • source words: “Theorem wp_Free (Q: iProp Σ) E l d γ (a: u64) : ↑N ⊆ E → {{{ is_allocator l d γ ∗ reserved_block γ a (Ψ a) ∗ (∀ σ, ⌜ σ !! a = Some block_reserved ⌝ -∗ ▷ P σ -∗ |NC={E ∖↑N}=> ▷ P (<[ a := block_free ]> σ) ∗ Q) }}} Allocator__Free #l #a @ E {{{ RET #(); Q }}}.”; alloc_crash_proof.v, line 1046
    • Perennial example alloc
      • specifies: allocation protocol
      • safety: operation and crash-recovery contracts
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 303 LOC in 1 .v file(s), scope src/program_proof/examples/alloc_proof.v
      • source: src/program_proof/examples/alloc_proof.v
      • source words: “Theorem wp_Free (Q: iProp Σ) l γ (a: u64) : {{{ is_allocator l γ ∗ Ψ a ∗ alloc_used γ a ∗ (∀ σ σ’, ⌜σ’ = set alloc.used (λ used, used ∖ {[a]}) σ⌝ -∗ ⌜alloc.wf σ⌝ -∗ ▷ P σ ={⊤}=∗ ▷ P σ’ ∗ Q) }}} Allocator__Free #l #a {{{ RET #(); Q }}}.”; alloc_proof.v, line 247
    • Perennial example alloc proof simple.v
      • specifies: simple allocation protocol
      • safety: operation and crash-recovery contracts
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 272 LOC in 1 .v file(s), scope src/program_proof/examples/alloc_proof_simple.v
      • source: src/program_proof/examples/alloc_proof_simple.v
      • source words: “Theorem wp_crash_Free P Pc l (a: u64) : {{{ is_crash_allocator l P Pc ∗ crash_borrow (P {[a]}) (Pc {[a]}) }}} Allocator__Free #l #a {{{ RET #(); True }}}.”; alloc_proof_simple.v, line 262
    • Go channel
      • specifies: channel concurrent program
      • safety: channel/data-structure/client Hoare contracts
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 408 LOC in 1 .v file(s), scope new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel.v
      • source: new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel.v
      • source words: “Lemma wp_BroadcastExample : {{{ is_pkg_init channel_examples }}} @! channel_examples.BroadcastExample #() {{{ RET #(); True }}}.”; channel.v, line 361
    • Go channel examples
      • specifies: channel examples concurrent program
      • safety: channel/data-structure/client Hoare contracts
      • liveness: not found in this row
      • tool and evidence: implementation/specification present; no active lemma/theorem found in counted files; source inspection only
      • size: 13 LOC in 1 .v file(s), scope new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel_examples.v
      • source: new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel_examples.v
    • Go channel fibonacci
      • specifies: channel fibonacci concurrent program
      • safety: channel/data-structure/client Hoare contracts
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 196 LOC in 1 .v file(s), scope new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel_fibonacci.v
      • source: new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel_fibonacci.v
      • source words: “Lemma wp_fib_consumer: {{{ is_pkg_init channel_examples }}} @! channel_examples.fib_consumer #() {{{ sl, RET #(sl); sl ↦* (fib_list 10) }}}.”; channel_fibonacci.v, line 135
    • Go channel dsp
      • specifies: channel dsp concurrent program
      • safety: channel/data-structure/client Hoare contracts
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 388 LOC in 1 .v file(s), scope new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel_dsp.v
      • source: new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel_dsp.v
      • source words: “Lemma wp_makeGreeting : {{{ is_pkg_init channel_examples }}} @! channel_examples.makeGreeting #() {{{ RET #“Hello, World!”; True%I }}}.”; channel_dsp.v, line 358
    • Go channel google
      • specifies: channel google concurrent program
      • safety: channel/data-structure/client Hoare contracts
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 415 LOC in 1 .v file(s), scope new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel_google.v
      • source: new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel_google.v
      • source words: “Lemma wp_Google (q : go_string) : {{{ True }}} @! channel_examples.Google #q {{{ (sl : slice.t), RET #sl; ∃ xs, sl ↦* xs ∗ ⌜xs ≡ₚ google_expected q⌝ }}}.”; channel_google.v, line 165
    • Go channel higher order
      • specifies: channel higher order concurrent program
      • safety: channel/data-structure/client Hoare contracts
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 152 LOC in 1 .v file(s), scope new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel_higher_order.v
      • source: new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel_higher_order.v
      • source words: “Lemma wp_HigherOrderExample : {{{ is_pkg_init channel_examples }}} @! channel_examples.HigherOrderExample #() {{{ (s:slice.t), RET #s; s ↦* [“hello world”%go; “HELLO”%go; “world”%go] }}}.”; channel_higher_order.v, line 94
    • Go channel search replace
      • specifies: channel search replace concurrent program
      • safety: channel/data-structure/client Hoare contracts
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 240 LOC in 1 .v file(s), scope new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel_search_replace.v
      • source: new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel_search_replace.v
      • source words: “Lemma wp_SearchReplace (s: slice.t) (xs: list w64) (x y: w64) : {{{ is_pkg_init parallel_search_replace ∗ s ↦* xs ∗ ⌜ length xs ≤ 2^63 - 1000 ⌝ ∗ ⌜ length xs ≤ (2^31 - 1)1000 ⌝ }}} @! parallel_search_replace.SearchReplace #s #x #y {{{ RET #(); s ↦ (search_replace x y xs) }}}.”; channel_search_replace.v, line 129
    • Go channel select tricky examples
      • specifies: channel select tricky examples concurrent program
      • safety: channel/data-structure/client Hoare contracts
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 260 LOC in 1 .v file(s), scope new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel_select_tricky_examples.v
      • source: new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel_select_tricky_examples.v
      • source words: “Lemma wp_select_nb_full_buffer_not_ready : {{{ is_pkg_init channel_examples }}} @! channel_examples.select_nb_full_buffer_not_ready #() {{{ RET #(); True }}}.”; channel_select_tricky_examples.v, line 219
    • Go elimination stack
      • specifies: elimination stack concurrent program
      • safety: channel/data-structure/client Hoare contracts
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 474 LOC in 1 .v file(s), scope new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/elimination_stack.v
      • source: new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/elimination_stack.v
      • source words: “Lemma wp_EliminationStack__Pop γ s N : ∀ Φ, is_pkg_init elimination_stack ∗ is_EliminationStack s γ N -∗ (|={⊤∖↑N,∅}=> ∃ σ, ⟦σ⟧ ∗ (match σ with | [] => ⟦[]⟧ ={∅,⊤∖↑N}=∗ Φ (#“”, #false)%V | v :: σ => ⟦σ⟧ ={∅,⊤∖↑N}=∗ Φ (#v, #true)%V end)) -∗ WP s @! (go.PointerType elimination_stack.EliminationStack) @! “Pop” #() {{ Φ }}.”; elimination_stack.v, line 361
    • Go lock
      • specifies: lock concurrent program
      • safety: channel/data-structure/client Hoare contracts
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 122 LOC in 1 .v file(s), scope new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/lock.v
      • source: new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/lock.v
      • source words: “Lemma wp_Lock__LockWithTimeout γ (l : Lock.t) (R : iProp Σ) (d : time.Duration.t) : {{{ is_pkg_init pkg_id.lock ∗ is_Lock γ l R }}} l @! lock.Lock @! “LockWithTimeout” #d {{{ (b : bool), RET #b; if b then R else True }}}.”; lock.v, line 94
    • Go channel workq
      • specifies: workq concurrent program
      • safety: channel/session/client Hoare contracts
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 713 LOC in 1 .v file(s), scope new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel/workq.v
      • source: new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel/workq.v
      • source words: “Lemma wp_wordCount docs_sl docs : {{{ is_pkg_init workq ∗ “Hdocs” ∷ docs_sl ↦* docs }}} @! workq.wordCount #docs_sl {{{ RET #(W64 (sum_list (word_count <$> docs))); True }}}.”; workq.v, line 487
    • Go channel etcd session
      • specifies: etcd session concurrent program
      • safety: channel/session/client Hoare contracts
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 205 LOC in 1 .v file(s), scope new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel/etcd_session.v
      • source: new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel/etcd_session.v
      • source words: “Lemma waitSession A A’ {!ZeroVal A'} {!TypedPointsto A’} `{!IntoValTyped A’ A} cancel γcancel (Pcancel : A’ → _) : {{{ is_pkg_init etcd_session ∗ “#Hcancel” ∷ is_chan_bag γcancel cancel Pcancel }}} #(functions etcd_session.waitSession [A]) #cancel {{{ (err : error.t), RET #err; match err with | interface.nil => True | _ => (∃ a, Pcancel a) end }}}.”; etcd_session.v, line 167
    • Go channel idiom future
      • specifies: future channel protocol resource specification
      • safety: protocol send/receive/ownership rules
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 423 LOC in 1 .v file(s), scope new/golang/theory/chan/idioms/future.v
      • source: new/golang/theory/chan/idioms/future.v
      • source words: “Lemma wp_future_await γ ch (pending : list (V → iProp Σ)) : {{{ is_future γ ch ∗ Await γ pending }}} chan.receive t #ch {{{ (v : V) (P : V → iProp Σ) (pre post : list (V → iProp Σ)), RET (#v, #true); ⌜pending = pre ++ P :: post⌝ ∗ P v ∗ Await γ (pre ++ post) }}}.”; future.v, line 404
    • Go channel idiom spsc
      • specifies: spsc channel protocol resource specification
      • safety: protocol send/receive/ownership rules
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 668 LOC in 1 .v file(s), scope new/golang/theory/chan/idioms/spsc.v
      • source: new/golang/theory/chan/idioms/spsc.v
      • source words: “Lemma wp_spsc_close γ ch P R sent `[ct ↓u go.ChannelType dir t] : {{{ is_spsc γ ch P R ∗ spsc_producer γ sent ∗ R sent }}} #(functions go.close [ct]) #ch {{{ RET #(); True }}}.”; spsc.v, line 654
    • Go channel idiom broadcast
      • specifies: broadcast channel protocol resource specification
      • safety: protocol send/receive/ownership rules
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 186 LOC in 1 .v file(s), scope new/golang/theory/chan/idioms/broadcast.v
      • source: new/golang/theory/chan/idioms/broadcast.v
      • source words: “Lemma own_broadcast_chan_is_chan ch γ Q cl : own_broadcast_chan ch γ Q cl -∗ is_chan ch γ unit.”; broadcast.v, line 181
    • Go channel idiom lock
      • specifies: lock channel protocol resource specification
      • safety: protocol send/receive/ownership rules
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 248 LOC in 1 .v file(s), scope new/golang/theory/chan/idioms/lock.v
      • source: new/golang/theory/chan/idioms/lock.v
      • source words: “Lemma wp_lock_channel_unlock γ ch (R : iProp Σ) : {{{ is_lock_channel γ ch R ∗ R }}} chan.receive t #ch {{{ (v : V), RET (#v, #true); True }}}.”; lock.v, line 233
    • Go channel idiom handshake
      • specifies: handshake channel protocol resource specification
      • safety: protocol send/receive/ownership rules
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 152 LOC in 1 .v file(s), scope new/golang/theory/chan/idioms/handshake.v
      • source: new/golang/theory/chan/idioms/handshake.v
      • source words: “Lemma wp_handshake_send γ ch v P Q : {{{ is_handshake γ ch P Q ∗ P v }}} chan.send t #ch #v {{{ RET (#()); Q }}}.”; handshake.v, line 135
    • Go channel idiom bag
      • specifies: bag channel protocol resource specification
      • safety: protocol send/receive/ownership rules
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 281 LOC in 1 .v file(s), scope new/golang/theory/chan/idioms/bag.v
      • source: new/golang/theory/chan/idioms/bag.v
      • source words: “Lemma wp_bag_send γ ch v P : {{{ is_chan_bag γ ch P ∗ P v }}} chan.send t #ch #v {{{ RET #(); True }}}.”; bag.v, line 268
    • Go channel idiom mpmc
      • specifies: mpmc channel protocol resource specification
      • safety: protocol send/receive/ownership rules
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 1,022 LOC in 1 .v file(s), scope new/golang/theory/chan/idioms/mpmc.v
      • source: new/golang/theory/chan/idioms/mpmc.v
      • source words: “Lemma mpmc_get_final_resource γ ch (n_prod n_cons : nat) P R (consumers : list (gmultiset V)) : length consumers = n_cons → £ 1 -∗ is_mpmc γ ch n_prod n_cons P R -∗ is_closed γ -∗ ([∗ list] r_i ∈ consumers, mpmc_consumer γ r_i) ={⊤}=∗ R (foldr disj_union ∅ consumers).”; mpmc.v, line 967
    • etcd client model/spec
      • specifies: etcd client operations and abstract model
      • safety: partial model/specification and operation contracts; this row does not claim full production etcd verification
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts with 4 active admission tokens in counted files; incomplete artifact; source inspection only
      • size: 895 LOC in 6 .v file(s), scope new/proof/go_etcd_io/etcd/client/v3_proof
      • source: new/proof/go_etcd_io/etcd/client/v3_proof
      • source words: “Lemma test req γ : ⊢ ∀ Φ, (∃ (σ : EtcdState.t), ghost_var γ 1%Qp σ ∗ (∀ resp (σ’ : EtcdState.t), ghost_var γ 1%Qp σ’ -∗ Φ resp)) -∗ GrantSpec req γ Φ.”; spec.v, line 30
    • etcd lease protocol
      • specifies: lease/cache protocol definitions
      • safety: partial model/specification and operation contracts; this row does not claim full production etcd verification
      • liveness: not found in this row
      • tool and evidence: implementation/specification present; no active lemma/theorem found in counted files; source inspection only
      • size: 203 LOC in 1 .v file(s), scope new/proof/go_etcd_io/etcd/client/v3/leasing_proof
      • source: new/proof/go_etcd_io/etcd/client/v3/leasing_proof
    • etcd Raft protocol
      • specifies: Raft readonly and protocol proof definitions
      • safety: partial model/specification and operation contracts; this row does not claim full production etcd verification
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts with 16 active admission tokens in counted files; incomplete artifact; source inspection only
      • size: 1,160 LOC in 3 .v file(s), scope new/proof/go_etcd_io/raft/v3_proof
      • source: new/proof/go_etcd_io/raft/v3_proof
      • source words: “Lemma wp_raft__stepLeader_MsgReadIndex γ r (rf : raft.raft.t) (m : raftpb.Message.t) : {{{ “Hr” ∷ r ↦ rf ∗ “Hrf” ∷ own_raft γ rf ∗ “%HmType” ∷ ⌜ m.(raftpb.Message.Type’) = MsgReadIndex ⌝ }}} @! raft.stepLeader #r #m {{{ RET #(); True }}}.”; readonly.v, line 936

  • gaps and interpretation

    • these rows inventory concrete source directories and separately addressable client examples; supporting algebra/network semantics are not separate problem rows
    • overlapping sizes are intentional where a system-level directory and an independently named client/protocol share files; LOC must not be summed as unique project effort
    • no human effort figures were found in the inspected source material
    • no Isabelle/Lean cases are covered in this Coq slice
    • Aneris viewstamped replication and state-based PN-counter have code but no local proof; iterated ping-pong is a commented proof draft
    • Toychain eventual consensus assumes pending block deliveries are exhausted; eventual delivery was not proved in the quoted lemma
    • additional Perennial releases and projects such as gojournal-proof remain outside this inspected snapshot

Coq extra cases: causal stores and termination

  • scope

    • physical LOC includes blank lines and comments in the named recursive .v scopes; files may overlap between independently named clients
    • pinned source inspection, no proof builds executed; active local admission tokens detected after stripping nested Coq comments
    • examples already in coq_rows.md are not repeated; new source pointers were followed with GitHub API repository search because web search returned an HTTP 404

  • Coq / Chapar

    • Chapar replicated KV algorithm 1
      • specifies: causally consistent replicated key-value implementation, algorithm 1
      • safety: causal consistency of execution history
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 2,500 LOC in 1 .v file(s), scope theories/Algorithms/KVSAlg1.v
      • source: theories/Algorithms/KVSAlg1.v
      • source words: “Lemma CausallyConsistent: forall (p: Syntax.PProg)(h: list N.CExec.Label), N.CExec.history (N.CExec.init p) h -> exists (h’: list AExec.Label), AExec.history (AExec.init p) h’ /\ N.CExec.ext_hist h = AExec.ext_hist h’.”; KVSAlg1.v, line 2489
    • Chapar replicated KV algorithm 2
      • specifies: causally consistent replicated key-value implementation, algorithm 2
      • safety: causal consistency of execution history
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 5,286 LOC in 1 .v file(s), scope theories/Algorithms/KVSAlg2.v
      • source: theories/Algorithms/KVSAlg2.v
      • source words: “Lemma CausallyConsistent: forall (p: Syntax.PProg)(h: list N.CExec.Label), N.CExec.history (N.CExec.init p) h -> exists (h’: list AExec.Label), AExec.history (AExec.init p) h’ /\ N.CExec.ext_hist h = AExec.ext_hist h’.”; KVSAlg2.v, line 5275
    • Chapar replicated KV algorithm 3
      • specifies: causally consistent replicated key-value implementation, algorithm 3
      • safety: causal consistency of execution history
      • liveness: not found in this row
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 3,378 LOC in 1 .v file(s), scope theories/Algorithms/KVSAlg3.v
      • source: theories/Algorithms/KVSAlg3.v
      • source words: “Lemma CausallyConsistent: forall (p: Syntax.PProg)(h: list N.CExec.Label), N.CExec.history (N.CExec.init p) h -> exists (h’: list AExec.Label), AExec.history (AExec.init p) h’ /\ N.CExec.ext_hist h = AExec.ext_hist h’.”; KVSAlg3.v, line 3366
    • Chapar photo upload client
      • specifies: upload photo, then advertise post; readers must not see advertised photo missing
      • safety: client fault-freedom from causally-content program contract
      • liveness: not found in this row
      • tool and evidence: Coq proof scripts using reflective automatic client checking, with proved checking semantics; not only an external model-checker result; source inspection only
      • size: 250 LOC in 1 .v file(s), scope theories/Examples/Clients.v
      • source: theories/Examples/Clients.v
      • source words: “Lemma CauseConsistent_Prog_PhotoUpload: forall h n, Alg.CExec.history (Alg.CExec.init prog_photo_upload) h -> forall l, List.In l h -> l <> Alg.CExec.fault_label n.”; Clients.v, line 73
    • Chapar lost ring client
      • specifies: causal key-value lost-ring client program
      • safety: client fault-freedom from causally-content program contract
      • liveness: not found in this row
      • tool and evidence: Coq proof scripts using reflective automatic client checking, with proved checking semantics; not only an external model-checker result; source inspection only
      • size: 250 LOC in 1 .v file(s), scope theories/Examples/Clients.v
      • source: theories/Examples/Clients.v
      • source words: “Lemma CauseConsistent_Prog_LostRing: forall h n, Alg.CExec.history (Alg.CExec.init prog_lost_ring) h -> forall l, List.In l h -> l <> Alg.CExec.fault_label n.”; Clients.v, line 117
    • Chapar photo album client
      • specifies: causal key-value photo-album client program
      • safety: client fault-freedom from causally-content program contract
      • liveness: not found in this row
      • tool and evidence: Coq proof scripts using reflective automatic client checking, with proved checking semantics; not only an external model-checker result; source inspection only
      • size: 250 LOC in 1 .v file(s), scope theories/Examples/Clients.v
      • source: theories/Examples/Clients.v
      • source words: “Lemma CauseConsistent_Prog_PhotoAlbum: forall h n, Alg.CExec.history (Alg.CExec.init prog_photo_album) h -> forall l, List.In l h -> l <> Alg.CExec.fault_label n.”; Clients.v, line 153
    • Chapar linked-list client
      • specifies: writer inserts linked-list nodes while reader traverses distributed key-value list
      • safety: client fault-freedom under causal consistency
      • liveness: not found in this row
      • tool and evidence: Coq proof scripts using reflective automatic client checking, with proved checking semantics; source inspection only
      • size: 151 LOC in 1 .v file(s), scope theories/Examples/ListClient.v
      • source: theories/Examples/ListClient.v
      • source words: “Lemma CausallyContent_Prog1: CausallyContent prog1.”; ListClient.v, line 95

  • Coq / Trillium Fairis

    • choose-natural-number concurrent program
      • specifies: nondeterministic natural-number choice using shared memory
      • safety: program/model simulation
      • liveness: fair termination
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 387 LOC in 2 .v file(s), scope fairis/heap_lang/examples/choose_nat
      • source: fairis/heap_lang/examples/choose_nat
      • source words: “Theorem choose_nat_terminates l extr : trfirst extr = ([choose_nat_prog l #()], {| heap := {[l:=#-1]}; used_proph_id := ∅ |}) → extrace_fairly_terminating extr.”; choose_nat_adequacy.v, line 81
    • yes/no concurrent program
      • specifies: two concurrent yes/no workers and shared counter/state
      • safety: program/model simulation
      • liveness: termination under per-thread fair scheduling, with N > 1
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 716 LOC in 2 .v file(s), scope fairis/heap_lang/examples/yesno
      • source: fairis/heap_lang/examples/yesno
      • source words: “Theorem yesno_terminates (N : nat) (HN: N > 1) (extr : heap_lang_extrace) (Hvex : extrace_valid extr) (Hexfirst : (trfirst extr).1 = [start #N]): (∀ tid, fair_ex tid extr) -> terminating_trace extr.”; yesno_adequacy.v, line 223
    • even/odd counter workers
      • specifies: two workers increment shared counter when parity permits
      • safety: counter monotonicity
      • liveness: counter progresses under maximal execution and fair per-thread scheduling
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 996 LOC in 2 .v file(s), scope fairis/heap_lang/examples/even_odd
      • source: fairis/heap_lang/examples/even_odd
      • source words: “Theorem evenodd_ex_liveness (l:loc) (extr : heap_lang_extrace) : extrace_maximal extr → (∀ tid, fair_ex tid extr) → trfirst extr = ([start #l], {| heap := {[l:=#0]}; used_proph_id := ∅ |}) → evenodd_ex_progress l extr ∧ evenodd_ex_mono l extr.”; even_odd_adequacy.v, line 571

  • Coq / Fairneris source branch

    • retransmission protocol model
      • specifies: abstract sender/receiver protocol with repeated transmissions
      • safety: model transitions and reception conditions
      • liveness: receiver role terminates under the explicit mtrace_fair premise
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 451 LOC in 1 .v file(s), scope fairneris/examples/retransmit_model.v
      • source: fairneris/examples/retransmit_model.v
      • source words: “Lemma retransmit_fair_traces_terminate_aux mtr : (trfirst mtr).1.1 = Received → retransmit_terminating_role (inl Brole) mtr.”; retransmit_model.v, line 420
    • retransmission model in temporal logic
      • specifies: same retransmission protocol, LTL formulation of trace properties
      • safety: model/trace facts
      • liveness: eventual delivery/reception and receiver-role termination on fair traces
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 523 LOC in 1 .v file(s), scope fairneris/examples/retransmit_model_ltl.v
      • source: fairneris/examples/retransmit_model_ltl.v
      • source words: “Lemma retransmit_fair_traces_terminate mtr : mtrace_valid mtr → mtrace_fair mtr → retransmit_terminating_role (inl Brole) mtr.”; retransmit_model_ltl.v, line 507
    • no-drop/duplicate network implementation refinement
      • specifies: concrete network send/receive nodes connected to a Fairneris model
      • safety: continued simulation of implementation and abstract model
      • liveness: local simulation statement found; no standalone concrete termination theorem in this counted file
      • tool and evidence: Coq/Rocq proof scripts with 3 active admission tokens in counted files; incomplete artifact; source inspection only
      • size: 521 LOC in 1 .v file(s), scope fairneris/examples/no_drop_dup.v
      • source: fairneris/examples/no_drop_dup.v
      • source words: “Lemma no_drop_dup_continued_simulation shA shB : fairly_terminating (initial_state shA shB).”; no_drop_dup.v, line 482

  • Coq / Aneris source implementation

    • Stenning retransmission protocol implementation
      • specifies: sender/receiver retransmission code in OCaml
      • safety: no proved property found alongside this implementation in inspected master and fairneris-stenning branches
      • liveness: no local Stenning theorem found; paper claims are not substituted for proof source
      • tool and evidence: OCaml implementation present; Coq/Aneris repository, proof location unresolved
      • size: 47 physical LOC in ml_sources/examples/stenning/stenning_code.ml
      • source: ml_sources/examples/stenning/stenning_code.ml
      • source words: “let server_aux addr j0 =”; line 5

  • Rocq / Lawyer

    • Lawyer static-bound terminating worker
      • specifies: counter/worker with statically known bound
      • safety: program/model proof
      • liveness: termination with execution bound linear in N
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 309 LOC in 2 .v file(s), scope lawyer/examples/const_term
      • source: lawyer/examples/const_term
      • source words: “Theorem const_term_bound_termination N (prog := const_term N) (bound := (N + 2) * 10) (extr : heap_lang_extrace) (START: trfirst extr = ([prog #()], Build_state ∅ ∅)) (VALID: extrace_valid extr): trace_len_le extr (bound + 1).”; const_term_adequacy.v, line 52
    • Lawyer runtime-bound terminating worker
      • specifies: worker whose bound is obtained at runtime
      • safety: program/model proof
      • liveness: termination under fair scheduler
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 199 LOC in 2 .v file(s), scope lawyer/examples/rt_bound
      • source: lawyer/examples/rt_bound
      • source words: “Theorem rt_bound_termination (extr : heap_lang_extrace) (START: trfirst extr = ([rt_bound #()], Build_state ∅ ∅)) (VALID: extrace_valid extr): extrace_fairly_terminating extr.”; rt_bound_adequacy.v, line 69
    • Lawyer delaying lock-free counter client
      • specifies: concurrent counter and delaying worker
      • safety: program/model proof
      • liveness: client termination under any scheduler
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 539 LOC in 2 .v file(s), scope lawyer/examples/lf_counter
      • source: lawyer/examples/lf_counter
      • source words: “Theorem lf_counter_termination (extr : heap_lang_extrace) (START: trfirst extr = ([counter_client #()], Build_state ∅ ∅)) (VALID: extrace_valid extr): terminating_trace extr.”; lf_counter_adequacy.v, line 58
    • Lawyer finite even/odd workers
      • specifies: finite parity-directed concurrent workers
      • safety: program/model proof
      • liveness: fair termination
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 971 LOC in 2 .v file(s), scope lawyer/examples/eo_fin
      • source: lawyer/examples/eo_fin
      • source words: “Lemma eofin_terminates_impl (extr : heap_lang_extrace) (START: trfirst extr = ([start #(0%nat) #B], Build_state ∅ ∅)): extrace_fairly_terminating extr.”; eo_fin_adequacy.v, line 51
    • Lawyer nondeterministic blocking choice
      • specifies: blocking choice plus forked/parallel choice clients
      • safety: program/model proof
      • liveness: fair termination of blocking and parallel clients
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 995 LOC in 4 .v file(s), scope lawyer/examples/nondet
      • source: lawyer/examples/nondet
      • source words: “Theorem nondet_termination (extr : heap_lang_extrace) (START: trfirst extr = ([nondet #()], Build_state ∅ ∅)) (VALID: extrace_valid extr): extrace_fairly_terminating extr.”; nondet_adequacy.v, line 54
    • Lawyer ticket lock and releasing-lock clients
      • specifies: ticket lock, releasing-lock wrapper, closed and two-lock clients
      • safety: lock/resource specifications and proof scripts
      • liveness: fair termination of closed client and two-lock composition
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 3,528 LOC in 9 .v file(s), scope lawyer/examples/ticketlock
      • source: lawyer/examples/ticketlock
      • source words: “Lemma closed_program_terminates_impl (extr : heap_lang_extrace) (START: trfirst extr = ([client_prog RFLInstance’ #()], Build_state ∅ ∅)): extrace_fairly_terminating extr.”; closed_adequacy.v, line 169
    • Lawyer parallel nondeterministic choice
      • specifies: parallel composition of blocking-choice calls
      • safety: program/model proof
      • liveness: fair termination
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 462 LOC in 2 .v file(s), scope lawyer/examples/nondet/nondet_par_adequacy.v plus named companion files
      • source: lawyer/examples/nondet/nondet_par_adequacy.v
      • source words: “Theorem nondet_par_termination (extr : heap_lang_extrace) (START: trfirst extr = ([nondet_par #()], Build_state ∅ ∅)) (VALID: extrace_valid extr): extrace_fairly_terminating extr.”; nondet_par_adequacy.v, line 61
    • Lawyer two ticket-lock composition
      • specifies: client using two lock instances
      • safety: lock/client proof
      • liveness: fair termination
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 512 LOC in 2 .v file(s), scope lawyer/examples/ticketlock/two_locks_adequacy.v plus named companion files
      • source: lawyer/examples/ticketlock/two_locks_adequacy.v
      • source words: “Theorem two_locks_program_terminates: forall extr, trfirst extr = ([client_two RFLInstance’1 RFLInstance’2 #()], Build_state ∅ ∅) -> extrace_fairly_terminating extr.”; two_locks_adequacy.v, line 199
    • Lawyer wait-free atomic counter
      • specifies: counter increment operation
      • safety: operation specifications and client-validity conditions
      • liveness: wait freedom of increment
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 151 LOC in 2 .v file(s), scope lawyer/nonblocking/examples/counter
      • source: lawyer/nonblocking/examples/counter
      • source words: “Theorem counter_is_wait_free (l0: loc := Loc 0) : wait_free (incr l0) (counter_is_init_st l0) NotStuck any_arg.”; counter_adequacy.v, line 5
    • Lawyer wait-free reference allocation
      • specifies: reference creation operation
      • safety: operation specifications and client-validity conditions
      • liveness: wait freedom of allocation
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 134 LOC in 2 .v file(s), scope lawyer/nonblocking/examples/mk_ref
      • source: lawyer/nonblocking/examples/mk_ref
      • source words: “Theorem mk_ref_is_wait_free: wait_free mk_ref (fun _ => True) NotStuck any_arg.”; mk_ref_adequacy.v, line 5
    • Lawyer wait-free higher-order list map with increment
      • specifies: list map parameterized by a wait-free counter operation
      • safety: operation specifications and client-validity conditions
      • liveness: possibly-stuck wait freedom of list_map(incr)
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 549 LOC in 2 .v file(s), scope lawyer/nonblocking/examples/list_map
      • source: lawyer/nonblocking/examples/list_map
      • source words: “Theorem list_map_incr_is_wait_free (l0: loc := Loc 0) : wait_free (λ: “x”, hl_list_map_cur (incr l0) “x”)%V (counter_is_init_st l0) MaybeStuck any_arg.”; list_map_adequacy.v, line 8
    • Lawyer wait-free simple concurrent queue
      • specifies: queue enqueue/dequeue algorithm and concurrent wrapper clients
      • safety: operation specifications and client-validity conditions
      • liveness: restricted wait freedom, under the source token/client conditions
      • tool and evidence: Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only
      • size: 6,085 LOC in 17 .v file(s), scope lawyer/nonblocking/examples/queue
      • source: lawyer/nonblocking/examples/queue
      • source words: “Theorem simple_queue_is_restr_wait_free (sq: SimpleQueue) ph pfl: wait_free_restr (queue_ms sq) (is_init_queue_cfg sq ph pfl #0) NotStuck any_arg.”; simple_queue_adequacy.v, line 7

  • standalone GoKV source and proof location

    • no additional row: vRSM/vKV proof case is already covered by the Perennial simplepb row
    • README source words: “The proofs for all of this code are in the Perennial repository”; README
    • Go implementation is useful as a counterpart to the Coq proof; vrsm directory

  • remaining gaps

    • Stenning code was found, but proof directory was not found in master, fairneris-stenning or ecoop_artifact branches; the quoted retransmission-model proofs are different individually identified artifacts
    • fairness statements must retain their source assumptions; this survey does not claim liveness under arbitrary message loss
    • Lawyer source README lists six permitted classical/choice axioms for its checks; no independent assumptions printout was run

Dafny and Verus

Rows distinguish source proof artifacts from fresh verification runs. Counts are mechanically computed from tracked files at the linked commits. Component rows overlap system rows; do not sum their sizes. “No liveness theorem found” means inspection did not locate one, not a proof that none exists. Storage rows are explicitly adjacent crash protocols, rather than multi-node distributed algorithms.

