{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/Bakery-Boulangerie/Bakery.tla", "specifies": "Bakery/Boulangerie mutual exclusion", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+/PlusCal; TLAPS", "size": "509 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Bakery-Boulangerie/Bakery.tla)", "safety": "`MutualExclusion` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Bakery-Boulangerie/Bakery.tla#L210)); `TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Bakery-Boulangerie/Bakery.tla#L218)); `TypeCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Bakery-Boulangerie/Bakery.tla#L226)); `Inv` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Bakery-Boulangerie/Bakery.tla#L305)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Bakery-Boulangerie/Bakery.tla#L315))", "liveness": "`DeadlockFree` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Bakery-Boulangerie/Bakery.tla#L494)); `StarvationFree` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Bakery-Boulangerie/Bakery.tla#L495))", "evidence_status": "TLAPS proof target listed; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Bakery-Boulangerie/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Bakery-Boulangerie/Bakery.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/Bakery-Boulangerie/Boulanger.tla", "specifies": "Bakery/Boulangerie mutual exclusion", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+/PlusCal; TLAPS", "size": "659 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Bakery-Boulangerie/Boulanger.tla)", "safety": "`MutualExclusion` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Bakery-Boulangerie/Boulanger.tla#L286)); `TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Bakery-Boulangerie/Boulanger.tla#L294)); `TypeCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Bakery-Boulangerie/Boulanger.tla#L303)); `Inv` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Bakery-Boulangerie/Boulanger.tla#L390)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Bakery-Boulangerie/Boulanger.tla#L401))", "liveness": "`DeadlockFree` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Bakery-Boulangerie/Boulanger.tla#L656)); `StarvationFree` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Bakery-Boulangerie/Boulanger.tla#L657))", "evidence_status": "TLAPS proof target listed; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Bakery-Boulangerie/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Bakery-Boulangerie/Boulanger.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/Bakery-Boulangerie/MCBakery.tla", "specifies": "Bakery/Boulangerie mutual exclusion", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "7 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Bakery-Boulangerie/MCBakery.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Bakery-Boulangerie/manifest.json)", "configured_checks": "`INVARIANTS: MutualExclusion TypeOK Inv`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Bakery-Boulangerie/MCBakery.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Bakery-Boulangerie/MCBakery.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/Bakery-Boulangerie/MCBoulanger.tla", "specifies": "Bakery/Boulangerie mutual exclusion", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "8 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Bakery-Boulangerie/MCBoulanger.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Bakery-Boulangerie/manifest.json)", "configured_checks": "`INVARIANTS: MutualExclusion TypeOK Inv`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Bakery-Boulangerie/MCBoulanger.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Bakery-Boulangerie/MCBoulanger.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/Chameneos/APChameneos.tla", "specifies": "concurrent rendezvous game", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "37 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Chameneos/APChameneos.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Chameneos/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Chameneos/APChameneos.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/Chameneos/Chameneos.tla", "specifies": "concurrent rendezvous game", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "81 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Chameneos/Chameneos.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Chameneos/Chameneos.tla#L36)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Chameneos/Chameneos.tla#L79))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Chameneos/manifest.json)", "configured_checks": "`INVARIANTS: TypeOK SumMet`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Chameneos/Chameneos.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Chameneos/Chameneos.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/CheckpointCoordination/CheckpointCoordination.tla", "specifies": "RingMaster checkpoint coordination", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "533 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/CheckpointCoordination/CheckpointCoordination.tla)", "safety": "`CheckpointVars` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/CheckpointCoordination/CheckpointCoordination.tla#L45)); `LogCheckpoint` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/CheckpointCoordination/CheckpointCoordination.tla#L98)); `CheckpointLease` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/CheckpointCoordination/CheckpointCoordination.tla#L106)); `NoCheckpointLease` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/CheckpointCoordination/CheckpointCoordination.tla#L114)); `TypeInvariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/CheckpointCoordination/CheckpointCoordination.tla#L163)); `SafetyInvariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/CheckpointCoordination/CheckpointCoordination.tla#L180)); `TemporalInvariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/CheckpointCoordination/CheckpointCoordination.tla#L217)); `StartCheckpoint` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/CheckpointCoordination/CheckpointCoordination.tla#L420)); `FinishCheckpoint` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/CheckpointCoordination/CheckpointCoordination.tla#L430))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/CheckpointCoordination/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/CheckpointCoordination/CheckpointCoordination.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/CheckpointCoordination/MCCheckpointCoordination.tla", "specifies": "RingMaster checkpoint coordination", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "21 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/CheckpointCoordination/MCCheckpointCoordination.tla)", "safety": "`IncorrectlyOptimizedShouldReplaceLease` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/CheckpointCoordination/MCCheckpointCoordination.tla#L14))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/CheckpointCoordination/manifest.json)", "configured_checks": "`INVARIANTS: TypeInvariant`; `INVARIANTS: SafetyInvariant`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/CheckpointCoordination/MCCheckpointCoordination.cfg) | `INVARIANTS: TypeInvariant`; `INVARIANTS: SafetyInvariant`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/CheckpointCoordination/MCCheckpointCoordinationFailure.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/CheckpointCoordination/MCCheckpointCoordination.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/CigaretteSmokers/APCigaretteSmokers.tla", "specifies": "smoker/agent synchronization", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "26 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/CigaretteSmokers/APCigaretteSmokers.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking symbolic; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/CigaretteSmokers/manifest.json)", "configured_checks": "`INVARIANT: TypeOK`; `INVARIANT: AtMostOne`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/CigaretteSmokers/APCigaretteSmokers.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/CigaretteSmokers/APCigaretteSmokers.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/CigaretteSmokers/CigaretteSmokers.tla", "specifies": "smoker/agent synchronization", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "58 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/CigaretteSmokers/CigaretteSmokers.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/CigaretteSmokers/CigaretteSmokers.tla#L27))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/CigaretteSmokers/manifest.json)", "configured_checks": "`INVARIANTS: TypeOK AtMostOne`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/CigaretteSmokers/CigaretteSmokers.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/CigaretteSmokers/CigaretteSmokers.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/CigaretteSmokers/CigaretteSmokers_proof.tla", "specifies": "smoker/agent synchronization", "artifact_kind": "proof module", "tool": "TLA+; TLAPS", "size": "305 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/CigaretteSmokers/CigaretteSmokers_proof.tla)", "safety": "`TypeCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/CigaretteSmokers/CigaretteSmokers_proof.tla#L23)); `Inv` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/CigaretteSmokers/CigaretteSmokers_proof.tla#L222)); `AtMostOneCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/CigaretteSmokers/CigaretteSmokers_proof.tla#L224))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "TLAPS proof target listed; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/CigaretteSmokers/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/CigaretteSmokers/CigaretteSmokers_proof.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/DiningPhilosophers/APDiningPhilosophers.tla", "specifies": "dining-philosopher resource synchronization", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "22 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/DiningPhilosophers/APDiningPhilosophers.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking symbolic; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/DiningPhilosophers/manifest.json)", "configured_checks": "`INVARIANT: TypeOK`; `INVARIANT: ExclusiveAccess`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/DiningPhilosophers/APDiningPhilosophers.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/DiningPhilosophers/APDiningPhilosophers.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/DiningPhilosophers/DiningPhilosophers.tla", "specifies": "dining-philosopher resource synchronization", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+/PlusCal", "size": "232 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/DiningPhilosophers/DiningPhilosophers.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/DiningPhilosophers/DiningPhilosophers.tla#L213))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/DiningPhilosophers/manifest.json)", "configured_checks": "`INVARIANT: TypeOK`; `INVARIANT: ExclusiveAccess`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/DiningPhilosophers/DiningPhilosophers.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/DiningPhilosophers/DiningPhilosophers.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/Disruptor/APDisruptor_MPMC.tla", "specifies": "producer/consumer ring-buffer synchronization", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "50 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Disruptor/APDisruptor_MPMC.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking symbolic; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Disruptor/manifest.json)", "configured_checks": "`INVARIANT: NoDataRaces`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Disruptor/APDisruptor_MPMC.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Disruptor/APDisruptor_MPMC.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/Disruptor/APDisruptor_SPMC.tla", "specifies": "producer/consumer ring-buffer synchronization", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "46 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Disruptor/APDisruptor_SPMC.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking symbolic; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Disruptor/manifest.json)", "configured_checks": "`INVARIANT: NoDataRaces`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Disruptor/APDisruptor_SPMC.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Disruptor/APDisruptor_SPMC.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/Disruptor/APRingBuffer.tla", "specifies": "producer/consumer ring-buffer synchronization", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "34 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Disruptor/APRingBuffer.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Disruptor/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Disruptor/APRingBuffer.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/Disruptor/Disruptor_MPMC.tla", "specifies": "producer/consumer ring-buffer synchronization", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "208 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Disruptor/Disruptor_MPMC.tla)", "safety": "`TypeOk` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Disruptor/Disruptor_MPMC.tla#L199))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Disruptor/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Disruptor/Disruptor_MPMC.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/Disruptor/MCDisruptor_MPMC.tla", "specifies": "producer/consumer ring-buffer synchronization", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "41 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Disruptor/MCDisruptor_MPMC.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "`Liveliness` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Disruptor/MCDisruptor_MPMC.tla#L37))", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Disruptor/manifest.json)", "configured_checks": "`INVARIANTS: TypeOk`; `INVARIANTS: NoDataRaces`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Disruptor/MCDisruptor_MPMC.cfg) | `INVARIANTS: TypeOk`; `INVARIANTS: NoDataRaces`; `PROPERTIES: Liveliness`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Disruptor/MCDisruptor_MPMC_liveliness.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Disruptor/MCDisruptor_MPMC.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/Disruptor/Disruptor_SPMC.tla", "specifies": "producer/consumer ring-buffer synchronization", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "159 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Disruptor/Disruptor_SPMC.tla)", "safety": "`TypeOk` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Disruptor/Disruptor_SPMC.tla#L150))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Disruptor/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Disruptor/Disruptor_SPMC.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/Disruptor/MCDisruptor_SPMC.tla", "specifies": "producer/consumer ring-buffer synchronization", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "40 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Disruptor/MCDisruptor_SPMC.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "`Liveliness` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Disruptor/MCDisruptor_SPMC.tla#L36))", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Disruptor/manifest.json)", "configured_checks": "`INVARIANTS: TypeOk`; `INVARIANTS: NoDataRaces`; `PROPERTIES: Liveliness`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Disruptor/MCDisruptor_SPMC.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Disruptor/MCDisruptor_SPMC.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/Disruptor/RingBuffer.tla", "specifies": "producer/consumer ring-buffer synchronization", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "92 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Disruptor/RingBuffer.tla)", "safety": "`TypeOk` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Disruptor/RingBuffer.tla#L85))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Disruptor/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Disruptor/RingBuffer.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/FiniteMonotonic/APCRDT.tla", "specifies": "bounded abstractions of monotonic systems", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "20 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FiniteMonotonic/APCRDT.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking symbolic; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FiniteMonotonic/manifest.json)", "configured_checks": "`INVARIANT: TypeOK`; `INVARIANT: Safety`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FiniteMonotonic/APCRDT.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FiniteMonotonic/APCRDT.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/FiniteMonotonic/APDistributedReplicatedLog.tla", "specifies": "bounded abstractions of monotonic systems", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "29 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FiniteMonotonic/APDistributedReplicatedLog.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FiniteMonotonic/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FiniteMonotonic/APDistributedReplicatedLog.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/FiniteMonotonic/APReplicatedLog.tla", "specifies": "bounded abstractions of monotonic systems", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "25 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FiniteMonotonic/APReplicatedLog.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking symbolic; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FiniteMonotonic/manifest.json)", "configured_checks": "`INVARIANT: Safety`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FiniteMonotonic/APReplicatedLog.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FiniteMonotonic/APReplicatedLog.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/FiniteMonotonic/CRDT.tla", "specifies": "bounded abstractions of monotonic systems", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "62 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FiniteMonotonic/CRDT.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FiniteMonotonic/CRDT.tla#L11)); `Safety` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FiniteMonotonic/CRDT.tla#L13)); `Monotonic` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FiniteMonotonic/CRDT.tla#L15)); `Monotonicity` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FiniteMonotonic/CRDT.tla#L17))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FiniteMonotonic/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FiniteMonotonic/CRDT.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/FiniteMonotonic/CRDT_proof.tla", "specifies": "bounded abstractions of monotonic systems", "artifact_kind": "proof module", "tool": "TLA+; TLAPS", "size": "653 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FiniteMonotonic/CRDT_proof.tla)", "safety": "`TypeCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FiniteMonotonic/CRDT_proof.tla#L8)); `Safe` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FiniteMonotonic/CRDT_proof.tla#L16)); `SumWeaklyMonotonic` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FiniteMonotonic/CRDT_proof.tla#L64)); `SumStronglyMonotonic` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FiniteMonotonic/CRDT_proof.tla#L83)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FiniteMonotonic/CRDT_proof.tla#L23))", "liveness": "`OGLiveness` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FiniteMonotonic/CRDT_proof.tla#L245)); `OGLiveness` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FiniteMonotonic/CRDT_proof.tla#L517))", "evidence_status": "TLAPS proof target listed; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FiniteMonotonic/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FiniteMonotonic/CRDT_proof.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/FiniteMonotonic/DistributedReplicatedLog.tla", "specifies": "bounded abstractions of monotonic systems", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "74 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FiniteMonotonic/DistributedReplicatedLog.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FiniteMonotonic/DistributedReplicatedLog.tla#L18)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FiniteMonotonic/DistributedReplicatedLog.tla#L59))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FiniteMonotonic/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FiniteMonotonic/DistributedReplicatedLog.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/FiniteMonotonic/MCCRDT.tla", "specifies": "bounded abstractions of monotonic systems", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "32 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FiniteMonotonic/MCCRDT.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FiniteMonotonic/manifest.json)", "configured_checks": "`INVARIANTS: TypeOK`; `INVARIANTS: Safety`; `PROPERTIES: Convergence`; `PROPERTIES: (* Cannot check Monotonicity because the reset of the`; `PROPERTIES: counter values of our technique violates this property. *)`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FiniteMonotonic/MCCRDT.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FiniteMonotonic/MCCRDT.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/FiniteMonotonic/MCDistributedReplicatedLog.tla", "specifies": "bounded abstractions of monotonic systems", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "23 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FiniteMonotonic/MCDistributedReplicatedLog.tla)", "safety": "`DropCommonPrefix` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FiniteMonotonic/MCDistributedReplicatedLog.tla#L18))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FiniteMonotonic/manifest.json)", "configured_checks": "`INVARIANTS: TypeOK`; `INVARIANTS: BoundedLag`; `PROPERTIES: AllExtending`; `PROPERTIES: InSync`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FiniteMonotonic/MCDistributedReplicatedLog.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FiniteMonotonic/MCDistributedReplicatedLog.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/FiniteMonotonic/MCReplicatedLog.tla", "specifies": "bounded abstractions of monotonic systems", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "35 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FiniteMonotonic/MCReplicatedLog.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FiniteMonotonic/manifest.json)", "configured_checks": "`INVARIANTS: TypeOK`; `INVARIANTS: Safety`; `PROPERTIES: Convergence`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FiniteMonotonic/MCReplicatedLog.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FiniteMonotonic/MCReplicatedLog.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/FiniteMonotonic/ReplicatedLog.tla", "specifies": "bounded abstractions of monotonic systems", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "100 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FiniteMonotonic/ReplicatedLog.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FiniteMonotonic/ReplicatedLog.tla#L10)); `Safety` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FiniteMonotonic/ReplicatedLog.tla#L16)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FiniteMonotonic/ReplicatedLog.tla#L47)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FiniteMonotonic/ReplicatedLog.tla#L48))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FiniteMonotonic/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FiniteMonotonic/ReplicatedLog.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/FlashProtocol/FlashWithMutex.tla", "specifies": "Flash cache coherence", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "761 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/FlashWithMutex.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/FlashWithMutex.tla#L66)); `TypeCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/FlashWithMutex.tla#L588)); `ReqProgressCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/FlashWithMutex.tla#L633)); `DirProgressCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/FlashWithMutex.tla#L638)); `UniProgressCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/FlashWithMutex.tla#L643)); `InvProgressCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/FlashWithMutex.tla#L647)); `RpProgressCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/FlashWithMutex.tla#L651)); `WbProgressCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/FlashWithMutex.tla#L654)); `ShWbProgressCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/FlashWithMutex.tla#L657)); `NakcProgressCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/FlashWithMutex.tla#L660)); `CacheStateCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/FlashWithMutex.tla#L680)); `CacheDataCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/FlashWithMutex.tla#L688)); `MemDataCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/FlashWithMutex.tla#L692)); `Lemma_1_Correct` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/FlashWithMutex.tla#L720)); `Lemma_2_Correct` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/FlashWithMutex.tla#L731)); `Lemma_3_Correct` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/FlashWithMutex.tla#L740)); `Lemma_4_Correct` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/FlashWithMutex.tla#L753)); `Lemma_5_Correct` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/FlashWithMutex.tla#L760))", "liveness": "`ReqProgress` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/FlashWithMutex.tla#L631)); `DirProgress` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/FlashWithMutex.tla#L637)); `UniProgress` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/FlashWithMutex.tla#L641)); `InvProgress` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/FlashWithMutex.tla#L645)); `RpProgress` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/FlashWithMutex.tla#L649)); `WbProgress` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/FlashWithMutex.tla#L653)); `ShWbProgress` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/FlashWithMutex.tla#L656)); `NakcProgress` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/FlashWithMutex.tla#L659)); `ReqSuccess` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/FlashWithMutex.tla#L670))", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/FlashWithMutex.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/FlashProtocol/FlashWithMutexCMP.tla", "specifies": "Flash cache coherence", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "410 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/FlashWithMutexCMP.tla)", "safety": "`ABS_TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/FlashWithMutexCMP.tla#L44)); `ABS_TypeCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/FlashWithMutexCMP.tla#L342)); `CMPFairness` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/FlashWithMutexCMP.tla#L373)); `ABS_ReqProgressCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/FlashWithMutexCMP.tla#L391)); `ABS_DirProgressCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/FlashWithMutexCMP.tla#L392)); `ABS_UniProgressCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/FlashWithMutexCMP.tla#L393)); `ABS_InvProgressCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/FlashWithMutexCMP.tla#L394)); `ABS_RpProgressCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/FlashWithMutexCMP.tla#L395)); `ABS_WbProgressCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/FlashWithMutexCMP.tla#L396)); `ABS_ShWbProgressCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/FlashWithMutexCMP.tla#L397)); `ABS_NakcProgressCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/FlashWithMutexCMP.tla#L398)); `ABS_CacheStateCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/FlashWithMutexCMP.tla#L400)); `ABS_CacheDataCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/FlashWithMutexCMP.tla#L401)); `ABS_MemDataCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/FlashWithMutexCMP.tla#L402)); `ABS_Lemma_1_Correct` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/FlashWithMutexCMP.tla#L404)); `ABS_Lemma_2_Correct` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/FlashWithMutexCMP.tla#L405)); `ABS_Lemma_3_Correct` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/FlashWithMutexCMP.tla#L406)); `ABS_Lemma_4_Correct` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/FlashWithMutexCMP.tla#L407)); `ABS_Lemma_5_Correct` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/FlashWithMutexCMP.tla#L408))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/FlashWithMutexCMP.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/FlashProtocol/APFlashWithMutex.tla", "specifies": "Flash cache coherence", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "78 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/APFlashWithMutex.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking symbolic; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/manifest.json)", "configured_checks": "`INVARIANT: TypeOK`; `INVARIANT: CacheStateProp`; `INVARIANT: CacheDataProp`; `INVARIANT: MemDataProp`; `INVARIANT: Lemma_1`; `INVARIANT: Lemma_2`; `INVARIANT: Lemma_3`; `INVARIANT: Lemma_4`; `INVARIANT: Lemma_5`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/APFlashWithMutex.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/APFlashWithMutex.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/FlashProtocol/MCFlashWithMutex.tla", "specifies": "Flash cache coherence", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "8 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/MCFlashWithMutex.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/manifest.json)", "configured_checks": "`INVARIANT: TypeOK`; `INVARIANT: CacheStateProp`; `INVARIANT: CacheDataProp`; `INVARIANT: MemDataProp`; `INVARIANT: Lemma_1`; `INVARIANT: Lemma_2`; `INVARIANT: Lemma_3`; `INVARIANT: Lemma_4`; `INVARIANT: Lemma_5`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/MCFlashWithMutex.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/MCFlashWithMutex.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/FlashProtocol/MCFlashWithMutexLive.tla", "specifies": "Flash cache coherence", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "9 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/MCFlashWithMutexLive.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/manifest.json)", "configured_checks": "`PROPERTIES: ReqProgress`; `PROPERTIES: DirProgress`; `PROPERTIES: UniProgress`; `PROPERTIES: InvProgress`; `PROPERTIES: RpProgress`; `PROPERTIES: WbProgress`; `PROPERTIES: ShWbProgress`; `PROPERTIES: NakcProgress`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/MCFlashWithMutexLive.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/FlashProtocol/MCFlashWithMutexLive.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/GermanProtocol/APGermanCMPWithMutex.tla", "specifies": "German cache-coherence protocol; repository labels these as agentic translations", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "49 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/GermanProtocol/APGermanCMPWithMutex.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking symbolic; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/GermanProtocol/manifest.json)", "configured_checks": "`INVARIANT: TypeOK`; `INVARIANT: Coherence`; `INVARIANT: Lemma_1`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/GermanProtocol/APGermanCMPWithMutex.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/GermanProtocol/APGermanCMPWithMutex.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/GermanProtocol/APGermanControl.tla", "specifies": "German cache-coherence protocol; repository labels these as agentic translations", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "46 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/GermanProtocol/APGermanControl.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking symbolic; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/GermanProtocol/manifest.json)", "configured_checks": "`INVARIANT: TypeOK`; `INVARIANT: Coherence`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/GermanProtocol/APGermanControl.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/GermanProtocol/APGermanControl.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/GermanProtocol/APGermanData.tla", "specifies": "German cache-coherence protocol; repository labels these as agentic translations", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "58 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/GermanProtocol/APGermanData.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking symbolic; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/GermanProtocol/manifest.json)", "configured_checks": "`INVARIANT: TypeOK`; `INVARIANT: Coherence`; `INVARIANT: DataProp`; `INVARIANT: TransactionConsistency`; `INVARIANT: DirectoryAccurate`; `INVARIANT: ExclusiveIsolation`; `INVARIANT: WritebackCarriesLatest`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/GermanProtocol/APGermanData.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/GermanProtocol/APGermanData.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/GermanProtocol/GermanCMPWithMutex.tla", "specifies": "German cache-coherence protocol; repository labels these as agentic translations", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "175 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/GermanProtocol/GermanCMPWithMutex.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/GermanProtocol/GermanCMPWithMutex.tla#L19))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/GermanProtocol/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/GermanProtocol/GermanCMPWithMutex.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/GermanProtocol/GermanControl.tla", "specifies": "German cache-coherence protocol; repository labels these as agentic translations", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "128 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/GermanProtocol/GermanControl.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/GermanProtocol/GermanControl.tla#L25))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/GermanProtocol/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/GermanProtocol/GermanControl.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/GermanProtocol/GermanData.tla", "specifies": "German cache-coherence protocol; repository labels these as agentic translations", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "230 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/GermanProtocol/GermanData.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/GermanProtocol/GermanData.tla#L35)); `TransactionConsistency` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/GermanProtocol/GermanData.tla#L181))", "liveness": "`RequestEventuallyServed` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/GermanProtocol/GermanData.tla#L218)); `SharedRequestEventuallyGranted` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/GermanProtocol/GermanData.tla#L222)); `ExclusiveRequestEventuallyGranted` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/GermanProtocol/GermanData.tla#L226))", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/GermanProtocol/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/GermanProtocol/GermanData.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/GermanProtocol/MCGermanCMPWithMutex.tla", "specifies": "German cache-coherence protocol; repository labels these as agentic translations", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "8 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/GermanProtocol/MCGermanCMPWithMutex.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/GermanProtocol/manifest.json)", "configured_checks": "`INVARIANT: TypeOK`; `INVARIANT: Coherence`; `INVARIANT: Lemma_1`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/GermanProtocol/MCGermanCMPWithMutex.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/GermanProtocol/MCGermanCMPWithMutex.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/GermanProtocol/MCGermanControl.tla", "specifies": "German cache-coherence protocol; repository labels these as agentic translations", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "16 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/GermanProtocol/MCGermanControl.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/GermanProtocol/manifest.json)", "configured_checks": "`INVARIANT: TypeOK`; `INVARIANT: Coherence`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/GermanProtocol/MCGermanControl.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/GermanProtocol/MCGermanControl.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/GermanProtocol/MCGermanData.tla", "specifies": "German cache-coherence protocol; repository labels these as agentic translations", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "8 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/GermanProtocol/MCGermanData.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/GermanProtocol/manifest.json)", "configured_checks": "`INVARIANT: TypeOK`; `INVARIANT: Coherence`; `INVARIANT: DataProp`; `INVARIANT: TransactionConsistency`; `INVARIANT: DirectoryAccurate`; `INVARIANT: ExclusiveIsolation`; `INVARIANT: WritebackCarriesLatest`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/GermanProtocol/MCGermanData.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/GermanProtocol/MCGermanData.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/Huang/Huang.tla", "specifies": "Huang distributed termination detection", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "132 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Huang/Huang.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Huang/Huang.tla#L24)); `TerminationDetected` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Huang/Huang.tla#L94)); `Safe` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Huang/Huang.tla#L103)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Huang/Huang.tla#L106)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Huang/Huang.tla#L111))", "liveness": "`Live` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Huang/Huang.tla#L108))", "interpretation": "termination/detection identifiers in the safety field are state predicates; the separately stated leads-to formula supplies eventual detection", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Huang/manifest.json)", "configured_checks": "`INVARIANTS: TypeOK`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Huang/Huang.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Huang/Huang.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/KeyValueStore/APKeyValueStore.tla", "specifies": "key-value-store snapshot isolation", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "32 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/KeyValueStore/APKeyValueStore.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/KeyValueStore/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/KeyValueStore/APKeyValueStore.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/KeyValueStore/ClientCentric.tla", "specifies": "key-value-store snapshot isolation", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "185 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/KeyValueStore/ClientCentric.tla)", "safety": "`TypeOKT` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/KeyValueStore/ClientCentric.tla#L176)); `TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/KeyValueStore/ClientCentric.tla#L180))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/KeyValueStore/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/KeyValueStore/ClientCentric.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/KeyValueStore/KVsnap.tla", "specifies": "key-value-store snapshot isolation", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+/PlusCal", "size": "168 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/KeyValueStore/KVsnap.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/KeyValueStore/KVsnap.tla#L154))", "liveness": "`Termination` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/KeyValueStore/KVsnap.tla#L145))", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/KeyValueStore/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/KeyValueStore/KVsnap.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/KeyValueStore/KeyValueStore.tla", "specifies": "key-value-store snapshot isolation", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "107 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/KeyValueStore/KeyValueStore.tla)", "safety": "`TypeInvariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/KeyValueStore/KeyValueStore.tla#L33)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/KeyValueStore/KeyValueStore.tla#L105))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/KeyValueStore/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/KeyValueStore/KeyValueStore.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/KeyValueStore/KeyValueStore_proof.tla", "specifies": "key-value-store snapshot isolation", "artifact_kind": "proof module", "tool": "TLA+; TLAPS", "size": "43 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/KeyValueStore/KeyValueStore_proof.tla)", "safety": "`Inv` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/KeyValueStore/KeyValueStore_proof.tla#L9)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/KeyValueStore/KeyValueStore_proof.tla#L11))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "TLAPS proof target listed; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/KeyValueStore/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/KeyValueStore/KeyValueStore_proof.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/KeyValueStore/MCKVS.tla", "specifies": "key-value-store snapshot isolation", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "5 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/KeyValueStore/MCKVS.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/KeyValueStore/manifest.json)", "configured_checks": "`INVARIANTS: TypeInvariant`; `INVARIANTS: TxLifecycle`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/KeyValueStore/MCKVSSafetyLarge.cfg) | `INVARIANTS: TypeInvariant`; `INVARIANTS: TxLifecycle`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/KeyValueStore/MCKVSSafetyMedium.cfg) | `INVARIANTS: TypeInvariant`; `INVARIANTS: TxLifecycle`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/KeyValueStore/MCKVSSafetySmall.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/KeyValueStore/MCKVS.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/KeyValueStore/MCKVsnap.tla", "specifies": "key-value-store snapshot isolation", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "9 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/KeyValueStore/MCKVsnap.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/KeyValueStore/manifest.json)", "configured_checks": "`INVARIANTS: TypeOK`; `INVARIANTS: SnapshotIsolation`; `PROPERTIES: Termination`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/KeyValueStore/MCKVsnap.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/KeyValueStore/MCKVsnap.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/KeyValueStore/Util.tla", "specifies": "key-value-store snapshot isolation", "artifact_kind": "support definitions or abstract interface", "tool": "TLA+", "size": "45 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/KeyValueStore/Util.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/KeyValueStore/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/KeyValueStore/Util.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/MisraReachability/APParReach.tla", "specifies": "sequential and multiprocess graph reachability variants", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "39 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MisraReachability/APParReach.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking symbolic; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MisraReachability/manifest.json)", "configured_checks": "`INVARIANT: Inv`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MisraReachability/APParReach.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MisraReachability/APParReach.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/MisraReachability/APReachable.tla", "specifies": "sequential and multiprocess graph reachability variants", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "31 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MisraReachability/APReachable.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MisraReachability/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MisraReachability/APReachable.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/MisraReachability/MCParReach.tla", "specifies": "sequential and multiprocess graph reachability variants", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "14 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MisraReachability/MCParReach.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MisraReachability/manifest.json)", "configured_checks": "`INVARIANT: Inv`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MisraReachability/MCParReach.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MisraReachability/MCParReach.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/MisraReachability/MCReachabilityTest.tla", "specifies": "sequential and multiprocess graph reachability variants", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "15 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MisraReachability/MCReachabilityTest.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MisraReachability/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MisraReachability/MCReachabilityTest.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/MisraReachability/MCReachable.tla", "specifies": "sequential and multiprocess graph reachability variants", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "14 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MisraReachability/MCReachable.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MisraReachability/manifest.json)", "configured_checks": "`INVARIANTS: TypeOK Inv1 Inv2 Inv3 PartialCorrectness`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MisraReachability/MCReachable.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MisraReachability/MCReachable.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/MisraReachability/ParReach.tla", "specifies": "sequential and multiprocess graph reachability variants", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+/PlusCal", "size": "241 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MisraReachability/ParReach.tla)", "safety": "`Inv` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MisraReachability/ParReach.tla#L173))", "liveness": "`Termination` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MisraReachability/ParReach.tla#L150))", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MisraReachability/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MisraReachability/ParReach.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/MisraReachability/ParReachProofs.tla", "specifies": "sequential and multiprocess graph reachability variants", "artifact_kind": "proof module", "tool": "TLA+; TLAPS", "size": "70 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MisraReachability/ParReachProofs.tla)", "safety": "`TypeInvariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MisraReachability/ParReachProofs.tla#L10))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "TLAPS proof target listed; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MisraReachability/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MisraReachability/ParReachProofs.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/MisraReachability/Reachability.tla", "specifies": "sequential and multiprocess graph reachability variants", "artifact_kind": "support definitions or abstract interface", "tool": "TLA+", "size": "67 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MisraReachability/Reachability.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MisraReachability/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MisraReachability/Reachability.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/MisraReachability/ReachabilityProofs.tla", "specifies": "sequential and multiprocess graph reachability variants", "artifact_kind": "proof module", "tool": "TLA+; TLAPS", "size": "315 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MisraReachability/ReachabilityProofs.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "TLAPS proof target listed; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MisraReachability/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MisraReachability/ReachabilityProofs.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/MisraReachability/ReachabilityTest.tla", "specifies": "sequential and multiprocess graph reachability variants", "artifact_kind": "support definitions or abstract interface", "tool": "TLA+", "size": "123 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MisraReachability/ReachabilityTest.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MisraReachability/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MisraReachability/ReachabilityTest.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/MisraReachability/Reachable.tla", "specifies": "sequential and multiprocess graph reachability variants", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+/PlusCal", "size": "243 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MisraReachability/Reachable.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MisraReachability/Reachable.tla#L125)); `Inv1` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MisraReachability/Reachable.tla#L135)); `Inv2` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MisraReachability/Reachable.tla#L145)); `Inv3` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MisraReachability/Reachable.tla#L166)); `PartialCorrectness` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MisraReachability/Reachable.tla#L194)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MisraReachability/Reachable.tla#L195))", "liveness": "`Termination` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MisraReachability/Reachable.tla#L112))", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MisraReachability/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MisraReachability/Reachable.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/MisraReachability/ReachableProofs.tla", "specifies": "sequential and multiprocess graph reachability variants", "artifact_kind": "proof module", "tool": "TLA+; TLAPS", "size": "215 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MisraReachability/ReachableProofs.tla)", "safety": "`theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MisraReachability/ReachableProofs.tla#L52)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MisraReachability/ReachableProofs.tla#L82)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MisraReachability/ReachableProofs.tla#L101)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MisraReachability/ReachableProofs.tla#L197))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "TLAPS proof target listed; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MisraReachability/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MisraReachability/ReachableProofs.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/MultiCarElevator/Elevator.tla", "specifies": "concurrent elevator control", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "238 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MultiCarElevator/Elevator.tla)", "safety": "`TypeInvariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MultiCarElevator/Elevator.tla#L55)); `SafetyInvariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MultiCarElevator/Elevator.tla#L60)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MultiCarElevator/Elevator.tla#L235))", "liveness": "`TemporalInvariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MultiCarElevator/Elevator.tla#L72))", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MultiCarElevator/manifest.json)", "configured_checks": "`INVARIANTS: TypeInvariant`; `INVARIANTS: SafetyInvariant`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MultiCarElevator/ElevatorLivenessLarge.cfg) | `INVARIANTS: TypeInvariant`; `INVARIANTS: SafetyInvariant`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MultiCarElevator/ElevatorLivenessMedium.cfg) | `INVARIANTS: TypeInvariant`; `INVARIANTS: SafetyInvariant`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MultiCarElevator/ElevatorSafetyLarge.cfg) | `INVARIANTS: TypeInvariant`; `INVARIANTS: SafetyInvariant`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MultiCarElevator/ElevatorSafetyMedium.cfg) | `INVARIANTS: TypeInvariant`; `INVARIANTS: SafetyInvariant`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MultiCarElevator/ElevatorSafetySmall.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MultiCarElevator/Elevator.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/MultiCarElevator/Elevator_proof.tla", "specifies": "concurrent elevator control", "artifact_kind": "proof module", "tool": "TLA+; TLAPS", "size": "484 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MultiCarElevator/Elevator_proof.tla)", "safety": "`Inv1` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MultiCarElevator/Elevator_proof.tla#L100)); `TypeCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MultiCarElevator/Elevator_proof.tla#L330)); `Inv2` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MultiCarElevator/Elevator_proof.tla#L390)); `SafetyCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MultiCarElevator/Elevator_proof.tla#L479))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "TLAPS proof target listed; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MultiCarElevator/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MultiCarElevator/Elevator_proof.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/MultiPaxos-SMR/MultiPaxos.tla", "specifies": "MultiPaxos replicated state machine", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+/PlusCal", "size": "585 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MultiPaxos-SMR/MultiPaxos.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "`Termination` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MultiPaxos-SMR/MultiPaxos.tla#L581))", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MultiPaxos-SMR/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MultiPaxos-SMR/MultiPaxos.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/MultiPaxos-SMR/MultiPaxos_MC.tla", "specifies": "MultiPaxos replicated state machine", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "75 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MultiPaxos-SMR/MultiPaxos_MC.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MultiPaxos-SMR/MultiPaxos_MC.tla#L22)); `Linearizability` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MultiPaxos-SMR/MultiPaxos_MC.tla#L67)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MultiPaxos-SMR/MultiPaxos_MC.tla#L32)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MultiPaxos-SMR/MultiPaxos_MC.tla#L73))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MultiPaxos-SMR/manifest.json)", "configured_checks": "`INVARIANTS: TypeOK`; `INVARIANTS: Linearizability`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MultiPaxos-SMR/MultiPaxos_MC.cfg) | `INVARIANTS: TypeOK`; `INVARIANTS: Linearizability`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MultiPaxos-SMR/MultiPaxos_MC_small.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/MultiPaxos-SMR/MultiPaxos_MC.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/NanoBlockchain/MCNano.tla", "specifies": "Nano blockchain consensus", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "122 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/NanoBlockchain/MCNano.tla)", "safety": "`TypeInvariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/NanoBlockchain/MCNano.tla#L93)); `SafetyInvariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/NanoBlockchain/MCNano.tla#L97)); `Safety` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/NanoBlockchain/MCNano.tla#L119))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/NanoBlockchain/manifest.json)", "configured_checks": "`INVARIANTS: TypeInvariant`; `INVARIANTS: SafetyInvariant`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/NanoBlockchain/MCNanoLarge.cfg) | `INVARIANTS: TypeInvariant`; `INVARIANTS: SafetyInvariant`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/NanoBlockchain/MCNanoMedium.cfg) | `INVARIANTS: TypeInvariant`; `INVARIANTS: SafetyInvariant`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/NanoBlockchain/MCNanoSmall.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/NanoBlockchain/MCNano.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/NanoBlockchain/Nano.tla", "specifies": "Nano blockchain consensus", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "491 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/NanoBlockchain/Nano.tla)", "safety": "`TypeInvariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/NanoBlockchain/Nano.tla#L175)); `CryptographicInvariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/NanoBlockchain/Nano.tla#L180)); `BalanceInvariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/NanoBlockchain/Nano.tla#L201)); `SafetyInvariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/NanoBlockchain/Nano.tla#L214)); `Safety` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/NanoBlockchain/Nano.tla#L488))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/NanoBlockchain/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/NanoBlockchain/Nano.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/Paxos/Consensus.tla", "specifies": "consensus, voting and Paxos refinements", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+; TLAPS", "size": "69 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Paxos/Consensus.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Paxos/Consensus.tla#L17)); `Inv` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Paxos/Consensus.tla#L36)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Paxos/Consensus.tla#L39))", "liveness": "`Success` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Paxos/Consensus.tla#L54))", "evidence_status": "TLAPS proof target listed; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Paxos/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Paxos/Consensus.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/Paxos/MCConsensus.tla", "specifies": "consensus, voting and Paxos refinements", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "23 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Paxos/MCConsensus.tla)", "safety": "`ITypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Paxos/MCConsensus.tla#L17))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Paxos/manifest.json)", "configured_checks": "`INVARIANT: Inv`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Paxos/MCConsensus.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Paxos/MCConsensus.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/Paxos/MCPaxos.tla", "specifies": "consensus, voting and Paxos refinements", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "74 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Paxos/MCPaxos.tla)", "safety": "`ITypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Paxos/MCPaxos.tla#L36)); `Inv1` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Paxos/MCPaxos.tla#L58)); `Inv2` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Paxos/MCPaxos.tla#L59)); `Inv3` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Paxos/MCPaxos.tla#L60)); `Inv4` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Paxos/MCPaxos.tla#L61))", "liveness": "`MCLiveness` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Paxos/MCPaxos.tla#L23))", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Paxos/manifest.json)", "configured_checks": "`INVARIANT: Inv1 Inv2 Inv3 Inv4`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Paxos/MCPaxos.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Paxos/MCPaxos.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/Paxos/MCVoting.tla", "specifies": "consensus, voting and Paxos refinements", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "55 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Paxos/MCVoting.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Paxos/manifest.json)", "configured_checks": "`INVARIANT: Inv`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Paxos/MCVoting.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Paxos/MCVoting.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/Paxos/Paxos.tla", "specifies": "consensus, voting and Paxos refinements", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "217 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Paxos/Paxos.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Paxos/Paxos.tla#L67)); `Inv` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Paxos/Paxos.tla#L203))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Paxos/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Paxos/Paxos.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/Paxos/Voting.tla", "specifies": "consensus, voting and Paxos refinements", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+; TLAPS", "size": "197 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Paxos/Voting.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Paxos/Voting.tla#L47)); `SafeAt` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Paxos/Voting.tla#L88)); `AllSafeAtZero` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Paxos/Voting.tla#L94)); `VotesSafe` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Paxos/Voting.tla#L100)); `VotesSafeImpliesConsistency` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Paxos/Voting.tla#L111)); `ShowsSafeAt` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Paxos/Voting.tla#L118)); `ShowsSafety` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Paxos/Voting.tla#L124)); `Inv` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Paxos/Voting.tla#L176)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Paxos/Voting.tla#L178))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "TLAPS proof target listed; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Paxos/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Paxos/Voting.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/PaxosHowToWinATuringAward/Consensus.tla", "specifies": "consensus/voting/Paxos tutorial variants", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+; TLAPS", "size": "117 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/PaxosHowToWinATuringAward/Consensus.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/PaxosHowToWinATuringAward/Consensus.tla#L40)); `Inv` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/PaxosHowToWinATuringAward/Consensus.tla#L68)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/PaxosHowToWinATuringAward/Consensus.tla#L76))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "TLAPS proof target listed; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/PaxosHowToWinATuringAward/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/PaxosHowToWinATuringAward/Consensus.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/PaxosHowToWinATuringAward/MCConsensus.tla", "specifies": "consensus/voting/Paxos tutorial variants", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "16 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/PaxosHowToWinATuringAward/MCConsensus.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/PaxosHowToWinATuringAward/manifest.json)", "configured_checks": "`INVARIANT: Inv`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/PaxosHowToWinATuringAward/MCConsensus.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/PaxosHowToWinATuringAward/MCConsensus.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/PaxosHowToWinATuringAward/MCPaxos.tla", "specifies": "consensus/voting/Paxos tutorial variants", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "45 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/PaxosHowToWinATuringAward/MCPaxos.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/PaxosHowToWinATuringAward/manifest.json)", "configured_checks": "`INVARIANT: Inv`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/PaxosHowToWinATuringAward/MCPaxosSmall.cfg) | `INVARIANT: Inv`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/PaxosHowToWinATuringAward/MCPaxosTiny.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/PaxosHowToWinATuringAward/MCPaxos.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/PaxosHowToWinATuringAward/MCVoting.tla", "specifies": "consensus/voting/Paxos tutorial variants", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "39 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/PaxosHowToWinATuringAward/MCVoting.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/PaxosHowToWinATuringAward/manifest.json)", "configured_checks": "`INVARIANT: Inv`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/PaxosHowToWinATuringAward/MCVoting.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/PaxosHowToWinATuringAward/MCVoting.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/PaxosHowToWinATuringAward/Paxos.tla", "specifies": "consensus/voting/Paxos tutorial variants", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "395 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/PaxosHowToWinATuringAward/Paxos.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/PaxosHowToWinATuringAward/Paxos.tla#L114)); `Inv` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/PaxosHowToWinATuringAward/Paxos.tla#L292)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/PaxosHowToWinATuringAward/Paxos.tla#L319))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/PaxosHowToWinATuringAward/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/PaxosHowToWinATuringAward/Paxos.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/PaxosHowToWinATuringAward/Voting.tla", "specifies": "consensus/voting/Paxos tutorial variants", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+; TLAPS", "size": "316 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/PaxosHowToWinATuringAward/Voting.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/PaxosHowToWinATuringAward/Voting.tla#L59)); `SafeAt` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/PaxosHowToWinATuringAward/Voting.tla#L115)); `AllSafeAtZero` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/PaxosHowToWinATuringAward/Voting.tla#L125)); `VotesSafe` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/PaxosHowToWinATuringAward/Voting.tla#L150)); `Inv` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/PaxosHowToWinATuringAward/Voting.tla#L161)); `ShowsSafeAt` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/PaxosHowToWinATuringAward/Voting.tla#L167)); `ShowsSafety` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/PaxosHowToWinATuringAward/Voting.tla#L180)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/PaxosHowToWinATuringAward/Voting.tla#L240))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "TLAPS proof target listed; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/PaxosHowToWinATuringAward/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/PaxosHowToWinATuringAward/Voting.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/PaxosHowToWinATuringAward/Voting_proof.tla", "specifies": "consensus/voting/Paxos tutorial variants", "artifact_kind": "proof module", "tool": "TLA+; TLAPS", "size": "142 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/PaxosHowToWinATuringAward/Voting_proof.tla)", "safety": "`AllSafeAtZero_T` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/PaxosHowToWinATuringAward/Voting_proof.tla#L22)); `ShowsSafety_T` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/PaxosHowToWinATuringAward/Voting_proof.tla#L63))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "TLAPS proof target listed; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/PaxosHowToWinATuringAward/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/PaxosHowToWinATuringAward/Voting_proof.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/Prisoners/APPrisoners.tla", "specifies": "prisoner coordination puzzle", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "29 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Prisoners/APPrisoners.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Prisoners/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Prisoners/APPrisoners.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/Prisoners/MCPrisoners.tla", "specifies": "prisoner coordination puzzle", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "27 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Prisoners/MCPrisoners.tla)", "safety": "`InductiveInvariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Prisoners/MCPrisoners.tla#L15))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Prisoners/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Prisoners/MCPrisoners.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/Prisoners/Prisoners.tla", "specifies": "prisoner coordination puzzle", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "206 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Prisoners/Prisoners.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Prisoners/Prisoners.tla#L83)); `Safety` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Prisoners/Prisoners.tla#L162)); `CountInvariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Prisoners/Prisoners.tla#L186)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Prisoners/Prisoners.tla#L178))", "liveness": "`Liveness` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Prisoners/Prisoners.tla#L172))", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Prisoners/manifest.json)", "configured_checks": "`INVARIANT: TypeOK CountInvariant`; `PROPERTIES: Safety Liveness`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Prisoners/Prisoners.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Prisoners/Prisoners.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/Prisoners_Single_Switch/APPrisoner.tla", "specifies": "prisoner coordination through one shared switch", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "30 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Prisoners_Single_Switch/APPrisoner.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Prisoners_Single_Switch/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Prisoners_Single_Switch/APPrisoner.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/Prisoners_Single_Switch/Prisoner.tla", "specifies": "prisoner coordination through one shared switch", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "184 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Prisoners_Single_Switch/Prisoner.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Prisoners_Single_Switch/Prisoner.tla#L174))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Prisoners_Single_Switch/manifest.json)", "configured_checks": "`INVARIANT: TypeOK`; `INVARIANT: VictoryOK`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Prisoners_Single_Switch/Prisoner.cfg) | `INVARIANT: TypeOK`; `INVARIANT: VictoryOK`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Prisoners_Single_Switch/PrisonerLightUnknown.cfg) | `INVARIANT: TypeOK`; `INVARIANT: VictoryOK`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Prisoners_Single_Switch/PrisonerSolo.cfg) | `INVARIANT: TypeOK`; `INVARIANT: VictoryOK`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Prisoners_Single_Switch/PrisonerSoloLightUnknown.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/Prisoners_Single_Switch/Prisoner.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/ReadersWriters/APReadersWriters.tla", "specifies": "reader/writer synchronization", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "39 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ReadersWriters/APReadersWriters.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking symbolic; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ReadersWriters/manifest.json)", "configured_checks": "`INVARIANT: Safety`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ReadersWriters/APReadersWriters.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ReadersWriters/APReadersWriters.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/ReadersWriters/MC.tla", "specifies": "reader/writer synchronization", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "13 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ReadersWriters/MC.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ReadersWriters/manifest.json)", "configured_checks": "`INVARIANT: TypeOK`; `INVARIANT: Safety`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ReadersWriters/MC.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ReadersWriters/MC.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/ReadersWriters/ReadersWriters.tla", "specifies": "reader/writer synchronization", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "123 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ReadersWriters/ReadersWriters.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ReadersWriters/ReadersWriters.tla#L104)); `Safety` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ReadersWriters/ReadersWriters.tla#L109))", "liveness": "`Liveness` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ReadersWriters/ReadersWriters.tla#L117))", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ReadersWriters/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ReadersWriters/ReadersWriters.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/ReadersWriters/ReadersWriters_proof.tla", "specifies": "reader/writer synchronization", "artifact_kind": "proof module", "tool": "TLA+; TLAPS", "size": "219 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ReadersWriters/ReadersWriters_proof.tla)", "safety": "`TypeOKStep` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ReadersWriters/ReadersWriters_proof.tla#L45)); `TypeCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ReadersWriters/ReadersWriters_proof.tla#L98)); `SafetyStep` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ReadersWriters/ReadersWriters_proof.tla#L110)); `SafetyCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ReadersWriters/ReadersWriters_proof.tla#L211))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "TLAPS proof target listed; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ReadersWriters/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ReadersWriters/ReadersWriters_proof.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SDP_Verification/SDP_Attack_New_Solution_Spec/MC.tla", "specifies": "software-defined perimeter authentication/attack models", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "51 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SDP_Verification/SDP_Attack_New_Solution_Spec/MC.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SDP_Verification/manifest.json)", "configured_checks": "`INVARIANT: SPASafeLaw`; `INVARIANT: DataAccessSafeLaw`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SDP_Verification/SDP_Attack_New_Solution_Spec/MC.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SDP_Verification/SDP_Attack_New_Solution_Spec/MC.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SDP_Verification/SDP_Attack_New_Solution_Spec/SPA_Attack_New.tla", "specifies": "software-defined perimeter authentication/attack models", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "1,318 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SDP_Verification/SDP_Attack_New_Solution_Spec/SPA_Attack_New.tla)", "safety": "`DataAccessSafeLaw` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SDP_Verification/SDP_Attack_New_Solution_Spec/SPA_Attack_New.tla#L1166)); `SPASafeLaw` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SDP_Verification/SDP_Attack_New_Solution_Spec/SPA_Attack_New.tla#L1169)); `FwCorrectProperty` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SDP_Verification/SDP_Attack_New_Solution_Spec/SPA_Attack_New.tla#L1299))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SDP_Verification/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SDP_Verification/SDP_Attack_New_Solution_Spec/SPA_Attack_New.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SDP_Verification/SDP_Attack_Spec/MC.tla", "specifies": "software-defined perimeter authentication/attack models", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "51 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SDP_Verification/SDP_Attack_Spec/MC.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SDP_Verification/manifest.json)", "configured_checks": "`INVARIANT: SPASafeLaw`; `INVARIANT: DataAccessSafeLaw`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SDP_Verification/SDP_Attack_Spec/MC.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SDP_Verification/SDP_Attack_Spec/MC.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SDP_Verification/SDP_Attack_Spec/SPA_Attack.tla", "specifies": "software-defined perimeter authentication/attack models", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "1,320 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SDP_Verification/SDP_Attack_Spec/SPA_Attack.tla)", "safety": "`DataAccessSafeLaw` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SDP_Verification/SDP_Attack_Spec/SPA_Attack.tla#L1157)); `SPASafeLaw` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SDP_Verification/SDP_Attack_Spec/SPA_Attack.tla#L1160))", "liveness": "`FwCorrectProperty` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SDP_Verification/SDP_Attack_Spec/SPA_Attack.tla#L1304))", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SDP_Verification/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SDP_Verification/SDP_Attack_Spec/SPA_Attack.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SimplifiedFastPaxos/FastPaxos.tla", "specifies": "simplified Fast Paxos consensus", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "158 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SimplifiedFastPaxos/FastPaxos.tla)", "safety": "`FastTypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SimplifiedFastPaxos/FastPaxos.tla#L136))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SimplifiedFastPaxos/manifest.json)", "configured_checks": "`INVARIANTS: FastTypeOK FastNontriviality`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SimplifiedFastPaxos/FastPaxos.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SimplifiedFastPaxos/FastPaxos.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SimplifiedFastPaxos/Paxos.tla", "specifies": "simplified Fast Paxos consensus", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "219 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SimplifiedFastPaxos/Paxos.tla)", "safety": "`PaxosTypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SimplifiedFastPaxos/Paxos.tla#L171)); `PaxosConsistency` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SimplifiedFastPaxos/Paxos.tla#L201))", "liveness": "`PaxosLiveness` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SimplifiedFastPaxos/Paxos.tla#L214))", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SimplifiedFastPaxos/manifest.json)", "configured_checks": "`INVARIANTS: PaxosTypeOK PaxosNontriviality`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SimplifiedFastPaxos/Paxos.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SimplifiedFastPaxos/Paxos.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SingleLaneBridge/APSingleLaneBridge.tla", "specifies": "single-lane bridge synchronization", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "32 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SingleLaneBridge/APSingleLaneBridge.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SingleLaneBridge/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SingleLaneBridge/APSingleLaneBridge.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SingleLaneBridge/MC.tla", "specifies": "single-lane bridge synchronization", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "26 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SingleLaneBridge/MC.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SingleLaneBridge/manifest.json)", "configured_checks": "`INVARIANT: Invariants`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SingleLaneBridge/MC.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SingleLaneBridge/MC.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SingleLaneBridge/SingleLaneBridge.tla", "specifies": "single-lane bridge synchronization", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "122 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SingleLaneBridge/SingleLaneBridge.tla)", "safety": "`Invariants` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SingleLaneBridge/SingleLaneBridge.tla#L88)); `TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SingleLaneBridge/SingleLaneBridge.tla#L100)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SingleLaneBridge/SingleLaneBridge.tla#L112)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SingleLaneBridge/SingleLaneBridge.tla#L114))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SingleLaneBridge/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SingleLaneBridge/SingleLaneBridge.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SlushProtocol/Slush.tla", "specifies": "Slush probabilistic blockchain consensus", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+/PlusCal", "size": "433 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SlushProtocol/Slush.tla)", "safety": "`TerminationMessageType` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SlushProtocol/Slush.tla#L70)); `TerminationMessage` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SlushProtocol/Slush.tla#L86)); `TypeInvariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SlushProtocol/Slush.tla#L98)); `TerminationMessageType` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SlushProtocol/Slush.tla#L238)); `TerminationMessage` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SlushProtocol/Slush.tla#L254)); `TypeInvariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SlushProtocol/Slush.tla#L266)); `WaitForQueryMessageOrTermination` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SlushProtocol/Slush.tla#L309)); `SlushLoopTermination` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SlushProtocol/Slush.tla#L389))", "liveness": "`Termination` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SlushProtocol/Slush.tla#L429))", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SlushProtocol/manifest.json)", "configured_checks": "`INVARIANTS: TypeInvariant`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SlushProtocol/SlushLarge.cfg) | `INVARIANTS: TypeInvariant`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SlushProtocol/SlushMedium.cfg) | `INVARIANTS: TypeInvariant`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SlushProtocol/SlushSmall.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SlushProtocol/Slush.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpanningTree/APSpanTree.tla", "specifies": "distributed spanning-tree construction", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "31 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpanningTree/APSpanTree.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking symbolic; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpanningTree/manifest.json)", "configured_checks": "`INVARIANT: TypeOK`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpanningTree/APSpanTree.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpanningTree/APSpanTree.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpanningTree/SpanTree.tla", "specifies": "distributed spanning-tree construction", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "168 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpanningTree/SpanTree.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpanningTree/SpanTree.tla#L63)); `Safety` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpanningTree/SpanTree.tla#L112))", "liveness": "`Liveness` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpanningTree/SpanTree.tla#L118))", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpanningTree/manifest.json)", "configured_checks": "`INVARIANT: TypeOK`; `PROPERTIES: Liveness Safety`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpanningTree/SpanTree.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpanningTree/SpanTree.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpanningTree/SpanTreeRandom.tla", "specifies": "distributed spanning-tree construction", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "91 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpanningTree/SpanTreeRandom.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpanningTree/SpanTreeRandom.tla#L52)); `Safety` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpanningTree/SpanTreeRandom.tla#L80))", "liveness": "`Liveness` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpanningTree/SpanTreeRandom.tla#L82))", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpanningTree/manifest.json)", "configured_checks": "`INVARIANT: TypeOK`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpanningTree/SpanTreeRandom.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpanningTree/SpanTreeRandom.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpanningTree/SpanTreeTest.tla", "specifies": "distributed spanning-tree construction", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "73 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpanningTree/SpanTreeTest.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpanningTree/SpanTreeTest.tla#L23)); `Safety` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpanningTree/SpanTreeTest.tla#L58))", "liveness": "`Liveness` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpanningTree/SpanTreeTest.tla#L60))", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpanningTree/manifest.json)", "configured_checks": "`INVARIANT: TypeOK`; `PROPERTIES: Liveness Safety`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpanningTree/SpanTreeTest4Nodes.cfg) | `INVARIANT: TypeOK`; `PROPERTIES: Liveness Safety`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpanningTree/SpanTreeTest5Nodes.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpanningTree/SpanTreeTest.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpanningTree/SpanTree_proof.tla", "specifies": "distributed spanning-tree construction", "artifact_kind": "proof module", "tool": "TLA+; TLAPS", "size": "60 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpanningTree/SpanTree_proof.tla)", "safety": "`TypeCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpanningTree/SpanTree_proof.tla#L16))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "TLAPS proof target listed; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpanningTree/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpanningTree/SpanTree_proof.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/AdvancedExamples/InnerSequential.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant AdvancedExamples", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "75 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/AdvancedExamples/InnerSequential.tla)", "safety": "`DataInvariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/AdvancedExamples/InnerSequential.tla#L7)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/AdvancedExamples/InnerSequential.tla#L74))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/AdvancedExamples/InnerSequential.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/AdvancedExamples/InnerSerial.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant AdvancedExamples", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "122 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/AdvancedExamples/InnerSerial.tla)", "safety": "`DataInvariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/AdvancedExamples/InnerSerial.tla#L21))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/AdvancedExamples/InnerSerial.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/AdvancedExamples/MCInnerSequential.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant AdvancedExamples", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "15 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/AdvancedExamples/MCInnerSequential.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "configured_checks": "`INVARIANT: DataInvariant`; `INVARIANT: (*************************************************************************)`; `INVARIANT: (* We have TLC check DataInvariant.                                      *)`; `INVARIANT: (*************************************************************************)`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/AdvancedExamples/MCInnerSequential.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/AdvancedExamples/MCInnerSequential.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/AdvancedExamples/MCInnerSerial.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant AdvancedExamples", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "46 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/AdvancedExamples/MCInnerSerial.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "configured_checks": "`INVARIANT: DataInvariant`; `INVARIANT: (*************************************************************************)`; `INVARIANT: (* We have TLC check DataInvariant.                                      *)`; `INVARIANT: (*************************************************************************)`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/AdvancedExamples/MCInnerSerial.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/AdvancedExamples/MCInnerSerial.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/AdvancedExamples/RegisterInterface.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant AdvancedExamples", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "12 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/AdvancedExamples/RegisterInterface.tla)", "safety": "`RegFileTypeInvariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/AdvancedExamples/RegisterInterface.tla#L11))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/AdvancedExamples/RegisterInterface.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/AdvancedExamples/SerialMemory.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant AdvancedExamples", "artifact_kind": "support definitions or abstract interface", "tool": "TLA+", "size": "8 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/AdvancedExamples/SerialMemory.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/AdvancedExamples/SerialMemory.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/AsynchronousInterface/APAsynchInterface.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant AsynchronousInterface", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "24 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/AsynchronousInterface/APAsynchInterface.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking symbolic; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "configured_checks": "`INVARIANT: TypeInvariant`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/AsynchronousInterface/APAsynchInterface.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/AsynchronousInterface/APAsynchInterface.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/AsynchronousInterface/APChannel.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant AsynchronousInterface", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "20 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/AsynchronousInterface/APChannel.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking symbolic; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "configured_checks": "`INVARIANT: TypeInvariant`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/AsynchronousInterface/APChannel.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/AsynchronousInterface/APChannel.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/AsynchronousInterface/AsynchInterface.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant AsynchronousInterface", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "28 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/AsynchronousInterface/AsynchInterface.tla)", "safety": "`TypeInvariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/AsynchronousInterface/AsynchInterface.tla#L6)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/AsynchronousInterface/AsynchInterface.tla#L27))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "configured_checks": "`INVARIANT: TypeInvariant`; `INVARIANT: (***************************************************************************)`; `INVARIANT: (* TLC requires that every declared constant in the specification be       *)`; `INVARIANT: (* assigned a value by a CONSTANT statement in the configuration file.     *)`; `INVARIANT: (***************************************************************************)`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/AsynchronousInterface/AsynchInterface.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/AsynchronousInterface/AsynchInterface.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/AsynchronousInterface/AsynchInterface_proof.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant AsynchronousInterface", "artifact_kind": "proof module", "tool": "TLA+; TLAPS", "size": "14 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/AsynchronousInterface/AsynchInterface_proof.tla)", "safety": "`TypeCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/AsynchronousInterface/AsynchInterface_proof.tla#L7))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "TLAPS proof target listed; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/AsynchronousInterface/AsynchInterface_proof.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/AsynchronousInterface/Channel.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant AsynchronousInterface", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "22 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/AsynchronousInterface/Channel.tla)", "safety": "`TypeInvariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/AsynchronousInterface/Channel.tla#L6)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/AsynchronousInterface/Channel.tla#L21))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "configured_checks": "`INVARIANT: TypeInvariant`; `INVARIANT: (***************************************************************************)`; `INVARIANT: (* TLC requires that every declared constant in the specification be       *)`; `INVARIANT: (* assigned a value by a CONSTANT statement in the configuration file.     *)`; `INVARIANT: (***************************************************************************)`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/AsynchronousInterface/Channel.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/AsynchronousInterface/Channel.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/AsynchronousInterface/Channel_proof.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant AsynchronousInterface", "artifact_kind": "proof module", "tool": "TLA+; TLAPS", "size": "14 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/AsynchronousInterface/Channel_proof.tla)", "safety": "`TypeCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/AsynchronousInterface/Channel_proof.tla#L7))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "TLAPS proof target listed; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/AsynchronousInterface/Channel_proof.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/AsynchronousInterface/PrintValues.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant AsynchronousInterface", "artifact_kind": "support definitions or abstract interface", "tool": "TLA+", "size": "55 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/AsynchronousInterface/PrintValues.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/AsynchronousInterface/PrintValues.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/CachingMemory/InternalMemory.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant CachingMemory", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "43 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/CachingMemory/InternalMemory.tla)", "safety": "`TypeInvariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/CachingMemory/InternalMemory.tla#L10)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/CachingMemory/InternalMemory.tla#L42))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/CachingMemory/InternalMemory.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/CachingMemory/InternalMemory_proof.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant CachingMemory", "artifact_kind": "proof module", "tool": "TLA+; TLAPS", "size": "76 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/CachingMemory/InternalMemory_proof.tla)", "safety": "`Inv` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/CachingMemory/InternalMemory_proof.tla#L21)); `TypeCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/CachingMemory/InternalMemory_proof.tla#L73))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "TLAPS proof target listed; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/CachingMemory/InternalMemory_proof.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/CachingMemory/MCInternalMemory.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant CachingMemory", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "45 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/CachingMemory/MCInternalMemory.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "configured_checks": "`INVARIANT: TypeInvariant`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/CachingMemory/MCInternalMemory.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/CachingMemory/MCInternalMemory.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/CachingMemory/MCWriteThroughCache.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant CachingMemory", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "91 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/CachingMemory/MCWriteThroughCache.tla)", "safety": "`LM_Inner_TypeInvariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/CachingMemory/MCWriteThroughCache.tla#L56)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/CachingMemory/MCWriteThroughCache.tla#L90))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "configured_checks": "`INVARIANTS: TypeInvariant Coherence LM_Inner_TypeInvariant`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/CachingMemory/MCWriteThroughCache.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/CachingMemory/MCWriteThroughCache.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/CachingMemory/Memory.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant CachingMemory", "artifact_kind": "support definitions or abstract interface", "tool": "TLA+", "size": "6 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/CachingMemory/Memory.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/CachingMemory/Memory.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/CachingMemory/MemoryInterface.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant CachingMemory", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "23 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/CachingMemory/MemoryInterface.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/CachingMemory/MemoryInterface.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/CachingMemory/WriteThroughCache.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant CachingMemory", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "93 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/CachingMemory/WriteThroughCache.tla)", "safety": "`TypeInvariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/CachingMemory/WriteThroughCache.tla#L12)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/CachingMemory/WriteThroughCache.tla#L89))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/CachingMemory/WriteThroughCache.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/CachingMemory/WriteThroughCacheInstanced.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant CachingMemory", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "163 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/CachingMemory/WriteThroughCacheInstanced.tla)", "safety": "`M_TypeInvariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/CachingMemory/WriteThroughCacheInstanced.tla#L33)); `TypeInvariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/CachingMemory/WriteThroughCacheInstanced.tla#L74)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/CachingMemory/WriteThroughCacheInstanced.tla#L151)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/CachingMemory/WriteThroughCacheInstanced.tla#L162))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/CachingMemory/WriteThroughCacheInstanced.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/Composing/APChannel.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant Composing", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "23 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Composing/APChannel.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking symbolic; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "configured_checks": "`INVARIANT: TypeInvariant`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Composing/APChannel.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Composing/APChannel.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/Composing/Channel.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant Composing", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "22 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Composing/Channel.tla)", "safety": "`TypeInvariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Composing/Channel.tla#L6)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Composing/Channel.tla#L21))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Composing/Channel.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/Composing/ChannelRefinement.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant Composing", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "42 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Composing/ChannelRefinement.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Composing/ChannelRefinement.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/Composing/Channel_proof.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant Composing", "artifact_kind": "proof module", "tool": "TLA+; TLAPS", "size": "14 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Composing/Channel_proof.tla)", "safety": "`TypeCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Composing/Channel_proof.tla#L7))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "TLAPS proof target listed; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Composing/Channel_proof.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/Composing/CompositeFIFO.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant Composing", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "41 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Composing/CompositeFIFO.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Composing/CompositeFIFO.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/Composing/InternalMemory.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant Composing", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "43 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Composing/InternalMemory.tla)", "safety": "`TypeInvariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Composing/InternalMemory.tla#L10)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Composing/InternalMemory.tla#L42))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Composing/InternalMemory.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/Composing/InternalMemory_proof.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant Composing", "artifact_kind": "proof module", "tool": "TLA+; TLAPS", "size": "76 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Composing/InternalMemory_proof.tla)", "safety": "`Inv` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Composing/InternalMemory_proof.tla#L21)); `TypeCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Composing/InternalMemory_proof.tla#L73))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "TLAPS proof target listed; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Composing/InternalMemory_proof.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/Composing/JointActionMemory.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant Composing", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "40 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Composing/JointActionMemory.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Composing/JointActionMemory.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/Composing/MemoryInterface.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant Composing", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "23 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Composing/MemoryInterface.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Composing/MemoryInterface.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/FIFO/APChannel.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant FIFO", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "23 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/FIFO/APChannel.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking symbolic; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "configured_checks": "`INVARIANT: TypeInvariant`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/FIFO/APChannel.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/FIFO/APChannel.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/FIFO/APInnerFIFO.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant FIFO", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "30 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/FIFO/APInnerFIFO.tla)", "safety": "`ChannelTypeInvariants` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/FIFO/APInnerFIFO.tla#L26))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking symbolic; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "configured_checks": "`INVARIANT: ChannelTypeInvariants`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/FIFO/APInnerFIFO.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/FIFO/APInnerFIFO.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/FIFO/APInnerFIFOInstanced.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant FIFO", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "33 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/FIFO/APInnerFIFOInstanced.tla)", "safety": "`ChannelTypeInvariants` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/FIFO/APInnerFIFOInstanced.tla#L29))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking symbolic; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "configured_checks": "`INVARIANT: ChannelTypeInvariants`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/FIFO/APInnerFIFOInstanced.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/FIFO/APInnerFIFOInstanced.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/FIFO/APMCInnerFIFO.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant FIFO", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "36 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/FIFO/APMCInnerFIFO.tla)", "safety": "`ChannelTypeInvariants` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/FIFO/APMCInnerFIFO.tla#L31))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking symbolic; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "configured_checks": "`INVARIANT: ChannelTypeInvariants`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/FIFO/APMCInnerFIFO.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/FIFO/APMCInnerFIFO.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/FIFO/Channel.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant FIFO", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "22 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/FIFO/Channel.tla)", "safety": "`TypeInvariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/FIFO/Channel.tla#L6)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/FIFO/Channel.tla#L21))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/FIFO/Channel.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/FIFO/Channel_proof.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant FIFO", "artifact_kind": "proof module", "tool": "TLA+; TLAPS", "size": "14 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/FIFO/Channel_proof.tla)", "safety": "`TypeCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/FIFO/Channel_proof.tla#L7))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "TLAPS proof target listed; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/FIFO/Channel_proof.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/FIFO/FIFO.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant FIFO", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "6 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/FIFO/FIFO.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/FIFO/FIFO.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/FIFO/InnerFIFO.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant FIFO", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "40 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/FIFO/InnerFIFO.tla)", "safety": "`TypeInvariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/FIFO/InnerFIFO.tla#L12)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/FIFO/InnerFIFO.tla#L38))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/FIFO/InnerFIFO.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/FIFO/InnerFIFOInstanced.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant FIFO", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "104 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/FIFO/InnerFIFOInstanced.tla)", "safety": "`InChan_TypeInvariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/FIFO/InnerFIFOInstanced.tla#L32)); `OutChan_TypeInvariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/FIFO/InnerFIFOInstanced.tla#L52)); `TypeInvariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/FIFO/InnerFIFOInstanced.tla#L75)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/FIFO/InnerFIFOInstanced.tla#L101))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/FIFO/InnerFIFOInstanced.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/FIFO/InnerFIFO_proof.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant FIFO", "artifact_kind": "proof module", "tool": "TLA+; TLAPS", "size": "35 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/FIFO/InnerFIFO_proof.tla)", "safety": "`TypeCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/FIFO/InnerFIFO_proof.tla#L9))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "TLAPS proof target listed; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/FIFO/InnerFIFO_proof.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/FIFO/MCInnerFIFO.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant FIFO", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "32 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/FIFO/MCInnerFIFO.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "configured_checks": "`INVARIANT: TypeInvariant`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/FIFO/MCInnerFIFO.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/FIFO/MCInnerFIFO.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/Liveness/InternalMemory.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant Liveness", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "43 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Liveness/InternalMemory.tla)", "safety": "`TypeInvariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Liveness/InternalMemory.tla#L10)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Liveness/InternalMemory.tla#L42))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Liveness/InternalMemory.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/Liveness/InternalMemory_proof.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant Liveness", "artifact_kind": "proof module", "tool": "TLA+; TLAPS", "size": "76 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Liveness/InternalMemory_proof.tla)", "safety": "`Inv` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Liveness/InternalMemory_proof.tla#L21)); `TypeCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Liveness/InternalMemory_proof.tla#L73))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "TLAPS proof target listed; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Liveness/InternalMemory_proof.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/Liveness/LiveInternalMemory.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant Liveness", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "45 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Liveness/LiveInternalMemory.tla)", "safety": "`theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Liveness/LiveInternalMemory.tla#L44))", "liveness": "`LivenessProperty` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Liveness/LiveInternalMemory.tla#L34))", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Liveness/LiveInternalMemory.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/Liveness/LiveWriteThroughCache.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant Liveness", "artifact_kind": "support definitions or abstract interface", "tool": "TLA+", "size": "28 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Liveness/LiveWriteThroughCache.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Liveness/LiveWriteThroughCache.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/Liveness/MCInternalMemory.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant Liveness", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "45 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Liveness/MCInternalMemory.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Liveness/MCInternalMemory.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/Liveness/MCLiveInternalMemory.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant Liveness", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "48 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Liveness/MCLiveInternalMemory.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Liveness/MCLiveInternalMemory.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/Liveness/MCLiveWriteThroughCache.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant Liveness", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "145 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Liveness/MCLiveWriteThroughCache.tla)", "safety": "`LM_Inner_TypeInvariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Liveness/MCLiveWriteThroughCache.tla#L74))", "liveness": "`LM_Inner_Liveness` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Liveness/MCLiveWriteThroughCache.tla#L129)); `LM_Inner_Liveness2` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Liveness/MCLiveWriteThroughCache.tla#L134)); `LM_Inner_LivenessProperty` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Liveness/MCLiveWriteThroughCache.tla#L142))", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Liveness/MCLiveWriteThroughCache.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/Liveness/Memory.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant Liveness", "artifact_kind": "support definitions or abstract interface", "tool": "TLA+", "size": "6 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Liveness/Memory.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Liveness/Memory.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/Liveness/MemoryInterface.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant Liveness", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "23 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Liveness/MemoryInterface.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Liveness/MemoryInterface.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/Liveness/WriteThroughCacheInstanced.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant Liveness", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "163 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Liveness/WriteThroughCacheInstanced.tla)", "safety": "`M_TypeInvariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Liveness/WriteThroughCacheInstanced.tla#L33)); `TypeInvariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Liveness/WriteThroughCacheInstanced.tla#L74)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Liveness/WriteThroughCacheInstanced.tla#L151)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Liveness/WriteThroughCacheInstanced.tla#L162))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/Liveness/WriteThroughCacheInstanced.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/RealTime/InternalMemory.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant RealTime", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "43 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/RealTime/InternalMemory.tla)", "safety": "`TypeInvariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/RealTime/InternalMemory.tla#L10)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/RealTime/InternalMemory.tla#L42))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/RealTime/InternalMemory.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/RealTime/InternalMemory_proof.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant RealTime", "artifact_kind": "proof module", "tool": "TLA+; TLAPS", "size": "76 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/RealTime/InternalMemory_proof.tla)", "safety": "`Inv` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/RealTime/InternalMemory_proof.tla#L21)); `TypeCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/RealTime/InternalMemory_proof.tla#L73))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "TLAPS proof target listed; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/RealTime/InternalMemory_proof.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/RealTime/MCRealTime.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant RealTime", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "31 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/RealTime/MCRealTime.tla)", "safety": "`RTFairness` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/RealTime/MCRealTime.tla#L28))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/RealTime/MCRealTime.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/RealTime/Memory.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant RealTime", "artifact_kind": "support definitions or abstract interface", "tool": "TLA+", "size": "6 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/RealTime/Memory.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/RealTime/Memory.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/RealTime/MemoryInterface.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant RealTime", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "23 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/RealTime/MemoryInterface.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/RealTime/MemoryInterface.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/RealTime/RTMemory.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant RealTime", "artifact_kind": "support definitions or abstract interface", "tool": "TLA+", "size": "16 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/RealTime/RTMemory.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/RealTime/RTMemory.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/RealTime/RTWriteThroughCache.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant RealTime", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "51 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/RealTime/RTWriteThroughCache.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/RealTime/RTWriteThroughCache.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/RealTime/WriteThroughCache.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant RealTime", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "93 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/RealTime/WriteThroughCache.tla)", "safety": "`TypeInvariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/RealTime/WriteThroughCache.tla#L12)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/RealTime/WriteThroughCache.tla#L89))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/RealTime/WriteThroughCache.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/TLC/ABCorrectness.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant TLC", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "40 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/TLC/ABCorrectness.tla)", "safety": "`ABCFairness` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/TLC/ABCorrectness.tla#L37))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "configured_checks": "`INVARIANT: TypeInv`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/TLC/ABCorrectness.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/TLC/ABCorrectness.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/TLC/AlternatingBit.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant TLC", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "78 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/TLC/AlternatingBit.tla)", "safety": "`ABFairness` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/TLC/AlternatingBit.tla#L72)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/TLC/AlternatingBit.tla#L77))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/TLC/AlternatingBit.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/TLC/AlternatingBit_proof.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant TLC", "artifact_kind": "proof module", "tool": "TLA+; TLAPS", "size": "62 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/TLC/AlternatingBit_proof.tla)", "safety": "`TypeCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/TLC/AlternatingBit_proof.tla#L32))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "TLAPS proof target listed; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/TLC/AlternatingBit_proof.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/SpecifyingSystems/TLC/MCAlternatingBit.tla", "specifies": "concurrent channels, FIFO, memory/cache or alternating-bit protocol; variant TLC", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "22 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/TLC/MCAlternatingBit.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/manifest.json)", "configured_checks": "`INVARIANT: ABTypeInv`; `PROPERTIES: ABCSpec SentLeadsToRcvd`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/TLC/MCAlternatingBit.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/SpecifyingSystems/TLC/MCAlternatingBit.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/TeachingConcurrency/Simple.tla", "specifies": "shared-register concurrency/mutual exclusion", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+/PlusCal; TLAPS", "size": "176 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/TeachingConcurrency/Simple.tla)", "safety": "`PCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/TeachingConcurrency/Simple.tla#L81)); `TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/TeachingConcurrency/Simple.tla#L90)); `Inv` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/TeachingConcurrency/Simple.tla#L114)); `Correctness` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/TeachingConcurrency/Simple.tla#L126)); `Correctness2` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/TeachingConcurrency/Simple.tla#L163))", "liveness": "`Termination` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/TeachingConcurrency/Simple.tla#L69))", "evidence_status": "TLAPS proof target listed; model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/TeachingConcurrency/manifest.json)", "configured_checks": "`INVARIANTS: PCorrect TypeOK Inv`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/TeachingConcurrency/Simple.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/TeachingConcurrency/Simple.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/TeachingConcurrency/SimpleRegular.tla", "specifies": "shared-register concurrency/mutual exclusion", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+/PlusCal; TLAPS", "size": "198 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/TeachingConcurrency/SimpleRegular.tla)", "safety": "`PCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/TeachingConcurrency/SimpleRegular.tla#L117)); `TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/TeachingConcurrency/SimpleRegular.tla#L126)); `Inv` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/TeachingConcurrency/SimpleRegular.tla#L130)); `Correctness` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/TeachingConcurrency/SimpleRegular.tla#L143)); `Correctness2` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/TeachingConcurrency/SimpleRegular.tla#L186))", "liveness": "`Termination` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/TeachingConcurrency/SimpleRegular.tla#L110))", "evidence_status": "TLAPS proof target listed; model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/TeachingConcurrency/manifest.json)", "configured_checks": "`INVARIANTS: PCorrect TypeOK Inv`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/TeachingConcurrency/SimpleRegular.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/TeachingConcurrency/SimpleRegular.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/TeachingConcurrency/SimpleRegular_proof.tla", "specifies": "shared-register concurrency/mutual exclusion", "artifact_kind": "proof module", "tool": "TLA+; TLAPS", "size": "63 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/TeachingConcurrency/SimpleRegular_proof.tla)", "safety": "`TypeCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/TeachingConcurrency/SimpleRegular_proof.tla#L8)); `InvInvariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/TeachingConcurrency/SimpleRegular_proof.tla#L37))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "TLAPS proof target listed; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/TeachingConcurrency/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/TeachingConcurrency/SimpleRegular_proof.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/TeachingConcurrency/Simple_proof.tla", "specifies": "shared-register concurrency/mutual exclusion", "artifact_kind": "proof module", "tool": "TLA+; TLAPS", "size": "25 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/TeachingConcurrency/Simple_proof.tla)", "safety": "`TypeCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/TeachingConcurrency/Simple_proof.tla#L8)); `InvInvariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/TeachingConcurrency/Simple_proof.tla#L18))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "TLAPS proof target listed; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/TeachingConcurrency/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/TeachingConcurrency/Simple_proof.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/TwoPhase/Alternate.tla", "specifies": "two-phase handshake and abstract alternation", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "34 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/TwoPhase/Alternate.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/TwoPhase/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/TwoPhase/Alternate.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/TwoPhase/MCTwoPhase.tla", "specifies": "two-phase handshake and abstract alternation", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "7 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/TwoPhase/MCTwoPhase.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/TwoPhase/manifest.json)", "configured_checks": "`INVARIANT: Inv`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/TwoPhase/MCTwoPhase.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/TwoPhase/MCTwoPhase.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/TwoPhase/TwoPhase.tla", "specifies": "two-phase handshake and abstract alternation", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+; TLAPS", "size": "96 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/TwoPhase/TwoPhase.tla)", "safety": "`Inv` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/TwoPhase/TwoPhase.tla#L50))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "TLAPS proof target listed; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/TwoPhase/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/TwoPhase/TwoPhase.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/TwoPhase/TwoPhase_proof.tla", "specifies": "two-phase handshake and abstract alternation", "artifact_kind": "proof module", "tool": "TLA+; TLAPS", "size": "35 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/TwoPhase/TwoPhase_proof.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "TLAPS proof target listed; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/TwoPhase/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/TwoPhase/TwoPhase_proof.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/YoYo/MCYoYoNoPruning.tla", "specifies": "Yo-Yo leader election", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "18 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/YoYo/MCYoYoNoPruning.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/YoYo/manifest.json)", "configured_checks": "`INVARIANTS: TypeOK`; `INVARIANTS: NeighborInv`; `PROPERTIES: NoNewSource`; `PROPERTIES: Liveness`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/YoYo/MCYoYoNoPruning.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/YoYo/MCYoYoNoPruning.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/YoYo/MCYoYoPruning.tla", "specifies": "Yo-Yo leader election", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "18 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/YoYo/MCYoYoPruning.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/YoYo/manifest.json)", "configured_checks": "`INVARIANTS: TypeOK`; `INVARIANTS: NeighborInv`; `INVARIANTS: FinishIffTerminated`; `PROPERTIES: Liveness`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/YoYo/MCYoYoPruning.