  • Dafny / IronFleet

    • IronLock
      • Specifies: a distributed token/lock transferred between hosts
      • Safety: refines one serial history of lock holders
      • Liveness: no liveness theorem found in this service
      • Tool/result: Dafny theorem proof artifact; proof sources inspected, checker not rerun here
      • Size: 729 physical lines in 4 .dfy file(s) under ironfleet/src/Dafny/Distributed/Services/Lock; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Core system size: 1,988 physical .dfy lines in 16 files across Services/Lock, Protocol/Lock, Impl/Lock; excludes shared Common/Libraries and C# environment
      • Source: exact artifact; evidence: “s’.history == s.history + [new_lock_holder]” (source line); service folder size excludes its Protocol/Impl dependencies
    • IronRSL (Paxos replicated state machine)
      • Specifies: Paxos replication of an application state machine
      • Safety: implementation refines the abstract service state machine
      • Liveness: conditional request completion: valid behavior and live queues; non-Zeno time; bounded clock ambiguity; no overflow-protection activation; a sufficiently large live quorum executes periodically; client periodically retransmits a valid request without issuing a higher sequence number; bounded delivery between client and quorum after synchrony starts
      • Tool/result: Dafny theorem proof artifact; proof sources inspected, checker not rerun here
      • Size: 1,435 physical lines in 5 .dfy file(s) under ironfleet/src/Dafny/Distributed/Services/RSL; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Core system size: 34,890 physical .dfy lines in 128 files across Services/RSL, Protocol/RSL, Impl/RSL; excludes shared Common/Libraries and C# environment
      • Source: exact artifact; evidence: “predicate Service_Next(s:ServiceState, s’:ServiceState)” (source line); service folder size excludes its Protocol/Impl dependencies
      • Assumption evidence: “Overflow protection is never used” and “the persistent client never sends a request with a higher sequence number” (full liveness assumptions)
      • Safety boundary: linearizability of executed application operations; “the specification does not require exactly-once semantics” (service specification); applications are abstract/axiomatized: “function {:axiom} AppHandleRequest(m:AppState, request:AppRequest) : (AppState, AppReply)” (application interface)
    • IronSHT / IronKV
      • Specifies: a lease-based sharded key-value/hash-table service
      • Safety: implementation refines abstract Get/Set hash-table operations
      • Liveness: reliable delivery is proved separately below; do not read it as unconditional request completion
      • Tool/result: Dafny theorem proof artifact; proof sources inspected, checker not rerun here
      • Size: 2,439 physical lines in 8 .dfy file(s) under ironfleet/src/Dafny/Distributed/Services/SHT; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Core system size: 17,120 physical .dfy lines in 63 files across Services/SHT, Protocol/SHT, Impl/SHT, Protocol/LiveSHT, Impl/LiveSHT; excludes shared Common/Libraries and C# environment
      • Source: exact artifact; evidence: “predicate Set(h:Hashtable, h’:Hashtable, k:Key, ov:OptionalValue)” (source line); service folder size excludes its Protocol/Impl dependencies
    • IronRSL protocol and refinement
      • Specifies: Paxos roles and refinement of the distributed implementation
      • Safety: refinement to service specification
      • Liveness: conditional request completion: valid behavior and live queues; non-Zeno time; bounded clock ambiguity; no overflow-protection activation; a sufficiently large live quorum executes periodically; client periodically retransmits a valid request without issuing a higher sequence number; bounded delivery between client and quorum after synchrony starts
      • Tool/result: Dafny theorem proof artifact; proof sources inspected, checker not rerun here
      • Size: 19,116 physical lines in 76 .dfy file(s) under ironfleet/src/Dafny/Distributed/Protocol/RSL; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “Proof of liveness, specifically that if a client submits a request” (source line)
      • Assumption evidence: “Overflow protection is never used” and “the persistent client never sends a request with a higher sequence number” (full liveness assumptions)
      • Safety boundary: linearizability of executed application operations; “the specification does not require exactly-once semantics” (service specification); applications are abstract/axiomatized: “function {:axiom} AppHandleRequest(m:AppState, request:AppRequest) : (AppState, AppReply)” (application interface)
    • IronSHT protocol and refinement
      • Specifies: shard delegation, ownership and key-value operations
      • Safety: refinement to hash-table specification
      • Liveness: no separate protocol-wide request liveness theorem found
      • Tool/result: Dafny theorem proof artifact; proof sources inspected, checker not rerun here
      • Size: 5,013 physical lines in 14 .dfy file(s) under ironfleet/src/Dafny/Distributed/Protocol/SHT; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “Defines the protocol layer of our SHT system” (source line)
    • LiveSHT reliable-delivery layer
      • Specifies: message retransmission, delivery queues and scheduling
      • Safety: refines SHT; maintains reliable-delivery bookkeeping
      • Liveness: submitted messages eventually reach recipient processing queues under valid behavior, live queues, every host scheduling infinitely often, bounded administrative shard requests, and weak network fairness
      • Tool/result: Dafny theorem proof artifact; proof sources inspected, checker not rerun here
      • Size: 4,168 physical lines in 22 .dfy file(s) under ironfleet/src/Dafny/Distributed/Protocol/LiveSHT; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “that if a message is submitted to the reliable-delivery” (source line)
      • Assumption evidence: “Each host executes its scheduler infinitely often”, “Admin doesn’t send too many shard requests”, and “Messages sent infinitely often are delivered infinitely often” (full liveness assumptions)
    • IronLock protocol and refinement
      • Specifies: lock passing with intermediate protocol/history states
      • Safety: implementation refines abstract lock ownership history
      • Liveness: not found
      • Tool/result: Dafny theorem proof artifact; proof sources inspected, checker not rerun here
      • Size: 394 physical lines in 5 .dfy file(s) under ironfleet/src/Dafny/Distributed/Protocol/Lock; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “Proof that the implementation refines the specification” (source line)

  • Verus / Anvil and Welder

    • Anvil/Welder ReplicaSet
      • Specifies: desired number of matching owned Pods
      • Safety: controller request noninterference guarantee; own guarantee is established by CORE, while progress depends on rely conditions
      • Liveness: eventually reaches desired resource state and remains there when desired state stays fixed; fairness/environment and dependency assumptions apply
      • Tool/result: Verus theorem proof artifact (temporal logic embedding); proof sources inspected, checker not rerun here
      • Size: 10,144 physical lines in 25 .rs file(s) under src/controllers/vreplicaset_controller; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “pub open spec fn vrs_eventually_stable_reconciliation() -> TempPred {” (source line)
    • Anvil/Welder Deployment
      • Specifies: desired workload via managed ReplicaSets
      • Safety: controller request noninterference guarantee; own guarantee is established by CORE, while progress depends on rely conditions
      • Liveness: eventually reaches desired resource state and remains there when desired state stays fixed; fairness/environment and dependency assumptions apply
      • Tool/result: Verus theorem proof artifact (temporal logic embedding); proof sources inspected, checker not rerun here
      • Size: 12,923 physical lines in 30 .rs file(s) under src/controllers/vdeployment_controller; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “pub open spec fn composed_vd_eventually_stable_reconciliation() -> TempPred {” (source line)
    • Anvil/Welder StatefulSet
      • Specifies: ordinal Pods and persistent-volume claims
      • Safety: controller request noninterference guarantee; own guarantee is established by CORE, while progress depends on rely conditions
      • Liveness: eventually reaches desired resource state and remains there when desired state stays fixed; fairness/environment and dependency assumptions apply
      • Tool/result: Verus theorem proof artifact (temporal logic embedding); proof sources inspected, checker not rerun here
      • Size: 17,229 physical lines in 27 .rs file(s) under src/controllers/vstatefulset_controller; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “pub open spec fn vsts_eventually_stable_reconciliation() -> TempPred {” (source line)
    • Anvil/Welder RabbitMQ controller
      • Specifies: Kubernetes resources implementing a RabbitMQ cluster
      • Safety: controller request noninterference guarantee; own guarantee is established by CORE, while progress depends on rely conditions; StatefulSet replica count never decreases while the object persists
      • Liveness: eventually reaches desired resource state and remains there when desired state stays fixed; fairness/environment and dependency assumptions apply
      • Tool/result: Verus theorem proof artifact (temporal logic embedding); proof sources inspected, checker not rerun here
      • Size: 14,134 physical lines in 55 .rs file(s) under src/controllers/rabbitmq_controller; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “pub open spec fn rmq_composed_eventually_stable_reconciliation() -> TempPred {” (source line)
    • Welder Deployment + ReplicaSet composition
      • Specifies: Deployment progress depends on ReplicaSet reconciliation
      • Safety: all component guarantee conditions; proved guarantee-to-rely compatibility
      • Liveness: CORE establishes conditional eventually stable reconciliation for the composed controllers
      • Tool/result: Verus composition proof artifact; proof sources inspected, checker not rerun here
      • Size: 406 physical lines in 1 .rs file(s) under src/controllers/composition/compose_all.rs; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “pub proof fn vrs_vd_core_holds(cluster: CoreCluster)” (source line)
    • Welder RabbitMQ + StatefulSet composition
      • Specifies: RabbitMQ progress depends on StatefulSet reconciliation
      • Safety: all component guarantee conditions; proved guarantee-to-rely compatibility
      • Liveness: CORE establishes conditional eventually stable reconciliation for the composed controllers
      • Tool/result: Verus composition proof artifact; proof sources inspected, checker not rerun here
      • Size: 406 physical lines in 1 .rs file(s) under src/controllers/composition/compose_all.rs; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “pub proof fn vsts_rmq_core_holds(cluster: CoreCluster)” (source line)
    • Welder all-four-controller composition
      • Specifies: ReplicaSet, Deployment, StatefulSet and RabbitMQ coexist in one cluster
      • Safety: all component guarantee conditions; proved guarantee-to-rely compatibility
      • Liveness: CORE establishes conditional eventually stable reconciliation for the composed controllers
      • Tool/result: Verus composition proof artifact; proof sources inspected, checker not rerun here
      • Size: 406 physical lines in 1 .rs file(s) under src/controllers/composition/compose_all.rs; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “pub proof fn core_holds()” (source line)
    • Anvil OSDI24 ZooKeeper controller
      • Specifies: Kubernetes resource reconciliation for ZooKeeper controller
      • Safety: helper invariants/resource ownership and implementation-to-model agreement; not a generic service-level safety guarantee
      • Liveness: eventually stable resource matching for a stable desired state, under cluster model assumptions
      • Tool/result: Verus temporal theorem proof artifact; proof sources inspected, checker not rerun here
      • Size: 12,455 physical lines in 45 .rs file(s) under src/controller_examples/zookeeper_controller; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “always(lift_state(desired_state_is(zookeeper))).leads_to(always(lift_state(current_state_matches::(zookeeper))))” (source line)
    • Anvil OSDI24 RabbitMQ controller
      • Specifies: Kubernetes resource reconciliation for RabbitMQ controller
      • Safety: helper invariants/resource ownership and implementation-to-model agreement; not a generic service-level safety guarantee
      • Liveness: eventually stable resource matching for a stable desired state, under cluster model assumptions
      • Tool/result: Verus temporal theorem proof artifact; proof sources inspected, checker not rerun here
      • Size: 11,488 physical lines in 53 .rs file(s) under src/controller_examples/rabbitmq_controller; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “always(lift_state(desired_state_is(rabbitmq))).leads_to(always(lift_state(current_state_matches::(rabbitmq))))” (source line)
    • Anvil OSDI24 FluentBit controller
      • Specifies: Kubernetes resource reconciliation for FluentBit controller
      • Safety: helper invariants/resource ownership and implementation-to-model agreement; not a generic service-level safety guarantee
      • Liveness: eventually stable resource matching for a stable desired state, under cluster model assumptions
      • Tool/result: Verus temporal theorem proof artifact; proof sources inspected, checker not rerun here
      • Size: 8,529 physical lines in 40 .rs file(s) under src/controller_examples/fluent_controller/fluentbit; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “always(lift_state(desired_state_is(fb))).leads_to(always(lift_state(current_state_matches::(fb))))” (source line)
    • Anvil OSDI24 FluentBit configuration controller
      • Specifies: Kubernetes resource reconciliation for FluentBit configuration controller
      • Safety: helper invariants/resource ownership and implementation-to-model agreement; not a generic service-level safety guarantee
      • Liveness: eventually stable resource matching for a stable desired state, under cluster model assumptions
      • Tool/result: Verus temporal theorem proof artifact; proof sources inspected, checker not rerun here
      • Size: 4,324 physical lines in 29 .rs file(s) under src/controller_examples/fluent_controller/fluentbit_config; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “always(lift_state(desired_state_is(fbc))).leads_to(always(lift_state(current_state_matches::(fbc))))” (source line)

  • Verus / verified system repositories

    • IronSHT Rust host-program port
      • Specifies: Rust implementation of the IronFleet SHT host state machine
      • Safety: implementation-level host correctness only; distributed refinement layer explicitly omitted
      • Liveness: no distributed liveness proof in this port
      • Tool/result: Verus host proof artifact; proof sources inspected, checker not rerun here
      • Size: 10,923 physical lines in 34 .rs file(s) under ironsht/src; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “This repository doesn’t replicate” (source line)
    • Verified Node Replication
      • Specifies: concurrent replicated in-memory data structure using log and flat combining
      • Safety: linearization/refinement to an asynchronous singleton
      • Liveness: no termination/starvation-freedom theorem found
      • Tool/result: Verus implementation and refinement proof artifact; proof sources inspected, checker not rerun here
      • Size: 11,483 physical lines in 18 .rs file(s) under verified-node-replication/src; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “b.wf() && behavior_equiv(a, b) && state_refinement_relation(” (source line)
    • NR simple-log specification
      • Specifies: abstract log of updates and reads
      • Safety: state-machine invariants and read/update consistency
      • Liveness: not stated in this artifact
      • Tool/result: Verus state-machine/refinement proof artifact; proof sources inspected, checker not rerun here
      • Size: 341 physical lines in 1 .rs file(s) under verified-node-replication/src/spec/simple_log.rs; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “SimpleLog” (source line)
    • NR unbounded-log protocol
      • Specifies: replica execution against an unbounded shared log
      • Safety: log/replica invariants
      • Liveness: not stated in this artifact
      • Tool/result: Verus state-machine/refinement proof artifact; proof sources inspected, checker not rerun here
      • Size: 2,063 physical lines in 1 .rs file(s) under verified-node-replication/src/spec/unbounded_log.rs; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “UnboundedLog” (source line)
    • NR unbounded-to-simple log refinement
      • Specifies: refinement between two log models
      • Safety: observable operations preserve the simpler model
      • Liveness: not stated in this artifact
      • Tool/result: Verus state-machine/refinement proof artifact; proof sources inspected, checker not rerun here
      • Size: 516 physical lines in 1 .rs file(s) under verified-node-replication/src/spec/unbounded_log_refines_simplelog.rs; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “refines” (source line)
    • NR cyclic buffer
      • Specifies: bounded log with multiple readers and writers
      • Safety: safe reservation, publication and reclamation with reader progress
      • Liveness: not stated in this artifact
      • Tool/result: Verus state-machine/refinement proof artifact; proof sources inspected, checker not rerun here
      • Size: 890 physical lines in 1 .rs file(s) under verified-node-replication/src/spec/cyclicbuffer.rs; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “Log space can be reclaimed once all readers have advanced their read pointers accordingly.” (source line)
    • NR flat combiner
      • Specifies: clients post requests; combiner batches operations
      • Safety: request/response ownership and client/combiner invariants
      • Liveness: not stated in this artifact
      • Tool/result: Verus state-machine/refinement proof artifact; proof sources inspected, checker not rerun here
      • Size: 408 physical lines in 1 .rs file(s) under verified-node-replication/src/spec/flat_combiner.rs; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “// The flat combiner state machine” (source line)
    • NR readers-writer lock
      • Specifies: exclusive writer and distributed reader bookkeeping
      • Safety: shared readers agree with storage; exclusive access controls storage
      • Liveness: not stated in this artifact
      • Tool/result: Verus state-machine/refinement proof artifact; proof sources inspected, checker not rerun here
      • Size: 307 physical lines in 1 .rs file(s) under verified-node-replication/src/spec/rwlock.rs; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “#[invariant]” (source line)
    • mimalloc-derived concurrent allocator
      • Specifies: multithreaded allocator with thread-owned pages and remote frees
      • Safety: ownership tokens, valid page/block state and safe cross-thread free-list transfer; platform/thread-id functions are trusted
      • Liveness: no temporal progress theorem located
      • Tool/result: Verus implementation/proof artifact; proof sources inspected, checker not rerun here
      • Size: 24,418 physical lines in 28 .rs file(s) under verus-mimalloc; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “ * linked_list.rs - Implements the free list (including atomic free list and normal free lists)” (source line)
    • allocator ownership/remote-free protocol
      • Specifies: thread, segment, page and block ownership state machine
      • Safety: reservation and ownership invariants across thread/page transitions
      • Liveness: not stated
      • Tool/result: Verus tokenized-state-machine proof artifact; proof sources inspected, checker not rerun here
      • Size: 1,664 physical lines in 1 .rs file(s) under verus-mimalloc/tokens.rs; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “tokenized_state_machine!{ Mim {” (source line)
    • allocator atomic free-list protocol
      • Specifies: cross-thread transfer of freed blocks in atomic linked lists
      • Safety: list shape and allocation token agreement
      • Liveness: not stated
      • Tool/result: Verus concurrent implementation/proof artifact; proof sources inspected, checker not rerun here
      • Size: 2,245 physical lines in 1 .rs file(s) under verus-mimalloc/linked_list.rs; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “ * linked_list.rs - Implements the free list (including atomic free list and normal free lists)” (source line)

  • Verus / storage crash protocols (adjacent scope)

    • pmemlog crash-consistent append-only log
      • Specifies: persistent-memory append-only log
      • Safety: append-only abstract behavior across crashes; metadata corruption detection
      • Liveness: none stated in repository README
      • Tool/result: Verus proof artifact; proof sources inspected, checker not rerun here
      • Size: 3,415 physical lines in 9 .rs file(s) under pmemlog/src; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “* pmemlog implements a persistent-memory append-only log. It handles crash” (source line)
    • multilog atomic append protocol
      • Specifies: transactions appending to multiple persistent-memory logs
      • Safety: atomic commits across logs despite crashes
      • Liveness: none stated in repository README
      • Tool/result: Verus proof artifact; proof sources inspected, checker not rerun here
      • Size: 11,332 physical lines in 23 .rs file(s) under multilog/multilog/src; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “ atomically committing appends across those logs.” (source line)
    • CapybaraKV persistent key-value store
      • Specifies: persistent-memory key-value store
      • Safety: crash consistency and bit-corruption handling
      • Liveness: none stated in repository README
      • Tool/result: Verus proof artifact; proof sources inspected, checker not rerun here
      • Size: 33,702 physical lines in 95 .rs file(s) under capybaraKV/capybarakv/src; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “* capybaraKV is a persistent-memory key-value store, handling crash” (source line)

  • Dafny / persistent notary protocol

    • CapybaraNS
      • Specifies: persistent notary associating increasing counter values with messages and signing them
      • Safety: successful advance increments counter by one; signatures bind counter and last message; crash/corruption handling
      • Liveness: no temporal liveness theorem found
      • Tool/result: Dafny proof artifact; proof sources inspected, checker not rerun here
      • Size: 2,283 physical lines in 12 .dfy file(s) under capybaraNS/src; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “&& state’.counter as int == state.counter as int + 1” (source line)

  • Verus / concrete concurrency and distributed examples

    • ring leader election
      • Specifies: max-ID messages around a ring
      • Safety: at most one leader
      • Liveness: no temporal progress theorem stated
      • Tool/result: Verus proof artifact; proof sources inspected, checker not rerun here
      • Size: 182 physical lines in 1 .rs file(s) under examples/state_machines/leader_election_complete.rs; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “self.is_leader(i) && self.is_leader(j) ==> i == j” (source line)
    • Peterson mutual exclusion
      • Specifies: two-thread flag-and-turn lock
      • Safety: never both threads in critical section
      • Liveness: no temporal progress theorem stated
      • Tool/result: Verus proof artifact; proof sources inspected, checker not rerun here
      • Size: 176 physical lines in 1 .rs file(s) under examples/state_machines/petersons_algorithm.rs; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “&&& !(self.thread_0 === ThreadState::Critical && self.thread_1 === ThreadState::Critical)” (source line)
    • distributed readers-writer lock
      • Specifies: lock with a collection of reference counters
      • Safety: exclusive writer ownership and consistency of distributed reader counts
      • Liveness: no temporal progress theorem stated
      • Tool/result: Verus proof artifact; proof sources inspected, checker not rerun here
      • Size: 407 physical lines in 1 .rs file(s) under examples/state_machines/dist_rwlock.rs; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “pub fn shared_counts_agree(&self) -> bool {” (source line)
    • tokenized readers-writer lock
      • Specifies: reader/writer flag state machine
      • Safety: reader-count/storage agreement and exclusive writer permission
      • Liveness: no temporal progress theorem stated
      • Tool/result: Verus proof artifact; proof sources inspected, checker not rerun here
      • Size: 197 physical lines in 1 .rs file(s) under examples/state_machines/rwlock.rs; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “pub fn count_matches(&self) -> bool {” (source line)
    • flat combining
      • Specifies: clients submit requests into slots for a combiner
      • Safety: request/response correspondence and token ownership
      • Liveness: no temporal progress theorem stated
      • Tool/result: Verus proof artifact; proof sources inspected, checker not rerun here
      • Size: 461 physical lines in 1 .rs file(s) under examples/state_machines/flat_combine.rs; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “pub fn request_stored_inv” (source line)
    • atomic reference counting
      • Specifies: reference-counted shared allocation
      • Safety: count matches readers; valid readers retain stored allocation
      • Liveness: no temporal progress theorem stated
      • Tool/result: Verus proof artifact; proof sources inspected, checker not rerun here
      • Size: 331 physical lines in 1 .rs file(s) under examples/state_machines/arc.rs; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “pub fn counter_agrees_reader_count” (source line); caveat: source explicitly uses assume(count < 100000000) for reference-count overflow
    • counting permissions
      • Specifies: split/recombine shared read permissions
      • Safety: read/write modes control exclusive stored value
      • Liveness: no temporal progress theorem stated
      • Tool/result: Verus proof artifact; proof sources inspected, checker not rerun here
      • Size: 267 physical lines in 1 .rs file(s) under examples/state_machines/counting.rs; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “pub spec fn main_inv” (source line)
    • interning with shared fragments
      • Specifies: canonical values and fragment handles
      • Safety: equal handles iff equal values; stored entries distinct
      • Liveness: no temporal progress theorem stated
      • Tool/result: Verus proof artifact; proof sources inspected, checker not rerun here
      • Size: 293 physical lines in 1 .rs file(s) under examples/state_machines/interner.rs; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “assert((idx1 == idx2) <==> (val1 === val2));” (source line)
    • SPSC FIFO queue
      • Specifies: single-producer/single-consumer ring-buffer queue
      • Safety: producer and consumer do not overlap occupied cells; in-bounds pointers
      • Liveness: no temporal progress theorem stated
      • Tool/result: Verus proof artifact; proof sources inspected, checker not rerun here
      • Size: 766 physical lines in 1 .rs file(s) under examples/state_machines/tutorial/fifo.rs; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “pub fn not_overlapping(&self) -> bool {” (source line)
    • two-thread counter
      • Specifies: two atomic increments and joins
      • Safety: final observed count is 2 after joining both threads
      • Liveness: no temporal progress theorem stated
      • Tool/result: Verus proof artifact; proof sources inspected, checker not rerun here
      • Size: 209 physical lines in 1 .rs file(s) under examples/state_machines/tutorial/counting_to_2.rs; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “assert(x == 2);” (source line)
    • N-thread counter implementation
      • Specifies: N atomic increments and joins
      • Safety: final observed count equals number of threads
      • Liveness: no temporal progress theorem stated
      • Tool/result: Verus proof artifact; proof sources inspected, checker not rerun here
      • Size: 224 physical lines in 1 .rs file(s) under examples/state_machines/tutorial/counting_to_n.rs; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “assert(x == num_threads);” (source line)
    • N-thread counter abstract model
      • Specifies: atomic increment state machine
      • Safety: counter equals number of completed increments
      • Liveness: no temporal progress theorem stated
      • Tool/result: Verus proof artifact; proof sources inspected, checker not rerun here
      • Size: 62 physical lines in 1 .rs file(s) under examples/state_machines/tutorial/counting_to_n_atomic.rs; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “assert(pre.counter == pre.num_threads);” (source line)
    • reference counting (non-atomic)
      • Specifies: allocation shared with cloned reference handles
      • Safety: reference count matches permissions; deallocate only at final reference
      • Liveness: no temporal progress theorem stated
      • Tool/result: Verus proof artifact; proof sources inspected, checker not rerun here
      • Size: 335 physical lines in 1 .rs file(s) under examples/state_machines/tutorial/rc.rs; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “pub fn counter_agrees_reader_count” (source line); caveat: source explicitly uses assume(count < 100000000) for reference-count overflow
    • RefCell dynamic borrowing
      • Specifies: runtime shared/mutable borrow flag protocol
      • Safety: exclusive mutable borrow or matching shared borrow permissions
      • Liveness: no temporal progress theorem stated
      • Tool/result: Verus proof artifact; proof sources inspected, checker not rerun here
      • Size: 435 physical lines in 1 .rs file(s) under examples/state_machines/tutorial/ref_cell.rs; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “pub fn flag_inv” (source line)
    • spin lock with explicit atomic permissions
      • Specifies: CAS-protected mutable cell
      • Safety: unique cell permission while lock held
      • Liveness: no temporal progress theorem stated
      • Tool/result: Verus proof artifact; proof sources inspected, checker not rerun here
      • Size: 101 physical lines in 1 .rs file(s) under examples/basic_lock1.rs; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “impl InvariantPredicate” (source line)
    • spin lock with atomic ghost state
      • Specifies: CAS-protected mutable cell
      • Safety: lock flag corresponds to stored cell permission
      • Liveness: no temporal progress theorem stated
      • Tool/result: Verus proof artifact; proof sources inspected, checker not rerun here
      • Size: 77 physical lines in 1 .rs file(s) under examples/basic_lock2.rs; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “pub atomic: AtomicBool” (source line)
    • atomic ghost spin lock
      • Specifies: atomic boolean protecting optional value
      • Safety: flag/value ownership invariant
      • Liveness: no temporal progress theorem stated
      • Tool/result: Verus proof artifact; proof sources inspected, checker not rerun here
      • Size: 139 physical lines in 1 .rs file(s) under examples/atomics.rs; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “b === t is Some” (source line)
    • vstd readers-writer lock use
      • Specifies: clients acquire/release library lock
      • Safety: only invariant-satisfying values stored
      • Liveness: no temporal progress theorem stated
      • Tool/result: Verus proof artifact; proof sources inspected, checker not rerun here
      • Size: 65 physical lines in 1 .rs file(s) under examples/rwlock_vstd.rs; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “let lock = RwLock::<u64, spec_fn(u64) -> bool>::new(5, Ghost(|v| v == 5 || v == 13));” (source line)
    • storage-cache readers-writer protocol
      • Specifies: cache bucket loading, shared reads, writeback and exclusive access
      • Safety: bucket/reference-count/storage invariants
      • Liveness: no temporal progress theorem stated
      • Tool/result: Verus experimental specification/proof source; test harness explicitly marks it ignored; successful machine checking not established; proof sources inspected, checker not rerun here
      • Size: 1,180 physical lines in 1 .rs file(s) under examples/scache/rwlock.rs; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “pub spec fn ref_count_invariant” (source line)
    • authoritative/fragment disk permissions
      • Specifies: ghost map representing disk with fragments
      • Safety: fragment permissions agree with authoritative map
      • Liveness: no temporal progress theorem stated
      • Tool/result: Verus experimental specification/proof source; test harness explicitly marks it ignored; successful machine checking not established; proof sources inspected, checker not rerun here
      • Size: 294 physical lines in 1 .rs file(s) under examples/state_machines/disk_example.rs; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “AuthFrag” (source line)
    • concurrent lazy initialization
      • Specifies: once-only initialization shared between threads
      • Safety: 0/1/2 atomic state matches uninitialized/initializing/initialized cell ownership
      • Liveness: no termination theorem for waiting on initializer
      • Tool/result: Verus atomic invariant proof artifact; proof sources inspected, checker not rerun here
      • Size: 173 physical lines in 1 .rs file(s) under examples/statics.rs; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “GhostState::Initialized(points_to) => {” (source line)

  • Verus / ghost coordination protocols

    • agreement resource
      • Specifies: constant-value knowledge shared across threads
      • Safety: resources for the same instance agree on value
      • Liveness: no eventual-completion theorem stated
      • Tool/result: Verus ghost proof API artifact; proof sources inspected, checker not rerun here
      • Size: 168 physical lines in 1 .rs file(s) under examples/pcm/agreement.rs; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “//! An agreement resource constitutes knowledge of a constant value.” (source line)
    • append-only log resource
      • Specifies: split append authority and shared prefix knowledge
      • Safety: appends preserve known prefixes
      • Liveness: no eventual-completion theorem stated
      • Tool/result: Verus ghost proof API artifact; proof sources inspected, checker not rerun here
      • Size: 293 physical lines in 1 .rs file(s) under examples/pcm/log.rs; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “pub proof fn deduce_prefix_relation” (source line)
    • monotonic counter resource
      • Specifies: split increment authority and shared lower-bound knowledge
      • Safety: counter only increases and lower bounds remain valid
      • Liveness: no eventual-completion theorem stated
      • Tool/result: Verus ghost proof API artifact; proof sources inspected, checker not rerun here
      • Size: 356 physical lines in 1 .rs file(s) under examples/pcm/monotonic_counter.rs; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “pub proof fn lemma_lower_bound” (source line)
    • one-shot completion resource
      • Specifies: split one-time completion authority
      • Safety: completion cannot be undone; halves combine into authority
      • Liveness: no eventual-completion theorem stated
      • Tool/result: Verus ghost proof API artifact; proof sources inspected, checker not rerun here
      • Size: 284 physical lines in 1 .rs file(s) under examples/pcm/oneshot.rs; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “pub proof fn perform_using_two_halves” (source line)

  • Dafny / remote attestation protocols

    • Ironclad remote notary
      • Specifies: remote signed monotonically increasing counter associated with messages
      • Safety: counter increments by one and returned statement/signature bind message to new counter
      • Liveness: no temporal progress theorem located
      • Tool/result: Dafny proof artifact in verified Ironclad stack; proof sources inspected, checker not rerun here
      • Size: 743 physical lines in 8 .dfy file(s) under ironclad-apps/src/Dafny/Apps/Notary; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “out_state.counter == in_state.counter + 1 &&” (source line)
    • Ironclad TrInc counter attestation
      • Specifies: authorized per-client monotonic counters and signed attestations
      • Safety: only authorized signatures advance counters; counters cannot decrease; attestation binds old/new value and message
      • Liveness: no temporal progress theorem located
      • Tool/result: Dafny proof artifact in verified Ironclad stack; proof sources inspected, checker not rerun here
      • Size: 1,441 physical lines in 7 .dfy file(s) under ironclad-apps/src/Dafny/Apps/TrInc; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded
      • Source: exact artifact; evidence: “in_state.counters[counter_index_in].counter_value <= new_counter_value_in &&” (source line)

  • Coverage and gaps

    • 60 rows; public sources and local clones inspected; no PDFs downloaded in this repository-focused slice
    • verus-lang/verified-storage did not exist at lookup; GitHub repository search located microsoft/verified-storage, whose README says “This repository contains code for verified storage systems” (README)
    • Anvil main omits the old ZooKeeper/FluentBit examples; the OSDI24 artifact commit retains them and was inspected separately
    • IronRSL Counter and KV C# application wrappers are examples atop the verified replication library; not counted as independently proved protocols: README says “IronRSL-Counter and IronRSL-KV are examples showing how to write a service in C#” (README); CODE.md labels their clients “Unverified C# client”
    • Generic arithmetic/ADT Verus examples, unverified tutorial variants, topological sort, and primitive-cell syntax demos are outside concurrent/distributed-protocol scope
    • Ghost resource APIs are listed separately because they specify shared authority, not a network implementation
    • PoWER API soundness arguments are verification-method proofs rather than a concrete protocol case, so the storage rows do not count them separately
    • Proof presence does not establish that every declaration is proved: platform/network/crash models and explicit assumptions remain trusted; ARC/Rc overflow assumptions and ignored experimental examples are marked in their rows

Isabelle and Lean

Isabelle/HOL source cases

Property descriptions are plain-English interpretations of the linked declarations. Counts include comments and blank lines. A source theorem is evidence of a proof artifact, not a successful build in this inventory. A lexical omission scan can miss imported axioms and can match prose.