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/YoYo/MCYoYoPruning.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/YoYo/YoYoAllGraphs.tla", "specifies": "Yo-Yo leader election", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "240 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/YoYo/YoYoAllGraphs.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/YoYo/YoYoAllGraphs.tla#L59)); `Termination` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/YoYo/YoYoAllGraphs.tla#L234))", "liveness": "`Liveness` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/YoYo/YoYoAllGraphs.tla#L238))", "interpretation": "`Termination` itself is a final-state predicate; `Liveness == <>Termination` is the eventual-election guarantee; disabledness alone is a state condition, not eventual progress", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/YoYo/manifest.json)", "configured_checks": "`INVARIANTS: TypeOK`; `INVARIANTS: NeighborInv`; `INVARIANTS: FinishIffTerminated`; `PROPERTIES: Liveness`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/YoYo/YoYoAllGraphs.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/YoYo/YoYoAllGraphs.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/YoYo/YoYoNoPruning.tla", "specifies": "Yo-Yo leader election", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "251 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/YoYo/YoYoNoPruning.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/YoYo/YoYoNoPruning.tla#L94))", "liveness": "`Liveness` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/YoYo/YoYoNoPruning.tla#L250))", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/YoYo/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/YoYo/YoYoNoPruning.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/YoYo/YoYoPruning.tla", "specifies": "Yo-Yo leader election", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "266 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/YoYo/YoYoPruning.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/YoYo/YoYoPruning.tla#L77)); `Termination` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/YoYo/YoYoPruning.tla#L260))", "liveness": "`Liveness` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/YoYo/YoYoPruning.tla#L264))", "interpretation": "`Termination` itself is a final-state predicate; `Liveness == <>Termination` is the eventual-election guarantee; disabledness alone is a state condition, not eventual progress", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/YoYo/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/YoYo/YoYoPruning.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/aba-asyn-byz/aba_asyn_byz.tla", "specifies": "asynchronous Byzantine agreement", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "160 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/aba-asyn-byz/aba_asyn_byz.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/aba-asyn-byz/aba_asyn_byz.tla#L138))", "liveness": "`Agreement_Ltl` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/aba-asyn-byz/aba_asyn_byz.tla#L154))", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/aba-asyn-byz/manifest.json)", "configured_checks": "`INVARIANTS: TypeOK`; `PROPERTIES: Unforg_Ltl Corr_Ltl Agreement_Ltl`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/aba-asyn-byz/aba_asyn_byz.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/aba-asyn-byz/aba_asyn_byz.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/acp/ACP_NB.tla", "specifies": "atomic commitment", "artifact_kind": "support definitions or abstract interface", "tool": "TLA+", "size": "177 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/acp/ACP_NB.tla)", "safety": "`fairnessNB` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/acp/ACP_NB.tla#L160))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/acp/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/acp/ACP_NB.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/acp/ACP_NB_TLC.tla", "specifies": "atomic commitment", "artifact_kind": "support definitions or abstract interface", "tool": "TLA+", "size": "18 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/acp/ACP_NB_TLC.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/acp/manifest.json)", "configured_checks": "`PROPERTIES: AC1 AC2 AC3_1 AC4_alt`; `PROPERTIES: AC3_2 AC5`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/acp/ACP_NB_TLC.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/acp/ACP_NB_TLC.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/acp/ACP_NB_WRONG_TLC.tla", "specifies": "atomic commitment", "artifact_kind": "support definitions or abstract interface", "tool": "TLA+", "size": "121 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/acp/ACP_NB_WRONG_TLC.tla)", "safety": "`fairnessNB` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/acp/ACP_NB_WRONG_TLC.tla#L116))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/acp/manifest.json)", "configured_checks": "`PROPERTIES: AC1`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/acp/ACP_NB_WRONG_TLC.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/acp/ACP_NB_WRONG_TLC.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/acp/ACP_SB.tla", "specifies": "atomic commitment", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "402 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/acp/ACP_SB.tla)", "safety": "`fairness` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/acp/ACP_SB.tla#L306))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/acp/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/acp/ACP_SB.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/acp/ACP_SB_TLC.tla", "specifies": "atomic commitment", "artifact_kind": "support definitions or abstract interface", "tool": "TLA+", "size": "18 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/acp/ACP_SB_TLC.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/acp/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/acp/ACP_SB_TLC.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/acp/APACP_SB.tla", "specifies": "atomic commitment", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "38 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/acp/APACP_SB.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking symbolic; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/acp/manifest.json)", "configured_checks": "`INVARIANTS: TypeInv`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/acp/APACP_SB.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/acp/APACP_SB.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/allocator/AllocatorImplementation.tla", "specifies": "resource-allocation protocol", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "204 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/AllocatorImplementation.tla)", "safety": "`TypeInvariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/AllocatorImplementation.tla#L46)); `Invariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/AllocatorImplementation.tla#L162)); `ResourceMutex` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/AllocatorImplementation.tla#L176)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/AllocatorImplementation.tla#L190)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/AllocatorImplementation.tla#L191)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/AllocatorImplementation.tla#L192)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/AllocatorImplementation.tla#L195))", "liveness": "`InfOftenSatisfied` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/AllocatorImplementation.tla#L185))", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/manifest.json)", "configured_checks": "`INVARIANTS: TypeInvariant ResourceMutex`; `INVARIANTS: Invariant`; `PROPERTIES: SchedAllocator`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/AllocatorImplementation.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/AllocatorImplementation.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/allocator/AllocatorImplementation_proof.tla", "specifies": "resource-allocation protocol", "artifact_kind": "proof module", "tool": "TLA+; TLAPS", "size": "271 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/AllocatorImplementation_proof.tla)", "safety": "`TypeCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/AllocatorImplementation_proof.tla#L211))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "TLAPS proof target listed; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/AllocatorImplementation_proof.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/allocator/AllocatorRefinement.tla", "specifies": "resource-allocation protocol", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "13 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/AllocatorRefinement.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/manifest.json)", "configured_checks": "`PROPERTIES: SimpleAllocator`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/AllocatorRefinement.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/AllocatorRefinement.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/allocator/SchedulingAllocator.tla", "specifies": "resource-allocation protocol", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "177 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/SchedulingAllocator.tla)", "safety": "`TypeInvariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/SchedulingAllocator.tla#L30)); `ResourceMutex` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/SchedulingAllocator.tla#L128)); `AllocatorInvariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/SchedulingAllocator.tla#L140)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/SchedulingAllocator.tla#L170)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/SchedulingAllocator.tla#L171)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/SchedulingAllocator.tla#L172)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/SchedulingAllocator.tla#L175))", "liveness": "`InfOftenSatisfied` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/SchedulingAllocator.tla#L159))", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/manifest.json)", "configured_checks": "`INVARIANTS: TypeInvariant ResourceMutex`; `INVARIANTS: AllocatorInvariant`; `PROPERTIES: ClientsWillReturn InfOftenSatisfied ClientsWillObtain`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/SchedulingAllocator.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/SchedulingAllocator.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/allocator/SchedulingAllocator_proof.tla", "specifies": "resource-allocation protocol", "artifact_kind": "proof module", "tool": "TLA+; TLAPS", "size": "342 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/SchedulingAllocator_proof.tla)", "safety": "`TypeCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/SchedulingAllocator_proof.tla#L200)); `Inv` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/SchedulingAllocator_proof.tla#L252)); `Mutex` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/SchedulingAllocator_proof.tla#L254))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "TLAPS proof target listed; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/SchedulingAllocator_proof.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/allocator/SimpleAllocator.tla", "specifies": "resource-allocation protocol", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "118 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/SimpleAllocator.tla)", "safety": "`TypeInvariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/SimpleAllocator.tla#L25)); `ResourceMutex` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/SimpleAllocator.tla#L78)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/SimpleAllocator.tla#L109)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/SimpleAllocator.tla#L110)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/SimpleAllocator.tla#L114))", "liveness": "`InfOftenSatisfied` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/SimpleAllocator.tla#L87))", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/manifest.json)", "configured_checks": "`INVARIANTS: TypeInvariant ResourceMutex`; `PROPERTIES: ClientsWillReturn ClientsWillObtain InfOftenSatisfied`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/SimpleAllocator.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/SimpleAllocator.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/allocator/SimpleAllocator_proof.tla", "specifies": "resource-allocation protocol", "artifact_kind": "proof module", "tool": "TLA+; TLAPS", "size": "122 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/SimpleAllocator_proof.tla)", "safety": "`TypeCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/SimpleAllocator_proof.tla#L19)); `Inv` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/SimpleAllocator_proof.tla#L50)); `Mutex` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/SimpleAllocator_proof.tla#L52))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "TLAPS proof target listed; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/allocator/SimpleAllocator_proof.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/barriers/APBarrier.tla", "specifies": "barrier synchronization", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "22 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/barriers/APBarrier.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking symbolic; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/barriers/manifest.json)", "configured_checks": "`INVARIANT: TypeOK`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/barriers/APBarrier.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/barriers/APBarrier.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/barriers/Barrier.tla", "specifies": "barrier synchronization", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "40 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/barriers/Barrier.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/barriers/Barrier.tla#L32))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/barriers/manifest.json)", "configured_checks": "`INVARIANT: TypeOK`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/barriers/Barrier.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/barriers/Barrier.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/barriers/Barriers.tla", "specifies": "barrier synchronization", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+/PlusCal; TLAPS", "size": "1,311 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/barriers/Barriers.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/barriers/Barriers.tla#L162)); `Inv` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/barriers/Barriers.tla#L194)); `Invariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/barriers/Barriers.tla#L412)); `FlushInvariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/barriers/Barriers.tla#L1093))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "TLAPS proof target listed; model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/barriers/manifest.json)", "configured_checks": "`INVARIANTS: TypeOK LockInv Inv FlushInv`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/barriers/Barriers.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/barriers/Barriers.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/bcastByz/bcastByz.tla", "specifies": "Byzantine broadcast", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+; TLAPS", "size": "1,146 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/bcastByz/bcastByz.tla)", "safety": "`ReceiveFromCorrectSender` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/bcastByz/bcastByz.tla#L94)); `TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/bcastByz/bcastByz.tla#L183)); `FCConstraints_TypeOK_InitNoBcast` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/bcastByz/bcastByz.tla#L342)); `FCConstraints_TypeOK_Init` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/bcastByz/bcastByz.tla#L414)); `FCConstraints_TypeOK_IndInv_Unforg_NoBcast` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/bcastByz/bcastByz.tla#L485)); `FCConstraints_TypeOK_IndInv_Unforg_NoBcast_TLC` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/bcastByz/bcastByz.tla#L492)); `FCConstraints_TypeOK_Next` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/bcastByz/bcastByz.tla#L559)); `FCConstraints_TypeOK_SpecNoBcast` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/bcastByz/bcastByz.tla#L850)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/bcastByz/bcastByz.tla#L1128))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "TLAPS proof target listed; model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/bcastByz/manifest.json)", "configured_checks": "`INVARIANTS: TypeOK FCConstraints`; `PROPERTIES: CorrLtl RelayLtl UnforgLtl`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/bcastByz/bcastByz.cfg) | `INVARIANTS: TypeOK FCConstraints Unforg`; `PROPERTIES: CorrLtl RelayLtl`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/bcastByz/bcastByzNoBcast.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/bcastByz/bcastByz.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/bcastFolklore/APbcastFolklore.tla", "specifies": "reliable broadcast", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "29 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/bcastFolklore/APbcastFolklore.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking symbolic; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/bcastFolklore/manifest.json)", "configured_checks": "`INVARIANT: TypeOK`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/bcastFolklore/APbcastFolklore.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/bcastFolklore/APbcastFolklore.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/bcastFolklore/bcastFolklore.tla", "specifies": "reliable broadcast", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "152 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/bcastFolklore/bcastFolklore.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/bcastFolklore/bcastFolklore.tla#L125))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/bcastFolklore/manifest.json)", "configured_checks": "`INVARIANTS: TypeOK`; `PROPERTIES: UnforgLtl CorrLtl RelayLtl ReliableChan`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/bcastFolklore/bcastFolklore.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/bcastFolklore/bcastFolklore.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/bosco/APbosco.tla", "specifies": "Bosco Byzantine consensus", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "25 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/bosco/APbosco.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking symbolic; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/bosco/manifest.json)", "configured_checks": "`INVARIANT: TypeOK`; `INVARIANT: Lemma3_0`; `INVARIANT: Lemma3_1`; `INVARIANT: Lemma4_0`; `INVARIANT: Lemma4_1`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/bosco/APbosco.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/bosco/APbosco.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/bosco/bosco.tla", "specifies": "Bosco Byzantine consensus", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "231 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/bosco/bosco.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/bosco/bosco.tla#L201))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/bosco/manifest.json)", "configured_checks": "`INVARIANTS: TypeOK Lemma3_0 Lemma3_1 Lemma4_0 Lemma4_1`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/bosco/bosco.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/bosco/bosco.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/byihive/VoucherCancel.tla", "specifies": "voucher transaction system", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "286 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byihive/VoucherCancel.tla)", "safety": "`VTPTypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byihive/VoucherCancel.tla#L72)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byihive/VoucherCancel.tla#L260))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byihive/manifest.json)", "configured_checks": "`INVARIANTS: VTPTypeOK VTPConsistent`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byihive/VoucherCancel.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byihive/VoucherCancel.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/byihive/VoucherIssue.tla", "specifies": "voucher transaction system", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "287 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byihive/VoucherIssue.tla)", "safety": "`VTPTypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byihive/VoucherIssue.tla#L73)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byihive/VoucherIssue.tla#L261))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byihive/manifest.json)", "configured_checks": "`INVARIANTS: VTPTypeOK VTPConsistent`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byihive/VoucherIssue.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byihive/VoucherIssue.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/byihive/VoucherLifeCycle.tla", "specifies": "voucher transaction system", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "107 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byihive/VoucherLifeCycle.tla)", "safety": "`VTypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byihive/VoucherLifeCycle.tla#L30)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byihive/VoucherLifeCycle.tla#L96))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byihive/manifest.json)", "configured_checks": "`INVARIANTS: VTypeOK VConsistent`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byihive/VoucherLifeCycle.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byihive/VoucherLifeCycle.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/byihive/VoucherLifeCycle_proof.tla", "specifies": "voucher transaction system", "artifact_kind": "proof module", "tool": "TLA+; TLAPS", "size": "19 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byihive/VoucherLifeCycle_proof.tla)", "safety": "`Inv` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byihive/VoucherLifeCycle_proof.tla#L10)); `Spec_TypeOK_Consistent` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byihive/VoucherLifeCycle_proof.tla#L12))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "TLAPS proof target listed; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byihive/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byihive/VoucherLifeCycle_proof.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/byihive/VoucherRedeem.tla", "specifies": "voucher transaction system", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "284 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byihive/VoucherRedeem.tla)", "safety": "`VTPTypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byihive/VoucherRedeem.tla#L70)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byihive/VoucherRedeem.tla#L258))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byihive/manifest.json)", "configured_checks": "`INVARIANTS: VTPTypeOK VTPConsistent`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byihive/VoucherRedeem.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byihive/VoucherRedeem.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/byihive/VoucherTransfer.tla", "specifies": "voucher transaction system", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "293 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byihive/VoucherTransfer.tla)", "safety": "`VTPTypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byihive/VoucherTransfer.tla#L80)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byihive/VoucherTransfer.tla#L267))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byihive/manifest.json)", "configured_checks": "`INVARIANTS: VTPTypeOK VTPConsistent`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byihive/VoucherTransfer.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byihive/VoucherTransfer.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/byzpaxos/BPConProof.tla", "specifies": "Byzantine Paxos refinement", "artifact_kind": "proof module", "tool": "TLA+/PlusCal; TLAPS", "size": "2,173 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byzpaxos/BPConProof.tla)", "safety": "`KnowsSafeAt` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byzpaxos/BPConProof.tla#L258)); `KnowsSafeAt` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byzpaxos/BPConProof.tla#L434)); `TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byzpaxos/BPConProof.tla#L825)); `Inv` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byzpaxos/BPConProof.tla#L935)); `KnowsSafeAtDef` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byzpaxos/BPConProof.tla#L1039)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byzpaxos/BPConProof.tla#L1315))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "TLAPS proof target listed; model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byzpaxos/manifest.json)", "configured_checks": "`INVARIANT: Inv`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byzpaxos/BPConProof.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byzpaxos/BPConProof.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/byzpaxos/Consensus.tla", "specifies": "Byzantine Paxos refinement", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+/PlusCal; TLAPS", "size": "209 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byzpaxos/Consensus.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byzpaxos/Consensus.tla#L105)); `Inv` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byzpaxos/Consensus.tla#L108)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byzpaxos/Consensus.tla#L156))", "liveness": "`Success` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byzpaxos/Consensus.tla#L173)); `Liveness` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byzpaxos/Consensus.tla#L188)); `LiveSpecEquals` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byzpaxos/Consensus.tla#L205))", "evidence_status": "TLAPS proof target listed; model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byzpaxos/manifest.json)", "configured_checks": "`INVARIANTS: TypeOK Inv`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byzpaxos/Consensus.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byzpaxos/Consensus.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/byzpaxos/PConProof.tla", "specifies": "Byzantine Paxos refinement", "artifact_kind": "proof module", "tool": "TLA+/PlusCal; TLAPS", "size": "612 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byzpaxos/PConProof.tla)", "safety": "`ShowsSafeAt` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byzpaxos/PConProof.tla#L202)); `ShowsSafeAt` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byzpaxos/PConProof.tla#L325)); `TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byzpaxos/PConProof.tla#L443)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byzpaxos/PConProof.tla#L511)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byzpaxos/PConProof.tla#L517)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byzpaxos/PConProof.tla#L527))", "liveness": "`Liveness` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byzpaxos/PConProof.tla#L572)); `CLiveness` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byzpaxos/PConProof.tla#L611))", "evidence_status": "TLAPS proof target listed; model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byzpaxos/manifest.json)", "configured_checks": "`INVARIANTS: TypeOK PAccInv P1bInv P1cInv P2aInv`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byzpaxos/PConProof.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byzpaxos/PConProof.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/byzpaxos/VoteProof.tla", "specifies": "Byzantine Paxos refinement", "artifact_kind": "proof module", "tool": "TLA+/PlusCal; TLAPS", "size": "1,473 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byzpaxos/VoteProof.tla)", "safety": "`SafeAt` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byzpaxos/VoteProof.tla#L130)); `SafeAt` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byzpaxos/VoteProof.tla#L212)); `SafeAtProp` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byzpaxos/VoteProof.tla#L273)); `TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byzpaxos/VoteProof.tla#L321)); `SafeLemma` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byzpaxos/VoteProof.tla#L342)); `SafeAtPropPrime` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byzpaxos/VoteProof.tla#L566)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byzpaxos/VoteProof.tla#L520)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byzpaxos/VoteProof.tla#L903)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byzpaxos/VoteProof.tla#L1044))", "liveness": "`Liveness` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byzpaxos/VoteProof.tla#L1156)); `LiveSpec` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byzpaxos/VoteProof.tla#L1123)) (assumption-bearing liveness specification, not a safety property)", "evidence_status": "TLAPS proof target listed; model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byzpaxos/manifest.json)", "configured_checks": "`INVARIANTS: TypeOK VInv1 VInv2 VInv3 VInv4`; `PROPERTIES: Refines`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byzpaxos/VoteProof.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/byzpaxos/VoteProof.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/c1cs/APc1cs.tla", "specifies": "one-communication-step consensus", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "47 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/c1cs/APc1cs.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking symbolic; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/c1cs/manifest.json)", "configured_checks": "`INVARIANT: TypeOK`; `INVARIANT: Validity`; `INVARIANT: Agreement`; `INVARIANT: WeakAgreement`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/c1cs/APc1cs.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/c1cs/APc1cs.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/c1cs/c1cs.tla", "specifies": "one-communication-step consensus", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "193 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/c1cs/c1cs.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/c1cs/c1cs.tla#L120)); `Validity` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/c1cs/c1cs.tla#L128)); `Agreement` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/c1cs/c1cs.tla#L132)); `WeakAgreement` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/c1cs/c1cs.tla#L137))", "liveness": "`Termination` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/c1cs/c1cs.tla#L141))", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/c1cs/manifest.json)", "configured_checks": "`INVARIANTS: TypeOK Validity Agreement WeakAgreement IndStrengthens`; `PROPERTIES: Termination`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/c1cs/c1cs.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/c1cs/c1cs.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/cbc_max/cbc_max.tla", "specifies": "condition-based consensus", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "179 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/cbc_max/cbc_max.tla)", "safety": "decisions use an initial proposal (`Validity`); no two processes decide differently (`Agreement`); state values have intended types (`TypeOK`); [definitions](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/cbc_max/cbc_max.tla#L149)", "liveness": "`Termination` says every noncrashed process eventually reaches `DONE`; `RealTermination` requires `Condition1`, meaning more than F processes initially hold the maximum proposed value; [conditional guarantee](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/cbc_max/cbc_max.tla#L167)", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/cbc_max/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/cbc_max/cbc_max.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/cf1s-folklore/APcf1s_folklore.tla", "specifies": "one-step consensus", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "35 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/cf1s-folklore/APcf1s_folklore.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/cf1s-folklore/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/cf1s-folklore/APcf1s_folklore.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/cf1s-folklore/cf1s_folklore.tla", "specifies": "one-step consensus", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "157 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/cf1s-folklore/cf1s_folklore.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/cf1s-folklore/cf1s_folklore.tla#L136))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/cf1s-folklore/manifest.json)", "configured_checks": "`INVARIANTS: TypeOK`; `PROPERTIES: OneStep0_Ltl OneStep1_Ltl`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/cf1s-folklore/cf1s_folklore.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/cf1s-folklore/cf1s_folklore.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/chang_roberts/APChangRoberts.tla", "specifies": "Chang-Roberts ring leader election", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "31 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/chang_roberts/APChangRoberts.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking symbolic; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/chang_roberts/manifest.json)", "configured_checks": "`INVARIANT: TypeOK`; `INVARIANT: Correctness`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/chang_roberts/APChangRoberts.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/chang_roberts/APChangRoberts.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/chang_roberts/ChangRoberts.tla", "specifies": "Chang-Roberts ring leader election", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+/PlusCal", "size": "143 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/chang_roberts/ChangRoberts.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/chang_roberts/ChangRoberts.tla#L121)); `Correctness` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/chang_roberts/ChangRoberts.tla#L131))", "liveness": "`Termination` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/chang_roberts/ChangRoberts.tla#L116)); `Liveness` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/chang_roberts/ChangRoberts.tla#L138))", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/chang_roberts/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/chang_roberts/ChangRoberts.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/chang_roberts/MCChangRoberts.tla", "specifies": "Chang-Roberts ring leader election", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "9 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/chang_roberts/MCChangRoberts.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/chang_roberts/manifest.json)", "configured_checks": "`INVARIANTS: TypeOK Correctness`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/chang_roberts/MCChangRoberts.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/chang_roberts/MCChangRoberts.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/dag-consensus/BlockDag.tla", "specifies": "DAG-based consensus", "artifact_kind": "support definitions or abstract interface", "tool": "TLA+", "size": "75 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dag-consensus/BlockDag.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dag-consensus/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dag-consensus/BlockDag.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/dag-consensus/BlockDagTest.tla", "specifies": "DAG-based consensus", "artifact_kind": "support definitions or abstract interface", "tool": "TLA+", "size": "54 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dag-consensus/BlockDagTest.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dag-consensus/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dag-consensus/BlockDagTest.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/dag-consensus/Digraph.tla", "specifies": "DAG-based consensus", "artifact_kind": "support definitions or abstract interface", "tool": "TLA+", "size": "35 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dag-consensus/Digraph.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dag-consensus/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dag-consensus/Digraph.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/dag-consensus/Sailfish.tla", "specifies": "DAG-based consensus", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+/PlusCal", "size": "231 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dag-consensus/Sailfish.tla)", "safety": "`TypeOK` is the type invariant; `Agreement` says correct nodes have compatible logs; `correctNode` is a protocol action, not a property; [definitions](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dag-consensus/Sailfish.tla#L212)", "liveness-related_condition": "after GST, for a round whose leader is nonfaulty, each correct node that has reached two rounds later has committed that leader vertex; [definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dag-consensus/Sailfish.tla#L227)", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dag-consensus/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dag-consensus/Sailfish.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/dag-consensus/TLCSailfish1.tla", "specifies": "DAG-based consensus", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "69 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dag-consensus/TLCSailfish1.tla)", "safety": "instantiated `TypeOK` and compatible-log `Agreement`; both enabled as TLC invariants", "liveness-related_condition": "imports Sailfish `Liveness`, conditional on round >= GST and a nonfaulty leader; nodes that reach two later rounds must have committed the leader vertex", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dag-consensus/manifest.json)", "configured_checks": "`INVARIANT: TypeOK`; `INVARIANT: Agreement`; `INVARIANT: Liveness`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dag-consensus/TLCSailfish1.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dag-consensus/TLCSailfish1.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/dag-consensus/TLCSailfish2.tla", "specifies": "DAG-based consensus", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "46 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dag-consensus/TLCSailfish2.tla)", "safety": "instantiated `TypeOK` and compatible-log `Agreement`; both enabled as TLC invariants", "liveness-related_condition": "imports Sailfish `Liveness`, conditional on round >= GST and a nonfaulty leader; nodes that reach two later rounds must have committed the leader vertex", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dag-consensus/manifest.json)", "configured_checks": "`INVARIANT: TypeOK`; `INVARIANT: Agreement`; `INVARIANT: Liveness`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dag-consensus/TLCSailfish2.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dag-consensus/TLCSailfish2.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/dag-consensus/Utils.tla", "specifies": "DAG-based consensus", "artifact_kind": "support definitions or abstract interface", "tool": "TLA+", "size": "8 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dag-consensus/Utils.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dag-consensus/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dag-consensus/Utils.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/detector_chan96/Age_Channel.tla", "specifies": "failure detection", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "64 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/detector_chan96/Age_Channel.tla)", "safety": "`Deliver` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/detector_chan96/Age_Channel.tla#L38)); `TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/detector_chan96/Age_Channel.tla#L56))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/detector_chan96/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/detector_chan96/Age_Channel.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/detector_chan96/EPFailureDetector.tla", "specifies": "failure detection", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "153 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/detector_chan96/EPFailureDetector.tla)", "safety": "`MakeAliveMsgsForAll` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/detector_chan96/EPFailureDetector.tla#L45)); `SendAlive` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/detector_chan96/EPFailureDetector.tla#L79)); `TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/detector_chan96/EPFailureDetector.tla#L143))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/detector_chan96/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/detector_chan96/EPFailureDetector.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/detector_chan96/EnvironmentController.tla", "specifies": "failure detection", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "340 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/detector_chan96/EnvironmentController.tla)", "safety": "`OnlyMessagesForCorrectProcesses` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/detector_chan96/EnvironmentController.tla#L217)); `TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/detector_chan96/EnvironmentController.tla#L311))", "liveness": "`EventuallyStrongAccuracy` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/detector_chan96/EnvironmentController.tla#L332))", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/detector_chan96/manifest.json)", "configured_checks": "`INVARIANT: TypeOK`; `PROPERTIES: StrongCompleteness EventuallyStrongAccuracy`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/detector_chan96/EnvironmentController.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/detector_chan96/EnvironmentController.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/dijkstra-mutex/DijkstraMutex.tla", "specifies": "Dijkstra mutual exclusion", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+/PlusCal", "size": "336 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dijkstra-mutex/DijkstraMutex.tla)", "safety": "`MutualExclusion` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dijkstra-mutex/DijkstraMutex.tla#L203))", "liveness": "`DeadlockFree` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dijkstra-mutex/DijkstraMutex.tla#L236)); `StarvationFree` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dijkstra-mutex/DijkstraMutex.tla#L264)); `DeadlockFreedom` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dijkstra-mutex/DijkstraMutex.tla#L314))", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dijkstra-mutex/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dijkstra-mutex/DijkstraMutex.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/dijkstra-mutex/DijkstraMutex.toolbox/LSpec-model/DijkstraMutex.tla", "specifies": "Dijkstra mutual exclusion", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+/PlusCal", "size": "330 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dijkstra-mutex/DijkstraMutex.toolbox/LSpec-model/DijkstraMutex.tla)", "safety": "`MutualExclusion` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dijkstra-mutex/DijkstraMutex.toolbox/LSpec-model/DijkstraMutex.tla#L205))", "liveness": "`DeadlockFree` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dijkstra-mutex/DijkstraMutex.toolbox/LSpec-model/DijkstraMutex.tla#L238)); `StarvationFree` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dijkstra-mutex/DijkstraMutex.toolbox/LSpec-model/DijkstraMutex.tla#L266)); `DeadlockFreedom` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dijkstra-mutex/DijkstraMutex.toolbox/LSpec-model/DijkstraMutex.tla#L312))", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dijkstra-mutex/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dijkstra-mutex/DijkstraMutex.toolbox/LSpec-model/DijkstraMutex.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/dijkstra-mutex/DijkstraMutex.toolbox/LSpec-model/MC.tla", "specifies": "Dijkstra mutual exclusion", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "28 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dijkstra-mutex/DijkstraMutex.toolbox/LSpec-model/MC.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dijkstra-mutex/manifest.json)", "configured_checks": "`INVARIANT: inv_1293897152959430000`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dijkstra-mutex/DijkstraMutex.toolbox/LSpec-model/MC.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dijkstra-mutex/DijkstraMutex.toolbox/LSpec-model/MC.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/dijkstra-mutex/DijkstraMutex.toolbox/Safety-4-processors/DijkstraMutex.tla", "specifies": "Dijkstra mutual exclusion", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+/PlusCal", "size": "330 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dijkstra-mutex/DijkstraMutex.toolbox/Safety-4-processors/DijkstraMutex.tla)", "safety": "`MutualExclusion` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dijkstra-mutex/DijkstraMutex.toolbox/Safety-4-processors/DijkstraMutex.tla#L205))", "liveness": "`DeadlockFree` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dijkstra-mutex/DijkstraMutex.toolbox/Safety-4-processors/DijkstraMutex.tla#L238)); `StarvationFree` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dijkstra-mutex/DijkstraMutex.toolbox/Safety-4-processors/DijkstraMutex.tla#L266)); `DeadlockFreedom` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dijkstra-mutex/DijkstraMutex.toolbox/Safety-4-processors/DijkstraMutex.tla#L312))", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dijkstra-mutex/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dijkstra-mutex/DijkstraMutex.toolbox/Safety-4-processors/DijkstraMutex.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/dijkstra-mutex/DijkstraMutex.toolbox/Safety-4-processors/MC.tla", "specifies": "Dijkstra mutual exclusion", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "24 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dijkstra-mutex/DijkstraMutex.toolbox/Safety-4-processors/MC.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dijkstra-mutex/manifest.json)", "configured_checks": "`INVARIANT: inv_1293897508027437000`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dijkstra-mutex/DijkstraMutex.toolbox/Safety-4-processors/MC.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/dijkstra-mutex/DijkstraMutex.toolbox/Safety-4-processors/MC.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/diskpaxos/DiskSynod.tla", "specifies": "Disk Paxos", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "132 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/diskpaxos/DiskSynod.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/diskpaxos/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/diskpaxos/DiskSynod.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/diskpaxos/HDiskSynod.tla", "specifies": "Disk Paxos", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "119 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/diskpaxos/HDiskSynod.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/diskpaxos/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/diskpaxos/HDiskSynod.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/diskpaxos/MC_HDiskSynod.tla", "specifies": "Disk Paxos", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "9 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/diskpaxos/MC_HDiskSynod.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/diskpaxos/manifest.json)", "configured_checks": "`INVARIANTS: HInv1 HInv2 HInv3 HInv4 HInv6`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/diskpaxos/MC_HDiskSynod.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/diskpaxos/MC_HDiskSynod.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/diskpaxos/Synod.tla", "specifies": "Disk Paxos", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "53 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/diskpaxos/Synod.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/diskpaxos/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/diskpaxos/Synod.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/echo/Echo.tla", "specifies": "distributed echo/termination detection", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+/PlusCal", "size": "200 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/echo/Echo.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/echo/Echo.tla#L160))", "liveness": "`Termination` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/echo/Echo.tla#L153))", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/echo/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/echo/Echo.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/echo/MCEcho.tla", "specifies": "distributed echo/termination detection", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "36 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/echo/MCEcho.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/echo/manifest.json)", "configured_checks": "`INVARIANT: TypeOK`; `INVARIANT: AncestorProperties`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/echo/MCEcho.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/echo/MCEcho.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/echo/Relation.tla", "specifies": "distributed echo/termination detection", "artifact_kind": "support definitions or abstract interface", "tool": "TLA+", "size": "63 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/echo/Relation.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/echo/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/echo/Relation.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/ewd426/APTokenRing.tla", "specifies": "Dijkstra self-stabilization", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "22 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd426/APTokenRing.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking symbolic; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd426/manifest.json)", "configured_checks": "`INVARIANT: TypeOK`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd426/APTokenRing.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd426/APTokenRing.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/ewd426/SimTokenRing.tla", "specifies": "Dijkstra self-stabilization", "artifact_kind": "support definitions or abstract interface", "tool": "TLA+", "size": "31 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd426/SimTokenRing.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking generate; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd426/manifest.json)", "configured_checks": "`INVARIANT: TypeOK`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd426/SimTokenRing.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd426/SimTokenRing.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/ewd426/TokenRing.tla", "specifies": "Dijkstra self-stabilization", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "63 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd426/TokenRing.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd426/TokenRing.tla#L21))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd426/manifest.json)", "configured_checks": "`INVARIANT: TypeOK`; `PROPERTIES: Stab`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd426/TokenRing.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd426/TokenRing.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/ewd687a/EWD687a.tla", "specifies": "Dijkstra-Scholten termination detection", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "471 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd687a/EWD687a.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd687a/EWD687a.tla#L255)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd687a/EWD687a.tla#L407)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd687a/EWD687a.tla#L429)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd687a/EWD687a.tla#L440))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd687a/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd687a/EWD687a.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/ewd687a/EWD687aPlusCal.tla", "specifies": "Dijkstra-Scholten termination detection", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+/PlusCal", "size": "185 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd687a/EWD687aPlusCal.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd687a/EWD687aPlusCal.tla#L158)); `TerminationDetection` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd687a/EWD687aPlusCal.tla#L174))", "liveness": "`Liveness` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd687a/EWD687aPlusCal.tla#L180))", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd687a/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd687a/EWD687aPlusCal.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/ewd687a/EWD687a_anim.tla", "specifies": "Dijkstra-Scholten termination detection", "artifact_kind": "support definitions or abstract interface", "tool": "TLA+", "size": "199 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd687a/EWD687a_anim.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking {'simulate': {'traceCount': 100}}; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd687a/manifest.json)", "configured_checks": "`INVARIANT: TypeOK`; `INVARIANT: DT1Inv`; `INVARIANT: InterestingBehavior`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd687a/EWD687a_anim.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd687a/EWD687a_anim.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/ewd687a/EWD687a_proof.tla", "specifies": "Dijkstra-Scholten termination detection", "artifact_kind": "proof module", "tool": "TLA+; TLAPS", "size": "399 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd687a/EWD687a_proof.tla)", "safety": "`Inv1` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd687a/EWD687a_proof.tla#L21)); `Invariant1` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd687a/EWD687a_proof.tla#L23)); `TypeCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd687a/EWD687a_proof.tla#L65)); `TreeInvariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd687a/EWD687a_proof.tla#L87)); `Safety` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd687a/EWD687a_proof.tla#L354))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "TLAPS proof target listed; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd687a/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd687a/EWD687a_proof.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/ewd687a/MCEWD687a.tla", "specifies": "Dijkstra-Scholten termination detection", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "20 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd687a/MCEWD687a.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd687a/manifest.json)", "configured_checks": "`INVARIANTS: TypeOK`; `INVARIANTS: CountersConsistent`; `INVARIANTS: TreeWithRoot`; `INVARIANTS: DT1Inv`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd687a/MCEWD687a.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd687a/MCEWD687a.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/ewd840/APEWD840.tla", "specifies": "Dijkstra ring termination detection", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "23 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd840/APEWD840.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking symbolic; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd840/manifest.json)", "configured_checks": "`INVARIANT: TypeOK`; `INVARIANT: TerminationDetection`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd840/APEWD840.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd840/APEWD840.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/ewd840/APSyncTerminationDetection.tla", "specifies": "Dijkstra ring termination detection", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "20 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd840/APSyncTerminationDetection.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking symbolic; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd840/manifest.json)", "configured_checks": "`INVARIANT: TypeOK`; `INVARIANT: TDCorrect`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd840/APSyncTerminationDetection.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd840/APSyncTerminationDetection.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/ewd840/EWD840.tla", "specifies": "Dijkstra ring termination detection", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "176 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd840/EWD840.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd840/EWD840.tla#L18)); `terminationDetected` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd840/EWD840.tla#L119)); `TerminationDetection` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd840/EWD840.tla#L123)); `Inv` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd840/EWD840.tla#L153))", "liveness": "`Liveness` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd840/EWD840.tla#L128)); `FalseLiveness` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd840/EWD840.tla#L135))", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd840/manifest.json)", "configured_checks": "`INVARIANTS: TypeOK`; `INVARIANTS: TerminationDetection`; `INVARIANTS: Inv`; `PROPERTIES: Liveness`; `PROPERTIES: TDSpec`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd840/EWD840.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd840/EWD840.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/ewd840/EWD840_anim.tla", "specifies": "Dijkstra ring termination detection", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "209 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd840/EWD840_anim.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking {'simulate': {'traceCount': 100}}; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd840/manifest.json)", "configured_checks": "`INVARIANT: AnimInv`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd840/EWD840_anim.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd840/EWD840_anim.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/ewd840/EWD840_json.tla", "specifies": "Dijkstra ring termination detection", "artifact_kind": "support definitions or abstract interface", "tool": "TLA+", "size": "29 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd840/EWD840_json.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd840/manifest.json)", "configured_checks": "`INVARIANT: JsonInv`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd840/EWD840_json.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd840/EWD840_json.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/ewd840/EWD840_proof.tla", "specifies": "Dijkstra ring termination detection", "artifact_kind": "proof module", "tool": "TLA+; TLAPS", "size": "316 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd840/EWD840_proof.tla)", "safety": "`TypeCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd840/EWD840_proof.tla#L13)); `Invariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd840/EWD840_proof.tla#L46)); `Safety` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd840/EWD840_proof.tla#L55))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "TLAPS proof target listed; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd840/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd840/EWD840_proof.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/ewd840/SyncTerminationDetection.tla", "specifies": "Dijkstra ring termination detection", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "66 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd840/SyncTerminationDetection.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd840/SyncTerminationDetection.tla#L17)); `DetectTermination` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd840/SyncTerminationDetection.tla#L42)); `TDCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd840/SyncTerminationDetection.tla#L58))", "liveness": "`Liveness` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd840/SyncTerminationDetection.tla#L62))", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd840/manifest.json)", "configured_checks": "`INVARIANTS: TypeOK`; `INVARIANTS: TDCorrect`; `PROPERTIES: Quiescence`; `PROPERTIES: Liveness`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd840/SyncTerminationDetection.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd840/SyncTerminationDetection.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/ewd840/SyncTerminationDetection_proof.tla", "specifies": "Dijkstra ring termination detection", "artifact_kind": "proof module", "tool": "TLA+; TLAPS", "size": "57 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd840/SyncTerminationDetection_proof.tla)", "safety": "`TypeCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd840/SyncTerminationDetection_proof.tla#L9)); `CorrectDetection` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd840/SyncTerminationDetection_proof.tla#L16))", "liveness": "`Live` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd840/SyncTerminationDetection_proof.tla#L46))", "evidence_status": "TLAPS proof target listed; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd840/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd840/SyncTerminationDetection_proof.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/ewd998/AsyncTerminationDetection.tla", "specifies": "Safra/Dijkstra ring termination detection", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "123 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/AsyncTerminationDetection.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/AsyncTerminationDetection.tla#L22)); `DetectTermination` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/AsyncTerminationDetection.tla#L57)); `Safe` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/AsyncTerminationDetection.tla#L85)); `StableActionInvariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/AsyncTerminationDetection.tla#L118))", "liveness": "`Live` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/AsyncTerminationDetection.tla#L89))", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/manifest.json)", "configured_checks": "`INVARIANTS: TypeOK`; `INVARIANTS: Safe`; `PROPERTIES: Quiescence`; `PROPERTIES: Live`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/AsyncTerminationDetection.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/AsyncTerminationDetection.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/ewd998/AsyncTerminationDetection_proof.tla", "specifies": "Safra/Dijkstra ring termination detection", "artifact_kind": "proof module", "tool": "TLA+; TLAPS", "size": "59 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/AsyncTerminationDetection_proof.tla)", "safety": "`TypeCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/AsyncTerminationDetection_proof.tla#L8)); `Safety` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/AsyncTerminationDetection_proof.tla#L19))", "liveness": "`Liveness` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/AsyncTerminationDetection_proof.tla#L46))", "evidence_status": "TLAPS proof target listed; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/AsyncTerminationDetection_proof.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/ewd998/EWD998.tla", "specifies": "Safra/Dijkstra ring termination detection", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "216 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998.tla#L33)); `terminationDetected` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998.tla#L130)); `Termination` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998.tla#L151)); `TerminationDetection` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998.tla#L155)); `Inv` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998.tla#L168))", "liveness": "`Liveness` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998.tla#L194))", "interpretation": "termination/detection identifiers in the safety field are state predicates; the separately stated leads-to formula supplies eventual detection", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/manifest.json)", "configured_checks": "`INVARIANT: TerminationDetection`; `INVARIANT: Inv`; `INVARIANT: TypeOK`; `PROPERTIES: Liveness`; `PROPERTIES: TDSpec`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998.cfg) | `INVARIANT: TerminationDetection`; `INVARIANT: Inv`; `INVARIANT: TypeOK`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998Small.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/ewd998/EWD998Chan.tla", "specifies": "Safra/Dijkstra ring termination detection", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "194 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998Chan.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998Chan.tla#L28))", "liveness": "the `EWD998Spec` refinement target includes eventual detection under its fairness assumptions; no separate local liveness alias defined; [refinement](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998Chan.tla#L190); [abstract progress](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998.tla#L194)", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/manifest.json)", "configured_checks": "`INVARIANT: TypeOK`; `PROPERTIES: EWD998Spec`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998Chan.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998Chan.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/ewd998/EWD998ChanID.tla", "specifies": "Safra/Dijkstra ring termination detection", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "274 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998ChanID.tla)", "safety": "`EWD998Safe` imports the termination-detector safety property: reported termination is correct; `terminationDetected` is a state predicate, not itself a progress guarantee; [alias](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998ChanID.tla#L264)", "liveness": "`EWD998Live` imports eventual detection after actual termination; the combined theorem states safety and liveness; [alias](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998ChanID.tla#L265)", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/manifest.json)", "configured_checks": "`INVARIANT: EWD998Safe`; `INVARIANT: Max3TokenRounds`; `PROPERTIES: EWD998ChanSpec`; `PROPERTIES: EWD998Live`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998ChanID.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998ChanID.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/ewd998/EWD998ChanID_export.tla", "specifies": "Safra/Dijkstra ring termination detection", "artifact_kind": "support definitions or abstract interface", "tool": "TLA+", "size": "58 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998ChanID_export.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "inherits `EWD998Live`, eventual detection after actual termination, from EWD998ChanID; this trace-export instance does not list that liveness check in its own configuration; [alias](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998ChanID.tla#L265)", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/manifest.json)", "configured_checks": "`INVARIANT: PostInv`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998ChanID_export.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998ChanID_export.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/ewd998/EWD998ChanID_shiviz.tla", "specifies": "Safra/Dijkstra ring termination detection", "artifact_kind": "support definitions or abstract interface", "tool": "TLA+", "size": "83 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998ChanID_shiviz.tla)", "safety": "`Inv` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998ChanID_shiviz.tla#L45))", "liveness": "inherits `EWD998Live`, eventual detection after actual termination, from EWD998ChanID; this trace-export instance does not list that liveness check in its own configuration; [alias](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998ChanID.tla#L265)", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/manifest.json)", "configured_checks": "`INVARIANT: Inv`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998ChanID_shiviz.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998ChanID_shiviz.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/ewd998/EWD998ChanTrace.tla", "specifies": "Safra/Dijkstra ring termination detection", "artifact_kind": "support definitions or abstract interface", "tool": "TLA+", "size": "318 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998ChanTrace.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998ChanTrace.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/ewd998/EWD998Chan_opts.tla", "specifies": "Safra/Dijkstra ring termination detection", "artifact_kind": "support definitions or abstract interface", "tool": "TLA+", "size": "138 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998Chan_opts.tla)", "safety": "`AtTermination` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998Chan_opts.tla#L92)); `AtTerminationDetected` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998Chan_opts.tla#L97))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998Chan_opts.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/ewd998/EWD998PCal.tla", "specifies": "Safra/Dijkstra ring termination detection", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+/PlusCal", "size": "170 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998PCal.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/manifest.json)", "configured_checks": "`PROPERTIES: EWD998Spec`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998PCal.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998PCal.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/ewd998/EWD998PCal_proof.tla", "specifies": "Safra/Dijkstra ring termination detection", "artifact_kind": "proof module", "tool": "TLA+; TLAPS", "size": "1,443 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998PCal_proof.tla)", "safety": "`PCalTypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998PCal_proof.tla#L87)); `InitTypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998PCal_proof.tla#L192)); `TypeOK_Step` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998PCal_proof.tla#L533)); `TypeCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998PCal_proof.tla#L1282))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "TLAPS proof target listed; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998PCal_proof.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/ewd998/EWD998_anim.tla", "specifies": "Safra/Dijkstra ring termination detection", "artifact_kind": "support definitions or abstract interface", "tool": "TLA+", "size": "541 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998_anim.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998_anim.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/ewd998/EWD998_opts.tla", "specifies": "Safra/Dijkstra ring termination detection", "artifact_kind": "support definitions or abstract interface", "tool": "TLA+", "size": "156 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998_opts.tla)", "safety": "`AtTermination` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998_opts.tla#L105)); `AtTerminationDetected` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998_opts.tla#L111))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998_opts.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/ewd998/EWD998_optsSC.tla", "specifies": "Safra/Dijkstra ring termination detection", "artifact_kind": "support definitions or abstract interface", "tool": "TLA+", "size": "59 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998_optsSC.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998_optsSC.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/ewd998/EWD998_proof.tla", "specifies": "Safra/Dijkstra ring termination detection", "artifact_kind": "proof module", "tool": "TLA+; TLAPS", "size": "882 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998_proof.tla)", "safety": "`TypeCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998_proof.tla#L12)); `Safety` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998_proof.tla#L406)); `TerminationDetectionInv` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998_proof.tla#L869)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998_proof.tla#L158))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "TLAPS proof target listed; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/EWD998_proof.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/ewd998/Folds.tla", "specifies": "Safra/Dijkstra ring termination detection", "artifact_kind": "support definitions or abstract interface", "tool": "TLA+", "size": "30 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/Folds.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/Folds.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/ewd998/SmokeEWD998.tla", "specifies": "Safra/Dijkstra ring termination detection", "artifact_kind": "support definitions or abstract interface", "tool": "TLA+", "size": "46 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/SmokeEWD998.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking {'simulate': {'traceCount': 100}}; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/manifest.json)", "configured_checks": "`INVARIANT: Inv`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/SmokeEWD998.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/SmokeEWD998.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/ewd998/SmokeEWD998_SC.tla", "specifies": "Safra/Dijkstra ring termination detection", "artifact_kind": "support definitions or abstract interface", "tool": "TLA+", "size": "35 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/SmokeEWD998_SC.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/SmokeEWD998_SC.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/ewd998/Utils.tla", "specifies": "Safra/Dijkstra ring termination detection", "artifact_kind": "support definitions or abstract interface", "tool": "TLA+", "size": "16 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/Utils.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/ewd998/Utils.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/lamport_mutex/APLamportMutex.tla", "specifies": "Lamport distributed mutual exclusion", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "27 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/lamport_mutex/APLamportMutex.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking symbolic; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/lamport_mutex/manifest.json)", "configured_checks": "`INVARIANT: Mutex`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/lamport_mutex/APLamportMutex.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/lamport_mutex/APLamportMutex.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/lamport_mutex/LamportMutex.tla", "specifies": "Lamport distributed mutual exclusion", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "184 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/lamport_mutex/LamportMutex.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/lamport_mutex/LamportMutex.tla#L47)); `Mutex` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/lamport_mutex/LamportMutex.tla#L182))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/lamport_mutex/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/lamport_mutex/LamportMutex.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/lamport_mutex/LamportMutex_proofs.tla", "specifies": "Lamport distributed mutual exclusion", "artifact_kind": "proof module", "tool": "TLA+; TLAPS", "size": "943 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/lamport_mutex/LamportMutex_proofs.tla)", "safety": "`TypeCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/lamport_mutex/LamportMutex_proofs.tla#L19)); `BasicInvariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/lamport_mutex/LamportMutex_proofs.tla#L265)); `ClockInvariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/lamport_mutex/LamportMutex_proofs.tla#L573)); `Safety` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/lamport_mutex/LamportMutex_proofs.tla#L862)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/lamport_mutex/LamportMutex_proofs.tla#L928))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "TLAPS proof target listed; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/lamport_mutex/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/lamport_mutex/LamportMutex_proofs.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/lamport_mutex/MCLamportMutex.tla", "specifies": "Lamport distributed mutual exclusion", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "7 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/lamport_mutex/MCLamportMutex.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/lamport_mutex/manifest.json)", "configured_checks": "`INVARIANTS: TypeOK BoundedNetwork Mutex`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/lamport_mutex/MCLamportMutex.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/lamport_mutex/MCLamportMutex.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/locks_auxiliary_vars/Lock.tla", "specifies": "lock refinement with auxiliary variables", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+/PlusCal; TLAPS", "size": "119 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/locks_auxiliary_vars/Lock.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/locks_auxiliary_vars/Lock.tla#L71)); `MutualExclusion` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/locks_auxiliary_vars/Lock.tla#L92))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "TLAPS proof target listed; model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/locks_auxiliary_vars/manifest.json)", "configured_checks": "`INVARIANTS: TypeOK LockInv`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/locks_auxiliary_vars/Lock.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/locks_auxiliary_vars/Lock.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/locks_auxiliary_vars/LockHS.tla", "specifies": "lock refinement with auxiliary variables", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+; TLAPS", "size": "403 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/locks_auxiliary_vars/LockHS.tla)", "safety": "`TypeOKHS` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/locks_auxiliary_vars/LockHS.tla#L99)); `MutualExclusionHS` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/locks_auxiliary_vars/LockHS.tla#L201))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "TLAPS proof target listed; model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/locks_auxiliary_vars/manifest.json)", "configured_checks": "`INVARIANTS: TypeOKHS InvHS LockInv`; `PROPERTIES: Spec PSpec`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/locks_auxiliary_vars/LockHS.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/locks_auxiliary_vars/LockHS.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/locks_auxiliary_vars/Peterson.tla", "specifies": "lock refinement with auxiliary variables", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+/PlusCal; TLAPS", "size": "191 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/locks_auxiliary_vars/Peterson.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/locks_auxiliary_vars/Peterson.tla#L85)); `Inv` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/locks_auxiliary_vars/Peterson.tla#L92)); `IndInvariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/locks_auxiliary_vars/Peterson.tla#L122))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "TLAPS proof target listed; model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/locks_auxiliary_vars/manifest.json)", "configured_checks": "`INVARIANTS: TypeOK Inv`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/locks_auxiliary_vars/Peterson.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/locks_auxiliary_vars/Peterson.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/locks_auxiliary_vars/Stuttering.tla", "specifies": "lock refinement with auxiliary variables", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "192 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/locks_auxiliary_vars/Stuttering.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/locks_auxiliary_vars/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/locks_auxiliary_vars/Stuttering.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/nbacc_ray97/nbacc_ray97.tla", "specifies": "nonblocking atomic commitment", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "135 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/nbacc_ray97/nbacc_ray97.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/nbacc_ray97/nbacc_ray97.tla#L114)); `Validity` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/nbacc_ray97/nbacc_ray97.tla#L120))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/nbacc_ray97/manifest.json)", "configured_checks": "`INVARIANT: TypeOK`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/nbacc_ray97/nbacc_ray97.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/nbacc_ray97/nbacc_ray97.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/nbacg_guer01/APnbacg_guer01.tla", "specifies": "nonblocking atomic commitment", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "31 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/nbacg_guer01/APnbacg_guer01.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking symbolic; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/nbacg_guer01/manifest.json)", "configured_checks": "`INVARIANT: TypeOK`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/nbacg_guer01/APnbacg_guer01.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/nbacg_guer01/APnbacg_guer01.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/nbacg_guer01/nbacg_guer01.tla", "specifies": "nonblocking atomic commitment", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "213 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/nbacg_guer01/nbacg_guer01.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/nbacg_guer01/nbacg_guer01.tla#L187)); `AbortValidityLtl` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/nbacg_guer01/nbacg_guer01.tla#L202)); `CommitValidityLtl` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/nbacg_guer01/nbacg_guer01.tla#L206))", "liveness": "`TerminationLtl` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/nbacg_guer01/nbacg_guer01.tla#L210))", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/nbacg_guer01/manifest.json)", "configured_checks": "`INVARIANT: TypeOK`; `PROPERTIES: AgrrLtl AbortValidityLtl CommitValidityLtl TerminationLtl`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/nbacg_guer01/nbacg_guer01.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/nbacg_guer01/nbacg_guer01.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/spanning/APspanning.tla", "specifies": "distributed spanning-tree construction", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "35 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/spanning/APspanning.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking symbolic; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/spanning/manifest.json)", "configured_checks": "`INVARIANT: TypeOK`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/spanning/APspanning.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/spanning/APspanning.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/spanning/MC_spanning.tla", "specifies": "distributed spanning-tree construction", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "4 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/spanning/MC_spanning.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/spanning/manifest.json)", "configured_checks": "`INVARIANTS: TypeOK SntMsg`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/spanning/MC_spanning.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/spanning/MC_spanning.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/spanning/spanning.tla", "specifies": "distributed spanning-tree construction", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "48 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/spanning/spanning.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/spanning/spanning.tla#L36))", "liveness": "`Termination` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/spanning/spanning.tla#L40))", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/spanning/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/spanning/spanning.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/spanning/spanning_proof.tla", "specifies": "distributed spanning-tree construction", "artifact_kind": "proof module", "tool": "TLA+; TLAPS", "size": "157 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/spanning/spanning_proof.tla)", "safety": "`Inv` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/spanning/spanning_proof.tla#L28)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/spanning/spanning_proof.tla#L149))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "TLAPS proof target listed; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/spanning/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/spanning/spanning_proof.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/tcp/APtcp.tla", "specifies": "TCP connection/protocol model", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "24 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/tcp/APtcp.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking symbolic; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/tcp/manifest.json)", "configured_checks": "`INVARIANT: Inv`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/tcp/APtcp.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/tcp/APtcp.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/tcp/IndInv_apa.tla", "specifies": "TCP connection/protocol model", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "220 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/tcp/IndInv_apa.tla)", "safety": "`TypeOKBounded` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/tcp/IndInv_apa.tla#L101))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/tcp/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/tcp/IndInv_apa.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/tcp/MCtcp.tla", "specifies": "TCP connection/protocol model", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "32 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/tcp/MCtcp.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/tcp/manifest.json)", "configured_checks": "`INVARIANT: TypeOK`; `INVARIANT: Inv`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/tcp/MCtcp.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/tcp/MCtcp.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/tcp/tcp.tla", "specifies": "TCP connection/protocol model", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "330 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/tcp/tcp.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/tcp/tcp.tla#L27)); `Inv` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/tcp/tcp.tla#L267))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification/support module; no proof target or model result attached to this module in manifest; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/tcp/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/tcp/tcp.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/tcp/tcp_proof.tla", "specifies": "TCP connection/protocol model", "artifact_kind": "proof module", "tool": "TLA+; TLAPS", "size": "5,661 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/tcp/tcp_proof.tla)", "safety": "`PrefixOneNonEmpty` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/tcp/tcp_proof.tla#L42)); `PrefixTwoNonEmpty` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/tcp/tcp_proof.tla#L63)); `TypeOKInductive` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/tcp/tcp_proof.tla#L83)); `TypeCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/tcp/tcp_proof.tla#L322)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/tcp/tcp_proof.tla#L5648)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/tcp/tcp_proof.tla#L5655))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "TLAPS proof target listed; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/tcp/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/tcp/tcp_proof.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/transaction_commit/2PCwithBTM.tla", "specifies": "transaction commit: abstract commit, two-phase and Paxos commit", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+/PlusCal", "size": "199 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/transaction_commit/2PCwithBTM.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/transaction_commit/2PCwithBTM.tla#L176)); `Consistency` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/transaction_commit/2PCwithBTM.tla#L183))", "liveness": "`Termination` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/transaction_commit/2PCwithBTM.tla#L169))", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/transaction_commit/manifest.json)", "configured_checks": "`INVARIANTS: TypeOK Consistency`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/transaction_commit/2PCwithBTM.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/transaction_commit/2PCwithBTM.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/transaction_commit/APTCommit.tla", "specifies": "transaction commit: abstract commit, two-phase and Paxos commit", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "18 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/transaction_commit/APTCommit.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking symbolic; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/transaction_commit/manifest.json)", "configured_checks": "`INVARIANT: TCTypeOK`; `INVARIANT: TCConsistent`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/transaction_commit/APTCommit.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/transaction_commit/APTCommit.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/transaction_commit/PaxosCommit.tla", "specifies": "transaction commit: abstract commit, two-phase and Paxos commit", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "281 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/transaction_commit/PaxosCommit.tla)", "safety": "`PCTypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/transaction_commit/PaxosCommit.tla#L84)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/transaction_commit/PaxosCommit.tla#L268))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/transaction_commit/manifest.json)", "configured_checks": "`INVARIANT: PCTypeOK`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/transaction_commit/PaxosCommit.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/transaction_commit/PaxosCommit.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/transaction_commit/PaxosCommit_proof.tla", "specifies": "transaction commit: abstract commit, two-phase and Paxos commit", "artifact_kind": "proof module", "tool": "TLA+; TLAPS", "size": "529 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/transaction_commit/PaxosCommit_proof.tla)", "safety": "`Inv` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/transaction_commit/PaxosCommit_proof.tla#L42)); `TypeOK_Invariant` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/transaction_commit/PaxosCommit_proof.tla#L513)); `TypeOK_Init` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/transaction_commit/PaxosCommit_proof.tla#L526))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "TLAPS proof target listed; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/transaction_commit/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/transaction_commit/PaxosCommit_proof.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/transaction_commit/TCommit.tla", "specifies": "transaction commit: abstract commit, two-phase and Paxos commit", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "66 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/transaction_commit/TCommit.tla)", "safety": "`TCTypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/transaction_commit/TCommit.tla#L5)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/transaction_commit/TCommit.tla#L62))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/transaction_commit/manifest.json)", "configured_checks": "`INVARIANTS: TCTypeOK TCConsistent`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/transaction_commit/TCommit.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/transaction_commit/TCommit.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/transaction_commit/TCommit_proof.tla", "specifies": "transaction commit: abstract commit, two-phase and Paxos commit", "artifact_kind": "proof module", "tool": "TLA+; TLAPS", "size": "31 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/transaction_commit/TCommit_proof.tla)", "safety": "`Inv` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/transaction_commit/TCommit_proof.tla#L9)); `TCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/transaction_commit/TCommit_proof.tla#L11))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "TLAPS proof target listed; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/transaction_commit/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/transaction_commit/TCommit_proof.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/transaction_commit/TwoPhase.tla", "specifies": "transaction commit: abstract commit, two-phase and Paxos commit", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "176 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/transaction_commit/TwoPhase.tla)", "safety": "`TPTypeOK` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/transaction_commit/TwoPhase.tla#L53)); `theorem` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/transaction_commit/TwoPhase.tla#L149))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "model checking exhaustive search; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/transaction_commit/manifest.json)", "configured_checks": "`INVARIANT: TPTypeOK`; [configuration](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/transaction_commit/TwoPhase.cfg)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/transaction_commit/TwoPhase.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-Examples / specifications/transaction_commit/TwoPhase_proof.tla", "specifies": "transaction commit: abstract commit, two-phase and Paxos commit", "artifact_kind": "proof module", "tool": "TLA+; TLAPS", "size": "154 physical lines; [exact source](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/transaction_commit/TwoPhase_proof.tla)", "safety": "`TypeCorrect` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/transaction_commit/TwoPhase_proof.tla#L28)); `Inv` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/transaction_commit/TwoPhase_proof.tla#L83)); `Consistency` ([definition](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/transaction_commit/TwoPhase_proof.tla#L143))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "TLAPS proof target listed; [manifest](https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/transaction_commit/manifest.json)", "source_url": "https://github.com/tlaplus/Examples/blob/6a7b26a31c1a6aeec789b455e9bbfa3b3ad2728f/specifications/transaction_commit/TwoPhase_proof.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-tlapm / examples/Allocator.tla", "specifies": "resource allocation", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+; TLAPS", "size": "297 physical lines; [exact source](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/Allocator.tla)", "safety": "`TypeInvariant` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/Allocator.tla#L30)); `Mutex` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/Allocator.tla#L90)); `InitTypeInvariant` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/Allocator.tla#L127)); `RequestTypeInvariant` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/Allocator.tla#L130)); `AllocateTypeInvariant` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/Allocator.tla#L136)); `ReturnTypeInvariant` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/Allocator.tla#L142)); `NextTypeInvariant` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/Allocator.tla#L148)); `TypeOK` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/Allocator.tla#L167)); `InitMutex` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/Allocator.tla#L172)); `RequestMutexBis` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/Allocator.tla#L175)); `ReturnMutex` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/Allocator.tla#L181)); `AllocateMutex` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/Allocator.tla#L205)); `NextMutex` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/Allocator.tla#L279)); `MutualExclusion` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/Allocator.tla#L286)); `theorem` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/Allocator.tla#L290))", "liveness": "`InfOftenSatisfied` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/Allocator.tla#L100))", "evidence_status": "proof-language content present; completion and successful machine checking not independently established", "source_url": "https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/Allocator.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-tlapm / examples/AtomicBakery.tla", "specifies": "Bakery mutual exclusion variant", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+/PlusCal; TLAPS", "size": "279 physical lines; [exact source](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/AtomicBakery.tla)", "safety": "`MutualExclusion` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/AtomicBakery.tla#L175)); `TypeOK` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/AtomicBakery.tla#L184)); `Inv` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/AtomicBakery.tla#L238)); `theorem` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/AtomicBakery.tla#L195)); `theorem` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/AtomicBakery.tla#L248))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "proof-language content present; completion and successful machine checking not independently established", "source_url": "https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/AtomicBakery.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-tlapm / examples/AtomicBakeryWithoutSMT.tla", "specifies": "Bakery mutual exclusion variant", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+/PlusCal; TLAPS", "size": "651 physical lines; [exact source](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/AtomicBakeryWithoutSMT.tla)", "safety": "`MutualExclusion` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/AtomicBakeryWithoutSMT.tla#L158)); `TypeOK` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/AtomicBakeryWithoutSMT.tla#L162)); `Inv` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/AtomicBakeryWithoutSMT.tla#L197)); `InitImpliesTypeOK` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/AtomicBakeryWithoutSMT.tla#L248)); `TypeOKInvariant` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/AtomicBakeryWithoutSMT.tla#L266)); `InductiveInvariant` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/AtomicBakeryWithoutSMT.tla#L345)); `Safety` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/AtomicBakeryWithoutSMT.tla#L644)); `theorem` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/AtomicBakeryWithoutSMT.tla#L330))", "liveness": "`Termination` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/AtomicBakeryWithoutSMT.tla#L154))", "evidence_status": "proof-language content present; completion and successful machine checking not independently established", "source_url": "https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/AtomicBakeryWithoutSMT.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-tlapm / examples/Bakery.tla", "specifies": "Bakery mutual exclusion variant", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+/PlusCal; TLAPS", "size": "383 physical lines; [exact source](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/Bakery.tla)", "safety": "`MutualExclusion` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/Bakery.tla#L238)); `TypeOK` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/Bakery.tla#L247)); `Inv` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/Bakery.tla#L298)); `theorem` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/Bakery.tla#L307))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "proof-language content present; completion and successful machine checking not independently established", "source_url": "https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/Bakery.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-tlapm / examples/ByzPaxos/BPConProof.tla", "specifies": "Byzantine/Paxos consensus refinement and voting proof", "artifact_kind": "proof module", "tool": "TLA+/PlusCal; TLAPS", "size": "2,191 physical lines; [exact source](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/ByzPaxos/BPConProof.tla)", "safety": "`KnowsSafeAt` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/ByzPaxos/BPConProof.tla#L258)); `KnowsSafeAt` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/ByzPaxos/BPConProof.tla#L434)); `TypeOK` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/ByzPaxos/BPConProof.tla#L832)); `Inv` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/ByzPaxos/BPConProof.tla#L941)); `KnowsSafeAtDef` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/ByzPaxos/BPConProof.tla#L1045)); `theorem` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/ByzPaxos/BPConProof.tla#L1326))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "proof-language content present; completion and successful machine checking not independently established", "source_url": "https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/ByzPaxos/BPConProof.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-tlapm / examples/ByzPaxos/Consensus.tla", "specifies": "Byzantine/Paxos consensus refinement and voting proof", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+/PlusCal; TLAPS", "size": "246 physical lines; [exact source](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/ByzPaxos/Consensus.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/ByzPaxos/Consensus.tla#L105)); `Inv` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/ByzPaxos/Consensus.tla#L108)); `theorem` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/ByzPaxos/Consensus.tla#L156)); `theorem` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/ByzPaxos/Consensus.tla#L208))", "liveness": "`Success` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/ByzPaxos/Consensus.tla#L172)); `LiveSpecEquals` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/ByzPaxos/Consensus.tla#L233))", "evidence_status": "proof-language content present; completion and successful machine checking not independently established", "source_url": "https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/ByzPaxos/Consensus.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-tlapm / examples/ByzPaxos/PConProof.tla", "specifies": "Byzantine/Paxos consensus refinement and voting proof", "artifact_kind": "proof module", "tool": "TLA+/PlusCal; TLAPS", "size": "612 physical lines; [exact source](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/ByzPaxos/PConProof.tla)", "safety": "`ShowsSafeAt` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/ByzPaxos/PConProof.tla#L202)); `ShowsSafeAt` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/ByzPaxos/PConProof.tla#L325)); `TypeOK` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/ByzPaxos/PConProof.tla#L443)); `theorem` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/ByzPaxos/PConProof.tla#L511)); `theorem` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/ByzPaxos/PConProof.tla#L517)); `theorem` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/ByzPaxos/PConProof.tla#L526))", "liveness": "`Liveness` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/ByzPaxos/PConProof.tla#L572)); `CLiveness` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/ByzPaxos/PConProof.tla#L611))", "evidence_status": "proof-language content present; completion and successful machine checking not independently established", "source_url": "https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/ByzPaxos/PConProof.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-tlapm / examples/ByzPaxos/VoteProof.tla", "specifies": "Byzantine/Paxos consensus refinement and voting proof", "artifact_kind": "proof module", "tool": "TLA+/PlusCal; TLAPS", "size": "1,494 physical lines; [exact source](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/ByzPaxos/VoteProof.tla)", "safety": "`SafeAt` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/ByzPaxos/VoteProof.tla#L130)); `SafeAt` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/ByzPaxos/VoteProof.tla#L212)); `SafeAtProp` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/ByzPaxos/VoteProof.tla#L273)); `TypeOK` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/ByzPaxos/VoteProof.tla#L321)); `SafeLemma` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/ByzPaxos/VoteProof.tla#L342)); `SafeAtPropPrime` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/ByzPaxos/VoteProof.tla#L572)); `theorem` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/ByzPaxos/VoteProof.tla#L526)); `theorem` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/ByzPaxos/VoteProof.tla#L907)); `theorem` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/ByzPaxos/VoteProof.tla#L1048))", "liveness": "`EventuallyAlwaysForall` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/ByzPaxos/VoteProof.tla#L1171)); `Liveness` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/ByzPaxos/VoteProof.tla#L1208)); `LiveSpec` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/ByzPaxos/VoteProof.tla#L1133)) (assumption-bearing liveness specification, not a safety property)", "evidence_status": "proof-language content present; 6 `OMITTED` occurrences; incomplete proof steps present; completion and successful machine checking not independently established", "source_url": "https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/ByzPaxos/VoteProof.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-tlapm / examples/Dekker/Dekker.tla", "specifies": "Dekker two-process mutex with starvation freedom", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+; TLAPS", "size": "978 physical lines; [exact source](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/Dekker/Dekker.tla)", "safety": "`Inv` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/Dekker/Dekker.tla#L131)); `MutualExclusion` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/Dekker/Dekker.tla#L173)); `Enabledness` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/Dekker/Dekker.tla#L193)); `NotStuck` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/Dekker/Dekker.tla#L196))", "liveness": "`StFr1` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/Dekker/Dekker.tla#L132)); `StFr2` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/Dekker/Dekker.tla#L133)); `StarvationFreedom` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/Dekker/Dekker.tla#L422))", "evidence_status": "proof-language content present; 2 `OMITTED` occurrences; incomplete proof steps present; completion and successful machine checking not independently established", "source_url": "https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/Dekker/Dekker.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-tlapm / examples/EWD840.tla", "specifies": "ring termination detection", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+; TLAPS", "size": "199 physical lines; [exact source](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/EWD840.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/EWD840.tla#L12)); `terminationDetected` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/EWD840.tla#L99)); `TerminationDetection` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/EWD840.tla#L103)); `Inv` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/EWD840.tla#L125)); `TypeOK_inv` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/EWD840.tla#L133)); `Inv_implies_Termination` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/EWD840.tla#L167)); `theorem` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/EWD840.tla#L144))", "liveness": "`Liveness` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/EWD840.tla#L109))", "evidence_status": "proof-language content present; completion and successful machine checking not independently established", "source_url": "https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/EWD840.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-tlapm / examples/Peterson.tla", "specifies": "Peterson two-process mutex", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+/PlusCal; TLAPS", "size": "199 physical lines; [exact source](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/Peterson.tla)", "safety": "`MutualExclusion` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/Peterson.tla#L91)); `TypeOK` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/Peterson.tla#L106)); `Inv` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/Peterson.tla#L116)); `theorem` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/Peterson.tla#L123)); `theorem` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/Peterson.tla#L172))", "liveness": "`Liveness1` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/Peterson.tla#L99)); `Liveness` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/Peterson.tla#L100))", "evidence_status": "proof-language content present; completion and successful machine checking not independently established", "source_url": "https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/Peterson.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-tlapm / examples/SimpleEventually.tla", "specifies": "small temporal-progress proof example", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+; TLAPS", "size": "73 physical lines; [exact source](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/SimpleEventually.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/SimpleEventually.tla#L9)); `TypeCorrect` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/SimpleEventually.tla#L47))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "proof-language content present; completion and successful machine checking not independently established", "source_url": "https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/SimpleEventually.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-tlapm / examples/SimpleEventuallyInt.tla", "specifies": "small temporal-progress proof example", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+; TLAPS", "size": "77 physical lines; [exact source](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/SimpleEventuallyInt.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "proof-language content present; completion and successful machine checking not independently established", "source_url": "https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/SimpleEventuallyInt.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-tlapm / examples/SimpleMutex.tla", "specifies": "mutual exclusion", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+/PlusCal; TLAPS", "size": "180 physical lines; [exact source](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/SimpleMutex.tla)", "safety": "`TypeOK` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/SimpleMutex.tla#L61)); `Inv` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/SimpleMutex.tla#L65)); `MutualExclusion` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/SimpleMutex.tla#L84)); `Mutex` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/SimpleMutex.tla#L90)); `Safety` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/SimpleMutex.tla#L177)); `theorem` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/SimpleMutex.tla#L81)); `theorem` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/SimpleMutex.tla#L98)); `theorem` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/SimpleMutex.tla#L139)); `theorem` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/SimpleMutex.tla#L170))", "liveness": "`Termination` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/SimpleMutex.tla#L57))", "evidence_status": "proof-language content present; completion and successful machine checking not independently established", "source_url": "https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/SimpleMutex.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-tlapm / examples/paxos/Consensus.tla", "specifies": "Paxos consensus safety/refinement", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "22 physical lines; [exact source](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/paxos/Consensus.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification or model-checking instance; no TLAPS proof-language content found in this file", "source_url": "https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/paxos/Consensus.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-tlapm / examples/paxos/Paxos.tla", "specifies": "Paxos consensus safety/refinement", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+; TLAPS", "size": "530 physical lines; [exact source](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/paxos/Paxos.tla)", "safety": "`Consistency` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/paxos/Paxos.tla#L140)); `TypeOK` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/paxos/Paxos.tla#L152)); `SafeAt` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/paxos/Paxos.tla#L169)); `Inv` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/paxos/Paxos.tla#L223)); `SafeAtStable` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/paxos/Paxos.tla#L230)); `Invariant` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/paxos/Paxos.tla#L282)); `theorem` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/paxos/Paxos.tla#L465))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "proof-language content present; completion and successful machine checking not independently established", "source_url": "https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/paxos/Paxos.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-tlapm / examples/two_phase/Alternate.tla", "specifies": "two-phase handshake/abstract alternation", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "34 physical lines; [exact source](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/two_phase/Alternate.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification or model-checking instance; no TLAPS proof-language content found in this file", "source_url": "https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/two_phase/Alternate.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "tlaplus-tlapm / examples/two_phase/TwoPhase.tla", "specifies": "two-phase handshake/abstract alternation", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+; TLAPS", "size": "128 physical lines; [exact source](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/two_phase/TwoPhase.tla)", "safety": "`Inv` ([definition](https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/two_phase/TwoPhase.tla#L50))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "proof-language content present; completion and successful machine checking not independently established", "source_url": "https://github.com/tlaplus/tlapm/blob/d8b9747a1dce9b4816bcc1ff130ccf7a3af2ce37/examples/two_phase/TwoPhase.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "ongardie-raft.tla / raft.tla", "specifies": "Raft leader election, log replication, restart and lossy/duplicating network", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "471 physical lines; [exact source](https://github.com/ongardie/raft.tla/blob/6ecbdbcf1bcde2910367cdfd67f31b0bae447ddd/raft.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification or model-checking instance; no TLAPS proof-language content found in this file", "source_url": "https://github.com/ongardie/raft.tla/blob/6ecbdbcf1bcde2910367cdfd67f31b0bae447ddd/raft.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "pingcap-tla-plus / CollapseRollbacks/CollapseRollbacks.tla", "specifies": "TiDB/TiKV CollapseRollbacks protocol", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "507 physical lines; [exact source](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/CollapseRollbacks/CollapseRollbacks.tla)", "safety": "`TypeInvariant` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/CollapseRollbacks/CollapseRollbacks.tla#L395)); `WriteConsistency` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/CollapseRollbacks/CollapseRollbacks.tla#L410)); `LockConsistency` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/CollapseRollbacks/CollapseRollbacks.tla#L422)); `CommittedConsistency` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/CollapseRollbacks/CollapseRollbacks.tla#L435)); `AbortedConsistency` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/CollapseRollbacks/CollapseRollbacks.tla#L464)); `RollbackConsistency` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/CollapseRollbacks/CollapseRollbacks.tla#L472)); `Safety` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/CollapseRollbacks/CollapseRollbacks.tla#L499))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification or model-checking instance; no TLAPS proof-language content found in this file", "source_url": "https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/CollapseRollbacks/CollapseRollbacks.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "pingcap-tla-plus / CollapseRollbacks/Test1.tla", "specifies": "TiDB/TiKV CollapseRollbacks protocol model-checking instance", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "16 physical lines; [exact source](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/CollapseRollbacks/Test1.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification or model-checking instance; no TLAPS proof-language content found in this file", "configured_checks": "`INVARIANT: TypeInvariant`; `INVARIANT: WriteConsistency`; `INVARIANT: LockConsistency`; `INVARIANT: CommittedConsistency`; `INVARIANT: AbortedConsistency`; `INVARIANT: RollbackConsistency`; `INVARIANT: UniqueWrite`; `INVARIANT: SnapshotIsolation`; [configuration](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/CollapseRollbacks/Test1.cfg)", "source_url": "https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/CollapseRollbacks/Test1.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "pingcap-tla-plus / CollapseRollbacks/Test2.tla", "specifies": "TiDB/TiKV CollapseRollbacks protocol model-checking instance", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "14 physical lines; [exact source](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/CollapseRollbacks/Test2.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification or model-checking instance; no TLAPS proof-language content found in this file", "configured_checks": "`INVARIANT: TypeInvariant`; `INVARIANT: WriteConsistency`; `INVARIANT: LockConsistency`; `INVARIANT: CommittedConsistency`; `INVARIANT: AbortedConsistency`; `INVARIANT: RollbackConsistency`; `INVARIANT: UniqueWrite`; `INVARIANT: SnapshotIsolation`; [configuration](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/CollapseRollbacks/Test2.cfg)", "source_url": "https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/CollapseRollbacks/Test2.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "pingcap-tla-plus / ConcurrentPercolator/ConcurrentPercolator.tla", "specifies": "TiDB/TiKV ConcurrentPercolator protocol", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "455 physical lines; [exact source](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/ConcurrentPercolator/ConcurrentPercolator.tla)", "safety": "`TypeInvariant` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/ConcurrentPercolator/ConcurrentPercolator.tla#L343)); `WriteConsistency` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/ConcurrentPercolator/ConcurrentPercolator.tla#L358)); `LockConsistency` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/ConcurrentPercolator/ConcurrentPercolator.tla#L370)); `CommittedConsistency` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/ConcurrentPercolator/ConcurrentPercolator.tla#L383)); `AbortedConsistency` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/ConcurrentPercolator/ConcurrentPercolator.tla#L412)); `RollbackConsistency` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/ConcurrentPercolator/ConcurrentPercolator.tla#L420)); `Safety` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/ConcurrentPercolator/ConcurrentPercolator.tla#L447))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification or model-checking instance; no TLAPS proof-language content found in this file", "source_url": "https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/ConcurrentPercolator/ConcurrentPercolator.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "pingcap-tla-plus / ConcurrentPercolator/Test1.tla", "specifies": "TiDB/TiKV ConcurrentPercolator protocol model-checking instance", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "16 physical lines; [exact source](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/ConcurrentPercolator/Test1.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification or model-checking instance; no TLAPS proof-language content found in this file", "configured_checks": "`INVARIANT: TypeInvariant`; `INVARIANT: WriteConsistency`; `INVARIANT: LockConsistency`; `INVARIANT: CommittedConsistency`; `INVARIANT: AbortedConsistency`; `INVARIANT: RollbackConsistency`; `INVARIANT: UniqueWrite`; `INVARIANT: SnapshotIsolation`; [configuration](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/ConcurrentPercolator/Test1.cfg)", "source_url": "https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/ConcurrentPercolator/Test1.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "pingcap-tla-plus / ConcurrentPercolator/Test2.tla", "specifies": "TiDB/TiKV ConcurrentPercolator protocol model-checking instance", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "14 physical lines; [exact source](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/ConcurrentPercolator/Test2.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification or model-checking instance; no TLAPS proof-language content found in this file", "configured_checks": "`INVARIANT: TypeInvariant`; `INVARIANT: WriteConsistency`; `INVARIANT: LockConsistency`; `INVARIANT: CommittedConsistency`; `INVARIANT: AbortedConsistency`; `INVARIANT: RollbackConsistency`; `INVARIANT: UniqueWrite`; `INVARIANT: SnapshotIsolation`; [configuration](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/ConcurrentPercolator/Test2.cfg)", "source_url": "https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/ConcurrentPercolator/Test2.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "pingcap-tla-plus / DistributedTransaction/DistributedTransaction.tla", "specifies": "TiDB/TiKV DistributedTransaction protocol", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "891 physical lines; [exact source](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/DistributedTransaction/DistributedTransaction.tla)", "safety": "`TypeOK` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/DistributedTransaction/DistributedTransaction.tla#L181)); `CommitConsistency` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/DistributedTransaction/DistributedTransaction.tla#L797)); `AbortConsistency` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/DistributedTransaction/DistributedTransaction.tla#L812)); `WriteConsistency` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/DistributedTransaction/DistributedTransaction.tla#L822)); `MsgTsConsistency` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/DistributedTransaction/DistributedTransaction.tla#L848)); `Safety` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/DistributedTransaction/DistributedTransaction.tla#L880))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification or model-checking instance; no TLAPS proof-language content found in this file", "source_url": "https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/DistributedTransaction/DistributedTransaction.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "pingcap-tla-plus / DistributedTransaction/Test1.tla", "specifies": "TiDB/TiKV DistributedTransaction protocol model-checking instance", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "13 physical lines; [exact source](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/DistributedTransaction/Test1.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification or model-checking instance; no TLAPS proof-language content found in this file", "configured_checks": "`INVARIANT: TypeOK`; `INVARIANT: UniqueCommitOrAbort`; `INVARIANT: CommitConsistency`; `INVARIANT: AbortConsistency`; `INVARIANT: WriteConsistency`; `INVARIANT: UniqueLockOrWrite`; `INVARIANT: UniqueWrite`; `INVARIANT: OptimisticReadSnapshotIsolation`; `INVARIANT: PessimisticReadSnapshotIsolation`; `INVARIANT: MsgTsConsistency`; [configuration](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/DistributedTransaction/Test1.cfg)", "source_url": "https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/DistributedTransaction/Test1.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "pingcap-tla-plus / DistributedTransaction/Test2.tla", "specifies": "TiDB/TiKV DistributedTransaction protocol model-checking instance", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "13 physical lines; [exact source](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/DistributedTransaction/Test2.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification or model-checking instance; no TLAPS proof-language content found in this file", "configured_checks": "`INVARIANT: TypeOK`; `INVARIANT: UniqueCommitOrAbort`; `INVARIANT: CommitConsistency`; `INVARIANT: AbortConsistency`; `INVARIANT: WriteConsistency`; `INVARIANT: UniqueLockOrWrite`; `INVARIANT: UniqueWrite`; `INVARIANT: OptimisticReadSnapshotIsolation`; `INVARIANT: PessimisticReadSnapshotIsolation`; `INVARIANT: MsgTsConsistency`; [configuration](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/DistributedTransaction/Test2.cfg)", "source_url": "https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/DistributedTransaction/Test2.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "pingcap-tla-plus / DistributedTransaction/Test3.tla", "specifies": "TiDB/TiKV DistributedTransaction protocol model-checking instance", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "13 physical lines; [exact source](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/DistributedTransaction/Test3.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification or model-checking instance; no TLAPS proof-language content found in this file", "configured_checks": "`INVARIANT: TypeOK`; `INVARIANT: UniqueCommitOrAbort`; `INVARIANT: CommitConsistency`; `INVARIANT: AbortConsistency`; `INVARIANT: WriteConsistency`; `INVARIANT: UniqueLockOrWrite`; `INVARIANT: UniqueWrite`; `INVARIANT: OptimisticReadSnapshotIsolation`; `INVARIANT: PessimisticReadSnapshotIsolation`; `INVARIANT: MsgTsConsistency`; [configuration](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/DistributedTransaction/Test3.cfg)", "source_url": "https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/DistributedTransaction/Test3.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "pingcap-tla-plus / DistributedTransaction/Test4.tla", "specifies": "TiDB/TiKV DistributedTransaction protocol model-checking instance", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "13 physical lines; [exact source](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/DistributedTransaction/Test4.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification or model-checking instance; no TLAPS proof-language content found in this file", "configured_checks": "`INVARIANT: TypeOK`; `INVARIANT: UniqueCommitOrAbort`; `INVARIANT: CommitConsistency`; `INVARIANT: AbortConsistency`; `INVARIANT: WriteConsistency`; `INVARIANT: UniqueLockOrWrite`; `INVARIANT: UniqueWrite`; `INVARIANT: OptimisticReadSnapshotIsolation`; `INVARIANT: PessimisticReadSnapshotIsolation`; `INVARIANT: MsgTsConsistency`; [configuration](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/DistributedTransaction/Test4.cfg)", "source_url": "https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/DistributedTransaction/Test4.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "pingcap-tla-plus / DistributedTransaction/Test5.tla", "specifies": "TiDB/TiKV DistributedTransaction protocol model-checking instance", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "13 physical lines; [exact source](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/DistributedTransaction/Test5.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification or model-checking instance; no TLAPS proof-language content found in this file", "configured_checks": "`INVARIANT: TypeOK`; `INVARIANT: UniqueCommitOrAbort`; `INVARIANT: CommitConsistency`; `INVARIANT: AbortConsistency`; `INVARIANT: WriteConsistency`; `INVARIANT: UniqueLockOrWrite`; `INVARIANT: UniqueWrite`; `INVARIANT: OptimisticReadSnapshotIsolation`; `INVARIANT: PessimisticReadSnapshotIsolation`; `INVARIANT: MsgTsConsistency`; [configuration](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/DistributedTransaction/Test5.cfg)", "source_url": "https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/DistributedTransaction/Test5.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "pingcap-tla-plus / OptimizedCommitTS/OptimizedCommitTS.tla", "specifies": "TiDB/TiKV OptimizedCommitTS protocol", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "459 physical lines; [exact source](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/OptimizedCommitTS/OptimizedCommitTS.tla)", "safety": "`TypeInvariant` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/OptimizedCommitTS/OptimizedCommitTS.tla#L347)); `WriteConsistency` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/OptimizedCommitTS/OptimizedCommitTS.tla#L362)); `LockConsistency` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/OptimizedCommitTS/OptimizedCommitTS.tla#L374)); `CommittedConsistency` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/OptimizedCommitTS/OptimizedCommitTS.tla#L387)); `AbortedConsistency` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/OptimizedCommitTS/OptimizedCommitTS.tla#L416)); `RollbackConsistency` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/OptimizedCommitTS/OptimizedCommitTS.tla#L424)); `Safety` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/OptimizedCommitTS/OptimizedCommitTS.tla#L451))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification or model-checking instance; no TLAPS proof-language content found in this file", "source_url": "https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/OptimizedCommitTS/OptimizedCommitTS.