  • Heard-Of / Ate

    • specified: round-based fault-tolerant consensus under the algorithm’s communication predicates
    • safety: agreement and validity: correct decisions do not conflict and satisfy the input restriction
    • liveness: termination under the stated heard-of communication predicates
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here; explicit axioms found
    • size: 1,041 physical lines across 2 .thy files in this directory; imports outside this scope excluded
    • source: exact directory
    • provenance: AFP entry “Verifying Fault-Tolerant Distributed Algorithms in the Heard-Of Model”, dated 2012-07-27; authors Henri Debrat, Stephan Merz; metadata
    • proof statement excerpt: theorem ate_agreement: assumes run: "SHORun Ate_M rho HOs SHOs" and comm: "\<forall>r. SHOcommPerRd Ate_M (HOs r) (SHOs r)" and p: "decide (rho m p) = Some v" and q: "decide (rho n q) = Some w" shows "w = v" (full source statement)
    • proof statement excerpt: theorem ate_validity: assumes run: "SHORun Ate_M rho HOs SHOs" and comm: "\<forall>r. SHOcommPerRd Ate_M (HOs r) (SHOs r)" and initv: "\<forall>q. x (rho 0 q) = v" and dp: "decide (rho r p) = Some w" shows "w = v" (full source statement)
    • proof statement excerpt: theorem ate_termination: assumes run: "SHORun Ate_M rho HOs SHOs" and commR: "\<forall>r. (SHOcommPerRd::((Proc, 'val::linorder pstate, 'val) SHOMachine) \<Rightarrow> (Proc HO) \<Rightarrow> (Proc HO) \<Rightarrow> bool) Ate_M (HOs r) (SHOs r)" and commG: "SHOcommGlobal Ate_M HOs SHOs" shows "\<exists>r v. decide (rho r p) = Some v" (full source statement)
    • axiom evidence: axiomatization where Proc_finite: "OFCLASS(Proc, finite_class)" (source line); 1 matching source lines in this row’s scope (lexical scan, not a dependency audit)

  • Heard-Of / Ute

    • specified: round-based fault-tolerant consensus under the algorithm’s communication predicates
    • safety: agreement and validity: correct decisions do not conflict and satisfy the input restriction
    • liveness: termination under the stated heard-of communication predicates
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here; explicit axioms found
    • size: 1,394 physical lines across 2 .thy files in this directory; imports outside this scope excluded
    • source: exact directory
    • provenance: AFP entry “Verifying Fault-Tolerant Distributed Algorithms in the Heard-Of Model”, dated 2012-07-27; authors Henri Debrat, Stephan Merz; metadata
    • proof statement excerpt: theorem ute_agreement: assumes run: "SHORun Ute_M rho HOs SHOs" and comm: "\<forall>r. SHOcommPerRd Ute_M (HOs r) (SHOs r)" and p: "decide (rho m p) = Some v" and q: "decide (rho n q) = Some w" shows "v = w" (full source statement)
    • proof statement excerpt: theorem ute_validity: assumes run: "SHORun Ute_M rho HOs SHOs" and comm: "\<forall>r. SHOcommPerRd Ute_M (HOs r) (SHOs r)" and init: "\<forall>p. x (rho 0 p) = v" and dw: "decide (rho r p) = Some w" shows "v = w" (full source statement)
    • proof statement excerpt: theorem ute_termination: assumes run: "SHORun Ute_M rho HOs SHOs" and commR: "\<forall>r. SHOcommPerRd Ute_M (HOs r) (SHOs r)" and commG: "SHOcommGlobal Ute_M HOs SHOs" shows "\<exists>r v. decide (rho r p) = Some v" (full source statement)
    • axiom evidence: axiomatization where Proc_finite: "OFCLASS(Proc, finite_class)" (source line); 1 matching source lines in this row’s scope (lexical scan, not a dependency audit)

  • Heard-Of / UniformVoting

    • specified: round-based fault-tolerant consensus under the algorithm’s communication predicates
    • safety: agreement and validity: correct decisions do not conflict and satisfy the input restriction
    • liveness: termination under the stated heard-of communication predicates
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here; explicit axioms found
    • size: 933 physical lines across 2 .thy files in this directory; imports outside this scope excluded
    • source: exact directory
    • provenance: AFP entry “Verifying Fault-Tolerant Distributed Algorithms in the Heard-Of Model”, dated 2012-07-27; authors Henri Debrat, Stephan Merz; metadata
    • proof statement excerpt: theorem uv_agreement: assumes run: "HORun UV_M rho HOs" and com: "\<forall>r. HOcommPerRd UV_M (HOs r)" and p: "decide (rho m p) = Some v" and q: "decide (rho n q) = Some w" shows "v = w" (full source statement)
    • proof statement excerpt: theorem uv_termination: assumes run: "HORun UV_M rho HOs" and commR: "\<forall>r. HOcommPerRd UV_M (HOs r)" and commG: "HOcommGlobal UV_M HOs" shows "\<exists>r v. decide (rho r p) = Some v" (full source statement)
    • axiom evidence: axiomatization where Proc_finite: "OFCLASS(Proc, finite_class)" (source line); 1 matching source lines in this row’s scope (lexical scan, not a dependency audit)

  • Heard-Of / OneThirdRule

    • specified: round-based fault-tolerant consensus under the algorithm’s communication predicates
    • safety: agreement and validity: correct decisions do not conflict and satisfy the input restriction
    • liveness: termination under the stated heard-of communication predicates
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here; explicit axioms found
    • size: 708 physical lines across 2 .thy files in this directory; imports outside this scope excluded
    • source: exact directory
    • provenance: AFP entry “Verifying Fault-Tolerant Distributed Algorithms in the Heard-Of Model”, dated 2012-07-27; authors Henri Debrat, Stephan Merz; metadata
    • proof statement excerpt: theorem OTR_agreement: assumes run:"HORun OTR_M rho HOs" and p: "decide (rho n p) = Some v" and p': "decide (rho m p') = Some w" shows "v = w" (full source statement)
    • proof statement excerpt: theorem OTR_termination: assumes run: "HORun OTR_M rho HOs" and commG: "HOcommGlobal OTR_M HOs" shows "\<exists>r v. decide (rho r p) = Some v" (full source statement)
    • axiom evidence: axiomatization where Proc_finite: "OFCLASS(Proc, finite_class)" (source line); 1 matching source lines in this row’s scope (lexical scan, not a dependency audit)

  • Heard-Of / LastVoting

    • specified: round-based fault-tolerant consensus under the algorithm’s communication predicates
    • safety: agreement and validity: correct decisions do not conflict and satisfy the input restriction
    • liveness: termination under the stated heard-of communication predicates
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here; explicit axioms found
    • size: 1,936 physical lines across 2 .thy files in this directory; imports outside this scope excluded
    • source: exact directory
    • provenance: AFP entry “Verifying Fault-Tolerant Distributed Algorithms in the Heard-Of Model”, dated 2012-07-27; authors Henri Debrat, Stephan Merz; metadata
    • proof statement excerpt: theorem lv_agreement: assumes run: "CHORun LV_M rho HOs coords" and p: "decide (rho m p) = Some v" and q: "decide (rho n q) = Some w" shows "v = w" (full source statement)
    • proof statement excerpt: theorem lv_termination: assumes run: "CHORun LV_M rho HOs coords" and commG:"CHOcommGlobal LV_M HOs coords" shows "\<exists>r. \<forall>p. decide (rho r p) \<noteq> None" (full source statement)
    • axiom evidence: axiomatization where Proc_finite: "OFCLASS(Proc, finite_class)" (source line); 1 matching source lines in this row’s scope (lexical scan, not a dependency audit)

  • Heard-Of / EIG Byzantine agreement

    • specified: round-based fault-tolerant consensus under the algorithm’s communication predicates
    • safety: agreement and validity: correct decisions do not conflict and satisfy the input restriction
    • liveness: termination under the stated heard-of communication predicates
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here; explicit axioms found
    • size: 1,196 physical lines across 2 .thy files in this directory; imports outside this scope excluded
    • source: exact directory
    • provenance: AFP entry “Verifying Fault-Tolerant Distributed Algorithms in the Heard-Of Model”, dated 2012-07-27; authors Henri Debrat, Stephan Merz; metadata
    • proof statement excerpt: theorem Agreement: assumes run: "SHORun EIG_M rho HOs SHOs" and commG: "EIG_commGlobal HOs SHOs" and commR: "\<forall>r. EIG_commPerRd (HOs r) (SHOs r)" and p: "decide (rho m p) = Some v" and q: "decide (rho n q) = Some w" shows "v = w" (full source statement)
    • proof statement excerpt: theorem Validity: assumes run: "SHORun EIG_M rho HOs SHOs" and commR: "\<forall>r. EIG_commPerRd (HOs r) (SHOs r)" and initv: "\<forall>q. the (vals (rho 0 q) root_node) = v" and dp: "decide (rho r p) = Some w" shows "v = w" (full source statement)
    • proof statement excerpt: theorem Termination: assumes "SHORun EIG_M rho HOs SHOs" shows "\<exists>r v. decide (rho r p) = Some v" (full source statement)
    • axiom evidence: axiomatization where Proc_finite: "OFCLASS(Proc, finite_class)" (source line); 2 matching source lines in this row’s scope (lexical scan, not a dependency audit)

  • Consensus Refined / Paxos / defs

    • specified: round-based consensus transition definitions
    • safety: consensus validity/agreement through refinement; see exact declarations
    • liveness: conditional termination where a termination declaration is quoted; otherwise not identified in this file
    • tool/status: Isabelle/HOL; specification/definition source; no proof declaration identified in this scope
    • size: 203 physical lines across 1 .thy files in this file; imports outside this scope excluded
    • source: exact file
    • provenance: AFP entry “Consensus Refined”, dated 2015-03-18; authors Ognjen Marić, Christoph Sprenger; metadata
    • property/model declaration excerpt (not proof evidence): definition isValStamp where "isValStamp m \<equiv> \<exists>v ts. m = ValStamp v ts" (full source statement)

  • Consensus Refined / Paxos / proofs

    • specified: round-based consensus refinement/termination proofs
    • safety: consensus validity/agreement through refinement; see exact declarations
    • liveness: conditional termination where a termination declaration is quoted; otherwise not identified in this file
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here
    • size: 365 physical lines across 1 .thy files in this file; imports outside this scope excluded
    • source: exact file
    • provenance: AFP entry “Consensus Refined”, dated 2015-03-18; authors Ognjen Marić, Christoph Sprenger; metadata
    • proof statement excerpt: lemma Paxos_Refines_ThreeStep_MRU: "PO_refines paxos_ref_rel majorities.ts_mru_TS (Paxos_TS HOs HOs crds)" (full source statement)
    • proof statement excerpt: theorem Paxos_termination: assumes run: "CHORun Paxos_Alg rho HOs crds" and commR: "\<forall>r. CHOcommPerRd Paxos_M r (HOs r) (crds r)" and commG: "CHOcommGlobal Paxos_M HOs crds" shows "\<exists>r v. decide (rho r p) = Some v" (full source statement)

  • Consensus Refined / Chandra–Toueg / defs

    • specified: round-based consensus transition definitions
    • safety: consensus validity/agreement through refinement; see exact declarations
    • liveness: conditional termination where a termination declaration is quoted; otherwise not identified in this file
    • tool/status: Isabelle/HOL; specification/definition source; no proof declaration identified in this scope
    • size: 202 physical lines across 1 .thy files in this file; imports outside this scope excluded
    • source: exact file
    • provenance: AFP entry “Consensus Refined”, dated 2015-03-18; authors Ognjen Marić, Christoph Sprenger; metadata
    • property/model declaration excerpt (not proof evidence): definition isValStamp where "isValStamp m \<equiv> \<exists>v ts. m = ValStamp v ts" (full source statement)

  • Consensus Refined / Chandra–Toueg / proofs

    • specified: round-based consensus refinement/termination proofs
    • safety: consensus validity/agreement through refinement; see exact declarations
    • liveness: conditional termination where a termination declaration is quoted; otherwise not identified in this file
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here
    • size: 362 physical lines across 1 .thy files in this file; imports outside this scope excluded
    • source: exact file
    • provenance: AFP entry “Consensus Refined”, dated 2015-03-18; authors Ognjen Marić, Christoph Sprenger; metadata
    • proof statement excerpt: lemma CT_Refines_ThreeStep_MRU: "PO_refines ct_ref_rel majorities.ts_mru_TS (CT_TS HOs HOs crds)" (full source statement)
    • proof statement excerpt: theorem CT_termination: assumes run: "CHORun CT_Alg rho HOs crds" and commR: "\<forall>r. CHOcommPerRd CT_M r (HOs r) (crds r)" and commG: "CHOcommGlobal CT_M HOs crds" shows "\<exists>r v. decide (rho r p) = Some v" (full source statement)

  • Consensus Refined / new MRU consensus algorithm / defs

    • specified: round-based consensus transition definitions
    • safety: consensus validity/agreement through refinement; see exact declarations
    • liveness: conditional termination where a termination declaration is quoted; otherwise not identified in this file
    • tool/status: Isabelle/HOL; specification/definition source; no proof declaration identified in this scope; explicit axioms found
    • size: 175 physical lines across 1 .thy files in this file; imports outside this scope excluded
    • source: exact file
    • provenance: AFP entry “Consensus Refined”, dated 2015-03-18; authors Ognjen Marić, Christoph Sprenger; metadata
    • property/model declaration excerpt (not proof evidence): definition isLV where "isLV m \<equiv> \<exists>rv. m = Vote rv" (full source statement)
    • axiom evidence: axiomatization where val_linorder: (source line); 1 matching source lines in this row’s scope (lexical scan, not a dependency audit)

  • Consensus Refined / new MRU consensus algorithm / proofs

    • specified: round-based consensus refinement/termination proofs
    • safety: consensus validity/agreement through refinement; see exact declarations
    • liveness: conditional termination where a termination declaration is quoted; otherwise not identified in this file
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here
    • size: 420 physical lines across 1 .thy files in this file; imports outside this scope excluded
    • source: exact file
    • provenance: AFP entry “Consensus Refined”, dated 2015-03-18; authors Ognjen Marić, Christoph Sprenger; metadata
    • proof statement excerpt: lemma New_Algo_Refines_votes: "PO_refines new_algo_ref_rel majorities.ts_mru_TS (New_Algo_TS HOs HOs crds)" (full source statement)
    • proof statement excerpt: theorem New_Algo_termination: assumes run: "HORun New_Algo_Alg rho HOs" and commR: "\<forall>r. HOcommPerRd New_Algo_M (HOs r)" and commG: "HOcommGlobal New_Algo_M HOs" shows "\<exists>r v. decide (rho r p) = Some v" (full source statement)

  • Consensus Refined / Ben-Or / defs

    • specified: round-based consensus transition definitions
    • safety: consensus validity/agreement through refinement; see exact declarations
    • liveness: conditional termination where a termination declaration is quoted; otherwise not identified in this file
    • tool/status: Isabelle/HOL; specification/definition source; no proof declaration identified in this scope
    • size: 103 physical lines across 1 .thy files in this file; imports outside this scope excluded
    • source: exact file
    • provenance: AFP entry “Consensus Refined”, dated 2015-03-18; authors Ognjen Marić, Christoph Sprenger; metadata
    • property/model declaration excerpt (not proof evidence): definition isVote where "isVote m \<equiv> \<exists>v. m = Vote v" (full source statement)

  • Consensus Refined / Ben-Or / proofs

    • specified: round-based consensus refinement/termination proofs
    • safety: consensus validity/agreement through refinement; see exact declarations
    • liveness: conditional termination where a termination declaration is quoted; otherwise not identified in this file
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here; explicit axioms found
    • size: 468 physical lines across 1 .thy files in this file; imports outside this scope excluded
    • source: exact file
    • provenance: AFP entry “Consensus Refined”, dated 2015-03-18; authors Ognjen Marić, Christoph Sprenger; metadata
    • proof statement excerpt: lemma BenOr_Refines_Two_Step_Obs: "PO_refines (ref_rel \<inter> (TSO_inv1 \<inter> TSO_inv2) \<times> UNIV) tso_TS (BenOr_TS HOs HOs crds)" (full source statement)
    • proof statement excerpt: theorem BenOr_termination: shows "\<exists>r v. decide (rho r p) = Some v" (full source statement)
    • axiom evidence: axiomatization where (source line); 1 matching source lines in this row’s scope (lexical scan, not a dependency audit)

  • Consensus Refined / UniformVoting / defs

    • specified: round-based consensus transition definitions
    • safety: consensus validity/agreement through refinement; see exact declarations
    • liveness: conditional termination where a termination declaration is quoted; otherwise not identified in this file
    • tool/status: Isabelle/HOL; specification/definition source; no proof declaration identified in this scope
    • size: 168 physical lines across 1 .thy files in this file; imports outside this scope excluded
    • source: exact file
    • provenance: AFP entry “Consensus Refined”, dated 2015-03-18; authors Ognjen Marić, Christoph Sprenger; metadata
    • property/model declaration excerpt (not proof evidence): definition phase where "phase (r::nat) \<equiv> r div nSteps" (full source statement)

  • Consensus Refined / UniformVoting / proofs

    • specified: round-based consensus refinement/termination proofs
    • safety: consensus validity/agreement through refinement; see exact declarations
    • liveness: conditional termination where a termination declaration is quoted; otherwise not identified in this file
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here; explicit axioms found
    • size: 440 physical lines across 1 .thy files in this file; imports outside this scope excluded
    • source: exact file
    • provenance: AFP entry “Consensus Refined”, dated 2015-03-18; authors Ognjen Marić, Christoph Sprenger; metadata
    • proof statement excerpt: lemma UV_Refines_votes: "PO_refines (ref_rel \<inter> (TSO_inv1 \<inter> TSO_inv2) \<times> UV_inv1) tso_TS (UV_TS HOs HOs crds)" (full source statement)
    • axiom evidence: axiomatization where val_linorder: (source line); 1 matching source lines in this row’s scope (lexical scan, not a dependency audit)

  • Consensus Refined / Ate / defs

    • specified: round-based consensus transition definitions
    • safety: consensus validity/agreement through refinement; see exact declarations
    • liveness: conditional termination where a termination declaration is quoted; otherwise not identified in this file
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here
    • size: 128 physical lines across 1 .thy files in this file; imports outside this scope excluded
    • source: exact file
    • provenance: AFP entry “Consensus Refined”, dated 2015-03-18; authors Ognjen Marić, Christoph Sprenger; metadata
    • property/model declaration excerpt (not proof evidence): definition Ate_initState where "Ate_initState p st \<equiv> (decide st = None)" locale ate_parameters = fixes \<alpha>::nat and T::nat and E::nat assumes TNaE:"T \<ge> 2*(N + 2*\<alpha> - E)" and TltN:"T < N" and EltN:"E < N" begin (full source statement)

  • Consensus Refined / Ate / proofs

    • specified: round-based consensus refinement/termination proofs
    • safety: consensus validity/agreement through refinement; see exact declarations
    • liveness: conditional termination where a termination declaration is quoted; otherwise not identified in this file
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here; explicit axioms found
    • size: 267 physical lines across 1 .thy files in this file; imports outside this scope excluded
    • source: exact file
    • provenance: AFP entry “Consensus Refined”, dated 2015-03-18; authors Ognjen Marić, Christoph Sprenger; metadata
    • proof statement excerpt: lemma Ate_Refines_LV_VOting: "PO_refines (ate_ref_rel) majorities.flv_TS (Ate_TS HOs HOs crds)" (full source statement)
    • axiom evidence: axiomatization where val_linorder: (source line); 1 matching source lines in this row’s scope (lexical scan, not a dependency audit)

  • Consensus Refined / OneThirdRule / defs

    • specified: round-based consensus transition definitions
    • safety: consensus validity/agreement through refinement; see exact declarations
    • liveness: conditional termination where a termination declaration is quoted; otherwise not identified in this file
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here
    • size: 174 physical lines across 1 .thy files in this file; imports outside this scope excluded
    • source: exact file
    • provenance: AFP entry “Consensus Refined”, dated 2015-03-18; authors Ognjen Marić, Christoph Sprenger; metadata
    • property/model declaration excerpt (not proof evidence): definition OTR_initState where "OTR_initState p st \<equiv> decision st = None" (full source statement)

  • Consensus Refined / OneThirdRule / proofs

    • specified: round-based consensus refinement/termination proofs
    • safety: consensus validity/agreement through refinement; see exact declarations
    • liveness: conditional termination where a termination declaration is quoted; otherwise not identified in this file
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here; explicit axioms found
    • size: 294 physical lines across 1 .thy files in this file; imports outside this scope excluded
    • source: exact file
    • provenance: AFP entry “Consensus Refined”, dated 2015-03-18; authors Ognjen Marić, Christoph Sprenger; metadata
    • proof statement excerpt: lemma OTR_Refines_LV_VOting: "PO_refines (otr_ref_rel) majorities.flv_TS (OTR_TS HOs HOs crds)" (full source statement)
    • axiom evidence: axiomatization where val_linorder: (source line); 1 matching source lines in this row’s scope (lexical scan, not a dependency audit)

  • Consensus Refined / abstract Voting

    • specified: abstract voting machine used in consensus refinements
    • safety: vote/decision invariants and refinement; abstract layer rather than additional deployed protocol
    • liveness: no progress theorem identified in this row’s source
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here
    • size: 416 physical lines across 1 .thy files in this file; imports outside this scope excluded
    • source: exact file
    • provenance: AFP entry “Consensus Refined”, dated 2015-03-18; authors Ognjen Marić, Christoph Sprenger; metadata
    • proof statement excerpt: lemma Voting_agreement: assumes beh: "tr \<in> beh v_TS" and len: "i < length tr" and s: "s = nth tr i" and t: "t = nth tr (i - j)" and dec: "decisions s p = Some v" "decisions t q = Some w" shows "w = v" (full source statement)
    • proof statement excerpt: lemma Vinv3_invariant: "reach v_TS \<subseteq> Vinv3" (full source statement)

  • Consensus Refined / abstract Voting_Opt

    • specified: abstract voting machine used in consensus refinements
    • safety: vote/decision invariants and refinement; abstract layer rather than additional deployed protocol
    • liveness: no progress theorem identified in this row’s source
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here
    • size: 195 physical lines across 1 .thy files in this file; imports outside this scope excluded
    • source: exact file
    • provenance: AFP entry “Consensus Refined”, dated 2015-03-18; authors Ognjen Marić, Christoph Sprenger; metadata
    • proof statement excerpt: lemma Last_Voting_Refines: "PO_refines (flv_ref_rel \<inter> (Vinv1 \<inter> Vinv2) \<times> UNIV) v_TS flv_TS" (full source statement)

  • Consensus Refined / abstract Observing_Quorums

    • specified: abstract voting machine used in consensus refinements
    • safety: vote/decision invariants and refinement; abstract layer rather than additional deployed protocol
    • liveness: no progress theorem identified in this row’s source
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here
    • size: 213 physical lines across 1 .thy files in this file; imports outside this scope excluded
    • source: exact file
    • provenance: AFP entry “Consensus Refined”, dated 2015-03-18; authors Ognjen Marić, Christoph Sprenger; metadata
    • proof statement excerpt: lemma Observable_Refines: "PO_refines (obsv_ref_rel \<inter> UNIV \<times> OV_inv1) sv_TS obsv_TS" (full source statement)

  • Consensus Refined / abstract Observing_Quorums_Opt

    • specified: abstract voting machine used in consensus refinements
    • safety: vote/decision invariants and refinement; abstract layer rather than additional deployed protocol
    • liveness: no progress theorem identified in this row’s source
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here
    • size: 156 physical lines across 1 .thy files in this file; imports outside this scope excluded
    • source: exact file
    • provenance: AFP entry “Consensus Refined”, dated 2015-03-18; authors Ognjen Marić, Christoph Sprenger; metadata
    • proof statement excerpt: lemma OLV_Refines: "PO_refines (olv_ref_rel \<inter> (OV_inv2 \<inter> OV_inv3 \<inter> OV_inv4) \<times> UNIV) obsv_TS olv_TS" (full source statement)

  • Consensus Refined / abstract MRU_Vote

    • specified: abstract voting machine used in consensus refinements
    • safety: vote/decision invariants and refinement; abstract layer rather than additional deployed protocol
    • liveness: no progress theorem identified in this row’s source
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here
    • size: 67 physical lines across 1 .thy files in this file; imports outside this scope excluded
    • source: exact file
    • provenance: AFP entry “Consensus Refined”, dated 2015-03-18; authors Ognjen Marić, Christoph Sprenger; metadata
    • property/model declaration excerpt (not proof evidence): definition mru_guard :: "v_state \<Rightarrow> process set \<Rightarrow> val \<Rightarrow> bool" where "mru_guard s Q v \<equiv> Q \<in> Quorum \<and> (let mru = mru_of_set (votes s) Q in mru = None \<or> (\<exists>r. mru = Some (r, v)))" (full source statement)

  • Consensus Refined / abstract MRU_Vote_Opt

    • specified: abstract voting machine used in consensus refinements
    • safety: vote/decision invariants and refinement; abstract layer rather than additional deployed protocol
    • liveness: no progress theorem identified in this row’s source
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here
    • size: 217 physical lines across 1 .thy files in this file; imports outside this scope excluded
    • source: exact file
    • provenance: AFP entry “Consensus Refined”, dated 2015-03-18; authors Ognjen Marić, Christoph Sprenger; metadata
    • proof statement excerpt: lemma Opt_MRU_Vote_Refines: "PO_refines (lv_ref_rel \<inter> (Vinv1 \<inter> Vinv2 \<inter> SV_inv3 \<inter> SV_inv4) \<times> UNIV) sv_TS mru_opt_TS" (full source statement)

  • Consensus Refined / abstract Same_Vote

    • specified: abstract voting machine used in consensus refinements
    • safety: vote/decision invariants and refinement; abstract layer rather than additional deployed protocol
    • liveness: no progress theorem identified in this row’s source
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here
    • size: 183 physical lines across 1 .thy files in this file; imports outside this scope excluded
    • source: exact file
    • provenance: AFP entry “Consensus Refined”, dated 2015-03-18; authors Ognjen Marić, Christoph Sprenger; metadata
    • proof statement excerpt: lemma Same_Vote_Refines: "PO_refines Id v_TS sv_TS" (full source statement)
    • proof statement excerpt: lemma SV_inv4_invariant: "reach sv_TS \<subseteq> SV_inv4" (full source statement)

  • Disk Paxos

    • specified: disk-based fault-tolerant consensus
    • safety: chosen-value agreement and state invariants
    • liveness: no progress theorem identified in this row’s source
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here; explicit axioms found
    • size: 6,954 physical lines across 10 .thy files in this directory; imports outside this scope excluded
    • source: exact directory
    • provenance: AFP entry “Proving the Correctness of Disk Paxos”, dated 2005-06-22; authors Mauro Jaskelioff, Stephan Merz; metadata
    • proof statement excerpt: lemma outpt_chosen_2: assumes outpt: "outpt s' = (outpt s) (p:= NotAnInput)" and inv2c: "Inv2c s" and nextp: "HNextPart s s'" shows "chosen s = chosen s'" (full source statement)
    • axiom evidence: axiomatization (source line); 1 matching source lines in this row’s scope (lexical scan, not a dependency audit)

  • Chandy–Lamport snapshot

    • specified: distributed consistent snapshot and stable-property detection
    • safety: snapshot matches a consistent global state
    • liveness: snapshot termination; stable-property detection under source assumptions
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here
    • size: 10,220 physical lines across 7 .thy files in this directory; imports outside this scope excluded
    • source: exact directory
    • provenance: AFP entry “A Formal Proof of The Chandy–Lamport Distributed Snapshot Algorithm”, dated 2020-07-21; authors Ben Fiedler, Dmitriy Traytel; metadata
    • proof statement excerpt: theorem snapshot_algorithm_is_correct: assumes "trace init t final" shows "\<exists>t' i. trace init t' final \<and> mset t' = mset t \<and> state_equal_to_snapshot (S t' i) final \<and> i \<le> length t'" (full source statement)
    • proof statement excerpt: theorem Stable_Property_Detection: assumes "stable p" and "trace init t final" and "(t', i) = some_snapshot_state t" and "p (S t' i)" shows "p final" (full source statement)

  • Schneider generalized Byzantine clock synchronization

    • specified: local clocks corrected using a convergence function
    • safety: correct clocks stay within the stated skew bound
    • liveness: periodic synchronization assumptions are premises; separate eventual-progress theorem not identified
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here; explicit axioms found
    • size: 1,357 physical lines across 1 .thy files in this directory; imports outside this scope excluded
    • source: exact directory
    • provenance: AFP entry “Formalization of a Generalized Protocol for Clock Synchronization”, dated 2005-06-24; authors Alwen Tiu; metadata
    • proof statement excerpt: theorem agreement: assumes ie1: "\<beta> \<le> rmin" and ie2: "\<mu> \<le> \<delta>S" and ie3: "\<gamma>1 \<delta>S \<le> \<delta>S" and ie4: "\<gamma>2 \<delta>S \<le> \<delta>" and ie5: "\<gamma>3 \<delta>S \<le> \<delta>" and ie6: "0 \<le> t" and cpq: "correct p t \<and> correct q t" shows "\<bar>VC p t - VC q t\<bar> \<le> \<delta>" (full source statement)
    • axiom evidence: axiomatization (source line); 16 matching source lines in this row’s scope (lexical scan, not a dependency audit)

  • interactive convergence clock synchronization

    • specified: concrete convergence function for generalized clock synchronization
    • safety: precision enhancement and accuracy preservation
    • liveness: no progress theorem identified in this row’s source
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here; explicit axioms found
    • size: 688 physical lines across 1 .thy files in this file; imports outside this scope excluded
    • source: exact file
    • provenance: AFP entry “Instances of Schneider’s generalized protocol of clock synchronization”, dated 2006-03-15; authors Damián Barsotti; metadata
    • proof statement excerpt: theorem prec_enh: assumes hC: "C \<subseteq> PR" and hbx: "\<forall> l\<in>C. \<bar>f l - g l\<bar> <= x" and hby1: "\<forall> l\<in>C. \<forall> m\<in>C. \<bar>f l - f m\<bar> <= y" and hby2: "\<forall> l\<in>C. \<forall> m\<in>C. \<bar>g l - g m\<bar> <= y" and hpC: "p\<in>C" and hqC: "q\<in>C" shows "\<bar> cfni p f - cfni q g \<bar> <= (real (card C) * (x + (if (y <= \<Delta>) then 0 else y)) + real (card ({..<np} - C)) * (2 * \<Delta> + x + y)) / real np" (is "\<bar> ?dif_div_np \<bar> <= ?B") (full source statement)
    • proof statement excerpt: lemma accur_pres: assumes hC: "C \<subseteq> PR" and hby: "\<forall> l\<in>C. \<forall> m\<in>C. \<bar>f l - f m\<bar> <= x" and hpC: "p\<in>C" and hqC: "q\<in>C" shows "\<bar> cfni p f - f q \<bar> <= (real (card C) * x + real (card ({..<np} - C)) * (x + \<Delta>))/ real np" (is "?abs1 <= (?bC + ?bnpC)/real np") (full source statement)
    • axiom evidence: axiomatization (source line); 1 matching source lines in this row’s scope (lexical scan, not a dependency audit)

  • Lynch clock synchronization

    • specified: concrete convergence function for generalized clock synchronization
    • safety: precision enhancement and accuracy preservation
    • liveness: no progress theorem identified in this row’s source
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here; explicit axioms found
    • size: 1,032 physical lines across 1 .thy files in this file; imports outside this scope excluded
    • source: exact file
    • provenance: AFP entry “Instances of Schneider’s generalized protocol of clock synchronization”, dated 2006-03-15; authors Damián Barsotti; metadata
    • proof statement excerpt: theorem prec_enh: assumes hC: "C \<subseteq> PR" and hCF: "np - nF <= card C" and hFn: "3 * nF < np" and hFk: "nF = khl" and hbx: "\<forall> l\<in>C. \<bar>f l - g l\<bar> <= x" and hby1: "\<forall> l\<in>C. \<forall> m\<in>C. \<bar>f l - f m\<bar> <= y" and hby2: "\<forall> l\<in>C. \<forall> m\<in>C. \<bar>g l - g m\<bar> <= y" and hpC: "p\<in>C" and hqC: "q\<in>C" shows "\<bar> cfnl p f - cfnl q g \<bar> <= y / 2 + x" (full source statement)
    • proof statement excerpt: theorem accur_pres: assumes hC: "C \<subseteq> PR" and hCF: "np - nF <= card C" and hFk: "nF = khl" and hby: "\<forall> l\<in>C. \<forall> m\<in>C. \<bar>f l - f m\<bar> <= y" and hqC: "q\<in>C" shows "\<bar> cfnl p f - f q \<bar> <= y" (full source statement)
    • axiom evidence: axiomatization (source line); 1 matching source lines in this row’s scope (lexical scan, not a dependency audit)

  • CRDT / operation-based counter

    • specified: replicated datatype operations under a causal network model
    • safety: concurrent operations commute; convergence via imported framework
    • liveness: framework sec_progress concerns operations being applicable; eventual network delivery must not be inferred
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here
    • size: 57 physical lines across 1 .thy files in this file; imports outside this scope excluded
    • source: exact file
    • provenance: AFP entry “A framework for establishing Strong Eventual Consistency for Conflict-free Replicated Datatypes”, dated 2017-07-07; authors Victor B. F. Gomes, Martin Kleppmann, Dominic P. Mulligan, Alastair R. Beresford; metadata
    • proof statement excerpt: lemma (in counter) concurrent_operations_commute: assumes "xs prefix of i" shows "hb.concurrent_ops_commute (node_deliver_messages xs)" (full source statement)

  • CRDT / observed-remove set

    • specified: replicated datatype operations under a causal network model
    • safety: concurrent operations commute; convergence via imported framework
    • liveness: framework sec_progress concerns operations being applicable; eventual network delivery must not be inferred
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here
    • size: 248 physical lines across 1 .thy files in this file; imports outside this scope excluded
    • source: exact file
    • provenance: AFP entry “A framework for establishing Strong Eventual Consistency for Conflict-free Replicated Datatypes”, dated 2017-07-07; authors Victor B. F. Gomes, Martin Kleppmann, Dominic P. Mulligan, Alastair R. Beresford; metadata
    • proof statement excerpt: theorem (in orset) convergence: assumes "set (node_deliver_messages xs) = set (node_deliver_messages ys)" and "xs prefix of i" and "ys prefix of j" shows "apply_operations xs = apply_operations ys" (full source statement)
    • proof statement excerpt: lemma (in orset) concurrent_operations_commute: assumes "xs prefix of i" shows "hb.concurrent_ops_commute (node_deliver_messages xs)" (full source statement)
    • proof statement excerpt: lemma (in orset) apply_operations_never_fails: assumes "xs prefix of i" shows "apply_operations xs \<noteq> None" (full source statement)

  • CRDT / replicated growable array

    • specified: replicated datatype operations under a causal network model
    • safety: concurrent operations commute; convergence via imported framework
    • liveness: framework sec_progress concerns operations being applicable; eventual network delivery must not be inferred
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here
    • size: 530 physical lines across 1 .thy files in this file; imports outside this scope excluded
    • source: exact file
    • provenance: AFP entry “A framework for establishing Strong Eventual Consistency for Conflict-free Replicated Datatypes”, dated 2017-07-07; authors Victor B. F. Gomes, Martin Kleppmann, Dominic P. Mulligan, Alastair R. Beresford; metadata
    • proof statement excerpt: lemma (in rga) concurrent_operations_commute: assumes "xs prefix of i" shows "hb.concurrent_ops_commute (node_deliver_messages xs)" (full source statement)
    • proof statement excerpt: lemma (in rga) apply_operations_never_fails': shows "apply_operations (history i) \<noteq> None" (full source statement)

  • CRDT / convergence framework

    • specified: reordering and applying concurrent replicated updates
    • safety: same delivered update set gives equal state
    • liveness: sec_progress: valid delivery/applicability, not an unconditional eventual-delivery guarantee
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here
    • size: 385 physical lines across 1 .thy files in this file; imports outside this scope excluded
    • source: exact file
    • provenance: AFP entry “A framework for establishing Strong Eventual Consistency for Conflict-free Replicated Datatypes”, dated 2017-07-07; authors Victor B. F. Gomes, Martin Kleppmann, Dominic P. Mulligan, Alastair R. Beresford; metadata
    • proof statement excerpt: theorem sec_convergence: assumes "set xs = set ys" "op_history xs" "op_history ys" shows "apply_operations xs = apply_operations ys" (full source statement)
    • proof statement excerpt: theorem sec_progress: assumes "op_history xs" shows "apply_operations xs initial_state \<noteq> None" (full source statement)

  • IMAP replicated mailbox

    • specified: replicated IMAP operations
    • safety: commutativity and strong convergence
    • liveness: delivery fairness not proved by commutativity alone
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here
    • size: 1,100 physical lines across 5 .thy files in this directory; imports outside this scope excluded
    • source: exact directory
    • provenance: AFP entry “The IMAP CmRDT”, dated 2017-11-09; authors Tim Jungnickel, Lennart Oldenburg, Matthias Loibl; metadata
    • proof statement excerpt: lemma (in imap) concurrent_operations_commute: assumes "xs prefix of i" shows "hb.concurrent_ops_commute (node_deliver_messages xs)" (full source statement)
    • proof statement excerpt: theorem (in imap) convergence: assumes "set (node_deliver_messages xs) = set (node_deliver_messages ys)" and "xs prefix of i" and "ys prefix of j" shows "apply_operations xs = apply_operations ys" (full source statement)

  • WOOT collaborative editor

    • specified: replicated text editing with causal delivery
    • safety: same operations produce same text; delivery does not fail
    • liveness: network delivery assumptions are explicit; unconditional eventual delivery not established
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here
    • size: 2,922 physical lines across 15 .thy files in this directory; imports outside this scope excluded
    • source: exact directory
    • provenance: AFP entry “Strong Eventual Consistency of the Collaborative Editing Framework WOOT”, dated 2020-03-25; authors Emin Karayel, Edgar Gonzàlez; metadata
    • proof statement excerpt: theorem (in dist_execution) no_failure: fixes i assumes "is_valid_state_id i" shows "isOK (state i)" (full source statement)
    • proof statement excerpt: theorem (in dist_execution) strong_convergence: assumes "is_valid_state_id i" assumes "is_valid_state_id j" assumes "set (received_messages i) = set (received_messages j)" shows "state i = state j" (full source statement)

  • OpSets / RGA and noninterleaving text specification

    • specified: replicated list semantics and concurrent insertion blocks
    • safety: RGA meets sequential spec; ordered insertion and no interleaving
    • liveness: no progress theorem identified in this row’s source
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here
    • size: 4,034 physical lines across 5 .thy files in this directory; imports outside this scope excluded
    • source: exact directory
    • provenance: AFP entry “OpSets: Sequential Specifications for Replicated Datatypes”, dated 2018-05-10; authors Martin Kleppmann, Victor B. F. Gomes, Dominic P. Mulligan, Alastair R. Beresford; metadata
    • proof statement excerpt: theorem rga_meets_spec: assumes "rga_ops xs" shows "\<exists>ys. set ys = set xs \<and> insert_ops ys \<and> interp_ins ys = interp_rga xs" (full source statement)
    • proof statement excerpt: theorem no_interleaving: assumes "insert_ops ops" and "insert_seq start xs" and "insert_ops xs" and "insert_seq start ys" and "insert_ops ys" and "set xs \<subseteq> set ops" and "set ys \<subseteq> set ops" and "distinct (map fst xs @ map fst ys)" and "start = None \<or> (\<exists>r. start = Some r \<and> r \<in> set (interp_ins ops))" shows "(\<forall>x \<in> set (map fst xs). \<forall>y \<in> set (map fst ys). list_order ops x y) \<or> (\<forall>x \<in> set (map fst xs). \<forall>y \<in> set (map fst ys). list_order ops y x)" (full source statement)
    • proof statement excerpt: theorem list_order_total: assumes "list_ops ops" and "x \<in> set (fst (interp_ops ops))" and "y \<in> set (fst (interp_ops ops))" and "x \<noteq> y" shows "list_order ops x y \<or> list_order ops y x" (full source statement)

  • Timely Dataflow progress tracking

    • specified: distributed capability/message accounting and frontiers
    • safety: frontier does not incorrectly announce completed work
    • liveness: no progress theorem identified in this row’s source
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here
    • size: 7,972 physical lines across 7 .thy files in this directory; imports outside this scope excluded
    • source: exact directory
    • provenance: AFP entry “Formalization of Timely Dataflow’s Progress Tracking Protocol”, dated 2021-04-13; authors Matthias Brun, Sára Decova, Andrea Lattuada, Dmitriy Traytel; metadata
    • proof statement excerpt: lemma alw_safe_combined2: "FullSpec s \<Longrightarrow> alw (holds safe_combined2) s" (full source statement)
    • proof statement excerpt: lemma spec_imp_SafeStickyGlobVacantUpto: "spec s \<Longrightarrow> alw SafeStickyGlobVacantUpto s" (full source statement)

  • strict two-phase locking

    • specified: transaction schedules and lock acquisition/release
    • safety: strict two-phase locking implies conflict serializability
    • liveness: no progress theorem identified in this row’s source
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here
    • size: 499 physical lines across 1 .thy files in this directory; imports outside this scope excluded
    • source: exact directory
    • provenance: AFP entry “Formalization of (Conflict-)Serializability and Strict Two-Phase Locking”, dated 2025-02-01; authors Dmitriy Traytel; metadata
    • proof statement excerpt: theorem s2pl_conflict_serializable: \<open>s2pl (\<lambda>_. {}) s \<Longrightarrow> conflict_serializable s\<close> (full source statement)

  • concurrent revisions

    • specified: fork/join revision-based shared state
    • safety: determinacy independent of scheduling
    • liveness: no progress theorem identified in this row’s source
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here
    • size: 3,055 physical lines across 7 .thy files in this directory; imports outside this scope excluded
    • source: exact directory
    • provenance: AFP entry “Formalization of Concurrent Revisions”, dated 2018-12-25; authors Roy Overbeek; metadata
    • proof statement excerpt: theorem determinacy: assumes prog_expr: "program_expr e" and e_terminates_in_s: "e \<down> s" and e_terminates_in_s': "e \<down> s'" and lid_inf: "infinite (UNIV :: 'l set)" and rid_inf: "infinite (UNIV :: 'r set)" shows "s \<approx> s'" (full source statement)

  • Schism concurrent garbage collector on x86-TSO

    • specified: mutator/collector and weak-memory execution
    • safety: collection safety and valid references
    • liveness: no progress theorem identified in this row’s source
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here
    • size: 8,004 physical lines across 19 .thy files in this directory; imports outside this scope excluded
    • source: exact directory
    • provenance: AFP entry “Relaxing Safely: Verified On-the-Fly Garbage Collection for x86-TSO”, dated 2015-04-13; authors Peter Gammie, Tony Hosking, Kai Engelhardt; metadata
    • proof statement excerpt: lemma (in sys) valid_refs_inv[intro]: "\<lbrace> LSTP (valid_refs_inv \<^bold>\<and> tso_store_inv) \<rbrace> sys \<lbrace> LSTP valid_refs_inv \<rbrace>" (full source statement)

  • CoSMeDis distributed social-media platform

    • specified: networked users, posts, friendship and API transitions
    • safety: confidentiality and state safety
    • liveness: no progress theorem identified in this row’s source
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here
    • size: 16,273 physical lines across 55 .thy files in this directory; imports outside this scope excluded
    • source: exact directory
    • provenance: AFP entry “CoSMeDis: A confidentiality-verified distributed social media platform”, dated 2021-08-16; authors Thomas Bauereiss, Andrei Popescu; metadata
    • proof statement excerpt: theorem Post_secure: secure (full source statement)

  • FLP impossibility

    • specified: asynchronous consensus with one possible failure
    • safety: formal system validity assumptions
    • liveness: impossibility of guaranteeing consensus termination; negative result
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here
    • size: 4,521 physical lines across 7 .thy files in this directory; imports outside this scope excluded
    • source: exact directory
    • provenance: AFP entry “A Constructive Proof for FLP”, dated 2016-05-18; authors Benjamin Bisping, Paul-David Brodmann, Tim Jungnickel, Christina Rickmann, Henning Seidler, Anke Stüber, Arno Wilhelm-Weidner, Kirstin Peters, Uwe Nestmann; metadata
    • property/model declaration excerpt (not proof evidence): definition (in flpSystem) terminationFLP:: "(nat \<Rightarrow> ('p, 'v, 's) configuration list) \<Rightarrow> (nat \<Rightarrow> ('p, 'v) message list) \<Rightarrow> bool" where "terminationFLP fe ft \<equiv> infiniteExecution fe ft \<longrightarrow> (\<forall> p . \<exists> n . (\<exists> i0 < length (ft n). \<exists> b . (<\<bottom>, outM b> \<in># sends p (states ((fe n) ! i0) p) (unpackMessage ((ft n) ! i0))) \<and> isReceiverOf p ((ft n) ! i0)) \<or> (\<forall> n1 > n . \<forall> m \<in> set (drop (length (ft n)) (ft n1)) . \<not> isReceiverOf p m))" (full source statement)
    • property/model declaration excerpt (not proof evidence): definition (in asynchronousSystem) fairInfiniteExecution :: "(nat \<Rightarrow> (('p, 'v, 's) configuration list)) \<Rightarrow> (nat \<Rightarrow> (('p, 'v) message list)) \<Rightarrow> bool" where "fairInfiniteExecution fe ft \<equiv> infiniteExecution fe ft \<and> (\<forall> n . \<forall> n0 < length (fe n). \<forall> p . \<forall> msg . ((enabled ((fe n) ! n0) msg) \<and> isReceiverOf p msg \<and> correctInfinite fe ft p ) \<longrightarrow> (\<exists> n' \<ge> n . \<exists> n0' \<ge> n0 . n0' < length (ft n') \<and> (msg = ((ft n') ! n0'))))" (full source statement)

  • Stellar / personal Byzantine quorum systems

    • specified: static quorum intersection and trust restrictions
    • safety: quorum-set safety; no full message-level consensus model
    • liveness: no progress theorem identified in this row’s source
    • tool/status: Isabelle/HOL; incomplete proof source: omission tokens found; no completed proof claim
    • size: 613 physical lines across 1 .thy files in this directory; imports outside this scope excluded
    • source: exact directory
    • provenance: AFP entry “Stellar Quorum Systems”, dated 2019-08-01; authors Giuliano Losa; metadata
    • proof statement excerpt: theorem union_quorum_intersection: assumes "proj.quorum Q\<^sub>1" and "proj.quorum Q\<^sub>2" and "Q\<^sub>1 \<inter> (I\<^sub>1\<union>I\<^sub>2) \<noteq> {}" and "Q\<^sub>2 \<inter> (I\<^sub>1\<union>I\<^sub>2) \<noteq> {}" shows "Q\<^sub>1 \<inter> Q\<^sub>2 \<inter> (I\<^sub>1\<union>I\<^sub>2) \<noteq> {}" \<comment> \<open>Any two sets that intersect @{term \<open>I\<^sub>1\<union>I\<^sub>2\<close>} and that are quorums in the system projected on @{term \<open>I\<^sub>1\<union>I\<^sub>2\<close>} intersect in @{term \<open>I\<^sub>1\<union>I\<^sub>2\<close>}.\<close> (full source statement)
    • proof statement excerpt: theorem blocking_safe: \<comment> \<open>A set that blocks an intact node contains an intact node. If this were not the case, quorum availability would trivially be violated.\<close> fixes S n assumes "n\<in>I" and "\<forall> Sl\<in> slices n .Sl\<inter>S \<noteq> {}" shows "S \<inter> I \<noteq> {}" (full source statement)
    • unfinished step evidence: oops (source line); 1 matching source lines in this row’s scope (lexical scan, not a dependency audit)

  • abortable linearizable modules / consensus

    • specified: abortable consensus modules and their composition
    • safety: linearizable composition/idempotence
    • liveness: no progress theorem identified in this row’s source
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here
    • size: 3,185 physical lines across 7 .thy files in this directory; imports outside this scope excluded
    • source: exact directory
    • provenance: AFP entry “Abortable Linearizable Modules”, dated 2012-03-01; authors Rachid Guerraoui, Viktor Kuncak, Giuliano Losa; metadata
    • proof statement excerpt: theorem idempotence: shows "((composition) =<| (ioa 0 id2))" (full source statement)
    • proof statement excerpt: lemma single_use: fixes r rs shows "\<bottom> \<star> ([r]@rs) = Some (snd r)" (full source statement)

  • AODV main

    • specified: wireless routing transition specification
    • safety: loop freedom supplied by corresponding *_Loop_Freedom theory, not necessarily proved in this model file
    • liveness: no progress theorem identified in this row’s source
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here
    • size: 536 physical lines across 1 .thy files in this file; imports outside this scope excluded
    • source: exact file
    • provenance: AFP entry “Loop freedom of the (untimed) AODV routing protocol”, dated 2014-10-23; authors Timothy Bourke, Peter Höfner; metadata
    • proof statement excerpt: lemma aodv_init_sip_not_i [simp]: assumes "(\<xi>, p) \<in> \<sigma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V i" shows "sip \<xi> \<noteq> i" (full source statement)

  • AODV variant A

    • specified: wireless routing transition specification
    • safety: loop freedom supplied by corresponding *_Loop_Freedom theory, not necessarily proved in this model file
    • liveness: no progress theorem identified in this row’s source
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here
    • size: 532 physical lines across 1 .thy files in this file; imports outside this scope excluded
    • source: exact file
    • provenance: AFP entry “Loop freedom of the (untimed) AODV routing protocol”, dated 2014-10-23; authors Timothy Bourke, Peter Höfner; metadata
    • proof statement excerpt: lemma aodv_init_sip_not_i [simp]: assumes "(\<xi>, p) \<in> \<sigma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V i" shows "sip \<xi> \<noteq> i" (full source statement)

  • AODV variant B

    • specified: wireless routing transition specification
    • safety: loop freedom supplied by corresponding *_Loop_Freedom theory, not necessarily proved in this model file
    • liveness: no progress theorem identified in this row’s source
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here
    • size: 532 physical lines across 1 .thy files in this file; imports outside this scope excluded
    • source: exact file
    • provenance: AFP entry “Loop freedom of the (untimed) AODV routing protocol”, dated 2014-10-23; authors Timothy Bourke, Peter Höfner; metadata
    • proof statement excerpt: lemma aodv_init_sip_not_i [simp]: assumes "(\<xi>, p) \<in> \<sigma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V i" shows "sip \<xi> \<noteq> i" (full source statement)

  • AODV variant C

    • specified: wireless routing transition specification
    • safety: loop freedom supplied by corresponding *_Loop_Freedom theory, not necessarily proved in this model file
    • liveness: no progress theorem identified in this row’s source
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here
    • size: 517 physical lines across 1 .thy files in this file; imports outside this scope excluded
    • source: exact file
    • provenance: AFP entry “Loop freedom of the (untimed) AODV routing protocol”, dated 2014-10-23; authors Timothy Bourke, Peter Höfner; metadata
    • proof statement excerpt: lemma aodv_init_sip_not_i [simp]: assumes "(\<xi>, p) \<in> \<sigma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V i" shows "sip \<xi> \<noteq> i" (full source statement)

  • AODV variant D

    • specified: wireless routing transition specification
    • safety: loop freedom supplied by corresponding *_Loop_Freedom theory, not necessarily proved in this model file
    • liveness: no progress theorem identified in this row’s source
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here
    • size: 551 physical lines across 1 .thy files in this file; imports outside this scope excluded
    • source: exact file
    • provenance: AFP entry “Loop freedom of the (untimed) AODV routing protocol”, dated 2014-10-23; authors Timothy Bourke, Peter Höfner; metadata
    • proof statement excerpt: lemma aodv_init_sip_not_i [simp]: assumes "(\<xi>, p) \<in> \<sigma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V i" shows "sip \<xi> \<noteq> i" (full source statement)

  • AODV variant E

    • specified: wireless routing transition specification
    • safety: loop freedom supplied by corresponding *_Loop_Freedom theory, not necessarily proved in this model file
    • liveness: no progress theorem identified in this row’s source
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here
    • size: 524 physical lines across 1 .thy files in this file; imports outside this scope excluded
    • source: exact file
    • provenance: AFP entry “Loop freedom of the (untimed) AODV routing protocol”, dated 2014-10-23; authors Timothy Bourke, Peter Höfner; metadata
    • proof statement excerpt: lemma aodv_init_sip_not_i [simp]: assumes "(\<xi>, p) \<in> \<sigma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V i" shows "sip \<xi> \<noteq> i" (full source statement)

  • AODV / loop-freedom proof

    • specified: main routing model’s loop-freedom theorem
    • safety: no routing loops
    • liveness: no progress theorem identified in this row’s source
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here
    • size: 369 physical lines across 1 .thy files in this file; imports outside this scope excluded
    • source: exact file
    • provenance: AFP entry “Loop freedom of the (untimed) AODV routing protocol”, dated 2014-10-23; authors Timothy Bourke, Peter Höfner; metadata
    • proof statement excerpt: theorem aodv_loop_freedom: assumes "wf_net_tree n" shows "closed (pnet (\<lambda>i. paodv i \<langle>\<langle> qmsg) n) \<TTurnstile> netglobal (\<lambda>\<sigma>. \<forall>dip. irrefl ((rt_graph \<sigma> dip)\<^sup>+))" (full source statement)

  • ticket lock

    • specified: concurrent acquire/release using rely/guarantee contracts
    • safety: global/local lock contract preservation
    • liveness: termination/starvation freedom not identified
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here
    • size: 421 physical lines across 1 .thy files in this file; imports outside this scope excluded
    • source: exact file
    • provenance: AFP entry “Rely-Guarantee Extensions and Locks”, dated 2025-11-21; authors Robert J. Colvin, Scott Heiner, Peter Höfner, Roger C. Su; metadata
    • proof statement excerpt: theorem tktlock_global: assumes "0 < n" shows "valid_multipar: annotated global_init: \<lbrace> \<acute>now_serving = 1 \<and> \<acute>next_ticket = 1 \<and> \<acute>myticket = (\<lambda>j. 0) \<and> \<acute>aux_queue = [] \<rbrace> global_rely: Id \<parallel> i < n @ { \<lbrace> \<acute>myticket i < \<acute>now_serving \<and> i \<notin> set \<acute>aux_queue\<rbrace>, tktlock_rely i } FOREVER ( \<lbrace> \<acute>myticket i < \<acute>now_serving \<and> i \<notin> set \<acute>aux_queue \<rbrace> / \<langle>\<acute>myticket[i] := \<acute>next_ticket ;; \<acute>next_ticket := \<acute>next_ticket + 1 ;; \<acute>aux_queue := \<acute>aux_queue @ [i] \<rangle> .; \<lbrace> \<acute>now_serving \<le> \<acute>myticket i \<and> i \<in> set \<acute>aux_queue \<rbrace> SPIN \<acute>now_serving \<noteq> \<acute>myticket i .; {\<lbrace> \<acute>now_serving = \<acute>myticket i \<and> at_head i \<acute>aux_queue \<rbrace>} \<langle>\<acute>now_serving := \<acute>now_serving + 1 ;; \<acute>aux_queue := tl \<acute>aux_queue \<rangle>a ) \<sslash> tktlock_inv { for_others tktlock_rely i, {} } global_guar: UNIV global_post: \<lbrace> \<acute>aux_queue = [] \<rbrace>" (full source statement)
    • proof statement excerpt: theorem tktlock_acq2: "rely: tktlock_rely i guar: for_others tktlock_rely i inv: tktlock_inv code: { \<lbrace> \<acute>now_serving \<le> \<acute>myticket i \<and> i \<in> set \<acute>aux_queue \<rbrace> } WHILE \<acute>now_serving \<noteq> \<acute>myticket i DO SKIP OD { \<lbrace> \<acute>now_serving = \<acute>myticket i \<and> at_head i \<acute>aux_queue \<rbrace> }" (full source statement)
    • proof statement excerpt: theorem tktlock_rel: "rely: tktlock_rely i guar: for_others tktlock_rely i inv: tktlock_inv code: { \<lbrace> \<acute>now_serving = \<acute>myticket i \<and> at_head i \<acute>aux_queue \<rbrace> } Basic ((\<acute>now_serving \<leftarrow> \<acute>now_serving + 1) \<circ>> (\<acute>aux_queue \<leftarrow> tl \<acute>aux_queue)) { \<lbrace> \<acute>myticket i < \<acute>now_serving \<and> i \<notin> set \<acute>aux_queue \<rbrace> }" (full source statement)

  • circular-buffer lock

    • specified: concurrent acquire/release using rely/guarantee contracts
    • safety: global/local lock contract preservation
    • liveness: termination/starvation freedom not identified
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here
    • size: 988 physical lines across 1 .thy files in this file; imports outside this scope excluded
    • source: exact file
    • provenance: AFP entry “Rely-Guarantee Extensions and Locks”, dated 2025-11-21; authors Robert J. Colvin, Scott Heiner, Peter Höfner, Roger C. Su; metadata
    • proof statement excerpt: theorem cblock_global: "valid_multipar: annotated global_init: cblock_init global_rely: Id \<parallel> i < NumThreads @ { \<lbrace> i \<notin> set \<acute>aux_queue \<rbrace>, cblock_rely i } FOREVER (cblock_local i) \<sslash> cblock_invar i { for_others cblock_rely i, {} } global_guar: UNIV global_post: {}" (full source statement)
    • proof statement excerpt: theorem cblock_acq: "annquin_valid rely: cblock_rely i guar: for_others cblock_rely i inv: cblock_invar i annotated_code: { \<lbrace> i \<notin> set \<acute>aux_queue \<rbrace> } BasicAnno (acq_line1 i) .; { \<lbrace> i \<in> set \<acute>aux_queue \<rbrace> } (SPIN \<acute>flag_mapping (\<acute>myindex i) = Pending ) { \<lbrace> at_head i \<acute>aux_queue \<and> \<acute>aux_mid_release = None \<rbrace> }" (full source statement)
    • proof statement excerpt: theorem cblock_rel: "annquin_valid rely: cblock_rely i guar: for_others cblock_rely i inv: cblock_invar i annotated_code: { \<lbrace> at_head i \<acute>aux_queue \<and> \<acute>aux_mid_release = None \<rbrace> } BasicAnno (rel_line1 i) .; { \<lbrace> at_head i \<acute>aux_queue \<and> \<acute>aux_mid_release = Some i \<rbrace> } BasicAnno (rel_line2 i) { \<lbrace> i \<notin> set \<acute>aux_queue \<rbrace> }" (full source statement)

  • abstract queue lock

    • specified: concurrent acquire/release using rely/guarantee contracts
    • safety: global/local lock contract preservation
    • liveness: termination/starvation freedom not identified
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here
    • size: 288 physical lines across 1 .thy files in this file; imports outside this scope excluded
    • source: exact file
    • provenance: AFP entry “Rely-Guarantee Extensions and Locks”, dated 2025-11-21; authors Robert J. Colvin, Scott Heiner, Peter Höfner, Roger C. Su; metadata
    • proof statement excerpt: theorem qlock_global_anno: assumes "0 < N" shows "valid_multipar: annotated global_init: \<lbrace> \<acute>queue = [] \<rbrace> global_rely: Id \<parallel> i < N @ { \<lbrace> i \<notin> set \<acute>queue \<rbrace>, qlock_rely i } FOREVER ( \<acute>queue := \<acute>queue @ [i] ..; \<lbrace> i \<in> set \<acute>queue \<rbrace> SPIN hd \<acute>queue \<noteq> i .; {\<lbrace> at_head i \<acute>queue \<rbrace>} (\<acute>queue := tl \<acute>queue)- ) \<sslash> qlock_invar { for_others qlock_rely i, \<lbrace> i \<notin> set \<acute>queue \<rbrace> } global_guar: UNIV global_post: \<lbrace> \<acute>queue = [] \<rbrace>" (full source statement)
    • proof statement excerpt: lemma qlock_rel: "rely: qlock_rely i guar: for_others qlock_rely i inv: qlock_invar code: { \<lbrace> at_head i \<acute>queue \<rbrace> } \<acute>queue (full source statement)

  • COMPLX / Peterson and concurrency examples

    • specified: two-thread mutual exclusion plus simple parallel programs
    • safety: Peterson mutual exclusion and assertions
    • liveness: no progress theorem identified in this row’s source
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here
    • size: 265 physical lines across 1 .thy files in this file; imports outside this scope excluded
    • source: exact file
    • provenance: AFP entry “COMPLX: A Verification Framework for Concurrent Imperative Programs”, dated 2016-11-29; authors Sidney Amani, June Andronick, Maksym Bortin, Corey Lewis, Christine Rizkallah, Joseph Tuong; metadata
    • proof statement excerpt: lemma Petersons_mutex_1: "\<Gamma>, \<Theta> |\<tturnstile>\<^bsub>/F\<^esub> \<lbrace>\<acute>pr1=0 \<and> \<not>\<acute>in1 \<and> \<acute>pr2=0 \<and> \<not>\<acute>in2 \<rbrace> COBEGIN \<lbrace>\<acute>pr1=0 \<and> \<not>\<acute>in1 \<rbrace> WHILE True INV \<lbrace>\<acute>pr1=0 \<and> \<not>\<acute>in1\<rbrace> DO \<lbrace>\<acute>pr1=0 \<and> \<not>\<acute>in1\<rbrace> \<langle> \<acute>in1 (full source statement)

  • COMPLX / parallel array summation

    • specified: parallel array traversal and sums
    • safety: sum result satisfies specification
    • liveness: no progress theorem identified in this row’s source
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here
    • size: 470 physical lines across 1 .thy files in this file; imports outside this scope excluded
    • source: exact file
    • provenance: AFP entry “COMPLX: A Verification Framework for Concurrent Imperative Programs”, dated 2016-11-29; authors Sidney Amani, June Andronick, Maksym Bortin, Corey Lewis, Christine Rizkallah, Joseph Tuong; metadata
    • proof statement excerpt: lemma sumarr_correct: "\<Gamma>, \<Theta> |\<tturnstile>\<^bsub>/F\<^esub> \<lbrace>\<acute>precond\<rbrace> COBEGIN SCHEME [0 \<le> m < 2] call_sumarr m \<lbrace>\<acute>local_postcond m\<rbrace>,\<lbrace>False\<rbrace> COEND \<lbrace>\<acute>postcond\<rbrace>, \<lbrace>False\<rbrace>" (full source statement)

  • CSP / dining philosophers

    • specified: parameterized philosophers and forks
    • safety: reachable-state invariants
    • liveness: deadlock freedom (a finite-state refusal property); not starvation freedom
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here
    • size: 969 physical lines across 1 .thy files in this file; imports outside this scope excluded
    • source: exact file
    • provenance: AFP entry “The HOL-CSP Refinement Toolkit”, dated 2020-11-19; authors Safouan Taha, Burkhart Wolff, Lina Ye; metadata
    • proof statement excerpt: lemma inv_implies_DF:"inv_dining ps fs \<Longrightarrow> Tr\<^sub>D N (ps, fs) \<noteq> {}" unfolding inv_dining_def (full source statement)

  • CSP / copy buffer

    • specified: communicating copy/buffer pipeline
    • safety: CSP refinement
    • liveness: deadlock freedom; no starvation assertion identified
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here
    • size: 87 physical lines across 1 .thy files in this file; imports outside this scope excluded
    • source: exact file
    • provenance: AFP entry “The HOL-CSP Refinement Toolkit”, dated 2020-11-19; authors Safouan Taha, Burkhart Wolff, Lina Ye; metadata
    • proof statement excerpt: lemma DF_SYSTEM: "DF UNIV \<sqsubseteq>\<^sub>F\<^sub>D SYSTEM" (full source statement)

  • ConcurrentHOL / parallel predicate search

    • specified: concurrent programs with trace/assume-guarantee semantics
    • safety: refinement or program contract as declared
    • liveness: termination only where covered by exact contract; not inferred
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here
    • size: 333 physical lines across 1 .thy files in this file; imports outside this scope excluded
    • source: exact file
    • provenance: AFP entry “ConcurrentHOL”, dated 2024-04-16; authors Peter Gammie; metadata
    • proof statement excerpt: lemma ag_findP_coprime: \<comment>\<open> Shuffle the parameter to the precondition, exploiting purity. \<close> shows "prog.p2s findP_coprime \<le> \<lbrace>\<langle>a\<rangle> \<^bold>= get\<^bsub>fst\<^sub>L\<^esub>\<rbrace>, Id \<turnstile> Id, \<lbrace>\<lambda>rv s. rv = (LEAST i. i < length (get\<^bsub>snd\<^sub>L\<^esub> s) \<longrightarrow> coprime a (get\<^bsub>snd\<^sub>L\<^esub> s ! i))\<rbrace>" (full source statement)