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "pingcap-tla-plus / OptimizedCommitTS/Test1.tla", "specifies": "TiDB/TiKV OptimizedCommitTS protocol model-checking instance", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "16 physical lines; [exact source](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/OptimizedCommitTS/Test1.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification or model-checking instance; no TLAPS proof-language content found in this file", "configured_checks": "`INVARIANT: TypeInvariant`; `INVARIANT: WriteConsistency`; `INVARIANT: LockConsistency`; `INVARIANT: CommittedConsistency`; `INVARIANT: AbortedConsistency`; `INVARIANT: RollbackConsistency`; `INVARIANT: UniqueWrite`; `INVARIANT: SnapshotIsolation`; [configuration](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/OptimizedCommitTS/Test1.cfg)", "source_url": "https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/OptimizedCommitTS/Test1.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "pingcap-tla-plus / OptimizedCommitTS/Test2.tla", "specifies": "TiDB/TiKV OptimizedCommitTS protocol model-checking instance", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "14 physical lines; [exact source](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/OptimizedCommitTS/Test2.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification or model-checking instance; no TLAPS proof-language content found in this file", "configured_checks": "`INVARIANT: TypeInvariant`; `INVARIANT: WriteConsistency`; `INVARIANT: LockConsistency`; `INVARIANT: CommittedConsistency`; `INVARIANT: AbortedConsistency`; `INVARIANT: RollbackConsistency`; `INVARIANT: UniqueWrite`; `INVARIANT: SnapshotIsolation`; [configuration](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/OptimizedCommitTS/Test2.cfg)", "source_url": "https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/OptimizedCommitTS/Test2.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "pingcap-tla-plus / Percolator/Percolator.tla", "specifies": "TiDB/TiKV Percolator protocol", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "415 physical lines; [exact source](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/Percolator/Percolator.tla)", "safety": "`TypeInvariant` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/Percolator/Percolator.tla#L329)); `WriteConsistency` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/Percolator/Percolator.tla#L344)); `LockConsistency` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/Percolator/Percolator.tla#L352)); `CommittedConsistency` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/Percolator/Percolator.tla#L365)); `AbortedConsistency` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/Percolator/Percolator.tla#L394)); `Safety` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/Percolator/Percolator.tla#L407))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification or model-checking instance; no TLAPS proof-language content found in this file", "source_url": "https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/Percolator/Percolator.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "pingcap-tla-plus / Percolator/Test1.tla", "specifies": "TiDB/TiKV Percolator protocol model-checking instance", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "16 physical lines; [exact source](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/Percolator/Test1.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification or model-checking instance; no TLAPS proof-language content found in this file", "configured_checks": "`INVARIANT: TypeInvariant`; `INVARIANT: WriteConsistency`; `INVARIANT: LockConsistency`; `INVARIANT: CommittedConsistency`; `INVARIANT: AbortedConsistency`; `INVARIANT: SnapshotIsolation`; [configuration](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/Percolator/Test1.cfg)", "source_url": "https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/Percolator/Test1.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "pingcap-tla-plus / Percolator/Test2.tla", "specifies": "TiDB/TiKV Percolator protocol model-checking instance", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "14 physical lines; [exact source](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/Percolator/Test2.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification or model-checking instance; no TLAPS proof-language content found in this file", "configured_checks": "`INVARIANT: TypeInvariant`; `INVARIANT: WriteConsistency`; `INVARIANT: LockConsistency`; `INVARIANT: CommittedConsistency`; `INVARIANT: AbortedConsistency`; `INVARIANT: SnapshotIsolation`; [configuration](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/Percolator/Test2.cfg)", "source_url": "https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/Percolator/Test2.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "pingcap-tla-plus / Raft/Raft.tla", "specifies": "TiDB/TiKV Raft protocol", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "469 physical lines; [exact source](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/Raft/Raft.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification or model-checking instance; no TLAPS proof-language content found in this file", "source_url": "https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/Raft/Raft.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "pingcap-tla-plus / RaftMerge/RaftMerge.tla", "specifies": "TiDB/TiKV RaftMerge protocol", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "538 physical lines; [exact source](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/RaftMerge/RaftMerge.tla)", "safety": "`TypeInvariant` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/RaftMerge/RaftMerge.tla#L456)); `OneLeaderInvariant` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/RaftMerge/RaftMerge.tla#L464)); `AppendEntriesMessageInvariant` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/RaftMerge/RaftMerge.tla#L468)); `LogInvariant` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/RaftMerge/RaftMerge.tla#L485)); `ApplyIndexInvariant` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/RaftMerge/RaftMerge.tla#L495)); `SimpliedRaftInvariant` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/RaftMerge/RaftMerge.tla#L501)); `RegionApplyInvariant` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/RaftMerge/RaftMerge.tla#L512)); `MergeLogInvariant` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/RaftMerge/RaftMerge.tla#L524)); `RaftMergeInvariant` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/RaftMerge/RaftMerge.tla#L534))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification or model-checking instance; no TLAPS proof-language content found in this file", "source_url": "https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/RaftMerge/RaftMerge.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "pingcap-tla-plus / ResolvedTS/MC.tla", "specifies": "TiDB/TiKV ResolvedTS protocol model-checking instance", "artifact_kind": "model-checking instance", "tool": "TLA+", "size": "20 physical lines; [exact source](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/ResolvedTS/MC.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification or model-checking instance; no TLAPS proof-language content found in this file", "configured_checks": "`INVARIANT: RTTypeOK`; `INVARIANT: CommitConsistency`; `INVARIANT: ResolvedConsistency`; [configuration](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/ResolvedTS/MC.cfg)", "source_url": "https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/ResolvedTS/MC.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "pingcap-tla-plus / ResolvedTS/ResolvedTS.tla", "specifies": "TiDB/TiKV ResolvedTS protocol", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "240 physical lines; [exact source](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/ResolvedTS/ResolvedTS.tla)", "safety": "`RTTypeOK` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/ResolvedTS/ResolvedTS.tla#L28)); `CommitConsistency` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/ResolvedTS/ResolvedTS.tla#L215)); `ResolvedConsistency` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/ResolvedTS/ResolvedTS.tla#L222)); `Safety` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/ResolvedTS/ResolvedTS.tla#L232))", "liveness": "`ResolveLiveness` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/ResolvedTS/ResolvedTS.tla#L210))", "evidence_status": "specification or model-checking instance; no TLAPS proof-language content found in this file", "source_url": "https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/ResolvedTS/ResolvedTS.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "pingcap-tla-plus / TwoPC/TLAPS/TwoPC.tla", "specifies": "TiDB/TiKV TwoPC protocol", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "178 physical lines; [exact source](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/TwoPC/TLAPS/TwoPC.tla)", "safety": "`RMStateTypeInvariant` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/TwoPC/TLAPS/TwoPC.tla#L89)); `TMStateTypeInvariant` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/TwoPC/TLAPS/TwoPC.tla#L92)); `TMPreparedTypeInvariant` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/TwoPC/TLAPS/TwoPC.tla#L95)); `MsgsTypeInvariant` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/TwoPC/TLAPS/TwoPC.tla#L98)); `TypeInvariant` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/TwoPC/TLAPS/TwoPC.tla#L101)); `Consistency` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/TwoPC/TLAPS/TwoPC.tla#L113)); `Invariant` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/TwoPC/TLAPS/TwoPC.tla#L117)); `InvariantImpliesConsistency` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/TwoPC/TLAPS/TwoPC.tla#L133)); `InitStateSatisfiesInvariant` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/TwoPC/TLAPS/TwoPC.tla#L146)); `StateStepKeepsInvariant` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/TwoPC/TLAPS/TwoPC.tla#L152)); `Safety` ([definition](https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/TwoPC/TLAPS/TwoPC.tla#L172))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification or model-checking instance; no TLAPS proof-language content found in this file", "source_url": "https://github.com/pingcap/tla-plus/blob/8ae629ddf9f5ad8efc763bff93e3e43ce0a3585d/TwoPC/TLAPS/TwoPC.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "Azure-azure-cosmos-tla / general-model/cosmos_client.tla", "specifies": "Cosmos DB consistency with multiple clients/regions", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+/PlusCal", "size": "384 physical lines; [exact source](https://github.com/Azure/azure-cosmos-tla/blob/a8357c9c0a8d0ed710c68a64bc3a9ed0dc860a8a/general-model/cosmos_client.tla)", "safety": "`TypeOK` ([definition](https://github.com/Azure/azure-cosmos-tla/blob/a8357c9c0a8d0ed710c68a64bc3a9ed0dc860a8a/general-model/cosmos_client.tla#L309)); `Monotonic` ([definition](https://github.com/Azure/azure-cosmos-tla/blob/a8357c9c0a8d0ed710c68a64bc3a9ed0dc860a8a/general-model/cosmos_client.tla#L317)); `MonotonicReadPerRegion` ([definition](https://github.com/Azure/azure-cosmos-tla/blob/a8357c9c0a8d0ed710c68a64bc3a9ed0dc860a8a/general-model/cosmos_client.tla#L320)); `MonotonicReadPerClient` ([definition](https://github.com/Azure/azure-cosmos-tla/blob/a8357c9c0a8d0ed710c68a64bc3a9ed0dc860a8a/general-model/cosmos_client.tla#L326)); `MonotonicWritePerRegion` ([definition](https://github.com/Azure/azure-cosmos-tla/blob/a8357c9c0a8d0ed710c68a64bc3a9ed0dc860a8a/general-model/cosmos_client.tla#L331)); `ReadYourWrite` ([definition](https://github.com/Azure/azure-cosmos-tla/blob/a8357c9c0a8d0ed710c68a64bc3a9ed0dc860a8a/general-model/cosmos_client.tla#L337)); `ReadAfterWrite` ([definition](https://github.com/Azure/azure-cosmos-tla/blob/a8357c9c0a8d0ed710c68a64bc3a9ed0dc860a8a/general-model/cosmos_client.tla#L344)); `Linearizability` ([definition](https://github.com/Azure/azure-cosmos-tla/blob/a8357c9c0a8d0ed710c68a64bc3a9ed0dc860a8a/general-model/cosmos_client.tla#L349)); `BoundedStaleness` ([definition](https://github.com/Azure/azure-cosmos-tla/blob/a8357c9c0a8d0ed710c68a64bc3a9ed0dc860a8a/general-model/cosmos_client.tla#L356)); `ConsistentPrefix` ([definition](https://github.com/Azure/azure-cosmos-tla/blob/a8357c9c0a8d0ed710c68a64bc3a9ed0dc860a8a/general-model/cosmos_client.tla#L360)); `Strong` ([definition](https://github.com/Azure/azure-cosmos-tla/blob/a8357c9c0a8d0ed710c68a64bc3a9ed0dc860a8a/general-model/cosmos_client.tla#L363)); `Session` ([definition](https://github.com/Azure/azure-cosmos-tla/blob/a8357c9c0a8d0ed710c68a64bc3a9ed0dc860a8a/general-model/cosmos_client.tla#L367)); `Eventual` ([definition](https://github.com/Azure/azure-cosmos-tla/blob/a8357c9c0a8d0ed710c68a64bc3a9ed0dc860a8a/general-model/cosmos_client.tla#L370)); `Invariant` ([definition](https://github.com/Azure/azure-cosmos-tla/blob/a8357c9c0a8d0ed710c68a64bc3a9ed0dc860a8a/general-model/cosmos_client.tla#L374))", "liveness": "`Liveness` ([definition](https://github.com/Azure/azure-cosmos-tla/blob/a8357c9c0a8d0ed710c68a64bc3a9ed0dc860a8a/general-model/cosmos_client.tla#L381))", "evidence_status": "specification or model-checking instance; no TLAPS proof-language content found in this file", "source_url": "https://github.com/Azure/azure-cosmos-tla/blob/a8357c9c0a8d0ed710c68a64bc3a9ed0dc860a8a/general-model/cosmos_client.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "Azure-azure-cosmos-tla / scenario1/swscop.tla", "specifies": "Cosmos DB single-client counter writes", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+/PlusCal", "size": "212 physical lines; [exact source](https://github.com/Azure/azure-cosmos-tla/blob/a8357c9c0a8d0ed710c68a64bc3a9ed0dc860a8a/scenario1/swscop.tla)", "safety": "`Eventual` ([definition](https://github.com/Azure/azure-cosmos-tla/blob/a8357c9c0a8d0ed710c68a64bc3a9ed0dc860a8a/scenario1/swscop.tla#L193)); `Consistent_Prefix` ([definition](https://github.com/Azure/azure-cosmos-tla/blob/a8357c9c0a8d0ed710c68a64bc3a9ed0dc860a8a/scenario1/swscop.tla#L195)); `Session` ([definition](https://github.com/Azure/azure-cosmos-tla/blob/a8357c9c0a8d0ed710c68a64bc3a9ed0dc860a8a/scenario1/swscop.tla#L197)); `Bounded_Staleness` ([definition](https://github.com/Azure/azure-cosmos-tla/blob/a8357c9c0a8d0ed710c68a64bc3a9ed0dc860a8a/scenario1/swscop.tla#L200)); `Strong` ([definition](https://github.com/Azure/azure-cosmos-tla/blob/a8357c9c0a8d0ed710c68a64bc3a9ed0dc860a8a/scenario1/swscop.tla#L203))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification or model-checking instance; no TLAPS proof-language content found in this file", "source_url": "https://github.com/Azure/azure-cosmos-tla/blob/a8357c9c0a8d0ed710c68a64bc3a9ed0dc860a8a/scenario1/swscop.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "Azure-azure-cosmos-tla / scenario2/swscrw.tla", "specifies": "Cosmos DB single-client read/increment/write", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+/PlusCal", "size": "215 physical lines; [exact source](https://github.com/Azure/azure-cosmos-tla/blob/a8357c9c0a8d0ed710c68a64bc3a9ed0dc860a8a/scenario2/swscrw.tla)", "safety": "`Eventual` ([definition](https://github.com/Azure/azure-cosmos-tla/blob/a8357c9c0a8d0ed710c68a64bc3a9ed0dc860a8a/scenario2/swscrw.tla#L196)); `Consistent_Prefix` ([definition](https://github.com/Azure/azure-cosmos-tla/blob/a8357c9c0a8d0ed710c68a64bc3a9ed0dc860a8a/scenario2/swscrw.tla#L198)); `Session` ([definition](https://github.com/Azure/azure-cosmos-tla/blob/a8357c9c0a8d0ed710c68a64bc3a9ed0dc860a8a/scenario2/swscrw.tla#L200)); `Bounded_Staleness` ([definition](https://github.com/Azure/azure-cosmos-tla/blob/a8357c9c0a8d0ed710c68a64bc3a9ed0dc860a8a/scenario2/swscrw.tla#L203)); `Strong` ([definition](https://github.com/Azure/azure-cosmos-tla/blob/a8357c9c0a8d0ed710c68a64bc3a9ed0dc860a8a/scenario2/swscrw.tla#L206))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification or model-checking instance; no TLAPS proof-language content found in this file", "source_url": "https://github.com/Azure/azure-cosmos-tla/blob/a8357c9c0a8d0ed710c68a64bc3a9ed0dc860a8a/scenario2/swscrw.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "elastic-elasticsearch-formal-models / ReplicaEngine/tla/ReplicaEngine.tla", "specifies": "concurrent replica-engine request processing", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+/PlusCal", "size": "972 physical lines; [exact source](https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/ReplicaEngine/tla/ReplicaEngine.tla)", "safety": "`SafeAccessEnablerLoop` ([definition](https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/ReplicaEngine/tla/ReplicaEngine.tla#L508)); `SafeAccessEnablerProcess` ([definition](https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/ReplicaEngine/tla/ReplicaEngine.tla#L527)); `UnsafePutterLoop` ([definition](https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/ReplicaEngine/tla/ReplicaEngine.tla#L529)); `UnsafePutterProcess` ([definition](https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/ReplicaEngine/tla/ReplicaEngine.tla#L547)); `MaxUnsafeAutoIdTimestampIncreaserLoop` ([definition](https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/ReplicaEngine/tla/ReplicaEngine.tla#L549)); `MaxUnsafeAutoIdTimestampIncreaserProcess` ([definition](https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/ReplicaEngine/tla/ReplicaEngine.tla#L576)); `LocalCheckpointTrackerLoop` ([definition](https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/ReplicaEngine/tla/ReplicaEngine.tla#L633)); `LocalCheckpointTrackerProcess` ([definition](https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/ReplicaEngine/tla/ReplicaEngine.tla#L657)); `UnsafeSeqnoIncreaserProcessLoop` ([definition](https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/ReplicaEngine/tla/ReplicaEngine.tla#L659)); `UnsafeSeqnoIncreaserProcess` ([definition](https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/ReplicaEngine/tla/ReplicaEngine.tla#L683)); `Invariant` ([definition](https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/ReplicaEngine/tla/ReplicaEngine.tla#L969))", "liveness": "`Termination` ([definition](https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/ReplicaEngine/tla/ReplicaEngine.tla#L963))", "evidence_status": "specification or model-checking instance; no TLAPS proof-language content found in this file", "tlc_enabled_invariant_checks": "`Invariant`; enabled temporal-property checks: `Invariant`; [Toolbox model](https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/ReplicaEngine/tla/ReplicaEngine.toolbox/ReplicaEngine___model.launch)", "source_url": "https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/ReplicaEngine/tla/ReplicaEngine.tla", "has_liveness": true}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "elastic-elasticsearch-formal-models / Storage/tla/Storage.tla", "specifies": "metadata/manifest storage update protocol", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "179 physical lines; [exact source](https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/Storage/tla/Storage.tla)", "safety": "no local safety property found by the source-identifier/formula pass; imported modules and model instances may supply it", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification or model-checking instance; no TLAPS proof-language content found in this file", "tlc_enabled_invariant_checks": "`MetadataFileReferencedByManifestExists`, `MetadataReferencedByManifestIsValid`; enabled temporal-property checks: none; [Toolbox model](https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/Storage/tla/Storage.toolbox/Storage___model.launch)", "source_url": "https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/Storage/tla/Storage.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "elastic-elasticsearch-formal-models / ZenWithTerms/tla/ZenWithTerms.tla", "specifies": "Elasticsearch cluster coordination with terms/reconfiguration", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "370 physical lines; [exact source](https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/ZenWithTerms/tla/ZenWithTerms.tla)", "safety": "`SingleNodeInvariant` ([definition](https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/ZenWithTerms/tla/ZenWithTerms.tla#L279)); `OneMasterPerTerm` ([definition](https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/ZenWithTerms/tla/ZenWithTerms.tla#L287)); `LogMatching` ([definition](https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/ZenWithTerms/tla/ZenWithTerms.tla#L294)); `P2bInvariant` ([definition](https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/ZenWithTerms/tla/ZenWithTerms.tla#L360))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification or model-checking instance; no TLAPS proof-language content found in this file", "tlc_enabled_invariant_checks": "`OneMasterPerTerm`, `LogMatching`, `SingleNodeInvariant`, `CommittedValuesDescendantsFromCommittedValues`, `CommittedValuesDescendantsFromInitialValue`, `DescendantRelationIsStrictlyOrdered`, `NewerOpsBasedOnOlderCommittedOps`, `CommitHasQuorumVsPreviousCommittedConfiguration`, `P2bInvariant`, `DescendantRelationIsTransitive`; enabled temporal-property checks: none; [Toolbox model](https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/ZenWithTerms/tla/ZenWithTerms.toolbox/ZenWithTerms___model.launch)", "source_url": "https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/ZenWithTerms/tla/ZenWithTerms.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "elastic-elasticsearch-formal-models / cluster/tla/consensus.tla", "specifies": "alternative Elasticsearch cluster consensus", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "329 physical lines; [exact source](https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/cluster/tla/consensus.tla)", "safety": "`StateMachineSafety` ([definition](https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/cluster/tla/consensus.tla#L281)); `OneMasterPerTerm` ([definition](https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/cluster/tla/consensus.tla#L287)); `LogMatching` ([definition](https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/cluster/tla/consensus.tla#L295)); `SingleNodeInvariant` ([definition](https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/cluster/tla/consensus.tla#L301)); `LogMatchingMessages` ([definition](https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/cluster/tla/consensus.tla#L308)); `SafeCatchupMessages` ([definition](https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/cluster/tla/consensus.tla#L316))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification or model-checking instance; no TLAPS proof-language content found in this file", "tlc_enabled_invariant_checks": "`StateMachineSafety`, `OneMasterPerTerm`, `LogMatching`, `SingleNodeInvariant`, `LogMatchingMessages`, `SafeCatchupMessages`; enabled temporal-property checks: none; [Toolbox model](https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/cluster/tla/consensus.toolbox/consensus___model.launch)", "source_url": "https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/cluster/tla/consensus.tla", "has_liveness": false}
{"section": "TLA+, PlusCal, TLAPS and Apalache source inventory", "group": "", "name": "elastic-elasticsearch-formal-models / data/tla/replication.tla", "specifies": "Elasticsearch sequence-number data replication", "artifact_kind": "specification/proof variant; separate artifact, not automatically a distinct problem", "tool": "TLA+", "size": "860 physical lines; [exact source](https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/data/tla/replication.tla)", "safety": "`newLocalCheckPoint` ([definition](https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/data/tla/replication.tla#L658)); `AllCopiesSameContents` ([definition](https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/data/tla/replication.tla#L801)); `SameTranslogUpToGlobalCheckPoint` ([definition](https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/data/tla/replication.tla#L815)); `AllCopiesSameContentsOnQuietDown` ([definition](https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/data/tla/replication.tla#L824)); `AllAckedResponsesStored` ([definition](https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/data/tla/replication.tla#L830)); `GlobalCheckPointBelowLocalCheckPoints` ([definition](https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/data/tla/replication.tla#L840)); `LocalCheckPointMatchesMaxConfirmedSeq` ([definition](https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/data/tla/replication.tla#L844))", "liveness": "no local liveness property found by the source-identifier/formula pass; imported modules and model instances may supply it", "evidence_status": "specification or model-checking instance; no TLAPS proof-language content found in this file", "tlc_enabled_invariant_checks": "`AllCopiesSameContentsOnQuietDown`, `WellFormedRoutingTable(clusterStateOnMaster.routingTable)`, `GlobalCheckPointBelowLocalCheckPoints`, `SameTranslogUpToGlobalCheckPoint`, `AllAckedResponsesStored`, `LocalCheckPointMatchesMaxConfirmedSeq`; enabled temporal-property checks: `<>AllCopiesSameContents`, `<>NoActiveMessages`, `<>AllAckedResponsesStored`; [Toolbox model](https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/data/tla/replication.toolbox/replication___model.launch)", "source_url": "https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/data/tla/replication.tla", "has_liveness": false}
{"section": "Isabelle: Elasticsearch alternative cluster-coordination proof", "group": "", "name": "Elasticsearch alternative cluster coordination / Implementation", "specifies": "functional cluster-consensus implementation", "safety": "consistency/equivalence proof artifact; inspect linked theorem statements for exact hypotheses", "liveness": "no progress guarantee claimed here", "tool": "Isabelle/HOL; machine-checkable proof source, not rerun", "size": "384 physical lines; [exact source](https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/cluster/isabelle/Implementation.thy)", "source_url": "https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/cluster/isabelle/Implementation.thy", "has_liveness": false}
{"section": "Isabelle: Elasticsearch alternative cluster-coordination proof", "group": "", "name": "Elasticsearch alternative cluster coordination / Monadic", "specifies": "monadic implementation and equivalence to functional implementation", "safety": "consistency/equivalence proof artifact; inspect linked theorem statements for exact hypotheses", "liveness": "no progress guarantee claimed here", "tool": "Isabelle/HOL; machine-checkable proof source, not rerun", "size": "830 physical lines; [exact source](https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/cluster/isabelle/Monadic.thy)", "source_url": "https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/cluster/isabelle/Monadic.thy", "has_liveness": false}
{"section": "Isabelle: Elasticsearch alternative cluster-coordination proof", "group": "", "name": "Elasticsearch alternative cluster coordination / OneSlot", "specifies": "consistency of each consensus slot", "safety": "consistency/equivalence proof artifact; inspect linked theorem statements for exact hypotheses", "liveness": "no progress guarantee claimed here", "tool": "Isabelle/HOL; machine-checkable proof source, not rerun", "size": "127 physical lines; [exact source](https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/cluster/isabelle/OneSlot.thy)", "source_url": "https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/cluster/isabelle/OneSlot.thy", "has_liveness": false}
{"section": "Isabelle: Elasticsearch alternative cluster-coordination proof", "group": "", "name": "Elasticsearch alternative cluster coordination / Preliminaries", "specifies": "definitions supporting the cluster-consensus proof", "safety": "consistency/equivalence proof artifact; inspect linked theorem statements for exact hypotheses", "liveness": "no progress guarantee claimed here", "tool": "Isabelle/HOL; machine-checkable proof source, not rerun", "size": "167 physical lines; [exact source](https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/cluster/isabelle/Preliminaries.thy)", "source_url": "https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/cluster/isabelle/Preliminaries.thy", "has_liveness": false}
{"section": "Isabelle: Elasticsearch alternative cluster-coordination proof", "group": "", "name": "Elasticsearch alternative cluster coordination / Zen", "specifies": "consistency of the full cluster-consensus implementation", "safety": "consistency/equivalence proof artifact; inspect linked theorem statements for exact hypotheses", "liveness": "no progress guarantee claimed here", "tool": "Isabelle/HOL; machine-checkable proof source, not rerun", "size": "3,319 physical lines; [exact source](https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/cluster/isabelle/Zen.thy)", "source_url": "https://github.com/elastic/elasticsearch-formal-models/blob/ca30663506a7e18de9d23fabbc70a369903d7c98/cluster/isabelle/Zen.thy", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "nano-o-MultiPaxos / DiskPaxos.tla", "specifies": "MultiPaxos/Distributed MultiPaxos/Disk Paxos consensus and abstract multi-consensus", "artifact_kind": "protocol/specification variant", "tool": "TLA+/PlusCal", "size": "214 physical lines; [exact source](https://github.com/nano-o/MultiPaxos/blob/308ddb36fb5374bd95a0b5bfbeb934926234564d/DiskPaxos.tla)", "safety": "`Inv1` ([statement](https://github.com/nano-o/MultiPaxos/blob/308ddb36fb5374bd95a0b5bfbeb934926234564d/DiskPaxos.tla#L189)); `Inv2` ([statement](https://github.com/nano-o/MultiPaxos/blob/308ddb36fb5374bd95a0b5bfbeb934926234564d/DiskPaxos.tla#L191)); `Agreement` ([statement](https://github.com/nano-o/MultiPaxos/blob/308ddb36fb5374bd95a0b5bfbeb934926234564d/DiskPaxos.tla#L193)); `Inv3` ([statement](https://github.com/nano-o/MultiPaxos/blob/308ddb36fb5374bd95a0b5bfbeb934926234564d/DiskPaxos.tla#L205)); `Inv4` ([statement](https://github.com/nano-o/MultiPaxos/blob/308ddb36fb5374bd95a0b5bfbeb934926234564d/DiskPaxos.tla#L209))", "liveness": "`Termination` ([statement](https://github.com/nano-o/MultiPaxos/blob/308ddb36fb5374bd95a0b5bfbeb934926234564d/DiskPaxos.tla#L185))", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://github.com/nano-o/MultiPaxos/blob/308ddb36fb5374bd95a0b5bfbeb934926234564d/DiskPaxos.tla", "has_liveness": true}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "nano-o-MultiPaxos / DistributedMultiPaxos.tla", "specifies": "MultiPaxos/Distributed MultiPaxos/Disk Paxos consensus and abstract multi-consensus", "artifact_kind": "protocol/specification variant", "tool": "TLA+", "size": "127 physical lines; [exact source](https://github.com/nano-o/MultiPaxos/blob/308ddb36fb5374bd95a0b5bfbeb934926234564d/DistributedMultiPaxos.tla)", "safety": "`TypeInv` ([statement](https://github.com/nano-o/MultiPaxos/blob/308ddb36fb5374bd95a0b5bfbeb934926234564d/DistributedMultiPaxos.tla#L37))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://github.com/nano-o/MultiPaxos/blob/308ddb36fb5374bd95a0b5bfbeb934926234564d/DistributedMultiPaxos.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "nano-o-MultiPaxos / MCDiskPaxos.tla", "specifies": "MultiPaxos/Distributed MultiPaxos/Disk Paxos consensus and abstract multi-consensus", "artifact_kind": "model instance", "tool": "TLA+", "size": "22 physical lines; [exact source](https://github.com/nano-o/MultiPaxos/blob/308ddb36fb5374bd95a0b5bfbeb934926234564d/MCDiskPaxos.tla)", "safety": "no named local property found; support/instance modules may inherit properties", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://github.com/nano-o/MultiPaxos/blob/308ddb36fb5374bd95a0b5bfbeb934926234564d/MCDiskPaxos.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "nano-o-MultiPaxos / MultiConsensus.tla", "specifies": "MultiPaxos/Distributed MultiPaxos/Disk Paxos consensus and abstract multi-consensus", "artifact_kind": "support module", "tool": "TLA+", "size": "30 physical lines; [exact source](https://github.com/nano-o/MultiPaxos/blob/308ddb36fb5374bd95a0b5bfbeb934926234564d/MultiConsensus.tla)", "safety": "no named local property found; support/instance modules may inherit properties", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://github.com/nano-o/MultiPaxos/blob/308ddb36fb5374bd95a0b5bfbeb934926234564d/MultiConsensus.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "nano-o-MultiPaxos / MultiPaxos.tla", "specifies": "MultiPaxos/Distributed MultiPaxos/Disk Paxos consensus and abstract multi-consensus", "artifact_kind": "protocol/specification variant", "tool": "TLA+", "size": "212 physical lines; [exact source](https://github.com/nano-o/MultiPaxos/blob/308ddb36fb5374bd95a0b5bfbeb934926234564d/MultiPaxos.tla)", "safety": "`TypeInv` ([statement](https://github.com/nano-o/MultiPaxos/blob/308ddb36fb5374bd95a0b5bfbeb934926234564d/MultiPaxos.tla#L35)); `ProvedSafeAt` ([statement](https://github.com/nano-o/MultiPaxos/blob/308ddb36fb5374bd95a0b5bfbeb934926234564d/MultiPaxos.tla#L96)); `WellFormed` ([statement](https://github.com/nano-o/MultiPaxos/blob/308ddb36fb5374bd95a0b5bfbeb934926234564d/MultiPaxos.tla#L159)); `SafeAt` ([statement](https://github.com/nano-o/MultiPaxos/blob/308ddb36fb5374bd95a0b5bfbeb934926234564d/MultiPaxos.tla#L173)); `SafeInstanceVoteArray` ([statement](https://github.com/nano-o/MultiPaxos/blob/308ddb36fb5374bd95a0b5bfbeb934926234564d/MultiPaxos.tla#L178)); `SafeVoteArray` ([statement](https://github.com/nano-o/MultiPaxos/blob/308ddb36fb5374bd95a0b5bfbeb934926234564d/MultiPaxos.tla#L182)); `Correctness` ([statement](https://github.com/nano-o/MultiPaxos/blob/308ddb36fb5374bd95a0b5bfbeb934926234564d/MultiPaxos.tla#L203)); `theorem` ([statement](https://github.com/nano-o/MultiPaxos/blob/308ddb36fb5374bd95a0b5bfbeb934926234564d/MultiPaxos.tla#L207))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://github.com/nano-o/MultiPaxos/blob/308ddb36fb5374bd95a0b5bfbeb934926234564d/MultiPaxos.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "fpaxos-fpaxos-tlaplus / FPaxos.tla", "specifies": "Flexible Paxos with different phase-one and phase-two quorums", "artifact_kind": "protocol/specification variant", "tool": "TLA+", "size": "128 physical lines; [exact source](https://github.com/fpaxos/fpaxos-tlaplus/blob/a6baf4a0f55799dc5fa413ffa073489808925889/FPaxos.tla)", "safety": "`TypeOK` ([statement](https://github.com/fpaxos/fpaxos-tlaplus/blob/a6baf4a0f55799dc5fa413ffa073489808925889/FPaxos.tla#L41)); `NoFutureProposal` ([statement](https://github.com/fpaxos/fpaxos-tlaplus/blob/a6baf4a0f55799dc5fa413ffa073489808925889/FPaxos.tla#L118)); `SafeValue` ([statement](https://github.com/fpaxos/fpaxos-tlaplus/blob/a6baf4a0f55799dc5fa413ffa073489808925889/FPaxos.tla#L122)); `Safety` ([statement](https://github.com/fpaxos/fpaxos-tlaplus/blob/a6baf4a0f55799dc5fa413ffa073489808925889/FPaxos.tla#L126))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "configured_checks": "`INVARIANT: SafeValue TypeOK`; [configuration](https://github.com/fpaxos/fpaxos-tlaplus/blob/a6baf4a0f55799dc5fa413ffa073489808925889/MCFPaxos.cfg)", "source_url": "https://github.com/fpaxos/fpaxos-tlaplus/blob/a6baf4a0f55799dc5fa413ffa073489808925889/FPaxos.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "fpaxos-fpaxos-tlaplus / MCFPaxosFourAcc.tla", "specifies": "Flexible Paxos with different phase-one and phase-two quorums", "artifact_kind": "model instance", "tool": "TLA+", "size": "11 physical lines; [exact source](https://github.com/fpaxos/fpaxos-tlaplus/blob/a6baf4a0f55799dc5fa413ffa073489808925889/MCFPaxosFourAcc.tla)", "safety": "no named local property found; support/instance modules may inherit properties", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "configured_checks": "`INVARIANT: SafeValue TypeOK`; [configuration](https://github.com/fpaxos/fpaxos-tlaplus/blob/a6baf4a0f55799dc5fa413ffa073489808925889/MCFPaxos.cfg)", "source_url": "https://github.com/fpaxos/fpaxos-tlaplus/blob/a6baf4a0f55799dc5fa413ffa073489808925889/MCFPaxosFourAcc.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "fpaxos-fpaxos-tlaplus / MCFPaxosFourAccLarge.tla", "specifies": "Flexible Paxos with different phase-one and phase-two quorums", "artifact_kind": "model instance", "tool": "TLA+", "size": "11 physical lines; [exact source](https://github.com/fpaxos/fpaxos-tlaplus/blob/a6baf4a0f55799dc5fa413ffa073489808925889/MCFPaxosFourAccLarge.tla)", "safety": "no named local property found; support/instance modules may inherit properties", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "configured_checks": "`INVARIANT: SafeValue TypeOK`; [configuration](https://github.com/fpaxos/fpaxos-tlaplus/blob/a6baf4a0f55799dc5fa413ffa073489808925889/MCFPaxos.cfg)", "source_url": "https://github.com/fpaxos/fpaxos-tlaplus/blob/a6baf4a0f55799dc5fa413ffa073489808925889/MCFPaxosFourAccLarge.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "fpaxos-fpaxos-tlaplus / MCFPaxosThreeAcc.tla", "specifies": "Flexible Paxos with different phase-one and phase-two quorums", "artifact_kind": "model instance", "tool": "TLA+", "size": "11 physical lines; [exact source](https://github.com/fpaxos/fpaxos-tlaplus/blob/a6baf4a0f55799dc5fa413ffa073489808925889/MCFPaxosThreeAcc.tla)", "safety": "no named local property found; support/instance modules may inherit properties", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "configured_checks": "`INVARIANT: SafeValue TypeOK`; [configuration](https://github.com/fpaxos/fpaxos-tlaplus/blob/a6baf4a0f55799dc5fa413ffa073489808925889/MCFPaxos.cfg)", "source_url": "https://github.com/fpaxos/fpaxos-tlaplus/blob/a6baf4a0f55799dc5fa413ffa073489808925889/MCFPaxosThreeAcc.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "fpaxos-fpaxos-tlaplus / MCFPaxosTwoAcc.tla", "specifies": "Flexible Paxos with different phase-one and phase-two quorums", "artifact_kind": "model instance", "tool": "TLA+", "size": "11 physical lines; [exact source](https://github.com/fpaxos/fpaxos-tlaplus/blob/a6baf4a0f55799dc5fa413ffa073489808925889/MCFPaxosTwoAcc.tla)", "safety": "no named local property found; support/instance modules may inherit properties", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "configured_checks": "`INVARIANT: SafeValue TypeOK`; [configuration](https://github.com/fpaxos/fpaxos-tlaplus/blob/a6baf4a0f55799dc5fa413ffa073489808925889/MCFPaxos.cfg)", "source_url": "https://github.com/fpaxos/fpaxos-tlaplus/blob/a6baf4a0f55799dc5fa413ffa073489808925889/MCFPaxosTwoAcc.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "Starydark-Tencent-Paxos-TLA / Consensus.tla", "specifies": "Tencent Paxos with voting abstractions/refinements", "artifact_kind": "protocol/specification variant", "tool": "TLA+; TLAPS proof language", "size": "30 physical lines; [exact source](https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/Consensus.tla)", "safety": "`Inv` ([statement](https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/Consensus.tla#L18)); `theorem` ([statement](https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/Consensus.tla#L23))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "TLAPS proof content present; successful checking not independently established", "source_url": "https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/Consensus.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "Starydark-Tencent-Paxos-TLA / EagerVoting.tla", "specifies": "Tencent Paxos with voting abstractions/refinements", "artifact_kind": "protocol/specification variant", "tool": "TLA+; TLAPS proof language", "size": "264 physical lines; [exact source](https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/EagerVoting.tla)", "safety": "`TypeOK` ([statement](https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/EagerVoting.tla#L23)); `ShowsSafeAt` ([statement](https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/EagerVoting.tla#L30)); `Consistency` ([statement](https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/EagerVoting.tla#L72)); `SafeAt` ([statement](https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/EagerVoting.tla#L82)); `VotesSafe` ([statement](https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/EagerVoting.tla#L85)); `Inv` ([statement](https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/EagerVoting.tla#L97)); `AllSafeAtZero` ([statement](https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/EagerVoting.tla#L99)); `VotesSafeImpliesConsistency` ([statement](https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/EagerVoting.tla#L110)); `ShowsSafety` ([statement](https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/EagerVoting.tla#L132)); `SafeAtStable` ([statement](https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/EagerVoting.tla#L140)); `Invariant` ([statement](https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/EagerVoting.tla#L145)); `theorem` ([statement](https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/EagerVoting.tla#L229))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "TLAPS proof content present; successful checking not independently established; 1 `OMITTED` occurrences, so completeness cannot be assumed", "source_url": "https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/EagerVoting.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "Starydark-Tencent-Paxos-TLA / TPaxos.tla", "specifies": "Tencent Paxos with voting abstractions/refinements", "artifact_kind": "protocol/specification variant", "tool": "TLA+", "size": "169 physical lines; [exact source](https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/TPaxos.tla)", "safety": "`TypeOK` ([statement](https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/TPaxos.tla#L59)); `Consistency` ([statement](https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/TPaxos.tla#L163)); `theorem` ([statement](https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/TPaxos.tla#L165))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/TPaxos.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "Starydark-Tencent-Paxos-TLA / TPaxosAP.tla", "specifies": "Tencent Paxos with voting abstractions/refinements", "artifact_kind": "protocol/specification variant", "tool": "TLA+", "size": "169 physical lines; [exact source](https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/TPaxosAP.tla)", "safety": "`TypeOK` ([statement](https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/TPaxosAP.tla#L59)); `Consistency` ([statement](https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/TPaxosAP.tla#L163)); `theorem` ([statement](https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/TPaxosAP.tla#L165))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/TPaxosAP.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "Starydark-Tencent-Paxos-TLA / TPaxosAPWithVotes.tla", "specifies": "Tencent Paxos with voting abstractions/refinements", "artifact_kind": "protocol/specification variant", "tool": "TLA+", "size": "51 physical lines; [exact source](https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/TPaxosAPWithVotes.tla)", "safety": "no named local property found; support/instance modules may inherit properties", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/TPaxosAPWithVotes.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "Starydark-Tencent-Paxos-TLA / TPaxosWithProof.tla", "specifies": "Tencent Paxos with voting abstractions/refinements", "artifact_kind": "proof module", "tool": "TLA+; TLAPS proof language", "size": "2,285 physical lines; [exact source](https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/TPaxosWithProof.tla)", "safety": "`TypeOK` ([statement](https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/TPaxosWithProof.tla#L63)); `Consistency` ([statement](https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/TPaxosWithProof.tla#L225)); `SafeAt` ([statement](https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/TPaxosWithProof.tla#L232)); `Inv` ([statement](https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/TPaxosWithProof.tla#L279)); `MaxTypeOK` ([statement](https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/TPaxosWithProof.tla#L290)); `UpdateStateTypeOKProperty` ([statement](https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/TPaxosWithProof.tla#L302)); `SafeAtStable` ([statement](https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/TPaxosWithProof.tla#L373)); `Invariant` ([statement](https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/TPaxosWithProof.tla#L1971)); `theorem` ([statement](https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/TPaxosWithProof.tla#L2232))", "liveness": "`Liveness` ([statement](https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/TPaxosWithProof.tla#L2279))", "evidence_status": "TLAPS proof content present; successful checking not independently established", "source_url": "https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/TPaxosWithProof.tla", "has_liveness": true}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "Starydark-Tencent-Paxos-TLA / TPaxosWithVotes.tla", "specifies": "Tencent Paxos with voting abstractions/refinements", "artifact_kind": "protocol/specification variant", "tool": "TLA+", "size": "51 physical lines; [exact source](https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/TPaxosWithVotes.tla)", "safety": "no named local property found; support/instance modules may inherit properties", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/TPaxosWithVotes.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "Starydark-Tencent-Paxos-TLA / Voting.tla", "specifies": "Tencent Paxos with voting abstractions/refinements", "artifact_kind": "protocol/specification variant", "tool": "TLA+; TLAPS proof language", "size": "256 physical lines; [exact source](https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/Voting.tla)", "safety": "`TypeOK` ([statement](https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/Voting.tla#L21)); `ShowsSafeAt` ([statement](https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/Voting.tla#L28)); `Consistency` ([statement](https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/Voting.tla#L64)); `SafeAt` ([statement](https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/Voting.tla#L74)); `VotesSafe` ([statement](https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/Voting.tla#L77)); `Inv` ([statement](https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/Voting.tla#L89)); `AllSafeAtZero` ([statement](https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/Voting.tla#L91)); `VotesSafeImpliesConsistency` ([statement](https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/Voting.tla#L102)); `ShowsSafety` ([statement](https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/Voting.tla#L124)); `SafeAtStable` ([statement](https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/Voting.tla#L132)); `Invariant` ([statement](https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/Voting.tla#L137)); `theorem` ([statement](https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/Voting.tla#L221))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "TLAPS proof content present; successful checking not independently established; 1 `OMITTED` occurrences, so completeness cannot be assumed", "source_url": "https://github.com/Starydark/Tencent-Paxos-TLA/blob/04125dd6399eb72f9ebf332bd8b923a639ef00a9/Voting.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "muratdem-PlusCal-examples / 2PCTM/2PCwithBTM.tla", "specifies": "two-phase transaction commit", "artifact_kind": "protocol/specification variant", "tool": "TLA+/PlusCal", "size": "196 physical lines; [exact source](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/2PCTM/2PCwithBTM.tla)", "safety": "`TypeOK` ([statement](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/2PCTM/2PCwithBTM.tla#L173)); `Consistency` ([statement](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/2PCTM/2PCwithBTM.tla#L180))", "liveness": "`Termination` ([statement](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/2PCTM/2PCwithBTM.tla#L166))", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/2PCTM/2PCwithBTM.tla", "has_liveness": true}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "muratdem-PlusCal-examples / BenOr/benor.tla", "specifies": "Ben-Or randomized consensus", "artifact_kind": "protocol/specification variant", "tool": "TLA+/PlusCal", "size": "139 physical lines; [exact source](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/BenOr/benor.tla)", "safety": "`Terminating` ([statement](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/BenOr/benor.tla#L115)); `Agreement` ([statement](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/BenOr/benor.tla#L128)); `BaitProgress` ([statement](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/BenOr/benor.tla#L132))", "liveness": "`Termination` ([statement](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/BenOr/benor.tla#L124)); `Progress` ([statement](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/BenOr/benor.tla#L135))", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/BenOr/benor.tla", "has_liveness": true}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "muratdem-PlusCal-examples / DAO/dao.tla", "specifies": "decentralized autonomous-organization protocol", "artifact_kind": "protocol/specification variant", "tool": "TLA+/PlusCal", "size": "187 physical lines; [exact source](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/DAO/dao.tla)", "safety": "`SafeWithdrawal` ([statement](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/DAO/dao.tla#L44)); `SafeWithdrawal1` ([statement](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/DAO/dao.tla#L145))", "liveness": "`Termination` ([statement](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/DAO/dao.tla#L140))", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/DAO/dao.tla", "has_liveness": true}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "muratdem-PlusCal-examples / DAO/dao2.tla", "specifies": "decentralized autonomous-organization protocol", "artifact_kind": "protocol/specification variant", "tool": "TLA+/PlusCal", "size": "192 physical lines; [exact source](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/DAO/dao2.tla)", "safety": "`SafeWithdrawal` ([statement](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/DAO/dao2.tla#L47)); `Invariant` ([statement](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/DAO/dao2.tla#L51)); `SafeWithdrawal1` ([statement](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/DAO/dao2.tla#L150))", "liveness": "`SafeWithdrawal` ([statement](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/DAO/dao2.tla#L11)); `Invariant` ([statement](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/DAO/dao2.tla#L15)); `Termination` ([statement](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/DAO/dao2.tla#L145))", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/DAO/dao2.tla", "has_liveness": true}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "muratdem-PlusCal-examples / DiningPhil/diningHygenic0.tla", "specifies": "dining-philosopher synchronization", "artifact_kind": "protocol/specification variant", "tool": "TLA+/PlusCal", "size": "200 physical lines; [exact source](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/DiningPhil/diningHygenic0.tla)", "safety": "`TypeOkFork` ([statement](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/DiningPhil/diningHygenic0.tla#L186)); `TypeOkReq` ([statement](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/DiningPhil/diningHygenic0.tla#L187))", "liveness": "`NoStarvation` ([statement](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/DiningPhil/diningHygenic0.tla#L189))", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/DiningPhil/diningHygenic0.tla", "has_liveness": true}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "muratdem-PlusCal-examples / DiningPhil/diningHygienic.tla", "specifies": "dining-philosopher synchronization", "artifact_kind": "protocol/specification variant", "tool": "TLA+/PlusCal", "size": "190 physical lines; [exact source](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/DiningPhil/diningHygienic.tla)", "safety": "`TypeOkFork` ([statement](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/DiningPhil/diningHygienic.tla#L176)); `TypeOkReq` ([statement](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/DiningPhil/diningHygienic.tla#L177))", "liveness": "`NoStarvation` ([statement](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/DiningPhil/diningHygienic.tla#L179))", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/DiningPhil/diningHygienic.tla", "has_liveness": true}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "muratdem-PlusCal-examples / DiningPhil/diningRound0.tla", "specifies": "dining-philosopher synchronization", "artifact_kind": "protocol/specification variant", "tool": "TLA+/PlusCal", "size": "130 physical lines; [exact source](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/DiningPhil/diningRound0.tla)", "safety": "no named local property found; support/instance modules may inherit properties", "liveness": "`NoStarvation` ([statement](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/DiningPhil/diningRound0.tla#L128))", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/DiningPhil/diningRound0.tla", "has_liveness": true}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "muratdem-PlusCal-examples / DiningPhil/diningRound1.tla", "specifies": "dining-philosopher synchronization", "artifact_kind": "protocol/specification variant", "tool": "TLA+/PlusCal", "size": "149 physical lines; [exact source](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/DiningPhil/diningRound1.tla)", "safety": "no named local property found; support/instance modules may inherit properties", "liveness": "`NoStarvation` ([statement](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/DiningPhil/diningRound1.tla#L147))", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/DiningPhil/diningRound1.tla", "has_liveness": true}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "muratdem-PlusCal-examples / Paxos/fpax1.tla", "specifies": "Paxos/Fast Paxos", "artifact_kind": "protocol/specification variant", "tool": "TLA+/PlusCal", "size": "295 physical lines; [exact source](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/Paxos/fpax1.tla)", "safety": "`Agreement` ([statement](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/Paxos/fpax1.tla#L274)); `Agreement2` ([statement](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/Paxos/fpax1.tla#L278)); `Agreement3` ([statement](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/Paxos/fpax1.tla#L284))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/Paxos/fpax1.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "muratdem-PlusCal-examples / Paxos/pax2.tla", "specifies": "Paxos/Fast Paxos", "artifact_kind": "protocol/specification variant", "tool": "TLA+/PlusCal", "size": "281 physical lines; [exact source](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/Paxos/pax2.tla)", "safety": "`Agreement` ([statement](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/Paxos/pax2.tla#L260)); `Agreement2` ([statement](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/Paxos/pax2.tla#L264)); `Agreement3` ([statement](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/Paxos/pax2.tla#L270))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/Paxos/pax2.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "muratdem-PlusCal-examples / Streamlet/str0.tla", "specifies": "Streamlet blockchain consensus", "artifact_kind": "protocol/specification variant", "tool": "TLA+/PlusCal", "size": "117 physical lines; [exact source](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/Streamlet/str0.tla)", "safety": "`Consistency` ([statement](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/Streamlet/str0.tla#L109))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/Streamlet/str0.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "muratdem-PlusCal-examples / Streamlet/str1.tla", "specifies": "Streamlet blockchain consensus", "artifact_kind": "protocol/specification variant", "tool": "TLA+/PlusCal", "size": "128 physical lines; [exact source](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/Streamlet/str1.tla)", "safety": "`Terminating` ([statement](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/Streamlet/str1.tla#L102)); `Consistency` ([statement](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/Streamlet/str1.tla#L120))", "liveness": "`Termination` ([statement](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/Streamlet/str1.tla#L111))", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/Streamlet/str1.tla", "has_liveness": true}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "muratdem-PlusCal-examples / Streamlet/str2.tla", "specifies": "Streamlet blockchain consensus", "artifact_kind": "protocol/specification variant", "tool": "TLA+/PlusCal", "size": "156 physical lines; [exact source](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/Streamlet/str2.tla)", "safety": "`Terminating` ([statement](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/Streamlet/str2.tla#L130)); `Consistency` ([statement](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/Streamlet/str2.tla#L148))", "liveness": "`Termination` ([statement](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/Streamlet/str2.tla#L139))", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/Streamlet/str2.tla", "has_liveness": true}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "muratdem-PlusCal-examples / SyncConsensus/syncCon1.tla", "specifies": "synchronous-round consensus", "artifact_kind": "protocol/specification variant", "tool": "TLA+/PlusCal", "size": "148 physical lines; [exact source](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/SyncConsensus/syncCon1.tla)", "safety": "`Agreement` ([statement](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/SyncConsensus/syncCon1.tla#L129))", "liveness": "`Termination` ([statement](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/SyncConsensus/syncCon1.tla#L125)); `Term` ([statement](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/SyncConsensus/syncCon1.tla#L130))", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/SyncConsensus/syncCon1.tla", "has_liveness": true}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "muratdem-PlusCal-examples / SyncConsensus/syncCon3.tla", "specifies": "synchronous-round consensus", "artifact_kind": "protocol/specification variant", "tool": "TLA+/PlusCal", "size": "162 physical lines; [exact source](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/SyncConsensus/syncCon3.tla)", "safety": "`Agreement` ([statement](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/SyncConsensus/syncCon3.tla#L141)); `SyncTerm` ([statement](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/SyncConsensus/syncCon3.tla#L143))", "liveness": "`Termination` ([statement](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/SyncConsensus/syncCon3.tla#L137)); `Term` ([statement](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/SyncConsensus/syncCon3.tla#L144))", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/SyncConsensus/syncCon3.tla", "has_liveness": true}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "muratdem-PlusCal-examples / VoldemortKV/voldchain.tla", "specifies": "replicated key-value storage, including chain replication", "artifact_kind": "protocol/specification variant", "tool": "TLA+/PlusCal", "size": "238 physical lines; [exact source](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/VoldemortKV/voldchain.tla)", "safety": "no named local property found; support/instance modules may inherit properties", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/VoldemortKV/voldchain.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "muratdem-PlusCal-examples / VoldemortKV/voldemortSimple.tla", "specifies": "replicated key-value storage, including chain replication", "artifact_kind": "protocol/specification variant", "tool": "TLA+/PlusCal", "size": "163 physical lines; [exact source](https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/VoldemortKV/voldemortSimple.tla)", "safety": "no named local property found; support/instance modules may inherit properties", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://github.com/muratdem/PlusCal-examples/blob/559f4b1e1956999fe8751acc3720b671822d21f8/VoldemortKV/voldemortSimple.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "HappyCS-Gu-Parallel-Raft-tla / MultiPaxos.tla", "specifies": "Parallel Raft and refinement to MultiPaxos", "artifact_kind": "protocol/specification variant", "tool": "TLA+", "size": "175 physical lines; [exact source](https://github.com/HappyCS-Gu/Parallel-Raft-tla/blob/567f3ee16432b778899d4802d9291bceea9306ad/MultiPaxos.tla)", "safety": "`TypeInv` ([statement](https://github.com/HappyCS-Gu/Parallel-Raft-tla/blob/567f3ee16432b778899d4802d9291bceea9306ad/MultiPaxos.tla#L35)); `WellFormed` ([statement](https://github.com/HappyCS-Gu/Parallel-Raft-tla/blob/567f3ee16432b778899d4802d9291bceea9306ad/MultiPaxos.tla#L141)); `SafeAt` ([statement](https://github.com/HappyCS-Gu/Parallel-Raft-tla/blob/567f3ee16432b778899d4802d9291bceea9306ad/MultiPaxos.tla#L155)); `SafeInstanceVoteArray` ([statement](https://github.com/HappyCS-Gu/Parallel-Raft-tla/blob/567f3ee16432b778899d4802d9291bceea9306ad/MultiPaxos.tla#L160)); `SafeVoteArray` ([statement](https://github.com/HappyCS-Gu/Parallel-Raft-tla/blob/567f3ee16432b778899d4802d9291bceea9306ad/MultiPaxos.tla#L164)); `Inv` ([statement](https://github.com/HappyCS-Gu/Parallel-Raft-tla/blob/567f3ee16432b778899d4802d9291bceea9306ad/MultiPaxos.tla#L166)); `Correctness` ([statement](https://github.com/HappyCS-Gu/Parallel-Raft-tla/blob/567f3ee16432b778899d4802d9291bceea9306ad/MultiPaxos.tla#L168))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://github.com/HappyCS-Gu/Parallel-Raft-tla/blob/567f3ee16432b778899d4802d9291bceea9306ad/MultiPaxos.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "HappyCS-Gu-Parallel-Raft-tla / ParallelRaftCE.tla", "specifies": "Parallel Raft and refinement to MultiPaxos", "artifact_kind": "protocol/specification variant", "tool": "TLA+", "size": "473 physical lines; [exact source](https://github.com/HappyCS-Gu/Parallel-Raft-tla/blob/567f3ee16432b778899d4802d9291bceea9306ad/ParallelRaftCE.tla)", "safety": "`Term` ([statement](https://github.com/HappyCS-Gu/Parallel-Raft-tla/blob/567f3ee16432b778899d4802d9291bceea9306ad/ParallelRaftCE.tla#L51)); `TypeSafety` ([statement](https://github.com/HappyCS-Gu/Parallel-Raft-tla/blob/567f3ee16432b778899d4802d9291bceea9306ad/ParallelRaftCE.tla#L90))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://github.com/HappyCS-Gu/Parallel-Raft-tla/blob/567f3ee16432b778899d4802d9291bceea9306ad/ParallelRaftCE.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "HappyCS-Gu-Parallel-Raft-tla / ParallelRaftSE.tla", "specifies": "Parallel Raft and refinement to MultiPaxos", "artifact_kind": "protocol/specification variant", "tool": "TLA+", "size": "254 physical lines; [exact source](https://github.com/HappyCS-Gu/Parallel-Raft-tla/blob/567f3ee16432b778899d4802d9291bceea9306ad/ParallelRaftSE.tla)", "safety": "`Term` ([statement](https://github.com/HappyCS-Gu/Parallel-Raft-tla/blob/567f3ee16432b778899d4802d9291bceea9306ad/ParallelRaftSE.tla#L8)); `TypeInv` ([statement](https://github.com/HappyCS-Gu/Parallel-Raft-tla/blob/567f3ee16432b778899d4802d9291bceea9306ad/ParallelRaftSE.tla#L36)); `Inv` ([statement](https://github.com/HappyCS-Gu/Parallel-Raft-tla/blob/567f3ee16432b778899d4802d9291bceea9306ad/ParallelRaftSE.tla#L232))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://github.com/HappyCS-Gu/Parallel-Raft-tla/blob/567f3ee16432b778899d4802d9291bceea9306ad/ParallelRaftSE.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "tschottdorf-caspaxos-tla / CASPaxos.tla", "specifies": "compare-and-set Paxos consensus", "artifact_kind": "protocol/specification variant", "tool": "TLA+", "size": "322 physical lines; [exact source](https://github.com/tschottdorf/caspaxos-tla/blob/50229e7b8914d4d1f297940a4494b010377fccf8/CASPaxos.tla)", "safety": "`TypeOK` ([statement](https://github.com/tschottdorf/caspaxos-tla/blob/50229e7b8914d4d1f297940a4494b010377fccf8/CASPaxos.tla#L110)); `OnlyOneValuePerBallot` ([statement](https://github.com/tschottdorf/caspaxos-tla/blob/50229e7b8914d4d1f297940a4494b010377fccf8/CASPaxos.tla#L293)); `MutationsLineUp` ([statement](https://github.com/tschottdorf/caspaxos-tla/blob/50229e7b8914d4d1f297940a4494b010377fccf8/CASPaxos.tla#L300)); `DesiredProperties` ([statement](https://github.com/tschottdorf/caspaxos-tla/blob/50229e7b8914d4d1f297940a4494b010377fccf8/CASPaxos.tla#L316))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "interpretation": "the state predicates ask for one value per ballot and for each mutation to use the previous committed value; the repository explicitly supplies a counterexample target", "source_url": "https://github.com/tschottdorf/caspaxos-tla/blob/50229e7b8914d4d1f297940a4494b010377fccf8/CASPaxos.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "tschottdorf-caspaxos-tla / CASPaxos.toolbox/Model_1/MC.tla", "specifies": "compare-and-set Paxos consensus", "artifact_kind": "model instance", "tool": "TLA+", "size": "38 physical lines; [exact source](https://github.com/tschottdorf/caspaxos-tla/blob/50229e7b8914d4d1f297940a4494b010377fccf8/CASPaxos.toolbox/Model_1/MC.tla)", "safety": "no named local property found; support/instance modules may inherit properties", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "configured_checks": "`INVARIANT: inv_14915459371617000`; [configuration](https://github.com/tschottdorf/caspaxos-tla/blob/50229e7b8914d4d1f297940a4494b010377fccf8/CASPaxos.toolbox/Model_1/MC.cfg)", "interpretation": "the state predicates ask for one value per ballot and for each mutation to use the previous committed value; the repository explicitly supplies a counterexample target", "source_url": "https://github.com/tschottdorf/caspaxos-tla/blob/50229e7b8914d4d1f297940a4494b010377fccf8/CASPaxos.toolbox/Model_1/MC.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "sanjosh-tlaplus / amazon/serializableSnapshotIsolation.tla", "specifies": "snapshot/serializable transaction isolation", "artifact_kind": "protocol/specification variant", "tool": "TLA+", "size": "1,584 physical lines; [exact source](https://github.com/sanjosh/tlaplus/blob/fbd1a2043801ddfbb1462ec47cb1c2984b98e93d/amazon/serializableSnapshotIsolation.tla)", "safety": "`TypeInv` ([statement](https://github.com/sanjosh/tlaplus/blob/fbd1a2043801ddfbb1462ec47cb1c2984b98e93d/amazon/serializableSnapshotIsolation.tla#L207)); `LegitimateTermination` ([statement](https://github.com/sanjosh/tlaplus/blob/fbd1a2043801ddfbb1462ec47cb1c2984b98e93d/amazon/serializableSnapshotIsolation.tla#L963)); `WellFormedTransactionsInHistory` ([statement](https://github.com/sanjosh/tlaplus/blob/fbd1a2043801ddfbb1462ec47cb1c2984b98e93d/amazon/serializableSnapshotIsolation.tla#L1146)); `UnitTest_WellFormedTransactionsInHistory` ([statement](https://github.com/sanjosh/tlaplus/blob/fbd1a2043801ddfbb1462ec47cb1c2984b98e93d/amazon/serializableSnapshotIsolation.tla#L1184)); `CorrectReadView` ([statement](https://github.com/sanjosh/tlaplus/blob/fbd1a2043801ddfbb1462ec47cb1c2984b98e93d/amazon/serializableSnapshotIsolation.tla#L1215)); `FirstCommitterWins` ([statement](https://github.com/sanjosh/tlaplus/blob/fbd1a2043801ddfbb1462ec47cb1c2984b98e93d/amazon/serializableSnapshotIsolation.tla#L1271)); `SemanticsOfSnapshotIsolation` ([statement](https://github.com/sanjosh/tlaplus/blob/fbd1a2043801ddfbb1462ec47cb1c2984b98e93d/amazon/serializableSnapshotIsolation.tla#L1288)); `CorrectnessOfHoldingXLocks` ([statement](https://github.com/sanjosh/tlaplus/blob/fbd1a2043801ddfbb1462ec47cb1c2984b98e93d/amazon/serializableSnapshotIsolation.tla#L1302)); `CorrectnessOfWaitingForXLock` ([statement](https://github.com/sanjosh/tlaplus/blob/fbd1a2043801ddfbb1462ec47cb1c2984b98e93d/amazon/serializableSnapshotIsolation.tla#L1324)); `CahillSerializable` ([statement](https://github.com/sanjosh/tlaplus/blob/fbd1a2043801ddfbb1462ec47cb1c2984b98e93d/amazon/serializableSnapshotIsolation.tla#L1446)); `BernsteinSerializable` ([statement](https://github.com/sanjosh/tlaplus/blob/fbd1a2043801ddfbb1462ec47cb1c2984b98e93d/amazon/serializableSnapshotIsolation.tla#L1556)); `theorem` ([statement](https://github.com/sanjosh/tlaplus/blob/fbd1a2043801ddfbb1462ec47cb1c2984b98e93d/amazon/serializableSnapshotIsolation.tla#L1017))", "liveness": "`theorem` ([statement](https://github.com/sanjosh/tlaplus/blob/fbd1a2043801ddfbb1462ec47cb1c2984b98e93d/amazon/serializableSnapshotIsolation.tla#L1022))", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "plain-language_safety": "transactions obey snapshot-read and first-committer-wins rules; the two serializability predicates rule out cycles in their transaction dependency graphs", "source_url": "https://github.com/sanjosh/tlaplus/blob/fbd1a2043801ddfbb1462ec47cb1c2984b98e93d/amazon/serializableSnapshotIsolation.tla", "has_liveness": true}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "sanjosh-tlaplus / amazon/textbookSnapshotIsolation.tla", "specifies": "snapshot/serializable transaction isolation", "artifact_kind": "protocol/specification variant", "tool": "TLA+", "size": "1,297 physical lines; [exact source](https://github.com/sanjosh/tlaplus/blob/fbd1a2043801ddfbb1462ec47cb1c2984b98e93d/amazon/textbookSnapshotIsolation.tla)", "safety": "`TypeInv` ([statement](https://github.com/sanjosh/tlaplus/blob/fbd1a2043801ddfbb1462ec47cb1c2984b98e93d/amazon/textbookSnapshotIsolation.tla#L143)); `LegitimateTermination` ([statement](https://github.com/sanjosh/tlaplus/blob/fbd1a2043801ddfbb1462ec47cb1c2984b98e93d/amazon/textbookSnapshotIsolation.tla#L568)); `WellFormedTransactionsInHistory` ([statement](https://github.com/sanjosh/tlaplus/blob/fbd1a2043801ddfbb1462ec47cb1c2984b98e93d/amazon/textbookSnapshotIsolation.tla#L751)); `UnitTest_WellFormedTransactionsInHistory` ([statement](https://github.com/sanjosh/tlaplus/blob/fbd1a2043801ddfbb1462ec47cb1c2984b98e93d/amazon/textbookSnapshotIsolation.tla#L789)); `CorrectReadView` ([statement](https://github.com/sanjosh/tlaplus/blob/fbd1a2043801ddfbb1462ec47cb1c2984b98e93d/amazon/textbookSnapshotIsolation.tla#L820)); `FirstCommitterWins` ([statement](https://github.com/sanjosh/tlaplus/blob/fbd1a2043801ddfbb1462ec47cb1c2984b98e93d/amazon/textbookSnapshotIsolation.tla#L876)); `SemanticsOfSnapshotIsolation` ([statement](https://github.com/sanjosh/tlaplus/blob/fbd1a2043801ddfbb1462ec47cb1c2984b98e93d/amazon/textbookSnapshotIsolation.tla#L893)); `CorrectnessOfHoldingXLocks` ([statement](https://github.com/sanjosh/tlaplus/blob/fbd1a2043801ddfbb1462ec47cb1c2984b98e93d/amazon/textbookSnapshotIsolation.tla#L907)); `CorrectnessOfWaitingForXLock` ([statement](https://github.com/sanjosh/tlaplus/blob/fbd1a2043801ddfbb1462ec47cb1c2984b98e93d/amazon/textbookSnapshotIsolation.tla#L929)); `CahillSerializable` ([statement](https://github.com/sanjosh/tlaplus/blob/fbd1a2043801ddfbb1462ec47cb1c2984b98e93d/amazon/textbookSnapshotIsolation.tla#L1051)); `BernsteinSerializable` ([statement](https://github.com/sanjosh/tlaplus/blob/fbd1a2043801ddfbb1462ec47cb1c2984b98e93d/amazon/textbookSnapshotIsolation.tla#L1161)); `theorem` ([statement](https://github.com/sanjosh/tlaplus/blob/fbd1a2043801ddfbb1462ec47cb1c2984b98e93d/amazon/textbookSnapshotIsolation.tla#L622))", "liveness": "`theorem` ([statement](https://github.com/sanjosh/tlaplus/blob/fbd1a2043801ddfbb1462ec47cb1c2984b98e93d/amazon/textbookSnapshotIsolation.tla#L627))", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "plain-language_safety": "transactions obey snapshot-read and first-committer-wins rules; the two serializability predicates rule out cycles in their transaction dependency graphs", "source_url": "https://github.com/sanjosh/tlaplus/blob/fbd1a2043801ddfbb1462ec47cb1c2984b98e93d/amazon/textbookSnapshotIsolation.tla", "has_liveness": true}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "sanjosh-tlaplus / pluscal/alternating_bit/AltBitProtocol.tla", "specifies": "alternating-bit message transfer", "artifact_kind": "protocol/specification variant", "tool": "TLA+/PlusCal", "size": "149 physical lines; [exact source](https://github.com/sanjosh/tlaplus/blob/fbd1a2043801ddfbb1462ec47cb1c2984b98e93d/pluscal/alternating_bit/AltBitProtocol.tla)", "safety": "no named local property found; support/instance modules may inherit properties", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://github.com/sanjosh/tlaplus/blob/fbd1a2043801ddfbb1462ec47cb1c2984b98e93d/pluscal/alternating_bit/AltBitProtocol.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "sanjosh-tlaplus / pluscal/childcare/childcare.tla", "specifies": "concurrent staff/child ratio enforcement", "artifact_kind": "protocol/specification variant", "tool": "TLA+/PlusCal", "size": "101 physical lines; [exact source](https://github.com/sanjosh/tlaplus/blob/fbd1a2043801ddfbb1462ec47cb1c2984b98e93d/pluscal/childcare/childcare.tla)", "safety": "`IsEnvSafe` ([statement](https://github.com/sanjosh/tlaplus/blob/fbd1a2043801ddfbb1462ec47cb1c2984b98e93d/pluscal/childcare/childcare.tla#L10))", "liveness": "`Termination` ([statement](https://github.com/sanjosh/tlaplus/blob/fbd1a2043801ddfbb1462ec47cb1c2984b98e93d/pluscal/childcare/childcare.tla#L94))", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://github.com/sanjosh/tlaplus/blob/fbd1a2043801ddfbb1462ec47cb1c2984b98e93d/pluscal/childcare/childcare.tla", "has_liveness": true}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "sanjosh-tlaplus / pluscal/childcare/childcare2.tla", "specifies": "concurrent staff/child ratio enforcement", "artifact_kind": "protocol/specification variant", "tool": "TLA+/PlusCal", "size": "95 physical lines; [exact source](https://github.com/sanjosh/tlaplus/blob/fbd1a2043801ddfbb1462ec47cb1c2984b98e93d/pluscal/childcare/childcare2.tla)", "safety": "`IsEnvSafe` ([statement](https://github.com/sanjosh/tlaplus/blob/fbd1a2043801ddfbb1462ec47cb1c2984b98e93d/pluscal/childcare/childcare2.tla#L10))", "liveness": "`Termination` ([statement](https://github.com/sanjosh/tlaplus/blob/fbd1a2043801ddfbb1462ec47cb1c2984b98e93d/pluscal/childcare/childcare2.tla#L91))", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://github.com/sanjosh/tlaplus/blob/fbd1a2043801ddfbb1462ec47cb1c2984b98e93d/pluscal/childcare/childcare2.tla", "has_liveness": true}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "sanjosh-tlaplus / pluscal/childcare/childcare2_fail.tla", "specifies": "concurrent staff/child ratio enforcement", "artifact_kind": "protocol/specification variant", "tool": "TLA+/PlusCal", "size": "97 physical lines; [exact source](https://github.com/sanjosh/tlaplus/blob/fbd1a2043801ddfbb1462ec47cb1c2984b98e93d/pluscal/childcare/childcare2_fail.tla)", "safety": "`IsEnvSafe` ([statement](https://github.com/sanjosh/tlaplus/blob/fbd1a2043801ddfbb1462ec47cb1c2984b98e93d/pluscal/childcare/childcare2_fail.tla#L10))", "liveness": "`Termination` ([statement](https://github.com/sanjosh/tlaplus/blob/fbd1a2043801ddfbb1462ec47cb1c2984b98e93d/pluscal/childcare/childcare2_fail.tla#L93))", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://github.com/sanjosh/tlaplus/blob/fbd1a2043801ddfbb1462ec47cb1c2984b98e93d/pluscal/childcare/childcare2_fail.tla", "has_liveness": true}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "sanjosh-tlaplus / pluscal/dining_philosophers/dining_deadlock.tla", "specifies": "dining-philosopher synchronization", "artifact_kind": "protocol/specification variant", "tool": "TLA+/PlusCal", "size": "101 physical lines; [exact source](https://github.com/sanjosh/tlaplus/blob/fbd1a2043801ddfbb1462ec47cb1c2984b98e93d/pluscal/dining_philosophers/dining_deadlock.tla)", "safety": "no named local property found; support/instance modules may inherit properties", "liveness": "`Termination` ([statement](https://github.com/sanjosh/tlaplus/blob/fbd1a2043801ddfbb1462ec47cb1c2984b98e93d/pluscal/dining_philosophers/dining_deadlock.tla#L97))", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://github.com/sanjosh/tlaplus/blob/fbd1a2043801ddfbb1462ec47cb1c2984b98e93d/pluscal/dining_philosophers/dining_deadlock.tla", "has_liveness": true}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "sanjosh-tlaplus / pluscal/dining_philosophers/dining_no_deadlock.tla", "specifies": "dining-philosopher synchronization", "artifact_kind": "protocol/specification variant", "tool": "TLA+/PlusCal", "size": "116 physical lines; [exact source](https://github.com/sanjosh/tlaplus/blob/fbd1a2043801ddfbb1462ec47cb1c2984b98e93d/pluscal/dining_philosophers/dining_no_deadlock.tla)", "safety": "no named local property found; support/instance modules may inherit properties", "liveness": "`Termination` ([statement](https://github.com/sanjosh/tlaplus/blob/fbd1a2043801ddfbb1462ec47cb1c2984b98e93d/pluscal/dining_philosophers/dining_no_deadlock.tla#L112))", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://github.com/sanjosh/tlaplus/blob/fbd1a2043801ddfbb1462ec47cb1c2984b98e93d/pluscal/dining_philosophers/dining_no_deadlock.tla", "has_liveness": true}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "nano-o-Distributed-termination-detection / ApaTermination.tla", "specifies": "channel-counting distributed termination detection", "artifact_kind": "model instance", "tool": "TLA+", "size": "26 physical lines; [exact source](https://github.com/nano-o/Distributed-termination-detection/blob/48d7201903592583bd2bdb5d73552f70911e8874/ApaTermination.tla)", "safety": "no named local property found; support/instance modules may inherit properties", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "configured_checks": "`INVARIANTS: Canary1`; [configuration](https://github.com/nano-o/Distributed-termination-detection/blob/48d7201903592583bd2bdb5d73552f70911e8874/TerminationPlusCal.cfg) | `INVARIANTS: Canary1`; [configuration](https://github.com/nano-o/Distributed-termination-detection/blob/48d7201903592583bd2bdb5d73552f70911e8874/Termination.cfg)", "scope": "safety means a reported termination is correct, not that termination is eventually reported", "source_url": "https://github.com/nano-o/Distributed-termination-detection/blob/48d7201903592583bd2bdb5d73552f70911e8874/ApaTermination.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "nano-o-Distributed-termination-detection / Termination.tla", "specifies": "channel-counting distributed termination detection", "artifact_kind": "protocol/specification variant", "tool": "TLA+", "size": "157 physical lines; [exact source](https://github.com/nano-o/Distributed-termination-detection/blob/48d7201903592583bd2bdb5d73552f70911e8874/Termination.tla)", "safety": "`Safety` ([statement](https://github.com/nano-o/Distributed-termination-detection/blob/48d7201903592583bd2bdb5d73552f70911e8874/Termination.tla#L54)); `TypeOK` ([statement](https://github.com/nano-o/Distributed-termination-detection/blob/48d7201903592583bd2bdb5d73552f70911e8874/Termination.tla#L56)); `Inv1` ([statement](https://github.com/nano-o/Distributed-termination-detection/blob/48d7201903592583bd2bdb5d73552f70911e8874/Termination.tla#L132)); `Inv2` ([statement](https://github.com/nano-o/Distributed-termination-detection/blob/48d7201903592583bd2bdb5d73552f70911e8874/Termination.tla#L144)); `Inv3` ([statement](https://github.com/nano-o/Distributed-termination-detection/blob/48d7201903592583bd2bdb5d73552f70911e8874/Termination.tla#L147)); `Safety_` ([statement](https://github.com/nano-o/Distributed-termination-detection/blob/48d7201903592583bd2bdb5d73552f70911e8874/Termination.tla#L155))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "configured_checks": "`INVARIANTS: Canary1`; [configuration](https://github.com/nano-o/Distributed-termination-detection/blob/48d7201903592583bd2bdb5d73552f70911e8874/Termination.cfg)", "scope": "safety means a reported termination is correct, not that termination is eventually reported", "source_url": "https://github.com/nano-o/Distributed-termination-detection/blob/48d7201903592583bd2bdb5d73552f70911e8874/Termination.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "nano-o-Distributed-termination-detection / TerminationPlusCal.tla", "specifies": "channel-counting distributed termination detection", "artifact_kind": "protocol/specification variant", "tool": "TLA+/PlusCal", "size": "123 physical lines; [exact source](https://github.com/nano-o/Distributed-termination-detection/blob/48d7201903592583bd2bdb5d73552f70911e8874/TerminationPlusCal.tla)", "safety": "`Correctness` ([statement](https://github.com/nano-o/Distributed-termination-detection/blob/48d7201903592583bd2bdb5d73552f70911e8874/TerminationPlusCal.tla#L62)); `Terminating` ([statement](https://github.com/nano-o/Distributed-termination-detection/blob/48d7201903592583bd2bdb5d73552f70911e8874/TerminationPlusCal.tla#L107))", "liveness": "`Termination` ([statement](https://github.com/nano-o/Distributed-termination-detection/blob/48d7201903592583bd2bdb5d73552f70911e8874/TerminationPlusCal.tla#L116))", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "configured_checks": "`INVARIANTS: Canary1`; [configuration](https://github.com/nano-o/Distributed-termination-detection/blob/48d7201903592583bd2bdb5d73552f70911e8874/TerminationPlusCal.cfg)", "scope": "safety means a reported termination is correct, not that termination is eventually reported", "source_url": "https://github.com/nano-o/Distributed-termination-detection/blob/48d7201903592583bd2bdb5d73552f70911e8874/TerminationPlusCal.tla", "has_liveness": true}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "nano-o-Distributed-termination-detection / Termination_proof.tla", "specifies": "channel-counting distributed termination detection", "artifact_kind": "proof module", "tool": "TLA+; TLAPS proof language", "size": "240 physical lines; [exact source](https://github.com/nano-o/Distributed-termination-detection/blob/48d7201903592583bd2bdb5d73552f70911e8874/Termination_proof.tla)", "safety": "`TypeCorrect` ([statement](https://github.com/nano-o/Distributed-termination-detection/blob/48d7201903592583bd2bdb5d73552f70911e8874/Termination_proof.tla#L10)); `Invariant1` ([statement](https://github.com/nano-o/Distributed-termination-detection/blob/48d7201903592583bd2bdb5d73552f70911e8874/Termination_proof.tla#L44)); `Invariant2` ([statement](https://github.com/nano-o/Distributed-termination-detection/blob/48d7201903592583bd2bdb5d73552f70911e8874/Termination_proof.tla#L92)); `Invariant3` ([statement](https://github.com/nano-o/Distributed-termination-detection/blob/48d7201903592583bd2bdb5d73552f70911e8874/Termination_proof.tla#L213)); `theorem` ([statement](https://github.com/nano-o/Distributed-termination-detection/blob/48d7201903592583bd2bdb5d73552f70911e8874/Termination_proof.tla#L223))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "TLAPS proof content present; successful checking not independently established", "scope": "safety means a reported termination is correct, not that termination is eventually reported", "source_url": "https://github.com/nano-o/Distributed-termination-detection/blob/48d7201903592583bd2bdb5d73552f70911e8874/Termination_proof.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "nano-o-Caesar / AbstractLeaderlessPaxos.tla", "specifies": "Caesar/leaderless generalized consensus and dependency ordering", "artifact_kind": "protocol/specification variant", "tool": "TLA+/PlusCal", "size": "602 physical lines; [exact source](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/AbstractLeaderlessPaxos.tla)", "safety": "`TypeInvariant` ([statement](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/AbstractLeaderlessPaxos.tla#L343)); `Inv1` ([statement](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/AbstractLeaderlessPaxos.tla#L394)); `Inv3` ([statement](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/AbstractLeaderlessPaxos.tla#L396)); `Inv2` ([statement](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/AbstractLeaderlessPaxos.tla#L400)); `Inv4` ([statement](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/AbstractLeaderlessPaxos.tla#L403)); `GraphInvariant` ([statement](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/AbstractLeaderlessPaxos.tla#L420)); `Agreement` ([statement](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/AbstractLeaderlessPaxos.tla#L473))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/AbstractLeaderlessPaxos.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "nano-o-Caesar / Ballots.tla", "specifies": "Caesar/leaderless generalized consensus and dependency ordering", "artifact_kind": "support module", "tool": "TLA+", "size": "48 physical lines; [exact source](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/Ballots.tla)", "safety": "no named local property found; support/instance modules may inherit properties", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/Ballots.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "nano-o-Caesar / Caesar.tla", "specifies": "Caesar/leaderless generalized consensus and dependency ordering", "artifact_kind": "protocol/specification variant", "tool": "TLA+", "size": "238 physical lines; [exact source](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/Caesar.tla)", "safety": "`TypeInvariant` ([statement](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/Caesar.tla#L75)); `Inv1` ([statement](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/Caesar.tla#L229))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/Caesar.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "nano-o-Caesar / Caesar2.tla", "specifies": "Caesar/leaderless generalized consensus and dependency ordering", "artifact_kind": "protocol/specification variant", "tool": "TLA+/PlusCal", "size": "794 physical lines; [exact source](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/Caesar2.tla)", "safety": "`TypeInvariant` ([statement](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/Caesar2.tla#L464)); `Inv1` ([statement](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/Caesar2.tla#L524)); `Inv2` ([statement](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/Caesar2.tla#L526)); `Inv3` ([statement](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/Caesar2.tla#L535)); `GraphInvariant` ([statement](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/Caesar2.tla#L543)); `Agreement` ([statement](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/Caesar2.tla#L550))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/Caesar2.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "nano-o-Caesar / Caesar3.tla", "specifies": "Caesar/leaderless generalized consensus and dependency ordering", "artifact_kind": "protocol/specification variant", "tool": "TLA+/PlusCal", "size": "683 physical lines; [exact source](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/Caesar3.tla)", "safety": "`TypeInvariant` ([statement](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/Caesar3.tla#L413)); `Inv3` ([statement](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/Caesar3.tla#L426)); `Inv1` ([statement](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/Caesar3.tla#L466)); `Inv2` ([statement](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/Caesar3.tla#L468)); `GraphInvariant` ([statement](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/Caesar3.tla#L475)); `Agreement` ([statement](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/Caesar3.tla#L482))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/Caesar3.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "nano-o-Caesar / Caesar4.tla", "specifies": "Caesar/leaderless generalized consensus and dependency ordering", "artifact_kind": "protocol/specification variant", "tool": "TLA+/PlusCal", "size": "869 physical lines; [exact source](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/Caesar4.tla)", "safety": "`TypeInvariant` ([statement](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/Caesar4.tla#L480)); `GraphInvariant` ([statement](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/Caesar4.tla#L596)); `Agreement` ([statement](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/Caesar4.tla#L603))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/Caesar4.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "nano-o-Caesar / CaesarPlusCal.tla", "specifies": "Caesar/leaderless generalized consensus and dependency ordering", "artifact_kind": "protocol/specification variant", "tool": "TLA+/PlusCal", "size": "465 physical lines; [exact source](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/CaesarPlusCal.tla)", "safety": "`Disagreement` ([statement](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/CaesarPlusCal.tla#L274)); `TypeInvariant` ([statement](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/CaesarPlusCal.tla#L399)); `Inv1` ([statement](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/CaesarPlusCal.tla#L411)); `Inv2` ([statement](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/CaesarPlusCal.tla#L454)); `Inv3` ([statement](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/CaesarPlusCal.tla#L456))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/CaesarPlusCal.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "nano-o-Caesar / Commands.tla", "specifies": "Caesar/leaderless generalized consensus and dependency ordering", "artifact_kind": "support module", "tool": "TLA+", "size": "40 physical lines; [exact source](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/Commands.tla)", "safety": "no named local property found; support/instance modules may inherit properties", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/Commands.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "nano-o-Caesar / EPaxosLight.tla", "specifies": "Caesar/leaderless generalized consensus and dependency ordering", "artifact_kind": "protocol/specification variant", "tool": "TLA+/PlusCal", "size": "513 physical lines; [exact source](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/EPaxosLight.tla)", "safety": "`TypeInvariant` ([statement](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/EPaxosLight.tla#L299)); `Inv1` ([statement](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/EPaxosLight.tla#L326)); `Inv3` ([statement](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/EPaxosLight.tla#L328)); `Inv2` ([statement](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/EPaxosLight.tla#L332)); `Inv4` ([statement](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/EPaxosLight.tla#L334)); `GraphInvariant` ([statement](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/EPaxosLight.tla#L371)); `Agreement` ([statement](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/EPaxosLight.tla#L382))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/EPaxosLight.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "nano-o-Caesar / LeaderlessPaxos.tla", "specifies": "Caesar/leaderless generalized consensus and dependency ordering", "artifact_kind": "protocol/specification variant", "tool": "TLA+/PlusCal", "size": "589 physical lines; [exact source](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/LeaderlessPaxos.tla)", "safety": "`TypeInvariant` ([statement](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/LeaderlessPaxos.tla#L343)); `Inv1` ([statement](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/LeaderlessPaxos.tla#L394)); `Inv3` ([statement](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/LeaderlessPaxos.tla#L396)); `Inv2` ([statement](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/LeaderlessPaxos.tla#L400)); `Inv4` ([statement](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/LeaderlessPaxos.tla#L403)); `GraphInvariant` ([statement](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/LeaderlessPaxos.tla#L420)); `Agreement` ([statement](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/LeaderlessPaxos.tla#L460))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/LeaderlessPaxos.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "nano-o-Caesar / Maps.tla", "specifies": "Caesar/leaderless generalized consensus and dependency ordering", "artifact_kind": "support module", "tool": "TLA+", "size": "18 physical lines; [exact source](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/Maps.tla)", "safety": "no named local property found; support/instance modules may inherit properties", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/Maps.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "nano-o-Caesar / Quorums.tla", "specifies": "Caesar/leaderless generalized consensus and dependency ordering", "artifact_kind": "support module", "tool": "TLA+", "size": "21 physical lines; [exact source](https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/Quorums.tla)", "safety": "no named local property found; support/instance modules may inherit properties", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://github.com/nano-o/Caesar/blob/ad6781da4d38de42af2611f74a3815dc404f1b1b/Quorums.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "muratdem-HLC / hlc.tla", "specifies": "hybrid logical/vector clocks; naive counterexample variant", "artifact_kind": "protocol/specification variant", "tool": "TLA+/PlusCal", "size": "108 physical lines; [exact source](https://github.com/muratdem/HLC/blob/8af59b54db44656f34166019d8d0eb74314c0256/hlc.tla)", "safety": "`TypeOK` ([statement](https://github.com/muratdem/HLC/blob/8af59b54db44656f34166019d8d0eb74314c0256/hlc.tla#L101)); `Sync` ([statement](https://github.com/muratdem/HLC/blob/8af59b54db44656f34166019d8d0eb74314c0256/hlc.tla#L102)); `Boundedl` ([statement](https://github.com/muratdem/HLC/blob/8af59b54db44656f34166019d8d0eb74314c0256/hlc.tla#L103)); `Boundedc` ([statement](https://github.com/muratdem/HLC/blob/8af59b54db44656f34166019d8d0eb74314c0256/hlc.tla#L104))", "liveness": "`Termination` ([statement](https://github.com/muratdem/HLC/blob/8af59b54db44656f34166019d8d0eb74314c0256/hlc.tla#L96))", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://github.com/muratdem/HLC/blob/8af59b54db44656f34166019d8d0eb74314c0256/hlc.tla", "has_liveness": true}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "muratdem-HLC / hlcnaive2.tla", "specifies": "hybrid logical/vector clocks; naive counterexample variant", "artifact_kind": "protocol/specification variant", "tool": "TLA+/PlusCal", "size": "92 physical lines; [exact source](https://github.com/muratdem/HLC/blob/8af59b54db44656f34166019d8d0eb74314c0256/hlcnaive2.tla)", "safety": "`TypeOK` ([statement](https://github.com/muratdem/HLC/blob/8af59b54db44656f34166019d8d0eb74314c0256/hlcnaive2.tla#L87)); `Sync` ([statement](https://github.com/muratdem/HLC/blob/8af59b54db44656f34166019d8d0eb74314c0256/hlcnaive2.tla#L88)); `Bounded` ([statement](https://github.com/muratdem/HLC/blob/8af59b54db44656f34166019d8d0eb74314c0256/hlcnaive2.tla#L89))", "liveness": "`Termination` ([statement](https://github.com/muratdem/HLC/blob/8af59b54db44656f34166019d8d0eb74314c0256/hlcnaive2.tla#L82))", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "counterexample_status": "source says “this is violated!!! in general unbounded!” beside `Bounded`; this is an intentionally flawed variant", "source_url": "https://github.com/muratdem/HLC/blob/8af59b54db44656f34166019d8d0eb74314c0256/hlcnaive2.tla", "has_liveness": true}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "muratdem-HLC / vc.tla", "specifies": "hybrid logical/vector clocks; naive counterexample variant", "artifact_kind": "protocol/specification variant", "tool": "TLA+/PlusCal", "size": "110 physical lines; [exact source](https://github.com/muratdem/HLC/blob/8af59b54db44656f34166019d8d0eb74314c0256/vc.tla)", "safety": "`VCCOK` ([statement](https://github.com/muratdem/HLC/blob/8af59b54db44656f34166019d8d0eb74314c0256/vc.tla#L102)); `TypeOK` ([statement](https://github.com/muratdem/HLC/blob/8af59b54db44656f34166019d8d0eb74314c0256/vc.tla#L103)); `Sync` ([statement](https://github.com/muratdem/HLC/blob/8af59b54db44656f34166019d8d0eb74314c0256/vc.tla#L104)); `VCprop` ([statement](https://github.com/muratdem/HLC/blob/8af59b54db44656f34166019d8d0eb74314c0256/vc.tla#L105))", "liveness": "`Termination` ([statement](https://github.com/muratdem/HLC/blob/8af59b54db44656f34166019d8d0eb74314c0256/vc.tla#L97))", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://github.com/muratdem/HLC/blob/8af59b54db44656f34166019d8d0eb74314c0256/vc.tla", "has_liveness": true}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "efficient-epaxos / tla+/EgalitarianPaxos.tla", "specifies": "Egalitarian Paxos consensus", "artifact_kind": "protocol/specification variant", "tool": "TLA+", "size": "718 physical lines; [exact source](https://github.com/efficient/epaxos/blob/791b115669fca472d3136f6a2eda46c00b3f8251/tla+/EgalitarianPaxos.tla)", "safety": "`TypeOK` ([statement](https://github.com/efficient/epaxos/blob/791b115669fca472d3136f6a2eda46c00b3f8251/tla+/EgalitarianPaxos.tla#L120)); `Nontriviality` ([statement](https://github.com/efficient/epaxos/blob/791b115669fca472d3136f6a2eda46c00b3f8251/tla+/EgalitarianPaxos.tla#L687)); `Stability` ([statement](https://github.com/efficient/epaxos/blob/791b115669fca472d3136f6a2eda46c00b3f8251/tla+/EgalitarianPaxos.tla#L691)); `Consistency` ([statement](https://github.com/efficient/epaxos/blob/791b115669fca472d3136f6a2eda46c00b3f8251/tla+/EgalitarianPaxos.tla#L704)); `theorem` ([statement](https://github.com/efficient/epaxos/blob/791b115669fca472d3136f6a2eda46c00b3f8251/tla+/EgalitarianPaxos.tla#L708))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "plain-language_safety": "only proposed/no-op commands commit; committed/executed commands remain so; each instance commits at most one command", "source_url": "https://github.com/efficient/epaxos/blob/791b115669fca472d3136f6a2eda46c00b3f8251/tla+/EgalitarianPaxos.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "losa-leaderless / CStruct.tla", "specifies": "leaderless generalized consensus, command-order and graph-processing support", "artifact_kind": "support module", "tool": "TLA+", "size": "71 physical lines; [exact source](https://losa.fr/research/leaderless/CStruct.tla)", "safety": "no named local property found; support/instance modules may inherit properties", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://losa.fr/research/leaderless/CStruct.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "losa-leaderless / Common.tla", "specifies": "leaderless generalized consensus, command-order and graph-processing support", "artifact_kind": "support module", "tool": "TLA+", "size": "17 physical lines; [exact source](https://losa.fr/research/leaderless/Common.tla)", "safety": "no named local property found; support/instance modules may inherit properties", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://losa.fr/research/leaderless/Common.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "losa-leaderless / Consensus.tla", "specifies": "leaderless generalized consensus, command-order and graph-processing support", "artifact_kind": "protocol/specification variant", "tool": "TLA+", "size": "27 physical lines; [exact source](https://losa.fr/research/leaderless/Consensus.tla)", "safety": "`theorem` ([statement](https://losa.fr/research/leaderless/Consensus.tla))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://losa.fr/research/leaderless/Consensus.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "losa-leaderless / ConsensusInterface.tla", "specifies": "leaderless generalized consensus, command-order and graph-processing support", "artifact_kind": "support module", "tool": "TLA+", "size": "25 physical lines; [exact source](https://losa.fr/research/leaderless/ConsensusInterface.tla)", "safety": "no named local property found; support/instance modules may inherit properties", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://losa.fr/research/leaderless/ConsensusInterface.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "losa-leaderless / DiGraph.tla", "specifies": "leaderless generalized consensus, command-order and graph-processing support", "artifact_kind": "protocol/specification variant", "tool": "TLA+", "size": "159 physical lines; [exact source](https://losa.fr/research/leaderless/DiGraph.tla)", "safety": "`Prefix` ([statement](https://losa.fr/research/leaderless/DiGraph.tla))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://losa.fr/research/leaderless/DiGraph.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "losa-leaderless / GraphProcessing2.tla", "specifies": "leaderless generalized consensus, command-order and graph-processing support", "artifact_kind": "protocol/specification variant", "tool": "TLA+", "size": "277 physical lines; [exact source](https://losa.fr/research/leaderless/GraphProcessing2.tla)", "safety": "`DependencyGraphInvariant` ([statement](https://losa.fr/research/leaderless/GraphProcessing2.tla)); `PrefixUpTo` ([statement](https://losa.fr/research/leaderless/GraphProcessing2.tla))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://losa.fr/research/leaderless/GraphProcessing2.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "losa-leaderless / ModularLeaderless.tla", "specifies": "leaderless generalized consensus, command-order and graph-processing support", "artifact_kind": "protocol/specification variant", "tool": "TLA+", "size": "117 physical lines; [exact source](https://losa.fr/research/leaderless/ModularLeaderless.tla)", "safety": "`Consistency` ([statement](https://losa.fr/research/leaderless/ModularLeaderless.tla)); `theorem` ([statement](https://losa.fr/research/leaderless/ModularLeaderless.tla))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://losa.fr/research/leaderless/ModularLeaderless.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "losa-leaderless / OrderRelations.tla", "specifies": "leaderless generalized consensus, command-order and graph-processing support", "artifact_kind": "support module", "tool": "TLA+", "size": "57 physical lines; [exact source](https://losa.fr/research/leaderless/OrderRelations.tla)", "safety": "no named local property found; support/instance modules may inherit properties", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://losa.fr/research/leaderless/OrderRelations.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "losa-leaderless / SimpleDependencySetAlgorithm.tla", "specifies": "leaderless generalized consensus, command-order and graph-processing support", "artifact_kind": "protocol/specification variant", "tool": "TLA+/PlusCal", "size": "143 physical lines; [exact source](https://losa.fr/research/leaderless/SimpleDependencySetAlgorithm.tla)", "safety": "`Correctness` ([statement](https://losa.fr/research/leaderless/SimpleDependencySetAlgorithm.tla)); `theorem` ([statement](https://losa.fr/research/leaderless/SimpleDependencySetAlgorithm.tla))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://losa.fr/research/leaderless/SimpleDependencySetAlgorithm.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "losa-assignment / Allocation.tla", "specifies": "one-shot/long-lived distributed assignment and allocation", "artifact_kind": "support module", "tool": "TLA+/PlusCal", "size": "54 physical lines; [exact source](https://losa.fr/research/assignment/Allocation.tla)", "safety": "`Correctness` ([statement](https://losa.fr/research/assignment/Allocation.tla))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://losa.fr/research/assignment/Allocation.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "losa-assignment / Assignment.tla", "specifies": "one-shot/long-lived distributed assignment and allocation", "artifact_kind": "support module", "tool": "TLA+/PlusCal", "size": "102 physical lines; [exact source](https://losa.fr/research/assignment/Assignment.tla)", "safety": "`Correctness` ([statement](https://losa.fr/research/assignment/Assignment.tla))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://losa.fr/research/assignment/Assignment.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "losa-assignment / LongLivedAssignment.tla", "specifies": "one-shot/long-lived distributed assignment and allocation", "artifact_kind": "support module", "tool": "TLA+/PlusCal", "size": "114 physical lines; [exact source](https://losa.fr/research/assignment/LongLivedAssignment.tla)", "safety": "`Correctness` ([statement](https://losa.fr/research/assignment/LongLivedAssignment.tla))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://losa.fr/research/assignment/LongLivedAssignment.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "losa-M2Paxos / DistributedM2Paxos.tla", "specifies": "M2Paxos replicated object/consensus variants and MultiPaxos refinement", "artifact_kind": "protocol/specification variant", "tool": "TLA+", "size": "217 physical lines; [exact source](https://losa.fr/M2Paxos/M2Paxos.tar.gz)", "safety": "`TypeInv` ([statement](https://losa.fr/M2Paxos/M2Paxos.tar.gz))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://losa.fr/M2Paxos/M2Paxos.tar.gz", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "losa-M2Paxos / DistributedMultiPaxos.tla", "specifies": "M2Paxos replicated object/consensus variants and MultiPaxos refinement", "artifact_kind": "protocol/specification variant", "tool": "TLA+", "size": "126 physical lines; [exact source](https://losa.fr/M2Paxos/M2Paxos.tar.gz)", "safety": "`TypeInv` ([statement](https://losa.fr/M2Paxos/M2Paxos.tar.gz))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://losa.fr/M2Paxos/M2Paxos.tar.gz", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "losa-M2Paxos / M2Paxos.tla", "specifies": "M2Paxos replicated object/consensus variants and MultiPaxos refinement", "artifact_kind": "protocol/specification variant", "tool": "TLA+", "size": "207 physical lines; [exact source](https://losa.fr/M2Paxos/M2Paxos.tar.gz)", "safety": "`Prefix` ([statement](https://losa.fr/M2Paxos/M2Paxos.tar.gz)); `Correctness` ([statement](https://losa.fr/M2Paxos/M2Paxos.tar.gz)); `theorem` ([statement](https://losa.fr/M2Paxos/M2Paxos.tar.gz))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://losa.fr/M2Paxos/M2Paxos.tar.gz", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "losa-M2Paxos / MultiConsensus.tla", "specifies": "M2Paxos replicated object/consensus variants and MultiPaxos refinement", "artifact_kind": "support module", "tool": "TLA+", "size": "35 physical lines; [exact source](https://losa.fr/M2Paxos/M2Paxos.tar.gz)", "safety": "no named local property found; support/instance modules may inherit properties", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://losa.fr/M2Paxos/M2Paxos.tar.gz", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "losa-M2Paxos / MultiPaxos.tla", "specifies": "M2Paxos replicated object/consensus variants and MultiPaxos refinement", "artifact_kind": "protocol/specification variant", "tool": "TLA+", "size": "203 physical lines; [exact source](https://losa.fr/M2Paxos/M2Paxos.tar.gz)", "safety": "`TypeInv` ([statement](https://losa.fr/M2Paxos/M2Paxos.tar.gz)); `WellFormed` ([statement](https://losa.fr/M2Paxos/M2Paxos.tar.gz)); `SafeAt` ([statement](https://losa.fr/M2Paxos/M2Paxos.tar.gz)); `SafeInstanceVoteArray` ([statement](https://losa.fr/M2Paxos/M2Paxos.tar.gz)); `SafeVoteArray` ([statement](https://losa.fr/M2Paxos/M2Paxos.tar.gz)); `ProvedSafeAt` ([statement](https://losa.fr/M2Paxos/M2Paxos.tar.gz)); `Correctness` ([statement](https://losa.fr/M2Paxos/M2Paxos.tar.gz)); `theorem` ([statement](https://losa.fr/M2Paxos/M2Paxos.tar.gz))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://losa.fr/M2Paxos/M2Paxos.tar.gz", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "losa-M2Paxos / Objects.tla", "specifies": "M2Paxos replicated object/consensus variants and MultiPaxos refinement", "artifact_kind": "support module", "tool": "TLA+", "size": "16 physical lines; [exact source](https://losa.fr/M2Paxos/M2Paxos.tar.gz)", "safety": "no named local property found; support/instance modules may inherit properties", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "source_url": "https://losa.fr/M2Paxos/M2Paxos.tar.gz", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "YUH-Z-lmgpa / benchmarks/distributed_ind_inv/10_lockserv.tla", "specifies": "distributed-protocol inductive-invariant benchmark: lockserv", "artifact_kind": "protocol/specification variant", "tool": "TLA+", "size": "97 physical lines; [exact source](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/10_lockserv.tla)", "safety": "`TypeOK` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/10_lockserv.tla#L59)); `Mutex` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/10_lockserv.tla#L69)); `IndAuto` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/10_lockserv.tla#L83)); `Inductiveness` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/10_lockserv.tla#L96))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "benchmark_status": "supplied `IndAuto` candidate and inductiveness obligation; this source is a proof task, not evidence that the theorem was proved", "proof_coverage_limit": "preservation of an invariant candidate is distinct from proving initialization and deriving the desired system guarantee", "source_url": "https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/10_lockserv.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "YUH-Z-lmgpa / benchmarks/distributed_ind_inv/11_TwoPhase.tla", "specifies": "distributed-protocol inductive-invariant benchmark: TwoPhase", "artifact_kind": "protocol/specification variant", "tool": "TLA+", "size": "201 physical lines; [exact source](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/11_TwoPhase.tla)", "safety": "`TypeOK` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/11_TwoPhase.tla#L58)); `IndAuto` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/11_TwoPhase.tla#L187)); `Inductiveness` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/11_TwoPhase.tla#L200))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "benchmark_status": "supplied `IndAuto` candidate and inductiveness obligation; this source is a proof task, not evidence that the theorem was proved", "proof_coverage_limit": "preservation of an invariant candidate is distinct from proving initialization and deriving the desired system guarantee", "source_url": "https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/11_TwoPhase.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "YUH-Z-lmgpa / benchmarks/distributed_ind_inv/13_simple_decentralized_lock.tla", "specifies": "distributed-protocol inductive-invariant benchmark: simple decentralized lock", "artifact_kind": "protocol/specification variant", "tool": "TLA+", "size": "71 physical lines; [exact source](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/13_simple_decentralized_lock.tla)", "safety": "`TypeOK` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/13_simple_decentralized_lock.tla#L34)); `Inv` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/13_simple_decentralized_lock.tla#L39)); `IndAuto` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/13_simple_decentralized_lock.tla#L61)); `Inductiveness` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/13_simple_decentralized_lock.tla#L70))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "benchmark_status": "supplied `IndAuto` candidate and inductiveness obligation; this source is a proof task, not evidence that the theorem was proved", "proof_coverage_limit": "preservation of an invariant candidate is distinct from proving initialization and deriving the desired system guarantee", "source_url": "https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/13_simple_decentralized_lock.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "YUH-Z-lmgpa / benchmarks/distributed_ind_inv/14_two_phase_commit.tla", "specifies": "distributed-protocol inductive-invariant benchmark: two phase commit", "artifact_kind": "protocol/specification variant", "tool": "TLA+", "size": "138 physical lines; [exact source](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/14_two_phase_commit.tla)", "safety": "`TypeOK` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/14_two_phase_commit.tla#L91)); `Safety` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/14_two_phase_commit.tla#L101)); `IndAuto` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/14_two_phase_commit.tla#L122)); `Inductiveness` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/14_two_phase_commit.tla#L137))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "benchmark_status": "supplied `IndAuto` candidate and inductiveness obligation; this source is a proof task, not evidence that the theorem was proved", "proof_coverage_limit": "preservation of an invariant candidate is distinct from proving initialization and deriving the desired system guarantee", "source_url": "https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/14_two_phase_commit.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "YUH-Z-lmgpa / benchmarks/distributed_ind_inv/15_consensus_wo_decide.tla", "specifies": "distributed-protocol inductive-invariant benchmark: consensus wo decide", "artifact_kind": "protocol/specification variant", "tool": "TLA+", "size": "158 physical lines; [exact source](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/15_consensus_wo_decide.tla)", "safety": "`TypeOK` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/15_consensus_wo_decide.tla#L73)); `Safety` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/15_consensus_wo_decide.tla#L89)); `IndAuto` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/15_consensus_wo_decide.tla#L141)); `Inductiveness` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/15_consensus_wo_decide.tla#L156))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "benchmark_status": "supplied `IndAuto` candidate and inductiveness obligation; this source is a proof task, not evidence that the theorem was proved", "proof_coverage_limit": "preservation of an invariant candidate is distinct from proving initialization and deriving the desired system guarantee", "source_url": "https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/15_consensus_wo_decide.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "YUH-Z-lmgpa / benchmarks/distributed_ind_inv/16_consensus_forall.tla", "specifies": "distributed-protocol inductive-invariant benchmark: consensus forall", "artifact_kind": "protocol/specification variant", "tool": "TLA+", "size": "136 physical lines; [exact source](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/16_consensus_forall.tla)", "safety": "`TypeOK` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/16_consensus_forall.tla#L77)); `Safety` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/16_consensus_forall.tla#L95)); `IndAuto` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/16_consensus_forall.tla#L115)); `Inductiveness` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/16_consensus_forall.tla#L134))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "benchmark_status": "supplied `IndAuto` candidate and inductiveness obligation; this source is a proof task, not evidence that the theorem was proved", "proof_coverage_limit": "preservation of an invariant candidate is distinct from proving initialization and deriving the desired system guarantee", "source_url": "https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/16_consensus_forall.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "YUH-Z-lmgpa / benchmarks/distributed_ind_inv/19_sharded_kv_no_lost_keys.tla", "specifies": "distributed-protocol inductive-invariant benchmark: sharded kv no lost keys", "artifact_kind": "protocol/specification variant", "tool": "TLA+", "size": "86 physical lines; [exact source](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/19_sharded_kv_no_lost_keys.tla)", "safety": "`TypeOK` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/19_sharded_kv_no_lost_keys.tla#L54)); `Safety` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/19_sharded_kv_no_lost_keys.tla#L65)); `IndAuto` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/19_sharded_kv_no_lost_keys.tla#L77)); `Inductiveness` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/19_sharded_kv_no_lost_keys.tla#L85))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "benchmark_status": "supplied `IndAuto` candidate and inductiveness obligation; this source is a proof task, not evidence that the theorem was proved", "proof_coverage_limit": "preservation of an invariant candidate is distinct from proving initialization and deriving the desired system guarantee", "source_url": "https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/19_sharded_kv_no_lost_keys.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "YUH-Z-lmgpa / benchmarks/distributed_ind_inv/1_Consensus.tla", "specifies": "distributed-protocol inductive-invariant benchmark: Consensus", "artifact_kind": "protocol/specification variant", "tool": "TLA+", "size": "40 physical lines; [exact source](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/1_Consensus.tla)", "safety": "`TypeOK` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/1_Consensus.tla#L19)); `Inv` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/1_Consensus.tla#L29)); `IndAuto` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/1_Consensus.tla#L33)); `Inductiveness` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/1_Consensus.tla#L39))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "benchmark_status": "supplied `IndAuto` candidate and inductiveness obligation; this source is a proof task, not evidence that the theorem was proved", "proof_coverage_limit": "preservation of an invariant candidate is distinct from proving initialization and deriving the desired system guarantee", "source_url": "https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/1_Consensus.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "YUH-Z-lmgpa / benchmarks/distributed_ind_inv/20_naive_consensus.tla", "specifies": "distributed-protocol inductive-invariant benchmark: naive consensus", "artifact_kind": "protocol/specification variant", "tool": "TLA+", "size": "80 physical lines; [exact source](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/20_naive_consensus.tla)", "safety": "`TypeOK` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/20_naive_consensus.tla#L45)); `Safety` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/20_naive_consensus.tla#L56)); `IndAuto` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/20_naive_consensus.tla#L67)); `Inductiveness` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/20_naive_consensus.tla#L79))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "benchmark_status": "supplied `IndAuto` candidate and inductiveness obligation; this source is a proof task, not evidence that the theorem was proved", "proof_coverage_limit": "preservation of an invariant candidate is distinct from proving initialization and deriving the desired system guarantee", "source_url": "https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/20_naive_consensus.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "YUH-Z-lmgpa / benchmarks/distributed_ind_inv/21_client_server_ae.tla", "specifies": "distributed-protocol inductive-invariant benchmark: client server ae", "artifact_kind": "protocol/specification variant", "tool": "TLA+", "size": "72 physical lines; [exact source](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/21_client_server_ae.tla)", "safety": "`TypeOK` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/21_client_server_ae.tla#L46)); `Safety` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/21_client_server_ae.tla#L54)); `IndAuto` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/21_client_server_ae.tla#L63)); `Inductiveness` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/21_client_server_ae.tla#L71))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "benchmark_status": "supplied `IndAuto` candidate and inductiveness obligation; this source is a proof task, not evidence that the theorem was proved", "proof_coverage_limit": "preservation of an invariant candidate is distinct from proving initialization and deriving the desired system guarantee", "source_url": "https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/21_client_server_ae.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "YUH-Z-lmgpa / benchmarks/distributed_ind_inv/22_simple_election.tla", "specifies": "distributed-protocol inductive-invariant benchmark: simple election", "artifact_kind": "protocol/specification variant", "tool": "TLA+", "size": "79 physical lines; [exact source](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/22_simple_election.tla)", "safety": "`TypeOK` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/22_simple_election.tla#L50)); `Safety` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/22_simple_election.tla#L55)); `IndAuto` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/22_simple_election.tla#L63)); `Inductiveness` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/22_simple_election.tla#L78))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "benchmark_status": "supplied `IndAuto` candidate and inductiveness obligation; this source is a proof task, not evidence that the theorem was proved", "proof_coverage_limit": "preservation of an invariant candidate is distinct from proving initialization and deriving the desired system guarantee", "source_url": "https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/22_simple_election.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "YUH-Z-lmgpa / benchmarks/distributed_ind_inv/23_toy_consensus_epr.tla", "specifies": "distributed-protocol inductive-invariant benchmark: toy consensus epr", "artifact_kind": "protocol/specification variant", "tool": "TLA+", "size": "75 physical lines; [exact source](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/23_toy_consensus_epr.tla)", "safety": "`TypeOK` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/23_toy_consensus_epr.tla#L42)); `Safety` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/23_toy_consensus_epr.tla#L48)); `IndAuto` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/23_toy_consensus_epr.tla#L58)); `Inductiveness` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/23_toy_consensus_epr.tla#L74))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "benchmark_status": "supplied `IndAuto` candidate and inductiveness obligation; this source is a proof task, not evidence that the theorem was proved", "proof_coverage_limit": "preservation of an invariant candidate is distinct from proving initialization and deriving the desired system guarantee", "source_url": "https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/23_toy_consensus_epr.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "YUH-Z-lmgpa / benchmarks/distributed_ind_inv/24_toy_consensus.tla", "specifies": "distributed-protocol inductive-invariant benchmark: toy consensus", "artifact_kind": "protocol/specification variant", "tool": "TLA+", "size": "69 physical lines; [exact source](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/24_toy_consensus.tla)", "safety": "`TypeOK` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/24_toy_consensus.tla#L39)); `Inv` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/24_toy_consensus.tla#L46)); `IndAuto` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/24_toy_consensus.tla#L54)); `Inductiveness` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/24_toy_consensus.tla#L68))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "benchmark_status": "supplied `IndAuto` candidate and inductiveness obligation; this source is a proof task, not evidence that the theorem was proved", "proof_coverage_limit": "preservation of an invariant candidate is distinct from proving initialization and deriving the desired system guarantee", "source_url": "https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/24_toy_consensus.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "YUH-Z-lmgpa / benchmarks/distributed_ind_inv/25_client_server_db_ae.tla", "specifies": "distributed-protocol inductive-invariant benchmark: client server db ae", "artifact_kind": "protocol/specification variant", "tool": "TLA+", "size": "124 physical lines; [exact source](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/25_client_server_db_ae.tla)", "safety": "`TypeOK` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/25_client_server_db_ae.tla#L72)); `Safety` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/25_client_server_db_ae.tla#L90)); `IndAuto` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/25_client_server_db_ae.tla#L108)); `Inductiveness` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/25_client_server_db_ae.tla#L123))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "benchmark_status": "supplied `IndAuto` candidate and inductiveness obligation; this source is a proof task, not evidence that the theorem was proved", "proof_coverage_limit": "preservation of an invariant candidate is distinct from proving initialization and deriving the desired system guarantee", "source_url": "https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/25_client_server_db_ae.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "YUH-Z-lmgpa / benchmarks/distributed_ind_inv/27_firewall.tla", "specifies": "distributed-protocol inductive-invariant benchmark: firewall", "artifact_kind": "protocol/specification variant", "tool": "TLA+", "size": "70 physical lines; [exact source](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/27_firewall.tla)", "safety": "`Inv` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/27_firewall.tla#L37)); `TypeOK` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/27_firewall.tla#L44)); `IndAuto` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/27_firewall.tla#L58)); `Inductiveness` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/27_firewall.tla#L69))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "benchmark_status": "supplied `IndAuto` candidate and inductiveness obligation; this source is a proof task, not evidence that the theorem was proved", "proof_coverage_limit": "preservation of an invariant candidate is distinct from proving initialization and deriving the desired system guarantee", "source_url": "https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/27_firewall.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "YUH-Z-lmgpa / benchmarks/distributed_ind_inv/28_majorityset_leader_election.tla", "specifies": "distributed-protocol inductive-invariant benchmark: majorityset leader election", "artifact_kind": "protocol/specification variant", "tool": "TLA+", "size": "86 physical lines; [exact source](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/28_majorityset_leader_election.tla)", "safety": "`TypeOK` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/28_majorityset_leader_election.tla#L49)); `Safety` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/28_majorityset_leader_election.tla#L59)); `IndAuto` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/28_majorityset_leader_election.tla#L71)); `Inductiveness` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/28_majorityset_leader_election.tla#L85))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "benchmark_status": "supplied `IndAuto` candidate and inductiveness obligation; this source is a proof task, not evidence that the theorem was proved", "proof_coverage_limit": "preservation of an invariant candidate is distinct from proving initialization and deriving the desired system guarantee", "source_url": "https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/28_majorityset_leader_election.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "YUH-Z-lmgpa / benchmarks/distributed_ind_inv/29_consensus_epr.tla", "specifies": "distributed-protocol inductive-invariant benchmark: consensus epr", "artifact_kind": "protocol/specification variant", "tool": "TLA+", "size": "154 physical lines; [exact source](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/29_consensus_epr.tla)", "safety": "`TypeOK` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/29_consensus_epr.tla#L75)); `Safety` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/29_consensus_epr.tla#L110)); `SafetyWithTypeOK` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/29_consensus_epr.tla#L114)); `IndAuto` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/29_consensus_epr.tla#L132)); `Inductiveness` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/29_consensus_epr.tla#L153))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "benchmark_status": "supplied `IndAuto` candidate and inductiveness obligation; this source is a proof task, not evidence that the theorem was proved", "proof_coverage_limit": "preservation of an invariant candidate is distinct from proving initialization and deriving the desired system guarantee", "source_url": "https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/29_consensus_epr.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "YUH-Z-lmgpa / benchmarks/distributed_ind_inv/2_TCommit.tla", "specifies": "distributed-protocol inductive-invariant benchmark: TCommit", "artifact_kind": "protocol/specification variant", "tool": "TLA+", "size": "72 physical lines; [exact source](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/2_TCommit.tla)", "safety": "`TCTypeOK` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/2_TCommit.tla#L8)); `IndAuto` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/2_TCommit.tla#L67)); `Inductiveness` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/2_TCommit.tla#L71))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "benchmark_status": "supplied `IndAuto` candidate and inductiveness obligation; this source is a proof task, not evidence that the theorem was proved", "proof_coverage_limit": "preservation of an invariant candidate is distinct from proving initialization and deriving the desired system guarantee", "source_url": "https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/2_TCommit.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "YUH-Z-lmgpa / benchmarks/distributed_ind_inv/30_MongoLoglessDynamicRaft.tla", "specifies": "distributed-protocol inductive-invariant benchmark: MongoLoglessDynamicRaft", "artifact_kind": "protocol/specification variant", "tool": "TLA+", "size": "249 physical lines; [exact source](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/30_MongoLoglessDynamicRaft.tla)", "safety": "`Safety` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/30_MongoLoglessDynamicRaft.tla#L176)); `BoundedSeq` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/30_MongoLoglessDynamicRaft.tla#L182)); `TypeOK` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/30_MongoLoglessDynamicRaft.tla#L187)); `IndAuto` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/30_MongoLoglessDynamicRaft.tla#L221)); `Inductiveness` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/30_MongoLoglessDynamicRaft.tla#L247))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "benchmark_status": "supplied `IndAuto` candidate and inductiveness obligation; this source is a proof task, not evidence that the theorem was proved", "proof_coverage_limit": "preservation of an invariant candidate is distinct from proving initialization and deriving the desired system guarantee", "source_url": "https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/30_MongoLoglessDynamicRaft.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "YUH-Z-lmgpa / benchmarks/distributed_ind_inv/3_lockserver.tla", "specifies": "distributed-protocol inductive-invariant benchmark: lockserver", "artifact_kind": "protocol/specification variant", "tool": "TLA+", "size": "76 physical lines; [exact source](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/3_lockserver.tla)", "safety": "`TypeOK` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/3_lockserver.tla#L52)); `Inv` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/3_lockserver.tla#L57)); `IndAuto` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/3_lockserver.tla#L69)); `Inductiveness` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/3_lockserver.tla#L75))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "benchmark_status": "supplied `IndAuto` candidate and inductiveness obligation; this source is a proof task, not evidence that the theorem was proved", "proof_coverage_limit": "preservation of an invariant candidate is distinct from proving initialization and deriving the desired system guarantee", "source_url": "https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/3_lockserver.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "YUH-Z-lmgpa / benchmarks/distributed_ind_inv/4_quorum_leader_election.tla", "specifies": "distributed-protocol inductive-invariant benchmark: quorum leader election", "artifact_kind": "protocol/specification variant", "tool": "TLA+", "size": "64 physical lines; [exact source](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/4_quorum_leader_election.tla)", "safety": "`Inv` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/4_quorum_leader_election.tla#L39)); `TypeOK` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/4_quorum_leader_election.tla#L41)); `IndAuto` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/4_quorum_leader_election.tla#L51)); `Inductiveness` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/4_quorum_leader_election.tla#L63))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "benchmark_status": "supplied `IndAuto` candidate and inductiveness obligation; this source is a proof task, not evidence that the theorem was proved", "proof_coverage_limit": "preservation of an invariant candidate is distinct from proving initialization and deriving the desired system guarantee", "source_url": "https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/4_quorum_leader_election.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "YUH-Z-lmgpa / benchmarks/distributed_ind_inv/5_toy_consensus_forall.tla", "specifies": "distributed-protocol inductive-invariant benchmark: toy consensus forall", "artifact_kind": "protocol/specification variant", "tool": "TLA+", "size": "100 physical lines; [exact source](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/5_toy_consensus_forall.tla)", "safety": "`Inv` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/5_toy_consensus_forall.tla#L59)); `TypeOK` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/5_toy_consensus_forall.tla#L46)); `IndAuto` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/5_toy_consensus_forall.tla#L87)); `Inductiveness` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/5_toy_consensus_forall.tla#L99))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "benchmark_status": "supplied `IndAuto` candidate and inductiveness obligation; this source is a proof task, not evidence that the theorem was proved", "proof_coverage_limit": "preservation of an invariant candidate is distinct from proving initialization and deriving the desired system guarantee", "source_url": "https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/5_toy_consensus_forall.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "YUH-Z-lmgpa / benchmarks/distributed_ind_inv/6_Simple.tla", "specifies": "distributed-protocol inductive-invariant benchmark: Simple", "artifact_kind": "protocol/specification variant", "tool": "TLA+", "size": "137 physical lines; [exact source](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/6_Simple.tla)", "safety": "`Terminating` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/6_Simple.tla#L62)); `PCorrect` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/6_Simple.tla#L82)); `TypeOK` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/6_Simple.tla#L91)); `IndAuto` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/6_Simple.tla#L124)); `Inductiveness` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/6_Simple.tla#L132))", "liveness": "`Termination` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/6_Simple.tla#L69))", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "benchmark_status": "supplied `IndAuto` candidate and inductiveness obligation; this source is a proof task, not evidence that the theorem was proved", "proof_coverage_limit": "preservation of an invariant candidate is distinct from proving initialization and deriving the desired system guarantee", "source_url": "https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/6_Simple.tla", "has_liveness": true}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "YUH-Z-lmgpa / benchmarks/distributed_ind_inv/7_lockserv_automaton.tla", "specifies": "distributed-protocol inductive-invariant benchmark: lockserv automaton", "artifact_kind": "protocol/specification variant", "tool": "TLA+", "size": "100 physical lines; [exact source](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/7_lockserv_automaton.tla)", "safety": "`TypeOK` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/7_lockserv_automaton.tla#L64)); `Mutex` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/7_lockserv_automaton.tla#L72)); `IndAuto` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/7_lockserv_automaton.tla#L86)); `Inductiveness` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/7_lockserv_automaton.tla#L99))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "benchmark_status": "supplied `IndAuto` candidate and inductiveness obligation; this source is a proof task, not evidence that the theorem was proved", "proof_coverage_limit": "preservation of an invariant candidate is distinct from proving initialization and deriving the desired system guarantee", "source_url": "https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/7_lockserv_automaton.tla", "has_liveness": false}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "YUH-Z-lmgpa / benchmarks/distributed_ind_inv/8_SimpleRegular.tla", "specifies": "distributed-protocol inductive-invariant benchmark: SimpleRegular", "artifact_kind": "protocol/specification variant", "tool": "TLA+", "size": "150 physical lines; [exact source](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/8_SimpleRegular.tla)", "safety": "`PCorrect` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/8_SimpleRegular.tla#L113)); `TypeOK` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/8_SimpleRegular.tla#L122)); `IndAuto` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/8_SimpleRegular.tla#L137)); `Inductiveness` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/8_SimpleRegular.tla#L145))", "liveness": "`Termination` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/8_SimpleRegular.tla#L106))", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "benchmark_status": "supplied `IndAuto` candidate and inductiveness obligation; this source is a proof task, not evidence that the theorem was proved", "proof_coverage_limit": "preservation of an invariant candidate is distinct from proving initialization and deriving the desired system guarantee", "source_url": "https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/8_SimpleRegular.tla", "has_liveness": true}
{"section": "TLA+ external source repositories and author source archives", "group": "", "name": "YUH-Z-lmgpa / benchmarks/distributed_ind_inv/9_sharded_kv.tla", "specifies": "distributed-protocol inductive-invariant benchmark: sharded kv", "artifact_kind": "protocol/specification variant", "tool": "TLA+", "size": "95 physical lines; [exact source](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/9_sharded_kv.tla)", "safety": "`TypeOK` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/9_sharded_kv.tla#L52)); `Safety` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/9_sharded_kv.tla#L63)); `IndAuto` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/9_sharded_kv.tla#L80)); `Inductiveness` ([statement](https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/9_sharded_kv.tla#L94))", "liveness": "no named local property found; support/instance modules may inherit properties", "evidence_status": "specification/model-checking source; no local machine-checked proof identified", "benchmark_status": "supplied `IndAuto` candidate and inductiveness obligation; this source is a proof task, not evidence that the theorem was proved", "proof_coverage_limit": "preservation of an invariant candidate is distinct from proving initialization and deriving the desired system guarantee", "source_url": "https://github.com/YUH-Z/lmgpa/blob/c27bf4f657c10254b8df8c66ca37f1cdbbf66f1e/benchmarks/distributed_ind_inv/9_sharded_kv.tla", "has_liveness": false}
{"section": "Additional Lean and Isabelle proof artifacts", "group": "", "name": "Flexible Paxos inductive transition system", "specifies": "acceptor promise/accept actions with separate phase-one and phase-two quorums", "tool": "Lean 4; machine-checkable proof source, not rerun", "size": "190 physical lines; [exact source](https://github.com/fpaxos/fpaxos-tlaplus/blob/a6baf4a0f55799dc5fa413ffa073489808925889/lean/FPaxos.lean)", "safety": "state/actions defined here; `SafeValue` and agreement are proved in `Proof.lean`", "liveness": "no progress guarantee claimed", "source_scan": "no literal `sorry` or `axiom` found; compilation not rerun", "source_url": "https://github.com/fpaxos/fpaxos-tlaplus/blob/a6baf4a0f55799dc5fa413ffa073489808925889/lean/FPaxos.lean", "has_liveness": false}
{"section": "Additional Lean and Isabelle proof artifacts", "group": "", "name": "Flexible Paxos reachable-state safety proof", "specifies": "inductive safety argument for the Flexible Paxos state/actions model", "tool": "Lean 4; machine-checkable proof source, not rerun", "size": "598 physical lines; [exact source](https://github.com/fpaxos/fpaxos-tlaplus/blob/a6baf4a0f55799dc5fa413ffa073489808925889/lean/Proof.lean)", "safety": "`reachable_safeValue` and `reachable_safety`; every reachable state allows at most one agreed value", "liveness": "no progress guarantee claimed", "source_scan": "no literal `sorry` or `axiom` found; compilation not rerun", "source_url": "https://github.com/fpaxos/fpaxos-tlaplus/blob/a6baf4a0f55799dc5fa413ffa073489808925889/lean/Proof.lean", "has_liveness": false}
{"section": "Additional Lean and Isabelle proof artifacts", "group": "", "name": "channel-counting termination-detector correctness proof", "specifies": "reports of global termination from per-channel message counts", "tool": "Isabelle/HOL; machine-checkable proof source, not rerun", "size": "283 physical lines; [exact source](https://github.com/nano-o/Distributed-termination-detection/blob/48d7201903592583bd2bdb5d73552f70911e8874/Termination/Termination.thy)", "safety": "every reported termination has no messages still in flight", "liveness": "no progress guarantee claimed", "source_url": "https://github.com/nano-o/Distributed-termination-detection/blob/48d7201903592583bd2bdb5d73552f70911e8874/Termination/Termination.thy", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "MongoDB exploratory Raft single-member reconfiguration", "specifies": "Raft replication with original Raft single-server membership changes", "safety": "no separate property configuration found; transition/state definitions present", "liveness": "`Liveness` supplies strong/weak scheduling fairness only; no separate eventual outcome is stated", "tool": "TLA+; TLC configurations, no TLAPS proof found", "size": "263 physical lines in [RaftMongoWithRaftReconfig.tla](https://github.com/mongodb/mongo/blob/0d30700a47defbf2a38dbd7bba7981ab6964b040/src/mongo/tla_plus/RaftMongoWithRaftReconfig.tla); comments and blank lines included", "fairness_premises": "the operator `Liveness` restricts scheduling so enabled replication, rollback and selected write actions cannot be postponed forever; these are assumptions used to check progress, not independently proved eventual outcomes", "source_url": "https://github.com/mongodb/mongo/blob/0d30700a47defbf2a38dbd7bba7981ab6964b040/src/mongo/tla_plus/RaftMongoWithRaftReconfig.tla", "has_liveness": true}
{"section": "Industrial specifications and P", "group": "", "name": "MongoDB Raft replication", "source_caveat": "\"NeverRollbackCommitted and NeverRollbackBeforeCommitPoint can be violated\"; the configuration points to SERVER-39626 and says the required five-server state space is larger than easily checked", "specifies": "primary elections, oplog replication, rollback and commit-point propagation", "safety": "at most one primary per election term; committed log entries and entries before the local commit point cannot be rolled back; source: `NoTwoPrimariesInSameTerm`, `NeverRollbackCommitted`, `NeverRollbackBeforeCommitPoint`", "liveness": "nodes with different commit points eventually agree after rollback stops; source: `CommitPointEventuallyPropagates`", "tool": "TLA+; TLC configurations, no TLAPS proof found", "size": "331 physical lines in [RaftMongo.tla](https://github.com/mongodb/mongo/blob/0d30700a47defbf2a38dbd7bba7981ab6964b040/src/mongo/tla_plus/Replication/RaftMongo/RaftMongo.tla); comments and blank lines included; [MCRaftMongo.cfg](https://github.com/mongodb/mongo/blob/0d30700a47defbf2a38dbd7bba7981ab6964b040/src/mongo/tla_plus/Replication/RaftMongo/MCRaftMongo.cfg) states the enabled checks", "fairness_premises": "the operator `Liveness` restricts scheduling so enabled replication, rollback and selected write actions cannot be postponed forever; these are assumptions used to check progress, not independently proved eventual outcomes", "source_url": "https://github.com/mongodb/mongo/blob/0d30700a47defbf2a38dbd7bba7981ab6964b040/src/mongo/tla_plus/Replication/RaftMongo/RaftMongo.tla", "has_liveness": true}
{"section": "Industrial specifications and P", "group": "", "name": "MongoDB Raft replication timestamps", "specifies": "replication with persistence, application, restart and failover", "safety": "at most one primary per term; committed entries and the committed storage snapshot must survive rollback; source: `NoTwoPrimariesInSameTerm`, `NeverRollbackCommitted`, `NeverRollbackBeforeCommitPoint`, `CommittedSnapshotNeverRollback`", "liveness": "commit-point agreement is the intended target, but its check is disabled; source: `CommitPointEventuallyPropagates` is commented out; fairness remains in `Liveness`", "tool": "TLA+; TLC configurations, no TLAPS proof found", "size": "445 physical lines in [RaftMongoReplTimestamp.tla](https://github.com/mongodb/mongo/blob/0d30700a47defbf2a38dbd7bba7981ab6964b040/src/mongo/tla_plus/Replication/RaftMongoReplTimestamp/RaftMongoReplTimestamp.tla); comments and blank lines included; [MCRaftMongoReplTimestamp.cfg](https://github.com/mongodb/mongo/blob/0d30700a47defbf2a38dbd7bba7981ab6964b040/src/mongo/tla_plus/Replication/RaftMongoReplTimestamp/MCRaftMongoReplTimestamp.cfg) states the enabled checks", "fairness_premises": "the operator `Liveness` restricts scheduling so enabled replication, rollback and selected write actions cannot be postponed forever; these are assumptions used to check progress, not independently proved eventual outcomes", "source_url": "https://github.com/mongodb/mongo/blob/0d30700a47defbf2a38dbd7bba7981ab6964b040/src/mongo/tla_plus/Replication/RaftMongoReplTimestamp/RaftMongoReplTimestamp.tla", "has_liveness": true}
{"section": "Industrial specifications and P", "group": "", "name": "MongoDB replica-set reconfiguration", "specifies": "single-node membership changes", "safety": "at most one primary per term, and committed entries are never rolled back; source: `ElectionSafety`, `NeverRollbackCommitted` (temporal safety; `PROPERTY` does not itself mean liveness)", "liveness": "eventually, either rollback becomes possible or live configuration members agree on their configuration; eventually, either rollback becomes possible or a leader exists; source: `ConfigEventuallyPropagates`, `ElectableNodeEventuallyExists` are defined but not enabled in shipped configuration", "tool": "TLA+; TLC configurations, no TLAPS proof found", "size": "492 physical lines in [MongoReplReconfig.tla](https://github.com/mongodb/mongo/blob/0d30700a47defbf2a38dbd7bba7981ab6964b040/src/mongo/tla_plus/Replication/MongoReplReconfig/MongoReplReconfig.tla); comments and blank lines included; [MCMongoReplReconfig.cfg](https://github.com/mongodb/mongo/blob/0d30700a47defbf2a38dbd7bba7981ab6964b040/src/mongo/tla_plus/Replication/MongoReplReconfig/MCMongoReplReconfig.cfg) states the enabled checks", "fairness_premises": "`Liveness` assumes weak fairness for election, configuration propagation, term updates, replication, rollback and commits; the named eventual outcomes above are separate obligations", "source_url": "https://github.com/mongodb/mongo/blob/0d30700a47defbf2a38dbd7bba7981ab6964b040/src/mongo/tla_plus/Replication/MongoReplReconfig/MongoReplReconfig.tla", "has_liveness": true}
{"section": "Industrial specifications and P", "group": "", "name": "MongoDB range migration and reads", "specifies": "range migration commit, query routing and ownership filtering", "safety": "queries return no duplicate keys; routing and shard-ownership ranges do not overlap outside the allowed critical section; placement versions reflect ownership; source: `RoutingUntimestampedReads`, `RoutingTableConsistent`, `ShardOwnershipConsistent`, `UniqueKeysReturned`, `OwningShardsHaveNonZeroPlacementVersion`, `NotOwningShardsHaveZeroPlacementVersion`", "liveness": "the query eventually returns every key; source: `PropertyAllKeysReturned` is defined but disabled in shipped configuration", "tool": "TLA+; TLC configurations, no TLAPS proof found", "size": "487 physical lines in [MoveRange.tla](https://github.com/mongodb/mongo/blob/0d30700a47defbf2a38dbd7bba7981ab6964b040/src/mongo/tla_plus/Sharding/MoveRange/MoveRange.tla); comments and blank lines included; [MCMoveRange.cfg](https://github.com/mongodb/mongo/blob/0d30700a47defbf2a38dbd7bba7981ab6964b040/src/mongo/tla_plus/Sharding/MoveRange/MCMoveRange.cfg) states the enabled checks", "fairness_premises": "`Fairness` restricts action scheduling; fairness assumptions alone do not establish the eventual properties above", "source_url": "https://github.com/mongodb/mongo/blob/0d30700a47defbf2a38dbd7bba7981ab6964b040/src/mongo/tla_plus/Sharding/MoveRange/MoveRange.tla", "has_liveness": true}
{"section": "Industrial specifications and P", "group": "", "name": "MongoDB transactions during range migration", "specifies": "multi-statement transactions and placement-conflict protocol", "safety": "a committed transaction has successful statements and can see every requested key; source: `TypeOK`, `CommittedTxnImpliesAllStmtsSuccessful`, `CommittedTxnImpliesKeysAreVisible`", "liveness": "each transaction eventually commits or aborts, and its locks are eventually released; source: `AllTxnsEventuallyDone`, `AllLocksEventuallyRescinded` are defined but disabled", "tool": "TLA+; TLC configurations, no TLAPS proof found", "size": "315 physical lines in [TxnsMoveRange.tla](https://github.com/mongodb/mongo/blob/0d30700a47defbf2a38dbd7bba7981ab6964b040/src/mongo/tla_plus/Sharding/TxnsMoveRange/TxnsMoveRange.tla); comments and blank lines included; [MCTxnsMoveRange.cfg](https://github.com/mongodb/mongo/blob/0d30700a47defbf2a38dbd7bba7981ab6964b040/src/mongo/tla_plus/Sharding/TxnsMoveRange/MCTxnsMoveRange.cfg) states the enabled checks", "fairness_premises": "`Fairness` restricts action scheduling; fairness assumptions alone do not establish the eventual properties above", "source_url": "https://github.com/mongodb/mongo/blob/0d30700a47defbf2a38dbd7bba7981ab6964b040/src/mongo/tla_plus/Sharding/TxnsMoveRange/TxnsMoveRange.tla", "has_liveness": true}
{"section": "Industrial specifications and P", "group": "", "name": "MongoDB transactions and collection incarnation", "specifies": "transactions concurrent with collection/database metadata changes", "safety": "a committed transaction has successful statements and a consistent key set; responses for namespaces unknown to the router come from the primary shard; source: `CommittedTxnImpliesAllStmtsSuccessful`, `CommittedTxnImpliesConsistentKeySet`, `ResponseForUntrackedNameSpaceIsFromPrimaryShard` (temporal safety)", "liveness": "each transaction eventually commits or aborts and releases acquired resources; source: `AllTxnsEventuallyDone`, `AcquiredTxnResourcesEventuallyReleased` are defined but disabled", "tool": "TLA+; TLC configurations, no TLAPS proof found", "size": "566 physical lines in [TxnsCollectionIncarnation.tla](https://github.com/mongodb/mongo/blob/0d30700a47defbf2a38dbd7bba7981ab6964b040/src/mongo/tla_plus/Sharding/TxnsCollectionIncarnation/TxnsCollectionIncarnation.tla); comments and blank lines included; [MCTxnsCollectionIncarnation.cfg](https://github.com/mongodb/mongo/blob/0d30700a47defbf2a38dbd7bba7981ab6964b040/src/mongo/tla_plus/Sharding/TxnsCollectionIncarnation/MCTxnsCollectionIncarnation.cfg) states the enabled checks", "fairness_premises": "`Fairness` restricts action scheduling; fairness assumptions alone do not establish the eventual properties above", "source_url": "https://github.com/mongodb/mongo/blob/0d30700a47defbf2a38dbd7bba7981ab6964b040/src/mongo/tla_plus/Sharding/TxnsCollectionIncarnation/TxnsCollectionIncarnation.tla", "has_liveness": true}
{"section": "Industrial specifications and P", "group": "", "name": "MongoDB secondary-node range deletion", "specifies": "range deletion concurrent with query snapshot advancement", "safety": "a query that finishes normally reads all documents; the range-preservation guard is invalidated before deletion becomes visible; source: `TypeOK`, `QueryShouldReadAllDocs`, `RangePreserverShouldBeInvalidatedBeforeRangeDeletionGetsVisible`", "liveness": "the deletion executes, the guard is invalidated, and the query eventually finishes or is killed; source: `RangeDeletionIsExecuted`, `RangePreserverIsInvalidated`, `Termination`", "tool": "TLA+; TLC configurations, no TLAPS proof found", "size": "187 physical lines in [RangeDeletionsSecondaryNodes.tla](https://github.com/mongodb/mongo/blob/0d30700a47defbf2a38dbd7bba7981ab6964b040/src/mongo/tla_plus/Sharding/RangeDeletionsSecondaryNodes/RangeDeletionsSecondaryNodes.tla); comments and blank lines included; [MCRangeDeletionsSecondaryNodes.cfg](https://github.com/mongodb/mongo/blob/0d30700a47defbf2a38dbd7bba7981ab6964b040/src/mongo/tla_plus/Sharding/RangeDeletionsSecondaryNodes/MCRangeDeletionsSecondaryNodes.cfg) states the enabled checks", "fairness_premises": "`Fairness` restricts action scheduling; fairness assumptions alone do not establish the eventual properties above", "source_url": "https://github.com/mongodb/mongo/blob/0d30700a47defbf2a38dbd7bba7981ab6964b040/src/mongo/tla_plus/Sharding/RangeDeletionsSecondaryNodes/RangeDeletionsSecondaryNodes.tla", "has_liveness": true}
{"section": "Industrial specifications and P", "group": "", "name": "MongoDB ordered ticket semaphore", "specifies": "concurrent acquire/release and resize; source says \"demonstrate a deadlock\"", "safety": "the count of held tickets stays nonnegative and matches actual holdings; each client appears once in the wait queue and awakened clients precede sleeping clients; source: `TypeOK`, `TakenNonNegative`, `TakenMatchesHolding`, `UniqueWaiters`, `AwakeBeforeNonAwake`", "liveness": "an uninterruptible waiter eventually gets a ticket; any waiter eventually acquires a ticket or leaves the queue; source: `WaitingLeadsToHolding`, `NeverWaitsIndefinitely`", "tool": "TLA+; TLC configurations, no TLAPS proof found", "size": "210 physical lines in [OrderedTicketSemaphore.tla](https://github.com/mongodb/mongo/blob/0d30700a47defbf2a38dbd7bba7981ab6964b040/src/mongo/tla_plus/Concurrency/OrderedTicketSemaphore/OrderedTicketSemaphore.tla); comments and blank lines included; [MCOrderedTicketSemaphore.cfg](https://github.com/mongodb/mongo/blob/0d30700a47defbf2a38dbd7bba7981ab6964b040/src/mongo/tla_plus/Concurrency/OrderedTicketSemaphore/MCOrderedTicketSemaphore.cfg) states the enabled checks", "fairness_premises": "`WF_vars(Next)`, `WF_vars(WakeAndConsume(t))` and `WF_vars(DoRelease(t))` restrict scheduling; they are premises for the two progress checks", "source_url": "https://github.com/mongodb/mongo/blob/0d30700a47defbf2a38dbd7bba7981ab6964b040/src/mongo/tla_plus/Concurrency/OrderedTicketSemaphore/OrderedTicketSemaphore.tla", "has_liveness": true}
{"section": "Industrial specifications and P", "group": "", "name": "CCF Raft consensus", "specifies": "Raft, signatures, membership retirement and pre-voting", "safety": "at most one leader per term; matching log positions agree; committed log prefixes only grow; later leaders retain committed entries; membership transitions and refinement to the abstract log are checked; source: `LogInv`, `MoreThanOneLeaderInv`, `CandidateTermNotInLogInv`, `ElectionSafetyInv`, `LogMatchingInv`, `QuorumLogInv`, `LeaderCompletenessInv`, `SignatureInv`, `TypeInv`, `MonoTermInv`, `MonoLogInv`, `NoLeaderBeforeInitialTerm`, `LogConfigurationConsistentInv`, `MembershipStateConsistentInv`, `CommitCommittableIndices`, `ReplicationInv`, `RetiredCommittedInv`, `RetirementCompletedNotInConfigsInv`, `RetirementCompletedAreRetirementCompletedInv`, `MatchIndexBoundedByLogInv`, `CommittedLogAppendOnlyProp`, `MonotonicTermProp`, `MonotonicMatchIndexProp`, `PermittedLogChangesProp`, `StateTransitionsProp`, `MembershipStateTransitionsProp`, `PendingBecomesFollowerProp`, `NeverCommitEntryPrevTermsProp`, `RefinementToAbsProp`", "liveness": "no eventual-progress obligation found in its shipped configuration", "tool": "TLA+; TLC model checking; no TLAPS proof found", "size": "1793 physical lines in [ccfraft.tla](https://github.com/microsoft/CCF/blob/41d6c20c218666673415d258e7d9201e0891b8df/tla/consensus/ccfraft.tla); comments and blank lines included; [MCccfraft.cfg](https://github.com/microsoft/CCF/blob/41d6c20c218666673415d258e7d9201e0891b8df/tla/consensus/MCccfraft.cfg) supplies check names", "related_artifacts": "[simulation configuration](https://github.com/microsoft/CCF/blob/41d6c20c218666673415d258e7d9201e0891b8df/tla/consensus/SIMccfraft.cfg), [trace validation](https://github.com/microsoft/CCF/blob/41d6c20c218666673415d258e7d9201e0891b8df/tla/consensus/Traceccfraft.tla); temporal properties here include log monotonicity and refinement, which are safety", "source_url": "https://github.com/microsoft/CCF/blob/41d6c20c218666673415d258e7d9201e0891b8df/tla/consensus/ccfraft.tla", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "CCF abstract consensus", "specifies": "abstract append-only log refinement target", "safety": "nodes do not commit conflicting entries, and committed log prefixes only grow; source: `NoConflicts`, `TypeOK`, `AppendOnlyProp`", "liveness": "no eventual-progress obligation found in its shipped configuration", "tool": "TLA+; TLC model checking; no TLAPS proof found", "size": "116 physical lines in [abs.tla](https://github.com/microsoft/CCF/blob/41d6c20c218666673415d258e7d9201e0891b8df/tla/consensus/abs.tla); comments and blank lines included; [MCabs.cfg](https://github.com/microsoft/CCF/blob/41d6c20c218666673415d258e7d9201e0891b8df/tla/consensus/MCabs.cfg) supplies check names", "source_url": "https://github.com/microsoft/CCF/blob/41d6c20c218666673415d258e7d9201e0891b8df/tla/consensus/abs.tla", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "CCF single-node external history", "specifies": "client read/write transaction history without view changes", "safety": "responses refer to requested transactions; committed histories can be ordered consistently; invalid transactions are excluded from committed observations; each response observes a transaction at most once; source: `AllReceivedIsFirstSentInv`, `AllCommittedObservedInv`, `OnlyObserveSentRequestsInv`, `UniqueTxsInv`, `UniqueTxIdsInv`, `UniqueSeqNumsInv`, `CommittedOrInvalidStrongInv`, `RwSerializableInv`, `CommittedRwSerializableInv`, `InvalidNotObservedInv`, `InvalidNotObservedByCommittedInv`, `AtMostOnceObservedInv`", "liveness": "no eventual-progress obligation found in its shipped configuration", "tool": "TLA+; TLC model checking; no TLAPS proof found", "size": "141 physical lines in [SingleNode.tla](https://github.com/microsoft/CCF/blob/41d6c20c218666673415d258e7d9201e0891b8df/tla/consistency/SingleNode.tla); comments and blank lines included; [MCSingleNode.cfg](https://github.com/microsoft/CCF/blob/41d6c20c218666673415d258e7d9201e0891b8df/tla/consistency/MCSingleNode.cfg) supplies check names", "source_url": "https://github.com/microsoft/CCF/blob/41d6c20c218666673415d258e7d9201e0891b8df/tla/consistency/SingleNode.tla", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "CCF single-node history with reads", "specifies": "single-node history with explicit read-only observations", "safety": "responses refer to requested transactions; committed histories can be ordered consistently; invalid transactions are excluded from committed observations; each response observes a transaction at most once; source: `AllReceivedIsFirstSentInv`, `AllCommittedObservedInv`, `OnlyObserveSentRequestsInv`, `UniqueTxsInv`, `UniqueTxIdsInv`, `UniqueSeqNumsInv`, `CommittedOrInvalidStrongInv`, `RwSerializableInv`, `CommittedRwSerializableInv`, `InvalidNotObservedInv`, `InvalidNotObservedByCommittedInv`, `AtMostOnceObservedInv`, `AllCommittedObservedRoInv`", "liveness": "no eventual-progress obligation found in its shipped configuration", "tool": "TLA+; TLC model checking; no TLAPS proof found", "size": "42 physical lines in [SingleNodeReads.tla](https://github.com/microsoft/CCF/blob/41d6c20c218666673415d258e7d9201e0891b8df/tla/consistency/SingleNodeReads.tla); comments and blank lines included; [MCSingleNodeReads.cfg](https://github.com/microsoft/CCF/blob/41d6c20c218666673415d258e7d9201e0891b8df/tla/consistency/MCSingleNodeReads.cfg) supplies check names", "source_url": "https://github.com/microsoft/CCF/blob/41d6c20c218666673415d258e7d9201e0891b8df/tla/consistency/SingleNodeReads.tla", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "CCF multi-node external history", "specifies": "ledger branches across leader/view changes", "safety": "responses refer to requested transactions; committed histories can be ordered consistently; invalid transactions are excluded from committed observations; each response observes a transaction at most once; committed read/write operations also respect real-time order; source: `AllReceivedIsFirstSentInv`, `AllCommittedObservedInv`, `OnlyObserveSentRequestsInv`, `UniqueTxsInv`, `SameObservationsInv`, `UniqueTxIdsInv`, `UniqueTxRequestsInv`, `UniqueSeqNumsCommittedInv`, `CommittedOrInvalidStrongInv`, `CommittedRwSerializableInv`, `InvalidNotObservedByCommittedInv`, `AtMostOnceObservedInv`, `CommittedRwOrderedSpecLinearizableInv`", "liveness": "no eventual-progress obligation found in its shipped configuration", "tool": "TLA+; TLC model checking; no TLAPS proof found", "size": "56 physical lines in [MultiNode.tla](https://github.com/microsoft/CCF/blob/41d6c20c218666673415d258e7d9201e0891b8df/tla/consistency/MultiNode.tla); comments and blank lines included; [MCMultiNode.cfg](https://github.com/microsoft/CCF/blob/41d6c20c218666673415d258e7d9201e0891b8df/tla/consistency/MCMultiNode.cfg) supplies check names", "source_url": "https://github.com/microsoft/CCF/blob/41d6c20c218666673415d258e7d9201e0891b8df/tla/consistency/MultiNode.tla", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "CCF multi-node history with reads", "specifies": "transaction history and read-only observations across views", "safety": "responses refer to requested transactions; committed histories can be ordered consistently; invalid transactions are excluded from committed observations; each response observes a transaction at most once; committed read/write operations also respect real-time order; source: `AllReceivedIsFirstSentInv`, `AllCommittedObservedInv`, `OnlyObserveSentRequestsInv`, `UniqueTxsInv`, `SameObservationsInv`, `UniqueTxIdsInv`, `UniqueTxRequestsInv`, `UniqueSeqNumsCommittedInv`, `CommittedOrInvalidStrongInv`, `CommittedRwSerializableInv`, `InvalidNotObservedByCommittedInv`, `AtMostOnceObservedInv`, `CommittedRwOrderedSpecLinearizableInv`", "liveness": "no eventual-progress obligation found in its shipped configuration", "tool": "TLA+; TLC model checking; no TLAPS proof found", "size": "13 physical lines in [MultiNodeReads.tla](https://github.com/microsoft/CCF/blob/41d6c20c218666673415d258e7d9201e0891b8df/tla/consistency/MultiNodeReads.tla); comments and blank lines included; [MCMultiNodeReads.cfg](https://github.com/microsoft/CCF/blob/41d6c20c218666673415d258e7d9201e0891b8df/tla/consistency/MCMultiNodeReads.cfg) supplies check names", "source_url": "https://github.com/microsoft/CCF/blob/41d6c20c218666673415d258e7d9201e0891b8df/tla/consistency/MultiNodeReads.tla", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "CCF alternative multi-node read model", "specifies": "alternate finite model wrapper for multi-node read history", "safety": "responses refer to requested transactions; committed histories can be ordered consistently; invalid transactions are excluded from committed observations; each response observes a transaction at most once; source: `AllReceivedIsFirstSentInv`, `AllCommittedObservedInv`, `OnlyObserveSentRequestsInv`, `UniqueTxsInv`, `SameObservationsInv`, `UniqueTxIdsInv`, `UniqueTxRequestsInv`, `UniqueSeqNumsCommittedInv`, `CommittedOrInvalidStrongInv`, `CommittedRwSerializableInv`, `InvalidNotObservedByCommittedInv`, `AtMostOnceObservedInv`", "liveness": "no eventual-progress obligation found in its shipped configuration", "tool": "TLA+; TLC model checking; no TLAPS proof found", "size": "24 physical lines in [MCMultiNodeReadsAlt.tla](https://github.com/microsoft/CCF/blob/41d6c20c218666673415d258e7d9201e0891b8df/tla/consistency/MCMultiNodeReadsAlt.tla); comments and blank lines included; [MCMultiNodeReadsAlt.cfg](https://github.com/microsoft/CCF/blob/41d6c20c218666673415d258e7d9201e0891b8df/tla/consistency/MCMultiNodeReadsAlt.cfg) supplies check names", "source_url": "https://github.com/microsoft/CCF/blob/41d6c20c218666673415d258e7d9201e0891b8df/tla/consistency/MCMultiNodeReadsAlt.tla", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "CCF abstract consistency", "specifies": "abstract transaction-observation consistency relations", "safety": "no checked invariant listed in its configuration", "liveness": "no eventual-progress obligation found in its shipped configuration", "tool": "TLA+; TLC model checking; no TLAPS proof found", "size": "360 physical lines in [Consistency.tla](https://github.com/microsoft/CCF/blob/41d6c20c218666673415d258e7d9201e0891b8df/tla/consistency/Consistency.tla); comments and blank lines included; [Consistency.cfg](https://github.com/microsoft/CCF/blob/41d6c20c218666673415d258e7d9201e0891b8df/tla/consistency/Consistency.cfg) supplies check names", "source_url": "https://github.com/microsoft/CCF/blob/41d6c20c218666673415d258e7d9201e0891b8df/tla/consistency/Consistency.tla", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "etcd Raft with membership changes", "specifies": "Raft library core algorithm and joint-consensus membership changes", "safety": "at most one leader per term; matching log entries have matching prefixes; later leaders retain committed entries; committed entries remain durable; source: `LogInv`, `MoreThanOneLeaderInv`, `ElectionSafetyInv`, `LogMatchingInv`, `QuorumLogInv`, `MoreUpToDateCorrectInv`, `LeaderCompletenessInv`, `CommittedIsDurableInv`", "liveness": "no eventual-progress property configured", "tool": "TLA+; TLC model checking and implementation-trace validation; no TLAPS proof found", "size": "926 physical lines in [etcdraft.tla](https://github.com/etcd-io/raft/blob/1c0011d2c6b7a0230f87bad38ad4c6e70d810f9e/tla/etcdraft.tla); comments and blank lines included; [configuration](https://github.com/etcd-io/raft/blob/1c0011d2c6b7a0230f87bad38ad4c6e70d810f9e/tla/MCetcdraft.cfg); [trace validator](https://github.com/etcd-io/raft/blob/1c0011d2c6b7a0230f87bad38ad4c6e70d810f9e/tla/Traceetcdraft.tla)", "source_url": "https://github.com/etcd-io/raft/blob/1c0011d2c6b7a0230f87bad38ad4c6e70d810f9e/tla/etcdraft.tla", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "ZooKeeper Zab protocol", "specifies": "atomic broadcast and leader recovery", "safety": "servers agree on committed history prefixes and delivery order; leaders obey epoch and primary-order rules; transactions are not delivered spuriously or twice; source: `Leadership1`, `Leadership2`, `PrefixConsistency`, `Integrity`, `Agreement`, `TotalOrder`, `LocalPrimaryOrder`, `GlobalPriamryOrder`, `PrimaryIntegrity`, `ShouldNotBeTriggered`", "liveness": "no eventual-progress/fairness property found", "tool": "TLA+; model-checking workflow documented for Zab; no TLAPS proof found", "size": "1251 physical lines in [Zab.tla](https://github.com/apache/zookeeper/blob/48f7cb00e2d48d4563e45bebcd0f4665c30772a2/zookeeper-specifications/protocol-spec/Zab.tla); comments and blank lines included", "source_url": "https://github.com/apache/zookeeper/blob/48f7cb00e2d48d4563e45bebcd0f4665c30772a2/zookeeper-specifications/protocol-spec/Zab.tla", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "ZooKeeper 3.7 system model", "specifies": "Zab as implemented in ZooKeeper 3.7 with election, crash/restart, synchronization and snapshots", "safety": "servers agree on committed history prefixes and delivery order; leader and primary-order rules hold across recovery; source: `TypeOK`, `CheckDuringAction`, `PrefixConsistency`, `Agreement`, `TotalOrder` plus leader/primary-order invariants", "liveness": "no eventual-progress/fairness property found", "tool": "TLA+; model-checking workflow documented for Zab; no TLAPS proof found", "size": "2050 physical lines in [ZkV3_7_0.tla](https://github.com/apache/zookeeper/blob/48f7cb00e2d48d4563e45bebcd0f4665c30772a2/zookeeper-specifications/system-spec/zk-3.7/ZkV3_7_0.tla); comments and blank lines included", "source_url": "https://github.com/apache/zookeeper/blob/48f7cb00e2d48d4563e45bebcd0f4665c30772a2/zookeeper-specifications/system-spec/zk-3.7/ZkV3_7_0.tla", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "ZooKeeper fast leader election", "specifies": "standalone election algorithm module imported by ZooKeeper 3.7 model", "safety": "no standalone checked correctness invariant found; `TotalOrderPredicate` is an election comparison function", "liveness": "no eventual-progress/fairness property found", "tool": "TLA+; model-checking workflow documented for Zab; no TLAPS proof found", "size": "553 physical lines in [FastLeaderElection.tla](https://github.com/apache/zookeeper/blob/48f7cb00e2d48d4563e45bebcd0f4665c30772a2/zookeeper-specifications/system-spec/zk-3.7/FastLeaderElection.tla); comments and blank lines included", "source_url": "https://github.com/apache/zookeeper/blob/48f7cb00e2d48d4563e45bebcd0f4665c30772a2/zookeeper-specifications/system-spec/zk-3.7/FastLeaderElection.tla", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "CockroachDB store liveness fabric", "specifies": "heartbeat support below Raft, including crash/restart, clock regression and message reordering", "safety": "a node cannot withdraw its promised support before the promised end time; epoch bookkeeping makes support assumptions safe across restarts; source: `DurableSupportInvariant`, `SupportProvidedLeadsSupportAssumedInvariant`, `CurrentEpochLeadsSupportedEpochsInvariant`, `WithdrawnSupportMinimumEpochInvariant`", "liveness": "no progress property configured; the product name does not imply a liveness proof", "tool": "PlusCal translated to TLA+; TLC configuration; no TLAPS proof found", "size": "517 physical lines in [StoreLiveness.tla](https://github.com/cockroachdb/cockroach/blob/d30c905fff79ef825adc96bcc647f1872a90f2ff/docs/tla-plus/StoreLiveness/StoreLiveness.tla); comments and blank lines included; line count includes both PlusCal source and generated translation", "source_url": "https://github.com/cockroachdb/cockroach/blob/d30c905fff79ef825adc96bcc647f1872a90f2ff/docs/tla-plus/StoreLiveness/StoreLiveness.tla", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "CockroachDB parallel transaction commits", "specifies": "parallel writes and transaction commit using one distributed-consensus round", "safety": "a success acknowledgement implies the transaction is committed; records, write intents and timestamp-cache updates obey allowed transitions; source: `TypeInvariants`, `AckImpliesCommit`, `TemporalTxnRecordProperties`, `TemporalIntentProperties`, `TemporalTSCacheProperties`", "liveness": "an implicit commit or success acknowledgement eventually results in an explicit committed record; source: `ImplicitCommitLeadsToExplicitCommit`, `AckLeadsToExplicitCommit`", "tool": "PlusCal translated to TLA+; TLC configuration; no TLAPS proof found", "size": "919 physical lines in [ParallelCommits.tla](https://github.com/cockroachdb/cockroach/blob/d30c905fff79ef825adc96bcc647f1872a90f2ff/docs/tla-plus/ParallelCommits/ParallelCommits.tla); comments and blank lines included; line count includes both PlusCal source and generated translation", "source_url": "https://github.com/cockroachdb/cockroach/blob/d30c905fff79ef825adc96bcc647f1872a90f2ff/docs/tla-plus/ParallelCommits/ParallelCommits.tla", "has_liveness": true}
{"section": "Industrial specifications and P", "group": "", "name": "P tutorial 1 ClientServer", "specifies": "concurrent event-driven ClientServer model", "safety": "successful withdrawals deduct exactly the requested amount while preserving the minimum bank balance; source: `BankBalanceIsAlwaysCorrect`", "liveness": "every withdrawal request eventually receives a response; source: `GuaranteedWithDrawProgress`", "tool": "P; systematic testing/model checking; no proof script found", "size": "115 physical lines in [BankBalanceCorrect.p](https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tutorial/1_ClientServer/PSpec/BankBalanceCorrect.p); comments and blank lines included; 445 physical lines across 7 .p files in [tutorial directory](https://github.com/p-org/P/tree/260da928f67569ca7a8c0039a02d0bad7cde6096/Tutorial/1_ClientServer); excludes imported Common helpers", "source_example": "\"assert wReq.accountId in balance, \"Invalid accountId received in the withdraw request!\";\"", "source_url": "https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tutorial/1_ClientServer/PSpec/BankBalanceCorrect.p", "has_liveness": true}
{"section": "Industrial specifications and P", "group": "", "name": "P tutorial 2 TwoPhaseCommit", "specifies": "concurrent event-driven TwoPhaseCommit model", "safety": "a successful transaction response requires all participants to vote yes; an error response requires a no vote; source: `AtomicityInvariant`", "liveness": "every submitted write transaction eventually receives a response; source: `Progress`", "tool": "P; systematic testing/model checking; no proof script found", "size": "83 physical lines in [Atomicity.p](https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tutorial/2_TwoPhaseCommit/PSpec/Atomicity.p); comments and blank lines included; 550 physical lines across 7 .p files in [tutorial directory](https://github.com/p-org/P/tree/260da928f67569ca7a8c0039a02d0bad7cde6096/Tutorial/2_TwoPhaseCommit); excludes imported Common helpers", "source_example": "\"assert transId in pendingWriteTrans,\"", "source_url": "https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tutorial/2_TwoPhaseCommit/PSpec/Atomicity.p", "has_liveness": true}
{"section": "Industrial specifications and P", "group": "", "name": "P tutorial 3 EspressoMachine", "specifies": "concurrent event-driven EspressoMachine model", "safety": "the coffee maker follows WarmUp → Ready → GrindBeans → MakeCoffee → Ready; after an error, it stays in Error until reset; source: `EspressoMachineModesOfOperation`", "liveness": "no progress monitor found", "tool": "P; systematic testing/model checking; no proof script found", "size": "53 physical lines in [Safety.p](https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tutorial/3_EspressoMachine/PSpec/Safety.p); comments and blank lines included; 658 physical lines across 7 .p files in [tutorial directory](https://github.com/p-org/P/tree/260da928f67569ca7a8c0039a02d0bad7cde6096/Tutorial/3_EspressoMachine); excludes imported Common helpers", "source_example": "\"assert coffeeMakerState != NotWarmedUp;\"", "source_url": "https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tutorial/3_EspressoMachine/PSpec/Safety.p", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "P tutorial 4 FailureDetector", "specifies": "concurrent event-driven FailureDetector model", "safety": "inline assertions only; no separate monitor", "liveness": "every node that has been shut down is eventually reported down; source: `ReliableFailureDetector`", "tool": "P; systematic testing/model checking; no proof script found", "size": "57 physical lines in [ReliableFailureDetector.p](https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tutorial/4_FailureDetector/PSpec/ReliableFailureDetector.p); comments and blank lines included; 293 physical lines across 7 .p files in [tutorial directory](https://github.com/p-org/P/tree/260da928f67569ca7a8c0039a02d0bad7cde6096/Tutorial/4_FailureDetector); excludes imported Common helpers", "source_example": "\"assert ReliableFailureDetector in\"", "source_url": "https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tutorial/4_FailureDetector/PSpec/ReliableFailureDetector.p", "has_liveness": true}
{"section": "Industrial specifications and P", "group": "", "name": "P tutorial 5 Paxos", "specifies": "concurrent event-driven Paxos model", "safety": "once a value is learned, later learned values must be the same; source: `OneValueTaught`", "liveness": "no progress monitor found", "tool": "P; systematic testing/model checking; no proof script found", "size": "63 physical lines in [common.p](https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tutorial/5_Paxos/PSpec/common.p); comments and blank lines included; 385 physical lines across 6 .p files in [tutorial directory](https://github.com/p-org/P/tree/260da928f67569ca7a8c0039a02d0bad7cde6096/Tutorial/5_Paxos); excludes imported Common helpers", "source_example": "\"assert OneValueTaught in (union Paxos, { BasicPaxos3on5 });\"", "source_url": "https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tutorial/5_Paxos/PSpec/common.p", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "P tutorial 6 Raft", "specifies": "concurrent event-driven Raft model", "safety": "one leader per term; matching logs share their prefix; new leaders retain committed entries; all replicas apply the same value at each log position; client results match the reference application; source: `SafetySynchronization`, `SafetyLogMatching`, `SafetyOneLeader`, `SafetyStateMachine`, `SafetyLeaderCompleteness`", "liveness": "all clients eventually finish, and pending client requests eventually receive responses; source: `LivenessClientsDone`, `LivenessProgress`", "tool": "P; systematic testing/model checking; no proof script found", "size": "94 physical lines in [SafetySynchronization.p](https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tutorial/6_Raft/PSpec/SafetySynchronization.p); comments and blank lines included; 1789 physical lines across 16 .p files in [tutorial directory](https://github.com/p-org/P/tree/260da928f67569ca7a8c0039a02d0bad7cde6096/Tutorial/6_Raft); excludes imported Common helpers", "source_example": "\"assert this in setup.cluster, \"Server should be in the cluster\";\"", "source_url": "https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tutorial/6_Raft/PSpec/SafetySynchronization.p", "has_liveness": true}
{"section": "Industrial specifications and P", "group": "", "name": "P tutorial PriorityQueue", "specifies": "concurrent event-driven PriorityQueue model", "safety": "inline assertions only; no separate monitor", "liveness": "no progress monitor found", "tool": "P; systematic testing/model checking; no proof script found", "size": "20 physical lines in [PriorityQueue.p](https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tutorial/PriorityQueue/PSrc/PriorityQueue.p); comments and blank lines included; 70 physical lines across 3 .p files in [tutorial directory](https://github.com/p-org/P/tree/260da928f67569ca7a8c0039a02d0bad7cde6096/Tutorial/PriorityQueue); excludes imported Common helpers", "source_example": "\"assert element == \"Hello\" || element == \"World\" || element == \"!!\";\"", "source_url": "https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tutorial/PriorityQueue/PSrc/PriorityQueue.p", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "P generated BasicPaxos BasicPaxos_2026_02_23_19_03_15", "specifies": "Paxos acceptor/proposer/learner variant", "safety": "all learned values agree; source: `OnlyOneValueChosen`; source: \"assert chosenValue == payload.learnedValue,\"", "liveness": "no progress monitor found", "tool": "P; model/checking input, no proof artifact found", "size": "19 physical lines in [OnlyOneValueChosen.p](https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tutorial/BasicPaxos/BasicPaxos_2026_02_23_19_03_15/PSpec/OnlyOneValueChosen.p); comments and blank lines included; 246 lines across 6 .p files", "source_url": "https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tutorial/BasicPaxos/BasicPaxos_2026_02_23_19_03_15/PSpec/OnlyOneValueChosen.p", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "P generated BasicPaxos BasicPaxos_2026_02_23_20_05_17", "specifies": "Paxos acceptor/proposer/learner variant", "safety": "all learned values agree; source: `OnlyOneValueChosen`; source: \"assert chosenValue == payload.learnedValue,\"", "liveness": "no progress monitor found", "tool": "P; model/checking input, no proof artifact found", "size": "27 physical lines in [OnlyOneValueChosen.p](https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tutorial/BasicPaxos/BasicPaxos_2026_02_23_20_05_17/PSpec/OnlyOneValueChosen.p); comments and blank lines included; 300 lines across 6 .p files", "source_url": "https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tutorial/BasicPaxos/BasicPaxos_2026_02_23_20_05_17/PSpec/OnlyOneValueChosen.p", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "P advanced 1 ChainReplicationVerification", "specifies": "unbounded protocol model and inductive invariants", "safety": "a successful read returns the value most recently recorded by the reference key-value map; source: `StrongConsistency` plus auxiliary invariants", "liveness": "no progress proof/monitor found", "tool": "P symbolic verifier (UCLID5/Z3 backend); invariants/monitor present, no explicit `Proof` script found", "size": "128 physical lines in [System.p](https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tutorial/Advanced/1_ChainReplicationVerification/PSrc/System.p); comments and blank lines included", "source_url": "https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tutorial/Advanced/1_ChainReplicationVerification/PSrc/System.p", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "P advanced 2 TwoPhaseCommitVerification / KeyValue", "specifies": "unbounded protocol model and inductive invariants", "safety": "a participant commits only when all participants voted yes for the same key/value transaction; source: `Consistency` plus auxiliary invariants", "liveness": "no progress proof/monitor found", "tool": "P symbolic verifier (UCLID5/Z3 backend); invariants/monitor present, no explicit `Proof` script found", "size": "246 physical lines in [System.p](https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tutorial/Advanced/2_TwoPhaseCommitVerification/KeyValue/PSrc/System.p); comments and blank lines included", "source_url": "https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tutorial/Advanced/2_TwoPhaseCommitVerification/KeyValue/PSrc/System.p", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "P advanced 2 TwoPhaseCommitVerification / Rounds", "specifies": "unbounded protocol model and inductive invariants", "safety": "a participant commits only when all participants voted yes for the same round; source: `invariant safety: forall (c: Coordinator, p1: Participant, r: Round) :: (r in p1.commited ==> (forall (p2: Participant) :: preference(p2, r) == YES));`", "liveness": "no progress proof/monitor found", "tool": "P symbolic verifier (UCLID5/Z3 backend); invariants/monitor present, no explicit `Proof` script found", "size": "136 physical lines in [System.p](https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tutorial/Advanced/2_TwoPhaseCommitVerification/Rounds/PSrc/System.p); comments and blank lines included", "source_url": "https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tutorial/Advanced/2_TwoPhaseCommitVerification/Rounds/PSrc/System.p", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "P advanced 2 TwoPhaseCommitVerification / Single", "specifies": "unbounded protocol model and inductive invariants", "safety": "a participant commits only when all participants voted yes; source: `invariant safety: forall (p1: Participant) :: p1 is Accepted ==> (forall (p2: Participant) :: preference(p2));`", "liveness": "no progress proof/monitor found", "tool": "P symbolic verifier (UCLID5/Z3 backend); explicit `Proof` script present; successful machine checking not rerun", "size": "129 physical lines in [System.p](https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tutorial/Advanced/2_TwoPhaseCommitVerification/Single/PSrc/System.p); comments and blank lines included", "source_url": "https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tutorial/Advanced/2_TwoPhaseCommitVerification/Single/PSrc/System.p", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "P advanced 3 RingLeaderVerification", "specifies": "unbounded protocol model and inductive invariants", "safety": "at most one node wins the election; source: `invariant UniqueLeader: forall (x: machine, y: machine) :: (x is Won && y is Won) ==> x == y;`", "liveness": "no progress proof/monitor found", "tool": "P symbolic verifier (UCLID5/Z3 backend); explicit `Proof` script present; successful machine checking not rerun", "size": "93 physical lines in [System.p](https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tutorial/Advanced/3_RingLeaderVerification/PSrc/System.p); comments and blank lines included", "source_url": "https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tutorial/Advanced/3_RingLeaderVerification/PSrc/System.p", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "P advanced 4 Paxos", "specifies": "unbounded protocol model and inductive invariants", "safety": "all learned values agree; source: `invariant unique_proposal:`; `invariant unique_learned_value:`", "liveness": "no progress proof/monitor found", "tool": "P symbolic verifier (UCLID5/Z3 backend); explicit `Proof` script present; successful machine checking not rerun", "size": "394 physical lines in [System.p](https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tutorial/Advanced/4_Paxos/PSrc/System.p); comments and blank lines included", "source_url": "https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tutorial/Advanced/4_Paxos/PSrc/System.p", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "P advanced 5 Consensus", "specifies": "unbounded protocol model and inductive invariants", "safety": "at most one node becomes leader; source: `invariant unique_leader:`", "liveness": "no progress proof/monitor found", "tool": "P symbolic verifier (UCLID5/Z3 backend); explicit `Proof` script present; successful machine checking not rerun", "size": "68 physical lines in [System.p](https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tutorial/Advanced/5_Consensus/PSrc/System.p); comments and blank lines included", "source_url": "https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tutorial/Advanced/5_Consensus/PSrc/System.p", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "P advanced 6 DistributedLock", "specifies": "unbounded protocol model and inductive invariants", "safety": "at most one node holds the distributed lock; source: `invariant unique_holder: forall (n1: Node, n2: Node) :: n1.held && n2.held ==> n1 == n2;`; `invariant unique_accept:`", "liveness": "no progress proof/monitor found", "tool": "P symbolic verifier (UCLID5/Z3 backend); explicit `Proof` script present; successful machine checking not rerun", "size": "41 physical lines in [System.p](https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tutorial/Advanced/6_DistributedLock/PSrc/System.p); comments and blank lines included", "source_url": "https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tutorial/Advanced/6_DistributedLock/PSrc/System.p", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "P advanced 7 ShardedKV", "specifies": "unbounded protocol model and inductive invariants", "safety": "each key has at most one owner, including while ownership is transferred; source: `invariant unique_key_transfer:`; `invariant unique_owner:`", "liveness": "no progress proof/monitor found", "tool": "P symbolic verifier (UCLID5/Z3 backend); explicit `Proof` script present; successful machine checking not rerun", "size": "47 physical lines in [System.p](https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tutorial/Advanced/7_ShardedKV/PSrc/System.p); comments and blank lines included", "source_url": "https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tutorial/Advanced/7_ShardedKV/PSrc/System.p", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "P advanced 8 LockServer", "specifies": "unbounded protocol model and inductive invariants", "safety": "at most one node holds a granted lock; source: `invariant unique_server: forall (m1: machine, m2: machine) ::`; `invariant unique_lock_holder:`; `invariant unique_grant:`; `invariant unique_unlock:`", "liveness": "no progress proof/monitor found", "tool": "P symbolic verifier (UCLID5/Z3 backend); explicit `Proof` script present; successful machine checking not rerun", "size": "96 physical lines in [System.p](https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tutorial/Advanced/8_LockServer/PSrc/System.p); comments and blank lines included", "source_url": "https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tutorial/Advanced/8_LockServer/PSrc/System.p", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "P portfolio 2PC/2PCwithBTM/TwoPC", "specifies": "two-phase commit with broadcast transaction manager", "safety": "no assertion, safety monitor or theorem found in this standalone file", "liveness": "no progress monitor found", "tool": "P; model-checking benchmark input, no proof artifact found", "size": "180 physical lines in [TwoPC.p](https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/PortfolioTests/2PC/2PCwithBTM/TwoPC.p); comments and blank lines included", "source_url": "https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/PortfolioTests/2PC/2PCwithBTM/TwoPC.p", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "P portfolio BenOr/BenOr", "specifies": "Ben-Or randomized consensus", "safety": "no assertion, safety monitor or theorem found in this standalone file", "liveness": "no progress monitor found", "tool": "P; model-checking benchmark input, no proof artifact found", "size": "237 physical lines in [BenOr.p](https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/PortfolioTests/BenOr/BenOr.p); comments and blank lines included", "source_url": "https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/PortfolioTests/BenOr/BenOr.p", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "P portfolio ChangRob/ChangRoberts", "specifies": "Chang–Roberts ring leader election", "safety": "no assertion, safety monitor or theorem found in this standalone file", "liveness": "no progress monitor found", "tool": "P; model-checking benchmark input, no proof artifact found", "size": "120 physical lines in [ChangRoberts.p](https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/PortfolioTests/ChangRob/ChangRoberts.p); comments and blank lines included", "source_url": "https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/PortfolioTests/ChangRob/ChangRoberts.p", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "P portfolio DAO/DAO", "specifies": "decentralized autonomous organization transition model", "safety": "no assertion, safety monitor or theorem found in this standalone file", "liveness": "no progress monitor found", "tool": "P; model-checking benchmark input, no proof artifact found", "size": "59 physical lines in [DAO.p](https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/PortfolioTests/DAO/DAO.p); comments and blank lines included", "source_url": "https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/PortfolioTests/DAO/DAO.p", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "P portfolio German/German", "specifies": "German cache-coherence protocol", "safety": "no assertion, safety monitor or theorem found in this standalone file", "liveness": "no progress monitor found", "tool": "P; model-checking benchmark input, no proof artifact found", "size": "282 physical lines in [German.p](https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/PortfolioTests/German/German.p); comments and blank lines included", "source_url": "https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/RegressionTests/Integration/Correct/German/German.p", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "P portfolio HClock/HLC", "specifies": "hybrid logical clock", "safety": "no assertion, safety monitor or theorem found in this standalone file", "liveness": "no progress monitor found", "tool": "P; model-checking benchmark input, no proof artifact found", "size": "128 physical lines in [HLC.p](https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/PortfolioTests/HClock/HLC.p); comments and blank lines included", "source_url": "https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/PortfolioTests/HClock/HLC.p", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "P portfolio Paxos/Paxos/Paxos", "specifies": "Paxos consensus variant", "safety": "no assertion, safety monitor or theorem found in this standalone file", "liveness": "no progress monitor found", "tool": "P; model-checking benchmark input, no proof artifact found", "size": "456 physical lines in [Paxos.p](https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/PortfolioTests/Paxos/Paxos/Paxos.p); comments and blank lines included", "source_url": "https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/PortfolioTests/Paxos/Paxos/Paxos.p", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "P portfolio Paxos/Paxos_map/Paxos_map", "specifies": "Paxos consensus variant", "safety": "no assertion, safety monitor or theorem found in this standalone file", "liveness": "no progress monitor found", "tool": "P; model-checking benchmark input, no proof artifact found", "size": "508 physical lines in [Paxos_map.p](https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/PortfolioTests/Paxos/Paxos_map/Paxos_map.p); comments and blank lines included", "source_url": "https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/PortfolioTests/Paxos/Paxos_map/Paxos_map.p", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "P portfolio Paxos/Paxos_seq/Paxos_seq", "specifies": "Paxos consensus variant", "safety": "no assertion, safety monitor or theorem found in this standalone file", "liveness": "no progress monitor found", "tool": "P; model-checking benchmark input, no proof artifact found", "size": "471 physical lines in [Paxos_seq.p](https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/PortfolioTests/Paxos/Paxos_seq/Paxos_seq.p); comments and blank lines included", "source_url": "https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/PortfolioTests/Paxos/Paxos_seq/Paxos_seq.p", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "P portfolio Paxos/paxosV2/PaxosV2", "specifies": "Paxos consensus variant", "safety": "no assertion, safety monitor or theorem found in this standalone file", "liveness": "no progress monitor found", "tool": "P; model-checking benchmark input, no proof artifact found", "size": "410 physical lines in [PaxosV2.p](https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/PortfolioTests/Paxos/paxosV2/PaxosV2.p); comments and blank lines included", "source_url": "https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/PortfolioTests/Paxos/paxosV2/PaxosV2.p", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "P portfolio Paxos/paxosV3/PaxosV3", "specifies": "Paxos consensus variant", "safety": "no assertion, safety monitor or theorem found in this standalone file", "liveness": "no progress monitor found", "tool": "P; model-checking benchmark input, no proof artifact found", "size": "465 physical lines in [PaxosV3.p](https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/PortfolioTests/Paxos/paxosV3/PaxosV3.p); comments and blank lines included", "source_url": "https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/PortfolioTests/Paxos/paxosV3/PaxosV3.p", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "P portfolio Paxos/paxosV4/PaxosV4", "specifies": "Paxos consensus variant", "safety": "no assertion, safety monitor or theorem found in this standalone file", "liveness": "no progress monitor found", "tool": "P; model-checking benchmark input, no proof artifact found", "size": "571 physical lines in [PaxosV4.p](https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/PortfolioTests/Paxos/paxosV4/PaxosV4.p); comments and blank lines included", "source_url": "https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/PortfolioTests/Paxos/paxosV4/PaxosV4.p", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "P portfolio Paxos/paxosV5/PaxosV5", "specifies": "Paxos consensus variant", "safety": "no assertion, safety monitor or theorem found in this standalone file", "liveness": "no progress monitor found", "tool": "P; model-checking benchmark input, no proof artifact found", "size": "425 physical lines in [PaxosV5.p](https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/PortfolioTests/Paxos/paxosV5/PaxosV5.p); comments and blank lines included", "source_url": "https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/PortfolioTests/Paxos/paxosV5/PaxosV5.p", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "P portfolio Paxos/paxosV5_no_requires/PaxosV5", "specifies": "Paxos consensus variant", "safety": "no assertion, safety monitor or theorem found in this standalone file", "liveness": "no progress monitor found", "tool": "P; model-checking benchmark input, no proof artifact found", "size": "260 physical lines in [PaxosV5.p](https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/PortfolioTests/Paxos/paxosV5_no_requires/PaxosV5.p); comments and blank lines included", "source_url": "https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/PortfolioTests/Paxos/paxosV5_no_requires/PaxosV5.p", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "P portfolio Streamlet/str0", "specifies": "Streamlet Byzantine consensus", "safety": "no assertion, safety monitor or theorem found in this standalone file", "liveness": "no progress monitor found", "tool": "P; model-checking benchmark input, no proof artifact found", "size": "164 physical lines in [str0.p](https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/PortfolioTests/Streamlet/str0.p); comments and blank lines included", "source_url": "https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/PortfolioTests/Streamlet/str0.p", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "P portfolio TokenRing/TokenRing", "specifies": "token-ring communication", "safety": "no assertion, safety monitor or theorem found in this standalone file", "liveness": "no progress monitor found", "tool": "P; model-checking benchmark input, no proof artifact found", "size": "164 physical lines in [TokenRing.p](https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/PortfolioTests/TokenRing/TokenRing.p); comments and blank lines included", "source_url": "https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/PortfolioTests/TokenRing/TokenRing.p", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "P portfolio VoldKV/VoldChain", "specifies": "chain-replicated key-value store", "safety": "no assertion, safety monitor or theorem found in this standalone file", "liveness": "no progress monitor found", "tool": "P; model-checking benchmark input, no proof artifact found", "size": "320 physical lines in [VoldChain.p](https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/PortfolioTests/VoldKV/VoldChain.p); comments and blank lines included", "source_url": "https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/PortfolioTests/VoldKV/VoldChain.p", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "P portfolio two-phase commit with failures", "specifies": "two-phase commit, client readback and injected node failures", "safety": "a successful transaction requires affirmative votes from all participants; source: `AtomicityInvariant`; source: \"assert participantsResponse[resp.transId][SUCCESS] == numParticipants,\"", "liveness": "pending write transactions eventually receive responses; source: `Progress`; source: \"hot state WaitForResponses\"", "tool": "P; systematic testing/model-checking monitors", "size": "83 physical lines in [Atomicity.p](https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/PortfolioTests/2PC/TwoPhaseCommit/PSpec/Atomicity.p); comments and blank lines included; 827 lines across 11 .p files including local helpers", "source_url": "https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/PortfolioTests/2PC/TwoPhaseCommit/PSpec/Atomicity.p", "has_liveness": true}
{"section": "Industrial specifications and P", "group": "", "name": "P shared object with exclusive lock", "specifies": "asynchronous read/modify/write guarded by a lock", "safety": "no standalone safety monitor found", "liveness": "no progress monitor found", "tool": "P; model-checking input; no proof artifact found", "size": "90 physical lines in [LBSharedObject.p](https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tutorial/Common/SharedMemory/PSrc/LBSharedObject.p); comments and blank lines included; 370 lines across 4 .p files", "source_url": "https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tutorial/Common/SharedMemory/PSrc/LBSharedObject.p", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "P shared object with reader/writer lock", "specifies": "reader/writer admission and serialized mutations", "safety": "inline assertion: \"assert sizeof(waitingReaders) == 0 && sizeof(waitingWriters) == 0, \"Logic for picking readers and writers is incorrect!\";\"", "liveness": "no progress monitor found", "tool": "P; model-checking input; no proof artifact found", "size": "187 physical lines in [RWLBSharedObject.p](https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tutorial/Common/SharedMemory/PSrc/RWLBSharedObject.p); comments and blank lines included; 370 lines across 4 .p files", "source_url": "https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tutorial/Common/SharedMemory/PSrc/RWLBSharedObject.p", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "P operating-system resource protocol", "specifies": "concurrent operating-system resource request/response model", "safety": "no standalone safety monitor found", "liveness": "no progress monitor found", "tool": "P; model-checking input; no proof artifact found", "size": "132 physical lines in [OS.p](https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/RegressionTests/Feature5ModuleSystem/Correct/OSR/OS.p); comments and blank lines included; 426 lines across 5 .p files", "source_url": "https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/RegressionTests/Feature5ModuleSystem/Correct/OSR/OS.p", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "P regression Feature5ModuleSystem/Correct/Elevator", "specifies": "concurrent protocol regression variant; correct-case fixture", "safety": "no stated safety assertion found", "liveness": "no progress monitor found", "tool": "P; test/model-checking fixture, no proof artifact found", "size": "278 physical lines in [Elevator.p](https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/RegressionTests/Feature5ModuleSystem/Correct/Elevator/Elevator.p); comments and blank lines included", "source_url": "https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/RegressionTests/Feature5ModuleSystem/Correct/Elevator/Elevator.p", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "P regression Feature5ModuleSystem/Correct/ElevatorMod", "specifies": "concurrent protocol regression variant; correct-case fixture", "safety": "no stated safety assertion found", "liveness": "no progress monitor found", "tool": "P; test/model-checking fixture, no proof artifact found", "size": "291 physical lines in [Elevator.p](https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/RegressionTests/Feature5ModuleSystem/Correct/ElevatorMod/Elevator.p); comments and blank lines included", "source_url": "https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/RegressionTests/Feature5ModuleSystem/Correct/ElevatorMod/Elevator.p", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "P regression Integration/Correct/TokenRing", "specifies": "concurrent protocol regression variant; correct-case fixture", "safety": "no stated safety assertion found", "liveness": "no progress monitor found", "tool": "P; test/model-checking fixture, no proof artifact found", "size": "166 physical lines in [TokenRing.p](https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/RegressionTests/Integration/Correct/TokenRing/TokenRing.p); comments and blank lines included", "source_url": "https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/RegressionTests/Integration/Correct/TokenRing/TokenRing.p", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "P regression Integration/Correct/openwsn1", "specifies": "concurrent protocol regression variant; correct-case fixture", "safety": "no stated safety assertion found", "liveness": "no progress monitor found", "tool": "P; test/model-checking fixture, no proof artifact found", "size": "288 physical lines in [openwsn1.p](https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/RegressionTests/Integration/Correct/openwsn1/openwsn1.p); comments and blank lines included", "source_url": "https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/RegressionTests/Integration/Correct/openwsn1/openwsn1.p", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "P regression Integration/Correct/two-phase-commit", "specifies": "concurrent protocol regression variant; correct-case fixture", "safety": "`M`", "liveness": "no progress monitor found", "tool": "P; test/model-checking fixture, no proof artifact found", "size": "299 physical lines in [two-phase-commit.p](https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/RegressionTests/Integration/Correct/two-phase-commit/two-phase-commit.p); comments and blank lines included", "source_url": "https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/RegressionTests/Integration/Correct/two-phase-commit/two-phase-commit.p", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "P regression Integration/DynamicError/Multi_Paxos_3", "specifies": "concurrent protocol regression variant; expected runtime-error case", "safety": "`BasicPaxosInvariant_P2b`, `ValmachineityCheck`", "liveness": "no progress monitor found", "tool": "P; test/model-checking fixture, no proof artifact found", "size": "576 physical lines in [Multi_Paxos_3.p](https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/RegressionTests/Integration/DynamicError/Multi_Paxos_3/Multi_Paxos_3.p); comments and blank lines included", "source_url": "https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/RegressionTests/Integration/DynamicError/Multi_Paxos_3/Multi_Paxos_3.p", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "P regression Integration/DynamicError/Multi_Paxos_4", "specifies": "concurrent protocol regression variant; expected runtime-error case", "safety": "`BasicPaxosInvariant_P2b`, `ValmachineityCheck`", "liveness": "no progress monitor found", "tool": "P; test/model-checking fixture, no proof artifact found", "size": "579 physical lines in [Multi_Paxos_4.p](https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/RegressionTests/Integration/DynamicError/Multi_Paxos_4/Multi_Paxos_4.p); comments and blank lines included", "source_url": "https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/RegressionTests/Integration/DynamicError/Multi_Paxos_4/Multi_Paxos_4.p", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "P regression Integration/DynamicError/two-phase-commit_1", "specifies": "concurrent protocol regression variant; expected runtime-error case", "safety": "inline assertions: \"assert (pendingWriteReq.seqNum > lastSeqNum);\"", "liveness": "no progress monitor found", "tool": "P; test/model-checking fixture, no proof artifact found", "size": "313 physical lines in [two-phase-commit_1.p](https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/RegressionTests/Integration/DynamicError/two-phase-commit_1/two-phase-commit_1.p); comments and blank lines included", "source_url": "https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Tst/RegressionTests/Integration/DynamicError/two-phase-commit_1/two-phase-commit_1.p", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "P resource variant Paxos", "specifies": "additional resource/example model; exact-identical Tutorial/Portfolio files excluded", "safety": "only one value is chosen; proposal numbers increase; accepted values remain consistent; source: `SafetyOnlyOneValueChosen`, `SafetyMonotonicProposalNumbers`, `SafetyConsistentAcceptedValues`", "liveness": "no progress monitor found in nonduplicate files", "tool": "P; monitor/model input; checker success unconfirmed", "size": "137 physical lines in [Safety.p](https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Src/PeasyAI/resources/rag_examples/Paxos/PSpec/Safety.p); comments and blank lines included; 601 lines across 7 nonduplicate .p files", "source_url": "https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Src/PeasyAI/resources/rag_examples/Paxos/PSpec/Safety.p", "has_liveness": false}
{"section": "Industrial specifications and P", "group": "", "name": "P resource variant TwoPhaseCommit", "specifies": "additional resource/example model; exact-identical Tutorial/Portfolio files excluded", "safety": "the transaction result agrees with participant votes; source: `Atomicity`", "liveness": "every transaction request eventually receives a response; source: `Progress`", "tool": "P; monitor/model input; checker success unconfirmed", "size": "101 physical lines in [Safety.p](https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Src/PeasyAI/resources/rag_examples/TwoPhaseCommit/PSpec/Safety.p); comments and blank lines included; 602 lines across 7 nonduplicate .p files", "source_url": "https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Src/PeasyAI/resources/rag_examples/TwoPhaseCommit/PSpec/Safety.p", "has_liveness": true}
{"section": "Industrial specifications and P", "group": "", "name": "P resource variant LockServerPObserve", "specifies": "additional resource/example model; exact-identical Tutorial/Portfolio files excluded", "safety": "only one client holds the lock; grant responses correspond to requests; source: `MutualExclusion`, `ResponseOnlyOnRequest`", "liveness": "no progress monitor found in nonduplicate files", "tool": "P; monitor/model input; checker success unconfirmed", "size": "95 physical lines in [LockServerCorrect.p](https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Src/PObserve/Examples/LockServerPObserve/src/main/PSpec/LockServerCorrect.p); comments and blank lines included; 95 lines across 1 nonduplicate .p files", "source_url": "https://github.com/p-org/P/blob/260da928f67569ca7a8c0039a02d0bad7cde6096/Src/PObserve/Examples/LockServerPObserve/src/main/PSpec/LockServerCorrect.p", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "pingpong (doc/examples/MSV/pingpong.ivy)", "specifies": "ping-pong message exchange", "safety": "`assert side = left;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/pingpong.ivy#L35)); `assert side = right;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/pingpong.ivy#L42))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "128 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/pingpong.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/pingpong.ivy#L35", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "pingpong_bad (doc/examples/MSV/pingpong_bad.ivy)", "specifies": "ping-pong message exchange", "safety": "`conjecture left_player.ball -> spec.side = left` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/pingpong_bad.ivy#L38)); `conjecture right_player.ball -> spec.side = right` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/pingpong_bad.ivy#L56))", "liveness": "no active temporal/progress declaration found in this file", "negative-test_warning": "the filename marks this as a bad/buggy/unsafe/error variant; displayed properties are attempted checks, not established guarantees", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "64 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/pingpong_bad.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/pingpong_bad.ivy#L38", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "pingpong_ex (doc/examples/MSV/pingpong_ex.ivy)", "specifies": "ping-pong message exchange", "safety": "`assert side = left & ...;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/pingpong_ex.ivy#L29)); `assert side = right & ...;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/pingpong_ex.ivy#L36))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "114 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/pingpong_ex.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/pingpong_ex.ivy#L29", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "pingpong_soln (doc/examples/MSV/pingpong_soln.ivy)", "specifies": "ping-pong message exchange", "safety": "`assert side = left & (val/2)*2 = val;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/pingpong_soln.ivy#L29)); `assert side = right & (val/2)*2+1 = val;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/pingpong_soln.ivy#L36))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "117 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/pingpong_soln.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/pingpong_soln.ivy#L29", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "repstore1 (doc/examples/MSV/repstore1.ivy)", "specifies": "replicated store", "safety": "`assert 0 <= tx & tx < next;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/repstore1.ivy#L187)); `assert ~committed(tx);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/repstore1.ivy#L188)); `assert committed(tx);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/repstore1.ivy#L198))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "387 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/repstore1.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/repstore1.ivy#L187", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "repstore2 (doc/examples/MSV/repstore2.ivy)", "specifies": "replicated store", "safety": "`assert 0 <= tx & tx < next;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/repstore2.ivy#L151)); `assert ~committed(tx);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/repstore2.ivy#L152)); `assert committed(tx);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/repstore2.ivy#L159))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "546 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/repstore2.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/repstore2.ivy#L151", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "repstore2bug (doc/examples/MSV/repstore2bug.ivy)", "specifies": "replicated store", "safety": "`assert 0 <= tx & tx < next;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/repstore2bug.ivy#L122)); `assert ~committed(tx);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/repstore2bug.ivy#L123)); `assert committed(tx);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/repstore2bug.ivy#L130))", "liveness": "no active temporal/progress declaration found in this file", "negative-test_warning": "the filename marks this as a bad/buggy/unsafe/error variant; displayed properties are attempted checks, not established guarantees", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "530 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/repstore2bug.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/repstore2bug.ivy#L122", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "repstore2ex (doc/examples/MSV/repstore2ex.ivy)", "specifies": "replicated store", "safety": "`assert 0 <= tx & tx < next;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/repstore2ex.ivy#L127)); `assert ~committed(tx);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/repstore2ex.ivy#L128)); `assert committed(tx);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/repstore2ex.ivy#L135))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "538 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/repstore2ex.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/repstore2ex.ivy#L127", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "repstore2ex_soln (doc/examples/MSV/repstore2ex_soln.ivy)", "specifies": "replicated store", "safety": "`assert 0 <= tx & tx < next;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/repstore2ex_soln.ivy#L127)); `assert ~committed(tx);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/repstore2ex_soln.ivy#L128)); `assert committed(tx);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/repstore2ex_soln.ivy#L135))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "562 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/repstore2ex_soln.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/repstore2ex_soln.ivy#L127", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "repstore3 (doc/examples/MSV/repstore3.ivy)", "specifies": "replicated store", "safety": "`assert 0 <= tx & tx < next;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/repstore3.ivy#L116)); `assert ~committed(tx);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/repstore3.ivy#L117)); `assert committed(tx);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/repstore3.ivy#L124))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "465 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/repstore3.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/repstore3.ivy#L116", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "repstore3_soln (doc/examples/MSV/repstore3_soln.ivy)", "specifies": "replicated store", "safety": "`assert 0 <= tx & tx < next;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/repstore3_soln.ivy#L114)); `assert ~committed(tx);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/repstore3_soln.ivy#L115)); `assert committed(tx);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/repstore3_soln.ivy#L122))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "531 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/repstore3_soln.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/repstore3_soln.ivy#L114", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "repstore_variant (doc/examples/MSV/repstore_variant.ivy)", "specifies": "replicated store", "safety": "`assert 0 <= tx & tx < next;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/repstore_variant.ivy#L100)); `assert ~serialized(tx);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/repstore_variant.ivy#L101)); `assert 0 <= tx & tx < next;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/repstore_variant.ivy#L107))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "248 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/repstore_variant.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/repstore_variant.ivy#L100", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "token_ring (doc/examples/MSV/token_ring.ivy)", "specifies": "ring protocol", "safety": "`assert ~lock(X);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/token_ring.ivy#L65)); `assert lock(v);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/token_ring.ivy#L70))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "112 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/token_ring.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/token_ring.ivy#L65", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "token_ring_buggy (doc/examples/MSV/token_ring_buggy.ivy)", "specifies": "ring protocol", "safety": "`assert ~sent(dst,pkt);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/token_ring_buggy.ivy#L83)); `assert sent(dst,pkt);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/token_ring_buggy.ivy#L88)); `assert ~lock(X);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/token_ring_buggy.ivy#L209))", "liveness": "no active temporal/progress declaration found in this file", "negative-test_warning": "the filename marks this as a bad/buggy/unsafe/error variant; displayed properties are attempted checks, not established guarantees", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "273 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/token_ring_buggy.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/MSV/token_ring_buggy.ivy#L83", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "account (doc/examples/account.ivy)", "specifies": "account concurrency", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "29 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/account.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/account.ivy", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "account2 (doc/examples/account2.ivy)", "specifies": "account concurrency", "safety": "`assert balance + x >= balance` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/account2.ivy#L26)); `assert x <= balance` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/account2.ivy#L29))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "39 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/account2.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/account2.ivy#L26", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "account3 (doc/examples/account3.ivy)", "specifies": "account concurrency", "safety": "`assert balance + x >= balance` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/account3.ivy#L26)); `assert x <= balance` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/account3.ivy#L29))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "46 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/account3.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/account3.ivy#L26", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "bcast (doc/examples/bcast.ivy)", "specifies": "Byzantine broadcast", "safety": "`invariant net.sent(M,D) -> sent(M,D)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/bcast.ivy#L57))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "85 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/bcast.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/bcast.ivy#L57", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "flash_inv (doc/examples/cav2020/cav-18/flash_inv.ivy)", "specifies": "FLASH cache coherence", "safety": "`invariant [coherent1] cache(X).state = exclusive -> X = real_owner` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/cav-18/flash_inv.ivy#L489))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "577 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/cav-18/flash_inv.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/cav-18/flash_inv.ivy#L489", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "flash_mc (doc/examples/cav2020/cav-18/flash_mc.ivy)", "specifies": "FLASH cache coherence", "safety": "`invariant [coherent] cache(X).state = exclusive -> X = real_owner` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/cav-18/flash_mc.ivy#L460))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun; model-checking variant indicated by filename", "size": "484 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/cav-18/flash_mc.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/cav-18/flash_mc.ivy#L460", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "german_inv (doc/examples/cav2020/cav-18/german_inv.ivy)", "specifies": "German cache coherence", "safety": "`invariant forall C1, C2. C1 ~= C2 & s.cache(C1) = exclusive -> s.cache(C2) = invalid` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/cav-18/german_inv.ivy#L113))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "143 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/cav-18/german_inv.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/cav-18/german_inv.ivy#L113", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "german_mc (doc/examples/cav2020/cav-18/german_mc.ivy)", "specifies": "German cache coherence", "safety": "`invariant forall C1, C2. C1 ~= C2 & s.cache(C1) = exclusive -> s.cache(C2) = invalid` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/cav-18/german_mc.ivy#L114))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun; model-checking variant indicated by filename", "size": "133 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/cav-18/german_mc.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/cav-18/german_mc.ivy#L114", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "vs_paxos_inv (doc/examples/cav2020/cav-18/vs_paxos_inv.ivy)", "specifies": "Paxos consensus variant", "safety": "`conjecture ~wedge_msg(E,0)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/cav-18/vs_paxos_inv.ivy#L221)); `conjecture ~accept_msg(E,0,C)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/cav-18/vs_paxos_inv.ivy#L222)); `conjecture ~accepted_msg(E,N,0,C)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/cav-18/vs_paxos_inv.ivy#L223)); `conjecture accept_msg(E,S,C1) & accept_msg(E,S,C2) -> C1 = C2` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/cav-18/vs_paxos_inv.ivy#L229)); `conjecture accepted_msg(E,N,S,C) -> accept_msg(E,S,C)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/cav-18/vs_paxos_inv.ivy#L230)); `conjecture joined_stake(E,N,S2) & (S2 > S1) -> left_stake(E,N,S1)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/cav-18/vs_paxos_inv.ivy#L231)); `conjecture (S2 > S1) & accept_msg(E,S2,C2) & C1 ~= C2 & nodeset.majority(NSET) ->` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/cav-18/vs_paxos_inv.ivy#L235)); `conjecture config_decided(E,C)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/cav-18/vs_paxos_inv.ivy#L238)); `conjecture config_decided(E,C1) & config_decided(E,C2) -> C1 = C2` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/cav-18/vs_paxos_inv.ivy#L242)); `conjecture joined_stake(E,N,S) -> started(E,N)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/cav-18/vs_paxos_inv.ivy#L245)); `conjecture wedged(E,N) -> started(E,N)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/cav-18/vs_paxos_inv.ivy#L246)); `conjecture leader_of(N,E) & proposal(E,I,V1) -> started(E,N)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/cav-18/vs_paxos_inv.ivy#L247)); `conjecture vote(E,N,I,V) -> started(E,N)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/cav-18/vs_paxos_inv.ivy#L248)); `conjecture decision(E,N,I,V) -> started(E,N)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/cav-18/vs_paxos_inv.ivy#L249)); `conjecture transferral(E,N,I,V) -> started(E,N)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/cav-18/vs_paxos_inv.ivy#L250)); `conjecture proposal(E,I,V1) & proposal(E,I,V2) -> V1 = V2` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/cav-18/vs_paxos_inv.ivy#L253)); `conjecture vote(E,N,I,V) -> proposal(E,I,V)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/cav-18/vs_paxos_inv.ivy#L254)); `conjecture joined_stake(E,N,S) -> wedged(E,N)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/cav-18/vs_paxos_inv.ivy#L255)); `conjecture transferral(E,N,I,V) -> decision(E,N,I,V)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/cav-18/vs_paxos_inv.ivy#L256)); `conjecture decision(E,N1,I,V) & nodeset.majority(NSET) -> transferral(E,N1,I,V)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/cav-18/vs_paxos_inv.ivy#L257)); `conjecture accept_msg(E,S,C) & val_at(C,I,V) -> exists N. vote(E,N,I,V) | transferral(E,N,I,V)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/cav-18/vs_paxos_inv.ivy#L261)); `conjecture decision(E,N,I,V) & accept_msg(E,S,C) -> val_at(C,I,V)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/cav-18/vs_paxos_inv.ivy#L264)); `conjecture accept_msg(E,S,C) & nodeset.majority(NSET)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/cav-18/vs_paxos_inv.ivy#L265)); `conjecture started(E,N1) & started(E,N2) -> (transferral(E,N1,I,V) <-> transferral(E,N2,I,V))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/cav-18/vs_paxos_inv.ivy#L270)); `conjecture (exists E2,N2. epoch.succ(E1,E2) & started(E2,N2)) -> exists C. config_decided(E1,C)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/cav-18/vs_paxos_inv.ivy#L271)); `conjecture epoch.succ(E1,E2) & started(E2,N) & config_decided(E1,C) -> ( transferral(E2,N,I,V) <-> val_at(C,I,V)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/cav-18/vs_paxos_inv.ivy#L272)); `conjecture transferral(E,N,I1,V1) & proposal(E,I2,V2) -> ~(I2 <= I1)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/cav-18/vs_paxos_inv.ivy#L277)); `conjecture (exists E2,N2. (E2 > E1) & started(E2,N2)) -> exists C. config_decided(E1,C)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/cav-18/vs_paxos_inv.ivy#L279)); `conjecture config_decided(E1,C1) & (E2 > E1) & val_at(C1,I,V) & started(E2,N2)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/cav-18/vs_paxos_inv.ivy#L282)); `conjecture (decision(E1,N1,I,V1) & decision(E2,N2,I,V2)) -> V1 = V2` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/cav-18/vs_paxos_inv.ivy#L285)); `conjecture any_decision(I,V) -> exists E,N. decision(E,N,I,V)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/cav-18/vs_paxos_inv.ivy#L287))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "299 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/cav-18/vs_paxos_inv.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/cav-18/vs_paxos_inv.ivy#L221", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "vs_paxos_mc (doc/examples/cav2020/cav-18/vs_paxos_mc.ivy)", "specifies": "Paxos consensus variant", "safety": "`require s ~= 0;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/cav-18/vs_paxos_mc.ivy#L89)); `require s ~= 0;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/cav-18/vs_paxos_mc.ivy#L94)); `require started(e,n);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/cav-18/vs_paxos_mc.ivy#L95))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun; model-checking variant indicated by filename", "size": "262 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/cav-18/vs_paxos_mc.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/cav-18/vs_paxos_mc.ivy#L89", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "german_bmc_bug (doc/examples/cav2020/german_bmc_bug.ivy)", "specifies": "German cache coherence", "safety": "`invariant forall C1, C2. C1 ~= C2 & s.cache(C1) = exclusive -> s.cache(C2) = invalid` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/german_bmc_bug.ivy#L144))", "liveness": "no active temporal/progress declaration found in this file", "negative-test_warning": "the filename marks this as a bad/buggy/unsafe/error variant; displayed properties are attempted checks, not established guarantees", "tool": "Ivy; specification/invariant obligations present; checker success not rerun; model-checking variant indicated by filename", "size": "159 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/german_bmc_bug.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/german_bmc_bug.ivy#L144", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "german_mc_bug (doc/examples/cav2020/german_mc_bug.ivy)", "specifies": "German cache coherence", "safety": "`invariant forall C1, C2. C1 ~= C2 & s.cache(C1) = exclusive -> s.cache(C2) = invalid` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/german_mc_bug.ivy#L140))", "liveness": "no active temporal/progress declaration found in this file", "negative-test_warning": "the filename marks this as a bad/buggy/unsafe/error variant; displayed properties are attempted checks, not established guarantees", "tool": "Ivy; specification/invariant obligations present; checker success not rerun; model-checking variant indicated by filename", "size": "159 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/german_mc_bug.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/german_mc_bug.ivy#L140", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "leader_tutorial (doc/examples/cav2020/leader_tutorial.ivy)", "specifies": "leader election", "safety": "`invariant ~(pid(N) < pid(P) & sent(pid(N),N))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/leader_tutorial.ivy#L106))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "167 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/leader_tutorial.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/leader_tutorial.ivy#L106", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "leader_tutorial_without_proof (doc/examples/cav2020/leader_tutorial_without_proof.ivy)", "specifies": "leader election", "safety": "`invariant net.sent(V,N) -> abstract_model.sent(V,N)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/leader_tutorial_without_proof.ivy#L153))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "161 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/leader_tutorial_without_proof.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/leader_tutorial_without_proof.ivy#L153", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "ticket (doc/examples/cav2020/liveness/ticket.ivy)", "specifies": "ticket lock", "safety": "`invariant pc1(T) | pc2(T) | pc3(T)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/liveness/ticket.ivy#L131))", "liveness": "`temporal property [nonstarvation]  (forall T:thread. globally (~globally (~scheduled(T)))) ->` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/liveness/ticket.ivy#L150))", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "231 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/liveness/ticket.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/liveness/ticket.ivy#L131", "has_liveness": true}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "ticket_nested (doc/examples/cav2020/liveness/ticket_nested.ivy)", "specifies": "ticket lock", "safety": "`invariant [safety] pc3(T1) & pc3(T2) -> T1 = T2` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/liveness/ticket_nested.ivy#L142))", "liveness": "`temporal property [nonstarvation] ( ((exists T0. ~(globally ~(pc2(T0) & globally ~pc3(T0)))) -> ~(globally ~(pc2(sk0) & globally ~pc3(sk0)))) &` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/liveness/ticket_nested.ivy#L169))", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "291 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/liveness/ticket_nested.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/liveness/ticket_nested.ivy#L142", "has_liveness": true}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "multi_paxos_protocol (doc/examples/cav2020/pldi-18/multi_paxos/multi_paxos_protocol.ivy)", "specifies": "Paxos consensus variant", "safety": "`invariant [agreement] decision(I,V1) & decision(I,V2) -> V1 = V2` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/pldi-18/multi_paxos/multi_paxos_protocol.ivy#L36))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "120 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/pldi-18/multi_paxos/multi_paxos_protocol.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/pldi-18/multi_paxos/multi_paxos_protocol.ivy#L36", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "multi_paxos_system (doc/examples/cav2020/pldi-18/multi_paxos/multi_paxos_system.ivy)", "specifies": "Paxos consensus variant", "safety": "`invariant ~init_status.decided & ~nset.member(N,init_status.voters) & ~init_status.active` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/pldi-18/multi_paxos/multi_paxos_system.ivy#L40))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "718 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/pldi-18/multi_paxos/multi_paxos_system.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/pldi-18/multi_paxos/multi_paxos_system.ivy#L40", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "toy_consensus (doc/examples/cav2020/pldi-18/toy_consensus.ivy)", "specifies": "consensus/agreement protocol", "safety": "`invariant [one_leader] isleader(N) & isleader(M) -> N = M` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/pldi-18/toy_consensus.ivy#L74))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "431 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/pldi-18/toy_consensus.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/pldi-18/toy_consensus.ivy#L74", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "token_ring (doc/examples/cav2020/token_ring.ivy)", "specifies": "ring protocol", "safety": "`assert ~lock(X);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/token_ring.ivy#L67)); `assert lock(v);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/token_ring.ivy#L72))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "192 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/token_ring.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/cav2020/token_ring.ivy#L67", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "client_server_example (doc/examples/client_server_example.ivy)", "specifies": "client/server request protocol", "safety": "`invariant ~(X ~= Z & link(X,Y) & link(Z,Y))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/client_server_example.ivy#L26))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "35 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/client_server_example.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/client_server_example.ivy#L26", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "client_server_example_mc2 (doc/examples/client_server_example_mc2.ivy)", "specifies": "client/server request protocol", "safety": "`invariant link(X,Y) & link(Z,Y) -> X = Z` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/client_server_example_mc2.ivy#L26))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun; model-checking variant indicated by filename", "size": "32 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/client_server_example_mc2.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/client_server_example_mc2.ivy#L26", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "client_server_example_mv (doc/examples/client_server_example_mv.ivy)", "specifies": "client/server request protocol", "safety": "`invariant link(X,Y) & link(Z,Y) -> X = Z` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/client_server_example_mv.ivy#L27))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "35 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/client_server_example_mv.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/client_server_example_mv.ivy#L27", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "client_server_example_new (doc/examples/client_server_example_new.ivy)", "specifies": "client/server request protocol", "safety": "`invariant ~(X ~= Z & link(X,Y) & link(Z,Y))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/client_server_example_new.ivy#L26))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "35 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/client_server_example_new.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/client_server_example_new.ivy#L26", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "echo (doc/examples/echo.ivy)", "specifies": "echo message protocol", "safety": "`invariant response_sent(X,S,D) -> request_sent(X,D,S)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/echo.ivy#L59))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "174 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/echo.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/echo.ivy#L59", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "interference (doc/examples/interference.ivy)", "specifies": "concurrent interference", "safety": "`conjecture left_player.ball -> spec.side = left` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/interference.ivy#L40)); `conjecture right_player.ball -> spec.side = right` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/interference.ivy#L58))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "66 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/interference.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/interference.ivy#L40", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "interference2 (doc/examples/interference2.ivy)", "specifies": "concurrent interference", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "15 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/interference2.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/interference2.ivy", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "interference3 (doc/examples/interference3.ivy)", "specifies": "concurrent interference", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "15 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/interference3.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/interference3.ivy", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "interference4 (doc/examples/interference4.ivy)", "specifies": "concurrent interference", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "15 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/interference4.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/interference4.ivy", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "lamport_mutex (doc/examples/lamport_mutex.ivy)", "specifies": "mutual exclusion", "safety": "`invariant idx <= self` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/lamport_mutex.ivy#L287))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "428 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/lamport_mutex.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/lamport_mutex.ivy#L287", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "leader_election_ring (doc/examples/leader_election_ring.ivy)", "specifies": "leader election", "safety": "`ensure (y <= X & X <= x) | (x < y & ~ (x < Z & Z < y))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_election_ring.ivy#L60)); `require sent(v,dst)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_election_ring.ivy#L95)); `ensure me.pid >= node.pid(X)    # only the max pid can be elected` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_election_ring.ivy#L114))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "147 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_election_ring.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_election_ring.ivy#L60", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "leader_election_ring2 (doc/examples/leader_election_ring2.ivy)", "specifies": "leader election", "safety": "`conjecture ~(pid(N1) <= pid(N0) & trans.pending(pid(N1),N1) & pid(N1) ~= pid(N0))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_election_ring2.ivy#L158)); `conjecture ~(pid(N2) <= pid(N0) & trans.pending(pid(N2),N1) & N0 <= N1 & N2 <= N0 & N0 ~= N2 & N1 ~= N0)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_election_ring2.ivy#L159)); `conjecture ~(pid(N2) <= pid(N0) & trans.pending(pid(N2),N1) & N0 <= N1 & N1 <= N2 & N1 ~= N0)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_election_ring2.ivy#L160)); `conjecture ~(pid(N2) <= pid(N0) & trans.pending(pid(N2),N1) & N1 <= N2 & N2 <= N0 & N0 ~= N2)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_election_ring2.ivy#L161))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "175 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_election_ring2.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_election_ring2.ivy#L158", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "leader_election_ring_btw (doc/examples/leader_election_ring_btw.ivy)", "specifies": "leader election", "safety": "`assert ~btw(x,Z,y)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_election_ring_btw.ivy#L63)); `require sent(v,dst)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_election_ring_btw.ivy#L99)); `ensure me.pid >= node.pid(X)    # only the max pid can be elected` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_election_ring_btw.ivy#L118))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "149 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_election_ring_btw.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_election_ring_btw.ivy#L63", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "leader_election_ring_repl (doc/examples/leader_election_ring_repl.ivy)", "specifies": "leader election", "safety": "`conjecture ~(asgn.pid(N) < asgn.pid(P) & trans.sent(asgn.pid(N),N))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_election_ring_repl.ivy#L157)); `conjecture ~(asgn.pid(P) < asgn.pid(Q) & N:node.t < P & P < Q & trans.sent(asgn.pid(P),N))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_election_ring_repl.ivy#L158)); `conjecture ~(asgn.pid(N) < asgn.pid(P) & N < P & P < Q & trans.sent(asgn.pid(N),Q))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_election_ring_repl.ivy#L159)); `conjecture ~(asgn.pid(Q) < asgn.pid(N) & N < P & P < Q & trans.sent(asgn.pid(Q),P))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_election_ring_repl.ivy#L160))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "191 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_election_ring_repl.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_election_ring_repl.ivy#L157", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "leader_election_ring_repl_err (doc/examples/leader_election_ring_repl_err.ivy)", "specifies": "leader election", "safety": "`conjecture ~(asgn.pid(N) < asgn.pid(P) & trans.sent(asgn.pid(N),N))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_election_ring_repl_err.ivy#L157)); `conjecture ~(asgn.pid(P) < asgn.pid(Q) & N:node.t < P & P < Q & trans.sent(asgn.pid(P),N))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_election_ring_repl_err.ivy#L158)); `conjecture ~(asgn.pid(N) < asgn.pid(P) & N < P & P < Q & trans.sent(asgn.pid(N),Q))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_election_ring_repl_err.ivy#L159)); `conjecture ~(asgn.pid(Q) < asgn.pid(N) & N < P & P < Q & trans.sent(asgn.pid(Q),P))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_election_ring_repl_err.ivy#L160))", "liveness": "no active temporal/progress declaration found in this file", "negative-test_warning": "the filename marks this as a bad/buggy/unsafe/error variant; displayed properties are attempted checks, not established guarantees", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "191 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_election_ring_repl_err.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_election_ring_repl_err.ivy#L157", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "leader_election_ring_repl_err2 (doc/examples/leader_election_ring_repl_err2.ivy)", "specifies": "leader election", "safety": "`conjecture ~(asgn.pid(N) < asgn.pid(P) & trans.sent(asgn.pid(N),N))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_election_ring_repl_err2.ivy#L157)); `conjecture ~(asgn.pid(P) < asgn.pid(Q) & N:node.t < P & P < Q & trans.sent(asgn.pid(P),N))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_election_ring_repl_err2.ivy#L158)); `conjecture ~(asgn.pid(N) < asgn.pid(P) & N < P & P < Q & trans.sent(asgn.pid(N),Q))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_election_ring_repl_err2.ivy#L159)); `conjecture ~(asgn.pid(Q) < asgn.pid(N) & N < P & P < Q & trans.sent(asgn.pid(Q),P))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_election_ring_repl_err2.ivy#L160))", "liveness": "no active temporal/progress declaration found in this file", "negative-test_warning": "the filename marks this as a bad/buggy/unsafe/error variant; displayed properties are attempted checks, not established guarantees", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "191 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_election_ring_repl_err2.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_election_ring_repl_err2.ivy#L157", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "leader_election_ring_udp (doc/examples/leader_election_ring_udp.ivy)", "specifies": "leader election", "safety": "`conjecture ~(asgn.pid(N) < asgn.pid(P) & trans.spec.sent(asgn.pid(N),N))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_election_ring_udp.ivy#L143)); `conjecture ~(asgn.pid(P) < asgn.pid(Q) & N:node.t < P & P < Q & trans.spec.sent(asgn.pid(P),N))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_election_ring_udp.ivy#L144)); `conjecture ~(asgn.pid(N) < asgn.pid(P) & N < P & P < Q & trans.spec.sent(asgn.pid(N),Q))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_election_ring_udp.ivy#L145)); `conjecture ~(asgn.pid(Q) < asgn.pid(N) & N < P & P < Q & trans.spec.sent(asgn.pid(Q),P))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_election_ring_udp.ivy#L146))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "175 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_election_ring_udp.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_election_ring_udp.ivy#L143", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "leader_election_ring_udp2 (doc/examples/leader_election_ring_udp2.ivy)", "specifies": "leader election", "safety": "`conjecture ~(asgn.pid(N) < asgn.pid(P) & trans.spec.sent(asgn.pid(N),N))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_election_ring_udp2.ivy#L143)); `conjecture ~(asgn.pid(P) < asgn.pid(Q) & N:node.t < P & P < Q & trans.spec.sent(asgn.pid(P),N))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_election_ring_udp2.ivy#L144)); `conjecture ~(asgn.pid(N) < asgn.pid(P) & N < P & P < Q & trans.spec.sent(asgn.pid(N),Q))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_election_ring_udp2.ivy#L145)); `conjecture ~(asgn.pid(Q) < asgn.pid(N) & N < P & P < Q & trans.spec.sent(asgn.pid(Q),P))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_election_ring_udp2.ivy#L146))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "177 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_election_ring_udp2.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_election_ring_udp2.ivy#L143", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "leader_election_ring_udp2_warn (doc/examples/leader_election_ring_udp2_warn.ivy)", "specifies": "leader election", "safety": "`conjecture ~(asgn.pid(N) < asgn.pid(P) & trans.spec.sent(asgn.pid(N),N))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_election_ring_udp2_warn.ivy#L143)); `conjecture ~(asgn.pid(P) < asgn.pid(Q) & N:node.t < P & P < Q & trans.spec.sent(asgn.pid(P),N))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_election_ring_udp2_warn.ivy#L144)); `conjecture ~(asgn.pid(N) < asgn.pid(P) & N < P & P < Q & trans.spec.sent(asgn.pid(N),Q))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_election_ring_udp2_warn.ivy#L145)); `conjecture ~(asgn.pid(Q) < asgn.pid(N) & N < P & P < Q & trans.spec.sent(asgn.pid(Q),P))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_election_ring_udp2_warn.ivy#L146))", "liveness": "no active temporal/progress declaration found in this file", "negative-test_warning": "the filename marks this as a bad/buggy/unsafe/error variant; displayed properties are attempted checks, not established guarantees", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "177 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_election_ring_udp2_warn.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_election_ring_udp2_warn.ivy#L143", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "leader_tutorial (doc/examples/leader_tutorial.ivy)", "specifies": "leader election", "safety": "`invariant ~(pid(N) < pid(P) & sent(pid(N),N))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_tutorial.ivy#L106))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "167 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_tutorial.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_tutorial.ivy#L106", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "leader_tutorial_liveness (doc/examples/leader_tutorial_liveness.ivy)", "specifies": "leader election", "safety": "`invariant ~(pid(N) < pid(P) & sent(pid(N),N))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_tutorial_liveness.ivy#L103))", "liveness": "`temporal property (forall P,N.` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_tutorial_liveness.ivy#L94)); `temporal property eventualy exists L. call elect(L)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_tutorial_liveness.ivy#L129)); `temporal axiom forall N. globally eventually call timer.timeout(N)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_tutorial_liveness.ivy#L161)); `temporal axiom forall P,N. (eventually net.sent(P,N)) -> (eventually call net.recv(N,P))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_tutorial_liveness.ivy#L162))", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "173 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_tutorial_liveness.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/leader_tutorial_liveness.ivy#L103", "has_liveness": true}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "lesstrivnet (doc/examples/lesstrivnet.ivy)", "specifies": "small asynchronous network", "safety": "`conjecture protocol.full -> spec.sent(protocol.contents)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/lesstrivnet.ivy#L42))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "48 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/lesstrivnet.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/lesstrivnet.ivy#L42", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "1queue_bounded (doc/examples/liveness/1queue_bounded.ivy)", "specifies": "queue concurrency/progress", "safety": "`invariant ~now` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/1queue_bounded.ivy#L31))", "liveness": "`temporal property [lpq] forall X. ((globally eventually recv_trying.now)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/1queue_bounded.ivy#L113)); `temporal property [nb] ((globally eventually recv_trying.now)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/1queue_bounded.ivy#L144))", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "169 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/1queue_bounded.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/1queue_bounded.ivy#L31", "has_liveness": true}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "1queuelive (doc/examples/liveness/1queuelive.ivy)", "specifies": "queue concurrency/progress", "safety": "`invariant ~now` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/1queuelive.ivy#L29))", "liveness": "`temporal property forall X. ((globally eventually receiving.now)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/1queuelive.ivy#L66))", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "86 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/1queuelive.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/1queuelive.ivy#L29", "has_liveness": true}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "1queuelive_mc1 (doc/examples/liveness/1queuelive_mc1.ivy)", "specifies": "queue concurrency/progress", "safety": "`invariant ~now` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/1queuelive_mc1.ivy#L25))", "liveness": "`temporal property forall X.` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/1queuelive_mc1.ivy#L80))", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun; model-checking variant indicated by filename", "size": "92 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/1queuelive_mc1.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/1queuelive_mc1.ivy#L25", "has_liveness": true}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "1queuelive_mc2 (doc/examples/liveness/1queuelive_mc2.ivy)", "specifies": "queue concurrency/progress", "safety": "`invariant ~now` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/1queuelive_mc2.ivy#L29))", "liveness": "`temporal property [lemma1] forall X.` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/1queuelive_mc2.ivy#L83)); `temporal property forall X.` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/1queuelive_mc2.ivy#L104))", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun; model-checking variant indicated by filename", "size": "120 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/1queuelive_mc2.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/1queuelive_mc2.ivy#L29", "has_liveness": true}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "1queuelive_prophecy3 (doc/examples/liveness/1queuelive_prophecy3.ivy)", "specifies": "queue concurrency/progress", "safety": "`invariant ~now` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/1queuelive_prophecy3.ivy#L22))", "liveness": "`temporal property forall X. ((globally eventually receiving.now)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/1queuelive_prophecy3.ivy#L85))", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "106 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/1queuelive_prophecy3.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/1queuelive_prophecy3.ivy#L22", "has_liveness": true}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "2queuelive (doc/examples/liveness/2queuelive.ivy)", "specifies": "queue concurrency/progress", "safety": "`invariant ~now` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/2queuelive.ivy#L31))", "liveness": "`temporal property [lpq] forall X. ((globally eventually trying.now)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/2queuelive.ivy#L106)); `temporal property [poll_lemma] forall X. (eventually q1.receiving.now & q1.receiving.value = X)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/2queuelive.ivy#L149)); `temporal property forall X. ((globally eventually q1.trying.now)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/2queuelive.ivy#L177))", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "199 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/2queuelive.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/2queuelive.ivy#L31", "has_liveness": true}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "2queuelive_bounded (doc/examples/liveness/2queuelive_bounded.ivy)", "specifies": "queue concurrency/progress", "safety": "`invariant ~now` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/2queuelive_bounded.ivy#L31))", "liveness": "`temporal property [lpq] forall X. ((globally eventually head < tail -> recv_trying.now)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/2queuelive_bounded.ivy#L126)); `temporal property [nb] ((globally eventually head < tail -> recv_trying.now)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/2queuelive_bounded.ivy#L144)); `temporal property [fpull] (globally eventually q2.head < q2.tail -> q2.recv_trying.now) &` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/2queuelive_bounded.ivy#L191)); `temporal property [poll_lemma] forall X. (eventually q1.receiving.now & q1.receiving.value = X)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/2queuelive_bounded.ivy#L212)); `temporal property [live] forall X.` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/2queuelive_bounded.ivy#L229))", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "252 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/2queuelive_bounded.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/2queuelive_bounded.ivy#L31", "has_liveness": true}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "2queuelive_noncomp (doc/examples/liveness/2queuelive_noncomp.ivy)", "specifies": "queue concurrency/progress", "safety": "`invariant ~now` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/2queuelive_noncomp.ivy#L27))", "liveness": "`temporal property forall X. ((globally eventually q1.trying.now)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/2queuelive_noncomp.ivy#L125))", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "159 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/2queuelive_noncomp.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/2queuelive_noncomp.ivy#L27", "has_liveness": true}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "liveness_refinement (doc/examples/liveness/liveness_refinement.ivy)", "specifies": "queue liveness refinement", "safety": "`invariant ~now` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/liveness_refinement.ivy#L30))", "liveness": "`temporal property [lemma1] (globally eventually trying1.now) &` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/liveness_refinement.ivy#L160)); `temporal property [gf1] (globally eventually trying1.now) ->` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/liveness_refinement.ivy#L248)); `temporal property [gf2] (globally eventually trying2.now) ->` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/liveness_refinement.ivy#L262)); `temporal property [lemma1] (globally eventually trying1.now) &` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/liveness_refinement.ivy#L282))", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "308 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/liveness_refinement.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/liveness_refinement.ivy#L30", "has_liveness": true}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "llqueue1 (doc/examples/liveness/llqueue1.ivy)", "specifies": "queue concurrency/progress", "safety": "`invariant ~now` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/llqueue1.ivy#L32))", "liveness": "`temporal property forall X. ((globally eventually receiving.now)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/llqueue1.ivy#L147))", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "196 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/llqueue1.