  • ConcurrentHOL / breadth-first search refinement

    • specified: concurrent programs with trace/assume-guarantee semantics
    • safety: refinement or program contract as declared
    • liveness: termination only where covered by exact contract; not inferred
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here
    • size: 457 physical lines across 1 .thy files in this file; imports outside this scope excluded
    • source: exact file
    • provenance: AFP entry “ConcurrentHOL”, dated 2024-04-16; authors Peter Gammie; metadata
    • proof statement excerpt: theorem ref_bfs: shows "bfs f P x \<le> asearch f P x" unfolding search_def (full source statement)

  • ConcurrentHOL / shared-variable increments

    • specified: concurrent programs with trace/assume-guarantee semantics
    • safety: refinement or program contract as declared
    • liveness: termination only where covered by exact contract; not inferred
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here
    • size: 372 physical lines across 1 .thy files in this file; imports outside this scope excluded
    • source: exact file
    • provenance: AFP entry “ConcurrentHOL”, dated 2024-04-16; authors Peter Gammie; metadata
    • proof statement excerpt: lemma pag_incr: \<comment>\<open> postcondition can be simplified wrt \<open>comm_xpp\<close> \<close> shows "prog.p2s incr \<le> \<lbrace>\<lambda>A. wdp.ceiling A ((=) c)\<rbrace>, comm_xpp \<turnstile>\<^sub>P increases, \<lbrace>\<lambda>A. \<langle>wdp.ceiling A ((=) (c + 1))\<rangle>\<rbrace>" (full source statement)

  • ConcurrentHOL / TSO weak-memory litmus tests

    • specified: concurrent programs with trace/assume-guarantee semantics
    • safety: refinement or program contract as declared
    • liveness: termination only where covered by exact contract; not inferred
    • tool/status: Isabelle/HOL; specification/definition source; no proof declaration identified in this scope
    • size: 127 physical lines across 1 .thy files in this file; imports outside this scope excluded
    • source: exact file
    • provenance: AFP entry “ConcurrentHOL”, dated 2024-04-16; authors Peter Gammie; metadata
    • property/model declaration excerpt (not proof evidence): definition iwp2_3_a :: "(nat \<times> nat) tso" where "iwp2_3_a = do { x \<leftarrow> tso.Ref.ref 0 ; y \<leftarrow> tso.Ref.ref 0 ; xvr \<leftarrow> tso.Ref.ref 0 ; yvr \<leftarrow> tso.Ref.ref 0 ; ( ( do { x := 1 ; yv \<leftarrow> !y ; yvr := yv } ) \<parallel> ( do { y := 1 ; xv \<leftarrow> !x ; xvr := xv } ) ) ; xv <- !xvr ; yv <- !yvr ; tso.return (xv, yv) }" code_thms iwp2_3_a export_code iwp2_3_a in Haskell schematic_goal iwp2_3_a: \<comment>\<open> Can terminate with both threads reading 0’’ <close> shows “<lblot>heap.empty, ?xs, Some (0, 0)<rblot> <le> prog.p2s (tso.t2p iwp2_3_a)” supply heap.simps[simp]`` (full source statement)

  • concurrent IMP / semaphore threads

    • specified: thread-local/global variables, locks, interleaving
    • safety: program correctness
    • liveness: deadlock freedom for particular modeled threads
    • tool/status: Isabelle/HOL; incomplete proof source: omission tokens found; no completed proof claim
    • size: 977 physical lines across 1 .thy files in this file; imports outside this scope excluded
    • source: exact file
    • provenance: AFP entry “IMP_concur - A Semantics for a Language with Concurrency based on HOL-CSP”, dated 2026-08-31; authors Burkhart Wolff; metadata
    • proof statement excerpt: theorem correct: assumes \<open>\<forall> i \<in> set[1..NP]. A'(array(''A'',idx)) = A!(nat(idx-1))\<close> and \<open>length A = nat NP\<close> shows \<open>deadlock_free (Thread7_sem A A')\<close> unfolding deadlock_free_def Thread7_sem_def Sem_def Thread7_def oops (full source statement)
    • proof statement excerpt: theorem bullocks2 : \<open>deadlock_free Thread6_sem\<close> unfolding Thread6_sem_def Sem_def Thread5_def Thread6_def (full source statement)
    • unfinished step evidence: oops (source line); 1 matching source lines in this row’s scope (lexical scan, not a dependency audit)

  • Igloo / leader-election

    • specified: successive abstract-to-I/O refinements of leader-election
    • safety: event/state invariants and refinement; security models additionally state authentication
    • liveness: no standalone eventual-progress claim identified
    • tool/status: Isabelle/HOL; Isabelle proof source; not rebuilt; scope includes refinement levels
    • size: 1,207 physical lines across 6 .thy files in this directory; imports outside this scope excluded
    • source: exact directory
    • proof statement excerpt: lemma tr2_refines_tr1: "tr2 \<sqsubseteq>\<^sub>\<pi>2 tr1" (full source statement)
    • proof statement excerpt: lemma leader_election_node_iospec: "IOspec t i ad s = (\<forall>\<^sup>\<star> (\<lambda>v. if v = Unit then ExT (\<lambda>t'. ExV (\<lambda>w. CBio B_set_up3s t v w t' \<star> IOspec t' i ad (s\<lparr>obuf2 := insert i (obuf2 s)\<rparr>))) else Bool True) \<star> (\<forall>\<^sup>\<star> (\<lambda>v. if v = Unit then ExT (\<lambda>t'. ExV (\<lambda>w. CBio B_receive3s t v w t' \<star> IOspec t' i ad (s\<lparr>ibuf2 := insert (MsgD w) (ibuf2 s)\<rparr>))) else Bool True) \<star> (\<forall>\<^sup>\<star> (\<lambda>v. if case v of Msg msg \<Rightarrow> msg \<in> ibuf2 s \<and> i \<^bold>< msg | _ \<Rightarrow> False then ExT (\<lambda>t'. ExV (\<lambda>w. CBio B_accept3s t v w t' \<star> IOspec t' i ad (s\<lparr>obuf2 := insert (MsgD v) (obuf2 s)\<rparr>))) else Bool True) \<star> (\<forall>\<^sup>\<star> (\<lambda>v. if case v of AddrMsg msg ad' \<Rightarrow> msg \<in> obuf2 s \<and> ad' = ad | _ \<Rightarrow> False then ExT (\<lambda>t'. ExV (\<lambda>w. UDP_send t v w t' \<star> IOspec t' i ad s)) else Bool True) \<star> (\<forall>\<^sup>\<star> (\<lambda>v. if i \<in> ibuf2 s \<and> v = Unit then ExT (\<lambda>t'. ExV (\<lambda>w. CBio B_elect3s t v w t' \<star> IOspec t' i ad (s\<lparr>leader2 := True\<rparr>))) else Bool True) \<star> (\<forall>\<^sup>\<star> (\<lambda>v. ExT (\<lambda>t'. ExV (\<lambda>w. CBio B_skip3s t v w t' \<star> IOspec t' i ad s))) \<star> Bool True))))))" \<comment> \<open>Note first part of proof only work on LHS (in particular, lPr.code).\<close> (full source statement)

  • Igloo / replication

    • specified: successive abstract-to-I/O refinements of replication
    • safety: event/state invariants and refinement; security models additionally state authentication
    • liveness: no standalone eventual-progress claim identified
    • tool/status: Isabelle/HOL; Isabelle proof source; not rebuilt; scope includes refinement levels
    • size: 3,746 physical lines across 4 .thy files in this directory; imports outside this scope excluded
    • source: exact directory
    • proof statement excerpt: lemma cval_case_const: "(case cval of cUnit \<Rightarrow> c | cUpdate _ _ \<Rightarrow> c | cInt1 _ _ \<Rightarrow> c | cInt2 _ _ _ \<Rightarrow> c | cInt3 _ \<Rightarrow> c) = c" (full source statement)
    • proof statement excerpt: lemma multiple_Inv: "\<lbrakk>Inv E I; Inv E J\<rbrakk> \<Longrightarrow> Inv E (\<lambda>s. I s \<and> J s)" (full source statement)

  • Igloo / security-protocols

    • specified: successive abstract-to-I/O refinements of security-protocols
    • safety: event/state invariants and refinement; security models additionally state authentication
    • liveness: no standalone eventual-progress claim identified
    • tool/status: Isabelle/HOL; Isabelle proof source; not rebuilt; scope includes refinement levels
    • size: 4,798 physical lines across 16 .thy files in this directory; imports outside this scope excluded
    • source: exact directory
    • proof statement excerpt: theorem m4_refines_m3: "m4 \<sqsubseteq>\<^sub>\<pi>\<^sub>4 m3" (full source statement)
    • proof statement excerpt: lemma PO_m2_inv2 [simp, intro]: "reach m2 s \<Longrightarrow> m2_inv1_auth s" (full source statement)

  • AWN / toy forwarding protocol

    • specified: packet forwarding through network node and queue semantics
    • safety: node/next-hop sequence numbers preserve ordered invariant
    • liveness: no progress theorem identified in this row’s source
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here
    • size: 875 physical lines across 1 .thy files in this file; imports outside this scope excluded
    • source: exact file
    • provenance: AFP entry “Mechanization of the Algebra for Wireless Networks (AWN)”, dated 2014-03-08; authors Timothy Bourke; metadata
    • proof statement excerpt: lemma bigger_than_next: assumes "wf_net_tree n" shows "closed (pnet (\<lambda>i. ptoy i \<langle>\<langle> qmsg) n) \<TTurnstile> netglobal (\<lambda>\<sigma>. \<forall>i. no (\<sigma> i) \<le> no (\<sigma> (nhid (\<sigma> i))))" (is "_ \<TTurnstile> netglobal (\<lambda>\<sigma>. \<forall>i. ?inv \<sigma> i)") (full source statement)

  • ConcurrentHOL / parallel Floyd–Warshall

    • specified: parallel updates of shortest-path adjacency matrix
    • safety: parallel program refines chaotic specification; graph complete and numeric limits abstracted
    • liveness: no progress theorem identified in this row’s source
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here
    • size: 439 physical lines across 1 .thy files in this file; imports outside this scope excluded
    • source: exact file
    • provenance: AFP entry “ConcurrentHOL”, dated 2024-04-16; authors Peter Gammie; metadata
    • proof statement excerpt: lemma fw_fw_chaotic_le: \<comment>\<open> the executable program refines the specification \<close> shows "fw a \<le> fw_chaotic a" unfolding fw_chaotic_def fw_def (full source statement)

  • distributed distinct-element cardinality estimator

    • specified: randomized mergeable cardinality sketch supporting parallel operation
    • safety: probabilistic approximation and space bounds; network consensus not part of this model
    • liveness: no network/scheduler progress assertion identified
    • tool/status: Isabelle/HOL; machine-checkable proof source present; not rebuilt here
    • size: 6,538 physical lines across 8 .thy files in this directory; imports outside this scope excluded
    • source: exact directory
    • provenance: AFP entry “Distributed Distinct Elements”, dated 2023-04-03; authors Emin Karayel; metadata
    • proof statement excerpt: theorem correctness: fixes X assumes "sketch_tree_set t \<subseteq> {..<n}" defines "p \<equiv> pmf_of_set {..<pro_size \<Theta>}" defines "X \<equiv> real (card (sketch_tree_set t))" shows "measure p {\<omega>. \<bar>estimate (eval \<omega> t) - X\<bar> > \<epsilon> * X} \<le> \<delta>" (is "?L \<le> ?R") (full source statement)
    • proof statement excerpt: lemma accuracy_without_cutoff: "measure \<Psi> {(f,g,h). \<bar>Y (f,g,h) - real X\<bar> > \<epsilon> * X \<or> s f < q_max} \<le> 1/2^4" (is "?L \<le> ?R") (full source statement)
    • proof statement excerpt: theorem asymptotic_space_complexity: "space_usage \<in> O[at_top \<times>\<^sub>F at_right 0 \<times>\<^sub>F at_right 0](\<lambda>(n, \<epsilon>, \<delta>). ln (1/\<delta>)/\<epsilon>^2 + ln n)" (full source statement)

Lean 4 source cases

  • Basic Paxos / history-variable model

    • specified: phase 1/2 message-set transitions
    • safety: Agreement: two chosen values cannot differ
    • liveness: no liveness claim identified
    • tool/status: Lean 4; machine-checkable proof source present; not rebuilt here; explicit axioms found
    • size: 1,020 physical lines across 4 .lean files in this directory; imports outside this scope excluded
    • source: exact directory
    • proof statement excerpt: theorem Agreement {σ : ℕ → Set Message} (hSpec : PaxosSpec Quorums σ) : ∀ n, Agree (σ n) Quorums (full source statement)
    • axiom evidence: axiom QuorumAssumption (h1 : Q₁ ∈ Quorums) (h2 : Q₂ ∈ Quorums) : Q₁ ∩ Q₂ ≠ ∅ (source line); 1 matching source lines in this row’s scope (lexical scan, not a dependency audit)

  • LeanDA / two-phase commit

    • specified: two-phase commit
    • safety: commit/abort consistency and inductive invariants
    • liveness: no protocol termination proof identified
    • tool/status: Lean 4; machine-checkable proof source present; not rebuilt here
    • size: 1,846 physical lines across 5 .lean files in this directory; imports outside this scope excluded
    • source: exact directory
    • proof statement excerpt: theorem invariant_implies_consistency (s: ProtocolState RM) (h_inv: invariant s): consistency s (full source statement)

  • LeanDA / eventually perfect failure detector

    • specified: eventually perfect failure detector
    • safety: no separate safety theorem identified; eventual accuracy is a progress property, not safety
    • liveness: strong completeness on fair runs: failed processes eventually stay suspected; eventual strong accuracy remains an unproved commented-out draft
    • tool/status: Lean 4; machine-checkable proof source present; not rebuilt here
    • size: 1,476 physical lines across 4 .lean files in this directory; imports outside this scope excluded
    • source: exact directory
    • proof statement excerpt: theorem strong_completeness_on_states (tr: Trace Proc) (h_is_fair_run: is_fair_run Proc InitDelay GST MsgDelay tr) (Crashed: Finset Proc): is_strongly_complete Proc Crashed (states_of_trace Proc tr) (full source statement)

  • LeanDA / Ben-Or Byzantine agreement

    • specified: Ben-Or Byzantine agreement
    • safety: agreement invariant over generated definitions
    • liveness: no probabilistic termination theorem identified
    • tool/status: Lean 4; machine-checkable proof source present; not rebuilt here
    • size: 7,063 physical lines across 3 .lean files in this directory; imports outside this scope excluded
    • source: exact directory
    • proof statement excerpt: theorem agreement_inv_invariant {tr : Nat → State} (hmodel : ∀ i, model_assumptions (tr i)) (htype : ∀ i, type_ok (tr i)) (hinit : init_with_faults (tr 0)) (hnext : ∀ i, Next (tr i) (tr (i + 1))) : ∀ i, agreement_inv (tr i) (full source statement)

  • LeanDA / single-height Tendermint

    • specified: single-height Tendermint
    • safety: run_agreement and inductive invariant
    • liveness: no termination theorem identified
    • tool/status: Lean 4; machine-checkable proof source present; not rebuilt here
    • size: 8,571 physical lines across 6 .lean files in this directory; imports outside this scope excluded
    • source: exact directory
    • proof statement excerpt: theorem run_agreement {tr : Nat → State} (hmodel : model_assumptions (tr 0)) (hrun : IsRun tr) (i : Nat) : agreement (tr i) (full source statement)

  • Zug atomic broadcast

    • specified: round leader, reliable broadcast and weak binary agreement
    • safety: ordered outputs agree and are valid
    • liveness: censorship resilience and eventual outputs under partial synchrony
    • tool/status: Lean 4; machine-checkable proof source present; not rebuilt here
    • size: 3,621 physical lines across 24 .lean files in this directory; imports outside this scope excluded
    • source: exact directory
    • proof statement excerpt: theorem atomic_broadcast_correctness (pb : ProtocolBehavior V ctx) (L : NodeId) (hL : ctx.correct L) (v : V) (t₀ : Time) (hgst₀ : ctx.sync.gst ≤ t₀) (hpending : ∀ t, t₀ ≤ t → ctx.pending L t v ∨ ∃ k, KthOutputAt ctx.views L t k v) : (∀ N, ctx.correct N → ∀ k w, KthOutput ctx.views N k w → ∀ N', ctx.correct N' → KthOutput ctx.views N' k w) ∧ ∃ k, ∀ N, ctx.correct N → KthOutput ctx.views N k v (full source statement)
    • proof statement excerpt: theorem censorship_resilience (pb : ProtocolBehavior V ctx) (L : NodeId) (hL : ctx.correct L) (v : V) (t₀ : Time) (hgst₀ : ctx.sync.gst ≤ t₀) (hpending : ∀ t, t₀ ≤ t → ctx.pending L t v ∨ ∃ k, KthOutputAt ctx.views L t k v) : ∃ k, ∀ N, ctx.correct N → KthOutput ctx.views N k v (full source statement)
    • proof statement excerpt: theorem kth_output_agreement (agreement : SubprotocolAgreement V correct views) {N : NodeId} (hN : correct N) {k : Nat} {v : V} (hout : KthOutput views N k v) : ∀ N', correct N' → KthOutput views N' k v (full source statement)

  • Zug / reliable broadcast

    • specified: reliable broadcast
    • safety: agreement and validity
    • liveness: conditional weak termination
    • tool/status: Lean 4; machine-checkable proof source present; not rebuilt here
    • size: 438 physical lines across 5 .lean files in this directory; imports outside this scope excluded
    • source: exact directory
    • proof statement excerpt: theorem rb_agreement {inst : RBInstance V} {qa : QuorumAxioms inst.cfg inst.correct} {np : NetworkProperties (Msg V) inst.correct inst.net inst.gst inst.delta_net} (beh : RBBehavior inst qa np) : RBAgreement inst.correct (mkRBView inst) where persistent (full source statement)
    • proof statement excerpt: theorem rb_validity {V : Type} {inst : RBInstance V} {qa : QuorumAxioms inst.cfg inst.correct} {np : NetworkProperties (Msg V) inst.correct inst.net inst.gst inst.delta_net} (beh : RBBehavior inst qa np) : RBValidity inst.correct (mkRBView inst) inst.proposer inst.input_at where validity (full source statement)
    • proof statement excerpt: theorem rb_weak_termination {inst : RBInstance V} {qa : QuorumAxioms inst.cfg inst.correct} {np : NetworkProperties (Msg V) inst.correct inst.net inst.gst inst.delta_net} (beh : RBBehavior inst qa np) : RBTimedWeakTermination inst.correct (mkRBView inst) inst.proposer inst.input_at inst.gst (3 * inst.delta_net) where weak_termination (full source statement)

  • Zug / weakly terminating binary agreement

    • specified: weakly terminating binary agreement
    • safety: agreement and validity
    • liveness: conditional weak termination
    • tool/status: Lean 4; machine-checkable proof source present; not rebuilt here
    • size: 375 physical lines across 4 .lean files in this directory; imports outside this scope excluded
    • source: exact directory
    • proof statement excerpt: theorem wba_agreement {inst : WBAInstance} {qa : QuorumAxioms inst.cfg inst.correct} {np : NetworkProperties Msg inst.correct inst.net inst.gst inst.delta_net} (beh : WBABehavior inst qa np) : WBAAgreement inst.correct (mkWBAView inst) where persistent (full source statement)
    • proof statement excerpt: theorem wba_validity {inst : WBAInstance} {qa : QuorumAxioms inst.cfg inst.correct} {np : NetworkProperties Msg inst.correct inst.net inst.gst inst.delta_net} (beh : WBABehavior inst qa np) : WBAValidity inst.cfg inst.correct (mkWBAView inst) inst.input_at where validity (full source statement)
    • proof statement excerpt: theorem wba_weak_termination {inst : WBAInstance} {qa : QuorumAxioms inst.cfg inst.correct} {np : NetworkProperties Msg inst.correct inst.net inst.gst inst.delta_net} (beh : WBABehavior inst qa np) : WBATimedWeakTermination inst.cfg inst.correct (mkWBAView inst) inst.gst (3 * inst.delta_net) inst.input_at where weak_termination (full source statement)

  • Zug / earlier prototype

    • specified: network and protocol skeleton
    • safety: partial proof definitions; unfinished statement
    • liveness: not established
    • tool/status: Lean 4; incomplete Lean prototype; source includes sorry
    • size: 116 physical lines across 3 .lean files in this directory; imports outside this scope excluded
    • source: exact directory
    • property/model declaration excerpt (not proof evidence): def transform (w_binary_agreement : WBA) (reliable_broadcast : RB β) : AB β (full source statement)
    • unfinished step evidence: by sorry (source line); 1 matching source lines in this row’s scope (lexical scan, not a dependency audit)

  • Raft / structural model with proof stubs

    • specified: Raft roles, persistent log, RPCs and network soup
    • safety: states log matching, network matching and state machine safety; theorem bodies include sorry
    • liveness: not identified
    • tool/status: Lean 4; specification plus unfinished proof stubs; not a completed Raft proof
    • size: 654 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem raft_is_safe (w : NetworkWorld) (trace : List Packet) (h_init : InitState w) : RaftInvariant (applyTrace w trace) (full source statement)
    • proof statement excerpt: theorem no_double_voting (node : NodeState) (cA cB term lIdx lTerm : Nat) (h_diff : cA ≠ cB) : let (stateAfterA, grantedA) (full source statement)
    • proof statement excerpt: theorem invariant_preserved_over_trace (w : NetworkWorld) (trace : List Packet) (h_inv : RaftInvariant w) : RaftInvariant (applyTrace w trace) (full source statement)
    • unfinished step evidence: h_commit_bounds := by sorry (source line); 18 matching source lines in this row’s scope (lexical scan, not a dependency audit)

  • quorum safety / quorum intersection

    • specified: quorum intersection
    • safety: quorums pairwise intersect
    • liveness: explicitly outside this safety-only model
    • tool/status: Lean 4; machine-checkable proof source present; not rebuilt here
    • size: 85 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem agreement (qs : QuorumSystem α) (vote : α → Option V) {v v' : V} (h : Chosen qs vote v) (h' : Chosen qs vote v') : v = v' (full source statement)

  • quorum safety / strict-majority quorum instance

    • specified: strict-majority quorum instance
    • safety: strict majority implies intersection
    • liveness: explicitly outside this safety-only model
    • tool/status: Lean 4; machine-checkable proof source present; not rebuilt here
    • size: 61 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem majority_agreement {V : Type*} (vote : α → Option V) {v v' : V} (h : Chosen (majorityQuorums α) vote v) (h' : Chosen (majorityQuorums α) vote v') : v = v' (full source statement)

  • quorum safety / single-decree agreement

    • specified: single-decree agreement
    • safety: same single-valued vote assignment cannot choose two values
    • liveness: explicitly outside this safety-only model
    • tool/status: Lean 4; machine-checkable proof source present; not rebuilt here
    • size: 142 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem cert_agreement_cross (cfg cfg' : Config α) (vote : α → Option V) (c c' : Cert α V) (h : Valid cfg vote c) (h' : Valid cfg' vote c') (hoverlap : c.voters.card + c'.voters.card > (cfg.members ∪ cfg'.members).card) : c.value = c'.value (full source statement)

  • quorum safety / quorum reconfiguration

    • specified: quorum reconfiguration
    • safety: agreement across configurations under shared-vote premise
    • liveness: explicitly outside this safety-only model
    • tool/status: Lean 4; machine-checkable proof source present; not rebuilt here
    • size: 118 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem agreement_history (configs : ℕ → QuorumSystem α) (hcompat : ∀ i j, Compatible (configs i) (configs j)) (vote : α → Option V) {i j : ℕ} {v v' : V} (h : Chosen (configs i) vote v) (h' : Chosen (configs j) vote v') : v = v' (full source statement)

  • quorum safety / certificate checker soundness

    • specified: certificate checker soundness
    • safety: accepted certificates cannot carry conflicting values
    • liveness: explicitly outside this safety-only model
    • tool/status: Lean 4; machine-checkable proof source present; not rebuilt here
    • size: 126 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem agreement_via_bridge (members : List Nat) (votes : Votes) (c c' : Checker.Cert) (h : validB members votes c = true) (h' : validB members votes c' = true) : c.value = c'.value (full source statement)

  • CRDT / generic state-based CRDT

    • specified: generic state-based CRDT
    • safety: equal delivered update sets give equal state
    • liveness: none in this file
    • tool/status: Lean 4; machine-checkable proof source present; not rebuilt here
    • size: 87 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem strong_eventual_consistency (l₁ l₂ : List S) (h : l₁.toFinset = l₂.toFinset) : l₁.foldr merge ⊥ = l₂.foldr merge ⊥ (full source statement)

  • CRDT / add-wins observed-remove set

    • specified: add-wins observed-remove set
    • safety: strong eventual consistency
    • liveness: conditional eventual agreement
    • tool/status: Lean 4; machine-checkable proof source present; not rebuilt here
    • size: 147 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem strong_eventual_consistency (l₁ l₂ : List (State α τ)) (h : l₁.toFinset = l₂.toFinset) : l₁.foldr merge ⊥ = l₂.foldr merge ⊥ (full source statement)
    • proof statement excerpt: theorem eventual_agreement {ι : Type*} (sys : DeliverySystem ι (State α τ)) (r₁ r₂ : ι) : ∃ T, ∀ t, T ≤ t → replicaState (sys.delivered r₁ t) = replicaState (sys.delivered r₂ t) (full source statement)

  • CRDT / ordered replicated sequence

    • specified: ordered replicated sequence
    • safety: read strong eventual consistency
    • liveness: conditional eventual agreement
    • tool/status: Lean 4; machine-checkable proof source present; not rebuilt here
    • size: 141 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem read_strong_eventual_consistency (l₁ l₂ : List (State ι α)) (h : l₁.toFinset = l₂.toFinset) : read (l₁.foldr merge ⊥) = read (l₂.foldr merge ⊥) (full source statement)
    • proof statement excerpt: theorem eventual_agreement {κ : Type*} (sys : DeliverySystem κ (State ι α)) (r₁ r₂ : κ) : ∃ T, ∀ t, T ≤ t → replicaState (sys.delivered r₁ t) = replicaState (sys.delivered r₂ t) (full source statement)

  • CRDT / replica delivery system

    • specified: replica delivery system
    • safety: agreed converged state
    • liveness: all replicas eventually reach and stay at join of all updates under fairness
    • tool/status: Lean 4; machine-checkable proof source present; not rebuilt here
    • size: 106 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem DeliverySystem.eventual_agreement (sys : DeliverySystem ι S) (r₁ r₂ : ι) : ∃ T, ∀ t, T ≤ t → replicaState (sys.delivered r₁ t) = replicaState (sys.delivered r₂ t) (full source statement)

  • CRDT / partitioned single-use authority and handoff

    • specified: partitioned single-use authority and handoff
    • safety: no double spend/unique live authority under sealing premises
    • liveness: handoff constraints and modeled availability; source live predicates are not automatically temporal progress
    • tool/status: Lean 4; machine-checkable proof source present; not rebuilt here
    • size: 1,506 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem no_silent_handoff (S : AuthoritySystem D) (hsafe : Safe S) (hdis : ∀ c, S.reachable c → ∀ d₁ d₂ : D, d₁ ≠ d₂ → S.disconnected c d₁ d₂) {c₁ c₂ : S.Config} {d₁ d₂ : D} (hr : S.reachable c₁) (hchain : StepChain S c₁ c₂) (h₁ : S.live c₁ d₁) (h₂ : S.live c₂ d₂) : d₁ = d₂ (full source statement)
    • proof statement excerpt: theorem sealed_handoff_safe (w : CutWorld) (h : w.SealedHandoff) : ∀ C : Finset PE, w.closedCut C → w.validCut C → (w.cutReceipts C).card ≤ 1 (full source statement)

  • CRDT / G-Set

    • specified: G-Set merge carrier
    • safety: strong eventual consistency of this carrier
    • liveness: eventual agreement under DeliverySystem fairness
    • tool/status: Lean 4; machine-checkable proof source present; not rebuilt here
    • size: 164 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem gset_strong_eventual_consistency (l₁ l₂ : List (Finset α)) (h : l₁.toFinset = l₂.toFinset) : l₁.foldr merge ⊥ = l₂.foldr merge ⊥ (full source statement)
    • proof statement excerpt: theorem gset_eventual_agreement {ι : Type*} (sys : DeliverySystem ι (Finset α)) (r₁ r₂ : ι) : ∃ T, ∀ t, T ≤ t → replicaState (sys.delivered r₁ t) = replicaState (sys.delivered r₂ t) (full source statement)

  • CRDT / G-Counter

    • specified: G-Counter merge carrier
    • safety: strong eventual consistency of this carrier
    • liveness: eventual agreement under DeliverySystem fairness
    • tool/status: Lean 4; machine-checkable proof source present; not rebuilt here
    • size: 164 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem gcounter_strong_eventual_consistency (l₁ l₂ : List (GCounter ι)) (h : l₁.toFinset = l₂.toFinset) : l₁.foldr merge ⊥ = l₂.foldr merge ⊥ (full source statement)
    • proof statement excerpt: theorem gcounter_eventual_agreement (sys : DeliverySystem ι (GCounter ι)) (r₁ r₂ : ι) : ∃ T, ∀ t, T ≤ t → replicaState (sys.delivered r₁ t) = replicaState (sys.delivered r₂ t) (full source statement)

  • CRDT / PN-Counter

    • specified: PN-Counter merge carrier
    • safety: strong eventual consistency of this carrier
    • liveness: eventual agreement under DeliverySystem fairness
    • tool/status: Lean 4; machine-checkable proof source present; not rebuilt here
    • size: 164 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem pncounter_strong_eventual_consistency (l₁ l₂ : List (PNCounter ι)) (h : l₁.toFinset = l₂.toFinset) : l₁.foldr merge ⊥ = l₂.foldr merge ⊥ (full source statement)
    • proof statement excerpt: theorem pncounter_eventual_agreement (sys : DeliverySystem ι (PNCounter ι)) (r₁ r₂ : ι) : ∃ T, ∀ t, T ≤ t → replicaState (sys.delivered r₁ t) = replicaState (sys.delivered r₂ t) (full source statement)

  • decoupled consensus / review theorem

    • specified: executable consensus model’s bundled guarantees
    • safety: finality safety, monotonicity, accountability and honest-unslashability
    • liveness: availability, finality and recovery under delivery, participation and proposer-recurrence premises
    • tool/status: Lean 4; Lean theorem source; repository README claims complete proof; this one-file LOC excludes 1,000+ supporting modules
    • size: 445 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem concreteConsensus (S : Setup V) : Statements.Instantiation.Consensus S (full source statement)

  • decoupled consensus / algorithm specification

    • specified: Goldfish/stable-grade/finality stores, voting, healing and duties
    • safety: algorithm definitions; protocol-level safety theorem not identified
    • liveness: protocol-level liveness theorem not identified
    • tool/status: Lean 4; Lean specification source, no full consensus proof identified in this scope
    • size: 3,605 physical lines across 18 .lean files in this directory; imports outside this scope excluded
    • source: exact directory
    • property/model declaration excerpt (not proof evidence): def filterM [DecidableEq α] [Monad m] [Std.Commutative (unionM (α := α) (m := m))] [Std.Associative (unionM (α := α) (m := m))] (p : α → m Bool) (s : Finset α) : m (Finset α) (full source statement)

  • synchronous Goldfish security

    • specified: synchronous Goldfish security
    • safety: ledger safety under explicit good-event assumptions
    • liveness: ledger liveness under synchronous assumptions
    • tool/status: Lean 4; Lean conditional theorem source; external and probabilistic axioms in Goldfish/Axioms.lean must be included in trust assessment
    • size: 236 physical lines across 5 .lean files in this directory; imports outside this scope excluded
    • source: exact directory
    • proof statement excerpt: theorem theorem1 (S : Spec E) {lead : Validator} {t : Slot} (hmaj : HonestMajorityPerSlot E) (hlead : E.leader lead t) : ∀ t' : Slot, t < t' → ∀ id : Validator, E.awakeHonest id (E.voteRound t') → E.eligibleVote id t' → E.proposalBlock lead t ≤ E.forkChoice id (E.voteRound t') (full source statement)
    • proof statement excerpt: theorem theorem2 (S : Spec E) (L : Ledger E κ) (TX : TxModel E) (hmaj : HonestMajorityPerSlot E) (hwin : HonestLeaderEveryWindow E κ) : L.Safe ∧ TX.Live L ((2 * κ + 2) * (3 * E.Δ)) (full source statement)