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/llqueue1.ivy#L32", "has_liveness": true}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "llqueue2_bounded (doc/examples/liveness/llqueue2_bounded.ivy)", "specifies": "queue concurrency/progress", "safety": "`invariant ~now` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/llqueue2_bounded.ivy#L32))", "liveness": "`temporal property [lpq] forall X. ((globally eventually receiving.now)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/llqueue2_bounded.ivy#L191)); `temporal property [nb] ((globally eventually recv_trying.now)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/llqueue2_bounded.ivy#L222))", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "280 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/llqueue2_bounded.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/llqueue2_bounded.ivy#L32", "has_liveness": true}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "progress1 (doc/examples/liveness/progress1.ivy)", "specifies": "unbounded queue delivery progress", "safety": "`invariant ~now` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/progress1.ivy#L20))", "liveness": "`temporal property forall X.` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/progress1.ivy#L75))", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "93 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/progress1.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/progress1.ivy#L20", "has_liveness": true}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "progress2 (doc/examples/liveness/progress2.ivy)", "specifies": "unbounded queue delivery progress", "safety": "`invariant ~now` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/progress2.ivy#L20))", "liveness": "`temporal property forall X.` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/progress2.ivy#L77))", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "95 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/progress2.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/progress2.ivy#L20", "has_liveness": true}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "ticket_l2s_auto (doc/examples/liveness/ticket_l2s_auto.ivy)", "specifies": "ticket lock", "safety": "`invariant ~now` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/ticket_l2s_auto.ivy#L49))", "liveness": "`temporal property [lemma1] (forall T. globally (eventually scheduled.now & scheduled.value = T))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/ticket_l2s_auto.ivy#L159))", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "207 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/ticket_l2s_auto.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/ticket_l2s_auto.ivy#L49", "has_liveness": true}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "ticket_mc (doc/examples/liveness/ticket_mc.ivy)", "specifies": "ticket lock", "safety": "`invariant ~now` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/ticket_mc.ivy#L50))", "liveness": "`temporal property [lemma1] (forall T. globally (eventually scheduled.emits(T))) ->` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/ticket_mc.ivy#L164)); `temporal property [live] (forall T. globally (eventually scheduled.emits(T))) ->` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/ticket_mc.ivy#L171))", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun; model-checking variant indicated by filename", "size": "181 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/ticket_mc.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/ticket_mc.ivy#L50", "has_liveness": true}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "ticket_ranking (doc/examples/liveness/ticket_ranking.ivy)", "specifies": "ticket lock", "safety": "`invariant ~now` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/ticket_ranking.ivy#L49))", "liveness": "`temporal property [lemma1] (forall T. globally (eventually scheduled.now & scheduled.value = T))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/ticket_ranking.ivy#L159))", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "207 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/ticket_ranking.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/liveness/ticket_ranking.ivy#L49", "has_liveness": true}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "ip_spec (doc/examples/networking/ip_spec.ivy)", "specifies": "network protocol", "safety": "`invariant intf(H1,N1,A) & intf(H2,N2,A) ->  H1 = H2 & N1 = N2` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/networking/ip_spec.ivy#L140))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "301 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/networking/ip_spec.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/networking/ip_spec.ivy#L140", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "ip_spec1 (doc/examples/networking/ip_spec1.ivy)", "specifies": "network protocol", "safety": "`invariant intf(H1,N1,A) & intf(H2,N2,A) ->  H1 = H2 & N1 = N2` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/networking/ip_spec1.ivy#L138))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "310 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/networking/ip_spec1.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/networking/ip_spec1.ivy#L138", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "pingpong (doc/examples/pingpong.ivy)", "specifies": "ping-pong message exchange", "safety": "`invariant ball -> side = left` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/pingpong.ivy#L45))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "71 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/pingpong.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/pingpong.ivy#L45", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "pingpongclock (doc/examples/pingpongclock.ivy)", "specifies": "lock protocol", "safety": "`invariant ball -> (intf.side = intf.left & intf.time <= time)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/pingpongclock.ivy#L80))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "116 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/pingpongclock.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/pingpongclock.ivy#L80", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "byte_stream (doc/examples/quic/byte_stream.ivy)", "specifies": "QUIC transport protocol", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "19 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/quic/byte_stream.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/quic/byte_stream.ivy", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "quic_application (doc/examples/quic/quic_application.ivy)", "specifies": "QUIC transport protocol", "safety": "`require conn_requested(dst,src,dcid);  # [1] require ~connected(dcid) & ~connected(scid);  # [2]` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/quic/quic_application.ivy#L101)); `require ~connected(dcid) & ~connected(scid);  # [2] ...` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/quic/quic_application.ivy#L102)); `require ~(send_end > stream_app_data_end(dcid,s) & stream_app_data_finished(dcid,s));  # [4] var end := stream_app_data(dcid,s).end;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/quic/quic_application.ivy#L147))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "169 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/quic/quic_application.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/quic/quic_application.ivy#L101", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "quic_connection (doc/examples/quic/quic_connection.ivy)", "specifies": "QUIC transport protocol", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "38 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/quic/quic_connection.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/quic/quic_connection.ivy", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "quic_monitor (doc/examples/quic/quic_monitor.ivy)", "specifies": "QUIC transport protocol", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "57 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/quic/quic_monitor.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/quic/quic_monitor.ivy", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "quic_packet (doc/examples/quic/quic_packet.ivy)", "specifies": "QUIC transport protocol", "safety": "`require pkt.token.end ~= 0 -> (pkt.ptype = quic_packet_type.initial);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/quic/quic_packet.ivy#L270)); `require pkt.ptype ~= quic_packet_type.zero_rtt;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/quic/quic_packet.ivy#L274)); `require connected(dcid) |` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/quic/quic_packet.ivy#L297))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "586 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/quic/quic_packet.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/quic/quic_packet.ivy#L270", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "quic_protection (doc/examples/quic/quic_protection.ivy)", "specifies": "QUIC transport protocol", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "403 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/quic/quic_protection.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/quic/quic_protection.ivy", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "quic_security (doc/examples/quic/quic_security.ivy)", "specifies": "QUIC transport protocol", "safety": "`require crypto_data_present(scid,e,cpos) -> crypto_data(scid,e).value(cpos) = byte;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/quic/quic_security.ivy#L191)); `require connected(dcid) & connected_to(dcid) = scid;  # [1] require lo < hi & lo = crypto_pos(dcid,e) & hi <= crypto_length(scid,e);  # [2]` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/quic/quic_security.ivy#L232)); `require lo < hi & lo = crypto_pos(dcid,e) & hi <= crypto_length(scid,e);  # [2] ...` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/quic/quic_security.ivy#L233))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "267 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/quic/quic_security.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/quic/quic_security.ivy#L191", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "quic_server_test_connection_close (doc/examples/quic/quic_server_test_connection_close.ivy)", "specifies": "QUIC transport protocol", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "8 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/quic/quic_server_test_connection_close.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/quic/quic_server_test_connection_close.ivy", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "quic_server_test_reset_stream (doc/examples/quic/quic_server_test_reset_stream.ivy)", "specifies": "QUIC transport protocol", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "6 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/quic/quic_server_test_reset_stream.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/quic/quic_server_test_reset_stream.ivy", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "quic_server_test_stream (doc/examples/quic/quic_server_test_stream.ivy)", "specifies": "QUIC transport protocol", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "6 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/quic/quic_server_test_stream.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/quic/quic_server_test_stream.ivy", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "quic_stream (doc/examples/quic/quic_stream.ivy)", "specifies": "QUIC transport protocol", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "20 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/quic/quic_stream.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/quic/quic_stream.ivy", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "tls_protocol (doc/examples/quic/tls_protocol.ivy)", "specifies": "QUIC transport protocol", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "49 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/quic/tls_protocol.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/quic/tls_protocol.ivy", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "tls_record (doc/examples/quic/tls_record.ivy)", "specifies": "QUIC transport protocol", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "244 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/quic/tls_record.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/quic/tls_record.ivy", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "proto (doc/examples/sht/proto.ivy)", "specifies": "sharded hash table", "safety": "`conjecture impl.dm.map(K,me) -> hash.hash(K) = ref.map(K)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/sht/proto.ivy#L133)); `conjecture impl.dm.map(K,me) & X ~= me -> ~proto.impl.dm(X).map(K,X)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/sht/proto.ivy#L136)); `conjecture impl.dm.map(K,me) -> ~(trans.delegated(X,S) & key.iter.between(shard.lo(S),K,shard.hi(S)))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/sht/proto.ivy#L139)); `conjecture trans.delegated(X,S) & key.iter.between(shard.lo(S),K,shard.hi(S))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/sht/proto.ivy#L142)); `conjecture trans.requested(D,R) & L = req.rtxid(R)->` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/sht/proto.ivy#L148)); `conjecture trans.replied(D,R) & L = req.rtxid(R)->` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/sht/proto.ivy#L155)); `conjecture trans.requested(D,R) -> ref.generated(req.rtxid(R)) & ~ref.committed(req.rtxid(R))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/sht/proto.ivy#L162)); `conjecture trans.replied(D,R) -> ref.generated(req.rtxid(R)) & ref.committed(req.rtxid(R))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/sht/proto.ivy#L166)); `conjecture trans.requested(D1,R1) & trans.requested(D2,R2) & req.rtxid(R1) = req.rtxid(R2)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/sht/proto.ivy#L170)); `conjecture trans.replied(D1,R1) & trans.replied(D2,R2) & req.rtxid(R1) = req.rtxid(R2)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/sht/proto.ivy#L175)); `conjecture trans.delegated(X,S) & key.iter.between(shard.lo(S),K,shard.hi(S)) -> shard.value(S,K) = ref.map(K)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/sht/proto.ivy#L180)); `conjecture trans.delegated(D,S) -> shard.valid(S)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/sht/proto.ivy#L184))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "188 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/sht/proto.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/sht/proto.ivy#L133", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "reference (doc/examples/sht/reference.ivy)", "specifies": "sharded hash table", "safety": "`conjecture committed(T) -> generated(T)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/sht/reference.ivy#L98))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "100 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/sht/reference.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/sht/reference.ivy#L98", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "shard (doc/examples/sht/shard.ivy)", "specifies": "sharded key-value storage", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "29 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/sht/shard.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/sht/shard.ivy", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "sht (doc/examples/sht/sht.ivy)", "specifies": "sharded hash table", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "52 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/sht/sht.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/sht/sht.ivy", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "trans (doc/examples/sht/trans.ivy)", "specifies": "sharded hash table", "safety": "`conjecture mq(D).contents(M) & impl(D).recv_seq(me) <= net_msg.num(M)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/sht/trans.ivy#L195)); `conjecture mq(D).contents(M) & impl(D).recv_seq(me) <= net_msg.num(M)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/sht/trans.ivy#L201)); `conjecture mq(D).contents(M) & impl(D).recv_seq(me) <= net_msg.num(M)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/sht/trans.ivy#L207)); `conjecture impl(S1).mq(D).contents(M1) & impl(D).recv_seq(S1) <= net_msg.num(M1)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/sht/trans.ivy#L212)); `conjecture impl(S1).mq(D).contents(M1) & impl(D).recv_seq(S1) <= net_msg.num(M1)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/sht/trans.ivy#L220)); `conjecture impl(S1).mq(D).contents(M1) & impl(D).recv_seq(S1) <= net_msg.num(M1)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/sht/trans.ivy#L228)); `conjecture mq(D).contents(M) -> ~(send_seq(D) <= net_msg.num(M))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/sht/trans.ivy#L236)); `conjecture mq(D).contents(M1) & mq(D).contents(M2) & M1 ~= M2` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/sht/trans.ivy#L240)); `conjecture lower.spec.sent(M,D) & net_msg.src(M) = me` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/sht/trans.ivy#L246)); `conjecture lower.spec.sent(M,D) & net_msg.src(M) = S` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/sht/trans.ivy#L255)); `conjecture lower.spec.sent(M,D) & net_msg.src(M) = S` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/sht/trans.ivy#L261)); `conjecture lower.spec.sent(M,D) & net_msg.src(M) = me & net_msg.mty(M) ~= ack_t` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/sht/trans.ivy#L266)); `conjecture mq(D).contents(M) -> net_msg.src(M) = me & net_msg.mty(M) ~= ack_t` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/sht/trans.ivy#L271))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "279 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/sht/trans.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/sht/trans.ivy#L195", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "chain (doc/examples/testing/chain.ivy)", "specifies": "chain-replicated database", "safety": "`assert 0 <= tx & tx < next;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/chain.ivy#L43)); `assert ~committed(tx);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/chain.ivy#L44)); `assert committed(tx);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/chain.ivy#L51))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "173 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/chain.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/chain.ivy#L43", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "chain2 (doc/examples/testing/chain2.ivy)", "specifies": "chain-replicated database", "safety": "`assert 0 <= tx & tx < next;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/chain2.ivy#L46)); `assert ~serialized(tx);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/chain2.ivy#L47)); `assert 0 <= tx & tx < next;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/chain2.ivy#L53))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "184 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/chain2.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/chain2.ivy#L46", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "chain3 (doc/examples/testing/chain3.ivy)", "specifies": "chain-replicated database", "safety": "`assert 0 <= tx & tx < next;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/chain3.ivy#L46)); `assert ~serialized(tx);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/chain3.ivy#L47)); `assert 0 <= tx & tx < next;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/chain3.ivy#L53))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "224 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/chain3.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/chain3.ivy#L46", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "interference (doc/examples/testing/interference.ivy)", "specifies": "concurrent interference", "safety": "`assert side = left;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/interference.ivy#L15)); `assert side = right;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/interference.ivy#L20))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "64 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/interference.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/interference.ivy#L15", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "leader_election_ring (doc/examples/testing/leader_election_ring.ivy)", "specifies": "leader election", "safety": "`assert asgn.pid(v) >= asgn.pid(X)   # only the max pid can be elected` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/leader_election_ring.ivy#L81))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "114 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/leader_election_ring.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/leader_election_ring.ivy#L81", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "pingpong (doc/examples/testing/pingpong.ivy)", "specifies": "ping-pong message exchange", "safety": "`assert side = left;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/pingpong.ivy#L35)); `assert side = right;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/pingpong.ivy#L42))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "128 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/pingpong.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/pingpong.ivy#L35", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "pingpong_bad (doc/examples/testing/pingpong_bad.ivy)", "specifies": "ping-pong message exchange", "safety": "`conjecture left_player.ball -> spec.side = left` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/pingpong_bad.ivy#L38)); `conjecture right_player.ball -> spec.side = right` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/pingpong_bad.ivy#L56))", "liveness": "no active temporal/progress declaration found in this file", "negative-test_warning": "the filename marks this as a bad/buggy/unsafe/error variant; displayed properties are attempted checks, not established guarantees", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "64 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/pingpong_bad.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/pingpong_bad.ivy#L38", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "pingpong_ex (doc/examples/testing/pingpong_ex.ivy)", "specifies": "ping-pong message exchange", "safety": "`assert side = left & ...;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/pingpong_ex.ivy#L29)); `assert side = right & ...;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/pingpong_ex.ivy#L36))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "114 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/pingpong_ex.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/pingpong_ex.ivy#L29", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "pingpong_soln (doc/examples/testing/pingpong_soln.ivy)", "specifies": "ping-pong message exchange", "safety": "`assert side = left & (val/2)*2 = val;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/pingpong_soln.ivy#L26)); `assert side = right & (val/2)*2+1 = val;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/pingpong_soln.ivy#L33))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "114 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/pingpong_soln.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/pingpong_soln.ivy#L26", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "repstore1 (doc/examples/testing/repstore1.ivy)", "specifies": "replicated store", "safety": "`assert 0 <= tx & tx < next;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/repstore1.ivy#L187)); `assert ~committed(tx);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/repstore1.ivy#L188)); `assert committed(tx);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/repstore1.ivy#L198))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "388 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/repstore1.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/repstore1.ivy#L187", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "repstore2 (doc/examples/testing/repstore2.ivy)", "specifies": "replicated store", "safety": "`assert 0 <= tx & tx < next;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/repstore2.ivy#L151)); `assert ~committed(tx);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/repstore2.ivy#L152)); `assert committed(tx);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/repstore2.ivy#L159))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "546 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/repstore2.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/repstore2.ivy#L151", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "repstore2_orig (doc/examples/testing/repstore2_orig.ivy)", "specifies": "replicated store", "safety": "`assert 0 <= tx & tx < next;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/repstore2_orig.ivy#L145)); `assert ~committed(tx);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/repstore2_orig.ivy#L146)); `assert committed(tx);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/repstore2_orig.ivy#L153))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "549 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/repstore2_orig.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/repstore2_orig.ivy#L145", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "repstore2bug (doc/examples/testing/repstore2bug.ivy)", "specifies": "replicated store", "safety": "`assert 0 <= tx & tx < next;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/repstore2bug.ivy#L122)); `assert ~committed(tx);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/repstore2bug.ivy#L123)); `assert committed(tx);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/repstore2bug.ivy#L130))", "liveness": "no active temporal/progress declaration found in this file", "negative-test_warning": "the filename marks this as a bad/buggy/unsafe/error variant; displayed properties are attempted checks, not established guarantees", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "531 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/repstore2bug.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/repstore2bug.ivy#L122", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "repstore2ex (doc/examples/testing/repstore2ex.ivy)", "specifies": "replicated store", "safety": "`assert 0 <= tx & tx < next;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/repstore2ex.ivy#L127)); `assert ~committed(tx);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/repstore2ex.ivy#L128)); `assert committed(tx);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/repstore2ex.ivy#L135))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "539 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/repstore2ex.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/repstore2ex.ivy#L127", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "repstore3 (doc/examples/testing/repstore3.ivy)", "specifies": "replicated store", "safety": "`assert 0 <= tx & tx < next;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/repstore3.ivy#L116)); `assert ~committed(tx);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/repstore3.ivy#L117)); `assert committed(tx);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/repstore3.ivy#L124))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "466 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/repstore3.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/repstore3.ivy#L116", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "repstore3_soln (doc/examples/testing/repstore3_soln.ivy)", "specifies": "replicated store", "safety": "`assert 0 <= tx & tx < next;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/repstore3_soln.ivy#L114)); `assert ~committed(tx);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/repstore3_soln.ivy#L115)); `assert committed(tx);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/repstore3_soln.ivy#L122))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "532 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/repstore3_soln.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/repstore3_soln.ivy#L114", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "repstore_variant (doc/examples/testing/repstore_variant.ivy)", "specifies": "replicated store", "safety": "`assert 0 <= tx & tx < next;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/repstore_variant.ivy#L100)); `assert ~serialized(tx);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/repstore_variant.ivy#L101)); `assert 0 <= tx & tx < next;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/repstore_variant.ivy#L107))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "249 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/repstore_variant.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/repstore_variant.ivy#L100", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "token_ring (doc/examples/testing/token_ring.ivy)", "specifies": "ring protocol", "safety": "`assert ~lock(X);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/token_ring.ivy#L65)); `assert lock(v);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/token_ring.ivy#L70))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "112 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/token_ring.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/token_ring.ivy#L65", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "token_ring_buggy (doc/examples/testing/token_ring_buggy.ivy)", "specifies": "ring protocol", "safety": "`assert ~sent(dst,pkt);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/token_ring_buggy.ivy#L83)); `assert sent(dst,pkt);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/token_ring_buggy.ivy#L88)); `assert ~lock(X);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/token_ring_buggy.ivy#L210))", "liveness": "no active temporal/progress declaration found in this file", "negative-test_warning": "the filename marks this as a bad/buggy/unsafe/error variant; displayed properties are attempted checks, not established guarantees", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "276 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/token_ring_buggy.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/token_ring_buggy.ivy#L83", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "trivnet (doc/examples/testing/trivnet.ivy)", "specifies": "small asynchronous network", "safety": "`assert sent(x)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/trivnet.ivy#L22))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "37 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/trivnet.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/trivnet.ivy#L22", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "trivnet2 (doc/examples/testing/trivnet2.ivy)", "specifies": "small asynchronous network", "safety": "`assert sent(x)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/trivnet2.ivy#L22))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "50 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/trivnet2.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/trivnet2.ivy#L22", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "trivnet3 (doc/examples/testing/trivnet3.ivy)", "specifies": "small asynchronous network", "safety": "`assert sent(x)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/trivnet3.ivy#L22))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "56 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/trivnet3.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/testing/trivnet3.ivy#L22", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "toy_consensus (doc/examples/toy_consensus.ivy)", "specifies": "consensus/agreement protocol", "safety": "`invariant [majorities_intersect] (majority(S) & majority(T)) -> exists N. member(N,S) & member(N,T)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/toy_consensus.ivy#L32))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "271 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/toy_consensus.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/toy_consensus.ivy#L32", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "trivnet (doc/examples/trivnet.ivy)", "specifies": "small asynchronous network", "safety": "`require sent(x)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/trivnet.ivy#L21))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "34 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/trivnet.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/trivnet.ivy#L21", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "trivnet2 (doc/examples/trivnet2.ivy)", "specifies": "small asynchronous network", "safety": "`require sent(x)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/trivnet2.ivy#L20))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "51 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/trivnet2.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/trivnet2.ivy#L20", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "window (doc/examples/window.ivy)", "specifies": "sliding-window protocol", "safety": "`invariant begin <= end` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/window.ivy#L189))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "289 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/window.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/window.ivy#L189", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "window_adt (doc/examples/window_adt.ivy)", "specifies": "sliding-window protocol", "safety": "`invariant i <= j & j <= bound` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/window_adt.ivy#L349))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "403 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/window_adt.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/doc/examples/window_adt.ivy#L349", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "abp (examples/ivy/abp.ivy)", "specifies": "alternating-bit message delivery", "safety": "`assert ~pending & v ~= state;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/abp.ivy#L15)); `assert pending & v = state;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/abp.ivy#L22))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "115 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/abp.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/abp.ivy#L15", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "abp2 (examples/ivy/abp2/abp2.ivy)", "specifies": "alternating-bit message delivery", "safety": "`assert vr = tape(round.val);      # correctness property!` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/abp2/abp2.ivy#L89))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "162 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/abp2/abp2.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/abp2/abp2.ivy#L89", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "abp2_proof (examples/ivy/abp2/abp2_proof.ivy)", "specifies": "alternating-bit message delivery", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "80 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/abp2/abp2_proof.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/abp2/abp2_proof.ivy", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "bakery (examples/ivy/bakery.ivy)", "specifies": "Bakery mutual exclusion", "safety": "`conjecture (pc7(I) & pc7(J) & public_n(I,X) & public_n(J, X)) -> I = J # the safety property` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/bakery.ivy#L294))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "301 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/bakery.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/bakery.ivy#L294", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "chord2s (examples/ivy/chord2s.ivy)", "specifies": "Chord ring maintenance", "safety": "`invariant (a(X) | p.map(Y, X) | ~s1.map(X, Y))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/chord2s.ivy#L230))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "254 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/chord2s.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/chord2s.ivy#L230", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "chord2s_demo (examples/ivy/chord2s_demo.ivy)", "specifies": "Chord ring maintenance", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "241 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/chord2s_demo.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/chord2s_demo.ivy", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "chord2sbd (examples/ivy/chord2sbd.ivy)", "specifies": "Chord ring maintenance", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "251 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/chord2sbd.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/chord2sbd.ivy", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "client_server (examples/ivy/client_server.ivy)", "specifies": "client/server request protocol", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "33 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/client_server.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/client_server.ivy", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "client_server_fp (examples/ivy/client_server_fp.ivy)", "specifies": "client/server request protocol", "safety": "`conjecture (X = Z | ~c(X,Y) | ~c(Z,Y))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/client_server_fp.ivy#L37))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "37 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/client_server_fp.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/client_server_fp.ivy#L37", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "client_server_sorted (examples/ivy/client_server_sorted.ivy)", "specifies": "client/server request protocol", "safety": "`conjecture (X = Z | ~c(X,Y) | ~c(Z,Y))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/client_server_sorted.ivy#L39))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "39 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/client_server_sorted.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/client_server_sorted.ivy#L39", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "flash (examples/ivy/flash.ivy)", "specifies": "FLASH cache coherence", "safety": "`assert reached ->` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/flash.ivy#L477))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "537 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/flash.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/flash.ivy#L477", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "flash2 (examples/ivy/flash2.ivy)", "specifies": "FLASH cache coherence", "safety": "`conjecture [coherent] ~(cache(X).state_ = exclusive & cache(X).wait = none &` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/flash2.ivy#L477))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "642 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/flash2.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/flash2.ivy#L477", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "flash3 (examples/ivy/flash3.ivy)", "specifies": "FLASH cache coherence", "safety": "`invariant [coherent] cache(X).state = exclusive -> X = real_owner` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/flash3.ivy#L477))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "493 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/flash3.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/flash3.ivy#L477", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "gc_abs (examples/ivy/gc_abs.ivy)", "specifies": "garbage collector concurrency", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "28 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/gc_abs.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/gc_abs.ivy", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "gc_abs2 (examples/ivy/gc_abs2.ivy)", "specifies": "garbage collector concurrency", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "31 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/gc_abs2.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/gc_abs2.ivy", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "gc_copy (examples/ivy/gc_copy.ivy)", "specifies": "garbage collector concurrency", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "240 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/gc_copy.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/gc_copy.ivy", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "gc_copy.save (examples/ivy/gc_copy.save.ivy)", "specifies": "garbage collector concurrency", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "302 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/gc_copy.save.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/gc_copy.save.ivy", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "gc_copy_oded (examples/ivy/gc_copy_oded.ivy)", "specifies": "garbage collector concurrency", "safety": "`conjecture repr(hroot, mroot)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/gc_copy_oded.ivy#L257)); `conjecture taddr(mroot)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/gc_copy_oded.ivy#L258)); `conjecture tlo <= tnext & tnext <= talloc` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/gc_copy_oded.ivy#L259)); `conjecture tnext < thi` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/gc_copy_oded.ivy#L260)); `conjecture tlo <= talloc & talloc <= thi` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/gc_copy_oded.ivy#L261)); `conjecture mroot = tlo` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/gc_copy_oded.ivy#L262)); `conjecture repr(O1, A) & repr(O2, A) -> O1 = O2` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/gc_copy_oded.ivy#L264)); `conjecture repr(O, A) -> ((faddr(A) & ~copied_to(A, X)) | (tlo <= A & A < talloc))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/gc_copy_oded.ivy#L265)); `conjecture (repr(O1,A1) & h0(O1,O2) -> dom[m0](A1))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/gc_copy_oded.ivy#L268)); `conjecture (repr(O1, A1) & h0(O1, O2) & repr(O2, A2) & m0(A1, A3)) -> (A2 = A3 | copied_to(A3, A2))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/gc_copy_oded.ivy#L270)); `conjecture (taddr(A1) & m0(A1,A2) & A1 < tnext) -> (taddr(A2) & A2 < talloc)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/gc_copy_oded.ivy#L271)); `conjecture (tnext <= A1 & A1 < talloc & m0(A1,A2)) -> faddr(A2)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/gc_copy_oded.ivy#L272)); `conjecture (repr(O1, A1) & repr(O2, A2) & m0(A1, A2)) -> h0(O1, O2)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/gc_copy_oded.ivy#L273)); `conjecture (faddr(A1) & m0(A1,A2)) -> faddr(A2)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/gc_copy_oded.ivy#L274)); `conjecture (repr(O1, A1) & repr(O2, A3) & m0(A1, A2) & copied_to(A2, A3)) -> h0(O1, O2)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/gc_copy_oded.ivy#L275)); `conjecture (repr(O1,A1) & h0(O1,O2) & m0(A1,A2) & taddr(A2)) -> repr(O2,A2)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/gc_copy_oded.ivy#L284)); `conjecture (repr(O1,A1) & h0(O1,O2) & m0(A1,A2) & copied_to(A2, A3)) -> repr(O2,A3)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/gc_copy_oded.ivy#L285)); `conjecture ~(m0(A1,A2) & faddr(A1) & ~faddr(A2))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/gc_copy_oded.ivy#L286)); `conjecture copied_to(A1,A2) -> faddr(A1)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/gc_copy_oded.ivy#L288)); `conjecture copied_to(A1,A2) -> tlo <= A2` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/gc_copy_oded.ivy#L289)); `conjecture (copied_to(A,A1) & copied_to(A,A2)) -> A1 = A2` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/gc_copy_oded.ivy#L291)); `conjecture (copied_to(A1,A) & copied_to(A2,A)) -> A1 = A2` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/gc_copy_oded.ivy#L292))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "305 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/gc_copy_oded.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/gc_copy_oded.ivy#L257", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "gc_temp_abs (examples/ivy/gc_temp_abs.ivy)", "specifies": "garbage collector concurrency", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "34 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/gc_temp_abs.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/gc_temp_abs.ivy", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "gc_test (examples/ivy/gc_test.ivy)", "specifies": "garbage collector concurrency", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "240 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/gc_test.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/gc_test.ivy", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "toy_lock (examples/ivy/ironfleet_toy_lock/toy_lock.ivy)", "specifies": "lock protocol", "safety": "`conjecture l.sent(P) -> an.transfer(af.ep(P),af.dst(P))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/ironfleet_toy_lock/toy_lock.ivy#L130)); `conjecture locked(E, N1) & locked(E, N2) -> N1 = N2` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/ironfleet_toy_lock/toy_lock.ivy#L237)); `conjecture an.transfer(E, N1) & an.transfer(E, N2) -> N1 = N2` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/ironfleet_toy_lock/toy_lock.ivy#L240)); `conjecture locked(E, N) -> (E <= ep(N))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/ironfleet_toy_lock/toy_lock.ivy#L243)); `conjecture held(N) & N ~= M -> ~(ep(N) <= ep(M))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/ironfleet_toy_lock/toy_lock.ivy#L246)); `conjecture held(N) & an.transfer(E, M) -> (E <= ep(N))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/ironfleet_toy_lock/toy_lock.ivy#L249)); `conjecture an.transfer(E, N) & ~(E <= ep(N)) -> ~(E <= ep(M))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/ironfleet_toy_lock/toy_lock.ivy#L252)); `conjecture an.transfer(E, N) & ~(E <= ep(N)) & an.transfer(F, M) -> (F <= E)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/ironfleet_toy_lock/toy_lock.ivy#L255))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "321 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/ironfleet_toy_lock/toy_lock.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/ironfleet_toy_lock/toy_lock.ivy#L130", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "ironfleet_toy_lock_refined (examples/ivy/ironfleet_toy_lock_refined.ivy)", "specifies": "lock protocol", "safety": "`conjecture l.sent(P) -> an.transfer(f.ep(P),f.dst(P))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/ironfleet_toy_lock_refined.ivy#L113)); `conjecture locked(E, N1) & locked(E, N2) -> N1 = N2` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/ironfleet_toy_lock_refined.ivy#L220)); `conjecture an.transfer(E, N1) & an.transfer(E, N2) -> N1 = N2` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/ironfleet_toy_lock_refined.ivy#L223)); `conjecture locked(E, N) -> (E <= ep(N))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/ironfleet_toy_lock_refined.ivy#L226)); `conjecture held(N) & N ~= M -> ~(ep(N) <= ep(M))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/ironfleet_toy_lock_refined.ivy#L229)); `conjecture held(N) & an.transfer(E, M) -> (E <= ep(N))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/ironfleet_toy_lock_refined.ivy#L232)); `conjecture an.transfer(E, N) & ~(E <= ep(N)) -> ~(E <= ep(M))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/ironfleet_toy_lock_refined.ivy#L235)); `conjecture an.transfer(E, N) & ~(E <= ep(N)) & an.transfer(F, M) -> (F <= E)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/ironfleet_toy_lock_refined.ivy#L238))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "287 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/ironfleet_toy_lock_refined.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/ironfleet_toy_lock_refined.ivy#L113", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "learning (examples/ivy/learning.ivy)", "specifies": "learning network switch", "safety": "`conjecture ~(route(S).dom(V0) & ~route(S).tc(V0, S))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/learning.ivy#L115)); `conjecture ~route(V0).dom(V0)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/learning.ivy#L116)); `conjecture ~(pending(P, V0, V1) & dst(P) = V0)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/learning.ivy#L117)); `conjecture ~(pending(P, V0, V1) & ~route(src(P)).dom(V0) & V0 ~= src(P))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/learning.ivy#L118)); `conjecture ~(route(S).tc(V0, V1) & ~V0 = V1 & ~route(S).dom(V0))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/learning.ivy#L119)); `conjecture ~(route(S).tc(V0, V1) & ~V0 = V1 & S ~= V1 & ~route(S).dom(V1)) # TODO: needed?` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/learning.ivy#L120)); `conjecture ~(~V0 = S & route(S).tc(S, V0))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/learning.ivy#L121))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "124 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/learning.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/learning.ivy#L115", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "learning_sorted_e (examples/ivy/learning_sorted_e.ivy)", "specifies": "learning network switch", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "132 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/learning_sorted_e.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/learning_sorted_e.ivy", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "learning_sorted_non_epr (examples/ivy/learning_sorted_non_epr.ivy)", "specifies": "learning network switch", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "135 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/learning_sorted_non_epr.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/learning_sorted_non_epr.ivy", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "learning_switch (examples/ivy/learning_switch.ivy)", "specifies": "learning network switch", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "77 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/learning_switch.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/learning_switch.ivy", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "learning_un (examples/ivy/learning_un.ivy)", "specifies": "learning network switch", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "98 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/learning_un.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/learning_un.ivy", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "learning_un_e (examples/ivy/learning_un_e.ivy)", "specifies": "learning network switch", "safety": "`conjecture ~(e(S, V0) & ~rp(S, V0, S))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/learning_un_e.ivy#L117)); `conjecture e(V0,V0)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/learning_un_e.ivy#L118)); `conjecture ~(pending(P, V0, V1) & dst(P,D) & D = V0)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/learning_un_e.ivy#L119)); `conjecture ~(pending(P, V0, V1) & src(P,S) & ~e(S, V0))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/learning_un_e.ivy#L120)); `conjecture ~(~V0 = S & rp(S, S, V0))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/learning_un_e.ivy#L122))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "125 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/learning_un_e.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/learning_un_e.ivy#L117", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "learning_un_ins (examples/ivy/learning_un_ins.ivy)", "specifies": "learning network switch", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "103 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/learning_un_ins.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/learning_un_ins.ivy", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "learning_with_count (examples/ivy/learning_with_count.ivy)", "specifies": "learning network switch", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "186 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/learning_with_count.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/learning_with_count.ivy", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "learning_withcount (examples/ivy/learning_withcount.ivy)", "specifies": "learning network switch", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "177 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/learning_withcount.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/learning_withcount.ivy", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "spanning_tree (examples/ivy/spanning_tree.ivy)", "specifies": "spanning-tree protocol", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "45 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/spanning_tree.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/spanning_tree.ivy", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "toy_consensus (examples/ivy/toy_consensus.ivy)", "specifies": "consensus/agreement protocol", "safety": "`conjecture decision(V1) & decision(V2) -> V1 = V2` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/toy_consensus.ivy#L31)); `conjecture vote(N,V1) & vote(N,V2) -> V1 = V2` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/toy_consensus.ivy#L34)); `conjecture decision(V) -> exists Q:quorum. forall N:node. member(N, Q) -> vote(N,V)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/toy_consensus.ivy#L35))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "39 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/toy_consensus.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/toy_consensus.ivy#L31", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "toy_consensus2 (examples/ivy/toy_consensus2.ivy)", "specifies": "consensus/agreement protocol", "safety": "`conjecture decision(V1) & decision(V2) -> V1 = V2` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/toy_consensus2.ivy#L47)); `conjecture vote(N,V1) & vote(N,V2) -> V1 = V2` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/toy_consensus2.ivy#L50)); `conjecture decision(V) -> exists Q:quorum. nodeset.majority(Q) &` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/toy_consensus2.ivy#L51))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "69 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/toy_consensus2.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/toy_consensus2.ivy#L47", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "toy_lock (examples/ivy/toy_lock_udp/toy_lock.ivy)", "specifies": "lock protocol", "safety": "`conjecture l.sent(D,P) & get_tg(P) = xfer -> an.transfer(get_ep(P),D)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/toy_lock_udp/toy_lock.ivy#L220)); `conjecture pend(S) & P = pend_pkt(S) & succ(S,D) -> get_tg(P) = xfer & an.transfer(get_ep(P),D)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/toy_lock_udp/toy_lock.ivy#L221)); `conjecture an.transfer(E, N1) & an.transfer(E, N2) -> N1 = N2` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/toy_lock_udp/toy_lock.ivy#L339)); `conjecture held(N) & N ~= M -> ~(ep(N) <= ep(M))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/toy_lock_udp/toy_lock.ivy#L345)); `conjecture held(N) & an.transfer(E, M) -> (E <= ep(N))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/toy_lock_udp/toy_lock.ivy#L348)); `conjecture an.transfer(E, N) & ~(E <= ep(N)) -> ~(E <= ep(M))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/toy_lock_udp/toy_lock.ivy#L351)); `conjecture an.transfer(E, N) & ~(E <= ep(N)) & an.transfer(F, M) -> (F <= E)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/toy_lock_udp/toy_lock.ivy#L354))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "433 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/toy_lock_udp/toy_lock.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/ivy/toy_lock_udp/toy_lock.ivy#L220", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "alternating_bit_protocol (examples/liveness/alternating_bit_protocol.ivy)", "specifies": "alternating-bit message delivery", "safety": "`invariant le(X, Y) & le(Y, Z) -> le(X, Z)  # Transitivity` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/liveness/alternating_bit_protocol.ivy#L74))", "liveness": "`temporal property [liveness] ( ((exists I. ~ globally (sender_array(I  ) ~= bot -> (eventually receiver_array(I  ) ~= bot))) ->` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/liveness/alternating_bit_protocol.ivy#L319))", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "486 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/liveness/alternating_bit_protocol.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/liveness/alternating_bit_protocol.ivy#L74", "has_liveness": true}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "hybrid_reliable_broadcast_cisa (examples/liveness/hybrid_reliable_broadcast_cisa.ivy)", "specifies": "reliable broadcast", "safety": "`invariant (exists N. obedient(N) & accept(N)) -> (exists M. obedient(M) & rcv_init(M)) # unforgebility` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/liveness/hybrid_reliable_broadcast_cisa.ivy#L211))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "433 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/liveness/hybrid_reliable_broadcast_cisa.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/liveness/hybrid_reliable_broadcast_cisa.ivy#L211", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "split_queue_2_new (examples/liveness/split_queue_2_new.ivy)", "specifies": "queue concurrency/progress", "safety": "`invariant ~now` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/liveness/split_queue_2_new.ivy#L16))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "189 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/liveness/split_queue_2_new.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/liveness/split_queue_2_new.ivy#L16", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "ticket (examples/liveness/ticket.ivy)", "specifies": "ticket lock", "safety": "`invariant pc1(T) | pc2(T) | pc3(T)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/liveness/ticket.ivy#L130))", "liveness": "`temporal property [nonstarvation] ( ((exists T0. ~(globally ~(pc2(T0) & globally ~pc3(T0)))) -> ~(globally ~(pc2(t0) & globally ~pc3(t0))))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/liveness/ticket.ivy#L157))", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "243 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/liveness/ticket.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/liveness/ticket.ivy#L130", "has_liveness": true}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "ticket_nested (examples/liveness/ticket_nested.ivy)", "specifies": "ticket lock", "safety": "`invariant [safety] pc3(T1) & pc3(T2) -> T1 = T2` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/liveness/ticket_nested.ivy#L142))", "liveness": "`temporal property [nonstarvation] ( ((exists T0. ~(globally ~(pc2(T0) & globally ~pc3(T0)))) -> ~(globally ~(pc2(sk0) & globally ~pc3(sk0)))) &` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/liveness/ticket_nested.ivy#L169))", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "294 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/liveness/ticket_nested.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/liveness/ticket_nested.ivy#L142", "has_liveness": true}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "tlb (examples/liveness/tlb.ivy)", "specifies": "TLB coherence", "safety": "`invariant pc_i3(P) | pc_i4(P) | pc_i5(P) | pc_i6(P) | pc_i7(P) | pc_i8(P) | pc_i9(P) | pc_i11(P) | pc_i12(P) | pc_i14(P) -> plock(writepmap(P))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/liveness/tlb.ivy#L547))", "liveness": "`temporal property [nonstarvation] ( ((exists P. ~ globally ~ globally ~ (pc_m2(P) | pc_r6(P))) -> ~ globally ~ globally ~ (pc_m2(sk0) | pc_r6(sk0))) &` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/liveness/tlb.ivy#L903))", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "1592 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/liveness/tlb.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/liveness/tlb.ivy#L547", "has_liveness": true}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "chord (examples/pldi16/chord.ivy)", "specifies": "Chord ring maintenance", "safety": "`conjecture ~(final & err(X))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/pldi16/chord.ivy#L257)); `conjecture (a(X) | p(Y, X) | ~s1(X, Y))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/pldi16/chord.ivy#L279)); `conjecture (a(X) | X ~= q)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/pldi16/chord.ivy#L280)); `conjecture (a(X) | ~p(Y, X) | ~s1(X, Y))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/pldi16/chord.ivy#L281)); `conjecture (a(X) | ~s2(X, Y))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/pldi16/chord.ivy#L282)); `conjecture (a(Y) | a(Z) | ~s1(X, Y) | ~s2(X, Z))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/pldi16/chord.ivy#L283)); `conjecture (a(Y) | dom[s2](X) | ~a(X) | ~s1(X, Y))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/pldi16/chord.ivy#L284)); `conjecture (a(Y) | ~a(X) | ~p(Y, X) | ~s1(X, Y))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/pldi16/chord.ivy#L285)); `conjecture (dom[s1](X) | ~a(X))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/pldi16/chord.ivy#L286)); `conjecture (~btw(X, q, Y) | ~s1(X, Y))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/pldi16/chord.ivy#L287)); `conjecture  ~(down(S1, q) & down(S2, q) & down(S2, S1) & s1(S2, S1) & s2(S2, S2) & S1 ~= q & S2 ~= q)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/pldi16/chord.ivy#L288)); `conjecture  ~(down(S0, q) & down(S0, S1) & down(S0, S2) & down(S1, q) & down(S2, q) & down(S2, S1) & s1(S2, S1) & s2(S2, S0) & S0 ~= q & S1 ~= q & S2 ~= q)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/pldi16/chord.ivy#L289))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "289 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/pldi16/chord.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/pldi16/chord.ivy#L257", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "database_chain_replication (examples/pldi16/database_chain_replication.ivy)", "specifies": "chain-replicated database", "safety": "`conjecture ~(TX1 ~= TX2 &` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/pldi16/database_chain_replication.ivy#L217)); `conjecture commit_tx(T) & op_in_tx(T, O) & op_node(O, N) -> precommit_tx(T, N)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/pldi16/database_chain_replication.ivy#L226)); `conjecture depends_tx(T1, K, T2) -> (le(T2, T1) & (T1 ~= T2 | T1 = zero))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/pldi16/database_chain_replication.ivy#L230)); `conjecture ~abort_tx(Tx) | ~commit_tx(Tx) # Abort and commit are disjoint` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/pldi16/database_chain_replication.ivy#L231)); `conjecture (~precommit_tx(T, N) & ~abort_tx(T) & node_for_key(K, N)) -> ~write_tx(T, K)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/pldi16/database_chain_replication.ivy#L232)); `conjecture (~precommit_tx(T, N) & ~abort_tx(T) & node_for_key(K, N)) -> ~depends_tx(T, K, T2)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/pldi16/database_chain_replication.ivy#L233)); `conjecture commit_tx(zero)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/pldi16/database_chain_replication.ivy#L234)); `conjecture ~(~read_tx(T1, K0) & depends_tx(T1, K0, T0))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/pldi16/database_chain_replication.ivy#L235)); `conjecture ~(T0 ~= T2 & le(T0, T1) & le(T2, T0) & (~abort_tx(T0)) & (~abort_tx(T1))& depends_tx(T1, K0, T2) & write_tx(T0, K0))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/pldi16/database_chain_replication.ivy#L236))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "236 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/pldi16/database_chain_replication.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/pldi16/database_chain_replication.ivy#L217", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "leader_election_ring (examples/pldi16/leader_election_ring.ivy)", "specifies": "leader election", "safety": "`conjecture leader(X) & leader(Y) -> X = Y  # at most one leader` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/pldi16/leader_election_ring.ivy#L117)); `conjecture leader(X) -> le(idn(Y), idn(X)) # leader has highest id` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/pldi16/leader_election_ring.ivy#L118))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "125 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/pldi16/leader_election_ring.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/pldi16/leader_election_ring.ivy#L117", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "leader_election_ring_btw (examples/pldi16/leader_election_ring_btw.ivy)", "specifies": "leader election", "safety": "`conjecture leader(X) & leader(Y) -> X = Y  # at most one leader` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/pldi16/leader_election_ring_btw.ivy#L126)); `conjecture leader(X) -> le(idn(Y), idn(X)) # leader has highest id` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/pldi16/leader_election_ring_btw.ivy#L127))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "132 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/pldi16/leader_election_ring_btw.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/pldi16/leader_election_ring_btw.ivy#L126", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "leader_election_ring_bug (examples/pldi16/leader_election_ring_bug.ivy)", "specifies": "leader election", "safety": "`conjecture leader(X) & leader(Y) -> X = Y  # at most one leader` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/pldi16/leader_election_ring_bug.ivy#L118))", "liveness": "no active temporal/progress declaration found in this file", "negative-test_warning": "the filename marks this as a bad/buggy/unsafe/error variant; displayed properties are attempted checks, not established guarantees", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "118 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/pldi16/leader_election_ring_bug.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/pldi16/leader_election_ring_bug.ivy#L118", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "learning_switch (examples/pldi16/learning_switch.ivy)", "specifies": "learning network switch", "safety": "`conjecture tc(X,X)                          # Reflexivity` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/pldi16/learning_switch.ivy#L24)); `conjecture tc(X, Y) & tc(Y, Z) -> tc(X, Z)  # Transitivity` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/pldi16/learning_switch.ivy#L25)); `conjecture tc(X, Y) & tc(Y, X) -> X = Y     # Anti-symmetry` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/pldi16/learning_switch.ivy#L26)); `conjecture tc(X, Y) & tc(X, Z) -> (tc(Y, Z) | tc(Z, Y)) # Semi-linearity` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/pldi16/learning_switch.ivy#L27)); `conjecture ~(route.tc(N1,N1,N0) & N1 ~= N0)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/pldi16/learning_switch.ivy#L117)); `conjecture ~(route.tc(N2,N0,N2) & N0 ~= N2 & ~route.dom(N2,N0))  # this is actually not needed` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/pldi16/learning_switch.ivy#L118)); `conjecture ~(route.tc(N0,N2,N1) & N1 ~= N2 & ~route.dom(N0,N2))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/pldi16/learning_switch.ivy#L119)); `conjecture ~(route.tc(N2,N1,N0) & N0 ~= N2 & N1 ~= N0 & ~route.dom(N2,N0))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/pldi16/learning_switch.ivy#L120)); `conjecture ~(pending(P0,N1,N0) & N1 ~= src(P0) & ~route.dom(src(P0),N1))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/pldi16/learning_switch.ivy#L121))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "121 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/pldi16/learning_switch.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/pldi16/learning_switch.ivy#L24", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "raft_logs (examples/raft/raft_logs.ivy)", "specifies": "Raft replicated log", "safety": "`conjecture committed(L,S) -> maj(S)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/raft/raft_logs.ivy#L105)); `conjecture committed(L,S) & mem(N,S) -> (L < node_logs(N) | L = node_logs(N))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/raft/raft_logs.ivy#L106)); `conjecture committed(L:log,S:node_set) & mem(N:node,S) & ~(L < node_logs(M:node) | L = node_logs(M:node)) -> meas(node_logs(M:node)) < meas(node_logs(N:node))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/raft/raft_logs.ivy#L107)); `conjecture ~(meas(node_logs(NO0)) < meas(LO1) & abs_net.sent(NO0,LO1))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/raft/raft_logs.ivy#L108)); `conjecture committed(L:log,S:node_set) & mem(N:node,S) & abs_net.sent(M,L2) &  ~(L < L2 | L = L2) -> meas(L2) < meas(node_logs(N:node))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/raft/raft_logs.ivy#L109))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "139 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/raft/raft_logs.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/raft/raft_logs.ivy#L105", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "proto (examples/sht/proto.ivy)", "specifies": "sharded hash table", "safety": "`conjecture p.impl.dm(me).map(K,me) -> hash.hash(K) = ref.hash(K)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/proto.ivy#L128)); `conjecture p.impl.dm(me).map(K,me) & X ~= me -> ~p.impl.dm(X).map(K,X)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/proto.ivy#L131)); `conjecture p.impl.dm(me).map(K,me) -> ~(trans.delegated(X,S) & shard.lo(S) <= K & K <= shard.hi(S))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/proto.ivy#L134)); `conjecture trans.delegated(X,S) & shard.lo(S) <= K & K <= shard.hi(S)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/proto.ivy#L137)); `conjecture trans.requested(D,R) & L = req.ltime(R)->` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/proto.ivy#L143)); `conjecture trans.replied(D,R) & L = req.ltime(R)->` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/proto.ivy#L150)); `conjecture trans.requested(D,R) -> ref.generated(req.ltime(R)) & ~ref.evs(req.ltime(R)).serialized` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/proto.ivy#L157)); `conjecture trans.replied(D,R) -> ref.generated(req.ltime(R)) & ref.evs(req.ltime(R)).serialized` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/proto.ivy#L161)); `conjecture trans.requested(D1,R1) & trans.requested(D2,R2) & req.ltime(R1) = req.ltime(R2)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/proto.ivy#L165)); `conjecture trans.replied(D1,R1) & trans.replied(D2,R2) & req.ltime(R1) = req.ltime(R2)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/proto.ivy#L170)); `conjecture trans.delegated(X,S) & shard.lo(S) <= K & K <= shard.hi(S) -> shard.value(S,K) = ref.hash(K)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/proto.ivy#L175)); `conjecture ref.evs(T).serialized -> ref.generated(T)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/proto.ivy#L179))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "182 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/proto.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/proto.ivy#L128", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "reference (examples/sht/reference.ivy)", "specifies": "sharded hash table", "safety": "`assert ~evs(lt).serialized;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/reference.ivy#L65)); `assert evs(lt).serialized` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/reference.ivy#L105))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "114 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/reference.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/reference.ivy#L65", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "shard (examples/sht/shard.ivy)", "specifies": "sharded key-value storage", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "51 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/shard.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/shard.ivy", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "sht (examples/sht/sht.ivy)", "specifies": "sharded hash table", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "54 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht.ivy", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "sht_abs (examples/sht/sht_abs.ivy)", "specifies": "sharded hash table", "safety": "`conjecture map(K,V) & map(K,W) -> V = W` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs.ivy#L254)); `conjecture has.s(K) & has.succ.map(K,L) & K <= M & (L = 0 | ~(L <= M)) -> dma.map(me,M,entries(K))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs.ivy#L292)); `conjecture has.s(0)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs.ivy#L296)); `conjecture dma(me).map(K,me) -> hash.hash(K) = ref.hash(K)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs.ivy#L363)); `conjecture dma(me).map(K,me) & X ~= me -> ~dma(X).map(K,X)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs.ivy#L366)); `conjecture dma(me).map(K,me) -> ~(net.delegated(X,S) & shard_lo(S) <= K & K <= shard_hi(S))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs.ivy#L369)); `conjecture net.delegated(X,S) & shard_lo(S) <= K & K <= shard_hi(S)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs.ivy#L372)); `conjecture net.requested(D,R) & L = req_ltime(R)->` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs.ivy#L378)); `conjecture net.requested(D,R) -> io_spec.generated(req_ltime(R)) & ~ref.evs(req_ltime(R)).serialized` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs.ivy#L385)); `conjecture net.requested(D1,R1) & net.requested(D2,R2) & req_ltime(R1) = req_ltime(R2)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs.ivy#L389)); `conjecture net.delegated(X,S) & shard_lo(S) <= K & K <= shard_hi(S) -> shard_value(S,K) = ref.hash(K)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs.ivy#L394)); `conjecture ref.evs(T).serialized -> io_spec.generated(T)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs.ivy#L396)); `conjecture mq(D).contents(M) & neti(D).recv_seq(me) <= net_msg_seq_num(M)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs.ivy#L579)); `conjecture mq(D).contents(M) & neti(D).recv_seq(me) <= net_msg_seq_num(M)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs.ivy#L585)); `conjecture neti(S1).mq(D).contents(M1) & neti(D).recv_seq(S1) <= net_msg_seq_num(M1)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs.ivy#L590)); `conjecture neti(S1).mq(D).contents(M1) & neti(D).recv_seq(S1) <= net_msg_seq_num(M1)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs.ivy#L598)); `conjecture mq(D).contents(M) -> ~(send_seq(D) <= net_msg_seq_num(M))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs.ivy#L606)); `conjecture mq(D).contents(M1) & mq(D).contents(M2) & M1 ~= M2` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs.ivy#L610)); `conjecture low.sent(M) & net_msg_src(M) = me & net_msg_dst(M) = D` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs.ivy#L616)); `conjecture low.sent(M) & net_msg_src(M) = S & net_msg_dst(M) = D` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs.ivy#L625)); `conjecture low.sent(M) & net_msg_src(M) = S & net_msg_dst(M) = D` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs.ivy#L631)); `conjecture low.sent(M) & net_msg_src(M) = me & net_msg_mtype(M) ~= ack_t` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs.ivy#L636)); `conjecture mq(D).contents(M) -> net_msg_src(M) = me & net_msg_dst(M) = D & net_msg_mtype(M) ~= ack_t` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs.ivy#L641))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "734 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs.ivy#L254", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "sht_abs_v1 (examples/sht/sht_abs_v1.ivy)", "specifies": "sharded hash table", "safety": "`conjecture dm.map(K,me) -> hash.hash(K) = ref.hash(K)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v1.ivy#L309)); `conjecture dm.map(K,me) & X ~= me -> ~servers(X).dm.map(K,X)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v1.ivy#L312)); `conjecture dm.map(K,me) -> ~(net.delegated(X,S) & shard_lo(S) <= K & K <= shard_hi(S))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v1.ivy#L315)); `conjecture net.delegated(X,S) & shard_lo(S) <= K & K <= shard_hi(S)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v1.ivy#L318)); `conjecture net.requested(D,R) & L = req_ltime(R)->` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v1.ivy#L324)); `conjecture net.requested(D,R) -> net.generated(req_ltime(R))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v1.ivy#L331)); `conjecture net.requested(D1,R1) & net.requested(D2,R2) & req_ltime(R1) = req_ltime(R2)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v1.ivy#L335)); `conjecture net.delegated(X,S) & shard_lo(S) <= K & K <= shard_hi(S) -> shard_value(S,K) = ref.hash(K)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v1.ivy#L340)); `conjecture mq(D).contents(M) & neti(D).recv_seq(me) <= net_msg_seq_num(M)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v1.ivy#L534)); `conjecture mq(D).contents(M) & neti(D).recv_seq(me) <= net_msg_seq_num(M)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v1.ivy#L540)); `conjecture neti(S1).mq(D).contents(M1) & neti(D).recv_seq(S1) <= net_msg_seq_num(M1)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v1.ivy#L545)); `conjecture neti(S1).mq(D).contents(M1) & neti(D).recv_seq(S1) <= net_msg_seq_num(M1)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v1.ivy#L553)); `conjecture mq(D).contents(M) -> ~(send_seq(D) <= net_msg_seq_num(M))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v1.ivy#L561)); `conjecture mq(D).contents(M1) & mq(D).contents(M2)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v1.ivy#L565)); `conjecture low.sent(M) & net_msg_src(M) = me & net_msg_dst(M) = D` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v1.ivy#L571)); `conjecture low.sent(M) & net_msg_mtype(M) = request_t & net_msg_dst(M) = D` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v1.ivy#L575)); `conjecture low.sent(M) & net_msg_mtype(M) = delegate_t & net_msg_dst(M) = D` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v1.ivy#L579))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "642 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v1.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v1.ivy#L309", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "sht_abs_v2 (examples/sht/sht_abs_v2.ivy)", "specifies": "sharded hash table", "safety": "`conjecture dm.map(K,me) -> hash.hash(K) = ref.hash(K)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v2.ivy#L311)); `conjecture dm.map(K,me) & X ~= me -> ~servers(X).dm.map(K,X)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v2.ivy#L314)); `conjecture dm.map(K,me) -> ~(net.delegated(X,S) & shard_lo(S) <= K & K <= shard_hi(S))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v2.ivy#L317)); `conjecture net.delegated(X,S) & shard_lo(S) <= K & K <= shard_hi(S)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v2.ivy#L320)); `conjecture net.requested(D,R) & L = req_ltime(R)->` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v2.ivy#L326)); `conjecture net.requested(D,R) -> net.generated(req_ltime(R))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v2.ivy#L333)); `conjecture net.requested(D1,R1) & net.requested(D2,R2) & req_ltime(R1) = req_ltime(R2)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v2.ivy#L337)); `conjecture net.delegated(X,S) & shard_lo(S) <= K & K <= shard_hi(S) -> shard_value(S,K) = ref.hash(K)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v2.ivy#L342)); `conjecture mq(D).contents(M) & neti(D).recv_seq(me) <= net_msg_seq_num(M)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v2.ivy#L536)); `conjecture mq(D).contents(M) & neti(D).recv_seq(me) <= net_msg_seq_num(M)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v2.ivy#L542)); `conjecture neti(S1).mq(D).contents(M1) & neti(D).recv_seq(S1) <= net_msg_seq_num(M1)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v2.ivy#L547)); `conjecture neti(S1).mq(D).contents(M1) & neti(D).recv_seq(S1) <= net_msg_seq_num(M1)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v2.ivy#L555)); `conjecture mq(D).contents(M) -> ~(send_seq(D) <= net_msg_seq_num(M))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v2.ivy#L563)); `conjecture mq(D).contents(M1) & mq(D).contents(M2)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v2.ivy#L567)); `conjecture low.sent(M) & net_msg_src(M) = me & net_msg_dst(M) = D` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v2.ivy#L573)); `conjecture low.sent(M) & net_msg_src(M) = S & net_msg_dst(M) = D` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v2.ivy#L581)); `conjecture low.sent(M) & net_msg_src(M) = S & net_msg_dst(M) = D` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v2.ivy#L585))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "648 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v2.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v2.ivy#L311", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "sht_abs_v3 (examples/sht/sht_abs_v3.ivy)", "specifies": "sharded hash table", "safety": "`conjecture dm.map(K,me) -> hash.hash(K) = ref.hash(K)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v3.ivy#L315)); `conjecture dm.map(K,me) & X ~= me -> ~servers(X).dm.map(K,X)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v3.ivy#L318)); `conjecture dm.map(K,me) -> ~(net.delegated(X,S) & shard_lo(S) <= K & K <= shard_hi(S))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v3.ivy#L321)); `conjecture net.delegated(X,S) & shard_lo(S) <= K & K <= shard_hi(S)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v3.ivy#L324)); `conjecture net.requested(D,R) & L = req_ltime(R)->` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v3.ivy#L330)); `conjecture net.requested(D,R) -> net.generated(req_ltime(R))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v3.ivy#L337)); `conjecture net.requested(D1,R1) & net.requested(D2,R2) & req_ltime(R1) = req_ltime(R2)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v3.ivy#L341)); `conjecture net.delegated(X,S) & shard_lo(S) <= K & K <= shard_hi(S) -> shard_value(S,K) = ref.hash(K)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v3.ivy#L346)); `conjecture mq(D).contents(M) & neti(D).recv_seq(me) <= net_msg_seq_num(M)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v3.ivy#L540)); `conjecture mq(D).contents(M) & neti(D).recv_seq(me) <= net_msg_seq_num(M)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v3.ivy#L546)); `conjecture neti(S1).mq(D).contents(M1) & neti(D).recv_seq(S1) <= net_msg_seq_num(M1)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v3.ivy#L551)); `conjecture neti(S1).mq(D).contents(M1) & neti(D).recv_seq(S1) <= net_msg_seq_num(M1)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v3.ivy#L559)); `conjecture mq(D).contents(M) -> ~(send_seq(D) <= net_msg_seq_num(M))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v3.ivy#L567)); `conjecture mq(D).contents(M1) & mq(D).contents(M2)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v3.ivy#L571)); `conjecture low.sent(M) & net_msg_src(M) = me & net_msg_dst(M) = D` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v3.ivy#L577)); `conjecture low.sent(M) & net_msg_src(M) = S & net_msg_dst(M) = D` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v3.ivy#L585)); `conjecture low.sent(M) & net_msg_src(M) = S & net_msg_dst(M) = D` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v3.ivy#L589))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "653 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v3.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v3.ivy#L315", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "sht_abs_v4 (examples/sht/sht_abs_v4.ivy)", "specifies": "sharded hash table", "safety": "`conjecture dm.map(K,me) -> hash.hash(K) = ref.hash(K)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v4.ivy#L317)); `conjecture dm.map(K,me) & X ~= me -> ~servers(X).dm.map(K,X)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v4.ivy#L320)); `conjecture dm.map(K,me) -> ~(net.delegated(X,S) & shard_lo(S) <= K & K <= shard_hi(S))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v4.ivy#L323)); `conjecture net.delegated(X,S) & shard_lo(S) <= K & K <= shard_hi(S)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v4.ivy#L326)); `conjecture net.requested(D,R) & L = req_ltime(R)->` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v4.ivy#L332)); `conjecture net.requested(D,R) -> net.generated(req_ltime(R))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v4.ivy#L339)); `conjecture net.requested(D1,R1) & net.requested(D2,R2) & req_ltime(R1) = req_ltime(R2)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v4.ivy#L343)); `conjecture net.delegated(X,S) & shard_lo(S) <= K & K <= shard_hi(S) -> shard_value(S,K) = ref.hash(K)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v4.ivy#L348)); `conjecture mq(D).contents(M) & neti(D).recv_seq(me) <= net_msg_seq_num(M)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v4.ivy#L543)); `conjecture mq(D).contents(M) & neti(D).recv_seq(me) <= net_msg_seq_num(M)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v4.ivy#L549)); `conjecture neti(S1).mq(D).contents(M1) & neti(D).recv_seq(S1) <= net_msg_seq_num(M1)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v4.ivy#L554)); `conjecture neti(S1).mq(D).contents(M1) & neti(D).recv_seq(S1) <= net_msg_seq_num(M1)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v4.ivy#L562)); `conjecture mq(D).contents(M) -> ~(send_seq(D) <= net_msg_seq_num(M))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v4.ivy#L570)); `conjecture mq(D).contents(M1) & mq(D).contents(M2)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v4.ivy#L574)); `conjecture low.sent(M) & net_msg_src(M) = me & net_msg_dst(M) = D` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v4.ivy#L580)); `conjecture low.sent(M) & net_msg_src(M) = S & net_msg_dst(M) = D` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v4.ivy#L588)); `conjecture low.sent(M) & net_msg_src(M) = S & net_msg_dst(M) = D` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v4.ivy#L592))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "656 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v4.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/sht_abs_v4.ivy#L317", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "trans (examples/sht/trans.ivy)", "specifies": "sharded hash table", "safety": "`conjecture mq(D).contents(M) & impl(D).recv_seq(me) <= net_msg.num(M)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/trans.ivy#L171)); `conjecture mq(D).contents(M) & impl(D).recv_seq(me) <= net_msg.num(M)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/trans.ivy#L177)); `conjecture mq(D).contents(M) & impl(D).recv_seq(me) <= net_msg.num(M)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/trans.ivy#L183)); `conjecture impl(S1).mq(D).contents(M1) & impl(D).recv_seq(S1) <= net_msg.num(M1)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/trans.ivy#L188)); `conjecture impl(S1).mq(D).contents(M1) & impl(D).recv_seq(S1) <= net_msg.num(M1)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/trans.ivy#L196)); `conjecture impl(S1).mq(D).contents(M1) & impl(D).recv_seq(S1) <= net_msg.num(M1)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/trans.ivy#L204)); `conjecture mq(D).contents(M) -> ~(send_seq(D) <= net_msg.num(M))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/trans.ivy#L212)); `conjecture mq(D).contents(M1) & mq(D).contents(M2) & M1 ~= M2` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/trans.ivy#L216)); `conjecture lower.spec.sent(M,D) & net_msg.src(M) = me` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/trans.ivy#L222)); `conjecture lower.spec.sent(M,D) & net_msg.src(M) = S` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/trans.ivy#L231)); `conjecture lower.spec.sent(M,D) & net_msg.src(M) = S` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/trans.ivy#L237)); `conjecture lower.spec.sent(M,D) & net_msg.src(M) = me & net_msg.mty(M) ~= ack_t` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/trans.ivy#L242)); `conjecture mq(D).contents(M) -> net_msg.src(M) = me & net_msg.mty(M) ~= ack_t` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/trans.ivy#L247))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "249 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/trans.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/sht/trans.ivy#L171", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "tilelink1 (examples/tilelink/tilelink1.ivy)", "specifies": "TileLink cache coherence", "safety": "`assert own(a) ~= none & lleq(lt,nlt);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink1.ivy#L134)); `assert mem(nlt,a,d)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink1.ivy#L140)); `assert own(a) = none & lleq(lt,nlt);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink1.ivy#L166))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "284 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink1.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink1.ivy#L134", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "tilelink2 (examples/tilelink/tilelink2.ivy)", "specifies": "TileLink cache coherence", "safety": "`assert cached(a);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink2.ivy#L179)); `assert own(a) ~= none;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink2.ivy#L180)); `assert mem(a,d)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink2.ivy#L182))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "623 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink2.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink2.ivy#L179", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "tilelink_abstract_spec (examples/tilelink/tilelink_abstract_spec.ivy)", "specifies": "TileLink cache coherence", "safety": "`conjecture dirt_p(A) -> excl_p(A)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_abstract_spec.ivy#L437)); `conjecture (excl_p(A) | shrd_p(A)) -> cached(A)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_abstract_spec.ivy#L441)); `conjecture ~(to_ser(T) & cached(ref.evs(T).addr_))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_abstract_spec.ivy#L445)); `conjecture ~(ref.prevents(T1,T2) & ~to_ser(T1) & to_ser(T2))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_abstract_spec.ivy#L449)); `conjecture to_ser(T) -> side(ref.evs(T).id_) = client` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_abstract_spec.ivy#L453))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "518 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_abstract_spec.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_abstract_spec.ivy#L437", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "tilelink_concrete_directory (examples/tilelink/tilelink_concrete_directory.ivy)", "specifies": "TileLink cache coherence", "safety": "`conjecture b.pend_prb(H,W) <-> intf.prb_addr(H,W)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_directory.ivy#L250)); `conjecture ~intf.none_r(H,W)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_directory.ivy#L252)); `conjecture b.cache_excl(H,W) <-> intf.excl_p(addr_cons(H,W))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_directory.ivy#L254)); `conjecture b.cache_shrd(H,W) <-> intf.shrd_p(addr_cons(H,W))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_directory.ivy#L256)); `conjecture b.pend_excl(H,W) -> intf.excl_r(H) | intf.excl_a(H)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_directory.ivy#L258)); `conjecture intf.excl_r(H) -> b.pend_excl(H,W)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_directory.ivy#L260)); `conjecture intf.excl_a(H) -> exists W. b.pend_excl(H,W)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_directory.ivy#L262)); `conjecture b.pend_shrd(H,W) -> intf.shrd_r(H) | intf.shrd_a(H)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_directory.ivy#L264)); `conjecture intf.shrd_r(H) -> b.pend_shrd(H,W)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_directory.ivy#L266)); `conjecture intf.shrd_a(H) -> exists W. b.pend_shrd(H,W)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_directory.ivy#L268)); `conjecture ((intf.excl_f(H) <-> b.pend_fnse(H)) & (intf.shrd_f(H) <-> b.pend_fnss(H)))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_directory.ivy#L273)); `conjecture (b.pend_excl(H,W) -> ~b.pend_fnse(H)) & (b.pend_shrd(H,W) -> ~b.pend_fnss(H))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_directory.ivy#L276)); `conjecture (~intf.excl_f(H) & b.pend_fnse(H) -> intf.excl_p(addr_cons(H,W)))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_directory.ivy#L282)); `conjecture (intf.excl_r(H) | intf.shrd_r(H)) -> intf.addr_rid(H) = b.addr_id(H)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_directory.ivy#L285)); `conjecture (intf.excl_a(H) | intf.shrd_a(H) | intf.excl_f(H) | intf.shrd_f(H)) -> intf.addr_id(H)  = b.addr_id(H)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_directory.ivy#L287)); `conjecture ~(b.cache_shrd(H,W) & b.pend_shrd(H,W)) & ~(b.cache_excl(H,W) & b.pend_excl(H,W))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_directory.ivy#L289)); `conjecture b.pend_excl(H,W1) & ~b.cache_excl(H,W2) -> b.pend_excl(H,W2)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_directory.ivy#L291)); `conjecture b.pend_shrd(H,W1) & ~b.cache_shrd(H,W2) -> b.pend_shrd(H,W2)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_directory.ivy#L293)); `conjecture ~(b.pend_prb(H,W1) & (b.pend_excl(H,W2) | b.pend_fnse(H) | b.pend_shrd(H,W2) | b.pend_fnss(H)))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_directory.ivy#L295)); `conjecture ~((b.pend_excl(H1,W1) | b.pend_shrd(H1,W1) | b.pend_fnse(H1) | b.pend_fnss(H1))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_directory.ivy#L297)); `conjecture ~b.dir0.cache_excl(H,W) & ~b.dir1.cache_excl(H,W) -> b.mem(addr_cons(H,W)) = ref.mem(addr_cons(H,W))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_directory.ivy#L305)); `conjecture ~intf0.dirt_p(A) & ~intf1.dirt_p(A) -> b.mem(A) = ref.mem(A)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_directory.ivy#L307)); `conjecture ~(b.dir0.cache_excl(H,W) & b.dir1.cache_excl(H,W))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_directory.ivy#L309))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "309 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_directory.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_directory.ivy#L250", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "tilelink_concrete_snoopy (examples/tilelink/tilelink_concrete_snoopy.ivy)", "specifies": "TileLink cache coherence", "safety": "`conjecture b.pend_prb(H,W) <-> back.prb_addr(H,W)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_snoopy.ivy#L360)); `conjecture b.pend_rls(H,W) <-> back.none_r(H,W)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_snoopy.ivy#L362)); `conjecture b.cache_excl(H,W) <-> back.excl_p(addr_cons(H,W))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_snoopy.ivy#L364)); `conjecture b.pend_excl(H,W) -> back.excl_r(H) | back.excl_a(H)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_snoopy.ivy#L368)); `conjecture back.excl_r(H) -> b.pend_excl(H,W)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_snoopy.ivy#L370)); `conjecture back.excl_a(H) -> exists W. b.pend_excl(H,W)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_snoopy.ivy#L372)); `conjecture b.pend_shrd(H,W) -> back.shrd_r(H) | back.shrd_a(H)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_snoopy.ivy#L374)); `conjecture back.shrd_r(H) -> b.pend_shrd(H,W)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_snoopy.ivy#L376)); `conjecture back.shrd_a(H) -> exists W. b.pend_shrd(H,W)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_snoopy.ivy#L378)); `conjecture ~back.excl_f(H) & ~back.shrd_f(H)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_snoopy.ivy#L380)); `conjecture ~back.unc_r(H,W) & ~back.unc_a(H,W) & ~back.unc_f(H,W)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_snoopy.ivy#L382)); `conjecture ~front.unc_r(H,W) & ~front.unc_a(H,W)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_snoopy.ivy#L384)); `conjecture ~front.excl_r(H) & ~front.excl_a(H) & ~front.excl_f(H)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_snoopy.ivy#L386)); `conjecture ~front.shrd_r(H) & ~front.shrd_a(H) & ~front.shrd_f(H)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_snoopy.ivy#L388)); `conjecture front.unc_f(H,W) -> b.wait_finish` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_snoopy.ivy#L390)); `conjecture front.unc_f(H1,W1) & front.unc_f(H2,W2) ->  (H1 = H2 & W1 = W2)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_snoopy.ivy#L392)); `conjecture (b.cache_excl(H,W) | b.cache_shrd(H,W)) -> b.cache_data(addr_cons(H,W)) = ref.mem(addr_cons(H,W))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_snoopy.ivy#L394)); `conjecture ~(b.pend_rls(H1,W1) & b.pend_rls(H2,W2) & H1 ~= H2)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_snoopy.ivy#L396)); `conjecture ~(b.pend_excl(H1,W1) & b.pend_excl(H2,W2) & H1 ~= H2)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_snoopy.ivy#L398)); `conjecture ~(b.pend_shrd(H1,W1) & b.pend_shrd(H2,W2) & H1 ~= H2)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_snoopy.ivy#L400)); `conjecture (back.excl_r(H) | back.shrd_r(H)) -> back.addr_rid(H) = buf_id` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_snoopy.ivy#L402)); `conjecture (back.excl_a(H) | back.shrd_a(H) | back.excl_f(H) | back.shrd_f(H)) -> back.addr_id(H) = buf_id` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_snoopy.ivy#L404)); `conjecture back.none_r(H,W) -> back.addr_nid(H) = buf_id` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_snoopy.ivy#L406)); `conjecture ~(b.cache_shrd(H,W) & b.pend_shrd(H,W)) & ~(b.cache_excl(H,W) & b.pend_excl(H,W))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_snoopy.ivy#L408)); `conjecture b.pend_excl(H,W1) & ~b.cache_excl(H,W2) -> b.pend_excl(H,W2)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_snoopy.ivy#L410)); `conjecture b.pend_shrd(H,W1) & ~b.cache_shrd(H,W2) -> b.pend_shrd(H,W2)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_snoopy.ivy#L412))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "418 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_snoopy.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_snoopy.ivy#L360", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "tilelink_concrete_spec (examples/tilelink/tilelink_concrete_spec.ivy)", "specifies": "TileLink cache coherence", "safety": "`conjecture (excl_r(H) | excl_a(H) | excl_f(H) |` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_spec.ivy#L765)); `conjecture (unc_r(H,L) | unc_a(H,L) | unc_f(H,L)) -> ~cached_hi(H)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_spec.ivy#L767)); `conjecture ~(excl_r(H) & excl_a(H)) & ~(excl_r(H) & excl_f(H)) & ~(excl_a(H) & excl_f(H))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_spec.ivy#L772)); `conjecture ~(shrd_r(H) & shrd_a(H)) & ~(shrd_r(H) & shrd_f(H)) & ~(shrd_a(H) & shrd_f(H))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_spec.ivy#L773)); `conjecture ~unc_a(H,L)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_spec.ivy#L777)); `conjecture excl_a(H) -> exists W. ~excl_p(addr_cons(H,W))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_spec.ivy#L781)); `conjecture shrd_a(H) -> exists W. ~shrd_p(addr_cons(H,W))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_spec.ivy#L782)); `conjecture none_r(H,W) -> cached_hi(H)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_spec.ivy#L786)); `conjecture none_r(H,W) -> ~excl_r(H) & ~excl_a(H) & ~shrd_r(H) & ~shrd_a(H)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_spec.ivy#L791)); `conjecture none_r(H,W) & A = addr_cons(H,W) -> ~excl_p(A) & ~shrd_p(A)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_spec.ivy#L795)); `conjecture prb_addr(H,W) -> cached_hi(H)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_spec.ivy#L799)); `conjecture excl_f(H) & ~none_r(H,W) -> excl_p(addr_cons(H,W))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_spec.ivy#L803)); `conjecture shrd_f(H) & ~none_r(H,W) -> shrd_p(addr_cons(H,W))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_spec.ivy#L804)); `conjecture prb_addr(H,W) -> ~excl_a(H) & ~excl_f(H) & ~shrd_a(H) & ~shrd_f(H)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_spec.ivy#L808)); `conjecture excl_r(H) & ~none_r(H,W) & ~prb_addr(H,W) -> ~excl_p(addr_cons(H,W))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_spec.ivy#L813)); `conjecture shrd_r(H) & ~none_r(H,W) & ~prb_addr(H,W) -> ~shrd_p(addr_cons(H,W))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_spec.ivy#L814)); `conjecture granted(E) -> ref.evs(E).serialized` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_spec.ivy#L818)); `conjecture granted(E) -> to_ser(E)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_spec.ivy#L822)); `conjecture to_ser(E2) & ref.prevents(E1,E2) -> granted(E1)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_spec.ivy#L826)); `conjecture ~(to_ser(E1) & to_ser(E2) & ~granted(E1) & ~granted(E2) & E1 ~= E2 &` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_spec.ivy#L832)); `conjecture ~(to_ser(E1) & to_ser(E2) & ~granted(E1) & ~granted(E2) & E1 ~= E2  &` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_spec.ivy#L841)); `conjecture (excl_a(H) | shrd_a(H) | unc_a(H,W)) -> addr_id(H) = addr_rid(H)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_spec.ivy#L847)); `conjecture (excl_a(H1) | excl_f(H1) | shrd_a(H1) | shrd_f(H1) | unc_a(H1,W1) | unc_f(H1,W1))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_spec.ivy#L851)); `conjecture (excl_r(H1) | shrd_r(H1) | unc_r(H1,W1))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_spec.ivy#L859)); `conjecture none_r(H1,W1) & none_r(H2,W2)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_spec.ivy#L867))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "984 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_spec.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_spec.ivy#L765", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "tilelink_concrete_two_client_testbench (examples/tilelink/tilelink_concrete_two_client_testbench.ivy)", "specifies": "TileLink cache coherence", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "66 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_two_client_testbench.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_two_client_testbench.ivy", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "tilelink_concrete_two_port_testbench (examples/tilelink/tilelink_concrete_two_port_testbench.ivy)", "specifies": "TileLink cache coherence", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "88 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_two_port_testbench.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_two_port_testbench.ivy", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "tilelink_concrete_unordered_channel (examples/tilelink/tilelink_concrete_unordered_channel.ivy)", "specifies": "TileLink cache coherence", "safety": "`conjecture front.excl_p(A) -> back.excl_p(A)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L187)); `conjecture front.shrd_p(A) -> back.shrd_p(A)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L188)); `conjecture back.to_ser(E) -> front.to_ser(E)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L193)); `conjecture front.granted(E) -> back.granted(E)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L197)); `conjecture front.to_ser(T) & ref.evs(T).serialized -> back.to_ser(T)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L204)); `conjecture back.excl_r(H) -> front.excl_r(H)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L212)); `conjecture back.shrd_r(H) -> front.shrd_r(H)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L213)); `conjecture back.unc_r(H,L) -> front.unc_r(H,L)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L214)); `conjecture back.excl_a(H) -> front.excl_r(H) | front.excl_a(H)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L218)); `conjecture back.shrd_a(H) -> front.shrd_r(H) | front.shrd_a(H)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L219)); `conjecture back.unc_a(H,L) -> front.unc_r(H,L) | front.unc_a(H,L)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L220)); `conjecture front.excl_a(H) -> back.excl_a(H) | back.excl_f(H)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L230)); `conjecture front.shrd_a(H) -> back.shrd_a(H) | back.shrd_f(H)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L231)); `conjecture front.unc_a(H,L) -> back.unc_a(H,L) | back.unc_f(H,L)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L232)); `conjecture front.excl_f(H) -> back.excl_f(H)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L236)); `conjecture front.shrd_f(H) -> back.shrd_f(H)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L237)); `conjecture front.unc_f(H,L) -> back.unc_f(H,L)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L238)); `conjecture back.none_r(H,W) -> front.none_r(H,W)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L242)); `conjecture front.prb_addr(H,W) -> back.prb_addr(H,W)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L246)); `conjecture (back.excl_a(H1) | back.shrd_a(H1) | back.unc_a(H1,W1))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L251)); `conjecture (back.excl_r(H1) | back.shrd_r(H1) | back.unc_r(H1,W1))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L254)); `conjecture (front.excl_a(H1) | front.shrd_a(H1) | front.unc_a(H1,W1)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L259)); `conjecture back.none_r(H,W) -> back.addr_nid(H) = front.addr_nid(H)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L265)); `conjecture A = addr_cons(H,W) & ~front.dirt_p(A) & back.dirt_p(A)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L279)); `conjecture front.excl_r(H) & ~back.excl_r(H) & ~back.excl_a(H) & ~back.excl_f(H)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L284)); `conjecture front.shrd_r(H) & ~back.shrd_r(H) & ~back.shrd_a(H) & ~back.shrd_f(H)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L286)); `conjecture ~front.excl_r(H) & ~front.excl_a(H) & ~back.excl_r(H) & ~back.excl_a(H)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L292)); `conjecture ~front.shrd_r(H) & ~front.shrd_a(H) & ~back.shrd_r(H) & ~back.shrd_a(H)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L294)); `conjecture ~front.excl_a(H) & ~back.excl_a(H)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L301)); `conjecture ~front.shrd_a(H) & ~back.shrd_a(H)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L304)); `conjecture ~front.excl_r(H) & ~front.excl_a(H) & ~back.excl_r(H) & ~back.excl_a(H)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L311)); `conjecture ~front.shrd_r(H) & ~front.shrd_a(H) & ~back.shrd_r(H) & ~back.shrd_a(H)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L313)); `conjecture b.acqs(I1,M1) & H = acqs(M1).addr_hi & acqs(M1).own = excl ->` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L327)); `conjecture b.acqs(I1,M1) & H = acqs(M1).addr_hi & acqs(M1).own = shrd ->` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L329)); `conjecture b.acqs(I1,M1) & H = acqs(M1).addr_hi & W = acqs(M1).word & acqs(M1).own = none ->` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L331)); `conjecture b.acqs(I1,M1) & acqs(M1).own = none & E = acqs(M1).ltime_ ->` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L336)); `conjecture b.acqs(I1,M1) -> front.addr_rid(acqs(M1).addr_hi) = acqs(M1).id_` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L343)); `conjecture b.acqs(I1,M1) & acqs(M1).own = none & E = acqs(M1).ltime_ ->` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L347)); `conjecture b.acqs(I1,M1) & b.acqs(I2,M2) & (I1 ~= I2 | M1 ~= M2) ->` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L354)); `conjecture ~(b.acqs(I1,M1) & b.gnts(I2,M2) & gnts(M2).own = acqs(M1).own &` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L360)); `conjecture b.gnts(I1,M1) & ~gnts(M1).relack & H = gnts(M1).addr_hi & W = gnts(M1).word & gnts(M1).own = none` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L373)); `conjecture b.gnts(I1,M1) & ~gnts(M1).relack & H = gnts(M1).addr_hi & W = gnts(M1).word & gnts(M1).own = excl` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L380)); `conjecture b.gnts(I1,M1) & ~gnts(M1).relack & H = gnts(M1).addr_hi & W = gnts(M1).word & gnts(M1).own = shrd` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L386)); `conjecture b.gnts(I1,M1) & ~gnts(M1).relack & H = gnts(M1).addr_hi -> front.addr_rid(H) = gnts(M1).id_` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L394)); `conjecture b.gnts(I1,M1) & gnts(M1).relack & H = gnts(M1).addr_hi -> front.addr_nid(H) = gnts(M1).id_` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L395)); `conjecture b.gnts(I1,M1) & ~gnts(M1).relack & H = gnts(M1).addr_hi -> back.addr_id(H) = gnts(M1).id_` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L399)); `conjecture b.gnts(I1,M1) & gnts(M1).relack & H = gnts(M1).addr_hi & W = gnts(M1).word ->` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L404)); `conjecture b.gnts(I1,M1) & b.gnts(I2,M2) & (I1 ~= I2 | M1 ~= M2) ->` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L412)); `conjecture b.rlss(I1,M1) & rlss(M1).voluntary & H = rlss(M1).addr_hi & W = rlss(M1).word ->` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L423)); `conjecture b.rlss(I1,M1) & rlss(M1).voluntary & A = addr_cons(rlss(M1).addr_hi,rlss(M1).word) ->` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L429)); `conjecture b.rlss(I1,M1) & A = addr_cons(rlss(M1).addr_hi,rlss(M1).word) ->` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L434)); `conjecture b.rlss(I1,M1) & A = addr_cons(rlss(M1).addr_hi,rlss(M1).word) &` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L439)); `conjecture b.rlss(I1,M1) & ~rlss(M1).voluntary & H = rlss(M1).addr_hi & W = rlss(M1).word ->` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L447)); `conjecture b.rlss(I1,M1) & rlss(M1).voluntary & H = rlss(M1).addr_hi ->` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L454)); `conjecture b.rlss(I1,M1) & b.rlss(I2,M2) & (I1 ~= I2 | M1 ~= M2) ->` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L460)); `conjecture b.prbs(I1,M1) & H = prbs(M1).addr_hi -> back.prb_addr(H,W) & ~front.prb_addr(H,W)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L470)); `conjecture ~(b.prbs(I1,M1) & b.rlss(I2,M2)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L474)); `conjecture b.prbs(I1,M1) & b.prbs(I2,M2) & (I1 ~= I2 | M1 ~= M2) ->` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L480)); `conjecture b.fnss(I1,M1) & H = fnss(M1).addr_hi & W = fnss(M1).word & fnss(M1).own = excl ->` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L492)); `conjecture b.fnss(I1,M1) & H = fnss(M1).addr_hi & W = fnss(M1).word & fnss(M1).own = shrd ->` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L495)); `conjecture b.fnss(I1,M1) & H = fnss(M1).addr_hi & W = fnss(M1).word & fnss(M1).own = none ->` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L498)); `conjecture b.fnss(I1,M1) -> back.addr_id(fnss(M1).addr_hi) = fnss(M1).id_` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L503)); `conjecture ~(b.fnss(I1,M1) & b.gnts(I2,M2) & ~gnts(M2).relack & gnts(M2).own = fnss(M1).own &` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L507)); `conjecture b.fnss(I1,M1) & b.fnss(I2,M2) & (I1 ~= I2 | M1 ~= M2) ->` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L513))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "518 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel.ivy#L187", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "tilelink_concrete_unordered_channel_tests (examples/tilelink/tilelink_concrete_unordered_channel_tests.ivy)", "specifies": "TileLink cache coherence", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "216 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel_tests.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_concrete_unordered_channel_tests.ivy", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "tilelink_rcsc_snoopy (examples/tilelink/tilelink_rcsc_snoopy.ivy)", "specifies": "TileLink cache coherence", "safety": "`assert evs(e2):id_(eid);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_rcsc_snoopy.ivy#L198)); `assert e1 ~= e2 & lleq(e1,e2) & evs(e1):type_ = write & evs(e2):type_ = read;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_rcsc_snoopy.ivy#L199)); `assert evs(e2):addr_(a);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_rcsc_snoopy.ivy#L200))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "600 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_rcsc_snoopy.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_rcsc_snoopy.ivy#L198", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "tilelink_rcsc_store_buffer (examples/tilelink/tilelink_rcsc_store_buffer.ivy)", "specifies": "TileLink cache coherence", "safety": "`assert cached(a);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_rcsc_store_buffer.ivy#L219)); `assert own(a) ~= none;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_rcsc_store_buffer.ivy#L220)); `assert mem(a,d)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_rcsc_store_buffer.ivy#L222))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "687 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_rcsc_store_buffer.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_rcsc_store_buffer.ivy#L219", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "tilelink_rcsc_store_buffer2 (examples/tilelink/tilelink_rcsc_store_buffer2.ivy)", "specifies": "TileLink cache coherence", "safety": "`assert evs(e2):id_(eid);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_rcsc_store_buffer2.ivy#L199)); `assert e1 ~= e2 & lleq(e1,e2) & evs(e1):type_ = write & evs(e2):type_ = read;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_rcsc_store_buffer2.ivy#L200)); `assert evs(e2):addr_(a);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_rcsc_store_buffer2.ivy#L201))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "735 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_rcsc_store_buffer2.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_rcsc_store_buffer2.ivy#L199", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "tilelink_rcsc_store_buffer2_save (examples/tilelink/tilelink_rcsc_store_buffer2_save.ivy)", "specifies": "TileLink cache coherence", "safety": "`assert evs(e2):id_(eid);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_rcsc_store_buffer2_save.ivy#L199)); `assert e1 ~= e2 & lleq(e1,e2) & evs(e1):type_ = write & evs(e2):type_ = read;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_rcsc_store_buffer2_save.ivy#L200)); `assert evs(e2):addr_(a);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_rcsc_store_buffer2_save.ivy#L201))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "735 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_rcsc_store_buffer2_save.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_rcsc_store_buffer2_save.ivy#L199", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "tilelink_rcsc_store_buffer2_temp (examples/tilelink/tilelink_rcsc_store_buffer2_temp.ivy)", "specifies": "TileLink cache coherence", "safety": "`assert evs(e2):id_(eid);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_rcsc_store_buffer2_temp.ivy#L198)); `assert e1 ~= e2 & lleq(e1,e2) & evs(e1):type_ = write & evs(e2):type_ = read;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_rcsc_store_buffer2_temp.ivy#L199)); `assert evs(e2):addr_(a);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_rcsc_store_buffer2_temp.ivy#L200))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "733 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_rcsc_store_buffer2_temp.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_rcsc_store_buffer2_temp.ivy#L198", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "tilelink_snoopy (examples/tilelink/tilelink_snoopy.ivy)", "specifies": "TileLink cache coherence", "safety": "`assert false  # block it` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_snoopy.ivy#L45))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "127 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_snoopy.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_snoopy.ivy#L45", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "tilelink_store_buffer (examples/tilelink/tilelink_store_buffer.ivy)", "specifies": "TileLink cache coherence", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "258 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_store_buffer.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_store_buffer.ivy", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "tilelink_two_port_test_bench (examples/tilelink/tilelink_two_port_test_bench.ivy)", "specifies": "TileLink cache coherence", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "71 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_two_port_test_bench.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/tilelink_two_port_test_bench.ivy", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "tilelink_abstract_spec (examples/tilelink/unit_test/single_client/tilelink_abstract_spec.ivy)", "specifies": "TileLink cache coherence", "safety": "`conjecture dirt_p(A) -> excl_p(A)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/single_client/tilelink_abstract_spec.ivy#L417)); `conjecture (excl_p(A) | shrd_p(A)) -> cached(A)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/single_client/tilelink_abstract_spec.ivy#L421)); `conjecture ~(to_ser(T) & cached(ref.evs(T).addr_))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/single_client/tilelink_abstract_spec.ivy#L425)); `conjecture ~(ref.prevents(T1,T2) & ~to_ser(T1) & to_ser(T2))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/single_client/tilelink_abstract_spec.ivy#L429)); `conjecture to_ser(T) -> side(ref.evs(T).id_) = client` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/single_client/tilelink_abstract_spec.ivy#L433))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "498 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/single_client/tilelink_abstract_spec.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/single_client/tilelink_abstract_spec.ivy#L417", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "tilelink_coherence_manager_tester (examples/tilelink/unit_test/single_client/tilelink_coherence_manager_tester.ivy)", "specifies": "TileLink cache coherence", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "265 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/single_client/tilelink_coherence_manager_tester.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/single_client/tilelink_coherence_manager_tester.ivy", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "tilelink_concrete_spec (examples/tilelink/unit_test/single_client/tilelink_concrete_spec.ivy)", "specifies": "TileLink cache coherence", "safety": "`conjecture (excl_r(H) | excl_a(H) | excl_f(H) |` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/single_client/tilelink_concrete_spec.ivy#L779)); `conjecture (unc_r(H,L) | unc_a(H,L) | unc_f(H,L)) -> ~cached_hi(H)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/single_client/tilelink_concrete_spec.ivy#L781)); `conjecture ~(excl_r(H) & excl_a(H)) & ~(excl_r(H) & excl_f(H)) & ~(excl_a(H) & excl_f(H))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/single_client/tilelink_concrete_spec.ivy#L786)); `conjecture ~(shrd_r(H) & shrd_a(H)) & ~(shrd_r(H) & shrd_f(H)) & ~(shrd_a(H) & shrd_f(H))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/single_client/tilelink_concrete_spec.ivy#L787)); `conjecture ~unc_a(H,L)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/single_client/tilelink_concrete_spec.ivy#L791)); `conjecture excl_a(H) -> exists W. ~excl_p(addr_cons(H,W))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/single_client/tilelink_concrete_spec.ivy#L795)); `conjecture shrd_a(H) -> exists W. ~shrd_p(addr_cons(H,W))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/single_client/tilelink_concrete_spec.ivy#L796)); `conjecture none_r(H,W) -> cached_hi(H)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/single_client/tilelink_concrete_spec.ivy#L800)); `conjecture none_r(H,W) -> ~excl_r(H) & ~excl_a(H) & ~shrd_r(H) & ~shrd_a(H)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/single_client/tilelink_concrete_spec.ivy#L805)); `conjecture none_r(H,W) & A = addr_cons(H,W) -> ~excl_p(A) & ~shrd_p(A)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/single_client/tilelink_concrete_spec.ivy#L809)); `conjecture prb_addr(H,W) -> cached_hi(H)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/single_client/tilelink_concrete_spec.ivy#L813)); `conjecture excl_f(H) & ~none_r(H,W) -> excl_p(addr_cons(H,W))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/single_client/tilelink_concrete_spec.ivy#L817)); `conjecture shrd_f(H) & ~none_r(H,W) -> shrd_p(addr_cons(H,W))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/single_client/tilelink_concrete_spec.ivy#L818)); `conjecture prb_addr(H,W) -> ~excl_a(H) & ~excl_f(H) & ~shrd_a(H) & ~shrd_f(H)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/single_client/tilelink_concrete_spec.ivy#L822)); `conjecture excl_r(H) & ~none_r(H,W) & ~prb_addr(H,W) -> ~excl_p(addr_cons(H,W))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/single_client/tilelink_concrete_spec.ivy#L827)); `conjecture shrd_r(H) & ~none_r(H,W) & ~prb_addr(H,W) -> ~shrd_p(addr_cons(H,W))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/single_client/tilelink_concrete_spec.ivy#L828)); `conjecture granted(E) -> ref.evs(E).serialized` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/single_client/tilelink_concrete_spec.ivy#L832)); `conjecture granted(E) -> to_ser(E)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/single_client/tilelink_concrete_spec.ivy#L836)); `conjecture to_ser(E2) & ref.prevents(E1,E2) -> granted(E1)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/single_client/tilelink_concrete_spec.ivy#L840)); `conjecture ~(to_ser(E1) & to_ser(E2) & ~granted(E1) & ~granted(E2) & E1 ~= E2 &` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/single_client/tilelink_concrete_spec.ivy#L846)); `conjecture ~(to_ser(E1) & to_ser(E2) & ~granted(E1) & ~granted(E2) & E1 ~= E2  &` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/single_client/tilelink_concrete_spec.ivy#L855)); `conjecture (excl_a(H) | shrd_a(H) | unc_a(H,W)) -> addr_gid(H) = addr_rid(H)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/single_client/tilelink_concrete_spec.ivy#L861)); `conjecture (excl_a(H1) | excl_f(H1) | shrd_a(H1) | shrd_f(H1) | unc_a(H1,W1) | unc_f(H1,W1))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/single_client/tilelink_concrete_spec.ivy#L865)); `conjecture (excl_r(H1) | shrd_r(H1) | unc_r(H1,W1))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/single_client/tilelink_concrete_spec.ivy#L873)); `conjecture none_r(H1,W1) & none_r(H2,W2)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/single_client/tilelink_concrete_spec.ivy#L881))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "1260 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/single_client/tilelink_concrete_spec.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/single_client/tilelink_concrete_spec.ivy#L779", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "tilelink_two_port_tester (examples/tilelink/unit_test/single_client/tilelink_two_port_tester.ivy)", "specifies": "TileLink cache coherence", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "262 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/single_client/tilelink_two_port_tester.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/single_client/tilelink_two_port_tester.ivy", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "tilelink_abstract_spec (examples/tilelink/unit_test/tilelink_abstract_spec.ivy)", "specifies": "TileLink cache coherence", "safety": "`conjecture dirt_p(C,A) -> excl_p(C,A)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/tilelink_abstract_spec.ivy#L422)); `conjecture (excl_p(C,A) | shrd_p(C,A)) -> cached(C,A)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/tilelink_abstract_spec.ivy#L426)); `conjecture ~(ref.prevents(T1,T2) & ~to_ser(T1) & to_ser(T2))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/tilelink_abstract_spec.ivy#L435)); `conjecture to_ser(T) -> side(ref.evs(T).id_) = client` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/tilelink_abstract_spec.ivy#L439))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "504 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/tilelink_abstract_spec.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/tilelink_abstract_spec.ivy#L422", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "tilelink_coherence_manager_tester (examples/tilelink/unit_test/tilelink_coherence_manager_tester.ivy)", "specifies": "TileLink cache coherence", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "351 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/tilelink_coherence_manager_tester.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/tilelink_coherence_manager_tester.ivy", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "tilelink_concrete_spec (examples/tilelink/unit_test/tilelink_concrete_spec.ivy)", "specifies": "TileLink cache coherence", "safety": "`conjecture (excl_r(C,H) | excl_a(C,H) | excl_f(C,H) |` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/tilelink_concrete_spec.ivy#L895)); `conjecture (unc_r(C,H,L) | unc_a(C,H,L) | unc_f(C,H,L)) -> ~cached_hi(C,H)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/tilelink_concrete_spec.ivy#L897)); `conjecture ~(excl_r(C,H) & excl_a(C,H)) & ~(excl_r(C,H) & excl_f(C,H)) & ~(excl_a(C,H) & excl_f(C,H))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/tilelink_concrete_spec.ivy#L902)); `conjecture ~(shrd_r(C,H) & shrd_a(C,H)) & ~(shrd_r(C,H) & shrd_f(C,H)) & ~(shrd_a(C,H) & shrd_f(C,H))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/tilelink_concrete_spec.ivy#L903)); `conjecture ~unc_a(C,H,L)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/tilelink_concrete_spec.ivy#L907)); `conjecture excl_a(C,H) -> exists W. ~excl_p(C,addr_cons(H,W))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/tilelink_concrete_spec.ivy#L911)); `conjecture shrd_a(C,H) -> exists W. ~shrd_p(C,addr_cons(H,W))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/tilelink_concrete_spec.ivy#L912)); `conjecture none_r(C,H,W) -> cached_hi(C,H)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/tilelink_concrete_spec.ivy#L916)); `conjecture none_r(C,H,W) -> ~excl_r(C,H) & ~excl_a(C,H) & ~shrd_r(C,H) & ~shrd_a(C,H)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/tilelink_concrete_spec.ivy#L921)); `conjecture none_r(C,H,W) & A = addr_cons(H,W) -> ~excl_p(C,A) & ~shrd_p(C,A)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/tilelink_concrete_spec.ivy#L925)); `conjecture prb_addr(C,H,W) -> cached_hi(C,H)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/tilelink_concrete_spec.ivy#L929)); `conjecture excl_f(C,H) & ~none_r(C,H,W) -> excl_p(C,addr_cons(H,W))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/tilelink_concrete_spec.ivy#L933)); `conjecture shrd_f(C,H) & ~none_r(C,H,W) -> shrd_p(C,addr_cons(H,W))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/tilelink_concrete_spec.ivy#L934)); `conjecture prb_addr(C,H,W) -> ~excl_a(C,H) & ~excl_f(C,H) & ~shrd_a(C,H) & ~shrd_f(C,H)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/tilelink_concrete_spec.ivy#L938)); `conjecture excl_r(C,H) & ~none_r(C,H,W) & ~prb_addr(C,H,W) -> ~excl_p(C,addr_cons(H,W))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/tilelink_concrete_spec.ivy#L943)); `conjecture shrd_r(C,H) & ~none_r(C,H,W) & ~prb_addr(C,H,W) -> ~shrd_p(C,addr_cons(H,W))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/tilelink_concrete_spec.ivy#L944)); `conjecture granted(E) -> ref.evs(E).serialized` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/tilelink_concrete_spec.ivy#L948)); `conjecture granted(E) -> to_ser(E)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/tilelink_concrete_spec.ivy#L952)); `conjecture ~(to_ser(E1) & to_ser(E2) & ~granted(E1) & ~granted(E2) & E1 ~= E2 &` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/tilelink_concrete_spec.ivy#L963)); `conjecture ~(to_ser(E1) & to_ser(E2) & ~granted(E1) & ~granted(E2) & E1 ~= E2  &` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/tilelink_concrete_spec.ivy#L972)); `conjecture (excl_a(C,H) | shrd_a(C,H) | unc_a(C,H,W)) -> addr_gid(C,H) = addr_rid(C,H)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/tilelink_concrete_spec.ivy#L978)); `conjecture (excl_a(C,H1) | excl_f(C,H1) | shrd_a(C,H1) | shrd_f(C,H1) | unc_a(C,H1,W1) | unc_f(C,H1,W1))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/tilelink_concrete_spec.ivy#L982)); `conjecture (excl_r(C,H1) | shrd_r(C,H1) | unc_r(C,H1,W1))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/tilelink_concrete_spec.ivy#L990)); `conjecture none_r(C,H1,W1) & none_r(C,H2,W2)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/tilelink_concrete_spec.ivy#L998))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "1400 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/tilelink_concrete_spec.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/examples/tilelink/unit_test/tilelink_concrete_spec.ivy#L895", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "client_server_mc (test/client_server_mc.ivy)", "specifies": "client/server request protocol", "safety": "`invariant [safety] ~(x ~= z & link(x,y) & link(z,y))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/client_server_mc.ivy#L30))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun; model-checking variant indicated by filename", "size": "38 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/client_server_mc.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/client_server_mc.ivy#L30", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "client_server_mc2 (test/client_server_mc2.ivy)", "specifies": "client/server request protocol", "safety": "`invariant [safety] ~(X ~= Z & link(X,Y) & link(Z,Y))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/client_server_mc2.ivy#L28))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun; model-checking variant indicated by filename", "size": "36 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/client_server_mc2.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/client_server_mc2.ivy#L28", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "client_server_mc3 (test/client_server_mc3.ivy)", "specifies": "client/server request protocol", "safety": "`invariant [safety] ~(X ~= Z & link(X,Y) & link(Z,Y))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/client_server_mc3.ivy#L30))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun; model-checking variant indicated by filename", "size": "60 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/client_server_mc3.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/client_server_mc3.ivy#L30", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "client_server_mc_finite1 (test/client_server_mc_finite1.ivy)", "specifies": "client/server request protocol", "safety": "`invariant [safety] ~(X ~= Z & link(X,Y) & link(Z,Y))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/client_server_mc_finite1.ivy#L27))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun; model-checking variant indicated by filename", "size": "36 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/client_server_mc_finite1.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/client_server_mc_finite1.ivy#L27", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "disk_token_ring (test/disk_token_ring.ivy)", "specifies": "ring protocol", "safety": "`invariant proto(X).token & proto(Y).token -> X = Y` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/disk_token_ring.ivy#L254))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "272 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/disk_token_ring.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/disk_token_ring.ivy#L254", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "fba (test/fba.ivy)", "specifies": "Stellar federated Byzantine agreement", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "206 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/fba.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/fba.ivy", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "flash (test/flash.ivy)", "specifies": "FLASH cache coherence", "safety": "`invariant [coherent] cache(X).state = exclusive -> X = real_owner` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/flash.ivy#L482))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "498 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/flash.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/flash.ivy#L482", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "flash.save (test/flash.save.ivy)", "specifies": "FLASH cache coherence", "safety": "`invariant [coherent] cache(X).state = exclusive -> X = real_owner` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/flash.save.ivy#L468))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "492 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/flash.save.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/flash.save.ivy#L468", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "flash2 (test/flash2.ivy)", "specifies": "FLASH cache coherence", "safety": "`invariant [coherent1] cache(X).state = exclusive -> X = real_owner` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/flash2.ivy#L489))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "575 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/flash2.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/flash2.ivy#L489", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "flash2_finite_mc (test/flash2_finite_mc.ivy)", "specifies": "FLASH cache coherence", "safety": "`invariant [coherent2] cache(X).state = shared & ~cache.invmarked(X) & ~dir.pending -> real_owner = home & cache.state(home) ~= exclusive` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/flash2_finite_mc.ivy#L485))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun; model-checking variant indicated by filename", "size": "490 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/flash2_finite_mc.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/flash2_finite_mc.ivy#L485", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "flash2_mc (test/flash2_mc.ivy)", "specifies": "FLASH cache coherence", "safety": "`invariant [coherent] cache(X).state = exclusive -> X = real_owner` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/flash2_mc.ivy#L482))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun; model-checking variant indicated by filename", "size": "517 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/flash2_mc.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/flash2_mc.ivy#L482", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "flash_cubicle (test/flash_cubicle.ivy)", "specifies": "FLASH cache coherence", "safety": "`invariant ~(cache(home).state = exclusive &` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/flash_cubicle.ivy#L470))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "594 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/flash_cubicle.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/flash_cubicle.ivy#L470", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "flash_mc (test/flash_mc.ivy)", "specifies": "FLASH cache coherence", "safety": "`invariant [coherent] cache(X).state = exclusive -> X = real_owner` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/flash_mc.ivy#L468))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun; model-checking variant indicated by filename", "size": "560 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/flash_mc.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/flash_mc.ivy#L468", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "ibm-cache-N (test/ibm-cache-N.ivy)", "specifies": "cache/memory coherence", "safety": "`invariant forall C1, C2. C1 ~= C2 & s.cache(C1) = exclusive -> s.cache(C2) = invalid` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/ibm-cache-N.ivy#L113))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "143 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/ibm-cache-N.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/ibm-cache-N.ivy#L113", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "ibm-cache-N_mc (test/ibm-cache-N_mc.ivy)", "specifies": "cache/memory coherence", "safety": "`invariant forall C1, C2. C1 ~= C2 & s.cache(C1) = exclusive -> s.cache(C2) = invalid` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/ibm-cache-N_mc.ivy#L113))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun; model-checking variant indicated by filename", "size": "131 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/ibm-cache-N_mc.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/ibm-cache-N_mc.ivy#L113", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "ibm-cache-N_mc_error (test/ibm-cache-N_mc_error.ivy)", "specifies": "cache/memory coherence", "safety": "`invariant forall C1, C2. C1 ~= C2 & s.cache(C1) = exclusive -> s.cache(C2) = invalid` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/ibm-cache-N_mc_error.ivy#L113))", "liveness": "no active temporal/progress declaration found in this file", "negative-test_warning": "the filename marks this as a bad/buggy/unsafe/error variant; displayed properties are attempted checks, not established guarantees", "tool": "Ivy; specification/invariant obligations present; checker success not rerun; model-checking variant indicated by filename", "size": "131 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/ibm-cache-N_mc_error.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/ibm-cache-N_mc_error.ivy#L113", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "ibm-cache-finite_mc (test/ibm-cache-finite_mc.ivy)", "specifies": "cache/memory coherence", "safety": "`invariant forall C1, C2. C1 ~= C2 & s.cache(C1) = exclusive -> s.cache(C2) = invalid` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/ibm-cache-finite_mc.ivy#L113))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun; model-checking variant indicated by filename", "size": "129 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/ibm-cache-finite_mc.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/ibm-cache-finite_mc.ivy#L113", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "leader_election_ring_repl (test/leader_election_ring_repl.ivy)", "specifies": "leader election", "safety": "`conjecture ~(asgn.pid(N) < asgn.pid(P) & trans.sent(asgn.pid(N),N))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/leader_election_ring_repl.ivy#L157)); `conjecture ~(asgn.pid(P) < asgn.pid(Q) & N:node.t < P & P < Q & trans.sent(asgn.pid(P),N))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/leader_election_ring_repl.ivy#L158)); `conjecture ~(asgn.pid(N) < asgn.pid(P) & N < P & P < Q & trans.sent(asgn.pid(N),Q))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/leader_election_ring_repl.ivy#L159)); `conjecture ~(asgn.pid(Q) < asgn.pid(N) & N < P & P < Q & trans.sent(asgn.pid(Q),P))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/leader_election_ring_repl.ivy#L160))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "191 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/leader_election_ring_repl.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/leader_election_ring_repl.ivy#L157", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "learning_switch1 (test/learning_switch1.ivy)", "specifies": "learning network switch", "safety": "`conjecture tc(X,X)                          # Reflexivity` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/learning_switch1.ivy#L24)); `conjecture tc(X, Y) & tc(Y, Z) -> tc(X, Z)  # Transitivity` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/learning_switch1.ivy#L25)); `conjecture tc(X, Y) & tc(Y, X) -> X = Y     # Anti-symmetry` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/learning_switch1.ivy#L26)); `conjecture tc(X, Y) & tc(X, Z) -> (tc(Y, Z) | tc(Z, Y)) # Semi-linearity` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/learning_switch1.ivy#L27)); `conjecture ~(route.tc(N1,N1,N0) & N1 ~= N0)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/learning_switch1.ivy#L117)); `conjecture ~(route.tc(N2,N0,N2) & N0 ~= N2 & ~route.dom(N2,N0))  # this is actually not needed` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/learning_switch1.ivy#L118)); `conjecture ~(route.tc(N0,N2,N1) & N1 ~= N2 & ~route.dom(N0,N2))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/learning_switch1.ivy#L119)); `conjecture ~(route.tc(N2,N1,N0) & N0 ~= N2 & N1 ~= N0 & ~route.dom(N2,N0))` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/learning_switch1.ivy#L120))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "121 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/learning_switch1.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/learning_switch1.ivy#L24", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "paxos-fol (test/paxos-fol.ivy)", "specifies": "Paxos consensus variant", "safety": "`conjecture ( decision(N1,R1,V1) &` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/paxos-fol.ivy#L126)); `conjecture proposal(R,V1) & proposal(R,V2) -> V1 = V2` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/paxos-fol.ivy#L132)); `conjecture vote(N,R,V) -> proposal(R,V)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/paxos-fol.ivy#L135)); `conjecture forall R:round, V:value. (exists N:node. decision(N,R,V)) -> exists Q:quorum. forall N:node. member(N, Q) -> vote(N,R,V)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/paxos-fol.ivy#L138)); `conjecture one_b_max_vote(N,R2,none,V1) & ~le(R2,R1) -> ~vote(N,R1,V2)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/paxos-fol.ivy#L141)); `conjecture one_b_max_vote(N,R,RMAX,V) & RMAX ~= none -> ~le(R,RMAX) & vote(N,RMAX,V)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/paxos-fol.ivy#L142)); `conjecture one_b_max_vote(N,R,RMAX,V) & RMAX ~= none & ~le(R,ROTHER) & ~le(ROTHER,RMAX) -> ~vote(N,ROTHER,VOTHER)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/paxos-fol.ivy#L143)); `conjecture ~vote(N,none,V)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/paxos-fol.ivy#L146)); `conjecture forall R1:round, R2:round, V1:value, V2:value, Q:quorum. ~le(R2,R1) & proposal(R2,V2) & V1 ~= V2 ->` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/paxos-fol.ivy#L149))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "154 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/paxos-fol.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/paxos-fol.ivy#L126", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "toy_consensus_mc (test/toy_consensus_mc.ivy)", "specifies": "consensus/agreement protocol", "safety": "`invariant [majorities_intersect] (majority(S) & majority(T)) -> exists N. member(N,S) & member(N,T)` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/toy_consensus_mc.ivy#L32))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun; model-checking variant indicated by filename", "size": "302 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/toy_consensus_mc.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/toy_consensus_mc.ivy#L32", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "vsync_paxos (test/vsync_paxos.ivy)", "specifies": "Paxos consensus variant", "safety": "`require s ~= 0;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/vsync_paxos.ivy#L91)); `require s ~= 0;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/vsync_paxos.ivy#L96)); `require started(e,n);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/vsync_paxos.ivy#L97))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; proof/isolation/refinement structure present; checker success not rerun", "size": "283 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/vsync_paxos.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/vsync_paxos.ivy#L91", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "vsync_paxos_save (test/vsync_paxos_save.ivy)", "specifies": "Paxos consensus variant", "safety": "`require s ~= 0;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/vsync_paxos_save.ivy#L89)); `require s ~= 0;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/vsync_paxos_save.ivy#L94)); `require started(e,n);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/vsync_paxos_save.ivy#L95))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "407 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/vsync_paxos_save.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/vsync_paxos_save.ivy#L89", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "vsync_paxos_temp (test/vsync_paxos_temp.ivy)", "specifies": "Paxos consensus variant", "safety": "`require s ~= 0;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/vsync_paxos_temp.ivy#L89)); `require s ~= 0;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/vsync_paxos_temp.ivy#L94)); `require started(e,n);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/vsync_paxos_temp.ivy#L95))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "403 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/vsync_paxos_temp.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/vsync_paxos_temp.ivy#L89", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: kenmcmil/ivy source cases", "name": "vsync_paxos_test (test/vsync_paxos_test.ivy)", "specifies": "Paxos consensus variant", "safety": "`require s ~= 0;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/vsync_paxos_test.ivy#L89)); `require s ~= 0;` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/vsync_paxos_test.ivy#L94)); `require started(e,n);` ([source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/vsync_paxos_test.ivy#L95))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Ivy; specification/invariant obligations present; checker success not rerun", "size": "405 lines in this file; [exact source](https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/vsync_paxos_test.ivy)", "source_url": "https://github.com/kenmcmil/ivy/blob/8858a0241ed37141757b7a051acc24c58e49c2f3/test/vsync_paxos_test.ivy#L89", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: DuoAI benchmark inputs", "name": "chord_ring_maintenance (protocols/chord_ring_maintenance/chord_ring_maintenance.ivy)", "specifies": "ring protocol", "safety": "`invariant [1000000] ~error(N)` ([source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/chord_ring_maintenance/chord_ring_maintenance.ivy#L147))", "liveness": "no active temporal/progress declaration found in this file", "tool": "DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "147 lines in this file; [exact source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/chord_ring_maintenance/chord_ring_maintenance.ivy)", "source_url": "https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/chord_ring_maintenance/chord_ring_maintenance.ivy#L147", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: DuoAI benchmark inputs", "name": "client_server_ae (protocols/client_server_ae/client_server_ae.ivy)", "specifies": "client/server request protocol", "safety": "`invariant [1000000] forall N,P. response_received(N,P) -> exists R. request_sent(N,R) & match(R,P)` ([source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/client_server_ae/client_server_ae.ivy#L39))", "liveness": "no active temporal/progress declaration found in this file", "tool": "DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "39 lines in this file; [exact source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/client_server_ae/client_server_ae.ivy)", "source_url": "https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/client_server_ae/client_server_ae.ivy#L39", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: DuoAI benchmark inputs", "name": "client_server_db_ae (protocols/client_server_db_ae/client_server_db_ae.ivy)", "specifies": "client/server request protocol", "safety": "`invariant [1000000] forall N,P. response_received(N,P) -> exists R. request_sent(N,R) & match(R,P)` ([source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/client_server_db_ae/client_server_db_ae.ivy#L63))", "liveness": "no active temporal/progress declaration found in this file", "tool": "DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "63 lines in this file; [exact source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/client_server_db_ae/client_server_db_ae.ivy)", "source_url": "https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/client_server_db_ae/client_server_db_ae.ivy#L63", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: DuoAI benchmark inputs", "name": "consensus_epr (protocols/consensus_epr/consensus_epr.ivy)", "specifies": "consensus/agreement protocol", "safety": "`invariant [1000000] decided(N1, V1) & decided(N2, V2) -> V1 = V2` ([source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/consensus_epr/consensus_epr.ivy#L67))", "liveness": "no active temporal/progress declaration found in this file", "tool": "DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "67 lines in this file; [exact source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/consensus_epr/consensus_epr.ivy)", "source_url": "https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/consensus_epr/consensus_epr.ivy#L67", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: DuoAI benchmark inputs", "name": "consensus_forall (protocols/consensus_forall/consensus_forall.ivy)", "specifies": "consensus/agreement protocol", "safety": "`invariant [1000000] decided(N1, V1) & decided(N2, V2) -> V1 = V2` ([source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/consensus_forall/consensus_forall.ivy#L74))", "liveness": "no active temporal/progress declaration found in this file", "tool": "DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "81 lines in this file; [exact source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/consensus_forall/consensus_forall.ivy)", "source_url": "https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/consensus_forall/consensus_forall.ivy#L74", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: DuoAI benchmark inputs", "name": "consensus_wo_decide (protocols/consensus_wo_decide/consensus_wo_decide.ivy)", "specifies": "consensus/agreement protocol", "safety": "`invariant [1000000] leader(N1) & leader(N2) -> N1 = N2` ([source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/consensus_wo_decide/consensus_wo_decide.ivy#L63))", "liveness": "no active temporal/progress declaration found in this file", "tool": "DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "68 lines in this file; [exact source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/consensus_wo_decide/consensus_wo_decide.ivy)", "source_url": "https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/consensus_wo_decide/consensus_wo_decide.ivy#L63", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: DuoAI benchmark inputs", "name": "database_chain_replication (protocols/database_chain_replication/database_chain_replication.ivy)", "specifies": "chain-replicated database", "safety": "`invariant [1000000] (~(TX1 ~= TX2 & commit_tx(TX1) & commit_tx(TX2)  & le(TX1,TX2) & write_tx(TX1, K) & depends_tx(TX2, K, T3) & ~le(TX1, T3))) &` ([source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/database_chain_replication/database_chain_replication.ivy#L159))", "liveness": "no active temporal/progress declaration found in this file", "tool": "DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "160 lines in this file; [exact source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/database_chain_replication/database_chain_replication.ivy)", "source_url": "https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/database_chain_replication/database_chain_replication.ivy#L159", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: DuoAI benchmark inputs", "name": "decentralized_lock (protocols/decentralized_lock/decentralized_lock.ivy)", "specifies": "lock protocol", "safety": "`invariant [1000000] X ~= Y -> ~(has_lock(X) & has_lock(Y))` ([source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/decentralized_lock/decentralized_lock.ivy#L32))", "liveness": "no active temporal/progress declaration found in this file", "tool": "DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "32 lines in this file; [exact source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/decentralized_lock/decentralized_lock.ivy)", "source_url": "https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/decentralized_lock/decentralized_lock.ivy#L32", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: DuoAI benchmark inputs", "name": "distributed_lock (protocols/distributed_lock/distributed_lock.ivy)", "specifies": "lock protocol", "safety": "`invariant [1000000] locked(E, N1) & locked(E, N2) -> N1 = N2` ([source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/distributed_lock/distributed_lock.ivy#L85))", "liveness": "no active temporal/progress declaration found in this file", "tool": "DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "85 lines in this file; [exact source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/distributed_lock/distributed_lock.ivy)", "source_url": "https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/distributed_lock/distributed_lock.ivy#L85", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: DuoAI benchmark inputs", "name": "fast_paxos (protocols/fast_paxos/fast_paxos.ivy)", "specifies": "Paxos consensus variant", "safety": "`invariant [1000000] decision(N1,R1,V1) & decision(N2,R2,V2) -> V1 = V2` ([source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/fast_paxos/fast_paxos.ivy#L163))", "liveness": "no active temporal/progress declaration found in this file", "tool": "DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "163 lines in this file; [exact source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/fast_paxos/fast_paxos.ivy)", "source_url": "https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/fast_paxos/fast_paxos.ivy#L163", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: DuoAI benchmark inputs", "name": "flexible_paxos (protocols/flexible_paxos/flexible_paxos.ivy)", "specifies": "Paxos consensus variant", "safety": "`invariant [1000000] (decision(N1,R1,V1) & decision(N2,R2,V2)) -> V1 = V2` ([source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/flexible_paxos/flexible_paxos.ivy#L129))", "liveness": "no active temporal/progress declaration found in this file", "tool": "DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "129 lines in this file; [exact source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/flexible_paxos/flexible_paxos.ivy)", "source_url": "https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/flexible_paxos/flexible_paxos.ivy#L129", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: DuoAI benchmark inputs", "name": "hybrid_reliable_broadcast (protocols/hybrid_reliable_broadcast/hybrid_reliable_broadcast.ivy)", "specifies": "reliable broadcast", "safety": "`invariant [1000000] (exists N. ~member_fs(N) & ~member_fa(N) & accept(N)) -> (exists M. ~member_fs(M) & ~member_fa(M) & rcv_init(M))` ([source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/hybrid_reliable_broadcast/hybrid_reliable_broadcast.ivy#L207))", "liveness": "no active temporal/progress declaration found in this file", "tool": "DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "207 lines in this file; [exact source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/hybrid_reliable_broadcast/hybrid_reliable_broadcast.ivy)", "source_url": "https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/hybrid_reliable_broadcast/hybrid_reliable_broadcast.ivy#L207", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: DuoAI benchmark inputs", "name": "learning_switch_quad (protocols/learning_switch_quad/learning_switch_quad.ivy)", "specifies": "learning network switch", "safety": "`invariant [1000000] (forall T, X. table(T,X,X)) & (forall T, X, Y, Z. table(T,X,Y) & table(T,Y,Z) -> table(T,X,Z)) & (forall T, X, Y. table(T,X,Y) & table(T,Y,X) -> X = Y) & (forall T, X, Y, Z. table(T,X,Y) & table(T,X,Z) -> table(T,Y,Z) | table(T,Z,Y))` ([source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/learning_switch_quad/learning_switch_quad.ivy#L33))", "liveness": "no active temporal/progress declaration found in this file", "tool": "DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "48 lines in this file; [exact source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/learning_switch_quad/learning_switch_quad.ivy)", "source_url": "https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/learning_switch_quad/learning_switch_quad.ivy#L33", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: DuoAI benchmark inputs", "name": "learning_switch_ternary (protocols/learning_switch_ternary/learning_switch_ternary.ivy)", "specifies": "learning network switch", "safety": "`invariant [1000000] route_tc(N, X, X) & (route_tc(N, X, Y) & route_tc(N, Y, Z) -> route_tc(N, X, Z)) & (route_tc(N, X, Y) & route_tc(N, Y, X) -> X = Y) & (route_tc(N, X, Y) & route_tc(N, X, Z) -> (route_tc(N, Y, Z) | route_tc(N, Z, Y)))` ([source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/learning_switch_ternary/learning_switch_ternary.ivy#L63))", "liveness": "no active temporal/progress declaration found in this file", "tool": "DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "64 lines in this file; [exact source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/learning_switch_ternary/learning_switch_ternary.ivy)", "source_url": "https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/learning_switch_ternary/learning_switch_ternary.ivy#L63", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: DuoAI benchmark inputs", "name": "lock_server_async (protocols/lock_server_async/lock_server_async.ivy)", "specifies": "lock protocol", "safety": "`invariant [1000000] holds_lock(N1, L) & holds_lock(N2, L) -> N1 = N2` ([source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/lock_server_async/lock_server_async.ivy#L57))", "liveness": "no active temporal/progress declaration found in this file", "tool": "DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "57 lines in this file; [exact source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/lock_server_async/lock_server_async.ivy)", "source_url": "https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/lock_server_async/lock_server_async.ivy#L57", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: DuoAI benchmark inputs", "name": "lock_server_sync (protocols/lock_server_sync/lock_server_sync.ivy)", "specifies": "lock protocol", "safety": "`invariant [1000000] link(C1, S) & link(C2, S) -> C1 = C2` ([source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/lock_server_sync/lock_server_sync.ivy#L29))", "liveness": "no active temporal/progress declaration found in this file", "tool": "DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "29 lines in this file; [exact source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/lock_server_sync/lock_server_sync.ivy)", "source_url": "https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/lock_server_sync/lock_server_sync.ivy#L29", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: DuoAI benchmark inputs", "name": "multi_paxos (protocols/multi_paxos/multi_paxos.ivy)", "specifies": "Paxos consensus variant", "safety": "`invariant [1000000] decision(N1,I,R1,V1) & decision(N2,I,R2,V2) -> V1 = V2` ([source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/multi_paxos/multi_paxos.ivy#L149))", "liveness": "no active temporal/progress declaration found in this file", "tool": "DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "149 lines in this file; [exact source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/multi_paxos/multi_paxos.ivy)", "source_url": "https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/multi_paxos/multi_paxos.ivy#L149", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: DuoAI benchmark inputs", "name": "paxos (protocols/paxos/paxos.ivy)", "specifies": "Paxos consensus variant", "safety": "`invariant [1000000] (decision(N1,R1,V1) & decision(N2,R2,V2)) -> V1 = V2` ([source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/paxos/paxos.ivy#L124))", "liveness": "no active temporal/progress declaration found in this file", "tool": "DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "124 lines in this file; [exact source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/paxos/paxos.ivy)", "source_url": "https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/paxos/paxos.ivy#L124", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: DuoAI benchmark inputs", "name": "ring_leader_election (protocols/ring_leader_election/ring_leader_election.ivy)", "specifies": "leader election", "safety": "`invariant [1000000] forall X: node, Y:node. leader(X) & leader(Y) -> X = Y  # at most one leader` ([source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/ring_leader_election/ring_leader_election.ivy#L108))", "liveness": "no active temporal/progress declaration found in this file", "tool": "DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "108 lines in this file; [exact source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/ring_leader_election/ring_leader_election.ivy)", "source_url": "https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/ring_leader_election/ring_leader_election.ivy#L108", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: DuoAI benchmark inputs", "name": "sharded_key_value_store (protocols/sharded_key_value_store/sharded_key_value_store.ivy)", "specifies": "sharded key-value storage", "safety": "`invariant [1000000] table(N1, K, V1) & table(N2, K, V2) -> N1 = N2 & V1 = V2` ([source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/sharded_key_value_store/sharded_key_value_store.ivy#L44))", "liveness": "no active temporal/progress declaration found in this file", "tool": "DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "50 lines in this file; [exact source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/sharded_key_value_store/sharded_key_value_store.ivy)", "source_url": "https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/sharded_key_value_store/sharded_key_value_store.ivy#L44", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: DuoAI benchmark inputs", "name": "sharded_kv_no_lost_keys (protocols/sharded_kv_no_lost_keys/sharded_kv_no_lost_keys.ivy)", "specifies": "sharded key-value storage", "safety": "`invariant [1000000] (exists N,K,V. transfer_msg(N,K,V)) | (forall K. exists N. owner(N,K))` ([source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/sharded_kv_no_lost_keys/sharded_kv_no_lost_keys.ivy#L43))", "liveness": "no active temporal/progress declaration found in this file", "tool": "DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "43 lines in this file; [exact source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/sharded_kv_no_lost_keys/sharded_kv_no_lost_keys.ivy)", "source_url": "https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/sharded_kv_no_lost_keys/sharded_kv_no_lost_keys.ivy#L43", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: DuoAI benchmark inputs", "name": "stoppable_paxos (protocols/stoppable_paxos/stoppable_paxos.ivy)", "specifies": "Paxos consensus variant", "safety": "`invariant [1000000] decision(N1,I1,R1,VA1) & decision(N2,I1,R2,VA2) -> VA1 = VA2` ([source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/stoppable_paxos/stoppable_paxos.ivy#L186))", "liveness": "no active temporal/progress declaration found in this file", "tool": "DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "186 lines in this file; [exact source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/stoppable_paxos/stoppable_paxos.ivy)", "source_url": "https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/stoppable_paxos/stoppable_paxos.ivy#L186", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: DuoAI benchmark inputs", "name": "ticket_lock (protocols/ticket_lock/ticket_lock.ivy)", "specifies": "lock protocol", "safety": "`invariant [1000000] pc3(T1) & pc3(T2) -> T1 = T2` ([source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/ticket_lock/ticket_lock.ivy#L70))", "liveness": "no active temporal/progress declaration found in this file", "tool": "DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "70 lines in this file; [exact source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/ticket_lock/ticket_lock.ivy)", "source_url": "https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/ticket_lock/ticket_lock.ivy#L70", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: DuoAI benchmark inputs", "name": "toy_consensus_epr (protocols/toy_consensus_epr/toy_consensus_epr.ivy)", "specifies": "consensus/agreement protocol", "safety": "`invariant [1000000] decided(V1) & decided(V2) -> V1 = V2` ([source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/toy_consensus_epr/toy_consensus_epr.ivy#L34))", "liveness": "no active temporal/progress declaration found in this file", "tool": "DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "34 lines in this file; [exact source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/toy_consensus_epr/toy_consensus_epr.ivy)", "source_url": "https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/toy_consensus_epr/toy_consensus_epr.ivy#L34", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: DuoAI benchmark inputs", "name": "toy_consensus_forall (protocols/toy_consensus_forall/toy_consensus_forall.ivy)", "specifies": "consensus/agreement protocol", "safety": "`invariant [1000000] (decided(V1) & decided(V2) -> V1 = V2)` ([source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/toy_consensus_forall/toy_consensus_forall.ivy#L38))", "liveness": "no active temporal/progress declaration found in this file", "tool": "DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "43 lines in this file; [exact source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/toy_consensus_forall/toy_consensus_forall.ivy)", "source_url": "https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/toy_consensus_forall/toy_consensus_forall.ivy#L38", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: DuoAI benchmark inputs", "name": "two_phase_commit (protocols/two_phase_commit/two_phase_commit.ivy)", "specifies": "two-phase atomic commit", "safety": "`invariant [1000000] (decide_commit(N0) -> ~decide_abort(N1)) & (decide_commit(N0) -> vote_yes(N1)) & (decide_abort(N0) -> abort_flag)` ([source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/two_phase_commit/two_phase_commit.ivy#L97))", "liveness": "no active temporal/progress declaration found in this file", "tool": "DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "97 lines in this file; [exact source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/two_phase_commit/two_phase_commit.ivy)", "source_url": "https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/two_phase_commit/two_phase_commit.ivy#L97", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: DuoAI benchmark inputs", "name": "vertical_paxos (protocols/vertical_paxos/vertical_paxos.ivy)", "specifies": "Paxos consensus variant", "safety": "`invariant [1000000] (decision(N1,R1,V1) & decision(N2,R2,V2)) -> V1 = V2` ([source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/vertical_paxos/vertical_paxos.ivy#L165))", "liveness": "no active temporal/progress declaration found in this file", "tool": "DuoAI invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "165 lines in this file; [exact source](https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/vertical_paxos/vertical_paxos.ivy)", "source_url": "https://github.com/VeriGu/DuoAI/blob/ecd37c418ef56202ca332d5bca113e8e7c8c8fac/protocols/vertical_paxos/vertical_paxos.ivy#L165", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: DistAI benchmark inputs and generated invariant files", "name": "Ricart-Agrawala (protocols/Ricart-Agrawala/Ricart-Agrawala.ivy)", "specifies": "Ricart–Agrawala mutual exclusion", "safety": "`invariant [1000000] holds(N1) & holds(N2) -> N1 = N2` ([source](https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/protocols/Ricart-Agrawala/Ricart-Agrawala.ivy#L48))", "liveness": "no active temporal/progress declaration found in this file", "tool": "DistAI input / Ivy invariant synthesis; generated invariant artifact [source](https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/outputs/Ricart-Agrawala/Ricart-Agrawala_inv.ivy) (54 lines); checker success not rerun", "size": "48 lines in this file; [exact source](https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/protocols/Ricart-Agrawala/Ricart-Agrawala.ivy)", "source_url": "https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/protocols/Ricart-Agrawala/Ricart-Agrawala.ivy#L48", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: DistAI benchmark inputs and generated invariant files", "name": "blockchain (protocols/blockchain/blockchain.ivy)", "specifies": "blockchain protocol", "safety": "`invariant [1000000] (honest(N1) & honest(N2) -> (block_confirmed(N1,B,T) & block_confirmed(N2,B,T)) | (~block_confirmed(N1,B,T) & ~block_confirmed(N2,B,T)))` ([source](https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/protocols/blockchain/blockchain.ivy#L90))", "liveness": "no active temporal/progress declaration found in this file", "tool": "DistAI input / Ivy invariant synthesis; generated invariant artifact [source](https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/outputs/blockchain/blockchain_inv.ivy) (105 lines); checker success not rerun", "size": "92 lines in this file; [exact source](https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/protocols/blockchain/blockchain.ivy)", "source_url": "https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/protocols/blockchain/blockchain.ivy#L90", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: DistAI benchmark inputs and generated invariant files", "name": "chord (protocols/chord/chord.ivy)", "specifies": "Chord ring maintenance", "safety": "`invariant [1000000] ~error(N)` ([source](https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/protocols/chord/chord.ivy#L147))", "liveness": "no active temporal/progress declaration found in this file", "tool": "DistAI input / Ivy invariant synthesis; generated invariant artifact [source](https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/outputs/chord/chord_inv.ivy) (310 lines); checker success not rerun", "size": "147 lines in this file; [exact source](https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/protocols/chord/chord.ivy)", "source_url": "https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/protocols/chord/chord.ivy#L147", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: DistAI benchmark inputs and generated invariant files", "name": "consensus (protocols/consensus/consensus.ivy)", "specifies": "consensus/agreement protocol", "safety": "`invariant [1000000] decided(N1, Q1, V1) & decided(N2, Q2, V2) -> V1 = V2` ([source](https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/protocols/consensus/consensus.ivy#L66))", "liveness": "no active temporal/progress declaration found in this file", "tool": "DistAI input / Ivy invariant synthesis; generated invariant artifact [source](https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/outputs/consensus/consensus_inv.ivy) (116 lines); checker success not rerun", "size": "66 lines in this file; [exact source](https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/protocols/consensus/consensus.ivy)", "source_url": "https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/protocols/consensus/consensus.ivy#L66", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: DistAI benchmark inputs and generated invariant files", "name": "database_chain_replication (protocols/database_chain_replication/database_chain_replication.ivy)", "specifies": "chain-replicated database", "safety": "`invariant [1000000] (~(TX1 ~= TX2 & commit_tx(TX1) & commit_tx(TX2)  & le(TX1,TX2) & write_tx(TX1, K) & depends_tx(TX2, K, T3) & ~le(TX1, T3))) &` ([source](https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/protocols/database_chain_replication/database_chain_replication.ivy#L159))", "liveness": "no active temporal/progress declaration found in this file", "tool": "DistAI input / Ivy invariant synthesis; generated invariant artifact [source](https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/outputs/database_chain_replication/database_chain_replication_inv.ivy) (184 lines); checker success not rerun", "size": "160 lines in this file; [exact source](https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/protocols/database_chain_replication/database_chain_replication.ivy)", "source_url": "https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/protocols/database_chain_replication/database_chain_replication.ivy#L159", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: DistAI benchmark inputs and generated invariant files", "name": "decentralized_lock (protocols/decentralized_lock/decentralized_lock.ivy)", "specifies": "lock protocol", "safety": "`invariant [1000000] X ~= Y -> ~(has_lock(X) & has_lock(Y))` ([source](https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/protocols/decentralized_lock/decentralized_lock.ivy#L32))", "liveness": "no active temporal/progress declaration found in this file", "tool": "DistAI input / Ivy invariant synthesis; generated invariant artifact [source](https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/outputs/decentralized_lock/decentralized_lock_inv.ivy) (48 lines); checker success not rerun", "size": "32 lines in this file; [exact source](https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/protocols/decentralized_lock/decentralized_lock.ivy)", "source_url": "https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/protocols/decentralized_lock/decentralized_lock.ivy#L32", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: DistAI benchmark inputs and generated invariant files", "name": "distributed_lock (protocols/distributed_lock/distributed_lock.ivy)", "specifies": "lock protocol", "safety": "`invariant [1000000] locked(E, N1) & locked(E, N2) -> N1 = N2` ([source](https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/protocols/distributed_lock/distributed_lock.ivy#L85))", "liveness": "no active temporal/progress declaration found in this file", "tool": "DistAI input / Ivy invariant synthesis; generated invariant artifact [source](https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/outputs/distributed_lock/distributed_lock_inv.ivy) (130 lines); checker success not rerun", "size": "85 lines in this file; [exact source](https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/protocols/distributed_lock/distributed_lock.ivy)", "source_url": "https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/protocols/distributed_lock/distributed_lock.ivy#L85", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: DistAI benchmark inputs and generated invariant files", "name": "leader (protocols/leader/leader.ivy)", "specifies": "leader election", "safety": "`invariant [1000000] forall X: node, Y:node. leader(X) & leader(Y) -> X = Y  # at most one leader` ([source](https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/protocols/leader/leader.ivy#L108))", "liveness": "no active temporal/progress declaration found in this file", "tool": "DistAI input / Ivy invariant synthesis; generated invariant artifact [source](https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/outputs/leader/leader_inv.ivy) (125 lines); checker success not rerun", "size": "108 lines in this file; [exact source](https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/protocols/leader/leader.ivy)", "source_url": "https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/protocols/leader/leader.ivy#L108", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: DistAI benchmark inputs and generated invariant files", "name": "lock_server (protocols/lock_server/lock_server.ivy)", "specifies": "lock protocol", "safety": "`invariant [1000000] link(C1, S) & link(C2, S) -> C1 = C2` ([source](https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/protocols/lock_server/lock_server.ivy#L29))", "liveness": "no active temporal/progress declaration found in this file", "tool": "DistAI input / Ivy invariant synthesis; generated invariant artifact [source](https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/outputs/lock_server/lock_server_inv.ivy) (30 lines); checker success not rerun", "size": "29 lines in this file; [exact source](https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/protocols/lock_server/lock_server.ivy)", "source_url": "https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/protocols/lock_server/lock_server.ivy#L29", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: DistAI benchmark inputs and generated invariant files", "name": "multi_lock_server (protocols/multi_lock_server/multi_lock_server.ivy)", "specifies": "lock protocol", "safety": "`invariant [1000000] holds_lock(N1, L) & holds_lock(N2, L) -> N1 = N2` ([source](https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/protocols/multi_lock_server/multi_lock_server.ivy#L57))", "liveness": "no active temporal/progress declaration found in this file", "tool": "DistAI input / Ivy invariant synthesis; generated invariant artifact [source](https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/outputs/multi_lock_server/multi_lock_server_inv.ivy) (69 lines); checker success not rerun", "size": "57 lines in this file; [exact source](https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/protocols/multi_lock_server/multi_lock_server.ivy)", "source_url": "https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/protocols/multi_lock_server/multi_lock_server.ivy#L57", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: DistAI benchmark inputs and generated invariant files", "name": "paxos (protocols/paxos/paxos.ivy)", "specifies": "Paxos consensus variant", "safety": "`invariant [1000000] (decision(N1,R1,V1) & decision(N2,R2,V2)) -> V1 = V2` ([source](https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/protocols/paxos/paxos.ivy#L158))", "liveness": "no active temporal/progress declaration found in this file", "tool": "DistAI input / Ivy invariant synthesis; no matching generated invariant artifact found", "size": "158 lines in this file; [exact source](https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/protocols/paxos/paxos.ivy)", "source_url": "https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/protocols/paxos/paxos.ivy#L158", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: DistAI benchmark inputs and generated invariant files", "name": "shard (protocols/shard/shard.ivy)", "specifies": "sharded key-value storage", "safety": "`invariant [1000000] table(N1, K, V1) & table(N2, K, V2) -> N1 = N2 & V1 = V2` ([source](https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/protocols/shard/shard.ivy#L41))", "liveness": "no active temporal/progress declaration found in this file", "tool": "DistAI input / Ivy invariant synthesis; generated invariant artifact [source](https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/outputs/shard/shard_inv.ivy) (56 lines); checker success not rerun", "size": "41 lines in this file; [exact source](https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/protocols/shard/shard.ivy)", "source_url": "https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/protocols/shard/shard.ivy#L41", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: DistAI benchmark inputs and generated invariant files", "name": "switch (protocols/switch/switch.ivy)", "specifies": "learning network switch", "safety": "`invariant [1000000] route_tc(N, X, X) & (route_tc(N, X, Y) & route_tc(N, Y, Z) -> route_tc(N, X, Z)) & (route_tc(N, X, Y) & route_tc(N, Y, X) -> X = Y) & (route_tc(N, X, Y) & route_tc(N, X, Z) -> (route_tc(N, Y, Z) | route_tc(N, Z, Y)))` ([source](https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/protocols/switch/switch.ivy#L63))", "liveness": "no active temporal/progress declaration found in this file", "tool": "DistAI input / Ivy invariant synthesis; generated invariant artifact [source](https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/outputs/switch/switch_inv.ivy) (135 lines); checker success not rerun", "size": "64 lines in this file; [exact source](https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/protocols/switch/switch.ivy)", "source_url": "https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/protocols/switch/switch.ivy#L63", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Ivy: DistAI benchmark inputs and generated invariant files", "name": "two_phase_commit (protocols/two_phase_commit/two_phase_commit.ivy)", "specifies": "two-phase atomic commit", "safety": "`invariant [1000000] (decide_commit(N0) -> ~decide_abort(N1)) & (decide_commit(N0) -> vote_yes(N1)) & (decide_abort(N0) -> abort_flag)` ([source](https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/protocols/two_phase_commit/two_phase_commit.ivy#L97))", "liveness": "no active temporal/progress declaration found in this file", "tool": "DistAI input / Ivy invariant synthesis; generated invariant artifact [source](https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/outputs/two_phase_commit/two_phase_commit_inv.ivy) (127 lines); checker success not rerun", "size": "97 lines in this file; [exact source](https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/protocols/two_phase_commit/two_phase_commit.ivy)", "source_url": "https://github.com/VeriGu/DistAI/blob/3c2b90122585cf1e785e7e31fb64ccfc4982655f/protocols/two_phase_commit/two_phase_commit.ivy#L97", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "block_cache_system (examples/block_cache_system.pyv)", "specifies": "block cache coherence", "safety": "`safety forall R. ((forall N. !cache(R, N)) & (forall L. !ephemeral_clean(R, L))) -> (forall N. !spec_ephemeral(R, N))` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/block_cache_system.pyv#L77)); `safety sync_in_progress & frozen_indirection_table_loc_some & (forall I. !outstanding_indirection_table_write(I)) -> spec_sync_in_progress` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/block_cache_system.pyv#L124)); `safety forall R, N. cache(R, N) -> spec_ephemeral(R, N)` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/block_cache_system.pyv#L147))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "316 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/block_cache_system.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/block_cache_system.pyv#L77", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "bosco_3t_safety (examples/bosco_3t_safety.pyv)", "specifies": "Bosco Byzantine consensus", "safety": "`safety [agreement1] forall N1, N2, V1, V2. !member_f(N1) & !member_f(N2) & dec(N1,V1) & dec(N2,V2) -> V1 = V2  # agreement (lemma 3)` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/bosco_3t_safety.pyv#L174)); `safety [agreement2] forall N, V1, V2. !member_f(N) & dec(N,V1) & und_cons_dec(V2) -> V1 = V2 # ultimate agreement` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/bosco_3t_safety.pyv#L175)); `safety [validity1] forall V1, V2. ((forall N:node. !member_f(N) -> input(N,V1)) & V1 != V2) -> (forall M. !member_f(M) -> !dec(M,V2)) # validity` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/bosco_3t_safety.pyv#L176)); `safety [validity2] forall V1, V2. (forall N:node. !member_f(N) -> input(N,V1)) & V1 != V2 -> !und_cons_dec(V2) # validity` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/bosco_3t_safety.pyv#L177))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "220 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/bosco_3t_safety.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/bosco_3t_safety.pyv#L174", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "cache (examples/cache.pyv)", "specifies": "cache/memory coherence", "safety": "`safety !invalid(C, A) & !modified(C, A) -> cache(C, A) = memory(A)` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/cache.pyv#L216))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "345 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/cache.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/cache.pyv#L216", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "client_server_ae (examples/client_server_ae.pyv)", "specifies": "client/server request protocol", "safety": "`safety forall N,P. response_received(N,P) -> exists R. request_sent(N,R) & match(R,P)` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/client_server_ae.pyv#L41))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "42 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/client_server_ae.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/client_server_ae.pyv#L41", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "client_server_db_ae (examples/client_server_db_ae.pyv)", "specifies": "client/server request protocol", "safety": "`safety forall N,P. response_received(N,P) -> exists R. request_sent(N,R) & match(R,P)` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/client_server_db_ae.pyv#L62))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "66 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/client_server_db_ae.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/client_server_db_ae.pyv#L62", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "fast_paxos_epr (examples/fast_paxos_epr.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety decision(R1, V1) & decision(R2, V2) -> V1 = V2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fast_paxos_epr.pyv#L129))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "158 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fast_paxos_epr.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fast_paxos_epr.pyv#L129", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "fast_paxos_forall_choosable (examples/fast_paxos_forall_choosable.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety decision(R1, V1) & decision(R2, V2) -> V1 = V2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fast_paxos_forall_choosable.pyv#L150))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "179 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fast_paxos_forall_choosable.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fast_paxos_forall_choosable.pyv#L150", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "fast_paxos_epr_rv_sk (examples/fbii/fast_paxos_epr/fast_paxos_epr_rv_sk.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety decision(r1, v1) & decision(r2, v2) -> v1 = v2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/fast_paxos_epr/fast_paxos_epr_rv_sk.pyv#L135))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "209 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/fast_paxos_epr/fast_paxos_epr_rv_sk.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/fast_paxos_epr/fast_paxos_epr_rv_sk.pyv#L135", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "fast_paxos_epr_rv_sk_proph (examples/fbii/fast_paxos_epr/fast_paxos_epr_rv_sk_proph.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety decision(r1, v1) & decision(r2, v2) -> v1 = v2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/fast_paxos_epr/fast_paxos_epr_rv_sk_proph.pyv#L135))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "216 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/fast_paxos_epr/fast_paxos_epr_rv_sk_proph.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/fast_paxos_epr/fast_paxos_epr_rv_sk_proph.pyv#L135", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "fast_paxos_epr_v_sk_proph (examples/fbii/fast_paxos_epr/fast_paxos_epr_v_sk_proph.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety decision(v1) & decision(v2) -> v1 = v2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/fast_paxos_epr/fast_paxos_epr_v_sk_proph.pyv#L133))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "212 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/fast_paxos_epr/fast_paxos_epr_v_sk_proph.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/fast_paxos_epr/fast_paxos_epr_v_sk_proph.pyv#L133", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "flexible_paxos_epr_rv_sk (examples/fbii/flexible_paxos_epr/flexible_paxos_epr_rv_sk.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety decision(r1, v1) & decision(r2, v2) -> v1 = v2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/flexible_paxos_epr/flexible_paxos_epr_rv_sk.pyv#L91))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "134 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/flexible_paxos_epr/flexible_paxos_epr_rv_sk.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/flexible_paxos_epr/flexible_paxos_epr_rv_sk.pyv#L91", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "flexible_paxos_epr_rv_sk_proph (examples/fbii/flexible_paxos_epr/flexible_paxos_epr_rv_sk_proph.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety decision(r1, v1) & decision(r2, v2) -> v1 = v2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/flexible_paxos_epr/flexible_paxos_epr_rv_sk_proph.pyv#L91))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "141 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/flexible_paxos_epr/flexible_paxos_epr_rv_sk_proph.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/flexible_paxos_epr/flexible_paxos_epr_rv_sk_proph.pyv#L91", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "flexible_paxos_epr_rvq_sk (examples/fbii/flexible_paxos_epr/flexible_paxos_epr_rvq_sk.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety decision(r1, v1, q1) & decision(r2, v2, q2) -> v1 = v2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/flexible_paxos_epr/flexible_paxos_epr_rvq_sk.pyv#L93))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "137 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/flexible_paxos_epr/flexible_paxos_epr_rvq_sk.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/flexible_paxos_epr/flexible_paxos_epr_rvq_sk.pyv#L93", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "flexible_paxos_epr_v_sk_proph (examples/fbii/flexible_paxos_epr/flexible_paxos_epr_v_sk_proph.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety decision(v1) & decision(v2) -> v1 = v2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/flexible_paxos_epr/flexible_paxos_epr_v_sk_proph.pyv#L89))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "139 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/flexible_paxos_epr/flexible_paxos_epr_v_sk_proph.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/flexible_paxos_epr/flexible_paxos_epr_v_sk_proph.pyv#L89", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "multi_paxos_epr_nirv_sk (examples/fbii/multi_paxos_epr/multi_paxos_epr_nirv_sk.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety ( decision(n1,i0,r1,v1) &` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/multi_paxos_epr/multi_paxos_epr_nirv_sk.pyv#L114))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "181 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/multi_paxos_epr/multi_paxos_epr_nirv_sk.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/multi_paxos_epr/multi_paxos_epr_nirv_sk.pyv#L114", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "multi_paxos_epr_nirv_sk_proph (examples/fbii/multi_paxos_epr/multi_paxos_epr_nirv_sk_proph.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety ( decision(n1,i0,r1,v1) &` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/multi_paxos_epr/multi_paxos_epr_nirv_sk_proph.pyv#L114))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "188 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/multi_paxos_epr/multi_paxos_epr_nirv_sk_proph.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/multi_paxos_epr/multi_paxos_epr_nirv_sk_proph.pyv#L114", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "paxos_epr_rv_sk (examples/fbii/paxos_epr/paxos_epr_rv_sk.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety decision(r1, v1) & decision(r2, v2) -> v1 = v2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/paxos_epr/paxos_epr_rv_sk.pyv#L88))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "131 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/paxos_epr/paxos_epr_rv_sk.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/paxos_epr/paxos_epr_rv_sk.pyv#L88", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "paxos_epr_rv_sk_proph (examples/fbii/paxos_epr/paxos_epr_rv_sk_proph.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety decision(r1, v1) & decision(r2, v2) -> v1 = v2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/paxos_epr/paxos_epr_rv_sk_proph.pyv#L88))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "138 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/paxos_epr/paxos_epr_rv_sk_proph.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/paxos_epr/paxos_epr_rv_sk_proph.pyv#L88", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "paxos_epr_rvq_sk (examples/fbii/paxos_epr/paxos_epr_rvq_sk.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety decision(r1, v1, q1) & decision(r2, v2, q2) -> v1 = v2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/paxos_epr/paxos_epr_rvq_sk.pyv#L90))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "134 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/paxos_epr/paxos_epr_rvq_sk.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/paxos_epr/paxos_epr_rvq_sk.pyv#L90", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "paxos_epr_v_sk_proph (examples/fbii/paxos_epr/paxos_epr_v_sk_proph.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety decision(v1) & decision(v2) -> v1 = v2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/paxos_epr/paxos_epr_v_sk_proph.pyv#L86))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "136 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/paxos_epr/paxos_epr_v_sk_proph.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/paxos_epr/paxos_epr_v_sk_proph.pyv#L86", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "paxos_fol_rv_sk (examples/fbii/paxos_fol/paxos_fol_rv_sk.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety [decisions_unique] decision(r1, v1) & decision(r2, v2) -> v1 = v2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/paxos_fol/paxos_fol_rv_sk.pyv#L101))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "176 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/paxos_fol/paxos_fol_rv_sk.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/paxos_fol/paxos_fol_rv_sk.pyv#L101", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "paxos_fol_rv_sk_proph (examples/fbii/paxos_fol/paxos_fol_rv_sk_proph.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety [decisions_unique] decision(r1, v1) & decision(r2, v2) -> v1 = v2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/paxos_fol/paxos_fol_rv_sk_proph.pyv#L101))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "183 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/paxos_fol/paxos_fol_rv_sk_proph.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/paxos_fol/paxos_fol_rv_sk_proph.pyv#L101", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "paxos_fol_rvq_sk (examples/fbii/paxos_fol/paxos_fol_rvq_sk.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety [decisions_unique] decision(r1, v1, q1) & decision(r2, v2, q2) -> v1 = v2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/paxos_fol/paxos_fol_rvq_sk.pyv#L103))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "155 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/paxos_fol/paxos_fol_rvq_sk.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/paxos_fol/paxos_fol_rvq_sk.pyv#L103", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "paxos_fol_v_sk_proph (examples/fbii/paxos_fol/paxos_fol_v_sk_proph.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety [decisions_unique] decision(v1) & decision(v2) -> v1 = v2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/paxos_fol/paxos_fol_v_sk_proph.pyv#L99))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "162 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/paxos_fol/paxos_fol_v_sk_proph.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/paxos_fol/paxos_fol_v_sk_proph.pyv#L99", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "raft_epr_sk_proph (examples/fbii/raft_epr/raft_epr_sk_proph.pyv)", "specifies": "Raft replicated log", "safety": "`safety [consensus] committed(i_sk, v1_sk) & committed(i_sk, v2_sk) -> v1_sk = v2_sk` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/raft_epr/raft_epr_sk_proph.pyv#L438))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "532 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/raft_epr/raft_epr_sk_proph.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/fbii/raft_epr/raft_epr_sk_proph.pyv#L438", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "firewall_ae (examples/firewall_ae.pyv)", "specifies": "network firewall", "safety": "`safety sent(S,D) & internal(D) -> exists I. internal(I) & sent(I,S)` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/firewall_ae.pyv#L37))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "45 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/firewall_ae.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/firewall_ae.pyv#L37", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "flexible_paxos_epr (examples/flexible_paxos_epr.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety decision(R1, V1) & decision(R2, V2) -> V1 = V2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/flexible_paxos_epr.pyv#L85))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "101 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/flexible_paxos_epr.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/flexible_paxos_epr.pyv#L85", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "flexible_paxos_forall_choosable (examples/flexible_paxos_forall_choosable.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety decision(R1, V1) & decision(R2, V2) -> V1 = V2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/flexible_paxos_forall_choosable.pyv#L96))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "143 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/flexible_paxos_forall_choosable.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/flexible_paxos_forall_choosable.pyv#L96", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "hybrid_reliable_broadcast_cisa (examples/hybrid_reliable_broadcast_cisa.pyv)", "specifies": "reliable broadcast", "safety": "`safety [unforgebility] (exists N. !member_fs(N) & !member_fa(N) & accept(N)) -> (exists M. !member_fs(M) & !member_fa(M) & rcv_init(M))` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/hybrid_reliable_broadcast_cisa.pyv#L227))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "256 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/hybrid_reliable_broadcast_cisa.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/hybrid_reliable_broadcast_cisa.pyv#L227", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "ironfleet_distributed_lock (examples/ironfleet_distributed_lock.pyv)", "specifies": "lock protocol", "safety": "`safety [mutual_exclusion] forall H1, H2. holds_lock(H1) & holds_lock(H2) -> H1 = H2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/ironfleet_distributed_lock.pyv#L50))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "63 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/ironfleet_distributed_lock.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/ironfleet_distributed_lock.pyv#L50", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "ironfleet_distributed_lock_valid_hosts (examples/ironfleet_distributed_lock_valid_hosts.pyv)", "specifies": "lock protocol", "safety": "`safety [mutual_exclusion] forall H1, H2. valid(H1) & valid(H2) & holds_lock(H1) & holds_lock(H2) -> H1 = H2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/ironfleet_distributed_lock_valid_hosts.pyv#L64))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "78 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/ironfleet_distributed_lock_valid_hosts.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/ironfleet_distributed_lock_valid_hosts.pyv#L64", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "learning_switch_ae (examples/learning_switch_ae.pyv)", "specifies": "learning network switch", "safety": "`safety table(T,X,X)` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/learning_switch_ae.pyv#L40)); `safety table(T,X,Y) & table(T,Y,Z) -> table(T,X,Z)` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/learning_switch_ae.pyv#L41)); `safety table(T,X,Y) & table(T,Y,X) -> X = Y` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/learning_switch_ae.pyv#L42)); `safety table(T,X,Y) & table(T,X,Z) -> table(T,Y,Z) | table(T,Z,Y)` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/learning_switch_ae.pyv#L43))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "54 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/learning_switch_ae.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/learning_switch_ae.pyv#L40", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "learning_switch_ae_projected (examples/learning_switch_ae_projected.pyv)", "specifies": "learning network switch", "safety": "`safety table(X,X)` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/learning_switch_ae_projected.pyv#L45)); `safety table(X,Y) & table(Y,Z) -> table(X,Z)` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/learning_switch_ae_projected.pyv#L46)); `safety table(X,Y) & table(Y,X) -> X = Y` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/learning_switch_ae_projected.pyv#L47)); `safety table(X,Y) & table(X,Z) -> table(Y,Z) | table(Z,Y)` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/learning_switch_ae_projected.pyv#L48))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "58 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/learning_switch_ae_projected.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/learning_switch_ae_projected.pyv#L45", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "learning_switch_forall (examples/learning_switch_forall.pyv)", "specifies": "learning network switch", "safety": "`safety table(T,X,X)` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/learning_switch_forall.pyv#L40)); `safety table(T,X,Y) & table(T,Y,Z) -> table(T,X,Z)` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/learning_switch_forall.pyv#L41)); `safety table(T,X,Y) & table(T,Y,X) -> X = Y` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/learning_switch_forall.pyv#L42)); `safety table(T,X,Y) & table(T,X,Z) -> table(T,Y,Z) | table(T,Z,Y)` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/learning_switch_forall.pyv#L43))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "54 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/learning_switch_forall.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/learning_switch_forall.pyv#L40", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "lockserv (examples/lockserv.pyv)", "specifies": "lock protocol", "safety": "`safety [mutex] holds_lock(N1) & holds_lock(N2) -> N1 = N2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/lockserv.pyv#L103))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "136 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/lockserv.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/lockserv.pyv#L103", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "message_passing_litmus (examples/message_passing_litmus.pyv)", "specifies": "message-passing memory model", "safety": "`safety & current_pc(t1) = pc2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/message_passing_litmus.pyv#L82))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "91 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/message_passing_litmus.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/message_passing_litmus.pyv#L82", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "bank (examples/misc/bank.pyv)", "specifies": "bank state transitions", "safety": "`safety balance(A) >= 0` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/bank.pyv#L17))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "25 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/bank.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/bank.pyv#L17", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "cache_one (examples/misc/cache_one.pyv)", "specifies": "cache/memory coherence", "safety": "`safety !invalid(C) & !modified(C) -> cache(C) = memory` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/cache_one.pyv#L199))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "322 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/cache_one.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/cache_one.pyv#L199", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "chain_replication (examples/misc/chain_replication.pyv)", "specifies": "chain-replicated database", "safety": "`invariant le(state(head), state(client))` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/chain_replication.pyv#L104))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "130 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/chain_replication.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/chain_replication.pyv#L104", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "paxos_autorelaxed (examples/misc/derived-relations/paxos_autorelaxed.pyv)", "specifies": "Paxos consensus variant", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "135 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/derived-relations/paxos_autorelaxed.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/derived-relations/paxos_autorelaxed.pyv", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "paxos_relaxed (examples/misc/derived-relations/paxos_relaxed.pyv)", "specifies": "Paxos consensus variant", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "212 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/derived-relations/paxos_relaxed.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/derived-relations/paxos_relaxed.pyv", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "paxos_unrelaxed (examples/misc/derived-relations/paxos_unrelaxed.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety decision(R1, V1) & decision(R2, V2) -> V1 = V2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/derived-relations/paxos_unrelaxed.pyv#L103))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "134 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/derived-relations/paxos_unrelaxed.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/derived-relations/paxos_unrelaxed.pyv#L103", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "lockserv (examples/misc/lockserv.pyv)", "specifies": "lock protocol", "safety": "`safety [mutex] holds_lock(N1) & holds_lock(N2) -> N1 = N2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/lockserv.pyv#L94))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "128 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/lockserv.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/lockserv.pyv#L94", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "lockserv_clean (examples/misc/lockserv_clean.pyv)", "specifies": "lock protocol", "safety": "`safety [mutex] holds_lock(N1) & holds_lock(N2) -> N1 = N2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/lockserv_clean.pyv#L45))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "66 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/lockserv_clean.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/lockserv_clean.pyv#L45", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "lockserv_multi (examples/misc/lockserv_multi.pyv)", "specifies": "lock protocol", "safety": "`safety [mutex] holds_lock(N1, L) & holds_lock(N2, L) -> N1 = N2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/lockserv_multi.pyv#L46))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "67 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/lockserv_multi.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/lockserv_multi.pyv#L46", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "lockserv_prime (examples/misc/lockserv_prime.pyv)", "specifies": "lock protocol", "safety": "`safety [mutex] holds_lock(N1) & holds_lock(N2) -> N1 = N2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/lockserv_prime.pyv#L47))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "68 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/lockserv_prime.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/lockserv_prime.pyv#L47", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "paxos (examples/misc/paxos/abstract_cex/paxos.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety decision(R1, V1) & decision(R2, V2) -> V1 = V2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/paxos/abstract_cex/paxos.pyv#L82))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "118 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/paxos/abstract_cex/paxos.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/paxos/abstract_cex/paxos.pyv#L82", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "paxos (examples/misc/paxos/updr_successful/paxos.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety decision(R1, V1) & decision(R2, V2) -> V1 = V2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/paxos/updr_successful/paxos.pyv#L85))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "121 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/paxos/updr_successful/paxos.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/paxos/updr_successful/paxos.pyv#L85", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "cache (examples/misc/pd/cache.pyv)", "specifies": "cache/memory coherence", "safety": "`safety !invalid(C, A) & !modified(C, A) -> cache(C, A) = memory(A)` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/cache.pyv#L210))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "263 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/cache.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/cache.pyv#L210", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "cache_unsafe (examples/misc/pd/cache_unsafe.pyv)", "specifies": "cache/memory coherence", "safety": "`safety !invalid(C, A) & !modified(C, A) -> cache(C, A) = memory(A)` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/cache_unsafe.pyv#L210))", "liveness": "no active temporal/progress declaration found in this file", "negative-test_warning": "the filename marks this as a bad/buggy/unsafe/error variant; displayed properties are attempted checks, not established guarantees", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "263 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/cache_unsafe.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/cache_unsafe.pyv#L210", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "consensus_epr (examples/misc/pd/consensus_epr.pyv)", "specifies": "consensus/agreement protocol", "safety": "`safety decided(N1, V1) & decided(N2, V2) -> V1 = V2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/consensus_epr.pyv#L49))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "56 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/consensus_epr.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/consensus_epr.pyv#L49", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "consensus_forall (examples/misc/pd/consensus_forall.pyv)", "specifies": "consensus/agreement protocol", "safety": "`safety decided(N1, V1) & decided(N2, V2) -> V1 = V2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/consensus_forall.pyv#L55))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "62 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/consensus_forall.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/consensus_forall.pyv#L55", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "consensus_unsafe (examples/misc/pd/consensus_unsafe.pyv)", "specifies": "consensus/agreement protocol", "safety": "`safety !decided(N1, V1)` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/consensus_unsafe.pyv#L55))", "liveness": "no active temporal/progress declaration found in this file", "negative-test_warning": "the filename marks this as a bad/buggy/unsafe/error variant; displayed properties are attempted checks, not established guarantees", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "62 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/consensus_unsafe.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/consensus_unsafe.pyv#L55", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "consensus_unsafe2 (examples/misc/pd/consensus_unsafe2.pyv)", "specifies": "consensus/agreement protocol", "safety": "`safety decided(N1, V1) & decided(N2, V2) -> V1 = V2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/consensus_unsafe2.pyv#L50))", "liveness": "no active temporal/progress declaration found in this file", "negative-test_warning": "the filename marks this as a bad/buggy/unsafe/error variant; displayed properties are attempted checks, not established guarantees", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "56 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/consensus_unsafe2.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/consensus_unsafe2.pyv#L50", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "fast_paxos_epr (examples/misc/pd/fast_paxos_epr.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety decision(R1, V1) & decision(R2, V2) -> V1 = V2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/fast_paxos_epr.pyv#L128))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "157 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/fast_paxos_epr.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/fast_paxos_epr.pyv#L128", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "fast_paxos_forall (examples/misc/pd/fast_paxos_forall.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety decision(R1, V1) & decision(R2, V2) -> V1 = V2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/fast_paxos_forall.pyv#L143))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "182 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/fast_paxos_forall.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/fast_paxos_forall.pyv#L143", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "fast_paxos_forall_choosable (examples/misc/pd/fast_paxos_forall_choosable.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety decision(R1, V1) & decision(R2, V2) -> V1 = V2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/fast_paxos_forall_choosable.pyv#L143))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "172 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/fast_paxos_forall_choosable.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/fast_paxos_forall_choosable.pyv#L143", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "flexible_paxos_epr (examples/misc/pd/flexible_paxos_epr.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety decision(R1, V1) & decision(R2, V2) -> V1 = V2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/flexible_paxos_epr.pyv#L83))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "128 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/flexible_paxos_epr.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/flexible_paxos_epr.pyv#L83", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "flexible_paxos_forall (examples/misc/pd/flexible_paxos_forall.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety decision(R1, V1) & decision(R2, V2) -> V1 = V2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/flexible_paxos_forall.pyv#L91))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "142 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/flexible_paxos_forall.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/flexible_paxos_forall.pyv#L91", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "flexible_paxos_forall_choosable (examples/misc/pd/flexible_paxos_forall_choosable.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety decision(R1, V1) & decision(R2, V2) -> V1 = V2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/flexible_paxos_forall_choosable.pyv#L89))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "136 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/flexible_paxos_forall_choosable.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/flexible_paxos_forall_choosable.pyv#L89", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "lockserv (examples/misc/pd/lockserv.pyv)", "specifies": "lock protocol", "safety": "`safety [mutex] holds_lock(N1) & holds_lock(N2) -> N1 = N2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/lockserv.pyv#L94))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "118 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/lockserv.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/lockserv.pyv#L94", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "lockserv_cnf (examples/misc/pd/lockserv_cnf.pyv)", "specifies": "lock protocol", "safety": "`safety [mutex] !holds_lock(N1) | !holds_lock(N2) | N1 = N2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/lockserv_cnf.pyv#L94))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "121 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/lockserv_cnf.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/lockserv_cnf.pyv#L94", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "lockserv_unsafe (examples/misc/pd/lockserv_unsafe.pyv)", "specifies": "lock protocol", "safety": "`safety [mutex] holds_lock(N1) & holds_lock(N2) -> N1 = N2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/lockserv_unsafe.pyv#L94))", "liveness": "no active temporal/progress declaration found in this file", "negative-test_warning": "the filename marks this as a bad/buggy/unsafe/error variant; displayed properties are attempted checks, not established guarantees", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "118 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/lockserv_unsafe.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/lockserv_unsafe.pyv#L94", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "paxos_epr (examples/misc/pd/paxos_epr.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety decision(R1, V1) & decision(R2, V2) -> V1 = V2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/paxos_epr.pyv#L81))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "97 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/paxos_epr.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/paxos_epr.pyv#L81", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "paxos_forall (examples/misc/pd/paxos_forall.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety decision(R1, V1) & decision(R2, V2) -> V1 = V2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/paxos_forall.pyv#L89))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "145 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/paxos_forall.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/paxos_forall.pyv#L89", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "paxos_forall_choosable (examples/misc/pd/paxos_forall_choosable.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety decision(R1, V1) & decision(R2, V2) -> V1 = V2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/paxos_forall_choosable.pyv#L87))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "134 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/paxos_forall_choosable.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/paxos_forall_choosable.pyv#L87", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "paxos_forall_choosable_unsafe (examples/misc/pd/paxos_forall_choosable_unsafe.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety !decision(R, V)  # UNSAFE` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/paxos_forall_choosable_unsafe.pyv#L87))", "liveness": "no active temporal/progress declaration found in this file", "negative-test_warning": "the filename marks this as a bad/buggy/unsafe/error variant; displayed properties are attempted checks, not established guarantees", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "134 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/paxos_forall_choosable_unsafe.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/paxos_forall_choosable_unsafe.pyv#L87", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "paxos_forall_choosable_unsafe2 (examples/misc/pd/paxos_forall_choosable_unsafe2.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety decision(R1, V1) & decision(R2, V2) -> V1 = V2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/paxos_forall_choosable_unsafe2.pyv#L87))", "liveness": "no active temporal/progress declaration found in this file", "negative-test_warning": "the filename marks this as a bad/buggy/unsafe/error variant; displayed properties are attempted checks, not established guarantees", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "134 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/paxos_forall_choosable_unsafe2.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/paxos_forall_choosable_unsafe2.pyv#L87", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "paxos_forall_choosable_unsafe_no_intersection (examples/misc/pd/paxos_forall_choosable_unsafe_no_intersection.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety decision(R1, V1) & decision(R2, V2) -> V1 = V2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/paxos_forall_choosable_unsafe_no_intersection.pyv#L87))", "liveness": "no active temporal/progress declaration found in this file", "negative-test_warning": "the filename marks this as a bad/buggy/unsafe/error variant; displayed properties are attempted checks, not established guarantees", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "134 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/paxos_forall_choosable_unsafe_no_intersection.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/paxos_forall_choosable_unsafe_no_intersection.pyv#L87", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "ring-id (examples/misc/pd/ring-id.pyv)", "specifies": "ring protocol", "safety": "`safety [one_leader] leader(L1) & leader(L2) -> L1 = L2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/ring-id.pyv#L52))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "55 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/ring-id.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/ring-id.pyv#L52", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "ring (examples/misc/pd/ring.pyv)", "specifies": "ring protocol", "safety": "`safety [one_leader] leader(L1) & leader(L2) -> L1 = L2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/ring.pyv#L48))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "51 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/ring.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/ring.pyv#L48", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "sharded-kv-retransmit (examples/misc/pd/sharded-kv-retransmit.pyv)", "specifies": "sharded key-value storage", "safety": "`safety [keys_unique] table(N1, K, V1) & table(N2, K, V2) -> N1 = N2 & V1 = V2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/sharded-kv-retransmit.pyv#L76))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "97 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/sharded-kv-retransmit.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/sharded-kv-retransmit.pyv#L76", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "sharded-kv-retransmit_unsafe (examples/misc/pd/sharded-kv-retransmit_unsafe.pyv)", "specifies": "sharded key-value storage", "safety": "`safety [keys_unique] table(N1, K, V1) & table(N2, K, V2) -> N1 = N2 & V1 = V2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/sharded-kv-retransmit_unsafe.pyv#L76))", "liveness": "no active temporal/progress declaration found in this file", "negative-test_warning": "the filename marks this as a bad/buggy/unsafe/error variant; displayed properties are attempted checks, not established guarantees", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "97 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/sharded-kv-retransmit_unsafe.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/sharded-kv-retransmit_unsafe.pyv#L76", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "sharded-kv (examples/misc/pd/sharded-kv.pyv)", "specifies": "sharded key-value storage", "safety": "`safety [keys_unique] table(N1, K, V1) & table(N2, K, V2) -> N1 = N2 & V1 = V2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/sharded-kv.pyv#L36))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "42 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/sharded-kv.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/sharded-kv.pyv#L36", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "sharded-kv_unsafe (examples/misc/pd/sharded-kv_unsafe.pyv)", "specifies": "sharded key-value storage", "safety": "`safety [keys_unique] table(N1, K, V1) & table(N2, K, V2) -> N1 = N2 & V1 = V2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/sharded-kv_unsafe.pyv#L36))", "liveness": "no active temporal/progress declaration found in this file", "negative-test_warning": "the filename marks this as a bad/buggy/unsafe/error variant; displayed properties are attempted checks, not established guarantees", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "42 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/sharded-kv_unsafe.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/sharded-kv_unsafe.pyv#L36", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "sharded-kv_unsafe2 (examples/misc/pd/sharded-kv_unsafe2.pyv)", "specifies": "sharded key-value storage", "safety": "`safety [keys_unique] table(N1, K, V1) & table(N2, K, V2) -> N1 = N2 & V1 = V2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/sharded-kv_unsafe2.pyv#L36))", "liveness": "no active temporal/progress declaration found in this file", "negative-test_warning": "the filename marks this as a bad/buggy/unsafe/error variant; displayed properties are attempted checks, not established guarantees", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "42 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/sharded-kv_unsafe2.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/sharded-kv_unsafe2.pyv#L36", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "stoppable_paxos_dnf_epr (examples/misc/pd/stoppable_paxos_dnf_epr.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety forall N1,N2,I,R1,R2,V1,V2. decision(N1,I,R1,V1) & decision(N2,I,R2,V2) -> V1 = V2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/stoppable_paxos_dnf_epr.pyv#L182)); `safety forall N1,N2,I1,I2,R1,R2. decision(N1,I1,R1,stop) & !inst_le(I2,I1) -> !decision(N2,I2,R2,V)` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/stoppable_paxos_dnf_epr.pyv#L185))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "223 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/stoppable_paxos_dnf_epr.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/stoppable_paxos_dnf_epr.pyv#L182", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "stoppable_paxos_dnf_forall (examples/misc/pd/stoppable_paxos_dnf_forall.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety forall N1,N2,I,R1,R2,V1,V2. decision(N1,I,R1,V1) & decision(N2,I,R2,V2) -> V1 = V2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/stoppable_paxos_dnf_forall.pyv#L191)); `safety forall N1,N2,I1,I2,R1,R2. decision(N1,I1,R1,stop) & !inst_le(I2,I1) -> !decision(N2,I2,R2,V)` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/stoppable_paxos_dnf_forall.pyv#L194))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "236 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/stoppable_paxos_dnf_forall.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/stoppable_paxos_dnf_forall.pyv#L191", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "stoppable_paxos_dnf_forall_choosable (examples/misc/pd/stoppable_paxos_dnf_forall_choosable.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety forall N1,N2,I,R1,R2,V1,V2. decision(N1,I,R1,V1) & decision(N2,I,R2,V2) -> V1 = V2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/stoppable_paxos_dnf_forall_choosable.pyv#L189)); `safety forall N1,N2,I1,I2,R1,R2. decision(N1,I1,R1,stop) & !inst_le(I2,I1) -> !decision(N2,I2,R2,V)` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/stoppable_paxos_dnf_forall_choosable.pyv#L192))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "228 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/stoppable_paxos_dnf_forall_choosable.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/stoppable_paxos_dnf_forall_choosable.pyv#L189", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "stoppable_paxos_epr (examples/misc/pd/stoppable_paxos_epr.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety forall N1,N2,I,R1,R2,V1,V2. decision(N1,I,R1,V1) & decision(N2,I,R2,V2) -> V1 = V2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/stoppable_paxos_epr.pyv#L150)); `safety forall N1,N2,I1,I2,R1,R2. decision(N1,I1,R1,stop) & !inst_le(I2,I1) -> !decision(N2,I2,R2,V)` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/stoppable_paxos_epr.pyv#L153))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "191 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/stoppable_paxos_epr.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/stoppable_paxos_epr.pyv#L150", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "stoppable_paxos_forall (examples/misc/pd/stoppable_paxos_forall.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety forall N1,N2,I,R1,R2,V1,V2. decision(N1,I,R1,V1) & decision(N2,I,R2,V2) -> V1 = V2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/stoppable_paxos_forall.pyv#L158)); `safety forall N1,N2,I1,I2,R1,R2. decision(N1,I1,R1,stop) & !inst_le(I2,I1) -> !decision(N2,I2,R2,V)` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/stoppable_paxos_forall.pyv#L161))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "203 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/stoppable_paxos_forall.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/stoppable_paxos_forall.pyv#L158", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "stoppable_paxos_forall_choosable (examples/misc/pd/stoppable_paxos_forall_choosable.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety forall N1,N2,I,R1,R2,V1,V2. decision(N1,I,R1,V1) & decision(N2,I,R2,V2) -> V1 = V2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/stoppable_paxos_forall_choosable.pyv#L157)); `safety forall N1,N2,I1,I2,R1,R2. decision(N1,I1,R1,stop) & !inst_le(I2,I1) -> !decision(N2,I2,R2,V)` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/stoppable_paxos_forall_choosable.pyv#L160))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "196 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/stoppable_paxos_forall_choosable.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/stoppable_paxos_forall_choosable.pyv#L157", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "tlb_safety (examples/misc/pd/tlb_safety.pyv)", "specifies": "TLB coherence", "safety": "`safety !error` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/tlb_safety.pyv#L463))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "470 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/tlb_safety.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/tlb_safety.pyv#L463", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "tlb_safety_prime (examples/misc/pd/tlb_safety_prime.pyv)", "specifies": "TLB coherence", "safety": "`safety !error` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/tlb_safety_prime.pyv#L467))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "474 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/tlb_safety_prime.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/tlb_safety_prime.pyv#L467", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "vertical_paxos_epr (examples/misc/pd/vertical_paxos_epr.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety decision(R1, V1) & decision(R2, V2) -> V1 = V2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/vertical_paxos_epr.pyv#L132))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "164 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/vertical_paxos_epr.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/vertical_paxos_epr.pyv#L132", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "vertical_paxos_forall (examples/misc/pd/vertical_paxos_forall.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety decision(R1, V1) & decision(R2, V2) -> V1 = V2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/vertical_paxos_forall.pyv#L148))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "188 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/vertical_paxos_forall.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/vertical_paxos_forall.pyv#L148", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "vertical_paxos_forall_choosable (examples/misc/pd/vertical_paxos_forall_choosable.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety decision(R1, V1) & decision(R2, V2) -> V1 = V2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/vertical_paxos_forall_choosable.pyv#L146))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "183 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/vertical_paxos_forall_choosable.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/pd/vertical_paxos_forall_choosable.pyv#L146", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "primary_backup (examples/misc/primary_backup.pyv)", "specifies": "primary/backup replication", "safety": "`safety le(backup, primary)` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/primary_backup.pyv#L35))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "49 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/primary_backup.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/primary_backup.pyv#L35", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "primary_backup_relational (examples/misc/primary_backup_relational.pyv)", "specifies": "primary/backup replication", "safety": "`safety exists X, Y. primary(X) & backup(Y) & le(Y, X)` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/primary_backup_relational.pyv#L37))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "48 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/primary_backup_relational.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/misc/primary_backup_relational.pyv#L37", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "multi_paxos_epr (examples/multi_paxos_epr.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety ( decision(N1,I,R1,V1) &` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/multi_paxos_epr.pyv#L106))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "140 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/multi_paxos_epr.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/multi_paxos_epr.pyv#L106", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "paxos_epr (examples/paxos_epr.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety decision(R1, V1) & decision(R2, V2) -> V1 = V2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/paxos_epr.pyv#L82))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "98 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/paxos_epr.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/paxos_epr.pyv#L82", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "paxos_fol (examples/paxos_fol.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety [decisions_unique] decision(R1, V1) & decision(R2, V2) -> V1 = V2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/paxos_fol.pyv#L95))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "134 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/paxos_fol.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/paxos_fol.pyv#L95", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "paxos_forall (examples/paxos_forall.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety decision(R1, V1) & decision(R2, V2) -> V1 = V2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/paxos_forall.pyv#L97))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "156 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/paxos_forall.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/paxos_forall.pyv#L97", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "paxos_forall_choosable (examples/paxos_forall_choosable.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety decision(R1, V1) & decision(R2, V2) -> V1 = V2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/paxos_forall_choosable.pyv#L94))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "141 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/paxos_forall_choosable.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/paxos_forall_choosable.pyv#L94", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "peterson (examples/peterson.pyv)", "specifies": "Peterson mutual exclusion", "safety": "`safety [mutex] ((pc(P) = cs) & (pc(Q) = cs)) -> (P = Q)` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/peterson.pyv#L139))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "183 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/peterson.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/peterson.pyv#L139", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "raft_epr (examples/raft_epr.pyv)", "specifies": "Raft replicated log", "safety": "`safety committed(I, V1) & committed(I, V2) -> V1 = V2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/raft_epr.pyv#L468))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "478 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/raft_epr.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/raft_epr.pyv#L468", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "ring_leader_election (examples/ring_leader_election.pyv)", "specifies": "leader election", "safety": "`safety [leader_unique] leader(X) & leader(Y) -> X = Y` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/ring_leader_election.pyv#L54))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "66 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/ring_leader_election.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/ring_leader_election.pyv#L54", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "ring_leader_election_no_deadlock (examples/ring_leader_election_no_deadlock.pyv)", "specifies": "leader election", "safety": "`safety [leader_unique] leader(X) & leader(Y) -> X = Y` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/ring_leader_election_no_deadlock.pyv#L68)); `safety [not_dead] (exists L. leader(L)) | (exists M,N. pending(M, N)) | (exists N. !sent(N))` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/ring_leader_election_no_deadlock.pyv#L69))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "84 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/ring_leader_election_no_deadlock.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/ring_leader_election_no_deadlock.pyv#L68", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "ring_leader_election_single_sort (examples/ring_leader_election_single_sort.pyv)", "specifies": "leader election", "safety": "`safety [leader_unique] leader(X) & leader(Y) -> X = Y` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/ring_leader_election_single_sort.pyv#L61))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "72 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/ring_leader_election_single_sort.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/ring_leader_election_single_sort.pyv#L61", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "sharded_kv (examples/sharded_kv.pyv)", "specifies": "sharded key-value storage", "safety": "`safety [keys_unique] table(N1, K, V1) & table(N2, K, V2) -> N1 = N2 & V1 = V2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/sharded_kv.pyv#L52))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "66 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/sharded_kv.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/sharded_kv.pyv#L52", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "sharded_kv_no_lost_keys (examples/sharded_kv_no_lost_keys.pyv)", "specifies": "sharded key-value storage", "safety": "`safety [no_lost_keys] (exists N,K,V. transfer_msg(N,K,V)) | (forall K. exists N. owner(N,K))` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/sharded_kv_no_lost_keys.pyv#L58))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "68 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/sharded_kv_no_lost_keys.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/sharded_kv_no_lost_keys.pyv#L58", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "sharded_kv_retransmit (examples/sharded_kv_retransmit.pyv)", "specifies": "sharded key-value storage", "safety": "`safety [keys_unique] table(N1, K, V1) & table(N2, K, V2) -> N1 = N2 & V1 = V2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/sharded_kv_retransmit.pyv#L91))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "146 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/sharded_kv_retransmit.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/sharded_kv_retransmit.pyv#L91", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "stoppable_paxos_epr (examples/stoppable_paxos_epr.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety forall N1,N2,I,R1,R2,V1,V2. decision(N1,I,R1,V1) & decision(N2,I,R2,V2) -> V1 = V2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/stoppable_paxos_epr.pyv#L156)); `safety forall N1,N2,I1,I2,R1,R2. decision(N1,I1,R1,stop) & !inst_le(I2,I1) -> !decision(N2,I2,R2,V)` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/stoppable_paxos_epr.pyv#L159))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "199 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/stoppable_paxos_epr.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/stoppable_paxos_epr.pyv#L156", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "stoppable_paxos_forall (examples/stoppable_paxos_forall.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety forall N1,N2,I,R1,R2,V1,V2. decision(N1,I,R1,V1) & decision(N2,I,R2,V2) -> V1 = V2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/stoppable_paxos_forall.pyv#L170)); `safety forall N1,N2,I1,I2,R1,R2. decision(N1,I1,R1,stop) & !inst_le(I2,I1) -> !decision(N2,I2,R2,V)` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/stoppable_paxos_forall.pyv#L173))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "229 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/stoppable_paxos_forall.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/stoppable_paxos_forall.pyv#L170", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "stoppable_paxos_forall_choosable (examples/stoppable_paxos_forall_choosable.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety forall N1,N2,I,R1,R2,V1,V2. decision(N1,I,R1,V1) & decision(N2,I,R2,V2) -> V1 = V2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/stoppable_paxos_forall_choosable.pyv#L168)); `safety forall N1,N2,I1,I2,R1,R2. decision(N1,I1,R1,stop) & !inst_le(I2,I1) -> !decision(N2,I2,R2,V)` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/stoppable_paxos_forall_choosable.pyv#L171))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "207 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/stoppable_paxos_forall_choosable.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/stoppable_paxos_forall_choosable.pyv#L168", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "ticket (examples/ticket.pyv)", "specifies": "ticket lock", "safety": "`safety [mutex] pc3(T1) & pc3(T2) -> T1 = T2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/ticket.pyv#L61))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "101 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/ticket.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/ticket.pyv#L61", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "toy_consensus_cav24 (examples/toy_consensus_cav24.pyv)", "specifies": "consensus/agreement protocol", "safety": "`safety [agreement] forall X, Y. d(X) & d(Y) -> X = Y` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/toy_consensus_cav24.pyv#L41))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "65 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/toy_consensus_cav24.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/toy_consensus_cav24.pyv#L41", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "toy_consensus_epr (examples/toy_consensus_epr.pyv)", "specifies": "consensus/agreement protocol", "safety": "`safety decided(V1) & decided(V2) -> V1 = V2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/toy_consensus_epr.pyv#L34))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "37 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/toy_consensus_epr.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/toy_consensus_epr.pyv#L34", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "toy_consensus_forall (examples/toy_consensus_forall.pyv)", "specifies": "consensus/agreement protocol", "safety": "`safety decided(V1) & decided(V2) -> V1 = V2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/toy_consensus_forall.pyv#L41))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "44 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/toy_consensus_forall.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/toy_consensus_forall.pyv#L41", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "toy_leader_consensus_epr (examples/toy_leader_consensus_epr.pyv)", "specifies": "consensus/agreement protocol", "safety": "`safety decided(N1, V1) & decided(N2, V2) -> V1 = V2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/toy_leader_consensus_epr.pyv#L63))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "79 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/toy_leader_consensus_epr.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/toy_leader_consensus_epr.pyv#L63", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "toy_leader_consensus_forall (examples/toy_leader_consensus_forall.pyv)", "specifies": "consensus/agreement protocol", "safety": "`safety decided(N1, V1) & decided(N2, V2) -> V1 = V2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/toy_leader_consensus_forall.pyv#L75))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "91 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/toy_leader_consensus_forall.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/toy_leader_consensus_forall.pyv#L75", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "toy_leader_consensus_forall_without_decide (examples/toy_leader_consensus_forall_without_decide.pyv)", "specifies": "consensus/agreement protocol", "safety": "`safety leader(N1) & leader(N2) -> N1 = N2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/toy_leader_consensus_forall_without_decide.pyv#L59))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "72 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/toy_leader_consensus_forall_without_decide.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/toy_leader_consensus_forall_without_decide.pyv#L59", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "vertical_paxos_epr (examples/vertical_paxos_epr.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety decision(R1, V1) & decision(R2, V2) -> V1 = V2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/vertical_paxos_epr.pyv#L136))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "168 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/vertical_paxos_epr.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/vertical_paxos_epr.pyv#L136", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "mypyvy: protocol specifications and encoding variants", "name": "vertical_paxos_forall_choosable (examples/vertical_paxos_forall_choosable.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety decision(R1, V1) & decision(R2, V2) -> V1 = V2` ([source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/vertical_paxos_forall_choosable.pyv#L152))", "liveness": "no active temporal/progress declaration found in this file", "tool": "mypyvy first-order transition-system specification; safety/invariant proof obligations encoded, solver result not rerun", "size": "189 lines in this file; [exact source](https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/vertical_paxos_forall_choosable.pyv)", "source_url": "https://github.com/wilcoxjay/mypyvy/blob/cd80557ae11f5958c7c81dbecf3b24f7a3b16c1f/examples/vertical_paxos_forall_choosable.pyv#L152", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "2PC (benchmarks/2PC.ivy)", "specifies": "two-phase atomic commit", "safety": "`conjecture (decide_commit(N) -> ~decide_abort(N2))` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/2PC.ivy#L135)); `conjecture (decide_commit(N) -> vote_yes(N2))` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/2PC.ivy#L136)); `conjecture (decide_abort(N) -> abort_flag)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/2PC.ivy#L137))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "137 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/2PC.ivy)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/2PC.ivy#L135", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "2PC (benchmarks/2PC.pyv)", "specifies": "two-phase atomic commit", "safety": "`safety (decide_commit(N) -> !decide_abort(N2))` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/2PC.pyv#L104)); `safety (decide_commit(N) -> vote_yes(N2))` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/2PC.pyv#L105)); `safety (decide_abort(N) -> abort_flag)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/2PC.pyv#L106))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof", "size": "106 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/2PC.pyv)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/2PC.pyv#L104", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "chain (benchmarks/chain.ivy)", "specifies": "chain-replicated database", "safety": "`conjecture (~(TX1 ~= TX2 &` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/chain.ivy#L195))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "212 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/chain.ivy)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/chain.ivy#L195", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "chain (benchmarks/chain.pyv)", "specifies": "chain-replicated database", "safety": "`safety (!(TX1 != TX2 &` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/chain.pyv#L151))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof", "size": "166 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/chain.pyv)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/chain.pyv#L151", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "chord-gimme-1 (benchmarks/chord-gimme-1.ivy)", "specifies": "Chord ring maintenance", "safety": "`conjecture (~btw(X, org, Y) | ~s1(X, Y))` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/chord-gimme-1.ivy#L226)); `conjecture ~error(N)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/chord-gimme-1.ivy#L230))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "232 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/chord-gimme-1.ivy)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/chord-gimme-1.ivy#L226", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "chord-last-2 (benchmarks/chord-last-2.ivy)", "specifies": "Chord ring maintenance", "safety": "`conjecture s1(X,Y) -> in_s1(X)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/chord-last-2.ivy#L210)); `conjecture s2(X,Y) -> in_s2(X)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/chord-last-2.ivy#L211)); `conjecture reach(org)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/chord-last-2.ivy#L212)); `conjecture s1(X,Y) & s1(X,Z) -> Y=Z` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/chord-last-2.ivy#L213)); `conjecture s2(X,Y) & s2(X,Z) -> Y=Z` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/chord-last-2.ivy#L214)); `conjecture p(X,Y) & p(X,Z) -> Y=Z` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/chord-last-2.ivy#L215)); `conjecture (a(X) | X ~= org)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/chord-last-2.ivy#L216)); `conjecture (a(X) | ~p(Y, X) | ~s1(X, Y))` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/chord-last-2.ivy#L217)); `conjecture (a(X) | p(Y, X) | ~s1(X, Y))` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/chord-last-2.ivy#L218)); `conjecture (a(X) | ~s2(X, Y))` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/chord-last-2.ivy#L219)); `conjecture (in_s1(X) | ~a(X))` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/chord-last-2.ivy#L220)); `conjecture (a(Y) | a(Z) | ~s1(X, Y) | ~s2(X, Z))` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/chord-last-2.ivy#L221)); `conjecture (a(Y) | in_s2(X) | ~a(X) | ~s1(X, Y))` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/chord-last-2.ivy#L222)); `conjecture p(A,B) -> a(A)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/chord-last-2.ivy#L223)); `conjecture a(X) & p(Y,X) & s1(X,Y) -> a(Y)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/chord-last-2.ivy#L225)); `conjecture ~error(N)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/chord-last-2.ivy#L230))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "232 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/chord-last-2.ivy)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/chord-last-2.ivy#L210", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "chord (benchmarks/chord.ivy)", "specifies": "Chord ring maintenance", "safety": "`conjecture ~error(N)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/chord.ivy#L230))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "245 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/chord.ivy)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/chord.ivy#L230", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "chord (benchmarks/chord.pyv)", "specifies": "Chord ring maintenance", "safety": "`safety !error(N)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/chord.pyv#L175))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof", "size": "175 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/chord.pyv)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/chord.pyv#L175", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "client_server_ae (benchmarks/client_server_ae.ivy)", "specifies": "client/server request protocol", "safety": "`conjecture forall N,P. response_received(N,P) -> exists R. request_sent(N,R) & match(R,P)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/client_server_ae.ivy#L42))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "43 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/client_server_ae.ivy)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/client_server_ae.ivy#L42", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "client_server_ae (benchmarks/client_server_ae.pyv)", "specifies": "client/server request protocol", "safety": "`safety forall N,P. response_received(N,P) -> exists R. request_sent(N,R) & match(R,P)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/client_server_ae.pyv#L41))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof", "size": "42 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/client_server_ae.pyv)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/client_server_ae.pyv#L41", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "client_server_db_ae (benchmarks/client_server_db_ae.ivy)", "specifies": "client/server request protocol", "safety": "`conjecture forall N,P. response_received(N,P) -> exists R. request_sent(N,R) & match(R,P)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/client_server_db_ae.ivy#L70))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "74 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/client_server_db_ae.ivy)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/client_server_db_ae.ivy#L70", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "client_server_db_ae (benchmarks/client_server_db_ae.pyv)", "specifies": "client/server request protocol", "safety": "`safety forall N,P. response_received(N,P) -> exists R. request_sent(N,R) & match(R,P)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/client_server_db_ae.pyv#L62))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof", "size": "66 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/client_server_db_ae.pyv)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/client_server_db_ae.pyv#L62", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "consensus_epr (benchmarks/consensus_epr.ivy)", "specifies": "consensus/agreement protocol", "safety": "`conjecture decided(N1, V1) & decided(N2, V2) -> V1 = V2` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/consensus_epr.ivy#L75))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "82 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/consensus_epr.ivy)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/consensus_epr.ivy#L75", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "consensus_epr (benchmarks/consensus_epr.pyv)", "specifies": "consensus/agreement protocol", "safety": "`safety decided(N1, V1) & decided(N2, V2) -> V1 = V2` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/consensus_epr.pyv#L51))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof", "size": "58 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/consensus_epr.pyv)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/consensus_epr.pyv#L51", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "consensus_forall (benchmarks/consensus_forall.ivy)", "specifies": "consensus/agreement protocol", "safety": "`conjecture decided(N1, V1) & decided(N2, V2) -> V1 = V2` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/consensus_forall.ivy#L71))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "78 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/consensus_forall.ivy)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/consensus_forall.ivy#L71", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "consensus_forall (benchmarks/consensus_forall.pyv)", "specifies": "consensus/agreement protocol", "safety": "`safety decided(N1, V1) & decided(N2, V2) -> V1 = V2` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/consensus_forall.pyv#L58))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof", "size": "65 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/consensus_forall.pyv)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/consensus_forall.pyv#L58", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "consensus_wo_decide (benchmarks/consensus_wo_decide.ivy)", "specifies": "consensus/agreement protocol", "safety": "`conjecture leader(N1) & leader(N2) -> N1 = N2` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/consensus_wo_decide.ivy#L59))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "64 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/consensus_wo_decide.ivy)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/consensus_wo_decide.ivy#L59", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "consensus_wo_decide (benchmarks/consensus_wo_decide.pyv)", "specifies": "consensus/agreement protocol", "safety": "`safety leader(N1) & leader(N2) -> N1 = N2` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/consensus_wo_decide.pyv#L50))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof", "size": "55 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/consensus_wo_decide.pyv)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/consensus_wo_decide.pyv#L50", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "decentralized-lock-gimme-1 (benchmarks/decentralized-lock-gimme-1.ivy)", "specifies": "lock protocol", "safety": "`conjecture ~(X ~= Y & ( has_lock(X) | (msg(X1, X, T) & ~le(T, epoch(X))) ) & ( has_lock(Y) | (msg(Y1, Y, S) & ~le(S, epoch(Y))) ))` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/decentralized-lock-gimme-1.ivy#L44)); `conjecture ~(X ~= Y & has_lock(X) & has_lock(Y))` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/decentralized-lock-gimme-1.ivy#L48))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "59 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/decentralized-lock-gimme-1.ivy)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/decentralized-lock-gimme-1.ivy#L44", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "decentralized-lock (benchmarks/decentralized-lock.ivy)", "specifies": "lock protocol", "safety": "`conjecture ~(X ~= Y & has_lock(X) & has_lock(Y))` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/decentralized-lock.ivy#L48))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "59 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/decentralized-lock.ivy)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/decentralized-lock.ivy#L48", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "distributed_lock (benchmarks/distributed_lock.ivy)", "specifies": "lock protocol", "safety": "`conjecture locked(E, N1) & locked(E, N2) -> N1 = N2` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/distributed_lock.ivy#L84))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "84 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/distributed_lock.ivy)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/distributed_lock.ivy#L84", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "distributed_lock (benchmarks/distributed_lock.pyv)", "specifies": "lock protocol", "safety": "`safety locked(E, N1) & locked(E, N2) -> N1 = N2` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/distributed_lock.pyv#L86))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof", "size": "101 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/distributed_lock.pyv)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/distributed_lock.pyv#L86", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "fast_paxos (benchmarks/fast_paxos.ivy)", "specifies": "Paxos consensus variant", "safety": "`conjecture ( decision(N1,R1,V1) &` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/fast_paxos.ivy#L179))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "186 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/fast_paxos.ivy)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/fast_paxos.ivy#L179", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "fast_paxos (benchmarks/fast_paxos.