  • Goldfish fast confirmation

    • specified: Goldfish fast confirmation
    • safety: safe fast confirmation
    • liveness: conditional confirmation latency
    • tool/status: Lean 4; Lean conditional theorem source; external and probabilistic axioms in Goldfish/Axioms.lean must be included in trust assessment
    • size: 418 physical lines across 6 .lean files in this directory; imports outside this scope excluded
    • source: exact directory
    • proof statement excerpt: theorem theorem5 (FS : Spec4Δ E) (FL : Ledger4Δ E κ) (hmaj : HonestMajorityPerSlot E) {idc : Validator} {t : Slot} {B : Block} (hfc : E.fastConfirms idc t B) : FL.Safe ∧ ∀ {r : Round} {id : Validator}, 4 * E.Δ * (t + κ) + 2 * E.Δ ≤ r → E.awakeHonest id r → B ≤ FL.chain id r (full source statement)
    • proof statement excerpt: theorem theorem6 (FS : Spec4Δ E) (FL : Ledger4Δ E κ) (TX : TxModel4Δ E) (hmaj : HonestMajorityPerSlot E) (hwin : HonestLeaderEveryWindow E κ) {lead : Validator} {t : Slot} (hlead : E.leader lead t) {idc : Validator} (hwake_idc : E.awakeHonest idc (E.fastConfirmRound t)) : TX.Live FL ((2 * κ + 2) * (4 * E.Δ)) ∧ E.fastConfirms idc t (E.proposalBlock lead t) (full source statement)

  • Goldfish ebb-and-flow composition

    • specified: Goldfish ebb-and-flow composition
    • safety: accountable finality under gadget assumptions
    • liveness: healing/liveness under stated assumptions
    • tool/status: Lean 4; Lean conditional theorem source; external and probabilistic axioms in Goldfish/Axioms.lean must be included in trust assessment
    • size: 612 physical lines across 8 .lean files in this directory; imports outside this scope excluded
    • source: exact directory
    • proof statement excerpt: theorem theorem7 {κ : ℕ} {G : Gadget E} (S : Spec E) (L : Ledger E κ) (TX : TxModel E) (Tacc : ℕ) (hmaj : HonestMajorityPerSlot E) (hwin : HonestLeaderEveryWindow E κ) (hchava : ∀ {id : Validator} {r : Round}, G.chava id r = L.chain id r) (hrecency : ∀ {idc : Validator} {r : Round} {B : Block}, G.checkpointed idc r B → G.maxGAS < r → G.Recent L B r) (healing_liveness : HonestLeaderEveryWindow E κ → (∀ {idc : Validator} {r : Round} {B : Block}, G.checkpointed idc r B → G.maxGAS < r → G.Recent L B r) → (∀ {id : Validator} {r r' : Round} {B B' : Block}, G.checkpointed id r B → G.checkpointed id r' B' → r ≤ r' → r' < r + G.Tchkpt → B = B') → G.LiveAfter TX G.chava (G.maxGAS + E.Δ + 2 * G.Tchkpt) (G.Tchkpt + G.Ttmout + G.Tbft)) (accountable_liveness : G.SecureAfter TX G.chava (G.maxGAS + E.Δ + 2 * G.Tchkpt) (G.Tchkpt + G.Ttmout + G.Tbft) → (∀ {id id' : Validator} {r r' : Round} {B B' : Block}, G.checkpointed id r B → G.checkpointed id' r' B' → BlockTree.Consistent B B') → G.LiveAfter TX G.chacc (G.maxGAS + E.Δ + 2 * G.Tchkpt) Tacc) : EbbAndFlowProperty G TX ((2 * κ + 2) * (3 * E.Δ)) (G.maxGAS + E.Δ + 2 * G.Tchkpt) Tacc (full source statement)
    • axiom evidence: axiom proposition3 (G : Gadget E) : (source line); 5 matching source lines in this row’s scope (lexical scan, not a dependency audit)

  • bounded Paxos learning model

    • specified: three-node Python/reactive-module model and network histories
    • safety: Safety stated but universal safety proof remains open; finite replay/interpreter proofs present
    • liveness: unfair-run counterexample to unconditional proposal progress; fair liveness remains open
    • tool/status: Lean 4; mixed Lean finite witnesses/interpreter proofs and Z3 checks; not a universal Paxos correctness proof
    • size: 691 physical lines across 6 .lean files in this directory; imports outside this scope excluded
    • source: exact directory
    • property/model declaration excerpt (not proof evidence): def Safety : Prop (full source statement)
    • proof statement excerpt: theorem stalled_not_live : ¬ ProposalLiveness stalledTrace (full source statement)
    • property/model declaration excerpt (not proof evidence): def LearningLiveness (trace : Nat → World) : Prop (full source statement)

  • EPFL prototype / Paxos model

    • specified: Paxos model
    • safety: model invariant/commit-input consistency where declared; see proof omission scan
    • liveness: not identified
    • tool/status: Lean 4; prototype definitions/proof attempts; imports include admitted helper lemmas; no complete protocol-proof claim
    • size: 165 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • property/model declaration excerpt (not proof evidence): def Value (full source statement)

  • EPFL prototype / Paxos proof attempt

    • specified: Paxos proof attempt
    • safety: model invariant/commit-input consistency where declared; see proof omission scan
    • liveness: not identified
    • tool/status: Lean 4; prototype definitions/proof attempts; imports include admitted helper lemmas; no complete protocol-proof claim
    • size: 109 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem inv_proof (s1 s2: System a l p) (v: Value): step s1 s2 -> ∀ j, (s2.learners j).decide ≠ some v -> (s1.learners j).decide ≠ some v (full source statement)

  • EPFL prototype / Paxos proof variant 2

    • specified: Paxos proof variant 2
    • safety: model invariant/commit-input consistency where declared; see proof omission scan
    • liveness: not identified
    • tool/status: Lean 4; prototype definitions/proof attempts; imports include admitted helper lemmas; no complete protocol-proof claim
    • size: 198 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • property/model declaration excerpt (not proof evidence): def accept_inv (s1 s2: System a l p) (v: Value): step s1 s2 -> (acceptorsAreEnoughOfValue s1.acceptors v) -> (acceptorsAreEnoughOfValue s2.acceptors v) (full source statement)
    • unfinished step evidence: sorry (source line); 7 matching source lines in this row’s scope (lexical scan, not a dependency audit)

  • EPFL prototype / Paxos proof variant 3

    • specified: Paxos proof variant 3
    • safety: model invariant/commit-input consistency where declared; see proof omission scan
    • liveness: not identified
    • tool/status: Lean 4; prototype definitions/proof attempts; imports include admitted helper lemmas; no complete protocol-proof claim
    • size: 65 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem set_inv_is_unique (s: System a l p) (v1 v2: Value) (i j: Fin l): a >= 2 -> set_invariant s v1 i -> set_invariant s v2 j -> v1 = v2 (full source statement)

  • EPFL prototype / Paxos proof variant 4

    • specified: Paxos proof variant 4
    • safety: model invariant/commit-input consistency where declared; see proof omission scan
    • liveness: not identified
    • tool/status: Lean 4; prototype definitions/proof attempts; imports include admitted helper lemmas; no complete protocol-proof claim
    • size: 113 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem inv_app (s : System a l p): ∀ i v1 v2, systemIsValid s -> inv_1 s.learners v1 i ∧ inv_2 s.learners s.acceptors i ∧ inv_3 s.acceptors v1 v2 (full source statement)
    • unfinished step evidence: sorry (source line); 6 matching source lines in this row’s scope (lexical scan, not a dependency audit)

  • EPFL prototype / Paxos proof variant 5

    • specified: Paxos proof variant 5
    • safety: model invariant/commit-input consistency where declared; see proof omission scan
    • liveness: not identified
    • tool/status: Lean 4; prototype definitions/proof attempts; imports include admitted helper lemmas; no complete protocol-proof claim
    • size: 82 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem decide_imp_set_invariant (s: System a l p) (j: Fin l) (v: Value) : systemIsValid s → (s.learners j).decide = some v → set_invariant s v j (full source statement)
    • unfinished step evidence: . sorry (source line); 1 matching source lines in this row’s scope (lexical scan, not a dependency audit)

  • EPFL prototype / Paxos proof variant 6

    • specified: Paxos proof variant 6
    • safety: model invariant/commit-input consistency where declared; see proof omission scan
    • liveness: not identified
    • tool/status: Lean 4; prototype definitions/proof attempts; imports include admitted helper lemmas; no complete protocol-proof claim
    • size: 151 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem full_inv_proof (s: System a l p) (v : Value) (j: Fin l): systemIsValid s -> ((s.learners j).decide = some v -> learn_invariant s v j) ∧ (learn_invariant s v j -> mess_invariant s v) ∧ (mess_invariant s v -> acc_invariant s v) (full source statement)
    • unfinished step evidence: -> Message.Learn (i, v, id) ∈ s1.network.messages) := by sorry (source line); 2 matching source lines in this row’s scope (lexical scan, not a dependency audit)

  • EPFL prototype / two-phase commit model

    • specified: two-phase commit model
    • safety: model invariant/commit-input consistency where declared; see proof omission scan
    • liveness: not identified
    • tool/status: Lean 4; prototype definitions/proof attempts; imports include admitted helper lemmas; no complete protocol-proof claim
    • size: 100 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • property/model declaration excerpt (not proof evidence): inductive Preference where | Yes : Preference | No : Preference deriving BEq, DecidableEq inductive Decision where | Abort: Decision | Commit: Decision deriving BEq, DecidableEq inductive Message (n: Nat) where | Vote : Preference -> (Fin n) -> Message n | Decide : Decision -> Message n deriving BEq, DecidableEq structure Coordinator (n: Nat) where numParticipants : Nat (full source statement)

  • EPFL prototype / two-phase commit proof

    • specified: two-phase commit proof
    • safety: model invariant/commit-input consistency where declared; see proof omission scan
    • liveness: not identified
    • tool/status: Lean 4; prototype definitions/proof attempts; imports include admitted helper lemmas; no complete protocol-proof claim
    • size: 127 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem commitImpliesPreference (s: System n) : validSystem s -> (∃ i, (s.participants i).decision = Decision.Commit) -> ∀ i, (s.participants i).preference = Preference.Yes (full source statement)
    • proof statement excerpt: theorem acceptImpliesMessageSentINV (s: System n) (i: Fin n): validSystem s -> (s.participants i).preference ≠ Preference.Yes -> s.coordinator.yesVotes i = false ∧ Message.Vote Preference.Yes i ∉ s.network.network (full source statement)

  • EPFL prototype / two-phase commit alternate model

    • specified: two-phase commit alternate model
    • safety: model invariant/commit-input consistency where declared; see proof omission scan
    • liveness: not identified
    • tool/status: Lean 4; prototype definitions/proof attempts; imports include admitted helper lemmas; no complete protocol-proof claim
    • size: 95 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • property/model declaration excerpt (not proof evidence): inductive Preference where | Yes | No deriving DecidableEq, Repr inductive Decision where | Commit | Abort deriving DecidableEq, Repr inductive Message where | VOTE (v : Preference) (src : ParticipantId) | DECIDE (d : Decision) deriving DecidableEq, Repr structure Coordinator where numParticipants : Nat decision : Decision yesVotes : List ParticipantId noVotes : List ParticipantId deriving Repr structure Participant where hostId : ParticipantId preference : Option Preference decision : Decision deriving Repr structure Network where network : List Message deriving Repr structure System where coordinator : Coordinator participants : ParticipantId → Participant network : Network (full source statement)

  • lean-dag / Mysticeti

    • specified: uncertified DAG consensus with quorum-supported commit and skip rules
    • safety: agreement/commit exclusion or checkpoint safety properties are specified; proof coverage is established only by the exact theorem excerpts below
    • liveness: conditional commits/decisions where quoted; no unconditional network-delivery inference
    • tool/status: Lean 4; Lean definitions and proof artifacts; a def/property declaration does not itself prove the stated guarantee; exact theorem excerpts identify covered claims; not rebuilt
    • size: 3,189 physical lines across 9 .lean files in this directory; imports outside this scope excluded
    • source: exact directory
    • proof statement excerpt: theorem safety : Properties.Safe (mysticetiRule (Validator := Validator) (BlockId := BlockId) (Payload := Payload)) (full source statement)
    • proof statement excerpt: theorem commits_recur_local_of_pace (vp : ViewPace U T N) (hcard : quorumCard Validator ≤ T.card) (fair : FairScheduleOn T) (R : ℕ) (hgst : vp.gst ≤ R) (hbackoff : ∀ n, R ≤ n → 2 * vp.delay + vp.proc ≤ vp.timeout n) (k : ℕ) : ∃ k', k ≤ k' ∧ R ≤ S.slotRound k' ∧ (S.slotRound k' + 2 ≤ N → ∃ L : BlockId, IsLeaderBlock U k' L ∧ ∀ v ∈ T, Decided U (vp.viewAt v (vp.latest (S.slotRound k' + 2) + vp.delay)) k' (some L)) (full source statement)
    • proof statement excerpt: theorem decided_of_wait (vp : ViewPace U T N) (hcard : quorumCard Validator ≤ T.card) (hgst : vp.gst ≤ R) (hwait : ∀ n, R ≤ n → 2 * vp.delay + vp.proc ≤ vp.timeout n) (hR : R ≤ S.slotRound k) (hN : S.slotRound k + 2 ≤ N) (hlead : S.leader k ∈ T) : ∃ L, IsLeaderBlock U k L ∧ Decided U (View.full U) k (some L) (full source statement)
    • proof statement excerpt: theorem liveness : Properties.Support.Lives (R := mysticetiRule (Validator := Validator) (BlockId := BlockId) (Payload := Payload)) coreSupport (coreReliability Validator) (full source statement)

  • lean-dag / MahiMahi

    • specified: wave-based DAG consensus with cone votes
    • safety: agreement/commit exclusion or checkpoint safety properties are specified; proof coverage is established only by the exact theorem excerpts below
    • liveness: conditional commits/decisions where quoted; no unconditional network-delivery inference
    • tool/status: Lean 4; Lean definitions and proof artifacts; a def/property declaration does not itself prove the stated guarantee; exact theorem excerpts identify covered claims; not rebuilt
    • size: 2,428 physical lines across 20 .lean files in this directory; imports outside this scope excluded
    • source: exact directory
    • property/model declaration excerpt (not proof evidence): def Agreement (U : BlockUniverse Validator BlockId Payload) (w : ℕ) : Prop (full source statement)
    • proof statement excerpt: theorem safety (hw : 2 ≤ w) : Properties.Safe (mahiMahiRule (Validator := Validator) (BlockId := BlockId) (Payload := Payload) w) (full source statement)
    • proof statement excerpt: theorem mmSupport_commits {w : ℕ} (hw : 2 ≤ w) : Support.Commits (R := mahiMahiRule (Validator := Validator) (BlockId := BlockId) (Payload := Payload) w) (mmSupport w) (coreReliability Validator) (full source statement)
    • proof statement excerpt: theorem allDecidedBelow {w c d N : ℕ} (hspan : (mahiMahiAnchored Validator BlockId Payload w).SpansEligible d) (hrun : UnpredictableRunWithin U w c d N) (k : ℕ) (hk : (mahiMahiAnchored Validator BlockId Payload w).decisionRound (k + c + d - 1) ≤ N) : ∃ b, k ≤ b ∧ ∀ i, i < b → ∃ v, Decided w U (View.full U) i v (full source statement)

  • lean-dag / AsyncBlueBottle

    • specified: asynchronous DAG commit variant with a weak cone test
    • safety: agreement/commit exclusion or checkpoint safety properties are specified; proof coverage is established only by the exact theorem excerpts below
    • liveness: conditional commits/decisions where quoted; no unconditional network-delivery inference
    • tool/status: Lean 4; Lean definitions and proof artifacts; a def/property declaration does not itself prove the stated guarantee; exact theorem excerpts identify covered claims; not rebuilt
    • size: 2,179 physical lines across 20 .lean files in this directory; imports outside this scope excluded
    • source: exact directory
    • property/model declaration excerpt (not proof evidence): def Agreement (U : BlockUniverse Validator BlockId Payload) : Prop (full source statement)
    • proof statement excerpt: theorem safety : Properties.Safe (asyncBlueBottleRule (Validator := Validator) (BlockId := BlockId) (Payload := Payload)) (full source statement)
    • proof statement excerpt: theorem abbSupport_commits : Support.Commits (R := asyncBlueBottleRule (Validator := Validator) (BlockId := BlockId) (Payload := Payload)) abbSupport (coreReliability Validator) (full source statement)
    • proof statement excerpt: theorem allDecidedBelow {c d N : ℕ} {V : View Validator BlockId Payload U} (hspan : (asyncBlueBottleAnchored Validator BlockId Payload).SpansEligible d) (hrun : UnpredictableRunWithin U c d N) (hV : V.CoversUpto N) (k : ℕ) (hk : (asyncBlueBottleAnchored Validator BlockId Payload).decisionRound (k + c + d - 1) ≤ N) : ∃ b, k ≤ b ∧ ∀ i, i < b → ∃ v, Decided U V i v (full source statement)

  • lean-dag / Bluestreak

    • specified: sparse DAG with referenceable claims and pull pacemaker
    • safety: agreement/commit exclusion or checkpoint safety properties are specified; proof coverage is established only by the exact theorem excerpts below
    • liveness: conditional commits/decisions where quoted; no unconditional network-delivery inference
    • tool/status: Lean 4; Lean definitions and proof artifacts; a def/property declaration does not itself prove the stated guarantee; exact theorem excerpts identify covered claims; not rebuilt
    • size: 1,112 physical lines across 5 .lean files in this directory; imports outside this scope excluded
    • source: exact directory
    • proof statement excerpt: theorem safety : Properties.Safe (bluestreakRule (Validator := Validator) (BlockId := BlockId) (Payload := Payload)) (full source statement)
    • proof statement excerpt: theorem commits : (bluestreakSupport (Validator := Validator) (BlockId := BlockId) (Payload := Payload)).Commits (R := bluestreakRule) (bluestreakReliability Validator) (full source statement)
    • proof statement excerpt: theorem decided_below_of_run (hT : T ⊆ (Correct : Finset Validator)) (hcard : quorumCard Validator ≤ T.card) (hgst : rb.gst ≤ R) (hto : ∀ n, R ≤ n → 2 * rb.delay + rb.proc ≤ rb.timeout n) (hspan : (bluestreakAnchored Validator BlockId Payload).SpansEligible (S := S) 3) {b : ℕ} (hR : R ≤ S.slotRound b) (hN : S.slotRound (b + 2) + 2 ≤ N) (hrun : ∀ i, i < 3 → S.leader (b + i) ∈ T) : ∀ i, i < b → ∃ v, Decided U (View.full U) i v (full source statement)
    • proof statement excerpt: theorem liveness : Properties.Support.Lives (R := bluestreakRule (Validator := Validator) (BlockId := BlockId) (Payload := Payload)) bluestreakSupport (bluestreakReliability Validator) (full source statement)

  • lean-dag / Nemo

    • specified: two-round crash-fault DAG consensus
    • safety: agreement/commit exclusion or checkpoint safety properties are specified; proof coverage is established only by the exact theorem excerpts below
    • liveness: conditional commits/decisions where quoted; no unconditional network-delivery inference
    • tool/status: Lean 4; Lean definitions and proof artifacts; a def/property declaration does not itself prove the stated guarantee; exact theorem excerpts identify covered claims; not rebuilt
    • size: 928 physical lines across 7 .lean files in this directory; imports outside this scope excluded
    • source: exact directory
    • proof statement excerpt: theorem safety : Properties.Safe (nemoRule (Validator := Validator) (BlockId := BlockId) (Payload := Payload)) (full source statement)
    • proof statement excerpt: theorem voteSupport_commits (hn : 0 < Fintype.card Validator) : (voteSupport (nemoRule (Validator := Validator) (BlockId := BlockId) (Payload := Payload))).Commits (nemoReliability Validator hn) (full source statement)
    • proof statement excerpt: theorem all_decided_below_of_fairRun_live {c : ℕ} (hc : 0 < c) (hspan : (Nemo.nemoAnchored Validator BlockId Payload).SpansEligible c) (fair : FairRunOn (Live Validator) c) (R : ℕ) (s : ℕ) : ∃ b, s ≤ b ∧ R ≤ S.slotRound b ∧ ∀ (U : Universe Validator BlockId Payload) (N : ℕ) (V : View Validator BlockId Payload U), (∀ r ≤ N, Populated U r) → Synchronised U R → S.slotRound (b + c - 1) + 1 ≤ N → V.CoversUpto N → ∀ i, i < b → ∃ v, Decided U V i v (full source statement)

  • lean-dag / Odontoceti

    • specified: two-round Byzantine DAG consensus
    • safety: agreement/commit exclusion or checkpoint safety properties are specified; proof coverage is established only by the exact theorem excerpts below
    • liveness: conditional commits/decisions where quoted; no unconditional network-delivery inference
    • tool/status: Lean 4; Lean definitions and proof artifacts; a def/property declaration does not itself prove the stated guarantee; exact theorem excerpts identify covered claims; not rebuilt
    • size: 990 physical lines across 6 .lean files in this directory; imports outside this scope excluded
    • source: exact directory
    • proof statement excerpt: theorem safety : Properties.Safe (odontocetiRule (Validator := Validator) (BlockId := BlockId) (Payload := Payload)) (full source statement)
    • proof statement excerpt: theorem voteSupport_commits : (voteSupport (odontocetiRule (Validator := Validator) (BlockId := BlockId) (Payload := Payload))).Commits (coreReliability Validator) (full source statement)
    • proof statement excerpt: theorem decided_none_fresh_agree_odontoceti [S : Slots Validator] (sk : SkipMsg W) {V : View Validator B Payload W} {T : Finset Validator} {k : ℕ} (hcard : quorumCard Validator ≤ T.card) (hlead : S.leader k = sk.v1) (hk1 : sk.r0 < S.slotRound k) (hk2 : S.slotRound k ≤ sk.r) (hpres : PresentAt (OdontocetiProperties.odontocetiRule (Payload := Payload)) V T (S.slotRound k + 1)) {U'' : BlockUniverse Validator B Payload} (he' : Extends (OdontocetiProperties.odontocetiRule (Payload := Payload)) sk.skipFill U'') {V'' Y : View Validator B Payload U''} (hsub : (sk.liftView V).ids ⊆ V''.ids) {v : Option B} (hY : Odontoceti.Decided U'' Y k v) : v = none (full source statement)
    • proof statement excerpt: theorem liveness : Properties.Support.Lives (Properties.voteSupport (odontocetiRule (Validator := Validator) (BlockId := BlockId) (Payload := Payload))) (coreReliability Validator) (full source statement)

  • lean-dag / FinWhale

    • specified: DAG consensus with a fast path and variable fault thresholds
    • safety: agreement/commit exclusion or checkpoint safety properties are specified; proof coverage is established only by the exact theorem excerpts below
    • liveness: conditional commits/decisions where quoted; no unconditional network-delivery inference
    • tool/status: Lean 4; Lean definitions and proof artifacts; a def/property declaration does not itself prove the stated guarantee; exact theorem excerpts identify covered claims; not rebuilt
    • size: 5,938 physical lines across 46 .lean files in this directory; imports outside this scope excluded
    • source: exact directory
    • proof statement excerpt: theorem agreement_of_commits [LinearOrder BlockId] {V V' : D.View} {dec dec' : ℕ → Verdict BlockId} (hwf : WellFormed (EligibleAt (S := S) 2) (viewCommit S D V) (viewSkip S D V) (chooseLeast S D) dec) (hwf' : WellFormed (EligibleAt (S := S) 2) (viewCommit S D V') (viewSkip S D V') (chooseLeast S D) dec') {M : ℕ} (hbound : ∀ s, M ≤ s → dec s = Verdict.undecided ∧ dec' s = Verdict.undecided) {R N : ℕ} (hsees : SeesCommits S D (viewCommit S D V) R N) (hsees' : SeesCommits S D (viewCommit S D V') R N) (hrr : RoundRobin S.leader) (hid : ∀ s, S.slotRound s = s) {k : ℕ} (hkN : max k R + (3 * F.f + 5) ≤ N) (hist : BlockId → List BlockId) : linearise hist (commitSeq dec k) = linearise hist (commitSeq dec' k) (full source statement)
    • proof statement excerpt: theorem safety : Properties.Safe (finWhaleRule (Validator := Validator) (BlockId := BlockId) (Payload := Payload)) (full source statement)
    • proof statement excerpt: theorem sees_of_commits_of_held {V : D.View} {R N : ℕ} (hcommits : CommitsCorrectLeaders S D R N) (hheld : ∀ n, R ≤ n → n ≤ N → ∀ b ∈ blocksAt D n, (D.block b).creator ∈ (Correct : Finset Validator) → b ∈ V.ids) : SeesCommits S D (viewCommit S D V ) R N (full source statement)
    • proof statement excerpt: theorem decided_of_wellFormed {V : D.View} {dec : ℕ → Verdict BlockId} (hwf : WellFormed (EligibleAt (S := S) 2) (viewCommit S D V) (viewSkip S D V) (chooseLeast S D) dec) {N : ℕ} (hN : ∀ s, N ≤ s → dec s = Verdict.undecided) : ∀ r, dec r ≠ Verdict.undecided → Decided D V r (dec r).optOf (full source statement)

  • lean-dag / Hydrozoan

    • specified: DAG consensus with fast/slow commit routes
    • safety: agreement/commit exclusion or checkpoint safety properties are specified; proof coverage is established only by the exact theorem excerpts below
    • liveness: conditional commits/decisions where quoted; no unconditional network-delivery inference
    • tool/status: Lean 4; Lean definitions and proof artifacts; a def/property declaration does not itself prove the stated guarantee; exact theorem excerpts identify covered claims; not rebuilt
    • size: 4,021 physical lines across 47 .lean files in this directory; imports outside this scope excluded
    • source: exact directory
    • proof statement excerpt: theorem seqAgreement : SeqAgreement U (full source statement)
    • proof statement excerpt: theorem safety : LeanDag.Properties.Safe (rule (Replica := Replica) (BlockId := BlockId)) (full source statement)
    • property/model declaration excerpt (not proof evidence): def CommitSkipExclusion (U : BlockUniverse Replica BlockId) : Prop (full source statement)
    • proof statement excerpt: theorem commitSeq_prefix {g : ℕ → Option BlockId} {n₁ n₂ : ℕ} (h : n₁ ≤ n₂) : commitSeq g n₁ <+: commitSeq g n₂ (full source statement)

  • lean-dag / OptimalHydrozoan

    • specified: optimized Hydrozoan with pruning and recovery
    • safety: agreement/commit exclusion or checkpoint safety properties are specified; proof coverage is established only by the exact theorem excerpts below
    • liveness: conditional commits/decisions where quoted; no unconditional network-delivery inference
    • tool/status: Lean 4; Lean definitions and proof artifacts; a def/property declaration does not itself prove the stated guarantee; exact theorem excerpts identify covered claims; not rebuilt
    • size: 3,533 physical lines across 36 .lean files in this directory; imports outside this scope excluded
    • source: exact directory
    • proof statement excerpt: theorem seqAgreement : SeqAgreement U (full source statement)
    • proof statement excerpt: theorem safety : Properties.Safe (optimalRule (Replica := Replica) (BlockId := BlockId)) (full source statement)
    • property/model declaration excerpt (not proof evidence): def CommitSkipExclusion (U : OptUniverse Replica BlockId) : Prop (full source statement)
    • proof statement excerpt: theorem voteSupport_fast_commits (h : (O.byzantine ∪ O.crashed).card ≤ LeanDag.OptimalHydrozoan.pOpt Replica) (hmin : 2 * LeanDag.OptimalHydrozoan.pOpt Replica < Fintype.card Replica) : Support.Commits (R := optimalRule (Replica := Replica) (BlockId := BlockId)) (voteSupport (optimalRule (Replica := Replica) (BlockId := BlockId))) (optFastReliability Replica h hmin) (full source statement)

  • lean-dag / Hybrid

    • specified: DAG consensus separating Byzantine and crash faults
    • safety: agreement/commit exclusion or checkpoint safety properties are specified; proof coverage is established only by the exact theorem excerpts below
    • liveness: conditional commits/decisions where quoted; no unconditional network-delivery inference
    • tool/status: Lean 4; Lean definitions and proof artifacts; a def/property declaration does not itself prove the stated guarantee; exact theorem excerpts identify covered claims; not rebuilt
    • size: 1,202 physical lines across 8 .lean files in this directory; imports outside this scope excluded
    • source: exact directory
    • proof statement excerpt: theorem safety {kt : ℕ} (hpos : 0 < kt) (hk : Hybrid.Admissible Validator kt) : Properties.Safe (hybridRule (Validator := Validator) (BlockId := BlockId) (Payload := Payload) kt) (full source statement)
    • proof statement excerpt: theorem voteSupport_commits (kt : ℕ) : (voteSupport (hybridRule (Validator := Validator) (BlockId := BlockId) (Payload := Payload) kt)).Commits (coreReliability Validator) (full source statement)
    • proof statement excerpt: theorem decided_none_fresh_agree {U : (HybridProperties.hybridRule (Validator := Validator) (BlockId := BlockId) (Payload := Payload) kt).Universe} (sk : SkipMsg U.val) (hpos : 0 < kt) (hk : Hybrid.Admissible Validator kt) {V : View Validator BlockId Payload U.val} {T : Finset Validator} {k : ℕ} (hq : Hybrid.q Validator ≤ T.card) (hlead : S.leader k = sk.v1) (hk1 : sk.r0 < S.slotRound k) (hk2 : S.slotRound k ≤ sk.r) (hpres : PresentAt (HybridProperties.hybridRule (Validator := Validator) (BlockId := BlockId) (Payload := Payload) kt) V T (S.slotRound k + 1)) {U'' : (HybridProperties.hybridRule (Validator := Validator) (BlockId := BlockId) (Payload := Payload) kt).Universe} (he' : Extends (HybridProperties.hybridRule (Validator := Validator) (BlockId := BlockId) (Payload := Payload) kt) (fill U sk) U'') {V'' W : View Validator BlockId Payload U''.val} (hsub : (sk.liftView V).ids ⊆ V''.ids) {v : Option BlockId} (hW : (HybridProperties.hybridRule (Validator := Validator) (BlockId := BlockId) (Payload := Payload) kt).Decided S (U := U'') W k v) : v = none (full source statement)
    • proof statement excerpt: theorem liveness (kt : ℕ) : Properties.Support.Lives (Properties.voteSupport (hybridRule (Validator := Validator) (BlockId := BlockId) (Payload := Payload) kt)) (coreReliability Validator) (full source statement)

  • lean-dag / Barnacle

    • specified: DAG schedule reconfiguration across pruning cuts
    • safety: agreement/commit exclusion or checkpoint safety properties are specified; proof coverage is established only by the exact theorem excerpts below
    • liveness: conditional commits/decisions where quoted; no unconditional network-delivery inference
    • tool/status: Lean 4; Lean definitions and proof artifacts; a def/property declaration does not itself prove the stated guarantee; exact theorem excerpts identify covered claims; not rebuilt
    • size: 3,851 physical lines across 40 .lean files in this directory; imports outside this scope excluded
    • source: exact directory
    • property/model declaration excerpt (not proof evidence): def WindowAgreement (R : BaseRule Validator BlockId Payload) : Prop (full source statement)
    • proof statement excerpt: theorem rangeLedger_disjoint (hR : Properties.CommitsCandidate R.toDagRule) (Rn : Run R P B upd C₀ U V K) {k k' : ℕ} (h : k < k') (hK : k' < K) : (Rn.rangeLedger k).Disjoint (Rn.rangeLedger k') (full source statement)
    • proof statement excerpt: theorem decided_and_not_output (Rn : Run R P B upd C₀ U V K) {k : ℕ} (hk : k < K) {κ : ℕ} (hlo : Rn.start (k + 1) < (Rn.cfg k).roundOf κ) (hhi : (Rn.cfg k).roundOf κ ≤ (Rn.cfg k).roundOf (Rn.anchor k)) : R.Decided (Rn.cfg k).sched V κ (Rn.vdct k κ) ∧ (Rn.cfg k).cum (Rn.start (k + 1) + 1) ≤ κ (full source statement)
    • proof statement excerpt: theorem liveOn_roundRobin {n : ℕ} (hn : 0 < n) {BlockId : Type} [DecidableEq BlockId] {Payload : Type} (R : LiveRule (Fin n) BlockId Payload) {slack : ℕ} (hD : R.Descent slack) (hw : 0 < R.waveLength) (hbound : R.waveLength * slack + 1 ≤ n) (C : Config (Fin n)) (hhead : C.head = roundRobin n hn) : R.LiveOn C.sched (n + R.waveLength - 1) (full source statement)