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety ( decision(N1,R1,V1) &` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/fast_paxos.pyv#L131))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof", "size": "172 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/fast_paxos.pyv)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/fast_paxos.pyv#L131", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "fast_paxos_epr (benchmarks/fast_paxos_epr.ivy)", "specifies": "Paxos consensus variant", "safety": "`conjecture ~proposal(R,V)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/fast_paxos_epr.ivy#L181)); `conjecture ( decision(N1,R1,V1) &` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/fast_paxos_epr.ivy#L184)); `conjecture proposal(R,V1) & proposal(R,V2) -> V1 = V2` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/fast_paxos_epr.ivy#L190)); `conjecture any_msg(R) -> fast(R)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/fast_paxos_epr.ivy#L193)); `conjecture ~fast(R) & (exists N. decision(N,R,V)) -> exists Q:c_quorum . forall N:node . c_member(N, Q) -> vote(N,R,V)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/fast_paxos_epr.ivy#L196)); `conjecture  fast(R) & (exists N. decision(N,R,V)) -> exists Q:f_quorum . forall N:node . f_member(N, Q) -> vote(N,R,V)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/fast_paxos_epr.ivy#L197)); `conjecture ~fast(R) & vote(N,R,V) -> proposal(R,V)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/fast_paxos_epr.ivy#L200)); `conjecture fast(R) & vote(N,R,V) -> (proposal(R,V) | any_msg(R))` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/fast_paxos_epr.ivy#L203)); `conjecture ~(any_msg(R) & proposal(R,V))` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/fast_paxos_epr.ivy#L204)); `conjecture fast(R) & vote(N,R,V1) & vote(N,R,V2) -> V1 = V2` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/fast_paxos_epr.ivy#L205)); `conjecture forall R1:round, R2:round, V1:value, V2:value, Q:c_quorum.` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/fast_paxos_epr.ivy#L208)); `conjecture forall R1:round, R2:round, V1:value, V2:value, Q:f_quorum.` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/fast_paxos_epr.ivy#L212)); `conjecture one_b_max_vote(N,R2,none,V1) & ~le(R2,R1) -> ~vote(N,R1,V2)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/fast_paxos_epr.ivy#L217)); `conjecture one_b_max_vote(N,R,RMAX,V) & RMAX ~= none -> ~le(R,RMAX) & vote(N,RMAX,V)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/fast_paxos_epr.ivy#L218)); `conjecture one_b_max_vote(N,R,RMAX,V) & RMAX ~= none & ~le(R,ROTHER) & ~le(ROTHER,RMAX) -> ~vote(N,ROTHER,VOTHER)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/fast_paxos_epr.ivy#L219)); `conjecture one_b_max_vote(N,R,RMAX,V) -> one_b(N,R)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/fast_paxos_epr.ivy#L222)); `conjecture one_b(N,R2) & ~le(R2,R1) -> left_rnd(N,R1)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/fast_paxos_epr.ivy#L223)); `conjecture ~vote(N,none,V)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/fast_paxos_epr.ivy#L226))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "226 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/fast_paxos_epr.ivy)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/fast_paxos_epr.ivy#L181", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "fast_paxos_start_with_hard (benchmarks/fast_paxos_start_with_hard.ivy)", "specifies": "Paxos consensus variant", "safety": "`conjecture ( decision(N1,R1,V1) &` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/fast_paxos_start_with_hard.ivy#L177)); `conjecture forall R1:round, R2:round, V1:value, V2:value, Q:c_quorum.` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/fast_paxos_start_with_hard.ivy#L183)); `conjecture forall R1:round, R2:round, V1:value, V2:value, Q:f_quorum.` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/fast_paxos_start_with_hard.ivy#L187))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "190 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/fast_paxos_start_with_hard.ivy)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/fast_paxos_start_with_hard.ivy#L177", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "flexible_paxos (benchmarks/flexible_paxos.ivy)", "specifies": "Paxos consensus variant", "safety": "`conjecture ( decision(N1,R1,V1) &` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/flexible_paxos.ivy#L147))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "150 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/flexible_paxos.ivy)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/flexible_paxos.ivy#L147", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "flexible_paxos (benchmarks/flexible_paxos.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety ( decision(N1,R1,V1) &` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/flexible_paxos.pyv#L94))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof", "size": "121 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/flexible_paxos.pyv)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/flexible_paxos.pyv#L94", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "hybrid_reliable_broadcast_cisa (benchmarks/hybrid_reliable_broadcast_cisa.ivy)", "specifies": "reliable broadcast", "safety": "`conjecture (exists N. ~member_fs(N) & ~member_fa(N) & accept(N)) -> (exists M. ~member_fs(M) & ~member_fa(M) & rcv_init(M))` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/hybrid_reliable_broadcast_cisa.ivy#L223))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "238 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/hybrid_reliable_broadcast_cisa.ivy)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/hybrid_reliable_broadcast_cisa.ivy#L223", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "hybrid_reliable_broadcast_cisa (benchmarks/hybrid_reliable_broadcast_cisa.pyv)", "specifies": "reliable broadcast", "safety": "`safety [unforgebility] (exists N. !member_fs(N) & !member_fa(N) & accept(N)) -> (exists M. !member_fs(M) & !member_fa(M) & rcv_init(M))` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/hybrid_reliable_broadcast_cisa.pyv#L225))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof", "size": "254 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/hybrid_reliable_broadcast_cisa.pyv)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/hybrid_reliable_broadcast_cisa.pyv#L225", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "leader-election (benchmarks/leader-election.ivy)", "specifies": "leader election", "safety": "`conjecture ~(leader(N) & leader(M) & N ~= M)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/leader-election.ivy#L58))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "74 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/leader-election.ivy)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/leader-election.ivy#L58", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "leader-election (benchmarks/leader-election.pyv)", "specifies": "leader election", "safety": "`safety [leader_unique] leader(X) & leader(Y) -> X = Y` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/leader-election.pyv#L45))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof", "size": "57 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/leader-election.pyv)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/leader-election.pyv#L45", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "learning-switch-quad (benchmarks/learning-switch-quad.ivy)", "specifies": "learning network switch", "safety": "`conjecture table(T,X,X)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/learning-switch-quad.ivy#L33)); `conjecture table(T,X,Y) & table(T,Y,Z) -> table(T,X,Z)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/learning-switch-quad.ivy#L34)); `conjecture table(T,X,Y) & table(T,Y,X) -> X = Y` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/learning-switch-quad.ivy#L35)); `conjecture table(T,X,Y) & table(T,X,Z) -> table(T,Y,Z) | table(T,Z,Y)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/learning-switch-quad.ivy#L36))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "44 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/learning-switch-quad.ivy)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/learning-switch-quad.ivy#L33", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "learning-switch-quad (benchmarks/learning-switch-quad.pyv)", "specifies": "learning network switch", "safety": "`safety table(T,X,X)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/learning-switch-quad.pyv#L30)); `safety table(T,X,Y) & table(T,Y,Z) -> table(T,X,Z)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/learning-switch-quad.pyv#L31)); `safety table(T,X,Y) & table(T,Y,X) -> X = Y` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/learning-switch-quad.pyv#L32)); `safety table(T,X,Y) & table(T,X,Z) -> table(T,Y,Z) | table(T,Z,Y)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/learning-switch-quad.pyv#L33))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof", "size": "41 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/learning-switch-quad.pyv)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/learning-switch-quad.pyv#L30", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "learning-switch-ternary (benchmarks/learning-switch-ternary.ivy)", "specifies": "learning network switch", "safety": "`conjecture ((pending(P0, SW0, SW1) | S0 = SW1 & SW0 = SW1) & (~dom(S0,SW1) & SW0 ~= SW1 & S0 ~= SW1)) -> ~tc(S0,SW0,SW1)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/learning-switch-ternary.ivy#L131))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "161 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/learning-switch-ternary.ivy)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/learning-switch-ternary.ivy#L131", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "learning-switch-ternary (benchmarks/learning-switch-ternary.pyv)", "specifies": "learning network switch", "safety": "`safety ((pending(P0, SW0, SW1) | S0 = SW1 & SW0 = SW1) & (!dom(S0,SW1) & SW0 != SW1 & S0 != SW1)) -> !tc(S0,SW0,SW1)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/learning-switch-ternary.pyv#L127))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof", "size": "143 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/learning-switch-ternary.pyv)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/learning-switch-ternary.pyv#L127", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "lock-server-async (benchmarks/lock-server-async.ivy)", "specifies": "lock protocol", "safety": "`conjecture holds_lock(N1) & holds_lock(N2) -> N1 = N2` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/lock-server-async.ivy#L61))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "72 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/lock-server-async.ivy)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/lock-server-async.ivy#L61", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "lock-server-async (benchmarks/lock-server-async.pyv)", "specifies": "lock protocol", "safety": "`safety [mutex] holds_lock(N1) & holds_lock(N2) -> N1 = N2` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/lock-server-async.pyv#L47))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof", "size": "58 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/lock-server-async.pyv)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/lock-server-async.pyv#L47", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "lock-server-sync (benchmarks/lock-server-sync.ivy)", "specifies": "lock protocol", "safety": "`conjecture link(C1, S) & link(C2, S) -> C1 = C2` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/lock-server-sync.ivy#L35))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "35 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/lock-server-sync.ivy)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/lock-server-sync.ivy#L35", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "lock-server-sync (benchmarks/lock-server-sync.pyv)", "specifies": "lock protocol", "safety": "`safety link(C1, S) & link(C2, S) -> C1 = C2` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/lock-server-sync.pyv#L24))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof", "size": "24 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/lock-server-sync.pyv)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/lock-server-sync.pyv#L24", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "multi_paxos (benchmarks/multi_paxos.ivy)", "specifies": "Paxos consensus variant", "safety": "`conjecture ( decision(N1,I,R1,V1) &` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/multi_paxos.ivy#L164))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "167 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/multi_paxos.ivy)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/multi_paxos.ivy#L164", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "multi_paxos (benchmarks/multi_paxos.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety ( decision(N1,I,R1,V1) &` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/multi_paxos.pyv#L116))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof", "size": "150 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/multi_paxos.pyv)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/multi_paxos.pyv#L116", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "multi_paxos_missing1 (benchmarks/multi_paxos_missing1.ivy)", "specifies": "Paxos consensus variant", "safety": "`conjecture ( decision(N1,I,R1,V1) &` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/multi_paxos_missing1.ivy#L162)); `conjecture proposal(I,R,V) -> active(R)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/multi_paxos_missing1.ivy#L169)); `conjecture proposal(I,R,V1) & proposal(I,R,V2) -> V1 = V2` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/multi_paxos_missing1.ivy#L172)); `conjecture vote(N,I,R,V) -> proposal(I,R,V)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/multi_paxos_missing1.ivy#L175)); `conjecture forall R:round, V:value. (exists N:node. decision(N,I,R,V)) -> exists Q:quorum. forall N:node. member(N, Q) -> vote(N,I,R,V)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/multi_paxos_missing1.ivy#L178)); `conjecture ~vote(N,I,none,V)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/multi_paxos_missing1.ivy#L181)); `conjecture joined_round(N,R2) & ~le(R2,R1) -> left_round(N,R1)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/multi_paxos_missing1.ivy#L184)); `conjecture one_b_msg(N,R,M) -> joined_round(N,R)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/multi_paxos_missing1.ivy#L185)); `conjecture one_b_msg(N,R2,M) & maxr(M,I) = none & ~le(R2,R1) -> ~vote(N,I,R1,V2)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/multi_paxos_missing1.ivy#L188)); `conjecture one_b_msg(N,R, M) & maxr(M,I) ~= none -> ~le(R,maxr(M,I)) & vote(N,I,maxr(M,I),maxv(M,I))` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/multi_paxos_missing1.ivy#L189)); `conjecture one_b_msg(N,R, M) & ~le(R,ROTHER) & ~le(ROTHER,maxr(M,I)) -> ~vote(N,I,ROTHER,VOTHER)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/multi_paxos_missing1.ivy#L190))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "199 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/multi_paxos_missing1.ivy)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/multi_paxos_missing1.ivy#L162", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "paxos (benchmarks/paxos.ivy)", "specifies": "Paxos consensus variant", "safety": "`conjecture ( decision(N1,R1,V1) &` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/paxos.ivy#L137))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "151 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/paxos.ivy)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/paxos.ivy#L137", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "paxos (benchmarks/paxos.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety ( decision(N1,R1,V1) &` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/paxos.pyv#L89))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof", "size": "117 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/paxos.pyv)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/paxos.pyv#L89", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "paxos_epr_missing1 (benchmarks/paxos_epr_missing1.ivy)", "specifies": "Paxos consensus variant", "safety": "`conjecture ( decision(N1,R1,V1) &` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/paxos_epr_missing1.ivy#L137)); `conjecture proposal(R,V1) & proposal(R,V2) -> V1 = V2` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/paxos_epr_missing1.ivy#L143)); `conjecture vote(N,R,V) -> proposal(R,V)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/paxos_epr_missing1.ivy#L146)); `conjecture forall R:round, V:value. (exists N:node. decision(N,R,V)) -> exists Q:quorum. forall N:node. member(N, Q) -> vote(N,R,V)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/paxos_epr_missing1.ivy#L149)); `conjecture one_b_max_vote(N,R2,none,V1) & ~le(R2,R1) -> ~vote(N,R1,V2)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/paxos_epr_missing1.ivy#L152)); `conjecture one_b_max_vote(N,R,RMAX,V) & RMAX ~= none -> ~le(R,RMAX) & vote(N,RMAX,V)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/paxos_epr_missing1.ivy#L153)); `conjecture one_b_max_vote(N,R,RMAX,V) & RMAX ~= none & ~le(R,ROTHER) & ~le(ROTHER,RMAX) -> ~vote(N,ROTHER,VOTHER)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/paxos_epr_missing1.ivy#L154)); `conjecture ~vote(N,none,V)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/paxos_epr_missing1.ivy#L157)); `conjecture one_b_max_vote(N,R,RMAX,V) -> one_b(N,R)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/paxos_epr_missing1.ivy#L164)); `conjecture one_b(N,R2) & ~le(R2,R1) -> left_rnd(N,R1)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/paxos_epr_missing1.ivy#L165))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "169 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/paxos_epr_missing1.ivy)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/paxos_epr_missing1.ivy#L137", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "sharded_kv (benchmarks/sharded_kv.ivy)", "specifies": "sharded key-value storage", "safety": "`conjecture table(N1, K, V1) & table(N2, K, V2) -> N1 = N2 & V1 = V2` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/sharded_kv.ivy#L45))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "51 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/sharded_kv.ivy)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/sharded_kv.ivy#L45", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "sharded_kv (benchmarks/sharded_kv.pyv)", "specifies": "sharded key-value storage", "safety": "`safety [keys_unique] table(N1, K, V1) & table(N2, K, V2) -> N1 = N2 & V1 = V2` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/sharded_kv.pyv#L38))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof", "size": "45 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/sharded_kv.pyv)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/sharded_kv.pyv#L38", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "sharded_kv_no_lost_keys (benchmarks/sharded_kv_no_lost_keys.ivy)", "specifies": "sharded key-value storage", "safety": "`conjecture (exists N,K,V. transfer_msg(N,K,V)) | (forall K. exists N. owner(N,K))` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/sharded_kv_no_lost_keys.ivy#L46))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "48 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/sharded_kv_no_lost_keys.ivy)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/sharded_kv_no_lost_keys.ivy#L46", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "sharded_kv_no_lost_keys (benchmarks/sharded_kv_no_lost_keys.pyv)", "specifies": "sharded key-value storage", "safety": "`safety (exists N,K,V. transfer_msg(N,K,V)) | (forall K. exists N. owner(N,K))` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/sharded_kv_no_lost_keys.pyv#L38))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof", "size": "40 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/sharded_kv_no_lost_keys.pyv)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/sharded_kv_no_lost_keys.pyv#L38", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "simple-de-lock (benchmarks/simple-de-lock.ivy)", "specifies": "lock protocol", "safety": "`conjecture X ~= Y -> ~(has_lock(X) & has_lock(Y))` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/simple-de-lock.ivy#L30))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "38 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/simple-de-lock.ivy)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/simple-de-lock.ivy#L30", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "simple-de-lock (benchmarks/simple-de-lock.pyv)", "specifies": "lock protocol", "safety": "`safety X != Y -> !(has_lock(X) & has_lock(Y))` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/simple-de-lock.pyv#L24))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof", "size": "29 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/simple-de-lock.pyv)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/simple-de-lock.pyv#L24", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "stoppable_paxos (benchmarks/stoppable_paxos.ivy)", "specifies": "Paxos consensus variant", "safety": "`conjecture ( decision(N1,I,R1,V1) &` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/stoppable_paxos.ivy#L194)); `conjecture decision(N1,I1,R1,stop) & ~inst_le(I2,I1) -> ~decision(N2,I2,R2,V)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/stoppable_paxos.ivy#L200))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "206 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/stoppable_paxos.ivy)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/stoppable_paxos.ivy#L194", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "stoppable_paxos (benchmarks/stoppable_paxos.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety ( decision(N1,I,R1,V1) &` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/stoppable_paxos.pyv#L150)); `safety decision(N1,I1,R1,stop) & !inst_le(I2,I1) -> !decision(N2,I2,R2,V)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/stoppable_paxos.pyv#L156))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof", "size": "208 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/stoppable_paxos.pyv)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/stoppable_paxos.pyv#L150", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "stoppable_paxos_start_with_hard (benchmarks/stoppable_paxos_start_with_hard.ivy)", "specifies": "Paxos consensus variant", "safety": "`conjecture ( decision(N1,I,R1,V1) &` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/stoppable_paxos_start_with_hard.ivy#L194)); `conjecture decision(N1,I1,R1,stop) & ~inst_le(I2,I1) -> ~decision(N2,I2,R2,V)` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/stoppable_paxos_start_with_hard.ivy#L200)); `conjecture forall I:inst, R1:round, R2:round, V:value, Q:quorum. ( ~le(R2,R1) & active(R2) & ~proposal(I,R2,V) -> (` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/stoppable_paxos_start_with_hard.ivy#L202)); `conjecture forall I1:inst, I2:inst, R1:round, R2:round, V:value, Q:quorum. ( ~le(R2,R1) & ~inst_le(I2,I1) & proposal(I2,R2,V) -> (` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/stoppable_paxos_start_with_hard.ivy#L208)); `conjecture forall I1:inst, I2:inst, R1:round, R2:round, V:value, Q:quorum. ( ~le(R2,R1) & ~inst_le(I2,I1) & proposal(I1,R2,stop) -> (` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/stoppable_paxos_start_with_hard.ivy#L214))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "218 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/stoppable_paxos_start_with_hard.ivy)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/stoppable_paxos_start_with_hard.ivy#L194", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "ticket (benchmarks/ticket.ivy)", "specifies": "ticket lock", "safety": "`conjecture pc3(T1) & pc3(T2) -> T1 = T2` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/ticket.ivy#L70))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "87 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/ticket.ivy)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/ticket.ivy#L70", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "ticket (benchmarks/ticket.pyv)", "specifies": "ticket lock", "safety": "`safety [mutex] pc3(T1) & pc3(T2) -> T1 = T2` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/ticket.pyv#L59))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof", "size": "99 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/ticket.pyv)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/ticket.pyv#L59", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "toy_consensus_epr (benchmarks/toy_consensus_epr.ivy)", "specifies": "consensus/agreement protocol", "safety": "`conjecture decided(V1) & decided(V2) -> V1 = V2` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/toy_consensus_epr.ivy#L36))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "40 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/toy_consensus_epr.ivy)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/toy_consensus_epr.ivy#L36", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "toy_consensus_epr (benchmarks/toy_consensus_epr.pyv)", "specifies": "consensus/agreement protocol", "safety": "`safety decided(V1) & decided(V2) -> V1 = V2` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/toy_consensus_epr.pyv#L29))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof", "size": "32 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/toy_consensus_epr.pyv)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/toy_consensus_epr.pyv#L29", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "toy_consensus_forall (benchmarks/toy_consensus_forall.ivy)", "specifies": "consensus/agreement protocol", "safety": "`conjecture decided(V1) & decided(V2) -> V1 = V2` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/toy_consensus_forall.ivy#L37))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "41 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/toy_consensus_forall.ivy)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/toy_consensus_forall.ivy#L37", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "toy_consensus_forall (benchmarks/toy_consensus_forall.pyv)", "specifies": "consensus/agreement protocol", "safety": "`safety decided(V1) & decided(V2) -> V1 = V2` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/toy_consensus_forall.pyv#L31))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof", "size": "34 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/toy_consensus_forall.pyv)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/toy_consensus_forall.pyv#L31", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "vertical_paxos (benchmarks/vertical_paxos.ivy)", "specifies": "Paxos consensus variant", "safety": "`conjecture ( decision(N1,R1,V1) &` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/vertical_paxos.ivy#L180))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "240 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/vertical_paxos.ivy)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/vertical_paxos.ivy#L180", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "vertical_paxos (benchmarks/vertical_paxos.pyv)", "specifies": "Paxos consensus variant", "safety": "`safety ( decision(N1,R1,V1) &` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/vertical_paxos.pyv#L149))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (pyv); source contract is present, but this row does not assert a successful machine-checked proof", "size": "205 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/vertical_paxos.pyv)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/vertical_paxos.pyv#L149", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "SWISS: Ivy and mypyvy benchmark encodings", "name": "vertical_paxos_start_with_hard (benchmarks/vertical_paxos_start_with_hard.ivy)", "specifies": "Paxos consensus variant", "safety": "`conjecture ( decision(N1,R1,V1) &` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/vertical_paxos_start_with_hard.ivy#L178)); `conjecture forall R1:round, R2:round, V1:value, V2:value, Q:quorum, C:config.` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/vertical_paxos_start_with_hard.ivy#L209)); `conjecture complete_msg(RR) & ~le(RR,R) & configure_round_msg(R,C) & quorumin(Q,C) &` ([source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/vertical_paxos_start_with_hard.ivy#L217))", "liveness": "no active temporal/progress declaration found in this file", "tool": "SWISS invariant-synthesis input (ivy); source contract is present, but this row does not assert a successful machine-checked proof", "size": "232 lines in this file; [exact source](https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/vertical_paxos_start_with_hard.ivy)", "source_url": "https://github.com/secure-foundations/SWISS/blob/348b9c4f9b0b2f124b50c8f420d071f4bc0789b3/benchmarks/vertical_paxos_start_with_hard.ivy#L178", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Veil / Lean: distributed and concurrent examples", "name": "AWSBuggy (Examples/AWS/AWSBuggy.lean)", "specifies": "AWS DNS race", "safety": "`safety [DnsConsistent] dns_valid = true` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/AWS/AWSBuggy.lean#L132))", "liveness": "no active temporal/progress declaration found in this file", "negative-test_warning": "the filename marks this as a bad/buggy/unsafe/error variant; displayed properties are attempted checks, not established guarantees", "tool": "Veil / Lean; finite model-checking command present; `#model_check { Enactor := Fin 2 } { max_plan := 3, plan_age_threshold := 2 }` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/AWS/AWSBuggy.lean#L137))", "size": "139 lines in this file; [exact source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/AWS/AWSBuggy.lean)", "source_url": "https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/AWS/AWSBuggy.lean#L132", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Veil / Lean: distributed and concurrent examples", "name": "AWSFixed (Examples/AWS/AWSFixed.lean)", "specifies": "AWS DNS race", "safety": "`safety [DnsConsistent] dns_valid = true` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/AWS/AWSFixed.lean#L125))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Veil / Lean; SMT-backed induction checking command present; `#check_invariants` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/AWS/AWSFixed.lean#L166))", "size": "168 lines in this file; [exact source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/AWS/AWSFixed.lean)", "source_url": "https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/AWS/AWSFixed.lean#L125", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Veil / Lean: distributed and concurrent examples", "name": "Blockchain (Examples/Ivy/Blockchain.lean)", "specifies": "blockchain protocol", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Veil / Lean; SMT-backed induction checking command present; `#check_invariants` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/Blockchain.lean#L109))", "size": "111 lines in this file; [exact source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/Blockchain.lean)", "source_url": "https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/Blockchain.lean#L109", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Veil / Lean: distributed and concurrent examples", "name": "ChordRingMaintenance (Examples/Ivy/ChordRingMaintenance.lean)", "specifies": "ring protocol", "safety": "`safety [no_error] ¬ error N` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/ChordRingMaintenance.lean#L143))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Veil / Lean; SMT-backed induction checking command present; `#check_invariants` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/ChordRingMaintenance.lean#L167))", "size": "169 lines in this file; [exact source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/ChordRingMaintenance.lean)", "source_url": "https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/ChordRingMaintenance.lean#L143", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Veil / Lean: distributed and concurrent examples", "name": "DecentralizedLock (Examples/Ivy/DecentralizedLock.lean)", "specifies": "lock protocol", "safety": "`safety [mutex] ¬ (has_lock X ∧ has_lock Y ∧ X ≠ Y)` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/DecentralizedLock.lean#L51))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Veil / Lean; SMT-backed induction checking command present; `#check_invariants` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/DecentralizedLock.lean#L59))", "size": "63 lines in this file; [exact source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/DecentralizedLock.lean)", "source_url": "https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/DecentralizedLock.lean#L51", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Veil / Lean: distributed and concurrent examples", "name": "MultiSigAll (Examples/Ivy/MultiSigAll.lean)", "specifies": "multisignature contract", "safety": "`safety [cancelled_after_deadline] cancelled N K V D → expired D` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/MultiSigAll.lean#L78)); `safety [paid_if_enough_sigs] paid N K V D → (∀ s, sig N K V D s ∧ sig_auth s)` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/MultiSigAll.lean#L79)); `safety [paid_imp_proposed] paid N K V D → proposed N K V D` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/MultiSigAll.lean#L80))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Veil / Lean; SMT-backed induction checking command present; `#check_invariants` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/MultiSigAll.lean#L87))", "size": "90 lines in this file; [exact source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/MultiSigAll.lean)", "source_url": "https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/MultiSigAll.lean#L78", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Veil / Lean: distributed and concurrent examples", "name": "MultiSigMajority (Examples/Ivy/MultiSigMajority.lean)", "specifies": "multisignature contract", "safety": "`safety [cancelled_after_deadline] cancelled N K V D → expired D` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/MultiSigMajority.lean#L88)); `safety [paid_if_enough_sigs] paid N K V D → (∃ q, ∀ s, (member s q) → (sig N K V D s ∧ sig_auth s))` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/MultiSigMajority.lean#L89)); `safety [paid_imp_proposed] paid N K V D → proposed N K V D` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/MultiSigMajority.lean#L90))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Veil / Lean; SMT-backed induction checking command present; `#check_invariants` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/MultiSigMajority.lean#L97))", "size": "99 lines in this file; [exact source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/MultiSigMajority.lean)", "source_url": "https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/MultiSigMajority.lean#L88", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Veil / Lean: distributed and concurrent examples", "name": "NOPaxos (Examples/Ivy/NOPaxos.lean)", "specifies": "Paxos consensus variant", "safety": "`safety [consistency] gh_committed S V1 ∧ gh_committed S V2 → V1 = V2` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/NOPaxos.lean#L243))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Veil / Lean; SMT-backed induction checking command present; `#check_invariants` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/NOPaxos.lean#L269))", "size": "271 lines in this file; [exact source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/NOPaxos.lean)", "source_url": "https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/NOPaxos.lean#L243", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Veil / Lean: distributed and concurrent examples", "name": "PaxosEPR (Examples/Ivy/PaxosEPR.lean)", "specifies": "Paxos consensus variant", "safety": "`safety [coherence] decision N1 R1 V1 ∧ decision N2 R2 V2 → V1 = V2` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/PaxosEPR.lean#L91))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Veil / Lean; SMT-backed induction checking command present; `#check_invariants` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/PaxosEPR.lean#L123))", "size": "125 lines in this file; [exact source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/PaxosEPR.lean)", "source_url": "https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/PaxosEPR.lean#L91", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Veil / Lean: distributed and concurrent examples", "name": "PaxosFirstOrder (Examples/Ivy/PaxosFirstOrder.lean)", "specifies": "Paxos consensus variant", "safety": "`safety [coherence] decision N1 R1 V1 ∧ decision N2 R2 V2 → V1 = V2` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/PaxosFirstOrder.lean#L99))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Veil / Lean; SMT-backed induction checking command present; `#check_invariants` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/PaxosFirstOrder.lean#L130))", "size": "132 lines in this file; [exact source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/PaxosFirstOrder.lean)", "source_url": "https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/PaxosFirstOrder.lean#L99", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Veil / Lean: distributed and concurrent examples", "name": "ReliableBroadcast (Examples/Ivy/ReliableBroadcast.lean)", "specifies": "reliable broadcast", "safety": "`safety [vote_integrity] ∀ (src dst : address) (r : round) (v : value),` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/ReliableBroadcast.lean#L122)); `safety [deliver_integrity] ∀ (src dst : address) (r : round) (v : value),` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/ReliableBroadcast.lean#L127)); `safety [agreement] ∀ (src dst₁ dst₂ : address) (r : round) (v₁ v₂ : value),` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/ReliableBroadcast.lean#L132))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Veil / Lean; SMT-backed induction checking command present; `#check_invariants` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/ReliableBroadcast.lean#L204))", "size": "212 lines in this file; [exact source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/ReliableBroadcast.lean)", "source_url": "https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/ReliableBroadcast.lean#L122", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Veil / Lean: distributed and concurrent examples", "name": "RicartAgrawala (Examples/Ivy/RicartAgrawala.lean)", "specifies": "Ricart–Agrawala mutual exclusion", "safety": "`safety [mutual_exclusion] (holds N1 ∧ holds N2) → N1 = N2` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/RicartAgrawala.lean#L51))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Veil / Lean; SMT-backed induction checking command present; `#check_invariants` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/RicartAgrawala.lean#L59))", "size": "61 lines in this file; [exact source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/RicartAgrawala.lean)", "source_url": "https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/RicartAgrawala.lean#L51", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Veil / Lean: distributed and concurrent examples", "name": "Ring (Examples/Ivy/Ring.lean)", "specifies": "ring protocol", "safety": "`safety [single_leader] leader N ∧ leader M → N = M` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/Ring.lean#L42))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Veil / Lean; SMT-backed induction checking command present; `#check_invariants` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/Ring.lean#L62))", "size": "64 lines in this file; [exact source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/Ring.lean)", "source_url": "https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/Ring.lean#L42", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Veil / Lean: distributed and concurrent examples", "name": "SuzukiKasami (Examples/Ivy/SuzukiKasami.lean)", "specifies": "Suzuki–Kasami mutual exclusion", "safety": "`invariant [mutex] (crit N ∧ crit M) → N = M` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/SuzukiKasami.lean#L111))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Veil / Lean; SMT-backed induction checking command present; `#check_invariants` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/SuzukiKasami.lean#L128))", "size": "130 lines in this file; [exact source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/SuzukiKasami.lean)", "source_url": "https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/SuzukiKasami.lean#L111", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Veil / Lean: distributed and concurrent examples", "name": "TwoPhaseCommit (Examples/Ivy/TwoPhaseCommit.lean)", "specifies": "two-phase atomic commit", "safety": "`invariant [manual_1] ¬((¬(alive N) ∧ ¬(abort_flag)))` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/TwoPhaseCommit.lean#L88))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Veil / Lean; SMT-backed induction checking command present; `#check_invariants` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/TwoPhaseCommit.lean#L99))", "size": "103 lines in this file; [exact source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/TwoPhaseCommit.lean)", "source_url": "https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/TwoPhaseCommit.lean#L88", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Veil / Lean: distributed and concurrent examples", "name": "VerticalPaxosFirstOrder (Examples/Ivy/VerticalPaxosFirstOrder.lean)", "specifies": "Paxos consensus variant", "safety": "`safety [coherence] decision N1 R1 V1 ∧ decision N2 R2 V2 → V1 = V2` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/VerticalPaxosFirstOrder.lean#L132))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Veil / Lean; SMT-backed induction checking command present; `#check_invariants` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/VerticalPaxosFirstOrder.lean#L455))", "size": "457 lines in this file; [exact source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/VerticalPaxosFirstOrder.lean)", "source_url": "https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Ivy/VerticalPaxosFirstOrder.lean#L132", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Veil / Lean: distributed and concurrent examples", "name": "CheckpointLeaseFailover (Examples/Simulate/CheckpointLeaseFailover.lean)", "specifies": "lease renewal/failover", "safety": "`safety [checkpointed_expiry_respected] ∀ (l : lease) (expiry now : epoch),` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Simulate/CheckpointLeaseFailover.lean#L77))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Veil / Lean; specification/simulation only; no active invariant or model-check command found", "size": "95 lines in this file; [exact source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Simulate/CheckpointLeaseFailover.lean)", "source_url": "https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Simulate/CheckpointLeaseFailover.lean#L77", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Veil / Lean: distributed and concurrent examples", "name": "LeaseKeepaliveRace (Examples/Simulate/LeaseKeepaliveRace.lean)", "specifies": "lease renewal/failover", "safety": "`safety [renewal_keeps_keys_live] ∀ (c : client) (k : key), keepalive_succeeded c ∧ key_attached c k -> key_present k` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Simulate/LeaseKeepaliveRace.lean#L73))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Veil / Lean; specification/simulation only; no active invariant or model-check command found", "size": "87 lines in this file; [exact source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Simulate/LeaseKeepaliveRace.lean)", "source_url": "https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Simulate/LeaseKeepaliveRace.lean#L73", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Veil / Lean: distributed and concurrent examples", "name": "ReliableBroadcast (Examples/Simulate/ReliableBroadcast.lean)", "specifies": "reliable broadcast", "safety": "`safety [agreement] ∀ (n1 n2 : node) (v1 v2 : value), delivered n1 v1 ∧ delivered n2 v2 -> v1 = v2` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Simulate/ReliableBroadcast.lean#L61))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Veil / Lean; specification/simulation only; no active invariant or model-check command found", "size": "75 lines in this file; [exact source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Simulate/ReliableBroadcast.lean)", "source_url": "https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Simulate/ReliableBroadcast.lean#L61", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Veil / Lean: distributed and concurrent examples", "name": "SCP (Examples/StellarConsensus/SCP.lean)", "specifies": "consensus/agreement protocol", "safety": "`safety [intertwined_safe] ∀ (n1 n2 : node) (b1 b2 : ballot) (v1 v2 : value),` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/StellarConsensus/SCP.lean#L218))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Veil / Lean; SMT-backed induction checking command present; `#time #check_invariants` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/StellarConsensus/SCP.lean#L346))", "size": "348 lines in this file; [exact source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/StellarConsensus/SCP.lean)", "source_url": "https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/StellarConsensus/SCP.lean#L218", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Veil / Lean: distributed and concurrent examples", "name": "FasterFloodSet (Examples/Synchronous/FasterFloodSet.lean)", "specifies": "synchronous FloodSet consensus", "safety": "`safety [agreement] ∀ n1 n2 v1 v2, decision n1 v1 ∧ decision n2 v2 → v1 = v2` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Synchronous/FasterFloodSet.lean#L179)); `safety [validity] ∀ n v, decision n v → (∃ m, initialValue m == v)` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Synchronous/FasterFloodSet.lean#L183)); `safety [all_nodes] ∀ n, nset.contains n allnodes` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Synchronous/FasterFloodSet.lean#L187))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Veil / Lean; finite model-checking command present; `#model_check` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Synchronous/FasterFloodSet.lean#L245))", "size": "252 lines in this file; [exact source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Synchronous/FasterFloodSet.lean)", "source_url": "https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Synchronous/FasterFloodSet.lean#L179", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Veil / Lean: distributed and concurrent examples", "name": "FloodSet (Examples/Synchronous/FloodSet.lean)", "specifies": "synchronous FloodSet consensus", "safety": "`safety [agreement] ∀ n1 n2 v1 v2, decision n1 v1 ∧ decision n2 v2 → v1 = v2` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Synchronous/FloodSet.lean#L137)); `safety [validity] ∀ n v, decision n v → (∃ m, initialValue m == v)` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Synchronous/FloodSet.lean#L141))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Veil / Lean; SMT-backed induction checking command present; `#check_invariants` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Synchronous/FloodSet.lean#L245))", "size": "247 lines in this file; [exact source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Synchronous/FloodSet.lean)", "source_url": "https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Synchronous/FloodSet.lean#L137", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Veil / Lean: distributed and concurrent examples", "name": "AWSDnsRace (Examples/TLA/AWSDnsRace.lean)", "specifies": "AWS DNS race", "safety": "`invariant [NeverDeleteActive] current_plan > 0 → ¬(plan_deleted current_plan true)` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/AWSDnsRace.lean#L89))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Veil / Lean; finite model-checking command present; `#model_check {}{ max_plan := 3, plan_age_threshold := 2 }` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/AWSDnsRace.lean#L96))", "size": "98 lines in this file; [exact source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/AWSDnsRace.lean)", "source_url": "https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/AWSDnsRace.lean#L89", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Veil / Lean: distributed and concurrent examples", "name": "Bakery (Examples/TLA/Bakery.lean)", "specifies": "Bakery mutual exclusion", "safety": "`safety [mutual_exclusion] pc I = cs ∧ pc J = cs → I = J` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/Bakery.lean#L300))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Veil / Lean; specification/simulation only; no active invariant or model-check command found", "size": "318 lines in this file; [exact source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/Bakery.lean)", "source_url": "https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/Bakery.lean#L300", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Veil / Lean: distributed and concurrent examples", "name": "BcastByz (Examples/TLA/BcastByz.lean)", "specifies": "Byzantine broadcast", "safety": "`invariant [Corr_cup_faulty_eq_proc] pset.union Corr Faulty == Proc` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/BcastByz.lean#L211))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Veil / Lean; finite model-checking command present; `#model_check` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/BcastByz.lean#L218))", "size": "227 lines in this file; [exact source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/BcastByz.lean)", "source_url": "https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/BcastByz.lean#L211", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Veil / Lean: distributed and concurrent examples", "name": "BuggyCircularBuffer (Examples/TLA/BuggyCircularBuffer.lean)", "specifies": "circular buffer concurrency", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "negative-test_warning": "the filename marks this as a bad/buggy/unsafe/error variant; displayed properties are attempted checks, not established guarantees", "tool": "Veil / Lean; finite model-checking command present; `#model_check { } { }` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/BuggyCircularBuffer.lean#L63))", "size": "65 lines in this file; [exact source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/BuggyCircularBuffer.lean)", "source_url": "https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/BuggyCircularBuffer.lean#L63", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Veil / Lean: distributed and concurrent examples", "name": "EPaxos (Examples/TLA/EPaxos.lean)", "specifies": "Paxos consensus variant", "safety": "`invariant [Consistency] ∀ i : Instance replica seqNum, commitSet.count (committedMap i) <= 1` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/EPaxos.lean#L1378))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Veil / Lean; specification/simulation only; no active invariant or model-check command found", "size": "1421 lines in this file; [exact source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/EPaxos.lean)", "source_url": "https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/EPaxos.lean#L1378", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Veil / Lean: distributed and concurrent examples", "name": "EWD840 (Examples/TLA/EWD840.lean)", "specifies": "distributed termination detection", "safety": "`invariant [TerminationDetection] (terminationDetected → terminated)` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/EWD840.lean#L118))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Veil / Lean; finite model-checking command present; `#model_check` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/EWD840.lean#L129))", "size": "135 lines in this file; [exact source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/EWD840.lean)", "source_url": "https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/EWD840.lean#L118", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Veil / Lean: distributed and concurrent examples", "name": "KVSnap (Examples/TLA/KVSnap.lean)", "specifies": "key-value snapshot protocol", "safety": "`invariant [serializability] TransactionsPool.length > 0 →` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/KVSnap.lean#L279))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Veil / Lean; specification/simulation only; no active invariant or model-check command found", "size": "327 lines in this file; [exact source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/KVSnap.lean)", "source_url": "https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/KVSnap.lean#L279", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Veil / Lean: distributed and concurrent examples", "name": "KVSnapRe (Examples/TLA/KVSnapRe.lean)", "specifies": "key-value snapshot protocol", "safety": "`invariant [serializability] TransactionsPool.length > 0 →` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/KVSnapRe.lean#L282))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Veil / Lean; specification/simulation only; no active invariant or model-check command found", "size": "333 lines in this file; [exact source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/KVSnapRe.lean)", "source_url": "https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/KVSnapRe.lean#L282", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Veil / Lean: distributed and concurrent examples", "name": "KeyValueStore (Examples/TLA/KeyValueStore.lean)", "specifies": "key-value store", "safety": "`invariant [unique_store] store K M ∧ store K N → M = N` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/KeyValueStore.lean#L144))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Veil / Lean; finite model-checking command present; `#model_check {key := key_IndT, value := value_IndT, txId := txId_IndT } {}` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/KeyValueStore.lean#L150))", "size": "153 lines in this file; [exact source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/KeyValueStore.lean)", "source_url": "https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/KeyValueStore.lean#L144", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Veil / Lean: distributed and concurrent examples", "name": "MultiPaxos (Examples/TLA/MultiPaxos.lean)", "specifies": "Paxos consensus variant", "safety": "`invariant [consistency] ∀ (v1 v2 : value) (s : slot),` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/MultiPaxos.lean#L369))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Veil / Lean; specification/simulation only; no active invariant or model-check command found", "size": "436 lines in this file; [exact source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/MultiPaxos.lean)", "source_url": "https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/MultiPaxos.lean#L369", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Veil / Lean: distributed and concurrent examples", "name": "MutexViolation (Examples/TLA/MutexViolation.lean)", "specifies": "mutual exclusion", "safety": "`invariant [mutual_exclusion] ∀ I J, I ≠ J → ¬ (pc I cs ∧ pc J cs)` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/MutexViolation.lean#L344))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Veil / Lean; specification/simulation only; no active invariant or model-check command found", "size": "354 lines in this file; [exact source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/MutexViolation.lean)", "source_url": "https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/MutexViolation.lean#L344", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Veil / Lean: distributed and concurrent examples", "name": "NOPaxos (Examples/TLA/NOPaxos.lean)", "specifies": "Paxos consensus variant", "safety": "`invariant [linearizability] let mReqReps := mSet.filter messages (fun m => m.mtype == .MRequestReply)` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/NOPaxos.lean#L1517))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Veil / Lean; specification/simulation only; no active invariant or model-check command found", "size": "1566 lines in this file; [exact source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/NOPaxos.lean)", "source_url": "https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/NOPaxos.lean#L1517", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Veil / Lean: distributed and concurrent examples", "name": "Paxos (Examples/TLA/Paxos.lean)", "specifies": "Paxos consensus variant", "safety": "`invariant [Consistency] ∀ v1 v2, Chosen v1 ∧ Chosen v2 → v1 = v2` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/Paxos.lean#L319))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Veil / Lean; specification/simulation only; no active invariant or model-check command found", "size": "401 lines in this file; [exact source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/Paxos.lean)", "source_url": "https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/Paxos.lean#L319", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Veil / Lean: distributed and concurrent examples", "name": "Peterson (Examples/TLA/Peterson.lean)", "specifies": "Peterson mutual exclusion", "safety": "`safety [mutual_exclusion] ∀ i j, i ≠ j → ¬(lockcs i ∧ lockcs j)` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/Peterson.lean#L108))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Veil / Lean; finite model-checking command present; `#model_check{ }{ }` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/Peterson.lean#L127))", "size": "129 lines in this file; [exact source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/Peterson.lean)", "source_url": "https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/Peterson.lean#L108", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Veil / Lean: distributed and concurrent examples", "name": "Raft (Examples/TLA/Raft.lean)", "specifies": "Raft replicated log", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Veil / Lean; specification/simulation only; no active invariant or model-check command found", "size": "1113 lines in this file; [exact source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/Raft.lean)", "source_url": "https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/Raft.lean", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Veil / Lean: distributed and concurrent examples", "name": "Room (Examples/TLA/Room.lean)", "specifies": "room/guest allocation", "safety": "`safety [registered_at_most_one] ∀ r g1 g2, guestTset.contains g1 (registered r) ∧ guestTset.contains g2 (registered r) → g1 = g2` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/Room.lean#L122)); `safety [guest_in_room_valid] ∀ g, assignedKey g = room →` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/Room.lean#L129)); `safety [room_occupied_valid] ∀ r, inside r = body →` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/Room.lean#L139))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Veil / Lean; finite model-checking command present; `#model_check` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/Room.lean#L148))", "size": "161 lines in this file; [exact source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/Room.lean)", "source_url": "https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/Room.lean#L122", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Veil / Lean: distributed and concurrent examples", "name": "SimpleAllocator (Examples/TLA/SimpleAllocator.lean)", "specifies": "resource allocation", "safety": "`invariant [resource_mutex] ∀ c1 c2 : client, c1 ≠ c2 → (resSet.intersection (alloc c1) (alloc c2) = resSet.empty)` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/SimpleAllocator.lean#L83))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Veil / Lean; finite model-checking command present; `#model_check` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/SimpleAllocator.lean#L87))", "size": "95 lines in this file; [exact source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/SimpleAllocator.lean)", "source_url": "https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/SimpleAllocator.lean#L83", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Veil / Lean: distributed and concurrent examples", "name": "Traffic (Examples/TLA/Traffic.lean)", "specifies": "traffic-light controller", "safety": "`safety [puzzle_unsolvable] at_light = true` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/Traffic.lean#L70))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Veil / Lean; finite model-checking command present; `#model_check { ProcSet := ProcSet_IndT, Color := Color_IndT, states := states_IndT } {}` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/Traffic.lean#L77))", "size": "79 lines in this file; [exact source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/Traffic.lean)", "source_url": "https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/Traffic.lean#L70", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Veil / Lean: distributed and concurrent examples", "name": "TwoPhaseCommit (Examples/TLA/TwoPhaseCommit.lean)", "specifies": "two-phase atomic commit", "safety": "`invariant [TCConsistency] ¬ (∃ rm1 rm2 : RM,` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/TwoPhaseCommit.lean#L216))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Veil / Lean; finite model-checking command present; `#model_check { RM := Fin 3 }` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/TwoPhaseCommit.lean#L221))", "size": "224 lines in this file; [exact source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/TwoPhaseCommit.lean)", "source_url": "https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/TLA/TwoPhaseCommit.lean#L216", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Veil / Lean: distributed and concurrent examples", "name": "FloodSet (Examples/Tutorial/FloodSet.lean)", "specifies": "synchronous FloodSet consensus", "safety": "`safety [agreement] ∀ n₁ n₂ v₁ v₂, decision n₁ v₁ ∧ decision n₂ v₂ → v₁ = v₂` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Tutorial/FloodSet.lean#L239)); `safety [strong_validity] ∀ n v, decision n v → ((∃ m, initialValue m = v))` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Tutorial/FloodSet.lean#L242))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Veil / Lean; SMT-backed induction checking command present; `#check_invariants` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Tutorial/FloodSet.lean#L481))", "size": "483 lines in this file; [exact source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Tutorial/FloodSet.lean)", "source_url": "https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Tutorial/FloodSet.lean#L239", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Veil / Lean: distributed and concurrent examples", "name": "RingDec (Examples/Tutorial/POPL26/RingDec.lean)", "specifies": "ring protocol", "safety": "`safety [single_leader] leader N ∧ leader M → N = M` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Tutorial/POPL26/RingDec.lean#L42))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Veil / Lean; SMT-backed induction checking command present; `#check_invariants` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Tutorial/POPL26/RingDec.lean#L61))", "size": "63 lines in this file; [exact source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Tutorial/POPL26/RingDec.lean)", "source_url": "https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Tutorial/POPL26/RingDec.lean#L42", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Veil / Lean: distributed and concurrent examples", "name": "RingFin (Examples/Tutorial/POPL26/RingFin.lean)", "specifies": "ring protocol", "safety": "`safety [single_leader] leader.length ≤ 1` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Tutorial/POPL26/RingFin.lean#L53))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Veil / Lean; finite model-checking command present; `#model_check { node := Fin 4 } { nextNode := fun n => n + 1 }` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Tutorial/POPL26/RingFin.lean#L58))", "size": "60 lines in this file; [exact source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Tutorial/POPL26/RingFin.lean)", "source_url": "https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Tutorial/POPL26/RingFin.lean#L53", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Veil / Lean: distributed and concurrent examples", "name": "RingNat (Examples/Tutorial/POPL26/RingNat.lean)", "specifies": "ring protocol", "safety": "`safety [single_leader] leader.length ≤ 1` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Tutorial/POPL26/RingNat.lean#L50))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Veil / Lean; finite model-checking command present; `#model_check { }` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Tutorial/POPL26/RingNat.lean#L55))", "size": "67 lines in this file; [exact source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Tutorial/POPL26/RingNat.lean)", "source_url": "https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Tutorial/POPL26/RingNat.lean#L50", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Veil / Lean: distributed and concurrent examples", "name": "Ring (Examples/Tutorial/Ring.lean)", "specifies": "ring protocol", "safety": "`safety [single_leader] leader L1 ∧ leader L2 → L1 = L2` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Tutorial/Ring.lean#L217))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Veil / Lean; SMT-backed induction checking command present; `#check_invariants` ([source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Tutorial/Ring.lean#L384))", "size": "386 lines in this file; [exact source](https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Tutorial/Ring.lean)", "source_url": "https://github.com/verse-lab/veil/blob/626901534a8c788e45b350328021cd4d7a942c32/Examples/Tutorial/Ring.lean#L217", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Quint: distributed examples and Cosmos protocols", "name": "bakery (examples/classic/distributed/Bakery/bakery.qnt)", "specifies": "Bakery mutual exclusion", "safety": "`def TypeOK = and { val state_space =` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/Bakery/bakery.qnt#L162)); `def correctness = processes.filter(x => op.get(x) == Critical).size() <= 1` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/Bakery/bakery.qnt#L236)); `def IndInv = and { TypeOK,` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/Bakery/bakery.qnt#L273))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file", "size": "392 lines in this file; [exact source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/Bakery/bakery.qnt)", "source_url": "https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/Bakery/bakery.qnt#L162", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Quint: distributed examples and Cosmos protocols", "name": "clockSync6 (examples/classic/distributed/ClockSync/clockSync6.qnt)", "specifies": "clock synchronization", "safety": "`val skew_inv: bool = { val all_sync = states.values().forall(s => s.control_state == Sync)` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/ClockSync/clockSync6.qnt#L168))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file", "size": "192 lines in this file; [exact source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/ClockSync/clockSync6.qnt)", "source_url": "https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/ClockSync/clockSync6.qnt#L168", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Quint: distributed examples and Cosmos protocols", "name": "ConsensusAlg (examples/classic/distributed/ConsensusAlgorithm/ConsensusAlg.qnt)", "specifies": "consensus/agreement protocol", "safety": "`val agreement = Procs.exclude(crashed).forall(process1 => { Procs.exclude(crashed).forall(process2 => {` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/ConsensusAlgorithm/ConsensusAlg.qnt#L87)); `val validity = { val allProposalValues = Procs.map(process => procState.get(process).proposalValue)` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/ConsensusAlgorithm/ConsensusAlg.qnt#L97))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file", "size": "317 lines in this file; [exact source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/ConsensusAlgorithm/ConsensusAlg.qnt)", "source_url": "https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/ConsensusAlgorithm/ConsensusAlg.qnt#L87", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Quint: distributed examples and Cosmos protocols", "name": "KSetAgreementConsensus (examples/classic/distributed/ConsensusAlgorithm/KSetAgreementConsensus.qnt)", "specifies": "consensus/agreement protocol", "safety": "`val kSetAgreement = { val decidedValues = Procs.exclude(crashed).map(p => procState.get(p).decision).filter(v => v != None)` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/ConsensusAlgorithm/KSetAgreementConsensus.qnt#L18))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file", "size": "137 lines in this file; [exact source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/ConsensusAlgorithm/KSetAgreementConsensus.qnt)", "source_url": "https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/ConsensusAlgorithm/KSetAgreementConsensus.qnt#L18", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Quint: distributed examples and Cosmos protocols", "name": "DiningPhilosophers5 (examples/classic/distributed/DiningPhilosophers/DiningPhilosophers5.qnt)", "specifies": "dining philosophers", "safety": "`val Safety = and { philosophers.forall(p =>` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/DiningPhilosophers/DiningPhilosophers5.qnt#L123))", "liveness": "`temporal DeadlockProperty = eventually(DeadlockCondition)` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/DiningPhilosophers/DiningPhilosophers5.qnt#L141)); `temporal DeadlockFreedom = weakFair(step, vars) implies always(eventually(not(DeadlockCondition)))` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/DiningPhilosophers/DiningPhilosophers5.qnt#L146)); `temporal LivelockFreedom = weakFair(step, vars) implies philosophers.forall(p => not(always(states.get(p) == Hungry)))` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/DiningPhilosophers/DiningPhilosophers5.qnt#L147))", "tool": "Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file", "size": "151 lines in this file; [exact source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/DiningPhilosophers/DiningPhilosophers5.qnt)", "source_url": "https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/DiningPhilosophers/DiningPhilosophers5.qnt#L123", "has_liveness": true}
{"section": "Invariant and modeling tools", "group": "Quint: distributed examples and Cosmos protocols", "name": "LamportMutex (examples/classic/distributed/LamportMutex/LamportMutex.qnt)", "specifies": "mutual exclusion", "safety": "`val Mutex = crit.forall(p => crit.forall(q => p == q))` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/LamportMutex/LamportMutex.qnt#L175))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file", "size": "183 lines in this file; [exact source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/LamportMutex/LamportMutex.qnt)", "source_url": "https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/LamportMutex/LamportMutex.qnt#L175", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Quint: distributed examples and Cosmos protocols", "name": "Paxos (examples/classic/distributed/Paxos/Paxos.qnt)", "specifies": "Paxos consensus variant", "safety": "`val TypeOK = and { maxBal.in(Acceptor.setOfMaps(Ballot.union(Set(-1)))),` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/Paxos/Paxos.qnt#L98)); `val Inv = and { TypeOK,` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/Paxos/Paxos.qnt#L272))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file", "size": "300 lines in this file; [exact source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/Paxos/Paxos.qnt)", "source_url": "https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/Paxos/Paxos.qnt#L98", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Quint: distributed examples and Cosmos protocols", "name": "Voting (examples/classic/distributed/Paxos/Voting.qnt)", "specifies": "Paxos consensus variant", "safety": "`val TypeOK = and { votes.in(Acceptor.setOfMaps(powerset(tuples(Ballot, Value)))),` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/Paxos/Voting.qnt#L49)); `val VotesSafe = tuples(Acceptor, Ballot, Value).forall( ((a, b, v)) =>` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/Paxos/Voting.qnt#L112)); `val OneVote = tuples(Acceptor, Ballot, Value, Value).forall( ((a, b, v, w)) =>` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/Paxos/Voting.qnt#L117)); `val OneValuePerBallot = tuples(Acceptor, Acceptor, Ballot, Value, Value)` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/Paxos/Voting.qnt#L122)); `val ShowsSafety = all { TypeOK, VotesSafe, OneValuePerBallot } implies` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/Paxos/Voting.qnt#L148)); `val Inv = TypeOK and VotesSafe and OneValuePerBallot` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/Paxos/Voting.qnt#L217))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file", "size": "245 lines in this file; [exact source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/Paxos/Voting.qnt)", "source_url": "https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/Paxos/Voting.qnt#L49", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Quint: distributed examples and Cosmos protocols", "name": "ReadersWriters (examples/classic/distributed/ReadersWriters/ReadersWriters.qnt)", "specifies": "readers/writers synchronization", "safety": "`val TypeOK = and { readers.subseteq(Actors),` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/ReadersWriters/ReadersWriters.qnt#L128)); `val Safety = and { not(readers != Set() and writers != Set()),` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/ReadersWriters/ReadersWriters.qnt#L134))", "liveness": "`temporal Liveness = and { Actors.forall(actor => always(eventually(actor.in(readers)))),` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/ReadersWriters/ReadersWriters.qnt#L143))", "tool": "Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file", "size": "153 lines in this file; [exact source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/ReadersWriters/ReadersWriters.qnt)", "source_url": "https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/ReadersWriters/ReadersWriters.qnt#L128", "has_liveness": true}
{"section": "Invariant and modeling tools", "group": "Quint: distributed examples and Cosmos protocols", "name": "reliablebc (examples/classic/distributed/ReliableBroadcast/reliablebc.qnt)", "specifies": "reliable broadcast", "safety": "`def safety = Proc.forall(p =>` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/ReliableBroadcast/reliablebc.qnt#L136)); `def invariant = safety and reliability` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/ReliableBroadcast/reliablebc.qnt#L150)); `def TypeOK = and { network.in(msg_universe),` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/ReliableBroadcast/reliablebc.qnt#L156)); `def IndInv = and { TypeOK,` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/ReliableBroadcast/reliablebc.qnt#L188))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file", "size": "197 lines in this file; [exact source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/ReliableBroadcast/reliablebc.qnt)", "source_url": "https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/ReliableBroadcast/reliablebc.qnt#L136", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Quint: distributed examples and Cosmos protocols", "name": "mutex (examples/classic/distributed/TeachingConcurrency/mutex.qnt)", "specifies": "mutual exclusion", "safety": "`val typeOK = and { counter.in(Int),` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/TeachingConcurrency/mutex.qnt#L65)); `val inv = and { typeOK,` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/TeachingConcurrency/mutex.qnt#L76)); `val correctness = processes.forall(p => local_memory.get(p).stage == Done)` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/TeachingConcurrency/mutex.qnt#L89))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file", "size": "92 lines in this file; [exact source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/TeachingConcurrency/mutex.qnt)", "source_url": "https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/TeachingConcurrency/mutex.qnt#L65", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Quint: distributed examples and Cosmos protocols", "name": "teaching (examples/classic/distributed/TeachingConcurrency/teaching.qnt)", "specifies": "garbage collector concurrency", "safety": "`val correctness = processes.forall(i => state.get(i).pc == End)` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/TeachingConcurrency/teaching.qnt#L66)); `def TypeOK = val local_states = tuples(Set(0, 1), domain, Set(Start, Middle, End)).map(((x, y, pc)) => { x: x, y: y, pc: pc })` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/TeachingConcurrency/teaching.qnt#L71)); `def IndInv = and { TypeOK,` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/TeachingConcurrency/teaching.qnt#L75))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file", "size": "82 lines in this file; [exact source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/TeachingConcurrency/teaching.qnt)", "source_url": "https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/TeachingConcurrency/teaching.qnt#L66", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Quint: distributed examples and Cosmos protocols", "name": "two_layered_cache (examples/classic/distributed/TwoLayeredCache/two_layered_cache.qnt)", "specifies": "cache/memory coherence", "safety": "`val readAfterWrite: bool = { val idx = history.indices()` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/TwoLayeredCache/two_layered_cache.qnt#L214)); `val writeAfterWrite: bool = { val idx = history.indices()` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/TwoLayeredCache/two_layered_cache.qnt#L227))", "liveness": "`temporal agreement: bool = eventually({ val a = l1.get(DefaultKey)` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/TwoLayeredCache/two_layered_cache.qnt#L245))", "tool": "Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file", "size": "255 lines in this file; [exact source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/TwoLayeredCache/two_layered_cache.qnt)", "source_url": "https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/TwoLayeredCache/two_layered_cache.qnt#L214", "has_liveness": true}
{"section": "Invariant and modeling tools", "group": "Quint: distributed examples and Cosmos protocols", "name": "two_phase_commit (examples/classic/distributed/TwoPhaseCommit/two_phase_commit.qnt)", "specifies": "two-phase atomic commit", "safety": "`val consistencyInv = tuples(resourceManagers, resourceManagers).forall(((r1, r2)) =>` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/TwoPhaseCommit/two_phase_commit.qnt#L111))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file", "size": "157 lines in this file; [exact source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/TwoPhaseCommit/two_phase_commit.qnt)", "source_url": "https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/TwoPhaseCommit/two_phase_commit.qnt#L111", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Quint: distributed examples and Cosmos protocols", "name": "two_phase_commit_modules (examples/classic/distributed/TwoPhaseCommit/two_phase_commit_modules.qnt)", "specifies": "two-phase atomic commit", "safety": "`def consistencyInv(resourceManagers) = tuples(resourceManagers, resourceManagers)` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/TwoPhaseCommit/two_phase_commit_modules.qnt#L70)); `val inv = RM::consistencyInv(resourceManagers)` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/TwoPhaseCommit/two_phase_commit_modules.qnt#L164))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file", "size": "207 lines in this file; [exact source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/TwoPhaseCommit/two_phase_commit_modules.qnt)", "source_url": "https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/TwoPhaseCommit/two_phase_commit_modules.qnt#L70", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Quint: distributed examples and Cosmos protocols", "name": "ewd426 (examples/classic/distributed/ewd426/ewd426.qnt)", "specifies": "self-stabilizing mutual exclusion", "safety": "`def tokenInv = count_tokens(system) > 0` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/ewd426/ewd426.qnt#L70)); `temporal closure = always(count_tokens(system) == 1 implies always(count_tokens(system) == 1))` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/ewd426/ewd426.qnt#L66))", "liveness": "`temporal convergence = step.weakFair(Set(system)) implies eventually(count_tokens(system) == 1)` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/ewd426/ewd426.qnt#L65)); `temporal persistence = step.weakFair(Set(system)) implies eventually(always(count_tokens(system) == 1))` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/ewd426/ewd426.qnt#L67))", "tool": "Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file", "size": "84 lines in this file; [exact source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/ewd426/ewd426.qnt)", "source_url": "https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/ewd426/ewd426.qnt#L70", "has_liveness": true}
{"section": "Invariant and modeling tools", "group": "Quint: distributed examples and Cosmos protocols", "name": "ewd426_3 (examples/classic/distributed/ewd426/ewd426_3.qnt)", "specifies": "self-stabilizing mutual exclusion", "safety": "`def tokenInv = count_tokens(system) > 0` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/ewd426/ewd426_3.qnt#L92)); `temporal closure = always(count_tokens(system) == 1 implies always(count_tokens(system) == 1))` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/ewd426/ewd426_3.qnt#L88))", "liveness": "`temporal convergence = step.weakFair(Set(system)) implies eventually(count_tokens(system) == 1)` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/ewd426/ewd426_3.qnt#L87)); `temporal persistence = step.weakFair(Set(system)) implies eventually(always(count_tokens(system) == 1))` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/ewd426/ewd426_3.qnt#L89))", "tool": "Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file", "size": "101 lines in this file; [exact source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/ewd426/ewd426_3.qnt)", "source_url": "https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/ewd426/ewd426_3.qnt#L92", "has_liveness": true}
{"section": "Invariant and modeling tools", "group": "Quint: distributed examples and Cosmos protocols", "name": "ewd426_4 (examples/classic/distributed/ewd426/ewd426_4.qnt)", "specifies": "self-stabilizing mutual exclusion", "safety": "`def tokenInv = count_tokens(system) > 0` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/ewd426/ewd426_4.qnt#L99)); `temporal closure = always(count_tokens(system) == 1 implies always(count_tokens(system) == 1))` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/ewd426/ewd426_4.qnt#L95))", "liveness": "`temporal convergence = step.weakFair(Set(system)) implies eventually(count_tokens(system) == 1)` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/ewd426/ewd426_4.qnt#L94)); `temporal persistence = step.weakFair(Set(system)) implies eventually(always(count_tokens(system) == 1))` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/ewd426/ewd426_4.qnt#L96))", "tool": "Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file", "size": "108 lines in this file; [exact source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/ewd426/ewd426_4.qnt)", "source_url": "https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/ewd426/ewd426_4.qnt#L99", "has_liveness": true}
{"section": "Invariant and modeling tools", "group": "Quint: distributed examples and Cosmos protocols", "name": "ewd840 (examples/classic/distributed/ewd840/ewd840.qnt)", "specifies": "distributed termination detection", "safety": "`val TypeOK = and { active.in(setOfMaps(Nodes, Bool)),   // status of nodes (active or passive)` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/ewd840/ewd840.qnt#L26)); `val TerminationDetection = terminationDetected implies Nodes.forall(i => not(active.get(i)))` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/ewd840/ewd840.qnt#L139)); `val Inv = or { Nodes.forall(i => tpos < i implies not(active.get(i))),` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/ewd840/ewd840.qnt#L176)); `val IndInv = TypeOK and Inv` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/ewd840/ewd840.qnt#L182))", "liveness": "`temporal liveness = System.weakFair(vars) implies (Nodes.forall(i => not(active.get(i))) leadsTo terminationDetected)` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/ewd840/ewd840.qnt#L144)); `temporal AllNodesTerminateIfNoMessagesFairStep = step.weakFair(vars) implies AllNodesTerminateIfNoMessages` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/ewd840/ewd840.qnt#L168))", "deliberate_negative_temporal_targets": "`temporal falseLiveness = System.weakFair(vars) implies Nodes.forall(i => always(eventually(not(active.get(i))))) leadsTo terminationDetected` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/ewd840/ewd840.qnt#L149)); `temporal AllNodesTerminateIfNoMessages = eventually(always(Nodes.forall(i => not(SendMsg(i))).orKeep(vars)))` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/ewd840/ewd840.qnt#L159)); `temporal AllNodesTerminateIfNoMessagesFairSystem = System.weakFair(vars) implies AllNodesTerminateIfNoMessages` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/ewd840/ewd840.qnt#L164))", "tool": "Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file", "size": "187 lines in this file; [exact source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/ewd840/ewd840.qnt)", "source_url": "https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/classic/distributed/ewd840/ewd840.qnt#L26", "has_liveness": true}
{"section": "Invariant and modeling tools", "group": "Quint: distributed examples and Cosmos protocols", "name": "bank (examples/cosmos/bank/bank.qnt)", "specifies": "bank state transitions", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file", "size": "207 lines in this file; [exact source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/cosmos/bank/bank.qnt)", "source_url": "https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/cosmos/bank/bank.qnt", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Quint: distributed examples and Cosmos protocols", "name": "ics20 (examples/cosmos/ics20/ics20.qnt)", "specifies": "IBC token-transfer protocol", "safety": "`val BalanceNonNegative = CHAINS.forall(chain =>` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/cosmos/ics20/ics20.qnt#L678))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file", "size": "683 lines in this file; [exact source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/cosmos/ics20/ics20.qnt)", "source_url": "https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/cosmos/ics20/ics20.qnt#L678", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Quint: distributed examples and Cosmos protocols", "name": "ics23 (examples/cosmos/ics23/ics23.qnt)", "specifies": "IBC Merkle membership proof", "safety": "`val TreeProofInv = and {` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/cosmos/ics23/ics23.qnt#L750)); `val MemInv = or { not(inputKey.in(tree.leafs.keys())),` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/cosmos/ics23/ics23.qnt#L763)); `val NonMemInv = def proofOrNil(key) = {` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/cosmos/ics23/ics23.qnt#L834))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file", "size": "885 lines in this file; [exact source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/cosmos/ics23/ics23.qnt)", "source_url": "https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/cosmos/ics23/ics23.qnt#L750", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Quint: distributed examples and Cosmos protocols", "name": "Blockchain (examples/cosmos/lightclient/Blockchain.qnt)", "specifies": "blockchain protocol", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file", "size": "163 lines in this file; [exact source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/cosmos/lightclient/Blockchain.qnt)", "source_url": "https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/cosmos/lightclient/Blockchain.qnt", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Quint: distributed examples and Cosmos protocols", "name": "LCVerificationApi (examples/cosmos/lightclient/LCVerificationApi.qnt)", "specifies": "blockchain light-client validation", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file", "size": "192 lines in this file; [exact source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/cosmos/lightclient/LCVerificationApi.qnt)", "source_url": "https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/cosmos/lightclient/LCVerificationApi.qnt", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Quint: distributed examples and Cosmos protocols", "name": "Lightclient (examples/cosmos/lightclient/Lightclient.qnt)", "specifies": "blockchain light-client validation", "safety": "`def TargetHeightOnSuccessInv: bool = state == \"finishedSuccess\" implies and {` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/cosmos/lightclient/Lightclient.qnt#L325)); `def CorrectnessInv: bool = fetchedLightBlocks.keys().forall( h =>` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/cosmos/lightclient/Lightclient.qnt#L339)); `def NoTrustOnFaultyBlockInv: bool = and { state == \"finishedSuccess\",` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/cosmos/lightclient/Lightclient.qnt#L349)); `def StoredHeadersAreVerifiedInv: bool = state == \"finishedSuccess\" implies {` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/cosmos/lightclient/Lightclient.qnt#L358)); `def StoredHeadersAreVerifiedOrNotTrustedInv: bool = state == \"finishedSuccess\" implies {` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/cosmos/lightclient/Lightclient.qnt#L381)); `def ProofOfChainOfTrustInv: bool = state == \"finishedSuccess\" implies {` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/cosmos/lightclient/Lightclient.qnt#L404)); `def NoFailedBlocksOnSuccessInv: bool= state == \"finishedSuccess\" implies` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/cosmos/lightclient/Lightclient.qnt#L432)); `def PrecisionInv: bool = state == \"finishedFailure\" implies or {` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/cosmos/lightclient/Lightclient.qnt#L496)); `def PrecisionBuggyInv: bool = state == \"finishedFailure\" implies or {` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/cosmos/lightclient/Lightclient.qnt#L511)); `def ApiPostInv: bool = state != \"working\" implies` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/cosmos/lightclient/Lightclient.qnt#L529))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file", "size": "560 lines in this file; [exact source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/cosmos/lightclient/Lightclient.qnt)", "source_url": "https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/cosmos/lightclient/Lightclient.qnt#L325", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Quint: distributed examples and Cosmos protocols", "name": "Tendermint (examples/cosmos/tendermint/Tendermint.qnt)", "specifies": "Tendermint Byzantine consensus", "safety": "`val Agreement = tuples(Corr, Corr).forall( ((p, q)) =>` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/cosmos/tendermint/Tendermint.qnt#L584)); `val Validity = Corr.forall(p =>` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/cosmos/tendermint/Tendermint.qnt#L593)); `val NoAgreement = tuples(Corr, Corr).forall( ((p, q)) =>` ([source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/cosmos/tendermint/Tendermint.qnt#L625))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file", "size": "662 lines in this file; [exact source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/cosmos/tendermint/Tendermint.qnt)", "source_url": "https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/cosmos/tendermint/Tendermint.qnt#L584", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Quint: distributed examples and Cosmos protocols", "name": "TendermintModels (examples/cosmos/tendermint/TendermintModels.qnt)", "specifies": "Tendermint Byzantine consensus", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file", "size": "35 lines in this file; [exact source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/cosmos/tendermint/TendermintModels.qnt)", "source_url": "https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/cosmos/tendermint/TendermintModels.qnt", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Quint: distributed examples and Cosmos protocols", "name": "TendermintTest (examples/cosmos/tendermint/TendermintTest.qnt)", "specifies": "Tendermint Byzantine consensus", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file", "size": "91 lines in this file; [exact source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/cosmos/tendermint/TendermintTest.qnt)", "source_url": "https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/cosmos/tendermint/TendermintTest.qnt", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Quint: distributed examples and Cosmos protocols", "name": "utxo (examples/cryptography/utxo/utxo.qnt)", "specifies": "UTXO transaction validity", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file", "size": "225 lines in this file; [exact source](https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/cryptography/utxo/utxo.qnt)", "source_url": "https://github.com/informalsystems/quint/blob/23a4b811ff2ac040057e9213d6a249d64a08d9be/examples/cryptography/utxo/utxo.qnt", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Quint: CometBFT source specifications", "name": "dog (spec/mempool/gossip/quint/dog.qnt)", "specifies": "transaction mempool", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file", "size": "219 lines in this file; [exact source](https://github.com/cometbft/cometbft/blob/65c54ed444bdc051a716a5421df8aa5909af2a8f/spec/mempool/gossip/quint/dog.qnt)", "source_url": "https://github.com/cometbft/cometbft/blob/65c54ed444bdc051a716a5421df8aa5909af2a8f/spec/mempool/gossip/quint/dog.qnt", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Quint: CometBFT source specifications", "name": "flood (spec/mempool/gossip/quint/flood.qnt)", "specifies": "synchronous FloodSet consensus", "safety": "no active top-level safety/property declaration found in this file", "liveness": "`temporal txInPoolGetsDisseminated = AllTxs.forall(tx =>` ([source](https://github.com/cometbft/cometbft/blob/65c54ed444bdc051a716a5421df8aa5909af2a8f/spec/mempool/gossip/quint/flood.qnt#L102))", "tool": "Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file", "size": "115 lines in this file; [exact source](https://github.com/cometbft/cometbft/blob/65c54ed444bdc051a716a5421df8aa5909af2a8f/spec/mempool/gossip/quint/flood.qnt)", "source_url": "https://github.com/cometbft/cometbft/blob/65c54ed444bdc051a716a5421df8aa5909af2a8f/spec/mempool/gossip/quint/flood.qnt#L102", "has_liveness": true}
{"section": "Invariant and modeling tools", "group": "Quint: CometBFT source specifications", "name": "mempool (spec/mempool/gossip/quint/mempool.qnt)", "specifies": "transaction mempool", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file", "size": "74 lines in this file; [exact source](https://github.com/cometbft/cometbft/blob/65c54ed444bdc051a716a5421df8aa5909af2a8f/spec/mempool/gossip/quint/mempool.qnt)", "source_url": "https://github.com/cometbft/cometbft/blob/65c54ed444bdc051a716a5421df8aa5909af2a8f/spec/mempool/gossip/quint/mempool.qnt", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Quint: CometBFT source specifications", "name": "p2p (spec/mempool/gossip/quint/p2p.qnt)", "specifies": "transaction mempool", "safety": "no active top-level safety/property declaration found in this file", "liveness": "`temporal allMsgsDelivered = eventually(NodeIDs.forall(node => length(node.IncomingMsgs()) == 0))` ([source](https://github.com/cometbft/cometbft/blob/65c54ed444bdc051a716a5421df8aa5909af2a8f/spec/mempool/gossip/quint/p2p.qnt#L82))", "tool": "Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file", "size": "86 lines in this file; [exact source](https://github.com/cometbft/cometbft/blob/65c54ed444bdc051a716a5421df8aa5909af2a8f/spec/mempool/gossip/quint/p2p.qnt)", "source_url": "https://github.com/cometbft/cometbft/blob/65c54ed444bdc051a716a5421df8aa5909af2a8f/spec/mempool/gossip/quint/p2p.qnt#L82", "has_liveness": true}
{"section": "Invariant and modeling tools", "group": "Quint: CometBFT source specifications", "name": "spells (spec/mempool/gossip/quint/spells.qnt)", "specifies": "transaction mempool", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file", "size": "135 lines in this file; [exact source](https://github.com/cometbft/cometbft/blob/65c54ed444bdc051a716a5421df8aa5909af2a8f/spec/mempool/gossip/quint/spells.qnt)", "source_url": "https://github.com/cometbft/cometbft/blob/65c54ed444bdc051a716a5421df8aa5909af2a8f/spec/mempool/gossip/quint/spells.qnt", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Quint: CometBFT source specifications", "name": "Consensus (spec/mempool/quint/Consensus.qnt)", "specifies": "consensus/agreement protocol", "safety": "`val consensusInvariant = { and {` ([source](https://github.com/cometbft/cometbft/blob/65c54ed444bdc051a716a5421df8aa5909af2a8f/spec/mempool/quint/Consensus.qnt#L154))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file", "size": "199 lines in this file; [exact source](https://github.com/cometbft/cometbft/blob/65c54ed444bdc051a716a5421df8aa5909af2a8f/spec/mempool/quint/Consensus.qnt)", "source_url": "https://github.com/cometbft/cometbft/blob/65c54ed444bdc051a716a5421df8aa5909af2a8f/spec/mempool/quint/Consensus.qnt#L154", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Quint: CometBFT source specifications", "name": "Ledger (spec/mempool/quint/Ledger.qnt)", "specifies": "transaction mempool", "safety": "`val ledgerInvariant = { and {` ([source](https://github.com/cometbft/cometbft/blob/65c54ed444bdc051a716a5421df8aa5909af2a8f/spec/mempool/quint/Ledger.qnt#L139))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file", "size": "188 lines in this file; [exact source](https://github.com/cometbft/cometbft/blob/65c54ed444bdc051a716a5421df8aa5909af2a8f/spec/mempool/quint/Ledger.qnt)", "source_url": "https://github.com/cometbft/cometbft/blob/65c54ed444bdc051a716a5421df8aa5909af2a8f/spec/mempool/quint/Ledger.qnt#L139", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Quint: CometBFT source specifications", "name": "Mempool (spec/mempool/quint/Mempool.qnt)", "specifies": "transaction mempool", "safety": "`val inv1 = { PROCESSES.forall(p => _state.ledger.getSubmittedFor(p).subseteq(_state.hmempool.get(p)))` ([source](https://github.com/cometbft/cometbft/blob/65c54ed444bdc051a716a5421df8aa5909af2a8f/spec/mempool/quint/Mempool.qnt#L151)); `val inv2 = { PROCESSES.forall(p => 0.to(_state.ledger.heightOf(p)-1).forall(i =>  _state.ledger.entry(p, i).intersect(_state.txsOf(p)).size()==0))` ([source](https://github.com/cometbft/cometbft/blob/65c54ed444bdc051a716a5421df8aa5909af2a8f/spec/mempool/quint/Mempool.qnt#L156)); `val inv3 = { PROCESSES.forall(p => _state.txsOf(p).forall(t => _state.ledger.isValid(p, t)))` ([source](https://github.com/cometbft/cometbft/blob/65c54ed444bdc051a716a5421df8aa5909af2a8f/spec/mempool/quint/Mempool.qnt#L161)); `val inv4() = { PROCESSES.forall(p => _state.hmempool.get(p).forall(tx => _state.ledger.isCommittedFor(p, tx) or not(_state.ledger.isValid(p, tx)) or _state.txsOf(p).contains(tx)))` ([source](https://github.com/cometbft/cometbft/blob/65c54ed444bdc051a716a5421df8aa5909af2a8f/spec/mempool/quint/Mempool.qnt#L173)); `val allInv = and { inv1,` ([source](https://github.com/cometbft/cometbft/blob/65c54ed444bdc051a716a5421df8aa5909af2a8f/spec/mempool/quint/Mempool.qnt#L177))", "liveness": "no active temporal/progress declaration found in this file", "tool": "Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file", "size": "195 lines in this file; [exact source](https://github.com/cometbft/cometbft/blob/65c54ed444bdc051a716a5421df8aa5909af2a8f/spec/mempool/quint/Mempool.qnt)", "source_url": "https://github.com/cometbft/cometbft/blob/65c54ed444bdc051a716a5421df8aa5909af2a8f/spec/mempool/quint/Mempool.qnt#L151", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Quint: CometBFT source specifications", "name": "Spells (spec/mempool/quint/Spells.qnt)", "specifies": "transaction mempool", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file", "size": "25 lines in this file; [exact source](https://github.com/cometbft/cometbft/blob/65c54ed444bdc051a716a5421df8aa5909af2a8f/spec/mempool/quint/Spells.qnt)", "source_url": "https://github.com/cometbft/cometbft/blob/65c54ed444bdc051a716a5421df8aa5909af2a8f/spec/mempool/quint/Spells.qnt", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Quint: CometBFT source specifications", "name": "System (spec/mempool/quint/System.qnt)", "specifies": "transaction mempool", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file", "size": "9 lines in this file; [exact source](https://github.com/cometbft/cometbft/blob/65c54ed444bdc051a716a5421df8aa5909af2a8f/spec/mempool/quint/System.qnt)", "source_url": "https://github.com/cometbft/cometbft/blob/65c54ed444bdc051a716a5421df8aa5909af2a8f/spec/mempool/quint/System.qnt", "has_liveness": false}
{"section": "Invariant and modeling tools", "group": "Quint: CometBFT source specifications", "name": "reactor (spec/p2p/reactor-api/reactor.qnt)", "specifies": "peer-to-peer reactor API", "safety": "no active top-level safety/property declaration found in this file", "liveness": "no active temporal/progress declaration found in this file", "tool": "Quint specification for simulation/model checking; no machine-checked proof artifact identified in this file", "size": "276 lines in this file; [exact source](https://github.com/cometbft/cometbft/blob/65c54ed444bdc051a716a5421df8aa5909af2a8f/spec/p2p/reactor-api/reactor.qnt)", "source_url": "https://github.com/cometbft/cometbft/blob/65c54ed444bdc051a716a5421df8aa5909af2a8f/spec/p2p/reactor-api/reactor.qnt", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Verdi", "name": "Counter", "specifies": "primary/backup counting server", "safety": "backup count never exceeds primary; number of outputs never exceeds inputs", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "438 LOC in 1 `.v` file(s), scope `theories/Systems/Counter.v`", "source": "[theories/Systems/Counter.v](https://github.com/uwplse/verdi/blob/7e1641b758d8f0032aa7de63620bc115330e0a6b/theories/Systems/Counter.v)", "source_words": "“Theorem primary_ge_backup : forall net tr, step_async_star (params := Counter_MultiParams) step_async_init net tr -> nwState net backup <= nwState net primary.”; [Counter.v, line 259](https://github.com/uwplse/verdi/blob/7e1641b758d8f0032aa7de63620bc115330e0a6b/theories/Systems/Counter.v#L259)", "source_url": "https://github.com/uwplse/verdi/blob/7e1641b758d8f0032aa7de63620bc115330e0a6b/theories/Systems/Counter.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Verdi", "name": "LockServ", "specifies": "message-passing lock server", "safety": "mutual exclusion of client nodes", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "1,236 LOC in 1 `.v` file(s), scope `theories/Systems/LockServ.v`", "source": "[theories/Systems/LockServ.v](https://github.com/uwplse/verdi/blob/7e1641b758d8f0032aa7de63620bc115330e0a6b/theories/Systems/LockServ.v)", "source_words": "“Theorem true_in_reachable_mutual_exclusion : true_in_reachable step_async step_async_init (fun net => mutual_exclusion (nwState net)).”; [LockServ.v, line 843](https://github.com/uwplse/verdi/blob/7e1641b758d8f0032aa7de63620bc115330e0a6b/theories/Systems/LockServ.v#L843)", "source_url": "https://github.com/uwplse/verdi/blob/7e1641b758d8f0032aa7de63620bc115330e0a6b/theories/Systems/LockServ.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Verdi", "name": "LiveLockServ", "specifies": "lock server with labeled network executions", "safety": "mutual exclusion", "liveness": "a requesting client eventually holds the lock under the theorem’s weak-fairness assumption", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "2,329 LOC in 1 `.v` file(s), scope `theories/Systems/LiveLockServ.v`", "source": "[theories/Systems/LiveLockServ.v](https://github.com/uwplse/verdi/blob/7e1641b758d8f0032aa7de63620bc115330e0a6b/theories/Systems/LiveLockServ.v)", "source_words": "“Theorem locking_clients_eventually_receive_lock_st : forall c s, event_step_star step_async step_async_init (hd s) -> lb_step_execution lb_step_async s -> weak_fairness lb_step_async label_silent s -> now (occurred (InputLock c)) s -> eventually (fun s => held (nwState (evt_a (hd s)) (Client c)) = true) s.”; [LiveLockServ.v, line 2312](https://github.com/uwplse/verdi/blob/7e1641b758d8f0032aa7de63620bc115330e0a6b/theories/Systems/LiveLockServ.v#L2312)", "liveness_source_words": "“weak_fairness lb_step_async label_silent s ->” and “eventually (fun s => held (nwState (evt_a (hd s)) (Client c)) = true) s.”; [full theorem](https://github.com/uwplse/verdi/blob/7e1641b758d8f0032aa7de63620bc115330e0a6b/theories/Systems/LiveLockServ.v#L2312)", "source_url": "https://github.com/uwplse/verdi/blob/7e1641b758d8f0032aa7de63620bc115330e0a6b/theories/Systems/LiveLockServ.v", "has_liveness": true}
{"section": "Coq and Rocq", "group": "Coq / Verdi", "name": "VarD", "specifies": "single-node key-value service used as replication input", "safety": "input/output traces agree with key-value state-machine semantics", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "347 LOC in 1 `.v` file(s), scope `theories/Systems/VarD.v`", "source": "[theories/Systems/VarD.v](https://github.com/uwplse/verdi/blob/7e1641b758d8f0032aa7de63620bc115330e0a6b/theories/Systems/VarD.v)", "source_words": "“Theorem step_1_star_trace_correct' : forall st st' trace, step_1_star st st' trace -> trace_correct' st trace.”; [VarD.v, line 307](https://github.com/uwplse/verdi/blob/7e1641b758d8f0032aa7de63620bc115330e0a6b/theories/Systems/VarD.v#L307)", "source_url": "https://github.com/uwplse/verdi/blob/7e1641b758d8f0032aa7de63620bc115330e0a6b/theories/Systems/VarD.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Verdi", "name": "VarDPrimaryBackup", "specifies": "primary-backup replication transformer applied to VarD", "safety": "correctness lifted to failure semantics", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "91 LOC in 1 `.v` file(s), scope `theories/Systems/VarDPrimaryBackup.v`", "source": "[theories/Systems/VarDPrimaryBackup.v](https://github.com/uwplse/verdi/blob/7e1641b758d8f0032aa7de63620bc115330e0a6b/theories/Systems/VarDPrimaryBackup.v)", "source_words": "“Theorem lifting_applied : forall (net : @network _ PB_multi_params) tr, step_async_star step_async_init net tr -> trace_correct (revert_trace (base_params := vard_base_params) tr).”; [VarDPrimaryBackup.v, line 13](https://github.com/uwplse/verdi/blob/7e1641b758d8f0032aa7de63620bc115330e0a6b/theories/Systems/VarDPrimaryBackup.v#L13)", "source_url": "https://github.com/uwplse/verdi/blob/7e1641b758d8f0032aa7de63620bc115330e0a6b/theories/Systems/VarDPrimaryBackup.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Verdi", "name": "LockServSeqNum", "specifies": "lock server with sequence-number duplicate suppression", "safety": "mutual exclusion lifted through the sequence-number transformer", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "32 LOC in 1 `.v` file(s), scope `theories/Systems/LockServSeqNum.v`", "source": "[theories/Systems/LockServSeqNum.v](https://github.com/uwplse/verdi/blob/7e1641b758d8f0032aa7de63620bc115330e0a6b/theories/Systems/LockServSeqNum.v)", "source_words": "“Theorem transformed_correctness : forall (net : transformed_network) tr, step_dup_star (params := transformed_multi_params) step_async_init net tr -> @mutual_exclusion num_Clients (nwState (revertNetwork net)).”; [LockServSeqNum.v, line 17](https://github.com/uwplse/verdi/blob/7e1641b758d8f0032aa7de63620bc115330e0a6b/theories/Systems/LockServSeqNum.v#L17)", "source_url": "https://github.com/uwplse/verdi/blob/7e1641b758d8f0032aa7de63620bc115330e0a6b/theories/Systems/LockServSeqNum.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Verdi", "name": "sequence numbering transformer", "specifies": "deduplication wrapper around arbitrary Verdi systems", "safety": "simulation/correctness relation between transformed and original traces", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "718 LOC in 1 `.v` file(s), scope `theories/Systems/SeqNumCorrect.v`", "source": "[theories/Systems/SeqNumCorrect.v](https://github.com/uwplse/verdi/blob/7e1641b758d8f0032aa7de63620bc115330e0a6b/theories/Systems/SeqNumCorrect.v)", "source_words": "“Theorem true_in_reachable_transform : forall P, true_in_reachable step_async step_async_init P -> true_in_reachable step_dup step_async_init (fun net => P (revertNetwork net)).”; [SeqNumCorrect.v, line 705](https://github.com/uwplse/verdi/blob/7e1641b758d8f0032aa7de63620bc115330e0a6b/theories/Systems/SeqNumCorrect.v#L705)", "source_url": "https://github.com/uwplse/verdi/blob/7e1641b758d8f0032aa7de63620bc115330e0a6b/theories/Systems/SeqNumCorrect.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Verdi", "name": "primary-backup transformer", "specifies": "asynchronous primary-backup replication of an arbitrary state machine", "safety": "trace simulation between replicated system and original state machine", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "1,300 LOC in 1 `.v` file(s), scope `theories/Systems/PrimaryBackup.v`", "source": "[theories/Systems/PrimaryBackup.v](https://github.com/uwplse/verdi/blob/7e1641b758d8f0032aa7de63620bc115330e0a6b/theories/Systems/PrimaryBackup.v)", "source_words": "“Lemma inputs_1_m_revert : forall net tr, step_async_star (params := PB_multi_params) step_async_init net tr -> inputs_m tr = inputs_1 (revert_trace tr) ++ queue (nwState net Primary).”; [PrimaryBackup.v, line 1258](https://github.com/uwplse/verdi/blob/7e1641b758d8f0032aa7de63620bc115330e0a6b/theories/Systems/PrimaryBackup.v#L1258)", "source_url": "https://github.com/uwplse/verdi/blob/7e1641b758d8f0032aa7de63620bc115330e0a6b/theories/Systems/PrimaryBackup.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Verdi", "name": "logging transformer", "specifies": "disk-backed event log and replay transformer", "safety": "simulation/refinement across logged crash-recovery semantics", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "382 LOC in 1 `.v` file(s), scope `theories/Systems/LogCorrect.v`", "source": "[theories/Systems/LogCorrect.v](https://github.com/uwplse/verdi/blob/7e1641b758d8f0032aa7de63620bc115330e0a6b/theories/Systems/LogCorrect.v)", "source_words": "“Lemma log_step_failure_star_simulation : forall net failed tr, step_failure_disk_ops_star step_failure_disk_ops_init (failed, net) tr -> step_failure_star step_failure_init (failed, revertLogNetwork net) tr.”; [LogCorrect.v, line 359](https://github.com/uwplse/verdi/blob/7e1641b758d8f0032aa7de63620bc115330e0a6b/theories/Systems/LogCorrect.v#L359)", "source_url": "https://github.com/uwplse/verdi/blob/7e1641b758d8f0032aa7de63620bc115330e0a6b/theories/Systems/LogCorrect.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Verdi", "name": "Verdi Raft", "specifies": "Raft consensus implementation, invariant interfaces and proof suite", "safety": "election safety, log matching, leader completeness, state-machine safety, end-to-end linearizability", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "49,436 LOC in 194 `.v` file(s), scope `theories/Raft` plus named companion files", "source": "[theories/Raft](https://github.com/uwplse/verdi-raft/tree/a3375e867326a82225e724cc1a7b4758b029376f/theories/Raft)", "source_words": "“Theorem raft_linearizable' : forall failed net tr, input_correct tr -> step_failure_star step_failure_init (failed, net) tr -> exists l tr1 st, equivalent _ (import tr) l /\\ exported (get_input tr) (get_output tr) l tr1 /\\ step_1_star init st tr1.”; [RaftLinearizableProofs.v, line 1056](https://github.com/uwplse/verdi-raft/blob/a3375e867326a82225e724cc1a7b4758b029376f/theories/Raft/RaftLinearizableProofs.v#L1056)", "readme_source_words": "“uses the proofs of all proof interfaces to show Raft's *linearizability* property.”; [README](https://github.com/uwplse/verdi-raft/blob/a3375e867326a82225e724cc1a7b4758b029376f/README.md#L107)", "source_url": "https://github.com/uwplse/verdi-raft/tree/a3375e867326a82225e724cc1a7b4758b029376f/theories/Raft", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Verdi", "name": "VarDRaft", "specifies": "fault-tolerant key-value service built by applying Raft to VarD", "safety": "key-value trace correctness lifted through the named transformer", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "52 LOC in 2 `.v` file(s), scope `theories/Systems/VarDRaft.v` plus named companion files", "source": "[theories/Systems/VarDRaft.v](https://github.com/uwplse/verdi-raft/blob/a3375e867326a82225e724cc1a7b4758b029376f/theories/Systems/VarDRaft.v)", "source_words": "“Theorem vard_raft_linearizable : forall failed net tr, input_correct tr -> step_failure_star step_failure_init (failed, net) tr -> exists l tr1 st, equivalent _ (import tr) l /\\ exported (get_input tr) (get_output tr) l tr1 /\\ step_1_star init st tr1.”; [VarDRaftCorrect.v, line 21](https://github.com/uwplse/verdi-raft/blob/a3375e867326a82225e724cc1a7b4758b029376f/theories/Systems/VarDRaftCorrect.v#L21)", "source_url": "https://github.com/uwplse/verdi-raft/blob/a3375e867326a82225e724cc1a7b4758b029376f/theories/Systems/VarDRaft.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Verdi", "name": "VarDRaftSerialized", "specifies": "VarDRaft with serialized network messages", "safety": "key-value trace correctness lifted through the named transformer", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "232 LOC in 2 `.v` file(s), scope `theories/Systems/VarDRaftSerialized.v` plus named companion files", "source": "[theories/Systems/VarDRaftSerialized.v](https://github.com/uwplse/verdi-raft/blob/a3375e867326a82225e724cc1a7b4758b029376f/theories/Systems/VarDRaftSerialized.v)", "source_words": "“Theorem vard_raft_serialized_linearizable : forall failed net tr, input_correct tr -> step_failure_star step_failure_init (failed, net) tr -> exists l tr1 st, equivalent _ (import tr) l /\\ exported (get_input tr) (get_output tr) l tr1 /\\ step_1_star init st tr1.”; [VarDRaftSerializedCorrect.v, line 185](https://github.com/uwplse/verdi-raft/blob/a3375e867326a82225e724cc1a7b4758b029376f/theories/Systems/VarDRaftSerializedCorrect.v#L185)", "source_url": "https://github.com/uwplse/verdi-raft/blob/a3375e867326a82225e724cc1a7b4758b029376f/theories/Systems/VarDRaftSerialized.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Verdi", "name": "VarDRaftLog", "specifies": "VarDRaft with persisted event log", "safety": "key-value trace correctness lifted through the named transformer", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "50 LOC in 2 `.v` file(s), scope `theories/Systems/VarDRaftLog.v` plus named companion files", "source": "[theories/Systems/VarDRaftLog.v](https://github.com/uwplse/verdi-raft/blob/a3375e867326a82225e724cc1a7b4758b029376f/theories/Systems/VarDRaftLog.v)", "source_words": "“Theorem vard_raft_log_linearizable : forall failed net tr, input_correct tr -> step_failure_disk_ops_star step_failure_disk_ops_init (failed, net) tr -> exists l tr1 st, equivalent _ (import tr) l /\\ exported (get_input tr) (get_output tr) l tr1 /\\ step_1_star init st tr1.”; [VarDRaftLogCorrect.v, line 20](https://github.com/uwplse/verdi-raft/blob/a3375e867326a82225e724cc1a7b4758b029376f/theories/Systems/VarDRaftLogCorrect.v#L20)", "source_url": "https://github.com/uwplse/verdi-raft/blob/a3375e867326a82225e724cc1a7b4758b029376f/theories/Systems/VarDRaftLog.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Verdi", "name": "VarDRaftSerializedLog", "specifies": "VarDRaft with both serialization and persisted log", "safety": "key-value trace correctness lifted through the named transformer", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "58 LOC in 2 `.v` file(s), scope `theories/Systems/VarDRaftSerializedLog.v` plus named companion files", "source": "[theories/Systems/VarDRaftSerializedLog.v](https://github.com/uwplse/verdi-raft/blob/a3375e867326a82225e724cc1a7b4758b029376f/theories/Systems/VarDRaftSerializedLog.v)", "source_words": "“Theorem vard_raft_log_linearizable : forall failed net tr, input_correct tr -> step_failure_disk_ops_star step_failure_disk_ops_init (failed, net) tr -> exists l tr1 st, equivalent _ (import tr) l /\\ exported (get_input tr) (get_output tr) l tr1 /\\ step_1_star init st tr1.”; [VarDRaftSerializedLogCorrect.v, line 21](https://github.com/uwplse/verdi-raft/blob/a3375e867326a82225e724cc1a7b4758b029376f/theories/Systems/VarDRaftSerializedLogCorrect.v#L21)", "source_url": "https://github.com/uwplse/verdi-raft/blob/a3375e867326a82225e724cc1a7b4758b029376f/theories/Systems/VarDRaftSerializedLog.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / DiSeL", "name": "Greeter", "specifies": "nodes exchanging greetings", "safety": "protocol coherence preserved by send/receive transitions", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "426 LOC in 1 `.v` file(s), scope `theories/Examples/Greeter`", "source": "[theories/Examples/Greeter](https://github.com/DistributedComponents/disel/tree/4ae4c207ef1a25010d63508f2bbda2d4c197d5ab/theories/Examples/Greeter)", "source_words": "“Lemma hcomp l : hook_complete (W l nodes).”; [Greeter.v, line 392](https://github.com/DistributedComponents/disel/blob/4ae4c207ef1a25010d63508f2bbda2d4c197d5ab/theories/Examples/Greeter/Greeter.v#L392)", "source_url": "https://github.com/DistributedComponents/disel/tree/4ae4c207ef1a25010d63508f2bbda2d4c197d5ab/theories/Examples/Greeter", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / DiSeL", "name": "distributed lock protocol", "specifies": "lock server and clients", "safety": "ownership/coherence of client/server lock states", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "584 LOC in 1 `.v` file(s), scope `theories/Examples/LockResource/LockProtocol.v`", "source": "[theories/Examples/LockResource/LockProtocol.v](https://github.com/DistributedComponents/disel/blob/4ae4c207ef1a25010d63508f2bbda2d4c197d5ab/theories/Examples/LockResource/LockProtocol.v)", "source_words": "“Lemma rc_step_coh : r_step_coh_t client_recv_wf the_tag rc_step.”; [LockProtocol.v, line 512](https://github.com/DistributedComponents/disel/blob/4ae4c207ef1a25010d63508f2bbda2d4c197d5ab/theories/Examples/LockResource/LockProtocol.v#L512)", "source_url": "https://github.com/DistributedComponents/disel/blob/4ae4c207ef1a25010d63508f2bbda2d4c197d5ab/theories/Examples/LockResource/LockProtocol.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / DiSeL", "name": "resource protocol", "specifies": "remote resource service intended for composition with locking", "safety": "coherence of resources and request/reply transitions", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "571 LOC in 1 `.v` file(s), scope `theories/Examples/LockResource/ResourceProtocol.v`", "source": "[theories/Examples/LockResource/ResourceProtocol.v](https://github.com/DistributedComponents/disel/blob/4ae4c207ef1a25010d63508f2bbda2d4c197d5ab/theories/Examples/LockResource/ResourceProtocol.v)", "source_words": "“Lemma rc_step_coh : r_step_coh_t client_recv_wf the_tag rc_step.”; [ResourceProtocol.v, line 504](https://github.com/DistributedComponents/disel/blob/4ae4c207ef1a25010d63508f2bbda2d4c197d5ab/theories/Examples/LockResource/ResourceProtocol.v#L504)", "source_url": "https://github.com/DistributedComponents/disel/blob/4ae4c207ef1a25010d63508f2bbda2d4c197d5ab/theories/Examples/LockResource/ResourceProtocol.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / DiSeL", "name": "calculator protocol and client", "specifies": "request/reply arithmetic service, client, batching, memoization and delegation", "safety": "returned results satisfy calculator function and protocol invariants", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "2,032 LOC in 7 `.v` file(s), scope `theories/Examples/Calculator`", "source": "[theories/Examples/Calculator](https://github.com/DistributedComponents/disel/tree/4ae4c207ef1a25010d63508f2bbda2d4c197d5ab/theories/Examples/Calculator)", "source_words": "“Lemma lookup_valid s args : state_wf s -> if lookup_mem_table s args is Some v then f args = Some v else True.”; [SimpleCalculatorServers.v, line 358](https://github.com/DistributedComponents/disel/blob/4ae4c207ef1a25010d63508f2bbda2d4c197d5ab/theories/Examples/Calculator/SimpleCalculatorServers.v#L358)", "source_url": "https://github.com/DistributedComponents/disel/tree/4ae4c207ef1a25010d63508f2bbda2d4c197d5ab/theories/Examples/Calculator", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / DiSeL", "name": "two-phase commit", "specifies": "coordinator/participant atomic commit with rounds", "safety": "participant/coordinator log agreement and invariant preservation", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "6,134 LOC in 7 `.v` file(s), scope `theories/Examples/TwoPhaseCommit`", "source": "[theories/Examples/TwoPhaseCommit](https://github.com/DistributedComponents/disel/tree/4ae4c207ef1a25010d63508f2bbda2d4c197d5ab/theories/Examples/TwoPhaseCommit)", "source_words": "“Lemma rp_step_coh : r_step_coh_t rp_wf rp_tag rp_step.”; [TwoPhaseProtocol.v, line 831](https://github.com/DistributedComponents/disel/blob/4ae4c207ef1a25010d63508f2bbda2d4c197d5ab/theories/Examples/TwoPhaseCommit/TwoPhaseProtocol.v#L831)", "source_url": "https://github.com/DistributedComponents/disel/tree/4ae4c207ef1a25010d63508f2bbda2d4c197d5ab/theories/Examples/TwoPhaseCommit", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / DiSeL", "name": "query protocol", "specifies": "queries of distributed node state", "safety": "unique request identifiers and request/reply coherence", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "415 LOC in 1 `.v` file(s), scope `theories/Examples/Querying/QueryProtocol.v`", "source": "[theories/Examples/Querying/QueryProtocol.v](https://github.com/DistributedComponents/disel/blob/4ae4c207ef1a25010d63508f2bbda2d4c197d5ab/theories/Examples/Querying/QueryProtocol.v)", "source_words": "“Lemma receive_step_coh : r_step_coh_t rc_wf rtag receive_step.”; [QueryProtocol.v, line 345](https://github.com/DistributedComponents/disel/blob/4ae4c207ef1a25010d63508f2bbda2d4c197d5ab/theories/Examples/Querying/QueryProtocol.v#L345)", "source_url": "https://github.com/DistributedComponents/disel/blob/4ae4c207ef1a25010d63508f2bbda2d4c197d5ab/theories/Examples/Querying/QueryProtocol.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / DiSeL", "name": "query with protocol hooks", "specifies": "query protocol composed with another protocol", "safety": "queries describe coherent stable core state", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "1,227 LOC in 1 `.v` file(s), scope `theories/Examples/Querying/QueryHooked.v`", "source": "[theories/Examples/Querying/QueryHooked.v](https://github.com/DistributedComponents/disel/blob/4ae4c207ef1a25010d63508f2bbda2d4c197d5ab/theories/Examples/Querying/QueryHooked.v)", "source_words": "“Lemma msg_story_rely req_num to data reqs resp s s2 : msg_story s req_num to data reqs resp -> network_rely W this s s2 -> msg_story s2 req_num to data reqs resp.”; [QueryHooked.v, line 869](https://github.com/DistributedComponents/disel/blob/4ae4c207ef1a25010d63508f2bbda2d4c197d5ab/theories/Examples/Querying/QueryHooked.v#L869)", "source_url": "https://github.com/DistributedComponents/disel/blob/4ae4c207ef1a25010d63508f2bbda2d4c197d5ab/theories/Examples/Querying/QueryHooked.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / DiSeL", "name": "query plus two-phase commit", "specifies": "queries composed with atomic-commit protocol", "safety": "queried coordinator state related to commit-protocol state", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "228 LOC in 1 `.v` file(s), scope `theories/Examples/Querying/QueryPlusTPC.v`", "source": "[theories/Examples/Querying/QueryPlusTPC.v](https://github.com/DistributedComponents/disel/blob/4ae4c207ef1a25010d63508f2bbda2d4c197d5ab/theories/Examples/Querying/QueryPlusTPC.v)", "source_words": "“Lemma find_empty l i : l \\notin dom i -> getStatelet i l = empty_dstatelet.”; [QueryPlusTPC.v, line 116](https://github.com/DistributedComponents/disel/blob/4ae4c207ef1a25010d63508f2bbda2d4c197d5ab/theories/Examples/Querying/QueryPlusTPC.v#L116)", "source_url": "https://github.com/DistributedComponents/disel/blob/4ae4c207ef1a25010d63508f2bbda2d4c197d5ab/theories/Examples/Querying/QueryPlusTPC.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / DiSeL", "name": "simple calculator server", "specifies": "simple calculator server", "safety": "server Hoare contracts preserve calculator function/result invariant", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "420 LOC in 1 `.v` file(s), scope `theories/Examples/Calculator/SimpleCalculatorServers.v`", "source": "[theories/Examples/Calculator/SimpleCalculatorServers.v](https://github.com/DistributedComponents/disel/blob/4ae4c207ef1a25010d63508f2bbda2d4c197d5ab/theories/Examples/Calculator/SimpleCalculatorServers.v)", "source_words": "“Lemma lookup_valid s args : state_wf s -> if lookup_mem_table s args is Some v then f args = Some v else True.”; [SimpleCalculatorServers.v, line 358](https://github.com/DistributedComponents/disel/blob/4ae4c207ef1a25010d63508f2bbda2d4c197d5ab/theories/Examples/Calculator/SimpleCalculatorServers.v#L358)", "source_url": "https://github.com/DistributedComponents/disel/blob/4ae4c207ef1a25010d63508f2bbda2d4c197d5ab/theories/Examples/Calculator/SimpleCalculatorServers.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / DiSeL", "name": "batching calculator server", "specifies": "batching calculator server", "safety": "server Hoare contracts preserve calculator function/result invariant", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "420 LOC in 1 `.v` file(s), scope `theories/Examples/Calculator/SimpleCalculatorServers.v`", "source": "[theories/Examples/Calculator/SimpleCalculatorServers.v](https://github.com/DistributedComponents/disel/blob/4ae4c207ef1a25010d63508f2bbda2d4c197d5ab/theories/Examples/Calculator/SimpleCalculatorServers.v)", "source_words": "“Lemma lookup_valid s args : state_wf s -> if lookup_mem_table s args is Some v then f args = Some v else True.”; [SimpleCalculatorServers.v, line 358](https://github.com/DistributedComponents/disel/blob/4ae4c207ef1a25010d63508f2bbda2d4c197d5ab/theories/Examples/Calculator/SimpleCalculatorServers.v#L358)", "source_url": "https://github.com/DistributedComponents/disel/blob/4ae4c207ef1a25010d63508f2bbda2d4c197d5ab/theories/Examples/Calculator/SimpleCalculatorServers.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / DiSeL", "name": "memoizing calculator server", "specifies": "memoizing calculator server", "safety": "server Hoare contracts preserve calculator function/result invariant", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "420 LOC in 1 `.v` file(s), scope `theories/Examples/Calculator/SimpleCalculatorServers.v`", "source": "[theories/Examples/Calculator/SimpleCalculatorServers.v](https://github.com/DistributedComponents/disel/blob/4ae4c207ef1a25010d63508f2bbda2d4c197d5ab/theories/Examples/Calculator/SimpleCalculatorServers.v)", "source_words": "“Lemma lookup_valid s args : state_wf s -> if lookup_mem_table s args is Some v then f args = Some v else True.”; [SimpleCalculatorServers.v, line 358](https://github.com/DistributedComponents/disel/blob/4ae4c207ef1a25010d63508f2bbda2d4c197d5ab/theories/Examples/Calculator/SimpleCalculatorServers.v#L358)", "source_url": "https://github.com/DistributedComponents/disel/blob/4ae4c207ef1a25010d63508f2bbda2d4c197d5ab/theories/Examples/Calculator/SimpleCalculatorServers.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / DiSeL", "name": "delegating calculator server", "specifies": "delegating calculator server", "safety": "server Hoare contracts preserve calculator function/result invariant", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "181 LOC in 1 `.v` file(s), scope `theories/Examples/Calculator/DelegatingCalculatorServer.v`", "source": "[theories/Examples/Calculator/DelegatingCalculatorServer.v](https://github.com/DistributedComponents/disel/blob/4ae4c207ef1a25010d63508f2bbda2d4c197d5ab/theories/Examples/Calculator/DelegatingCalculatorServer.v)", "source_words": "“Lemma hcomp l : hook_complete (mkWorld l).”; [DelegatingCalculatorServer.v, line 113](https://github.com/DistributedComponents/disel/blob/4ae4c207ef1a25010d63508f2bbda2d4c197d5ab/theories/Examples/Calculator/DelegatingCalculatorServer.v#L113)", "source_url": "https://github.com/DistributedComponents/disel/blob/4ae4c207ef1a25010d63508f2bbda2d4c197d5ab/theories/Examples/Calculator/DelegatingCalculatorServer.