  • lean-dag / BlackMarlin

    • specified: three-round anchor delivery and cross-view chain agreement
    • safety: commit/chain agreement model and supporting ledger lemmas; no complete cross-view safety theorem identified in this row
    • liveness: no protocol progress theorem identified in this scope
    • tool/status: Lean 4; Lean definitions and proof artifacts; a def/property declaration does not itself prove the stated guarantee; exact theorem excerpts identify covered claims; not rebuilt
    • size: 1,509 physical lines across 10 .lean files in this directory; imports outside this scope excluded
    • source: exact directory
    • property/model declaration excerpt (not proof evidence): def commitSeq (U : BlockUniverse Validator BlockId Payload) (τ : TopoSort U) : ℕ → BlockId → Finset BlockId → List BlockId × Finset BlockId | 0, B, D => ([], insert B D) | (n + 1), B, D => let pd (full source statement)
    • proof statement excerpt: theorem deliverSeq_of_correct {b : BlockId} (hb : b ∈ ledgerSeq U f τ n) (hc : (U.block b).creator ∈ (Correct : Finset Validator)) : b ∈ deliverSeq U f τ n (full source statement)

  • lean-dag / Minnow

    • specified: S-Minnow commit-rule model used to prove blocking counterexamples
    • safety: agreement/commit exclusion or checkpoint safety properties are specified; proof coverage is established only by the exact theorem excerpts below
    • liveness: negative progress cases: a dead/unquorate unresolved slot blocks later commits
    • tool/status: Lean 4; Lean definitions and proof artifacts; a def/property declaration does not itself prove the stated guarantee; exact theorem excerpts identify covered claims; not rebuilt
    • size: 221 physical lines across 2 .lean files in this directory; imports outside this scope excluded
    • source: exact directory
    • proof statement excerpt: theorem quorum_of_committedAt : ∀ {k : ℕ} {l : BlockId}, CommittedAt D L k l → Quorum D l | 0, _, h => (full source statement)
    • property/model declaration excerpt (not proof evidence): structure ValidHere (blk : BlockId → Block Validator BlockId Payload) (b : Block Validator BlockId Payload) : Prop where predecessor : ∀ i ∈ b.refs, (blk i).round + 1 = b.round distinct_creators : ∀ i ∈ b.refs, ∀ j ∈ b.refs, (blk i).creator = (blk j).creator → i = j quorum : 0 < b.round → quorumCard Validator ≤ (creators blk b).card instance (blk : BlockId → Block Validator BlockId Payload) (b : Block Validator BlockId Payload) : Decidable (ValidHere blk b) (full source statement)

  • lean-dag / RedSnapper

    • specified: transaction/object DAG protocol with conflicting inputs, skips and unlocks
    • safety: agreement/commit exclusion or checkpoint safety properties are specified; proof coverage is established only by the exact theorem excerpts below
    • liveness: conditional commits/decisions where quoted; no unconditional network-delivery inference
    • tool/status: Lean 4; Lean definitions and proof artifacts; a def/property declaration does not itself prove the stated guarantee; exact theorem excerpts identify covered claims; not rebuilt
    • size: 8,220 physical lines across 68 .lean files in this directory; imports outside this scope excluded
    • source: exact directory
    • proof statement excerpt: theorem verdictAgreement (hdisc : StanceDiscipline U) {A : Anchors U} : VerdictAgreement U A (full source statement)
    • proof statement excerpt: theorem recoverySafetyWin (hfd : FreezeDiscipline U) : RecoverySafetyWin U (full source statement)
    • proof statement excerpt: theorem decidedOrdered : DecidedOrdered U (full source statement)
    • proof statement excerpt: theorem fastLiveness : FastLiveness U (full source statement)

  • lean-dag / Steelhead

    • specified: adaptive wave lengths and control-slot decisions
    • safety: agreement/commit exclusion or checkpoint safety properties are specified; proof coverage is established only by the exact theorem excerpts below
    • liveness: conditional commits/decisions where quoted; no unconditional network-delivery inference
    • tool/status: Lean 4; Lean definitions and proof artifacts; a def/property declaration does not itself prove the stated guarantee; exact theorem excerpts identify covered claims; not rebuilt
    • size: 17,608 physical lines across 83 .lean files in this directory; imports outside this scope excluded
    • source: exact directory
    • proof statement excerpt: theorem pairAgreement [S : Slots Validator] : PairAgreement (S := S) U (full source statement)
    • proof statement excerpt: theorem safety {w : ℕ → ℕ} (hw : ∀ κ, 2 ≤ w κ) : Properties.Safe (steelheadRule (Validator := Validator) (BlockId := BlockId) (Payload := Payload) w) (full source statement)
    • proof statement excerpt: theorem shSupport_commits {w : ℕ → ℕ} (hw : ∀ κ, 2 ≤ w κ) : Support.Commits (R := steelheadRule (Validator := Validator) (BlockId := BlockId) (Payload := Payload) w) (shSupport w) (coreReliability Validator) (full source statement)
    • proof statement excerpt: theorem compose_decided_iff {rules : ℕ → AnchoredRule Validator BlockId Payload P honest} {κ : ℕ} (hr : ∀ r, (rules r).rungs = (rules 0).rungs) (ht : ∀ r, (rules r).tie = (rules 0).tie) {S : Slots Validator} (hkind : ∀ k, S.kind k = κ) {U : BlockRecord Validator BlockId Payload P honest} {V : U.View} {k : ℕ} {v : Option BlockId} : (compose rules).Decided (S := S) U V k v ↔ (rules κ).Decided (S := S) U V k v (full source statement)

  • lean-dag / Checkpoint

    • specified: signed resilient checkpoints and recovery selection
    • safety: agreement/commit exclusion or checkpoint safety properties are specified; proof coverage is established only by the exact theorem excerpts below
    • liveness: conditional commits/decisions where quoted; no unconditional network-delivery inference
    • tool/status: Lean 4; Lean definitions and proof artifacts; a def/property declaration does not itself prove the stated guarantee; exact theorem excerpts identify covered claims; not rebuilt
    • size: 1,051 physical lines across 6 .lean files in this directory; imports outside this scope excluded
    • source: exact directory
    • proof statement excerpt: theorem selection_agreement {v w : Validator} (hv : v ∈ M.recoveryCorrect) (hw : w ∈ M.recoveryCorrect) : select M E R v = select M E R w (full source statement)
    • proof statement excerpt: theorem emitted_of_decided (ha : Agree R) (P : SigningRule M E R S U vm) {V : R.View U} {slot : ℕ} {block : BlockId} (commit : R.Decided S V slot (some block)) {v : Validator} (hv : v ∈ M.recoveryCorrect) {b : BlockId} (hb : R.Decided S (P.view v) slot (some b)) : E.emitted ⟨v, vm.checkpointAfterCommit slot block⟩ (full source statement)
    • proof statement excerpt: theorem liveCommitFinalized (sp : Support R) (rel : Reliability Validator) : LiveCommitFinalized M E R sp rel vm (full source statement)
    • proof statement excerpt: theorem finalized_prefix_next_checkpoint {receiver : Validator} (T : EpochTransition M E R receiver) {old new : CheckpointData Value} (F : SigningFaults.Execution.FinalityQC M E old) (hold_epoch : old.epoch = epoch) (Q : SigningFaults.Execution.CheckpointQC M E new) (hne : new.epoch = T.next_epoch) : old.history.IsPrefix new.history (full source statement)

  • three-state approximate-majority population protocol

    • specified: random uniform ordered-pair interactions among X, Y and blank opinions
    • safety: population size and absorbing unanimity; winning initial-majority correctness is outside headline theorem
    • liveness: probabilistic consensus-time bound and high-probability convergence, excluding all-blank start
    • tool/status: Lean 4; machine-checkable proof source present; not rebuilt here
    • size: 9,245 physical lines across 33 .lean files in this directory; imports outside this scope excluded
    • source: exact directory
    • proof statement excerpt: theorem convergence_time_bound_exp (hn : n ≥ 16) (c₀ : Config n) (hop : c₀.hasOpinion) (k : ℕ) : ((transitionKernel (show n ≥ 2 (full source statement)
    • proof statement excerpt: theorem convergence_time_high_probability (hn : n ≥ 16) (c₀ : Config n) (hop : c₀.hasOpinion) (r : ℝ) (k : ℕ) (hk : 15000*(n : ℝ)*(Real.log (3*(n : ℝ)^2) + r*Real.log (n : ℝ)) ≤ (k : ℝ)) : ((transitionKernel (show n ≥ 2 (full source statement)

  • Minimmit BFT consensus

    • specified: notarization/finalization with different quorum thresholds
    • safety: consistency and quorum-intersection lemmas
    • liveness: conditional liveness and optimistic responsiveness
    • tool/status: Lean 4; Lean conditional proof source; cryptographic axioms explicit; not rebuilt
    • size: 2,923 physical lines across 22 .lean files in this directory; imports outside this scope excluded
    • source: exact directory
    • proof statement excerpt: theorem consistency_logs {n f : Nat} (sv : StateView n Block Message Tx) (e : Execution n Message) (lv : LogView n Block Tx) (hd : sv.VoteDiscipline e) (hrd : sv.ReceiptDiscipline e) (hnd : sv.NullifyDiscipline e f) (hpd : sv.ProposalDiscipline e f) (hnf : 5 * f + 1 ≤ n) (hfb : e.FaultBound f) (hld : LogDiscipline sv lv e f) {p q : Processor n} (hp : e.Correct p) (hq : e.Correct q) (t t' : Time) : lv.log p t <+: lv.log q t' ∨ lv.log q t' <+: lv.log p t (full source statement)
    • axiom evidence: axiom signature_unforgeable {n : Nat} {Message : Type} (e : Execution n Message) : (source line); 2 matching source lines in this row’s scope (lexical scan, not a dependency audit)

  • Ethereum / Fulu consensus spec

    • specified: Fulu beacon state transition, operations, fork choice and upgrade
    • safety: executable specification plus local component proof statements; not a complete consensus-safety theorem
    • liveness: no protocol-level liveness proof identified
    • tool/status: Lean 4; Lean executable spec; upstream conformance-test claim in README; proof ledger separates proven components from unproved bodies; tests not rerun
    • size: 4,292 physical lines across 32 .lean files in this directory; imports outside this scope excluded
    • source: exact directory
    • property/model declaration excerpt (not proof evidence): def pyspecPinnedVersion : String (full source statement)
    • property/model declaration excerpt (not proof evidence): def addressOf (v : Validator) : ExecutionAddress (full source statement)

  • Ethereum / Gloas consensus spec

    • specified: Gloas beacon state transition, operations, fork choice and upgrade
    • safety: executable specification plus local component proof statements; not a complete consensus-safety theorem
    • liveness: no protocol-level liveness proof identified
    • tool/status: Lean 4; Lean executable spec; upstream conformance-test claim in README; proof ledger separates proven components from unproved bodies; tests not rerun
    • size: 3,688 physical lines across 20 .lean files in this directory; imports outside this scope excluded
    • source: exact directory
    • property/model declaration excerpt (not proof evidence): def computePtcFromFulu [Preset] [HasherTag] (state : Fulu.State) (slot : Slot) : Vector ValidatorIndex Const.ptcSize (full source statement)
    • property/model declaration excerpt (not proof evidence): def addressOf (v : Validator) : ExecutionAddress (full source statement)

  • Ethereum / Heze consensus spec

    • specified: Heze beacon state transition, operations, fork choice and upgrade
    • safety: executable specification plus local component proof statements; not a complete consensus-safety theorem
    • liveness: no protocol-level liveness proof identified
    • tool/status: Lean 4; Lean executable spec; upstream conformance-test claim in README; proof ledger separates proven components from unproved bodies; tests not rerun
    • size: 1,869 physical lines across 17 .lean files in this directory; imports outside this scope excluded
    • source: exact directory
    • property/model declaration excerpt (not proof evidence): def upgradeToHeze [Preset] (hezeForkVersion : Version) (pre : Gloas.BeaconState) : Heze.BeaconState (full source statement)
    • property/model declaration excerpt (not proof evidence): def addressOf (v : Validator) : ExecutionAddress (full source statement)

  • 3SF-mini block/attestation state transition

    • specified: Aeneas translation from Rust of 3SF-mini block/attestation state transition
    • safety: algorithm definition; full safety theorem not identified
    • liveness: none identified
    • tool/status: Lean 4; generated Lean functional model; external function axioms are in FunsExternal.lean; no protocol proof claim
    • size: 1,402 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • property/model declaration excerpt (not proof evidence): def state_transition.serialize_justifications_loop0.body (justifications : alloc.vec.Vec (types.H256 × (alloc.vec.Vec Bool))) (roots : alloc.vec.Vec types.H256) (i : Std.Usize) : Result (ControlFlow ((alloc.vec.Vec types.H256) × Std.Usize) (alloc.vec.Vec types.H256)) (full source statement)

  • LMD-GHOST fork choice

    • specified: Aeneas translation from Rust of LMD-GHOST fork choice
    • safety: algorithm definition; full safety theorem not identified
    • liveness: none identified
    • tool/status: Lean 4; generated Lean functional model; external function axioms are in FunsExternal.lean; no protocol proof claim
    • size: 1,043 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • property/model declaration excerpt (not proof evidence): def fork_choice.compute_block_weights_loop0_loop0_loop0_loop0.body (weights : alloc.vec.Vec (types.H256 × Std.U64)) (current_root : types.H256) (wi : Std.Usize) : Result (ControlFlow Std.Usize ((alloc.vec.Vec (types.H256 × Std.U64)) × Bool)) (full source statement)

  • justified-slot tracking

    • specified: Aeneas translation from Rust of justified-slot tracking
    • safety: algorithm definition; full safety theorem not identified
    • liveness: none identified
    • tool/status: Lean 4; generated Lean functional model; external function axioms are in FunsExternal.lean; no protocol proof claim
    • size: 187 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • property/model declaration excerpt (not proof evidence): def justified_slots.relative_index (target_slot : Std.U64) (finalized_slot : Std.U64) : Result (Option Std.Usize) (full source statement)

  • Simplex / Rust-to-Lean translation scaffold

    • specified: Rust consensus machine with Charon/Aeneas generation instructions
    • safety: complete protocol safety proof not found in tracked proof files
    • liveness: not found
    • tool/status: Lean 4; proof scaffold only; README says generated Consensus.lean excluded from git; Basic.lean is hello-world
    • size: 403 physical lines across 5 .lean files in this directory; imports outside this scope excluded
    • source: exact directory
    • property/model declaration excerpt (not proof evidence): def main : IO Unit (full source statement)
    • property/model declaration excerpt (not proof evidence): def hello (full source statement)
    • axiom evidence: axiom Array.Insts.CoreHashHash.hash (source line); 42 matching source lines in this row’s scope (lexical scan, not a dependency audit)

  • co-located Paxos constraints

    • specified: co-located Paxos constraints
    • safety: constraints imply consensus safety / at most one chosen value
    • liveness: no progress proof identified
    • tool/status: Lean 4; machine-checkable proof source present; not rebuilt here
    • size: 794 physical lines across 5 .lean files in this directory; imports outside this scope excluded
    • source: exact directory
    • proof statement excerpt: theorem requirements_give_safety_v2 : requirements proto defs → safety_v2 proto defs (full source statement)

  • co-located Paxos implementation model

    • specified: co-located Paxos implementation model
    • safety: constraints imply consensus safety / at most one chosen value
    • liveness: no progress proof identified
    • tool/status: Lean 4; machine-checkable proof source present; not rebuilt here
    • size: 2,787 physical lines across 16 .lean files in this directory; imports outside this scope excluded
    • source: exact directory
    • proof statement excerpt: theorem at_most_one_value_chosen : predicate.invariant (λ s : sys_state pid_t (server pid_t value_t is_quorum vals) (message pid_t value_t), safety s) (full source statement)

  • Raft Lean squad / AEBroadcastInvariant

    • specified: Raft Rust-component model/proof: AEBroadcastInvariant
    • safety: source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately
    • liveness: no temporal eventual-progress guarantee inferred from a Progress-named component
    • tool/status: Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt
    • size: 337 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem hqc_preserved_of_broadcast [DecidableEq E] {cs cs' : ClusterState E} {lead v : Nat} {msg : AppendEntriesMsg E} (hstep : ValidAEStep E cs lead v msg cs') : ∀ k e, isQuorumCommitted cs.voters cs.logs k e → isQuorumCommitted cs'.voters cs'.logs k e (full source statement)
    • proof statement excerpt: theorem hae_broadcast_invariant_schema (E : Type) [DecidableEq E] : ∀ (lead : Nat) (voterIdx : Nat → Nat) (covered : List Nat) (cs cs' : ClusterState E) (v : Nat) (msg : AppendEntriesMsg E), ValidAEStep E cs lead v msg cs' → msg.prevLogIndex = 0 → lead ≠ v → 1 ≤ voterIdx v → HaeCovered E covered cs.logs lead voterIdx → HaeCovered E (v :: covered) cs'.logs lead voterIdx (full source statement)

  • Raft Lean squad / Basic

    • specified: Raft Rust-component model/proof: Basic
    • safety: source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately
    • liveness: no temporal eventual-progress guarantee inferred from a Progress-named component
    • tool/status: Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt
    • size: 1 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • property/model declaration excerpt (not proof evidence): def hello (full source statement)

  • Raft Lean squad / BroadcastLifecycle

    • specified: Raft Rust-component model/proof: BroadcastLifecycle
    • safety: source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately
    • liveness: no temporal eventual-progress guarantee inferred from a Progress-named component
    • tool/status: Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt
    • size: 134 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem broadcastSeq_to_validAEList (E : Type) [DecidableEq E] (lead : Nat) (voterIdx : Nat → Nat) (vs : List Nat) (cs_init cs_final : ClusterState E) (hseq : BroadcastSeq E lead voterIdx vs cs_init cs_final) : ValidAEList E cs_init cs_final (full source statement)

  • Raft Lean squad / CommitRule

    • specified: Raft Rust-component model/proof: CommitRule
    • safety: source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately
    • liveness: no temporal eventual-progress guarantee inferred from a Progress-named component
    • tool/status: Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt
    • size: 300 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem commitRule_and_preservation_implies_cci [DecidableEq E] (cs cs' : ClusterState E) (hvoters : cs.voters = cs'.voters) (hcrv : CommitRuleValid cs cs') (hqc_preserved : ∀ k e, isQuorumCommitted cs.voters cs.logs k e → ∀ w, cs'.logs w k = cs.logs w k) (hlog_preserved : ∀ w k, cs.committed w ≥ k → cs'.logs w k = cs.logs w k) (hcci : CommitCertInvariant cs) : CommitCertInvariant cs' (full source statement)

  • Raft Lean squad / CommittedIndex

    • specified: Raft Rust-component model/proof: CommittedIndex
    • safety: source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately
    • liveness: no temporal eventual-progress guarantee inferred from a Progress-named component
    • tool/status: Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt
    • size: 417 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem committedIndex_safety (voters : List Nat) (acked : AckedFn) (hn : 0 < voters.length) : majority voters.length ≤ countGe voters acked (committedIndex voters acked) (full source statement)
    • proof statement excerpt: theorem committedIndex_mono (voters : List Nat) (acked1 acked2 : AckedFn) (hle : ∀ v, acked1 v ≤ acked2 v) : committedIndex voters acked1 ≤ committedIndex voters acked2 (full source statement)

  • Raft Lean squad / ConcreteProtocolStep

    • specified: Raft Rust-component model/proof: ConcreteProtocolStep
    • safety: source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately
    • liveness: no temporal eventual-progress guarantee inferred from a Progress-named component
    • tool/status: Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt
    • size: 538 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem validAEStep_hqc_preserved_from_lc [DecidableEq E] {cs cs' : ClusterState E} {lead v : Nat} {msg : AppendEntriesMsg E} (hstep : ValidAEStep E cs lead v msg cs') (hd : Nat) (tl : List Nat) (hvoters : cs.voters = hd :: tl) (record : VoteRecord) (term : Nat) (hwin : wonInTerm (hd :: tl) record term lead = true) (hcovers : CandidateLogCovers E (hd :: tl) record term lead cs.logs (cs.logs lead)) : ∀ k e, isQuorumCommitted cs.voters cs.logs k e → isQuorumCommitted cs'.voters cs'.logs k e (full source statement)
    • proof statement excerpt: theorem validAEStep_committed_invariant (E : Type) [DecidableEq E] {cs cs' : ClusterState E} {lead v : Nat} {msg : AppendEntriesMsg E} (_hstep : ValidAEStep E cs lead v msg cs') (_w : Nat) (_hw : _w ≠ v) (hother_eq : cs'.committed _w = cs.committed _w) : cs'.committed _w = cs.committed _w (full source statement)

  • Raft Lean squad / ConcreteTransitions

    • specified: Raft Rust-component model/proof: ConcreteTransitions
    • safety: source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately
    • liveness: no temporal eventual-progress guarantee inferred from a Progress-named component
    • tool/status: Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt
    • size: 502 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem clm_preserved_single_step (E : Type) (logs : VoterLogs E) (candLog : Nat → Option E) (msg : AppendEntriesMsg E) (v : Nat) (hclm : CandLogMatching E logs candLog) (hprev : candLog msg.prevLogIndex = logs v msg.prevLogIndex) (hnew : ∀ k > msg.prevLogIndex, applyAppendEntries E (logs v) msg k = candLog k) : CandLogMatching E (fun w i => if w = v then applyAppendEntries E (logs v) msg i else logs w i) candLog (full source statement)

  • Raft Lean squad / ConfigValidate

    • specified: Raft Rust-component model/proof: ConfigValidate
    • safety: source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately
    • liveness: no temporal eventual-progress guarantee inferred from a Progress-named component
    • tool/status: Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt
    • size: 268 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem uncommitted_less_than_msg_invalid (c : Config) (h : c.max_uncommitted_size < c.max_size_per_msg) : configValidate c = false (full source statement)

  • Raft Lean squad / ConfigurationInvariants

    • specified: Raft Rust-component model/proof: ConfigurationInvariants
    • safety: source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately
    • liveness: no temporal eventual-progress guarantee inferred from a Progress-named component
    • tool/status: Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt
    • size: 349 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem CI7_finalise_preserves_incoming_disjoint (cfg : Configuration) (hinv : VotersLearnersDisjoint cfg) : ∀ id, id ∈ cfg.incoming_voters → id ∉ (cfg.learners ++ cfg.learners_next) (full source statement)
    • proof statement excerpt: theorem CI3_empty_satisfies_invariant : VotersLearnersDisjoint emptyConfiguration (full source statement)

  • Raft Lean squad / CrossModuleComposition

    • specified: Raft Rust-component model/proof: CrossModuleComposition
    • safety: source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately
    • liveness: no temporal eventual-progress guarantee inferred from a Progress-named component
    • tool/status: Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt
    • size: 260 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem CMC7_maybeAppend_safety_composition [DecidableEq E] (hd : Nat) (tl : List Nat) (logs : VoterLogs E) (k : Nat) (e1 e2 : E) (h1 : isQuorumCommitted (hd :: tl) logs k e1) (h2 : isQuorumCommitted (hd :: tl) logs k e2) : e1 = e2 (full source statement)
    • proof statement excerpt: theorem CMC6_committed_index_entry_bridge (hd : Nat) (tl : List Nat) (acked : AckedFn) (logs : VoterLogs Nat) (k : Nat) (hci : committedIndex (hd :: tl) acked ≥ k) (hbridge : ∃ e, ∀ v, acked v ≥ k → logs v k = some e) : ∃ e, hasQuorum (hd :: tl) (fun v => decide (logs v k = some e)) = true (full source statement)

  • Raft Lean squad / ElectionBroadcastChain

    • specified: Raft Rust-component model/proof: ElectionBroadcastChain
    • safety: source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately
    • liveness: no temporal eventual-progress guarantee inferred from a Progress-named component
    • tool/status: Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt
    • size: 267 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem broadcastSeq_hqc_preserved [DecidableEq E] (lead : Nat) (voterLog : Nat → LogId) (hd : Nat) (tl : List Nat) (cs_bc cs_post : ClusterState E) (hseq : BroadcastSeq E lead (fun w => (voterLog w).index) (hd :: tl) cs_bc cs_post) (hlead_not_in : lead ∉ (hd :: tl)) {cs_next : ClusterState E} {v_next : Nat} {msg_next : AppendEntriesMsg E} (hstep : ValidAEStep E cs_post lead v_next msg_next cs_next) (hvoters : cs_post.voters = hd :: tl) (record : VoteRecord) (term : Nat) (candLastTerm candLastIndex : Nat → Nat) (hwin : wonInTerm (hd :: tl) record term lead = true) (hnv_hae : ∀ w, w ∉ (hd :: tl) → ∀ k, k ≤ (voterLog w).index → cs_post.logs w k = cs_post.logs lead k) (hlog_none : ∀ w k, k > (voterLog w).index → cs_post.logs w k = none) (hcand_mono : ∀ j k, j ≤ k → cs_post.logs lead k = none → cs_post.logs lead j = none) (hconsist : VoteRecordConsistency record voterLog candLastTerm candLastIndex) (hvoter_idx : ∀ w k e, w ∈ (hd :: tl) → cs_post.logs w k = some e → k ≤ (voterLog w).index) : ∀ k e, isQuorumCommitted cs_post.voters cs_post.logs k e → isQuorumCommitted cs_next.voters cs_next.logs k e (full source statement)

  • Raft Lean squad / ElectionConcreteModel

    • specified: Raft Rust-component model/proof: ElectionConcreteModel
    • safety: source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately
    • liveness: no temporal eventual-progress guarantee inferred from a Progress-named component
    • tool/status: Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt
    • size: 307 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem hqc_preserved_of_validAEStep [DecidableEq E] {cs cs' : ClusterState E} {lead v : Nat} {msg : AppendEntriesMsg E} (hstep : ValidAEStep E cs lead v msg cs') (hd : Nat) (tl : List Nat) (hvoters : cs.voters = hd :: tl) (record : VoteRecord) (term : Nat) (voterLog : Nat → LogId) (candLastTerm candLastIndex : Nat → Nat) (hwin : wonInTerm (hd :: tl) record term lead = true) (hae : ∀ w k, k ≤ (voterLog w).index → cs.logs w k = cs.logs lead k) (hlog_none : ∀ w k, k > (voterLog w).index → cs.logs w k = none) (hcand_mono : ∀ j k, j ≤ k → cs.logs lead k = none → cs.logs lead j = none) (hconsist : VoteRecordConsistency record voterLog candLastTerm candLastIndex) (hvoter_idx : ∀ w k e, w ∈ (hd :: tl) → cs.logs w k = some e → k ≤ (voterLog w).index) : ∀ k e, isQuorumCommitted cs.voters cs.logs k e → isQuorumCommitted cs'.voters cs'.logs k e (full source statement)

  • Raft Lean squad / ElectionLifecycle

    • specified: Raft Rust-component model/proof: ElectionLifecycle
    • safety: source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately
    • liveness: no temporal eventual-progress guarantee inferred from a Progress-named component
    • tool/status: Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt
    • size: 260 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem fullProtocolStep_safe {E : Type} [DecidableEq E] {lead hd : Nat} {tl : List Nat} {cs_pre cs_post cs_next : ClusterState E} (hreach_pre : RaftReachable cs_pre) (epoch : ElectionEpoch E lead hd tl cs_pre cs_post) {v_next : Nat} {msg_next : AppendEntriesMsg E} (hstep : ValidAEStep E cs_post lead v_next msg_next cs_next) (hvoters_next : cs_next.voters = hd :: tl) : isClusterSafe cs_next (full source statement)
    • proof statement excerpt: theorem electionEpoch_full_safety {E : Type} [DecidableEq E] {lead hd : Nat} {tl : List Nat} {cs_pre cs_post cs_next : ClusterState E} (epoch : ElectionEpoch E lead hd tl cs_pre cs_post) (hreach_post : RaftReachable cs_post) {v_next : Nat} {msg_next : AppendEntriesMsg E} (hstep : ValidAEStep E cs_post lead v_next msg_next cs_next) (hvoters_next : cs_next.voters = hd :: tl) : isClusterSafe cs_next (full source statement)
    • proof statement excerpt: theorem electionEpoch_hqc_preserved {E : Type} [DecidableEq E] {lead hd : Nat} {tl : List Nat} {cs_pre cs_post cs_next : ClusterState E} (epoch : ElectionEpoch E lead hd tl cs_pre cs_post) {v_next : Nat} {msg_next : AppendEntriesMsg E} (hstep : ValidAEStep E cs_post lead v_next msg_next cs_next) : ∀ k e, isQuorumCommitted cs_post.voters cs_post.logs k e → isQuorumCommitted cs_next.voters cs_next.logs k e (full source statement)

  • Raft Lean squad / ElectionReachability

    • specified: Raft Rust-component model/proof: ElectionReachability
    • safety: source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately
    • liveness: no temporal eventual-progress guarantee inferred from a Progress-named component
    • tool/status: Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt
    • size: 421 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem candLogCoversLastIndex_of_highWaterMark (E : Type) (voterLog : Nat → LogId) (logs : VoterLogs E) (candLog : Nat → Option E) (hclm : CandLogMatching E logs candLog) (hwm : ∀ w, ∃ j, (voterLog w).index ≤ j ∧ candLog j = logs w j) : CandLogCoversLastIndex E voterLog logs candLog (full source statement)

  • Raft Lean squad / FindConflict

    • specified: Raft Rust-component model/proof: FindConflict
    • safety: source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately
    • liveness: no temporal eventual-progress guarantee inferred from a Progress-named component
    • tool/status: Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt
    • size: 211 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • property/model declaration excerpt (not proof evidence): structure LogEntry where index : Nat term : Nat deriving Repr, DecidableEq abbrev LogTerm (full source statement)

  • Raft Lean squad / FindConflictByTerm

    • specified: Raft Rust-component model/proof: FindConflictByTerm
    • safety: source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately
    • liveness: no temporal eventual-progress guarantee inferred from a Progress-named component
    • tool/status: Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt
    • size: 227 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • property/model declaration excerpt (not proof evidence): def LogNonDecreasing (logTerm : Nat → Nat) : Prop (full source statement)

  • Raft Lean squad / HasNextEntries

    • specified: Raft Rust-component model/proof: HasNextEntries
    • safety: source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately
    • liveness: no temporal eventual-progress guarantee inferred from a Progress-named component
    • tool/status: Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt
    • size: 215 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem HNE12_hasNextEntriesSince_mono_committed (firstIndex c1 c2 persisted limit sinceIdx : Nat) (hle : c1 ≤ c2) (htrue : hasNextEntriesSince firstIndex c1 persisted limit sinceIdx = true) : hasNextEntriesSince firstIndex c2 persisted limit sinceIdx = true (full source statement)

  • Raft Lean squad / HasQuorum

    • specified: Raft Rust-component model/proof: HasQuorum
    • safety: source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately
    • liveness: no temporal eventual-progress guarantee inferred from a Progress-named component
    • tool/status: Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt
    • size: 337 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • property/model declaration excerpt (not proof evidence): def overlapCount : List Nat → (Nat → Bool) → Nat | [], _ => 0 | v :: vs, s => (if s v then 1 else 0) + overlapCount vs s (full source statement)

  • Raft Lean squad / Inflights

    • specified: Raft Rust-component model/proof: Inflights
    • safety: source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately
    • liveness: no temporal eventual-progress guarantee inferred from a Progress-named component
    • tool/status: Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt
    • size: 779 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem inflights_freeTo_preserves_gt (inf : Inflights) (to : Nat) (hsort : inf.queue.Pairwise (· ≤ ·)) (x : Nat) (hx : x ∈ inf.queue) (hgt : x > to) : x ∈ (inf.freeTo to).queue (full source statement)
    • proof statement excerpt: theorem inflightsConc_reset_correct (s : InflightsConc) : s.resetConc.toAbstract = s.toAbstract.reset (full source statement)

  • Raft Lean squad / IsContinuousEnts

    • specified: Raft Rust-component model/proof: IsContinuousEnts
    • safety: source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately
    • liveness: no temporal eventual-progress guarantee inferred from a Progress-named component
    • tool/status: Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt
    • size: 115 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • property/model declaration excerpt (not proof evidence): def isContinuousEnts (msgEnts : List Nat) (ents : List Nat) : Bool (full source statement)