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "Paxos", "specifies": "Paxos acceptor, proposer, learner and clients", "safety": "consensus model agreement and implementation/model adequacy", "liveness": "not found", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "3,006 LOC in 9 `.v` file(s), scope `aneris/examples/consensus`", "source": "[aneris/examples/consensus](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/consensus)", "source_words": "“Lemma runner_spec : {{{ inv paxosN paxos_inv ∗ ([∗ set] a ∈ acceptors, a ⤇ acceptor_si) ∗ ([∗ set] p ∈ proposers, p ⤇ proposer_si) ∗ ([∗ set] l ∈ learners, l ⤇ learner_si) ∗ c_addr ⤇ client_si ∗ ([∗ set] l ∈ learners, l ⤳ (∅, ∅)) ∗ c_addr ⤳ (∅, ∅) ∗ ([∗ set] ip ∈ ips, free_ip ip) ∗ ([∗ set] a ∈ acceptors, ∃ prf, maxBal_frag (a ↾ prf) None ∗ maxVal_frag (a ↾ prf) None) ∗ pending_class 0 0 ∗ pending_class 1 0 }}} runner 41 42 @[\"system\"] {{{ v, RET v; True }}}.”; [paxos_runner.v, line 51](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/consensus/paxos_runner.v#L51)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/consensus", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "two-phase transaction commit", "specifies": "transaction manager and resource managers", "safety": "transaction-commit state-machine model and adequacy", "liveness": "not found", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "1,293 LOC in 9 `.v` file(s), scope `aneris/examples/transaction_commit`", "source": "[aneris/examples/transaction_commit](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transaction_commit)", "source_words": "“Lemma transaction_manager_spec vRMs : is_set RMs vRMs → free_ports (ip_of_address tm) {[port_of_address tm]} -∗ ([∗ set] rm ∈ RMs, rm ⤇ rm_si) -∗ tm ⤇ tm_si -∗ tm ⤳ (∅, ∅) -∗ pending -∗ WP transaction_manager #tm vRMs @[ip_of_address tm] {{ v, (⌜v = #(\"COMMITTED\")⌝ ∗ [∗ set] rm ∈ RMs, rm ↦◯ COMMITTED) ∨ (⌜v = #(\"ABORTED\")⌝ ∗ ∃ rm, ⌜rm ∈ RMs⌝ ∗ rm ↦◯ ABORTED) }}.”; [two_phase_tm.v, line 61](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transaction_commit/two_phase_tm.v#L61)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transaction_commit", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "reliable causal broadcast", "specifies": "vector-clock causal broadcast", "safety": "deliver/broadcast contracts and causal history model", "liveness": "not found; name “reliable” alone does not establish eventual delivery", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "5,992 LOC in 36 `.v` file(s), scope `aneris/examples/rcb`", "source": "[aneris/examples/rcb](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/rcb)", "source_words": "“Lemma mapi_length {A B} (f : nat -> A -> B) l : length (mapi f l) = length l.”; [list_proof_alt.v, line 376](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/rcb/util/list_proof_alt.v#L376)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/rcb", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "causally consistent key-value database", "specifies": "distributed causal-memory key-value store", "safety": "causal histories, read/write model and client contracts", "liveness": "not found", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "7,566 LOC in 49 `.v` file(s), scope `aneris/examples/ccddb`", "source": "[aneris/examples/ccddb](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/ccddb)", "source_words": "“Lemma Maximum_maximals_val_agree (e1 e2 : ae) i s k h E : nclose DB_InvName ⊆ E → Maximum h = Some (erasure e1) → e1 ∈ restrict_key k s → e2 ∈ Maximals (restrict_key k s) → erasure e2 ∈ h → GlobalInv ⊢ Seen i s -∗ k ↦ᵤ h ={E}=∗ ⌜AE_val e1 = AE_val e2⌝ ∗ k ↦ᵤ h.”; [spec_util.v, line 162](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/ccddb/spec_util.v#L162)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/ccddb", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "reliable communication", "specifies": "connection establishment and reliable-session channel send/receive", "safety": "session/API contracts and channel-resource invariants", "liveness": "not found", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "17,511 LOC in 109 `.v` file(s), scope `aneris/examples/reliable_communication`", "source": "[aneris/examples/reliable_communication](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/reliable_communication)", "source_words": "“Lemma int_client_two_channels_spec ip v c1 c2 : v = #40 → {{{ c1 ↣{ip, int_serialization} int_proto2 ∗ c2 ↣{ip, int_serialization} int_proto2 }}} int_client_two_channels v c1 c2 @[ip] {{{ RET #42; True }}}.”; [proofmode.v, line 604](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/reliable_communication/spec/proofmode.v#L604)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/reliable_communication", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "operation-based CRDT library", "specifies": "generic replicated-data library parameterized by datatype", "safety": "generic model/specification and operation-library proof", "liveness": "not found", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "8,261 LOC in 33 `.v` file(s), scope `aneris/examples/crdt/oplib`", "source": "[aneris/examples/crdt/oplib](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/crdt/oplib)", "source_words": "“Lemma update_spec_implies_simplified_update update repId addr : update_spec update repId addr ⊢ simplified_update_spec update repId addr.”; [spec.v, line 226](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/crdt/oplib/spec/spec.v#L226)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/crdt/oplib", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "state-based CRDT library", "specifies": "state-based replication library", "safety": "model, events and resource definitions", "liveness": "not found", "tool": "Coq/Rocq proof scripts with 1 active admission tokens in counted files; incomplete artifact; source inspection only", "size": "330 LOC in 5 `.v` file(s), scope `aneris/examples/crdt/statelib`", "source": "[aneris/examples/crdt/statelib](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/crdt/statelib)", "source_words": "“Lemma dep_closed_union (s s' : gset (Event Op)) : dep_closed s -> dep_closed s' -> dep_closed (s ∪ s').”; [model.v, line 33](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/crdt/statelib/spec/model.v#L33)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/crdt/statelib", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "G-counter convergence", "specifies": "grow-only counter replicas communicating over network", "safety": "model/implementation relation and monotone counter invariants", "liveness": "eventual consistency after a stability point, assuming explicit send, receive, and sent-to-received network fairness", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "4,301 LOC in 10 `.v` file(s), scope `aneris/examples/gcounter_convergence`", "source": "[aneris/examples/gcounter_convergence](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/gcounter_convergence)", "source_words": "“Lemma elem_of_all_vecs_smaller n (v' v : vector_clock n) : v' ∈ all_vecs_smaller v ↔ vc_le v' v.”; [vc.v, line 132](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/gcounter_convergence/vc.v#L132)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/gcounter_convergence", "has_liveness": true}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "snapshot-isolation database", "specifies": "transactional key-value store and client proxy", "safety": "snapshot-isolation model/specification and server/client contracts", "liveness": "not found", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "19,404 LOC in 68 `.v` file(s), scope `aneris/examples/transactional_consistency/snapshot_isolation`", "source": "[aneris/examples/transactional_consistency/snapshot_isolation](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/snapshot_isolation)", "source_words": "“Lemma run_spec : ∀ (c : val) (tbody : val) (sa : socket_address) (E : coPset) (P : gmap Key Hist → iProp Σ) (Q : (gmap Key Hist) -> (gmap Key Hist) -> (gmap Key (option val * bool)) → iProp Σ), ⌜↑KVS_InvName ⊆ E⌝ -∗ start_spec -∗ commit_spec -∗ IsConnected c sa -∗ {{{ ConnectionState c sa CanStart ∗ (|={⊤, E}=> ▷ ∃ m_at_start, P m_at_start ∗ ([∗ map] k ↦ h ∈ m_at_start, k ↦ₖ h) ∗ (([∗ map] k ↦ h ∈ m_at_start, k ↦ₖ h) ={E, ⊤}=∗ emp)) ∗ (∀ (m_snap : gmap Key Hist), {{{ ([∗ map] k ↦ h ∈ m_snap, k ↦{c} (last h) ∗ KeyUpdStatus c k false) ∗ P m_snap }}} tbody c @[ip_of_address sa] {{{ (mc : gmap Key (option val * bool)), RET #(); ⌜dom m_snap = dom mc⌝ ∗ ([∗ map] k ↦ p ∈ mc, k ↦{c} p.1 ∗ KeyUpdStatus c k p.2) ∗ (|={⊤, E}=> ▷ ∃ m_at_commit, ([∗ map] k ↦ h ∈ m_at_commit, k ↦ₖ h) ∗ ⌜dom m_at_commit = dom m_snap⌝ ∗ Q m_at_commit m_snap mc ∗ ((([∗ map] k↦h;p ∈ m_at_commit; mc, k ↦ₖ (commit_event p h)) ∨ ([∗ map] k↦h ∈ m_at_commit, k ↦ₖ h)) ={E, ⊤}=∗ emp)) }}}) }}} run c tbody @[ip_of_address sa] {{{ m ms mc (b : bool), RET #b; ConnectionState c sa CanStart ∗ Q m ms mc ∗ ((⌜b = true⌝ ∗ ⌜can_commit m ms mc⌝ ∗ ([∗ map] k↦ h;p ∈ m; mc, Seen k (commit_event p h))) ∨ (⌜b = false⌝ ∗ ⌜¬ can_commit m ms mc⌝ ∗ [∗ map] k ↦ h ∈ m, Seen k h)) }}}.”; [util_proof.v, line 263](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/snapshot_isolation/util/util_proof.v#L263)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/snapshot_isolation", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "read-committed specification", "specifies": "weaker transaction model and clients", "safety": "read-committed trace specification; snapshot isolation implies read committed", "liveness": "not found", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "5,325 LOC in 12 `.v` file(s), scope `aneris/examples/transactional_consistency/read_committed`", "source": "[aneris/examples/transactional_consistency/read_committed](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/read_committed)", "source_words": "“Lemma wait_transaction_spec : ∀ (c cond v : val) (key : Key) (sa : socket_address) (E : coPset), ⌜↑KVS_InvName ⊆ E⌝ -∗ ⌜key ∈ KVS_keys⌝ -∗ IsConnected c sa -∗ GlobalInv -∗ RC_client_toolbox -∗ □ (|={⊤, E}=> ▷ ∃ V, key ↦ₖ V ∗ (key ↦ₖ V ={E, ⊤}=∗ emp)) -∗ (∀ v', {{{ True }}} cond v' @[ip_of_address sa] {{{ (b : bool), RET #b; ⌜b → v = v'⌝ }}}) -∗ {{{ ConnectionState c sa CanStart }}} weak_wait_transaction c cond #key @[ip_of_address sa] {{{ V, RET #(); ConnectionState c sa CanStart ∗ Seen key ({[v]} ∪ V) }}}.”; [util_proof.v, line 18](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/read_committed/util/util_proof.v#L18)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/read_committed", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "read-uncommitted specification", "specifies": "weak transaction model and clients", "safety": "read-uncommitted trace specification; read committed implies read uncommitted", "liveness": "not found", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "3,794 LOC in 10 `.v` file(s), scope `aneris/examples/transactional_consistency/read_uncommitted`", "source": "[aneris/examples/transactional_consistency/read_uncommitted](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/read_uncommitted)", "source_words": "“Lemma wait_transaction_spec : ∀ (c cond v : val) (key : Key) (sa : socket_address) (E : coPset), ⌜↑KVS_InvName ⊆ E⌝ -∗ ⌜key ∈ KVS_keys⌝ -∗ IsConnected c sa -∗ GlobalInv -∗ RU_client_toolbox -∗ □ (|={⊤, E}=> ▷ ∃ V, key ↦ₖ V ∗ (key ↦ₖ V ={E, ⊤}=∗ emp)) -∗ (∀ v', {{{ True }}} cond v' @[ip_of_address sa] {{{ (b : bool), RET #b; ⌜b → v = v'⌝ }}}) -∗ {{{ ConnectionState c sa CanStart }}} weak_wait_transaction c cond #key @[ip_of_address sa] {{{ V, RET #(); ConnectionState c sa CanStart ∗ Seen key ({[v]} ∪ V) }}}.”; [util_proof.v, line 18](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/read_uncommitted/util/util_proof.v#L18)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/read_uncommitted", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "DSCM specification and one-server implementation", "specifies": "distributed shared causal memory and one-server client proxy", "safety": "event/resource specification; one client-proxy lemma is admitted", "liveness": "not found", "tool": "Coq/Rocq proof scripts with 1 active admission tokens in counted files; incomplete artifact; source inspection only", "size": "2,800 LOC in 18 `.v` file(s), scope `aneris/examples/dscm`", "source": "[aneris/examples/dscm](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/dscm)", "source_words": "“Lemma Writes_Obs_origin_frame E s we sa h hf : nclose DB_InvName ⊆ E → Writes sa (s ++ [we]) -∗ Obs (h ++ [we] ++ hf) ={E}=∗ Writes sa (s ++ [we]) ∗ ⌜hist_at_origin sa hf = []⌝.”; [utils.v, line 129](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/dscm/spec/utils.v#L129)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/dscm", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "viewstamped replication", "specifies": "replica, network layer and client proxy", "safety": "implementation definitions; no proof found in this directory", "liveness": "not found", "tool": "implementation/specification present; no active lemma/theorem found in counted files; source inspection only", "size": "1,404 LOC in 5 `.v` file(s), scope `aneris/examples/viewstamped_replication`", "source": "[aneris/examples/viewstamped_replication](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/viewstamped_replication)", "source_words": "“Definition wait_for_reply val_ser : val :=”; [vr_client_proxy_code.v](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/viewstamped_replication/vr_client_proxy_code.v)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/viewstamped_replication", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "echo", "specifies": "single echo server/client", "safety": "echo client/server postconditions", "liveness": "not found", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "251 LOC in 2 `.v` file(s), scope `aneris/examples/echo`", "source": "[aneris/examples/echo](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/echo)", "source_words": "“Theorem echo_safe : aneris_adequate echo_runner \"system\" echo_is (λ _, True).”; [echo_proof.v, line 183](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/echo/echo_proof.v#L183)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/echo", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "echo groups", "specifies": "groups of echo server/client nodes", "safety": "group echo postconditions", "liveness": "not found", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "561 LOC in 2 `.v` file(s), scope `aneris/examples/echo_groups`", "source": "[aneris/examples/echo_groups](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/echo_groups)", "source_words": "“Theorem echo_safe : aneris_adequate echo_runner \"system\" echo_is (λ _, True).”; [proof.v, line 500](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/echo_groups/proof.v#L500)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/echo_groups", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "minimal message passing", "specifies": "minimal distributed message example", "safety": "client/server contracts", "liveness": "not found", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "436 LOC in 2 `.v` file(s), scope `aneris/examples/minimal_example`", "source": "[aneris/examples/minimal_example](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/minimal_example)", "source_words": "“Lemma gcounter_adequacy ip : @continued_simulation aneris_lang (aneris_to_trace_model incr_exampleM) (incr_sim ip) {tr[ ([mkExpr ip incr_example], init_state ip) ]} {tr[ 0%nat ]}.”; [minimal_example_proof.v, line 239](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/minimal_example/minimal_example_proof.v#L239)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/minimal_example", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "ping-pong", "specifies": "ping/pong communication", "safety": "client/server postconditions", "liveness": "not found", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "211 LOC in 1 `.v` file(s), scope `aneris/examples/ping_pong`", "source": "[aneris/examples/ping_pong](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/ping_pong)", "source_words": "“Theorem ping_pong_safe : aneris_adequate ping_pong_runner \"system\" ping_pong_is (λ _, True).”; [ping_pong.v, line 196](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/ping_pong/ping_pong.v#L196)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/ping_pong", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "ping-pong done", "specifies": "ping/pong with completion message", "safety": "client/server postconditions", "liveness": "not found", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "297 LOC in 3 `.v` file(s), scope `aneris/examples/ping_pong_done`", "source": "[aneris/examples/ping_pong_done](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/ping_pong_done)", "source_words": "“Lemma ping_pong_runner_spec : {{{ pong_addr ⤇ pong_si ∗ pong_addr ⤳ (∅, ∅) ∗ ping_addr ⤳ (∅, ∅) ∗ unallocated {[ping_addr]} ∗ ([∗ set] ip ∈ ips, free_ip ip) ∗ last_message γpong NONE ∗ last_message γpong NONE }}} ping_pong_runner @[\"system\"] {{{ v, RET v; True }}}.”; [ping_pong_done_proof.v, line 217](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/ping_pong_done/ping_pong_done_proof.v#L217)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/ping_pong_done", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "iterated ping-pong", "specifies": "server and multiple ping/pong clients", "safety": "proof draft is commented out; no active proof claimed", "liveness": "not found", "tool": "implementation/specification present; no active lemma/theorem found in counted files; source inspection only", "size": "1,599 LOC in 2 `.v` file(s), scope `aneris/examples/iterated_ping_pong`", "source": "[aneris/examples/iterated_ping_pong](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/iterated_ping_pong)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/iterated_ping_pong", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "CRDT add wins set", "specifies": "add wins set replicated datatype or CRDT client", "safety": "datatype-specific model/operation contracts; theorem quoted below", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "407 LOC in 2 `.v` file(s), scope `aneris/examples/crdt/oplib/examples/add_wins_set`", "source": "[aneris/examples/crdt/oplib/examples/add_wins_set](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/crdt/oplib/examples/add_wins_set)", "source_words": "“Lemma aws_init_spec : init_spec (oplib_init (s_ser (s_serializer (sum_serialization vl_serialization vl_serialization))) (s_deser (s_serializer (sum_serialization vl_serialization vl_serialization)))) -∗ init_spec_for_specific_crdt (aws_init (s_ser (s_serializer vl_serialization)) (s_deser (s_serializer vl_serialization))).”; [add_wins_set_proof.v, line 352](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/crdt/oplib/examples/add_wins_set/add_wins_set_proof.v#L352)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/crdt/oplib/examples/add_wins_set", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "CRDT gcounter", "specifies": "gcounter replicated datatype or CRDT client", "safety": "datatype-specific model/operation contracts; theorem quoted below", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "269 LOC in 2 `.v` file(s), scope `aneris/examples/crdt/oplib/examples/gcounter`", "source": "[aneris/examples/crdt/oplib/examples/gcounter](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/crdt/oplib/examples/gcounter)", "source_words": "“Lemma Ctr_init_spec : init_spec (oplib_init (s_ser (s_serializer OpLib_Serialization)) (s_deser (s_serializer OpLib_Serialization))) -∗ init_spec_for_specific_crdt counter_init.”; [gcounter_proof.v, line 226](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/crdt/oplib/examples/gcounter/gcounter_proof.v#L226)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/crdt/oplib/examples/gcounter", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "CRDT grow only set", "specifies": "grow only set replicated datatype or CRDT client", "safety": "datatype-specific model/operation contracts; theorem quoted below", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "183 LOC in 2 `.v` file(s), scope `aneris/examples/crdt/oplib/examples/grow_only_set`", "source": "[aneris/examples/crdt/oplib/examples/grow_only_set](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/crdt/oplib/examples/grow_only_set)", "source_words": "“Lemma prod_init_spec : init_spec (oplib_init (s_ser (s_serializer vl_serialization)) (s_deser (s_serializer vl_serialization))) -∗ init_spec_for_specific_crdt (gos_init (s_ser (s_serializer vl_serialization)) (s_deser (s_serializer vl_serialization))).”; [grow_only_set_proof.v, line 141](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/crdt/oplib/examples/grow_only_set/grow_only_set_proof.v#L141)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/crdt/oplib/examples/grow_only_set", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "CRDT lwwreg", "specifies": "lwwreg replicated datatype or CRDT client", "safety": "datatype-specific model/operation contracts; theorem quoted below", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "624 LOC in 2 `.v` file(s), scope `aneris/examples/crdt/oplib/examples/lwwreg`", "source": "[aneris/examples/crdt/oplib/examples/lwwreg](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/crdt/oplib/examples/lwwreg)", "source_words": "“Lemma lww_init_spec : init_spec (oplib_init (s_ser (s_serializer OpLib_Serialization)) (s_deser (s_serializer OpLib_Serialization))) -∗ init_spec_for_specific_crdt (lwwreg_init (s_ser (s_serializer vl_serialization)) (s_deser (s_serializer vl_serialization))).”; [lwwreg_proof.v, line 542](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/crdt/oplib/examples/lwwreg/lwwreg_proof.v#L542)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/crdt/oplib/examples/lwwreg", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "CRDT map comb", "specifies": "map comb replicated datatype or CRDT client", "safety": "datatype-specific model/operation contracts; theorem quoted below", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "570 LOC in 2 `.v` file(s), scope `aneris/examples/crdt/oplib/examples/map_comb`", "source": "[aneris/examples/crdt/oplib/examples/map_comb](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/crdt/oplib/examples/map_comb)", "source_words": "“Lemma map_init_spec crdt : @crdt_fun_spec _ _ _ _ _ _ _ OPP crdt -∗ @init_spec _ _ _ _ _ _ _ map_OpLib_Params _ _ oplib_init' -∗ ∀ (repId : nat) (addr : socket_address) (addrs_val : val), {{{ ⌜is_list CRDT_Addresses addrs_val⌝ ∗ ⌜CRDT_Addresses !! repId = Some addr⌝ ∗ ([∗ list] i ↦ z ∈ CRDT_Addresses, z ⤇ OpLib_SocketProto i) ∗ addr ⤳ (∅, ∅) ∗ free_ports (ip_of_address addr) {[port_of_address addr]} ∗ OpLib_InitToken repId }}} map_comb_init' crdt addrs_val #repId @[ip_of_address addr] {{{ get_state_val update_val, RET (get_state_val, update_val); LocState repId ∅ ∅ ∗ @get_state_spec _ _ _ _ _ _ _ map_OpLib_Params _ _ get_state_val repId addr ∗ @update_spec _ _ _ _ _ _ _ map_OpLib_Params _ _ update_val repId addr }}}.”; [map_comb_proof.v, line 499](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/crdt/oplib/examples/map_comb/map_comb_proof.v#L499)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/crdt/oplib/examples/map_comb", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "CRDT mvreg", "specifies": "mvreg replicated datatype or CRDT client", "safety": "datatype-specific model/operation contracts; theorem quoted below", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "365 LOC in 2 `.v` file(s), scope `aneris/examples/crdt/oplib/examples/mvreg`", "source": "[aneris/examples/crdt/oplib/examples/mvreg](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/crdt/oplib/examples/mvreg)", "source_words": "“Lemma Ctr_init_spec : init_spec (oplib_init (s_ser (s_serializer OpLib_Serialization)) (s_deser (s_serializer OpLib_Serialization))) -∗ init_spec_for_specific_crdt mvreg_init.”; [mvreg_proof.v, line 317](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/crdt/oplib/examples/mvreg/mvreg_proof.v#L317)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/crdt/oplib/examples/mvreg", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "CRDT pncounter", "specifies": "pncounter replicated datatype or CRDT client", "safety": "datatype-specific model/operation contracts; theorem quoted below", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "261 LOC in 2 `.v` file(s), scope `aneris/examples/crdt/oplib/examples/pncounter`", "source": "[aneris/examples/crdt/oplib/examples/pncounter](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/crdt/oplib/examples/pncounter)", "source_words": "“Lemma Ctr_init_spec : init_spec (oplib_init (s_ser (s_serializer OpLib_Serialization)) (s_deser (s_serializer OpLib_Serialization))) -∗ init_spec_for_specific_crdt pncounter_init.”; [pncounter_proof.v, line 218](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/crdt/oplib/examples/pncounter/pncounter_proof.v#L218)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/crdt/oplib/examples/pncounter", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "CRDT pncounter use case", "specifies": "pncounter use case replicated datatype or CRDT client", "safety": "datatype-specific model/operation contracts; theorem quoted below", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "401 LOC in 1 `.v` file(s), scope `aneris/examples/crdt/oplib/examples/pncounter_use_case`", "source": "[aneris/examples/crdt/oplib/examples/pncounter_use_case](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/crdt/oplib/examples/pncounter_use_case)", "source_words": "“Theorem use_case_program_adequate : aneris_adequate use_case_program \"system\" init_state (λ v, v = #()).”; [pncounter_use_case.v, line 367](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/crdt/oplib/examples/pncounter_use_case/pncounter_use_case.v#L367)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/crdt/oplib/examples/pncounter_use_case", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "CRDT prod comb", "specifies": "prod comb replicated datatype or CRDT client", "safety": "datatype-specific model/operation contracts; theorem quoted below", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "412 LOC in 2 `.v` file(s), scope `aneris/examples/crdt/oplib/examples/prod_comb`", "source": "[aneris/examples/crdt/oplib/examples/prod_comb](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/crdt/oplib/examples/prod_comb)", "source_words": "“Lemma prod_init_spec crdtA crdtB : @crdt_fun_spec _ _ _ _ _ _ _ OPPA crdtA -∗ @crdt_fun_spec _ _ _ _ _ _ _ OPPB crdtB -∗ @init_spec _ _ _ _ _ _ _ prod_OpLib_Params _ _ oplib_init' -∗ ∀ (repId : nat) (addr : socket_address) (addrs_val : val), {{{ ⌜is_list CRDT_Addresses addrs_val⌝ ∗ ⌜CRDT_Addresses !! repId = Some addr⌝ ∗ ([∗ list] i ↦ z ∈ CRDT_Addresses, z ⤇ OpLib_SocketProto i) ∗ addr ⤳ (∅, ∅) ∗ free_ports (ip_of_address addr) {[port_of_address addr]} ∗ OpLib_InitToken repId }}} prod_comb_init' crdtA crdtB addrs_val #repId @[ip_of_address addr] {{{ get_state_val update_val, RET (get_state_val, update_val); LocState repId ∅ ∅ ∗ @get_state_spec _ _ _ _ _ _ _ prod_OpLib_Params _ _ get_state_val repId addr ∗ @update_spec _ _ _ _ _ _ _ prod_OpLib_Params _ _ update_val repId addr }}}.”; [prod_comb_proof.v, line 340](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/crdt/oplib/examples/prod_comb/prod_comb_proof.v#L340)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/crdt/oplib/examples/prod_comb", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "CRDT remove wins set", "specifies": "remove wins set replicated datatype or CRDT client", "safety": "datatype-specific model/operation contracts; theorem quoted below", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "586 LOC in 2 `.v` file(s), scope `aneris/examples/crdt/oplib/examples/remove_wins_set`", "source": "[aneris/examples/crdt/oplib/examples/remove_wins_set](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/crdt/oplib/examples/remove_wins_set)", "source_words": "“Lemma rws_init_spec : init_spec (oplib_init (s_ser (s_serializer (sum_serialization vl_serialization vl_serialization))) (s_deser (s_serializer (sum_serialization vl_serialization vl_serialization)))) -∗ init_spec_for_specific_crdt (rws_init (s_ser (s_serializer vl_serialization)) (s_deser (s_serializer vl_serialization))).”; [remove_wins_set_proof.v, line 508](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/crdt/oplib/examples/remove_wins_set/remove_wins_set_proof.v#L508)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/crdt/oplib/examples/remove_wins_set", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "CRDT table of counters", "specifies": "table of counters replicated datatype or CRDT client", "safety": "datatype-specific model/operation contracts; theorem quoted below", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "101 LOC in 2 `.v` file(s), scope `aneris/examples/crdt/oplib/examples/table_of_counters`", "source": "[aneris/examples/crdt/oplib/examples/table_of_counters](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/crdt/oplib/examples/table_of_counters)", "source_words": "“Lemma table_of_counters_init_spec : @init_spec _ _ _ _ _ _ _ map_OpLib_Params _ _ oplib_init' -∗ @init_spec_for_specific_crdt _ _ _ _ _ _ _ map_OpLib_Params _ _ table_of_counters_init.”; [table_of_counters_proof.v, line 59](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/crdt/oplib/examples/table_of_counters/table_of_counters_proof.v#L59)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/crdt/oplib/examples/table_of_counters", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "CRDT table of lwwregs", "specifies": "table of lwwregs replicated datatype or CRDT client", "safety": "datatype-specific model/operation contracts; theorem quoted below", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "111 LOC in 2 `.v` file(s), scope `aneris/examples/crdt/oplib/examples/table_of_lwwregs`", "source": "[aneris/examples/crdt/oplib/examples/table_of_lwwregs](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/crdt/oplib/examples/table_of_lwwregs)", "source_words": "“Lemma table_of_lwwregs_init_spec : @init_spec _ _ _ _ _ _ _ map_OpLib_Params' _ _ oplib_init' -∗ @init_spec_for_specific_crdt _ _ _ _ _ _ _ map_OpLib_Params' _ _ (table_of_lwwregs_init (s_ser (s_serializer vl_serialization)) (s_deser (s_serializer vl_serialization))).”; [table_of_lwwregs_proof.v, line 68](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/crdt/oplib/examples/table_of_lwwregs/table_of_lwwregs_proof.v#L68)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/crdt/oplib/examples/table_of_lwwregs", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "CRDT two p set", "specifies": "two p set replicated datatype or CRDT client", "safety": "datatype-specific model/operation contracts; theorem quoted below", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "211 LOC in 2 `.v` file(s), scope `aneris/examples/crdt/oplib/examples/two_p_set`", "source": "[aneris/examples/crdt/oplib/examples/two_p_set](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/crdt/oplib/examples/two_p_set)", "source_words": "“Lemma tps_init_spec : init_spec (oplib_init (s_ser (s_serializer (sum_serialization vl_serialization vl_serialization))) (s_deser (s_serializer (sum_serialization vl_serialization vl_serialization)))) -∗ init_spec_for_specific_crdt (tps_init (s_ser (s_serializer vl_serialization)) (s_deser (s_serializer vl_serialization))).”; [two_p_set_proof.v, line 163](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/crdt/oplib/examples/two_p_set/two_p_set_proof.v#L163)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/crdt/oplib/examples/two_p_set", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "state-based PN-counter", "specifies": "positive/negative replicated counter implementation", "safety": "implementation only; no local theorem found", "liveness": "not found in this row", "tool": "implementation/specification present; no active lemma/theorem found in counted files; source inspection only", "size": "85 LOC in 1 `.v` file(s), scope `aneris/examples/crdt/statelib/examples/pncounter`", "source": "[aneris/examples/crdt/statelib/examples/pncounter](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/crdt/statelib/examples/pncounter)", "source_words": "“Definition mutate_side : val :=”; [counter_code.v](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/crdt/statelib/examples/pncounter/counter_code.v)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/crdt/statelib/examples/pncounter", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "Aneris reliable_communication case: ddb", "specifies": "ddb protocol/library/client case", "safety": "example/API contracts; exact theorem in linked source", "liveness": "not found in this row", "tool": "implementation/specification present; no active lemma/theorem found in counted files; source inspection only", "size": "147 LOC in 2 `.v` file(s), scope `aneris/examples/reliable_communication/lib/ddb`", "source": "[aneris/examples/reliable_communication/lib/ddb](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/reliable_communication/lib/ddb)", "source_words": "“Definition process_request : val :=”; [ddb_code.v](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/reliable_communication/lib/ddb/ddb_code.v)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/reliable_communication/lib/ddb", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "Aneris reliable_communication case: dlm", "specifies": "dlm protocol/library/client case", "safety": "example/API contracts; exact theorem in linked source", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "596 LOC in 5 `.v` file(s), scope `aneris/examples/reliable_communication/lib/dlm`", "source": "[aneris/examples/reliable_communication/lib/dlm](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/reliable_communication/lib/dlm)", "source_words": "“Lemma init_setup_holds (E : coPset) (R : iProp Σ) : ↑DL_namespace ⊆ E → ⊢ |={E}=> ∃ (DLRS : DL_resources), dl_service_init ∗ (dl_server_start_service_spec R) ∗ (dl_subscribe_client_spec R).”; [dlm_proof.v, line 270](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/reliable_communication/lib/dlm/dlm_proof.v#L270)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/reliable_communication/lib/dlm", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "Aneris reliable_communication case: mt server", "specifies": "mt server protocol/library/client case", "safety": "example/API contracts; exact theorem in linked source", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "471 LOC in 4 `.v` file(s), scope `aneris/examples/reliable_communication/lib/mt_server`", "source": "[aneris/examples/reliable_communication/lib/mt_server](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/reliable_communication/lib/mt_server)", "source_words": "“Lemma MTS_init_setup_holds (E : coPset) : ↑MTS_mN ⊆ E → ⊢ |={E}=> ∃ (srv_si : message → iProp Σ) (SrvInit : iProp Σ) (MTR : MTS_resources), SrvInit ∗ (run_server_spec SrvInit srv_si) ∗ (init_client_proxy_spec srv_si) ∗ make_request_spec.”; [mt_server_proof.v, line 209](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/reliable_communication/lib/mt_server/proof/mt_server_proof.v#L209)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/reliable_communication/lib/mt_server", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "Aneris reliable_communication case: repdb", "specifies": "repdb protocol/library/client case", "safety": "example/API contracts; exact theorem in linked source", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "4,801 LOC in 32 `.v` file(s), scope `aneris/examples/reliable_communication/lib/repdb`", "source": "[aneris/examples/reliable_communication/lib/repdb](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/reliable_communication/lib/repdb)", "source_words": "“Lemma filter_subseteq {A : Type} `{!EqDecision A} P `{! ∀ x : A, Decision (P x)} (xs : list A) : filter P xs ⊆ xs.”; [stdpp_utils.v, line 194](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/reliable_communication/lib/repdb/spec/stdpp_utils.v#L194)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/reliable_communication/lib/repdb", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "Aneris reliable_communication case: sharding", "specifies": "sharding protocol/library/client case", "safety": "example/API contracts; exact theorem in linked source", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "1,361 LOC in 9 `.v` file(s), scope `aneris/examples/reliable_communication/lib/sharding`", "source": "[aneris/examples/reliable_communication/lib/sharding](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/reliable_communication/lib/sharding)", "source_words": "“Lemma rep_ser_is_ser_injective_alt : ser_is_injective_alt rep_ser.”; [resources.v, line 303](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/reliable_communication/lib/sharding/spec/resources.v#L303)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/reliable_communication/lib/sharding", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "Aneris reliable_communication case: dlm db example", "specifies": "dlm db example protocol/library/client case", "safety": "example/API contracts; exact theorem in linked source", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "584 LOC in 2 `.v` file(s), scope `aneris/examples/reliable_communication/examples/dlm_db_example`", "source": "[aneris/examples/reliable_communication/examples/dlm_db_example](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/reliable_communication/examples/dlm_db_example)", "source_words": "“Theorem adequacy : aneris_adequate main \"system\" init_state (λ _, True).”; [dlm_db_example_proof.v, line 464](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/reliable_communication/examples/dlm_db_example/dlm_db_example_proof.v#L464)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/reliable_communication/examples/dlm_db_example", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "Aneris reliable_communication case: hello world", "specifies": "hello world protocol/library/client case", "safety": "example/API contracts; exact theorem in linked source", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "272 LOC in 2 `.v` file(s), scope `aneris/examples/reliable_communication/examples/hello_world`", "source": "[aneris/examples/reliable_communication/examples/hello_world](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/reliable_communication/examples/hello_world)", "source_words": "“Theorem adequacy : aneris_adequate main \"system\" init_state (λ _, True).”; [hello_world_proof.v, line 213](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/reliable_communication/examples/hello_world/hello_world_proof.v#L213)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/reliable_communication/examples/hello_world", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "Aneris reliable_communication case: hello world 2", "specifies": "hello world 2 protocol/library/client case", "safety": "example/API contracts; exact theorem in linked source", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "395 LOC in 2 `.v` file(s), scope `aneris/examples/reliable_communication/examples/hello_world_2`", "source": "[aneris/examples/reliable_communication/examples/hello_world_2](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/reliable_communication/examples/hello_world_2)", "source_words": "“Theorem adequacy : aneris_adequate main \"system\" init_state (λ _, True).”; [hello_world_2_proof.v, line 309](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/reliable_communication/examples/hello_world_2/hello_world_2_proof.v#L309)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/reliable_communication/examples/hello_world_2", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "Aneris reliable_communication case: messages in order", "specifies": "messages in order protocol/library/client case", "safety": "example/API contracts; exact theorem in linked source", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "280 LOC in 2 `.v` file(s), scope `aneris/examples/reliable_communication/examples/messages_in_order`", "source": "[aneris/examples/reliable_communication/examples/messages_in_order](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/reliable_communication/examples/messages_in_order)", "source_words": "“Theorem adequacy : aneris_adequate main \"system\" init_state (λ _, True).”; [messages_in_order_proof.v, line 206](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/reliable_communication/examples/messages_in_order/messages_in_order_proof.v#L206)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/reliable_communication/examples/messages_in_order", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "Aneris reliable_communication case: messages in order loop", "specifies": "messages in order loop protocol/library/client case", "safety": "example/API contracts; exact theorem in linked source", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "350 LOC in 2 `.v` file(s), scope `aneris/examples/reliable_communication/examples/messages_in_order_loop`", "source": "[aneris/examples/reliable_communication/examples/messages_in_order_loop](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/reliable_communication/examples/messages_in_order_loop)", "source_words": "“Theorem adequacy : aneris_adequate main \"system\" init_state (λ _, True).”; [messages_in_order_loop_proof.v, line 268](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/reliable_communication/examples/messages_in_order_loop/messages_in_order_loop_proof.v#L268)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/reliable_communication/examples/messages_in_order_loop", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "Aneris reliable_communication case: repdb leader followers", "specifies": "repdb leader followers protocol/library/client case", "safety": "example/API contracts; exact theorem in linked source", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "574 LOC in 2 `.v` file(s), scope `aneris/examples/reliable_communication/examples/repdb_leader_followers`", "source": "[aneris/examples/reliable_communication/examples/repdb_leader_followers](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/reliable_communication/examples/repdb_leader_followers)", "source_words": "“Theorem adequacy : aneris_adequate main \"system\" init_state (λ _, True).”; [causality_example_proof.v, line 470](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/reliable_communication/examples/repdb_leader_followers/causality_example_proof.v#L470)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/reliable_communication/examples/repdb_leader_followers", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "Aneris reliable_communication case: sharding examples", "specifies": "sharding examples protocol/library/client case", "safety": "example/API contracts; exact theorem in linked source", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "581 LOC in 2 `.v` file(s), scope `aneris/examples/reliable_communication/examples/sharding_examples`", "source": "[aneris/examples/reliable_communication/examples/sharding_examples](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/reliable_communication/examples/sharding_examples)", "source_words": "“Theorem main_adequacy : aneris_adequate main \"system\" init_state (λ _, True).”; [causality_example_proof.v, line 458](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/reliable_communication/examples/sharding_examples/causality_example_proof.v#L458)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/reliable_communication/examples/sharding_examples", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "Aneris rcb case: broadcast 1 2", "specifies": "broadcast 1 2 protocol/library/client case", "safety": "example/API contracts; exact theorem in linked source", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "400 LOC in 6 `.v` file(s), scope `aneris/examples/rcb/examples/broadcast_1_2`", "source": "[aneris/examples/rcb/examples/broadcast_1_2](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/rcb/examples/broadcast_1_2)", "source_words": "“Lemma exclusive_token γ : token γ -∗ token γ -∗ False.”; [proof_resources.v, line 13](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/rcb/examples/broadcast_1_2/proof_resources.v#L13)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/rcb/examples/broadcast_1_2", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "Aneris ccddb case: message passing", "specifies": "message passing protocol/library/client case", "safety": "example/API contracts; exact theorem in linked source", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "783 LOC in 7 `.v` file(s), scope `aneris/examples/ccddb/examples/message_passing`", "source": "[aneris/examples/ccddb/examples/message_passing](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/ccddb/examples/message_passing)", "source_words": "“Lemma token_exclusive (γ : gname) : token γ -∗ token γ -∗ False.”; [proof_resources.v, line 25](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/ccddb/examples/message_passing/proof_resources.v#L25)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/ccddb/examples/message_passing", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "Aneris ccddb case: session guarantees", "specifies": "session guarantees protocol/library/client case", "safety": "example/API contracts; exact theorem in linked source", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "1,869 LOC in 8 `.v` file(s), scope `aneris/examples/ccddb/examples/session_guarantees`", "source": "[aneris/examples/ccddb/examples/session_guarantees](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/ccddb/examples/session_guarantees)", "source_words": "“Theorem wfr_example_spec (ca sa1 : socket_address) (db_id1 : rep_id) : {{{ sa1 ⤇ (db_si db_id1) ∗ unallocated {[ca]} ∗ free_ports (ip_of_address ca) {[ port_of_address ca ]} ∗ ca ⤳ (∅, ∅) }}} wfr_example #ca #sa1 @[ip_of_address ca] {{{ vo, RET vo; ∃ e2 s1, (Seen db_id1 s1) ∗ (⌜AE_key e2 = key2⌝) ∗ (⌜AE_val e2 = dbv2⌝) ∗ (⌜e2 ∈ s1⌝) ∗ ( (⌜vo = NONEV⌝) ∨ (∃ e1 v, (⌜vo = SOMEV v⌝) ∗ (⌜e1 ∈ s1⌝) ∗ (⌜AE_key e1 = key1⌝) ∗ (⌜AE_val e1 = v⌝) ∗ (⌜e1 <ₜ e2⌝) ∗ (∀ e s2 db_id2, ((Seen db_id2 s2) ∗ (⌜e ∈ s2⌝) ∗ (⌜e2 ≤ₜ e⌝)) ={⊤}=∗ ∃ e1' e2', (⌜erasure e1' = erasure e1⌝) ∗ (⌜erasure e2' = erasure e2⌝) ∗ ⌜e1' ∈ s2⌝ ∗ ⌜e2' ∈ s2⌝ ∗ ⌜e1' <ₜ e2'⌝) ) ) }}}.”; [wfr.v, line 39](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/ccddb/examples/session_guarantees/wfr.v#L39)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/ccddb/examples/session_guarantees", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "DSCM client 1", "specifies": "distributed causal-memory client program", "safety": "client resource/postcondition contract", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "331 LOC in 2 `.v` file(s), scope `aneris/examples/dscm/clients/example1_proof.v` plus named companion files", "source": "[aneris/examples/dscm/clients/example1_proof.v](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/dscm/clients/example1_proof.v)", "source_words": "“Lemma prog_spec sa wr rd : sa ∉ DB_addresses → GlobalInv -∗ write_spec wr sa -∗ read_spec rd sa -∗ {{{ Obs [] ∗ \"x\" ↦ₖ None ∗ \"y\" ↦ₖ None ∗ Writes sa [] }}} par_prog wr rd @[ip_of_address sa] {{{ (v : val), RET v; ⌜v = (SOMEV #0, SOMEV #1)%V⌝ ∨ ⌜v = (SOMEV #1, SOMEV #0)%V⌝ ∨ ⌜v = (SOMEV #1, SOMEV #1)%V⌝}}}.”; [example1_proof.v, line 161](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/dscm/clients/example1_proof.v#L161)", "source_url": "https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/dscm/clients/example1_proof.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "DSCM client 2", "specifies": "distributed causal-memory client program", "safety": "client resource/postcondition contract", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "450 LOC in 2 `.v` file(s), scope `aneris/examples/dscm/clients/example2_proof.v` plus named companion files", "source": "[aneris/examples/dscm/clients/example2_proof.v](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/dscm/clients/example2_proof.v)", "source_words": "“Lemma prog_spec ip sa1 sa2 init k (n1 n2 : Z) dbsv : is_list DB_addresses dbsv → k ∈ DB_keys → ip_of_address sa1 = ip → ip_of_address sa2 = ip → sa1 ∉ DB_addresses → sa2 ∉ DB_addresses → sa1 ≠ sa2 → GlobalInv -∗ init_spec init -∗ {{{ sa1 ⤳ (∅, ∅) ∗ sa2 ⤳ (∅, ∅) ∗ free_ports (ip_of_address sa1) {[port_of_address sa1]} ∗ free_ports (ip_of_address sa2) {[port_of_address sa2]} ∗ k ↦ₖ None ∗ unallocated {[sa1;sa2]} ∗ ([∗ list] i ↦ z ∈ DB_addresses, z ⤇ DB_socket_proto) }}} prog init sa1 sa2 k n1 n2 dbsv @[ip] {{{ (v : val), RET v; ⌜v = (SOMEV #n1, SOMEV #n1)%V⌝ ∨ ⌜v = (SOMEV #n1, SOMEV #n2)%V⌝ ∨ ⌜v = (SOMEV #n2, SOMEV #n2)%V⌝}}}.”; [example2_proof.v, line 287](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/dscm/clients/example2_proof.v#L287)", "source_url": "https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/dscm/clients/example2_proof.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "Aneris transactional_consistency case: commit order", "specifies": "commit order protocol/library/client case", "safety": "example/API contracts; exact theorem in linked source", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "935 LOC in 2 `.v` file(s), scope `aneris/examples/transactional_consistency/read_committed/examples/commit_order`", "source": "[aneris/examples/transactional_consistency/read_committed/examples/commit_order](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/read_committed/examples/commit_order)", "source_words": "“Theorem runner_safe : aneris_adequate example_runner \"system\" init_state (λ _, True).”; [commit_order_proof.v, line 863](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/read_committed/examples/commit_order/commit_order_proof.v#L863)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/read_committed/examples/commit_order", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "Aneris transactional_consistency case: dirty read", "specifies": "dirty read protocol/library/client case", "safety": "example/API contracts; exact theorem in linked source", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "358 LOC in 2 `.v` file(s), scope `aneris/examples/transactional_consistency/read_committed/examples/dirty_read`", "source": "[aneris/examples/transactional_consistency/read_committed/examples/dirty_read](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/read_committed/examples/dirty_read)", "source_words": "“Theorem runner_safe : aneris_adequate example_runner \"system\" init_state (λ _, True).”; [dirty_read_proof.v, line 307](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/read_committed/examples/dirty_read/dirty_read_proof.v#L307)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/read_committed/examples/dirty_read", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "Aneris transactional_consistency case: trace proof of concept", "specifies": "trace proof of concept protocol/library/client case", "safety": "example/API contracts; exact theorem in linked source", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "368 LOC in 2 `.v` file(s), scope `aneris/examples/transactional_consistency/read_committed/examples/trace_proof_of_concept`", "source": "[aneris/examples/transactional_consistency/read_committed/examples/trace_proof_of_concept](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/read_committed/examples/trace_proof_of_concept)", "source_words": "“Theorem trace_valid : ∀ σ' t, rtc step ([(mkExpr \"system\" example_runner)], init_state) (t, σ') → valid_trace_rc (state_trace σ').”; [trace_proof_of_concept_proof.v, line 309](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/read_committed/examples/trace_proof_of_concept/trace_proof_of_concept_proof.v#L309)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/read_committed/examples/trace_proof_of_concept", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "Aneris transactional_consistency case: read own data", "specifies": "read own data protocol/library/client case", "safety": "example/API contracts; exact theorem in linked source", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "398 LOC in 2 `.v` file(s), scope `aneris/examples/transactional_consistency/read_uncommitted/examples/read_own_data`", "source": "[aneris/examples/transactional_consistency/read_uncommitted/examples/read_own_data](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/read_uncommitted/examples/read_own_data)", "source_words": "“Theorem runner_safe : aneris_adequate example_runner \"system\" init_state (λ _, True).”; [read_own_data_proof.v, line 345](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/read_uncommitted/examples/read_own_data/read_own_data_proof.v#L345)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/read_uncommitted/examples/read_own_data", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "Aneris transactional_consistency case: read uncommitted data", "specifies": "read uncommitted data protocol/library/client case", "safety": "example/API contracts; exact theorem in linked source", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "429 LOC in 2 `.v` file(s), scope `aneris/examples/transactional_consistency/read_uncommitted/examples/read_uncommitted_data`", "source": "[aneris/examples/transactional_consistency/read_uncommitted/examples/read_uncommitted_data](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/read_uncommitted/examples/read_uncommitted_data)", "source_words": "“Theorem runner_safe : aneris_adequate example_runner \"system\" init_state (λ _, True).”; [read_uncommitted_data_proof.v, line 377](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/read_uncommitted/examples/read_uncommitted_data/read_uncommitted_data_proof.v#L377)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/read_uncommitted/examples/read_uncommitted_data", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "Aneris transactional_consistency case: bank transfer", "specifies": "bank transfer protocol/library/client case", "safety": "example/API contracts; exact theorem in linked source", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "205 LOC in 2 `.v` file(s), scope `aneris/examples/transactional_consistency/snapshot_isolation/examples/bank_transfer`", "source": "[aneris/examples/transactional_consistency/snapshot_isolation/examples/bank_transfer](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/snapshot_isolation/examples/bank_transfer)", "source_words": "“Lemma transfer_transaction (amount : nat) (c : val) (src dst : Key) (client_addr : socket_address) (client_inv_name : namespace) : SI_client_toolbox -∗ {{{ ⌜src ∈ KVS_keys⌝ ∗ ⌜dst ∈ KVS_keys⌝ ∗ ⌜src ≠ dst⌝ ∗ ⌜∀ (n : nat), KVS_Serializable #n ⌝ ∗ ⌜↑KVS_InvName ⊆ (⊤ : coPset) ∖ ↑client_inv_name⌝ ∗ inv client_inv_name (client_inv src dst) ∗ ConnectionState c client_addr CanStart ∗ IsConnected c client_addr }}} transaction c $amount $src $dst @[ip_of_address client_addr] {{{ v, RET v; True }}}.”; [bank_transfer_proof.v, line 32](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/snapshot_isolation/examples/bank_transfer/bank_transfer_proof.v#L32)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/snapshot_isolation/examples/bank_transfer", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "Aneris transactional_consistency case: causality example", "specifies": "causality example protocol/library/client case", "safety": "example/API contracts; exact theorem in linked source", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "590 LOC in 2 `.v` file(s), scope `aneris/examples/transactional_consistency/snapshot_isolation/examples/causality_example`", "source": "[aneris/examples/transactional_consistency/snapshot_isolation/examples/causality_example](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/snapshot_isolation/examples/causality_example)", "source_words": "“Theorem runner_safe : aneris_adequate runner \"system\" init_state (λ _, True).”; [causality_example_proof.v, line 529](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/snapshot_isolation/examples/causality_example/causality_example_proof.v#L529)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/snapshot_isolation/examples/causality_example", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "Aneris transactional_consistency case: classical example", "specifies": "classical example protocol/library/client case", "safety": "example/API contracts; exact theorem in linked source", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "443 LOC in 2 `.v` file(s), scope `aneris/examples/transactional_consistency/snapshot_isolation/examples/classical_example`", "source": "[aneris/examples/transactional_consistency/snapshot_isolation/examples/classical_example](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/snapshot_isolation/examples/classical_example)", "source_words": "“Theorem runner_safe : aneris_adequate example_runner \"system\" init_state (λ _, True).”; [classical_example_proof.v, line 380](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/snapshot_isolation/examples/classical_example/classical_example_proof.v#L380)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/snapshot_isolation/examples/classical_example", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "Aneris deprecated SI client: anomalie", "specifies": "anomalie transaction client", "safety": "example postcondition or anomaly witness; exact contract in linked source", "liveness": "not found in this row", "tool": "implementation/specification present; no active lemma/theorem found in counted files; source inspection only", "size": "6 LOC in 1 `.v` file(s), scope `aneris/examples/transactional_consistency/snapshot_isolation/examples/deprecated/anomalie`", "source": "[aneris/examples/transactional_consistency/snapshot_isolation/examples/deprecated/anomalie](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/snapshot_isolation/examples/deprecated/anomalie)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/snapshot_isolation/examples/deprecated/anomalie", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "Aneris deprecated SI client: classical example run", "specifies": "classical example run transaction client", "safety": "example postcondition or anomaly witness; exact contract in linked source", "liveness": "not found in this row", "tool": "implementation/specification present; no active lemma/theorem found in counted files; source inspection only", "size": "1,154 LOC in 4 `.v` file(s), scope `aneris/examples/transactional_consistency/snapshot_isolation/examples/deprecated/classical_example_run`", "source": "[aneris/examples/transactional_consistency/snapshot_isolation/examples/deprecated/classical_example_run](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/snapshot_isolation/examples/deprecated/classical_example_run)", "source_words": "“Definition transaction1 : val :=”; [classical_example_run_code.v](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/snapshot_isolation/examples/deprecated/classical_example_run/classical_example_run_code.v)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/snapshot_isolation/examples/deprecated/classical_example_run", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "Aneris deprecated SI client: disjoint reads", "specifies": "disjoint reads transaction client", "safety": "example postcondition or anomaly witness; exact contract in linked source", "liveness": "not found in this row", "tool": "implementation/specification present; no active lemma/theorem found in counted files; source inspection only", "size": "406 LOC in 2 `.v` file(s), scope `aneris/examples/transactional_consistency/snapshot_isolation/examples/deprecated/disjoint_reads`", "source": "[aneris/examples/transactional_consistency/snapshot_isolation/examples/deprecated/disjoint_reads](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/snapshot_isolation/examples/deprecated/disjoint_reads)", "source_words": "“Definition transaction1 : val :=”; [disjoint_reads_code.v](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/snapshot_isolation/examples/deprecated/disjoint_reads/disjoint_reads_code.v)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/snapshot_isolation/examples/deprecated/disjoint_reads", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "Aneris deprecated SI client: read your writes", "specifies": "read your writes transaction client", "safety": "example postcondition or anomaly witness; exact contract in linked source", "liveness": "not found in this row", "tool": "implementation/specification present; no active lemma/theorem found in counted files; source inspection only", "size": "226 LOC in 2 `.v` file(s), scope `aneris/examples/transactional_consistency/snapshot_isolation/examples/deprecated/read_your_writes`", "source": "[aneris/examples/transactional_consistency/snapshot_isolation/examples/deprecated/read_your_writes](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/snapshot_isolation/examples/deprecated/read_your_writes)", "source_words": "“Definition transaction : val :=”; [read_your_writes_code.v](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/snapshot_isolation/examples/deprecated/read_your_writes/read_your_writes_code.v)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/snapshot_isolation/examples/deprecated/read_your_writes", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "Aneris transactional_consistency case: disjoint writes", "specifies": "disjoint writes protocol/library/client case", "safety": "example/API contracts; exact theorem in linked source", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "332 LOC in 2 `.v` file(s), scope `aneris/examples/transactional_consistency/snapshot_isolation/examples/disjoint_writes`", "source": "[aneris/examples/transactional_consistency/snapshot_isolation/examples/disjoint_writes](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/snapshot_isolation/examples/disjoint_writes)", "source_words": "“Theorem runner_safe : aneris_adequate example_runner \"system\" init_state (λ _, True).”; [disjoint_writes_proof.v, line 285](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/snapshot_isolation/examples/disjoint_writes/disjoint_writes_proof.v#L285)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/snapshot_isolation/examples/disjoint_writes", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "Aneris transactional_consistency case: function call", "specifies": "function call protocol/library/client case", "safety": "example/API contracts; exact theorem in linked source", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "394 LOC in 2 `.v` file(s), scope `aneris/examples/transactional_consistency/snapshot_isolation/examples/function_call`", "source": "[aneris/examples/transactional_consistency/snapshot_isolation/examples/function_call](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/snapshot_isolation/examples/function_call)", "source_words": "“Theorem runner_safe : aneris_adequate runner \"system\" init_state (λ _, True).”; [function_call_proof.v, line 346](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/snapshot_isolation/examples/function_call/function_call_proof.v#L346)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/snapshot_isolation/examples/function_call", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "Aneris transactional_consistency case: no serializability", "specifies": "no serializability protocol/library/client case", "safety": "example/API contracts; exact theorem in linked source", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "896 LOC in 2 `.v` file(s), scope `aneris/examples/transactional_consistency/snapshot_isolation/examples/no_serializability`", "source": "[aneris/examples/transactional_consistency/snapshot_isolation/examples/no_serializability](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/snapshot_isolation/examples/no_serializability)", "source_words": "“Theorem runner_safe : aneris_adequate example_runner \"system\" init_state (λ _, True).”; [no_serializability_proof.v, line 811](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/snapshot_isolation/examples/no_serializability/no_serializability_proof.v#L811)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/snapshot_isolation/examples/no_serializability", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "Aneris transactional_consistency case: non repeatable read", "specifies": "non repeatable read protocol/library/client case", "safety": "example/API contracts; exact theorem in linked source", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "364 LOC in 2 `.v` file(s), scope `aneris/examples/transactional_consistency/snapshot_isolation/examples/non_repeatable_read`", "source": "[aneris/examples/transactional_consistency/snapshot_isolation/examples/non_repeatable_read](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/snapshot_isolation/examples/non_repeatable_read)", "source_words": "“Theorem runner_safe : aneris_adequate example_runner \"system\" init_state (λ _, True).”; [non_repeatable_read_proof.v, line 315](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/snapshot_isolation/examples/non_repeatable_read/non_repeatable_read_proof.v#L315)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/snapshot_isolation/examples/non_repeatable_read", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "Aneris transactional_consistency case: only reads", "specifies": "only reads protocol/library/client case", "safety": "example/API contracts; exact theorem in linked source", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "298 LOC in 2 `.v` file(s), scope `aneris/examples/transactional_consistency/snapshot_isolation/examples/only_reads`", "source": "[aneris/examples/transactional_consistency/snapshot_isolation/examples/only_reads](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/snapshot_isolation/examples/only_reads)", "source_words": "“Theorem runner_safe : aneris_adequate example_runner \"system\" init_state (λ _, True).”; [only_reads_proof.v, line 252](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/snapshot_isolation/examples/only_reads/only_reads_proof.v#L252)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/snapshot_isolation/examples/only_reads", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "Aneris transactional_consistency case: read skew", "specifies": "read skew protocol/library/client case", "safety": "example/API contracts; exact theorem in linked source", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "383 LOC in 2 `.v` file(s), scope `aneris/examples/transactional_consistency/snapshot_isolation/examples/read_skew`", "source": "[aneris/examples/transactional_consistency/snapshot_isolation/examples/read_skew](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/snapshot_isolation/examples/read_skew)", "source_words": "“Theorem runner_safe : aneris_adequate example_runner \"system\" init_state (λ _, True).”; [read_skew_proof.v, line 332](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/snapshot_isolation/examples/read_skew/read_skew_proof.v#L332)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/snapshot_isolation/examples/read_skew", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "Aneris transactional_consistency case: sequential writes", "specifies": "sequential writes protocol/library/client case", "safety": "example/API contracts; exact theorem in linked source", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "339 LOC in 2 `.v` file(s), scope `aneris/examples/transactional_consistency/snapshot_isolation/examples/sequential_writes`", "source": "[aneris/examples/transactional_consistency/snapshot_isolation/examples/sequential_writes](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/snapshot_isolation/examples/sequential_writes)", "source_words": "“Theorem runner_safe : aneris_adequate example_runner \"system\" init_state (λ _, True).”; [sequential_writes_proof.v, line 291](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/snapshot_isolation/examples/sequential_writes/sequential_writes_proof.v#L291)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/snapshot_isolation/examples/sequential_writes", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "Aneris transactional_consistency case: write skew", "specifies": "write skew protocol/library/client case", "safety": "example/API contracts; exact theorem in linked source", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "374 LOC in 2 `.v` file(s), scope `aneris/examples/transactional_consistency/snapshot_isolation/examples/write_skew`", "source": "[aneris/examples/transactional_consistency/snapshot_isolation/examples/write_skew](https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/snapshot_isolation/examples/write_skew)", "source_words": "“Theorem runner_safe : aneris_adequate example_runner \"system\" init_state (λ _, True).”; [write_skew_proof.v, line 324](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/snapshot_isolation/examples/write_skew/write_skew_proof.v#L324)", "source_url": "https://github.com/logsem/aneris/tree/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/transactional_consistency/snapshot_isolation/examples/write_skew", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "causal DB session guarantee: read-your-writes", "specifies": "read-your-writes session guarantee client", "safety": "a session reads its preceding write", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "120 LOC in 1 `.v` file(s), scope `aneris/examples/ccddb/examples/session_guarantees/ryw.v`", "source": "[aneris/examples/ccddb/examples/session_guarantees/ryw.v](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/ccddb/examples/session_guarantees/ryw.v)", "source_words": "“Theorem ryw_example_spec (A : gset socket_address) (ca sa : socket_address) (db_id : rep_id) : {{{ sa ⤇ (db_si db_id) ∗ unallocated {[ca]} ∗ free_ports (ip_of_address ca) {[ port_of_address ca ]} ∗ ca ⤳ (∅, ∅) }}} ryw_example #ca #sa @[ip_of_address ca] {{{ vo, RET vo; ∃ s e e' v, ⌜vo = SOMEV v⌝ ∗ ⌜AE_val e = v⌝ ∗ ⌜AE_key e = key⌝ ∗ ⌜AE_val e' = dbv⌝ ∗ ⌜AE_key e' = key⌝ ∗ Seen db_id s ∗ ⌜e ∈ s⌝ ∗ ⌜e' ∈ s⌝ ∗ ⌜¬ (e <ₜ e')⌝ }}}.”; [ryw.v, line 38](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/ccddb/examples/session_guarantees/ryw.v#L38)", "source_url": "https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/ccddb/examples/session_guarantees/ryw.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "causal DB session guarantee: monotonic reads", "specifies": "monotonic reads session guarantee client", "safety": "later session reads do not move backward in observed history", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "155 LOC in 1 `.v` file(s), scope `aneris/examples/ccddb/examples/session_guarantees/mr.v`", "source": "[aneris/examples/ccddb/examples/session_guarantees/mr.v](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/ccddb/examples/session_guarantees/mr.v)", "source_words": "“Theorem mr_example_spec (A : gset socket_address) (ca sa : socket_address) (db_id : rep_id) : {{{ sa ⤇ (db_si db_id) ∗ unallocated {[ca]} ∗ free_ports (ip_of_address ca) {[ port_of_address ca ]} ∗ ca ⤳ (∅, ∅) }}} mr_example #ca #sa @[ip_of_address ca] {{{ p, RET p; ∃ vo1 vo2, (⌜p = (vo1, vo2)%V⌝) ∗ ( (∃ s, (⌜vo1 = NONEV⌝) ∗ (⌜vo2 = NONEV⌝) ∗ Seen db_id s ∗ (⌜restrict_key key s = ∅⌝)) ∨ ( ∃ s v2 e, (⌜vo1 = NONEV⌝) ∗ (⌜vo2 = SOMEV v2⌝) ∗ Seen db_id s ∗ (⌜AE_key e = key⌝) ∗ (⌜AE_val e = v2⌝) ∗ (⌜e ∈ Maximals (restrict_key key s)⌝) ) ∨ ( ∃ s v1 v2 e1 e2, (⌜vo1 = SOMEV v1⌝) ∗ (⌜vo2 = SOMEV v2⌝) ∗ Seen db_id s ∗ (⌜AE_key e1 = key⌝) ∗ (⌜AE_val e1 = v1⌝) ∗ (⌜AE_key e2 = key⌝) ∗ (⌜AE_val e2 = v2⌝) ∗ (⌜e2 ∈ Maximals (restrict_key key s)⌝) ∗ (⌜¬ (e2 <ₜ e1)⌝) ) ) }}}.”; [mr.v, line 37](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/ccddb/examples/session_guarantees/mr.v#L37)", "source_url": "https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/ccddb/examples/session_guarantees/mr.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "causal DB session guarantee: monotonic writes", "specifies": "monotonic writes session guarantee client", "safety": "session writes preserve their order", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "189 LOC in 1 `.v` file(s), scope `aneris/examples/ccddb/examples/session_guarantees/mw.v`", "source": "[aneris/examples/ccddb/examples/session_guarantees/mw.v](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/ccddb/examples/session_guarantees/mw.v)", "source_words": "“Theorem mw_example_spec (A : gset socket_address) (ca sa1 : socket_address) (db_id1 : rep_id) : {{{ sa1 ⤇ (db_si db_id1) ∗ unallocated {[ca]} ∗ free_ports (ip_of_address ca) {[ port_of_address ca ]} ∗ ca ⤳ (∅, ∅) }}} mw_example #ca #sa1 @[ip_of_address ca] {{{ RET #(); ∃ s1 e1 e2, (⌜AE_val e1 = dbv1⌝) ∗ (⌜AE_key e1 = key1⌝) ∗ (⌜AE_val e2 = dbv2⌝) ∗ (⌜AE_key e2 = key2⌝) ∗ Seen db_id1 s1 ∗ ⌜e1 ∈ s1⌝ ∗ ⌜e2 ∈ s1⌝ ∗ (⌜e1 <ₜ e2⌝) ∗ (∀ e s2 db_id2, (Seen db_id2 s2 ∗ ⌜e ∈ s2⌝ ∗ ⌜e2 ≤ₜ e⌝) ={⊤}=∗ ∃ e1' e2', (⌜erasure e1' = erasure e1⌝) ∗ (⌜erasure e2' = erasure e2⌝) ∗ ⌜e1' ∈ s2⌝ ∗ ⌜e2' ∈ s2⌝ ∗ ⌜e1' <ₜ e2'⌝) }}}.”; [mw.v, line 41](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/ccddb/examples/session_guarantees/mw.v#L41)", "source_url": "https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/ccddb/examples/session_guarantees/mw.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "causal DB session guarantee: writes-follow-reads", "specifies": "writes-follow-reads session guarantee client", "safety": "writes depend on session preceding reads", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "211 LOC in 1 `.v` file(s), scope `aneris/examples/ccddb/examples/session_guarantees/wfr.v`", "source": "[aneris/examples/ccddb/examples/session_guarantees/wfr.v](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/ccddb/examples/session_guarantees/wfr.v)", "source_words": "“Theorem wfr_example_spec (ca sa1 : socket_address) (db_id1 : rep_id) : {{{ sa1 ⤇ (db_si db_id1) ∗ unallocated {[ca]} ∗ free_ports (ip_of_address ca) {[ port_of_address ca ]} ∗ ca ⤳ (∅, ∅) }}} wfr_example #ca #sa1 @[ip_of_address ca] {{{ vo, RET vo; ∃ e2 s1, (Seen db_id1 s1) ∗ (⌜AE_key e2 = key2⌝) ∗ (⌜AE_val e2 = dbv2⌝) ∗ (⌜e2 ∈ s1⌝) ∗ ( (⌜vo = NONEV⌝) ∨ (∃ e1 v, (⌜vo = SOMEV v⌝) ∗ (⌜e1 ∈ s1⌝) ∗ (⌜AE_key e1 = key1⌝) ∗ (⌜AE_val e1 = v⌝) ∗ (⌜e1 <ₜ e2⌝) ∗ (∀ e s2 db_id2, ((Seen db_id2 s2) ∗ (⌜e ∈ s2⌝) ∗ (⌜e2 ≤ₜ e⌝)) ={⊤}=∗ ∃ e1' e2', (⌜erasure e1' = erasure e1⌝) ∗ (⌜erasure e2' = erasure e2⌝) ∗ ⌜e1' ∈ s2⌝ ∗ ⌜e2' ∈ s2⌝ ∗ ⌜e1' <ₜ e2'⌝) ) ) }}}.”; [wfr.v, line 39](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/ccddb/examples/session_guarantees/wfr.v#L39)", "source_url": "https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/ccddb/examples/session_guarantees/wfr.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Aneris and Trillium", "name": "causal DB transitive message passing", "specifies": "transitive message passing through causal-memory keys", "safety": "client assertion supported by transitive causal order", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "330 LOC in 1 `.v` file(s), scope `aneris/examples/ccddb/examples/message_passing/message_passing_transitive.v`", "source": "[aneris/examples/ccddb/examples/message_passing/message_passing_transitive.v](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/ccddb/examples/message_passing/message_passing_transitive.v)", "source_words": "“Theorem z2_spec γ1 γ2 s rd : GlobalInv -∗ read_spec rd 2 z2 -∗ {{{ Seen 2 s ∗ inv Ny (inv_y γ1) ∗ inv Nx (inv_x γ1 γ2) }}} z2_prog rd @[ip_of_address z2] {{{ RET (InjRV #37); True }}}.”; [message_passing_transitive.v, line 273](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/ccddb/examples/message_passing/message_passing_transitive.v#L273)", "source_url": "https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/aneris/examples/ccddb/examples/message_passing/message_passing_transitive.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Velisarios", "name": "PBFT", "specifies": "Practical Byzantine Fault Tolerance replica protocol", "safety": "agreement of correct replicas, validity and ordering, under formal fault/authentication assumptions", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "58,013 LOC in 124 `.v` file(s), scope `PBFT`", "source": "[PBFT](https://github.com/vrahli/Velisarios/tree/6fb353b18610cd79210755fcc90123536c367aaa/PBFT)", "source_words": "“Lemma wf_view_change_state_no_repeats_before_events : forall (eo : EventOrdering) (e : Event) i st, state_sm_before_event (PBFTreplicaSM i) e = Some st -> wf_view_change_state_no_repeats i (view_change_state st).”; [PBFTwf_view_change_state_no_repeats.v, line 459](https://github.com/vrahli/Velisarios/blob/6fb353b18610cd79210755fcc90123536c367aaa/PBFT/PBFTwf_view_change_state_no_repeats.v#L459)", "source_url": "https://github.com/vrahli/Velisarios/tree/6fb353b18610cd79210755fcc90123536c367aaa/PBFT", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Velisarios", "name": "two-thirds consensus", "specifies": "two-thirds voting consensus", "safety": "agreement and validity", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "3,697 LOC in 1 `.v` file(s), scope `TwoThirds/TwoThirds.v`", "source": "[TwoThirds/TwoThirds.v](https://github.com/vrahli/Velisarios/blob/6fb353b18610cd79210755fcc90123536c367aaa/TwoThirds/TwoThirds.v)", "source_words": "“Lemma TTCagreement : forall (eo : EventOrdering), authenticated_messages_were_sent_or_byz_usys eo TTCsys -> TTCall_not_byz eo -> TTChold_keys eo -> forall (e1 e2 : Event) (sn : SlotNum) (cmd1 cmd2 : Cmd) (c1 c2 : list name) (dl1 dl2 : nat), In (MkDMsg (TTCnotify (prop sn cmd1)) c1 dl1) (output_system_on_event_ldata TTCsys e1) -> In (MkDMsg (TTCnotify (prop sn cmd2)) c2 dl2) (output_system_on_event_ldata TTCsys e2) -> cmd1 = cmd2.”; [TwoThirds.v, line 3667](https://github.com/vrahli/Velisarios/blob/6fb353b18610cd79210755fcc90123536c367aaa/TwoThirds/TwoThirds.v#L3667)", "source_url": "https://github.com/vrahli/Velisarios/blob/6fb353b18610cd79210755fcc90123536c367aaa/TwoThirds/TwoThirds.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Velisarios", "name": "two-thirds consensus variant 2", "specifies": "second implementation/model of two-thirds voting", "safety": "agreement and validity", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "3,761 LOC in 1 `.v` file(s), scope `TwoThirds/TwoThirds2.v`", "source": "[TwoThirds/TwoThirds2.v](https://github.com/vrahli/Velisarios/blob/6fb353b18610cd79210755fcc90123536c367aaa/TwoThirds/TwoThirds2.v)", "source_words": "“Lemma TTCagreement : forall (eo : EventOrdering), sent_byz_usys eo TTCsys -> TTCall_not_byz eo -> TTChold_keys eo -> forall (e1 e2 : Event) (sn : SlotNum) (cmd1 cmd2 : Cmd) (c1 c2 : name), In (MkDMsg c1 (TTCnotify (prop sn cmd1))) (output_system_on_event_ldata TTCsys eo e1) -> In (MkDMsg c2 (TTCnotify (prop sn cmd2))) (output_system_on_event_ldata TTCsys eo e2) -> cmd1 = cmd2.”; [TwoThirds2.v, line 3732](https://github.com/vrahli/Velisarios/blob/6fb353b18610cd79210755fcc90123536c367aaa/TwoThirds/TwoThirds2.v#L3732)", "source_url": "https://github.com/vrahli/Velisarios/blob/6fb353b18610cd79210755fcc90123536c367aaa/TwoThirds/TwoThirds2.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Velisarios", "name": "primary-backup", "specifies": "primary-backup protocol", "safety": "validity", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "423 LOC in 1 `.v` file(s), scope `PrimaryBackup/PrimaryBackup.v`", "source": "[PrimaryBackup/PrimaryBackup.v](https://github.com/vrahli/Velisarios/blob/6fb353b18610cd79210755fcc90123536c367aaa/PrimaryBackup/PrimaryBackup.v)", "source_words": "“Lemma PBvalidity : forall (eo : EventOrdering), authenticated_messages_were_sent_or_byz_usys eo PBusys -> PBhold_keys eo -> PBall_correct eo -> forall (e : Event) (n : nat) (dst : list name) (d : nat), In (MkDMsg (PBreply n) dst d) (output_system_on_event_ldata PBusys e) -> exists e', e' ≺ e /\\ event_triggered_by_message e' (PBinput n).”; [PrimaryBackup.v, line 346](https://github.com/vrahli/Velisarios/blob/6fb353b18610cd79210755fcc90123536c367aaa/PrimaryBackup/PrimaryBackup.v#L346)", "source_url": "https://github.com/vrahli/Velisarios/blob/6fb353b18610cd79210755fcc90123536c367aaa/PrimaryBackup/PrimaryBackup.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Toychain", "name": "Toychain", "specifies": "minimal blockchain consensus protocol", "safety": "clique global/local block-tree invariant preserved by steps", "liveness": "conditional eventual consensus when pending blocks are exhausted; this theorem does not itself prove fair delivery", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "1,890 LOC in 6 `.v` file(s), scope `Systems` plus named companion files", "source": "[Systems](https://github.com/certichain/toychain/tree/76737e3b1abf7dd85f0dfc32c08920151bce016d/Systems)", "source_words": "“Lemma clique_eventual_consensus w : clique_inv w -> (forall n, blocksFor n w == [::]) -> exists bc, largest_chain w bc /\\ forall n, holds n w (fun st => (has_chain bc st)).”; [InvCliqueTopology.v, line 57](https://github.com/certichain/toychain/blob/76737e3b1abf7dd85f0dfc32c08920151bce016d/Properties/InvCliqueTopology.v#L57) | “clique_inv w -> (forall n, blocksFor n w == [::]) ->” followed by “exists bc, largest_chain w bc”; [complete theorem](https://github.com/certichain/toychain/blob/76737e3b1abf7dd85f0dfc32c08920151bce016d/Properties/InvCliqueTopology.v#L57)", "source_url": "https://github.com/certichain/toychain/tree/76737e3b1abf7dd85f0dfc32c08920151bce016d/Systems", "has_liveness": true}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "Grove primary-backup replicated key-value store", "specifies": "replicated state machine with epoch configuration, reconfiguration, leases, crash recovery and KV clients", "safety": "replicated-state/API correctness and crash-safe recovery contracts", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "21,038 LOC in 36 `.v` file(s), scope `src/program_proof/simplepb`", "source": "[src/program_proof/simplepb](https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/simplepb)", "source_words": "“Lemma wp_MakePbServer smMem own_InMemoryStateMachine fname γ data γsrv confHosts confHosts_sl me : let P := (own_Server_ghost_f γ γsrv) in {{{ \"#Hinvs\" ∷ is_pb_host me γ γsrv ∗ \"#HisConfHost\" ∷ config_protocol_proof.is_pb_config_hosts confHosts γ ∗ \"#Hconf_sl\" ∷ readonly (own_slice_small confHosts_sl uint64T 1 confHosts) ∗ \"Hfile_ctx\" ∷ crash_borrow (fname f↦ data ∗ file_crash P data) (|C={⊤}=> ∃ data', fname f↦ data' ∗ ▷ file_crash P data') ∗ \"#HisMemSm\" ∷ is_InMemoryStateMachine (sm_record:=pb_record) smMem own_InMemoryStateMachine ∗ \"Hmemstate\" ∷ own_InMemoryStateMachine [] }}} MakePbServer #smMem #(LitString fname) (slice_val confHosts_sl) {{{ s, RET #s; pb_definitions.is_Server s γ γsrv }}} .”; [proof.v, line 1760](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/simplepb/simplelog/proof.v#L1760)", "source_url": "https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/simplepb", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "primary-backup replica draft", "specifies": "append and become-primary RPCs with replication ghost state", "safety": "append/epoch protocol invariants; inspect admission status below", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts with 26 active admission tokens in counted files; incomplete artifact; source inspection only", "size": "1,402 LOC in 10 `.v` file(s), scope `src/program_proof/pb`", "source": "[src/program_proof/pb](https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/pb)", "source_words": "“Lemma primary_commit m γ r (p:PrimaryExtra) : m ∈ p.(matchIdx) → (∀ n, n ∈ p.(matchIdx) → int.Z m ≤ int.Z n) → int.Z m ≤ length r.(opLog) → pb_inv γ -∗ proposal_lb_fancy γ r.(cn) r.(opLog) -∗ own_Primary_ghost γ r p ={⊤}=∗ own_Primary_ghost γ r p ∗ own_Committer_ghost γ r (mkCommitterExtra m).”; [replica_ghost_proof.v, line 234](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/pb/replica_ghost_proof.v#L234)", "source_url": "https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/pb", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "Multi-Paxos", "specifies": "Paxos-backed epoch/leader service and follower replication", "safety": "protocol invariants, epoch acquisition and weak-read contracts", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "5,404 LOC in 12 `.v` file(s), scope `src/program_proof/mpaxos`", "source": "[src/program_proof/mpaxos](https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/mpaxos)", "source_words": "“Lemma wp_Server__withLock (s:loc) γ γsrv (f:val) Φ : is_Server s γ γsrv -∗ (∀ ps pst, (\"Hvol\" ∷ paxosState.own_vol ps pst ∗ \"#HP\" ∷ □ Pwf pst.(paxosState.state)) -∗ WP f #ps {{ λ _, ∃ pst', paxosState.own_vol ps pst' ∗ (□ Pwf pst'.(paxosState.state)) ∗ (own_paxosState_ghost γ γsrv pst ={⊤∖↑fileN}=∗ own_paxosState_ghost γ γsrv pst' ∗ Φ #()) }}) -∗ WP Server__withLock #s f {{ Φ }} .”; [withlock_proof.v, line 32](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/mpaxos/withlock_proof.v#L32)", "source_url": "https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/mpaxos", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "Paxos RSM draft", "specifies": "Paxos propose/accept/learn API", "safety": "protocol invariants; some ghost-state lemmas admitted", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts with 24 active admission tokens in counted files; incomplete artifact; source inspection only", "size": "2,552 LOC in 5 `.v` file(s), scope `src/program_proof/rsm`", "source": "[src/program_proof/rsm](https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/rsm)", "source_words": "“Theorem wp_Paxos__Propose (px : loc) (v : string) nid sc γ : is_paxos px nid sc γ -∗ {{{ True }}} Paxos__Propose #px #(LitString v) {{{ (ok : bool), RET #ok; if ok then is_proposed_decree γ v else True }}}.”; [spaxos_propose.v, line 1293](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/rsm/spaxos_propose.v#L1293)", "source_url": "https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/rsm", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "single-decree Paxos draft", "specifies": "prepare/propose/election implementation", "safety": "agreement-related state definitions and partial proof; active admissions", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts with 26 active admission tokens in counted files; incomplete artifact; source inspection only", "size": "1,182 LOC in 4 `.v` file(s), scope `src/program_proof/single`", "source": "[src/program_proof/single](https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/single)", "source_words": "“Lemma wp_TryDecide s pid γ (v:u64) (dummy_v:u64) (outv_ptr:loc) : is_Replica s pid γ (f:=f) -∗ {{{ outv_ptr ↦[uint64T] #dummy_v }}} Replica__TryDecide #s #v #outv_ptr {{{ (b:bool), RET #b; ⌜b = true⌝ ∗ outv_ptr ↦[uint64T] #dummy_v ∨ ∃ (outv:u64), outv_ptr ↦[uint64T] #outv ∗ cmd_is f γ outv }}}.”; [try_decide_proof.v, line 93](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/single/try_decide_proof.v#L93)", "source_url": "https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/single", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "replication reconfiguration draft", "specifies": "ghost model of changing replication configurations", "safety": "commit/leader invariants; active admissions", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts with 5 active admission tokens in counted files; incomplete artifact; source inspection only", "size": "449 LOC in 1 `.v` file(s), scope `src/program_proof/reconf`", "source": "[src/program_proof/reconf](https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/reconf)", "source_words": "“Lemma become_leader γ term highestVal highestTerm W: int.nat highestTerm < int.nat term → (get_config highestVal).(is_quorum) W → sys_inv γ -∗ proposed_lb γ highestTerm highestVal -∗ old_term_max γ highestTerm highestVal -∗ old_conf_max γ highestVal -∗ □( [∗ set] srv ∈ W, (∃ srvVal, ⌜mval_le srvVal highestVal⌝ ∗ accepted_ro γ srv highestTerm srvVal) ∗ (∀ term', ⌜int.nat highestTerm < int.nat term'⌝ → ⌜int.nat term' < int.nat term⌝ → accepted_ro_none γ srv term') ) -∗ old_term_max γ term highestVal.”; [ghost_proof.v, line 312](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/reconf/ghost_proof.v#L312)", "source_url": "https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/reconf", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "sharded in-memory key-value store", "specifies": "shards, coordinator, moves, installation, KV operations and clients", "safety": "shard ownership and KV/API contracts", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "7,584 LOC in 31 `.v` file(s), scope `src/program_proof/memkv`", "source": "[src/program_proof/memkv](https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/memkv)", "source_words": "“Lemma wp_KVShardServer__Start (s:loc) (host : u64) γ : is_urpc_dom γ.(urpc_gn) {[ U64 0; U64 1; U64 2; U64 3; U64 4; U64 5 ]} -∗ is_shard_server host γ -∗ is_KVShardServer s γ -∗ {{{ True }}} KVShardServer__Start #s #host {{{ RET #(); True }}}.”; [memkv_shard_start_proof.v, line 10](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/memkv/memkv_shard_start_proof.v#L10)", "source_url": "https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/memkv", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "distributed lock service", "specifies": "RPC locking service plus durable RPC/KV helpers", "safety": "lock/RPC/API contracts and durable state invariants", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts with 54 active admission tokens in counted files; incomplete artifact; source inspection only", "size": "9,099 LOC in 22 `.v` file(s), scope `src/program_proof/lockservice`", "source": "[src/program_proof/lockservice](https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/lockservice)", "source_words": "“Lemma wp_TransactionCoordinator__doTransfer {Eo Ei} (tc:loc) (tid acc1 acc2 amount v1 v2:u64) : Eo ⊆ ⊤ ∖ ↑txnSingleN → {{{ TransactionCoordinator_own tc ∗ fresh_tid γ1.(ps_tpc) tid ∗ fresh_tid γ2.(ps_tpc) tid ∗ |={Eo,Ei}=> (acc1 [[γ1.(ps_kvs)]]↦{1/4} v1 ∗ acc2 [[γ2.(ps_kvs)]]↦{1/4} v2) ∗ ((acc1 [[γ1.(ps_kvs)]]↦{1/4} (word.add v1 amount) ∗ acc2 [[γ2.(ps_kvs)]]↦{1/4} (word.sub v2 amount)) ={Ei,Eo}=∗ emp) }}} TransactionCoordinator__doTransfer #tc #tid #acc1 #acc2 #amount {{{ RET #(); True }}}.”; [two_pc_example.v, line 1137](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/lockservice/two_pc_example.v#L1137)", "source_url": "https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/lockservice", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "lock client", "specifies": "key-value-backed lock service", "safety": "lock acquisition/release ownership contracts", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "151 LOC in 1 `.v` file(s), scope `src/program_proof/lock`", "source": "[src/program_proof/lock](https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/lock)", "source_words": "“Lemma wp_LockClerk__Unlock ck key γ R : {{{ is_LockClerk ck γ ∗ is_lock N γ key R ∗ R }}} LockClerk__Unlock #ck #(str key) {{{ RET #(); True }}} .”; [lock_proof.v, line 117](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/lock/lock_proof.v#L117)", "source_url": "https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/lock", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "bank", "specifies": "distributed bank clients on KV service", "safety": "transfer and audit contracts", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "901 LOC in 1 `.v` file(s), scope `src/program_proof/bank`", "source": "[src/program_proof/bank](https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/bank)", "source_words": "“Lemma wp_MakeBankClerk (lck kck : loc) γlk kvptsto (acc0 acc1 : string ) E : {{{ is_LockClerk lockN lck γlk ∗ is_Kv kck kvptsto E ∗ is_bank init_flag γlk kvptsto {[ acc0; acc1 ]}∗ ⌜ acc0 ≠ acc1 ⌝ }}} MakeBankClerk #lck #kck #(str init_flag) #(str acc0) #(str acc1) {{{ (ck:loc), RET #ck; own_bank_clerk ck {[acc0; acc1]} }}} .”; [bank_proof.v, line 866](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/bank/bank_proof.v#L866)", "source_url": "https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/bank", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "fencing", "specifies": "epoch-fenced counter frontend and configuration service", "safety": "epoch/counter/API contracts", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "3,427 LOC in 6 `.v` file(s), scope `src/program_proof/fencing`", "source": "[src/program_proof/fencing](https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/fencing)", "source_words": "“Lemma ghost_map_points_to_update {γ k v} w : k ⤳[γ] v ==∗ k ⤳[γ] w.”; [map.v, line 146](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/fencing/map.v#L146)", "source_url": "https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/fencing", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "minimum lease", "specifies": "lease-bearing server and client", "safety": "time/lease-aware read and server contracts", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "483 LOC in 1 `.v` file(s), scope `src/program_proof/minlease`", "source": "[src/program_proof/minlease](https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/minlease)", "source_words": "“Lemma wp_main : {{{ True }}} main #() {{{ RET #(); True }}} .”; [proof.v, line 454](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/minlease/proof.v#L454)", "source_url": "https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/minlease", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "lease KV", "specifies": "lease cache around key-value operations", "safety": "get/cache/put contracts", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "640 LOC in 1 `.v` file(s), scope `src/program_proof/leasekv`", "source": "[src/program_proof/leasekv](https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/leasekv)", "source_words": "“Lemma wp_LeaseKv__Put (k:loc) key value γ : ⊢ {{{ is_LeaseKv k γ }}} <<< ∀∀ old_value, key ↪[γ] {#1/2} old_value >>> LeaseKv__Put #k #(str key) #(str value) @ (↑leasekvN ∪ E) <<< key ↪[γ] {#1/2} value >>> {{{ RET #(); True }}}.”; [proof.v, line 483](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/leasekv/proof.v#L483)", "source_url": "https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/leasekv", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "reconnecting RPC client", "specifies": "RPC client retry/reconnection wrapper", "safety": "Call2 API contract", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "262 LOC in 1 `.v` file(s), scope `src/program_proof/reconnectclient`", "source": "[src/program_proof/reconnectclient](https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/reconnectclient)", "source_words": "“Lemma wp_MakeReconnectingClient (srv:u64): {{{ True }}} MakeReconnectingClient #srv {{{ (cl_ptr:loc), RET #cl_ptr; is_ReconnectingClient cl_ptr srv }}}.”; [proof.v, line 228](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/reconnectclient/proof.v#L228)", "source_url": "https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/reconnectclient", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "vMVCC", "specifies": "concurrent multi-version transaction library", "safety": "transaction read/write/commit and garbage-collection contracts", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts with 4 active admission tokens in counted files; incomplete artifact; source inspection only", "size": "11,680 LOC in 52 `.v` file(s), scope `src/program_proof/mvcc`", "source": "[src/program_proof/mvcc](https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/mvcc)", "source_words": "“Theorem wp_wrbuf__UpdateTuples wrbuf (tid : u64) sid mods tpls γ : {{{ own_wrbuf wrbuf mods tpls ∗ own_tuples_updated (int.nat tid) mods tpls γ ∗ active_tid γ tid sid }}} WrBuf__UpdateTuples #wrbuf #tid {{{ RET #(); own_wrbuf_xtpls wrbuf mods ∗ active_tid γ tid sid }}}.”; [wrbuf_update_tuples.v, line 11](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/mvcc/wrbuf_update_tuples.v#L11)", "source_url": "https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/mvcc", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "two-phase local transaction system", "specifies": "journal transaction wrapper and two-phase refinement", "safety": "sequential transaction refinement and crash safety", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "6,816 LOC in 10 `.v` file(s), scope `src/program_proof/txn`", "source": "[src/program_proof/txn](https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/txn)", "source_words": "“Lemma twophase_started_step_puredet l γ γ' dinit objs_dom j K0 K `{Hctx: LanguageCtx' (ext := @spec_ffi_op_field _) (ffi := (spec_ffi_model_field)) (ffi_semantics := (spec_ext_semantics_field)) K} e0 e1 e2: (∀ σ g, prim_step' e1 σ g [] e2 σ g []) → is_twophase_started l γ γ' dinit objs_dom j K0 e0 (K e1) -∗ is_twophase_started l γ γ' dinit objs_dom j K0 e0 (K e2).”; [wrapper_proof.v, line 1680](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/txn/wrapper_proof.v#L1680)", "source_url": "https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/txn", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "TPCC transactions", "specifies": "transactional TPCC workload", "safety": "transaction operation contracts", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts with 10 active admission tokens in counted files; incomplete artifact; source inspection only", "size": "1,872 LOC in 4 `.v` file(s), scope `src/program_proof/tpcc`", "source": "[src/program_proof/tpcc](https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/tpcc)", "source_words": "“Theorem wp_txn__Delete”; [tpcc_prelude.v, line 126](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/tpcc/tpcc_prelude.v#L126)", "source_url": "https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/tpcc", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "append-only file", "specifies": "concurrent append and wait-for-durability service", "safety": "append/durability/close contracts", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "1,499 LOC in 1 `.v` file(s), scope `src/program_proof/aof`", "source": "[src/program_proof/aof](https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/aof)", "source_words": "“Lemma accessP_weak aof_ptr fname γ P Pcrash data : is_aof aof_ptr γ fname P Pcrash -∗ aof_log_own γ data -∗ (|NC={⊤,⊤∖↑aofN}=> ∃ durableData, ⌜prefix durableData data⌝ ∗ ▷ P durableData ∗ (▷ P durableData -∗ |NC={⊤∖↑aofN,⊤}=> aof_log_own γ data) ) .”; [proof.v, line 1452](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/aof/proof.v#L1452)", "source_url": "https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/aof", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "async file", "specifies": "asynchronous durable file implementation", "safety": "write/flush crash-safety contracts", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "756 LOC in 1 `.v` file(s), scope `src/program_proof/asyncfile`", "source": "[src/program_proof/asyncfile](https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/asyncfile)", "source_words": "“Lemma wp_MakeAsyncFile fname N P data : {{{ \"Hfile\" ∷ crash_borrow (P data ∗ fname f↦ data) (∃ d, P d ∗ fname f↦ d) }}} asyncfile.MakeAsyncFile #(str fname) {{{ γ sl f, RET (slice_val sl, #f); readonly (own_slice_small sl byteT 1 data) ∗ own_AsyncFile N f γ P data }}} .”; [proof.v, line 663](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/asyncfile/proof.v#L663)", "source_url": "https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/asyncfile", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "write-ahead log", "specifies": "concurrent write-ahead logging and recovery", "safety": "transaction/log/durability and recovery contracts", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts with 2 active admission tokens in counted files; incomplete artifact; source inspection only", "size": "19,175 LOC in 24 `.v` file(s), scope `src/program_proof/wal`", "source": "[src/program_proof/wal](https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/wal)", "source_words": "“Theorem wp_Walog__MemAppend (PreQ : iProp Σ) (Q: u64 -> iProp Σ) l γ dinit bufs bs : {{{ is_wal P l γ dinit ∗ updates_slice bufs bs ∗ (∀ σ σ' pos, ⌜wal_wf σ⌝ -∗ ⌜relation.denote (log_mem_append bs) σ σ' pos⌝ -∗ let txn_id := length σ.(log_state.txns) in (P σ -∗ |NC={⊤ ∖↑ N}=> ⌜addrs_wf bs σ.(log_state.d)⌝ ∗ P σ' ∗ (txn_pos γ txn_id pos -∗ Q pos))) ∧ PreQ }}} Walog__MemAppend #l (slice_val bufs) {{{ pos (ok : bool), RET (#pos, #ok); if ok then Q pos ∗ ∃ txn_id, txn_pos γ txn_id pos else PreQ }}}.”; [write_proof.v, line 696](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/wal/write_proof.v#L696)", "source_url": "https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/wal", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "journal", "specifies": "transactional journal", "safety": "journal operation and crash invariants", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "2,825 LOC in 5 `.v` file(s), scope `src/program_proof/jrnl`", "source": "[src/program_proof/jrnl](https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/jrnl)", "source_words": "“Theorem wpc_MkLog d γ dinit logm : {{{ is_txn_durable γ dinit logm }}} obj.MkLog (disk_val d) @ ⊤ {{{ γ' (l: loc), RET #l; is_txn l γ.(jrnl_txn_names) dinit ∗ is_txn_system N γ ∗ txn_cfupd_cancel dinit γ' ∗ txn_cinv N γ γ' }}} {{{ ∃ γ' logm', is_txn_durable γ' dinit logm' ∗ (⌜ γ' = γ ⌝ ∨ txn_cinv N γ γ') }}}.”; [sep_jrnl_recovery_proof.v, line 132](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/jrnl/sep_jrnl_recovery_proof.v#L132)", "source_url": "https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/jrnl", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "object transaction store", "specifies": "transactional object/buffer system over WAL", "safety": "load/commit/recovery contracts", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "2,954 LOC in 6 `.v` file(s), scope `src/program_proof/obj`", "source": "[src/program_proof/obj](https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/obj)", "source_words": "“Theorem wpc_MkLog E d dinit (γ:txn_names) : ↑walN ⊆ E → ↑invN ⊆ E → {{{ is_txn_durable γ dinit }}} obj.MkLog (disk_val d) @ ⊤ {{{ γ' (l: loc), RET #l; is_txn l γ dinit ∗ txn_cfupd_cancel E dinit γ' ∗ txn_cfupd_res E γ γ' }}} {{{ ∃ γ' logm', ⌜ txn_kinds γ' = txn_kinds γ ⌝ ∗ is_txn_durable γ' dinit ∗ (⌜ γ' = γ ⌝ ∨ txn_resources γ γ' logm') }}}.”; [recovery_proof.v, line 856](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/obj/recovery_proof.v#L856)", "source_url": "https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/obj", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "durable counter example", "specifies": "distributed counter server and client with durability", "safety": "fetch-and-increment and end-to-end crash-safety theorem", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts with 12 active admission tokens in counted files; incomplete artifact; source inspection only", "size": "803 LOC in 5 `.v` file(s), scope `src/program_proof/ctrexample`", "source": "[src/program_proof/ctrexample](https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/ctrexample)", "source_words": "“Lemma wpc_ServerMain γurpc_gn (γ:gname) : is_CtrServer_urpc γurpc_gn γ -∗ crash_cond γ -∗ WPC main #() @ NotStuck; ⊤ {{ v, True }} {{ crash_cond γ }} .”; [server.v, line 260](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/ctrexample/server.v#L260)", "source_url": "https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/ctrexample", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "simple NFS server", "specifies": "NFS read/write/getattr/setattr and recovery", "safety": "file API and crash-safe recovery contracts", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts with 4 active admission tokens in counted files; incomplete artifact; source inspection only", "size": "3,746 LOC in 13 `.v` file(s), scope `src/program_proof/simple`", "source": "[src/program_proof/simple](https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/simple)", "source_words": "“Theorem wp_NFSPROC3_WRITE γ (nfs : loc) (fh : u64) (fhslice : Slice.t) (offset : u64) (dataslice : Slice.t) (databuf : list u8) (Q : SimpleNFS.res u32 -> iProp Σ) (stab : u32) dinit : {{{ is_fs P γ nfs dinit ∗ is_fh fhslice fh ∗ own_slice dataslice u8T 1%Qp databuf ∗ ⌜ (length databuf < 2^32)%Z ⌝ ∗ ( ∀ σ σ' (r : SimpleNFS.res u32) E, ⌜relation.denote (SimpleNFS.wrapper fh (SimpleNFS.write fh offset databuf)) σ σ' r⌝ -∗ ( P σ -∗ |={E}=> P σ' ∗ Q r ) ) }}} Nfs__NFSPROC3_WRITE #nfs (struct.mk_f nfstypes.WRITE3args [ \"File\" ::= struct.mk_f nfstypes.Nfs_fh3 [ \"Data\" ::= slice_val fhslice ]; \"Offset\" ::= #offset; \"Count\" ::= #(U32 (length databuf)); \"Stable\" ::= #stab; \"Data\" ::= (slice_val dataslice) ])%V {{{ v, RET v; ( ∃ (count : u32) resok, ⌜ getField_f nfstypes.WRITE3res \"Status\" v = #(U32 0) ⌝ ∗ ⌜ getField_f nfstypes.WRITE3res \"Resok\" v = resok ⌝ ∗ ⌜ getField_f nfstypes.WRITE3resok \"Count\" resok = #count ⌝ ∗ Q (SimpleNFS.OK count) ) ∨ ( ∃ (stat : Z), ⌜ getField_f nfstypes.WRITE3res \"Status\" v = #(U32 stat) ⌝ ∗ ⌜ stat ≠ 0 ⌝ ∗ Q SimpleNFS.Err ) }}}.”; [write.v, line 39](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/simple/write.v#L39)", "source_url": "https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/simple", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "key-value store specification", "specifies": "crash-safe KV/multiput interface", "safety": "get and multi-put contracts", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts with 6 active admission tokens in counted files; incomplete artifact; source inspection only", "size": "219 LOC in 1 `.v` file(s), scope `src/program_proof/kvs`", "source": "[src/program_proof/kvs](https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/kvs)", "source_words": "“Theorem wpc_KVS__MultiPut kvsl kvsblks sz γDisk kvp_ls_before kvp_ls_new kvp_slice: {{{ ptsto_kvs kvsl kvsblks sz γDisk ∗ kvpairs_valid_match kvp_ls_before kvsblks γDisk sz ∗ kvpairs_valid_slice kvp_slice kvp_ls_new sz }}} KVS__MultiPut #kvsl (slice_val kvp_slice) {{{ (ok: bool), RET #ok; ptsto_kvs kvsl kvsblks sz γDisk ∗ kvpairs_valid_match kvp_ls_new kvsblks γDisk sz }}}.”; [specs.v, line 177](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/kvs/specs.v#L177)", "source_url": "https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/kvs", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "replicated journal example", "specifies": "journal replication client", "safety": "journal replication contract", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "151 LOC in 1 `.v` file(s), scope `src/program_proof/jrnl_replication`", "source": "[src/program_proof/jrnl_replication](https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/jrnl_replication)", "source_words": "“Theorem wp_RepBlock__Read l Q : txnN ## invariant.walN → txnN ## invN → {{{ \"#Hrb\" ∷ is_rep_block l ∗ \"Hfupd\" ∷ (∀ σ, P σ ={⊤}=∗ P σ ∗ Q σ) }}} RepBlock__Read #l {{{ s σ (ok:bool), RET (slice_val s, #ok); own_slice s u8T 1 σ ∗ Q σ }}}.”; [jrnl_replication_proof.v, line 73](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/jrnl_replication/jrnl_replication_proof.v#L73)", "source_url": "https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/jrnl_replication", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "buffer cache", "specifies": "concurrent crash-safe block-buffer subsystem", "safety": "buffer operation and crash-safety contracts", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "2,039 LOC in 3 `.v` file(s), scope `src/program_proof/buf`", "source": "[src/program_proof/buf](https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/buf)", "source_words": "“Theorem list_to_inode_buf_to_vals l : length l = inode_bytes -> inode_to_vals (list_to_inode_buf l) = b2val <$> l.”; [defs.v, line 61](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/buf/defs.v#L61)", "source_url": "https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/buf", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "Grove tutorial basics", "specifies": "basics service/client exercise", "safety": "service-specific partial-correctness contracts; partial tutorial drafts may contain admissions", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "397 LOC in 2 `.v` file(s), scope `src/program_proof/tutorial/basics`", "source": "[src/program_proof/tutorial/basics](https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/tutorial/basics)", "source_words": "“Lemma wp_Register (t : loc) (k : u64) (v : u64) : {{{ is_tracker t }}} Tracker__Register #t #k #v {{{ (b : bool), RET #b; True }}}.”; [proof.v, line 126](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/tutorial/basics/proof.v#L126)", "source_url": "https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/tutorial/basics", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "Grove tutorial kvservice", "specifies": "kvservice service/client exercise", "safety": "service-specific partial-correctness contracts; partial tutorial drafts may contain admissions", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts with 4 active admission tokens in counted files; incomplete artifact; source inspection only", "size": "4,337 LOC in 4 `.v` file(s), scope `src/program_proof/tutorial/kvservice`", "source": "[src/program_proof/tutorial/kvservice](https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/tutorial/kvservice)", "source_words": "“Lemma spec_bad_not_monotonic : ⊢ (∀ n, Φbad n -∗ Ψbad n) ∧ (spec_bad 37%nat Φbad) ∧ ((spec_bad 37%nat Ψbad) -∗ False) .”; [rpc_functoriality.v, line 22](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/tutorial/kvservice/rpc_functoriality.v#L22)", "source_url": "https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/tutorial/kvservice", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "Grove tutorial lockservice", "specifies": "lockservice service/client exercise", "safety": "service-specific partial-correctness contracts; partial tutorial drafts may contain admissions", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts with 18 active admission tokens in counted files; incomplete artifact; source inspection only", "size": "372 LOC in 1 `.v` file(s), scope `src/program_proof/tutorial/lockservice`", "source": "[src/program_proof/tutorial/lockservice](https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/tutorial/lockservice)", "source_words": "“Lemma wp_Locked__Release (l:loc) : {{{ is_Locked l }}} Locked__Release #l {{{ RET #(); True }}} .”; [proof.v, line 364](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/tutorial/lockservice/proof.v#L364)", "source_url": "https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/tutorial/lockservice", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "Grove tutorial objectstore", "specifies": "objectstore service/client exercise", "safety": "service-specific partial-correctness contracts; partial tutorial drafts may contain admissions", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts with 4 active admission tokens in counted files; incomplete artifact; source inspection only", "size": "239 LOC in 1 `.v` file(s), scope `src/program_proof/tutorial/objectstore`", "source": "[src/program_proof/tutorial/objectstore](https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/tutorial/objectstore)", "source_words": "“Lemma wp_Clerk__FinishWrite γd (ck:loc) args chunkhandles (data newdata : list (list u8)) : {{{ is_Clerk ck γd ∗ is_finished_writeId γd args.(FinishWriteArgs.WriteId) chunkhandles ∗ ([∗ list] index ↦ _ ∈ chunkhandles, is_dir_writeId_index_recorded γd args.(FinishWriteArgs.WriteId) index) ∗ ⌜chunkhandles.*2 = newdata⌝ ∗ object_ptsto γd args.(FinishWriteArgs.Keyname) data }}} Clerk__FinishWrite #ck {{{ RET #(); object_ptsto γd args.(FinishWriteArgs.Keyname) newdata }}} .”; [proof.v, line 222](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/tutorial/objectstore/proof.v#L222)", "source_url": "https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/tutorial/objectstore", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "Grove tutorial queue", "specifies": "queue service/client exercise", "safety": "service-specific partial-correctness contracts; partial tutorial drafts may contain admissions", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "714 LOC in 1 `.v` file(s), scope `src/program_proof/tutorial/queue`", "source": "[src/program_proof/tutorial/queue](https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/tutorial/queue)", "source_words": "“Lemma enqueue_dequeue (q : loc) (gamma : namespace) (lk : val) (P : u64 -> iProp Σ): {{{ is_queue q P }}} Queue__Dequeue #q {{{ (a:u64), RET #a; P a }}}.”; [proof.v, line 588](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/tutorial/queue/proof.v#L588)", "source_url": "https://github.com/mit-pdos/perennial/tree/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/tutorial/queue", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "Perennial example replicated block", "specifies": "replicated block with distributed adequacy", "safety": "operation and crash-recovery contracts", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "591 LOC in 1 `.v` file(s), scope `src/program_proof/examples/replicated_block_proof.v`", "source": "[src/program_proof/examples/replicated_block_proof.v](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/examples/replicated_block_proof.v)", "source_words": "“Theorem OpenRead_dist_adequate σ g addr : int.Z addr ∈ dom (σ.(world) : (@ffi_state disk_model)) → int.Z (word.add addr 1) ∈ dom (σ.(world) : (@ffi_state disk_model)) → dist_adequate (CS := goose_crash_lang) [OpenRead_init_cfg () addr σ; OpenRead_init_cfg () addr σ] g (λ _, True).”; [replicated_block_proof.v, line 566](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/examples/replicated_block_proof.v#L566)", "source_url": "https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/examples/replicated_block_proof.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "Perennial example toy", "specifies": "transfer even disk blocks between threads", "safety": "operation and crash-recovery contracts", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "144 LOC in 1 `.v` file(s), scope `src/program_proof/examples/toy_proof.v`", "source": "[src/program_proof/examples/toy_proof.v](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/examples/toy_proof.v)", "source_words": "“Theorem wpc_TransferEvenBlock (d_ref: loc) (addr: u64) : {{{ EBlk addr }}} TransferEvenBlock #d_ref #addr @ ⊤ {{{ RET #() ; True }}} {{{ EBlk addr }}}.”; [toy_proof.v, line 117](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/examples/toy_proof.v#L117)", "source_url": "https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/examples/toy_proof.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "Perennial example inode", "specifies": "concurrent crash-safe inode", "safety": "operation and crash-recovery contracts", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "988 LOC in 1 `.v` file(s), scope `src/program_proof/examples/inode_proof.v`", "source": "[src/program_proof/examples/inode_proof.v](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/examples/inode_proof.v)", "source_words": "“Theorem wpc_Inode__Append_triple {l P addr} {Palloc γalloc domain} (Q: iProp Σ) (Qc: iProp Σ) (alloc_ref: loc) q (b_s: Slice.t) (b0: Block) : inodeN ## allocN → {{{ \"Hinode\" ∷ is_inode l P addr ∗ \"Hbdata\" ∷ is_block b_s q b0 ∗ \"HQc\" ∷ (Q -∗ Qc) ∗ \"#Halloc\" ∷ is_allocator Palloc Ψ allocN alloc_ref domain γalloc ∗ \"#Halloc_fupd\" ∷ □ reserve_fupd (⊤ ∖ ↑allocN) Palloc ∗ \"#Hfree_fupd\" ∷ □ (∀ a, free_fupd (⊤ ∖ ↑allocN) Palloc a) ∗ \"Hfupd\" ∷ (Qc ∧ (∀ σ σ' addr', ⌜σ' = set inode.blocks (λ bs, bs ++ [b0]) (set inode.addrs ({[addr']} ∪.) σ)⌝ -∗ ⌜inode.wf σ⌝ -∗ ∀ s, ⌜s !! addr' = Some block_reserved⌝ -∗ P σ ∗ ▷ Palloc s ={⊤ ∖ ↑allocN}=∗ P σ' ∗ ▷ Palloc (<[addr' := block_used]> s) ∗ Q)) }}} Inode__Append #l (slice_val b_s) #alloc_ref @ ⊤ {{{ (ok: bool), RET #ok; if ok then Q else emp }}} {{{ Qc }}}.”; [inode_proof.v, line 920](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/examples/inode_proof.v#L920)", "source_url": "https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/examples/inode_proof.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "Perennial example async inode", "specifies": "asynchronous inode flushing", "safety": "operation and crash-recovery contracts", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts with 15 active admission tokens in counted files; incomplete artifact; source inspection only", "size": "1,414 LOC in 1 `.v` file(s), scope `src/program_proof/examples/async_inode_proof.v`", "source": "[src/program_proof/examples/async_inode_proof.v](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/examples/async_inode_proof.v)", "source_words": "“Theorem wpc_Inode__Flush {k} {l k' P addr} {Palloc γalloc domain n} (alloc_ref: loc) : (S k < n)%nat → (S k < k')%nat → inodeN ## allocN → ∀ Φ Φc, \"Hinode\" ∷ is_inode l (S k') P addr ∗ \"#Halloc\" ∷ is_allocator Palloc Ψ allocN alloc_ref domain γalloc n ∗ \"#Halloc_fupd\" ∷ □ reserve_fupd (⊤ ∖ ↑allocN) Palloc ∗ \"#Hfree_fupd\" ∷ □ (∀ a, free_fupd (⊤ ∖ ↑allocN) Palloc a) ∗ \"Hfupd\" ∷ (<disc> ▷ Φc ∧ (∀ σ, flush_fupd P Palloc σ Φ Φc σ.(inode.buffered_blocks))) -∗ WPC Inode__Flush #l #alloc_ref @ (S k); ⊤ {{ Φ }} {{ Φc }}.”; [async_inode_proof.v, line 1184](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/examples/async_inode_proof.v#L1184)", "source_url": "https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/examples/async_inode_proof.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "Perennial example single inode", "specifies": "single inode append with crash safety", "safety": "operation and crash-recovery contracts", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "482 LOC in 1 `.v` file(s), scope `src/program_proof/examples/single_inode_proof.v`", "source": "[src/program_proof/examples/single_inode_proof.v](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/examples/single_inode_proof.v)", "source_words": "“Theorem wpc_SingleInode__Append_triple (Q: iProp Σ) l sz b_s b0 : {{{ \"Hinode\" ∷ is_single_inode l sz ∗ \"Hb\" ∷ is_block b_s 1 b0 ∗ \"Hfupd\" ∷ ((∀ σ σ', ⌜σ' = s_inode.mk (σ.(s_inode.blocks) ++ [b0])⌝ -∗ ▷ P σ ={⊤ ∖ ↑N}=∗ ▷ P σ' ∗ Q)) }}} SingleInode__Append #l (slice_val b_s) @ ⊤ {{{ (ok: bool), RET #ok; if ok then Q else emp }}} {{{ True }}}.”; [single_inode_proof.v, line 458](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/examples/single_inode_proof.v#L458)", "source_url": "https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/examples/single_inode_proof.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "Perennial example single async inode", "specifies": "single asynchronous inode append/flush", "safety": "operation and crash-recovery contracts", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "764 LOC in 1 `.v` file(s), scope `src/program_proof/examples/single_async_inode_proof.v`", "source": "[src/program_proof/examples/single_async_inode_proof.v](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/examples/single_async_inode_proof.v)", "source_words": "“Theorem wpc_SingleInode__Flush1 {k} (Q: iProp Σ) γdur γbuf blks l sz k' : (S k < k')%nat → {{{ \"Hinode\" ∷ is_single_inode γdur γbuf l sz k' ∗ \"Hlb\" ∷ inode_current_lb γbuf blks }}} SingleInode__Flush #l @ (S k); ⊤ {{{ (ok: bool), RET #ok; if ok then inode_durable_lb γdur γbuf blks else emp }}} {{{ True }}}.”; [single_async_inode_proof.v, line 739](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/examples/single_async_inode_proof.v#L739)", "source_url": "https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/examples/single_async_inode_proof.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "Perennial example dir", "specifies": "concurrent crash-safe directory", "safety": "operation and crash-recovery contracts", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "1,227 LOC in 1 `.v` file(s), scope `src/program_proof/examples/dir_proof.v`", "source": "[src/program_proof/examples/dir_proof.v](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/examples/dir_proof.v)", "source_words": "“Theorem wpr_Open (d: ()) (sz: u64) σ0: (5 ≤ int.Z sz)%Z → dir_cinv (int.Z sz) σ0 true -∗ wpr NotStuck ⊤ (Open (disk_val d) #sz) (Open (disk_val d) #sz) (λ _, True%I) (λ _, True%I) (λ _ _, True%I).”; [dir_proof.v, line 1202](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/examples/dir_proof.v#L1202)", "source_url": "https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/examples/dir_proof.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "Perennial example async mem alloc inode", "specifies": "inode using asynchronous in-memory allocation", "safety": "operation and crash-recovery contracts", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "1,111 LOC in 1 `.v` file(s), scope `src/program_proof/examples/async_mem_alloc_inode_proof.v`", "source": "[src/program_proof/examples/async_mem_alloc_inode_proof.v](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/examples/async_mem_alloc_inode_proof.v)", "source_words": "“Theorem wpc_Inode__Append_triple {l P addr} {Palloc γalloc domain} (Q: iProp Σ) (Qc: iProp Σ) (alloc_ref: loc) q (b_s: Slice.t) (b0: Block) : inodeN ## allocN → {{{ \"Hinode\" ∷ is_inode l P addr ∗ \"Hbdata\" ∷ is_block b_s q b0 ∗ \"HQc\" ∷ (Q -∗ Qc) ∗ \"#Halloc\" ∷ is_allocator Palloc Ψ allocN alloc_ref domain γalloc ∗ \"#Halloc_fupd\" ∷ □ reserve_fupd (⊤ ∖ ↑allocN) Palloc ∗ \"#Hfree_fupd\" ∷ □ (∀ a, free_fupd (⊤ ∖ ↑allocN) Palloc a) ∗ \"Hfupd\" ∷ (Qc ∧ (∀ σ σ' addr', ⌜σ' = set inode.blocks (λ bs, bs ++ [b0]) (set inode.addrs ({[addr']} ∪.) σ)⌝ -∗ ⌜inode.wf σ⌝ -∗ ∀ s, ⌜s !! addr' = Some block_reserved⌝ -∗ P σ ∗ ▷ Palloc s ={⊤ ∖ ↑allocN}=∗ P σ' ∗ ▷ Palloc (<[addr' := block_used]> s) ∗ Q)) }}} Inode__Append #l (slice_val b_s) #alloc_ref @ ⊤ {{{ (ok: bool), RET #ok; if ok then Q else emp }}} {{{ Qc }}}.”; [async_mem_alloc_inode_proof.v, line 1030](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/examples/async_mem_alloc_inode_proof.v#L1030)", "source_url": "https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/examples/async_mem_alloc_inode_proof.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "Perennial example async mem alloc dir", "specifies": "directory using asynchronous in-memory allocation", "safety": "operation and crash-recovery contracts", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "1,273 LOC in 1 `.v` file(s), scope `src/program_proof/examples/async_mem_alloc_dir_proof.v`", "source": "[src/program_proof/examples/async_mem_alloc_dir_proof.v](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/examples/async_mem_alloc_dir_proof.v)", "source_words": "“Theorem wpr_Open (d: ()) (sz: u64) σ0: (5 ≤ int.Z sz)%Z → dir_cinv (int.Z sz) σ0 true -∗ wpr NotStuck ⊤ (Open (disk_val d) #sz) (Open (disk_val d) #sz) (λ _, True%I) (λ _, True%I) (λ _ _, True%I).”; [async_mem_alloc_dir_proof.v, line 1248](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/examples/async_mem_alloc_dir_proof.v#L1248)", "source_url": "https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/examples/async_mem_alloc_dir_proof.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "Perennial example indirect inode", "specifies": "indirect inode read/write protocol", "safety": "operation and crash-recovery contracts", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts with 13 active admission tokens in counted files; incomplete artifact; source inspection only", "size": "1,354 LOC in 1 `.v` file(s), scope `src/program_proof/examples/indirect_inode_proof.v`", "source": "[src/program_proof/examples/indirect_inode_proof.v](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/examples/indirect_inode_proof.v)", "source_words": "“Theorem wp_Inode__mkHdr {Stk E} l (sz numInd : Z) allocedDirAddrs allocedIndAddrs direct_s indirect_s: (length(allocedDirAddrs) <= int.nat maxDirect ∧ (Z.of_nat (length(allocedIndAddrs))) = numInd ∧ sz <= MaxBlocks ∧ numInd <= maxIndirect) -> {{{ \"direct\" ∷ l ↦[Inode :: \"direct\"] (slice_val direct_s) ∗ \"indirect\" ∷ l ↦[Inode :: \"indirect\"] (slice_val indirect_s) ∗ \"size\" ∷ l ↦[Inode :: \"size\"] #sz ∗ \"Hdirect\" ∷ own_slice direct_s uint64T 1 allocedDirAddrs ∗ \"Hindirect\" ∷ own_slice indirect_s uint64T 1 allocedIndAddrs }}} Inode__mkHdr #l @ Stk; E {{{ s hdr, RET (slice_val s); is_block s 1 hdr ∗ \"%Hencoded\" ∷ ⌜block_encodes hdr ([EncUInt64 sz] ++ (EncUInt64 <$> allocedDirAddrs) ++ (EncUInt64 <$> (replicate (int.nat (maxDirect - length allocedDirAddrs)) (U64 0))) ++ (EncUInt64 <$> allocedIndAddrs) ++ (EncUInt64 <$> (replicate (int.nat (maxIndirect - length allocedIndAddrs)) (U64 0))) ++ [EncUInt64 numInd])⌝ ∗ \"direct\" ∷ l ↦[Inode :: \"direct\"] (slice_val direct_s) ∗ \"indirect\" ∷ l ↦[Inode :: \"indirect\"] (slice_val indirect_s) ∗ \"size\" ∷ l ↦[Inode :: \"size\"] #sz ∗ \"Hdirect\" ∷ own_slice direct_s uint64T 1 allocedDirAddrs ∗ \"Hindirect\" ∷ own_slice indirect_s uint64T 1 allocedIndAddrs }}}.”; [indirect_inode_proof.v, line 1237](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/examples/indirect_inode_proof.v#L1237)", "source_url": "https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/examples/indirect_inode_proof.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "Perennial example indirect inode append", "specifies": "indirect inode append protocol", "safety": "operation and crash-recovery contracts", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts with 1 active admission tokens in counted files; incomplete artifact; source inspection only", "size": "1,145 LOC in 1 `.v` file(s), scope `src/program_proof/examples/indirect_inode_append_proof.v`", "source": "[src/program_proof/examples/indirect_inode_append_proof.v](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/examples/indirect_inode_append_proof.v)", "source_words": "“Theorem wpc_Inode__Append {k} {l k' P addr} {Palloc γalloc domain n} (alloc_ref: loc) q (b_s: Slice.t) (b0: Block) : (k < k')%nat → nroot.@\"readonly\" ## allocN → nroot.@\"readonly\" ## inodeN → inodeN ## allocN → ∀ Φ Φc, \"Hinode\" ∷ is_inode inodeN l k' P addr ∗ \"Hbdata\" ∷ is_block b_s q b0 ∗ \"#Halloc\" ∷ is_allocator Palloc Ψ allocN alloc_ref domain γalloc n ∗ \"#Halloc_fupd\" ∷ □ reserve_fupd (⊤ ∖ ↑allocN) Palloc ∗ \"#Hfree_fupd\" ∷ □ (∀ a, free_fupd (⊤ ∖ ↑allocN) Palloc a) ∗ \"Hfupd\" ∷ (Φc ∧ ▷ (Φ #false ∧ ∀ σ σ' addr', ⌜σ' = set inode.blocks (λ bs, bs ++ [b0]) (set inode.addrs ({[addr']} ∪.) σ)⌝ -∗ ⌜inode.wf σ⌝ -∗ ∀ s, ⌜s !! addr' = Some block_reserved⌝ -∗ ▷ P σ ∗ ▷ Palloc s ={⊤ ∖ ↑allocN ∖ ↑inodeN}=∗ ▷ P σ' ∗ ▷ Palloc (<[addr' := block_used]> s) ∗ (Φc ∧ Φ #true))) -∗ WPC Inode__Append #l (slice_val b_s) #alloc_ref @ ⊤ {{ Φ }} {{ Φc }}.”; [indirect_inode_append_proof.v, line 1113](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/examples/indirect_inode_append_proof.v#L1113)", "source_url": "https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/examples/indirect_inode_append_proof.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "Perennial example alloc crash", "specifies": "crash-safe allocation protocol", "safety": "operation and crash-recovery contracts", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "1,162 LOC in 1 `.v` file(s), scope `src/program_proof/examples/alloc_crash_proof.v`", "source": "[src/program_proof/examples/alloc_crash_proof.v](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/examples/alloc_crash_proof.v)", "source_words": "“Theorem wp_Free (Q: iProp Σ) E l d γ (a: u64) : ↑N ⊆ E → {{{ is_allocator l d γ ∗ reserved_block γ a (Ψ a) ∗ (∀ σ, ⌜ σ !! a = Some block_reserved ⌝ -∗ ▷ P σ -∗ |NC={E ∖↑N}=> ▷ P (<[ a := block_free ]> σ) ∗ Q) }}} Allocator__Free #l #a @ E {{{ RET #(); Q }}}.”; [alloc_crash_proof.v, line 1046](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/examples/alloc_crash_proof.v#L1046)", "source_url": "https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/examples/alloc_crash_proof.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "Perennial example alloc", "specifies": "allocation protocol", "safety": "operation and crash-recovery contracts", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "303 LOC in 1 `.v` file(s), scope `src/program_proof/examples/alloc_proof.v`", "source": "[src/program_proof/examples/alloc_proof.v](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/examples/alloc_proof.v)", "source_words": "“Theorem wp_Free (Q: iProp Σ) l γ (a: u64) : {{{ is_allocator l γ ∗ Ψ a ∗ alloc_used γ a ∗ (∀ σ σ', ⌜σ' = set alloc.used (λ used, used ∖ {[a]}) σ⌝ -∗ ⌜alloc.wf σ⌝ -∗ ▷ P σ ={⊤}=∗ ▷ P σ' ∗ Q) }}} Allocator__Free #l #a {{{ RET #(); Q }}}.”; [alloc_proof.v, line 247](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/examples/alloc_proof.v#L247)", "source_url": "https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/examples/alloc_proof.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "Perennial example alloc proof simple.v", "specifies": "simple allocation protocol", "safety": "operation and crash-recovery contracts", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "272 LOC in 1 `.v` file(s), scope `src/program_proof/examples/alloc_proof_simple.v`", "source": "[src/program_proof/examples/alloc_proof_simple.v](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/examples/alloc_proof_simple.v)", "source_words": "“Theorem wp_crash_Free P Pc l (a: u64) : {{{ is_crash_allocator l P Pc ∗ crash_borrow (P {[a]}) (Pc {[a]}) }}} Allocator__Free #l #a {{{ RET #(); True }}}.”; [alloc_proof_simple.v, line 262](https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/examples/alloc_proof_simple.v#L262)", "source_url": "https://github.com/mit-pdos/perennial/blob/820a2a9ab088d298f9854961c55c010d6ea1858d/src/program_proof/examples/alloc_proof_simple.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "Go channel", "specifies": "channel concurrent program", "safety": "channel/data-structure/client Hoare contracts", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "408 LOC in 1 `.v` file(s), scope `new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel.v`", "source": "[new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel.v](https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel.v)", "source_words": "“Lemma wp_BroadcastExample : {{{ is_pkg_init channel_examples }}} @! channel_examples.BroadcastExample #() {{{ RET #(); True }}}.”; [channel.v, line 361](https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel.v#L361)", "source_url": "https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "Go channel examples", "specifies": "channel examples concurrent program", "safety": "channel/data-structure/client Hoare contracts", "liveness": "not found in this row", "tool": "implementation/specification present; no active lemma/theorem found in