  • Raft Lean squad / IsUpToDate

    • specified: Raft Rust-component model/proof: IsUpToDate
    • safety: source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately
    • liveness: no temporal eventual-progress guarantee inferred from a Progress-named component
    • tool/status: Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt
    • size: 226 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • property/model declaration excerpt (not proof evidence): structure LogId where term : Nat index : Nat deriving Repr, BEq, DecidableEq (full source statement)

  • Raft Lean squad / JointCommittedIndex

    • specified: Raft Rust-component model/proof: JointCommittedIndex
    • safety: source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately
    • liveness: no temporal eventual-progress guarantee inferred from a Progress-named component
    • tool/status: Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt
    • size: 214 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem jointCommittedIndex_safety_out (incoming outgoing : List Nat) (acked : AckedFn) (hn : 0 < outgoing.length) : majority outgoing.length ≤ countGe outgoing acked (jointCommittedIndex incoming outgoing acked) (full source statement)
    • proof statement excerpt: theorem jointCommittedIndex_empty_out (incoming : List Nat) (acked : AckedFn) : jointCommittedIndex incoming [] acked = 0 (full source statement)

  • Raft Lean squad / JointSafetyComposition

    • specified: Raft Rust-component model/proof: JointSafetyComposition
    • safety: source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately
    • liveness: no temporal eventual-progress guarantee inferred from a Progress-named component
    • tool/status: Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt
    • size: 252 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem JSC7_joint_raft_log_safety (hi : Nat) (ti : List Nat) (ho : Nat) (to : List Nat) (a1 a2 : AckedFn) : (∃ w_in ∈ (hi :: ti), a1 w_in ≥ jointCommittedIndex (hi :: ti) (ho :: to) a1 ∧ a2 w_in ≥ jointCommittedIndex (hi :: ti) (ho :: to) a2) ∧ (∃ w_out ∈ (ho :: to), a1 w_out ≥ jointCommittedIndex (hi :: ti) (ho :: to) a1 ∧ a2 w_out ≥ jointCommittedIndex (hi :: ti) (ho :: to) a2) (full source statement)

  • Raft Lean squad / JointTally

    • specified: Raft Rust-component model/proof: JointTally
    • safety: source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately
    • liveness: no temporal eventual-progress guarantee inferred from a Progress-named component
    • tool/status: Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt
    • size: 289 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • property/model declaration excerpt (not proof evidence): def jointTallyVotes (incoming outgoing : List Nat) (check : Nat → Option Bool) : Nat × Nat × VoteResult (full source statement)

  • Raft Lean squad / JointVote

    • specified: Raft Rust-component model/proof: JointVote
    • safety: source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately
    • liveness: no temporal eventual-progress guarantee inferred from a Progress-named component
    • tool/status: Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt
    • size: 195 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • property/model declaration excerpt (not proof evidence): def combineVotes (i o : VoteResult) : VoteResult (full source statement)

  • Raft Lean squad / LeaderCompleteness

    • specified: Raft Rust-component model/proof: LeaderCompleteness
    • safety: source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately
    • liveness: no temporal eventual-progress guarantee inferred from a Progress-named component
    • tool/status: Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt
    • size: 393 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem hqc_preserved_from_leaderBroadcast [DecidableEq E] (hd : Nat) (tl : List Nat) (record : VoteRecord) (term leader : Nat) (logs logs' : VoterLogs E) (hwin : wonInTerm (hd :: tl) record term leader = true) (hcovers : CandidateLogCovers E (hd :: tl) record term leader logs (logs leader)) (happend : ∀ k e, isQuorumCommitted (hd :: tl) logs k e → ∀ w', logs' w' k = logs leader k) : ∀ k e, isQuorumCommitted (hd :: tl) logs k e → isQuorumCommitted (hd :: tl) logs' k e (full source statement)
    • proof statement excerpt: theorem electionWinner_overlaps_commitQuorum [DecidableEq E] (hd : Nat) (tl : List Nat) (record : VoteRecord) (term cand : Nat) (logs : VoterLogs E) (k : Nat) (e : E) (hwin : wonInTerm (hd :: tl) record term cand = true) (hcommit : isQuorumCommitted (hd :: tl) logs k e) : ∃ w ∈ (hd :: tl), record term w = some cand ∧ logs w k = some e (full source statement)

  • Raft Lean squad / LimitSize

    • specified: Raft Rust-component model/proof: LimitSize
    • safety: source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately
    • liveness: no temporal eventual-progress guarantee inferred from a Progress-named component
    • tool/status: Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt
    • size: 507 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • property/model declaration excerpt (not proof evidence): def totalSize {α : Type} (size : α → Nat) : List α → Nat | [] => 0 | e :: es => size e + totalSize size es @[simp] theorem totalSize_nil {α : Type} (size : α → Nat) : totalSize size [] = 0 (full source statement)

  • Raft Lean squad / LogUnstable

    • specified: Raft Rust-component model/proof: LogUnstable
    • safety: source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately
    • liveness: no temporal eventual-progress guarantee inferred from a Progress-named component
    • tool/status: Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt
    • size: 481 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem truncateAndAppend_snapshot_preserved (u : Unstable) (newTerms : List Nat) (after : Nat) : (truncateAndAppend u newTerms after).snapshot = u.snapshot (full source statement)

  • Raft Lean squad / MajorityVote

    • specified: Raft Rust-component model/proof: MajorityVote
    • safety: source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately
    • liveness: no temporal eventual-progress guarantee inferred from a Progress-named component
    • tool/status: Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt
    • size: 300 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • property/model declaration excerpt (not proof evidence): inductive VoteResult where | Pending | Lost | Won deriving DecidableEq, Repr (full source statement)

  • Raft Lean squad / MaybeAppend

    • specified: Raft Rust-component model/proof: MaybeAppend
    • safety: source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately
    • liveness: no temporal eventual-progress guarantee inferred from a Progress-named component
    • tool/status: Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt
    • size: 309 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem maybeAppend_log_prefix_preserved (s : RaftState) (idx term ca : Nat) (ents : List LogEntry) (h : matchTerm s.log idx term = true) (hc : findConflict s.log ents > 0) (hsuf : ∀ e ∈ ents.drop (findConflict s.log ents - (idx + 1)), findConflict s.log ents ≤ e.index) (i : Nat) (hi : i < findConflict s.log ents) : (maybeAppend s idx term ca ents).2.log i = s.log i (full source statement)
    • proof statement excerpt: theorem maybeAppend_committed_eq_min (s : RaftState) (idx term ca : Nat) (ents : List LogEntry) (h : matchTerm s.log idx term = true) (hca : s.committed ≤ ca) (hlast : s.committed ≤ idx + ents.length) : (maybeAppend s idx term ca ents).2.committed = min ca (idx + ents.length) (full source statement)

  • Raft Lean squad / MaybeCommit

    • specified: Raft Rust-component model/proof: MaybeCommit
    • safety: source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately
    • liveness: no temporal eventual-progress guarantee inferred from a Progress-named component
    • tool/status: Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt
    • size: 319 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem maybeCommit_eq_commitTo (log : LogTerm) (committed maxIndex term : Nat) (hterm : log maxIndex = some term) : maybeCommit log committed maxIndex term = commitTo committed maxIndex (full source statement)

  • Raft Lean squad / MaybePersist

    • specified: Raft Rust-component model/proof: MaybePersist
    • safety: source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately
    • liveness: no temporal eventual-progress guarantee inferred from a Progress-named component
    • tool/status: Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt
    • size: 237 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • property/model declaration excerpt (not proof evidence): def maybePersist (persisted firstUpdateIndex : Nat) (logTerm : Nat → Nat) (index term : Nat) : Nat × Bool (full source statement)

  • Raft Lean squad / MaybePersistFUI

    • specified: Raft Rust-component model/proof: MaybePersistFUI
    • safety: source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately
    • liveness: no temporal eventual-progress guarantee inferred from a Progress-named component
    • tool/status: Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt
    • size: 211 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • property/model declaration excerpt (not proof evidence): def firstUpdateIndex (snapshotIndex : Option Nat) (offset : Nat) : Nat (full source statement)

  • Raft Lean squad / MemStorage

    • specified: Raft Rust-component model/proof: MemStorage
    • safety: source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately
    • liveness: no temporal eventual-progress guarantee inferred from a Progress-named component
    • tool/status: Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt
    • size: 342 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem MS12_append_at_end_preserves (s : MemStorageCore) (newTerms : List Nat) (hne : newTerms ≠ []) : (append s (lastIndex s + 1) newTerms).terms = s.terms ++ newTerms (full source statement)

  • Raft Lean squad / MultiStepReachability

    • specified: Raft Rust-component model/proof: MultiStepReachability
    • safety: source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately
    • liveness: no temporal eventual-progress guarantee inferred from a Progress-named component
    • tool/status: Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt
    • size: 182 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem listStep_safe_from_init [DecidableEq E] {cs' : ClusterState E} (hd : Nat) (tl : List Nat) (hvoters : cs'.voters = hd :: tl) (hlist : ValidAEList E (initialCluster (hd :: tl)) cs') : isClusterSafe cs' (full source statement)
    • proof statement excerpt: theorem listStep_committed_mono [DecidableEq E] {cs cs' : ClusterState E} (hlist : ValidAEList E cs cs') : ∀ (w : Nat), cs'.committed w ≥ cs.committed w (full source statement)

  • Raft Lean squad / NextEntries

    • specified: Raft Rust-component model/proof: NextEntries
    • safety: source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately
    • liveness: no temporal eventual-progress guarantee inferred from a Progress-named component
    • tool/status: Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt
    • size: 195 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem NE5_mono_committed (fi c1 c2 p l si : Nat) (hle : c1 ≤ c2) (h1 : (nextEntriesSince fi c1 p l si).isSome = true) : (nextEntriesSince fi c2 p l si).isSome = true (full source statement)

  • Raft Lean squad / Progress

    • specified: Raft Rust-component model/proof: Progress
    • safety: source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately
    • liveness: no temporal eventual-progress guarantee inferred from a Progress-named component
    • tool/status: Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt
    • size: 538 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem PR35_optimisticUpdate_preserves_wf (p : Progress) (n : Nat) (hn : p.matched ≤ n) : (p.optimisticUpdate n).wf (full source statement)

  • Raft Lean squad / ProgressSet

    • specified: Raft Rust-component model/proof: ProgressSet
    • safety: source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately
    • liveness: no temporal eventual-progress guarantee inferred from a Progress-named component
    • tool/status: Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt
    • size: 350 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem PS7_resetActive_preserves_all_wf (ps : ProgressSet) (perspectiveOf : Nat) (h : all_wf_fn ps) : all_wf_fn (resetActive ps perspectiveOf) (full source statement)

  • Raft Lean squad / ProgressTracker

    • specified: Raft Rust-component model/proof: ProgressTracker
    • safety: source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately
    • liveness: no temporal eventual-progress guarantee inferred from a Progress-named component
    • tool/status: Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt
    • size: 520 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem PT25_initTracker_applyChanges_preserves_member (ids : List Nat) (next_idx : Nat) (changes : List (Nat × ChangeType)) (next_idx2 id : Nat) (hmem : id ∈ ids) (habsent : id ∉ changes.map (·.1)) : hasPeer (applyChanges (initTracker ids next_idx) changes next_idx2) id = true (full source statement)

  • Raft Lean squad / QuorumRecentlyActive

    • specified: Raft Rust-component model/proof: QuorumRecentlyActive
    • safety: source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately
    • liveness: no temporal eventual-progress guarantee inferred from a Progress-named component
    • tool/status: Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt
    • size: 270 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • property/model declaration excerpt (not proof evidence): def isActive (entries : List (Nat × Progress)) (perspectiveOf : Nat) (n : Nat) : Bool (full source statement)

  • Raft Lean squad / RaftElection

    • specified: Raft Rust-component model/proof: RaftElection
    • safety: source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately
    • liveness: no temporal eventual-progress guarantee inferred from a Progress-named component
    • tool/status: Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt
    • size: 1,013 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem electionSafety_two_leaders (hd : Nat) (tl : List Nat) (record : VoteRecord) (term n1 n2 : Nat) (hw1 : wonInTerm (hd :: tl) record term n1 = true) (hw2 : wonInTerm (hd :: tl) record term n2 = true) : n1 = n2 (full source statement)
    • proof statement excerpt: theorem RT14_becomeFollower_same_term_preserves_vote (s : NodeState) (selfId : Nat) : (becomeFollower (becomeCandidate s selfId) (s.currentTerm + 1)).votedFor = some selfId (full source statement)

  • Raft Lean squad / RaftLogAppend

    • specified: Raft Rust-component model/proof: RaftLogAppend
    • safety: source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately
    • liveness: no temporal eventual-progress guarantee inferred from a Progress-named component
    • tool/status: Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt
    • size: 442 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem ra_committed_prefix_preserved (rl : RaftLog) (first : Entry) (rest : List Entry) (k : Nat) (hk : k ≤ rl.committed) (hguard : rl.committed < first.1) (hle : first.1 ≤ rl.unstable.offset + rl.unstable.entries.length) : maybeTerm (raftLogAppend rl (first :: rest)).1.unstable k = maybeTerm rl.unstable k (full source statement)

  • Raft Lean squad / RaftProtocol

    • specified: Raft Rust-component model/proof: RaftProtocol
    • safety: source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately
    • liveness: no temporal eventual-progress guarantee inferred from a Progress-named component
    • tool/status: Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt
    • size: 446 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem appendEntries_preserves_log_matching (logs : Nat → LogTerm) (args : AppendEntriesArgs) (v : Nat) (s : RaftState) (hs : logs v = s.log) (hlm : LogMatchingInvariant logs) (hleader_lmi : ∀ w, w ≠ v → ∀ k, (maybeAppend s args.prevLogIndex args.prevLogTerm args.leaderCommit args.entries).2.log k = logs w k → ∀ j ≤ k, (maybeAppend s args.prevLogIndex args.prevLogTerm args.leaderCommit args.entries).2.log j = logs w j) : let s' (full source statement)
    • proof statement excerpt: theorem rss3_from_logMatchInvariant (logs : VoterLogs Nat) (hlm : LogMatchingInvariant logs) (v1 v2 : Nat) (k : Nat) (hmatch : logs v1 k = logs v2 k) : ∀ j ≤ k, logs v1 j = logs v2 j (full source statement)

  • Raft Lean squad / RaftSafety

    • specified: Raft Rust-component model/proof: RaftSafety
    • safety: source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately
    • liveness: no temporal eventual-progress guarantee inferred from a Progress-named component
    • tool/status: Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt
    • size: 426 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem raft_end_to_end_safety_full [DecidableEq E] (hd : Nat) (tl : List Nat) (cs : ClusterState E) (hvoters : cs.voters = hd :: tl) (hcci : CommitCertInvariant cs) : isClusterSafe cs (full source statement)
    • property/model declaration excerpt (not proof evidence): def CommitCertInvariant [DecidableEq E] (cs : ClusterState E) : Prop (full source statement)
    • proof statement excerpt: theorem raft_committed_no_rollback [DecidableEq E] (hd : Nat) (tl : List Nat) (logs₀ logs₁ : VoterLogs E) (k : Nat) (e : E) (hnr : NoRollbackInvariantFor E (hd :: tl) logs₀ logs₁) (hcommit : isQuorumCommitted (hd :: tl) logs₀ k e) : isQuorumCommitted (hd :: tl) logs₁ k e (full source statement)

  • Raft Lean squad / RaftTrace

    • specified: Raft Rust-component model/proof: RaftTrace
    • safety: source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately
    • liveness: no temporal eventual-progress guarantee inferred from a Progress-named component
    • tool/status: Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt
    • size: 243 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem initialCluster_safe : isClusterSafe (initialCluster (E := Nat) [1, 2, 3]) (full source statement)

  • Raft Lean squad / ReadOnly

    • specified: Raft Rust-component model/proof: ReadOnly
    • safety: source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately
    • liveness: no temporal eventual-progress guarantee inferred from a Progress-named component
    • tool/status: Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt
    • size: 442 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem RO14_advance_preserves_nodup (ro : ReadOnly) (ctx : Ctx) (hnd : ro.queue.Nodup) : (advance ro ctx).2.queue.Nodup (full source statement)

  • Raft Lean squad / Restore

    • specified: Raft Rust-component model/proof: Restore
    • safety: source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately
    • liveness: no temporal eventual-progress guarantee inferred from a Progress-named component
    • tool/status: Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt
    • size: 149 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem restore_invariant_ordering (s : RaftLogState) (idx : Nat) (hwf : s.wellFormed) (hpre : idx ≥ s.committed) : (restore s idx).wellFormed (full source statement)
    • proof statement excerpt: theorem restore_idempotent_committed (s : RaftLogState) : (restore s s.committed).committed = s.committed (full source statement)

  • Raft Lean squad / SafetyComposition

    • specified: Raft Rust-component model/proof: SafetyComposition
    • safety: source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately
    • liveness: no temporal eventual-progress guarantee inferred from a Progress-named component
    • tool/status: Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt
    • size: 283 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem SC4_raft_log_safety (hd : Nat) (tl : List Nat) (acked1 acked2 : AckedFn) : ∃ w ∈ (hd :: tl), acked1 w ≥ committedIndex (hd :: tl) acked1 ∧ acked2 w ≥ committedIndex (hd :: tl) acked2 (full source statement)
    • proof statement excerpt: theorem SC9_quorumActive_and_commit_share_voter (hd : Nat) (tl : List Nat) (acked : AckedFn) (entries : List (Nat × Progress)) (perspectiveOf : Nat) (hqra : quorumRecentlyActive (hd :: tl) entries perspectiveOf = true) : ∃ w ∈ (hd :: tl), isActive entries perspectiveOf w = true ∧ acked w ≥ committedIndex (hd :: tl) acked (full source statement)

  • Raft Lean squad / TallyVotes

    • specified: Raft Rust-component model/proof: TallyVotes
    • safety: source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately
    • liveness: no temporal eventual-progress guarantee inferred from a Progress-named component
    • tool/status: Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt
    • size: 335 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • property/model declaration excerpt (not proof evidence): def noCount : List Nat → (Nat → Option Bool) → Nat | [], _ => 0 | v :: vs, check => (if check v = some false then 1 else 0) + noCount vs check (full source statement)

  • Raft Lean squad / UncommittedState

    • specified: Raft Rust-component model/proof: UncommittedState
    • safety: source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately
    • liveness: no temporal eventual-progress guarantee inferred from a Progress-named component
    • tool/status: Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt
    • size: 319 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • proof statement excerpt: theorem US4_zeroUncommitted_increase_true (s : US) (size : Nat) (hz : s.uncommittedSize = 0) : (maybeIncrease s size).2 = true (full source statement)

  • Raft Lean squad / UnstablePersistBridge

    • specified: Raft Rust-component model/proof: UnstablePersistBridge
    • safety: source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately
    • liveness: no temporal eventual-progress guarantee inferred from a Progress-named component
    • tool/status: Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt
    • size: 231 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file
    • property/model declaration excerpt (not proof evidence): def maybePersistFromUnstable (u : Unstable) (persisted : Nat) (logTerm : Nat → Nat) (index term : Nat) : Nat × Bool (full source statement)

Lean 4 / Veil source cases

  • Chorus per-slot consensus

    • specified: Chorus per-slot consensus
    • safety: state/decision invariants and contract implementation
    • liveness: conditional termination/progress over explicit fairness and primitive contracts
    • tool/status: Lean 4 / Veil; Veil configured for reconstructed Lean proofs (veil.smt.trust false); Lean theorem/axiom audit source; no fresh build
    • size: 15,397 physical lines across 63 .lean files in this directory; imports outside this scope excluded
    • source: exact directory
    • proof statement excerpt: theorem not_decided (n : Nat) (i : Fin 4) (v : V) : ¬ (Mvba.mvbaSafety thM).decided (mst n) i v (full source statement)
    • proof statement excerpt: theorem timedTermination_premises_satisfiable : ∃ (n f : Nat) (hf : n = 3 * f + 1) (is_byz : Fin n → Prop) (_ : DecidablePred is_byz) (hbyz : (List.ofFn (n := n) id |>.filter (fun i => decide (is_byz i))).length ≤ f) (slot merkle_root view Phase PathChoice : Type) (_ : Inhabited slot) (_ : Inhabited merkle_root) (_ : Inhabited view) (_ : Inhabited Phase) (_ : Inhabited PathChoice) (vord : TotalOrderWithMinimum view) (_ : Chorus.Phase_EnumClass Phase) (_ : Chorus.PathChoice_EnumClass PathChoice) (_ : Inhabited (Fin n)) (vfin : Cadence.ViewOrderEnum view vord) (time : Type) (_ : LinearOrder time) (_ : AddCommMonoid time) (_ : IsOrderedCancelAddMonoid time) (_ : Archimedean time) (_ : ByzNodeSetHonestQuorum (Fin n) (ByzNSet n) (byzNodeSetFin n f hf is_byz hbyz)) (is_proposer : Fin n → Bool) (well_encoded : merkle_root → Bool) (mvba_init_state : Mvba.State (Mvba.FieldAbstractType (Fin n) (ByzNSet n) (MetaBlock (Fin n) merkle_root) (Fin n → Option merkle_root) view)) (thM : Mvba.Theory (Fin n) (ByzNSet n) (MetaBlock (Fin n) merkle_root) (Fin n → Option merkle_root) view) (sch : Chorus.Schedule view time) (_ : Mvba.LeaderRotation (nset := byzNodeSetFin n f hf is_byz hbyz) vfin sch.mvba.k thM), (atMvba (nset := byzNodeSetFin n f hf is_byz hbyz) (slot := slot) (Phase := Phase) (PathChoice := PathChoice) thM).assumptions (Cadence.chorusTheory (slot := slot) (Phase := Phase) (PathChoice := PathChoice) is_proposer well_encoded mvba_init_state) ∧ ∃ (r : TChorusRun (nset := byzNodeSetFin n f hf is_byz hbyz) (Cadence.chorusTheory (slot := slot) (Phase := Phase) (PathChoice := PathChoice) is_proposer well_encoded mvba_init_state) thM time) (t : time), SyncAtMvba (nset := byzNodeSetFin n f hf is_byz hbyz) sch r ∧ ValidBridge (nset := byzNodeSetFin n f hf is_byz hbyz) r.toLRun ∧ SyncParticipationWithin (nset := byzNodeSetFin n f hf is_byz hbyz) sch.Δ r ∧ NoAbandonBeforeFinalizing (nset := byzNodeSetFin n f hf is_byz hbyz) r.toLRun ∧ NoEarlyStart (nset := byzNodeSetFin n f hf is_byz hbyz) sch r ∧ AllParticipateBy (nset := byzNodeSetFin n f hf is_byz hbyz) t r (full source statement)
    • proof statement excerpt: theorem mvbaOwn : Mvba.BoundedJustice schC.mvba proj.timed ∧ Mvba.TimerPunctual schC.mvba proj.timed (full source statement)

  • Conductor window orchestration

    • specified: Conductor window orchestration
    • safety: state/decision invariants and contract implementation
    • liveness: conditional termination/progress over explicit fairness and primitive contracts
    • tool/status: Lean 4 / Veil; Veil configured for reconstructed Lean proofs (veil.smt.trust false); Lean theorem/axiom audit source; no fresh build
    • size: 4,853 physical lines across 6 .lean files in this directory; imports outside this scope excluded
    • source: exact directory
    • proof statement excerpt: theorem conductorFull_toSafety (sch : ConductorSchedule view time vfin) (TA : ACSTemporal node ℕ acsstate time msg fm.byz) (th : Conductor.Theory ℕ window time node acsstate) (hstart : StartTimes sch th) (hshift : WindowShifts sch th) (hunb : StartsUnbounded th) (hwin : WindowsUnbounded window) (hΔ : TA.Δ = sch.Δ) (hℓ : TA.ℓ = sch.ℓ) (hfault : (Finset.univ.filter fm.byz).card ≤ TA.fault_bound) : (conductorFull sch TA th hstart hshift hunb hwin hΔ hℓ hfault).toOrchestratorSafety = orchestratorSafety th (full source statement)
    • proof statement excerpt: theorem startsUnbounded_of_startTimes [Archimedean time] {sch : ConductorSchedule view time vfin} {th : Conductor.Theory ℕ window time node acsstate} (hstart : StartTimes sch th) (h0 : 0 ≤ sch.start₀) : StartsUnbounded th (full source statement)

  • composed Cadence

    • specified: composed Cadence
    • safety: state/decision invariants and contract implementation
    • liveness: conditional termination/progress over explicit fairness and primitive contracts
    • tool/status: Lean 4 / Veil; Veil configured for reconstructed Lean proofs (veil.smt.trust false); Lean theorem/axiom audit source; no fresh build
    • size: 5,625 physical lines across 15 .lean files in this directory; imports outside this scope excluded
    • source: exact directory
    • proof statement excerpt: theorem mno_stutter_step : ¬ (Mvba.mvbaSafety thM).step (mst 0) (mst 0) (full source statement)
    • proof statement excerpt: theorem corollary4_termination {x : ℕ} (ps : (PS x).Projection ((LS x) r).toLRun) (hps : (CT).Admissible (partRun ps)) : (∀ i, ¬ (byzNodeSetFin n f hf is_byz hbyz).is_byz i = true → (partRun ps).eventually (fun st => (SCI).participating st i)) → ∀ j, ¬ (byzNodeSetFin n f hf is_byz hbyz).is_byz j = true → (partRun ps).eventually (fun st => ∃ V, (SCI).finalized st j V) (full source statement)
    • proof statement excerpt: theorem liveness_premises_satisfiable : ∃ (sch : ConductorSchedule ℕ ℕ natViewOrderEnum) (TA : ACSTemporal (Fin 4) ℕ ACSt ℕ Unit (fmF 4 1 rfl isByz Chorus.Witness.hbyz).byz) (thO : Conductor.Theory ℕ ℕ ℕ (Fin 4) ACSt) (is_proposer : Fin 4 → Bool) (well_encoded : Unit → Bool) (mvba_init_state : MS) (mvalid : V → Bool) (mleader : ℕ → Fin 4 → Bool) (_ : ∃ J, is_proposer J = true) (_ : Mvba.LeaderRotation (nset := byzNodeSetFin 4 1 rfl isByz Chorus.Witness.hbyz) natViewOrderEnum sch.mvba.k (Cadence.mvbaTheory (nodeset := ByzNSet 4) mvalid mleader)) (thG : GTheory Unit ℕ Ph PC ℕ ℕ ACSt 4) (r : TSysRun 4 1 rfl isByz Chorus.Witness.hbyz thO (Cadence.chorusTheory (slot := ℕ) (Phase := Ph) (PathChoice := PC) is_proposer well_encoded mvba_init_state) (Cadence.mvbaTheory (nodeset := ByzNSet 4) mvalid mleader) thG), StartTimes sch thO ∧ WindowShifts sch thO ∧ StartsUnbounded thO ∧ WindowsUnbounded ℕ ∧ TA.Δ = sch.Δ ∧ TA.ℓ = sch.ℓ ∧ (Finset.univ.filter (fmF 4 1 rfl isByz Chorus.Witness.hbyz).byz).card ≤ TA.fault_bound ∧ SysSync 4 1 rfl isByz Chorus.Witness.hbyz sch TA r (full source statement)
    • proof statement excerpt: theorem censorship_premises_satisfiable : ∃ (sch : ConductorSchedule ℕ ℕ natViewOrderEnum) (TA : ACSTemporal (Fin 4) ℕ ACSt ℕ Unit (fmF 4 1 rfl isByz Chorus.Witness.hbyz).byz) (thO : Conductor.Theory ℕ ℕ ℕ (Fin 4) ACSt) (is_proposer : Fin 4 → Bool) (well_encoded : Unit → Bool) (mvba_init_state : MS) (mvalid : V → Bool) (mleader : ℕ → Fin 4 → Bool) (_ : ∃ J, is_proposer J = true) (_ : Mvba.LeaderRotation (nset := byzNodeSetFin 4 1 rfl isByz Chorus.Witness.hbyz) natViewOrderEnum sch.mvba.k (Cadence.mvbaTheory (nodeset := ByzNSet 4) mvalid mleader)) (o : OrchSt ℕ ℕ ACSt 4) (sci : ℕ → SlotSt Unit ℕ Ph PC 4) (r : TSysRun 4 1 rfl isByz Chorus.Witness.hbyz thO (Cadence.chorusTheory (slot := ℕ) (Phase := Ph) (PathChoice := PC) is_proposer well_encoded mvba_init_state) (Cadence.mvbaTheory (nodeset := ByzNSet 4) mvalid mleader) ⟨fun j _ => is_proposer j, o, sci⟩), StartTimes sch thO ∧ WindowShifts sch thO ∧ StartsUnbounded thO ∧ WindowsUnbounded ℕ ∧ TA.Δ = sch.Δ ∧ TA.ℓ = sch.ℓ ∧ (Finset.univ.filter (fmF 4 1 rfl isByz Chorus.Witness.hbyz).byz).card ≤ TA.fault_bound ∧ (∃ m, well_encoded m = true) ∧ SysSync 4 1 rfl isByz Chorus.Witness.hbyz sch TA r ∧ SlotInclusive 4 1 rfl isByz Chorus.Witness.hbyz sch r (full source statement)

  • multi-valued Byzantine agreement

    • specified: multi-valued Byzantine agreement
    • safety: state/decision invariants and contract implementation
    • liveness: conditional termination/progress over explicit fairness and primitive contracts
    • tool/status: Lean 4 / Veil; Veil configured for reconstructed Lean proofs (veil.smt.trust false); Lean theorem/axiom audit source; no fresh build
    • size: 11,713 physical lines across 40 .lean files in this directory; imports outside this scope excluded
    • source: exact directory
    • proof statement excerpt: theorem mvbaFull_toSafety [IsOrderedCancelAddMonoid time] [Archimedean time] [Fintype node] (th : Theory node nodeset value evec view) (hqe : ByzNodeSetHonestQuorum node nodeset nset) (sch : Schedule view time) (vfin : ViewOrderEnum view vord) (hrot : LeaderRotation vfin sch.k th) : (mvbaFull th hqe sch vfin hrot).toMVBASafety = mvbaSafety th (full source statement)
    • proof statement excerpt: theorem termination_premises_satisfiable : ∃ (node nodeset value evec view : Type) (_ : Inhabited node) (_ : Inhabited nodeset) (_ : Inhabited value) (_ : Inhabited evec) (_ : Inhabited view) (nset : ByzNodeSet node nodeset) (vord : TotalOrderWithMinimum view) (_ : Fintype node) (_ : ByzNodeSetHonestQuorum node nodeset nset) (_ : ViewOrderEnum view vord) (th : Theory node nodeset value evec view), (Mvba.relationalTransitionSystem node nodeset value evec view).assumptions th ∧ ∃ r : MvbaRun th, FJustice r ∧ AViewSync r ∧ FAvail r ∧ AllPropose r ∧ NoEarlyAbandon r ∧ FRelay r (full source statement)
    • proof statement excerpt: theorem sync : Sync schW run (full source statement)

  • Cadence / Chorus transition model

    • specified: Chorus transition state machine
    • safety: declared protocol invariants; associated proof directories supply preservation
    • liveness: eventual progress treated separately in Lean temporal proof modules
    • tool/status: Lean 4 / Veil; Veil source model; trust false proof reconstruction configured; not built here
    • size: 2,899 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file

  • Cadence / Conductor transition model

    • specified: Conductor transition state machine
    • safety: declared protocol invariants; associated proof directories supply preservation
    • liveness: eventual progress treated separately in Lean temporal proof modules
    • tool/status: Lean 4 / Veil; Veil source model; trust false proof reconstruction configured; not built here
    • size: 919 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file

  • Cadence / Mvba transition model

    • specified: Mvba transition state machine
    • safety: declared protocol invariants; associated proof directories supply preservation
    • liveness: eventual progress treated separately in Lean temporal proof modules
    • tool/status: Lean 4 / Veil; Veil source model; trust false proof reconstruction configured; not built here
    • size: 1,407 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file

  • Cadence / Cadence transition model

    • specified: Cadence transition state machine
    • safety: declared protocol invariants; associated proof directories supply preservation
    • liveness: eventual progress treated separately in Lean temporal proof modules
    • tool/status: Lean 4 / Veil; Veil source model; trust false proof reconstruction configured; not built here
    • size: 799 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file

  • Cadence / FallbackReceipt transition model

    • specified: FallbackReceipt transition state machine
    • safety: declared protocol invariants; associated proof directories supply preservation
    • liveness: eventual progress treated separately in Lean temporal proof modules
    • tool/status: Lean 4 / Veil; Veil source model; trust false proof reconstruction configured; not built here
    • size: 513 physical lines across 1 .lean files in this file; imports outside this scope excluded
    • source: exact file

Last edited: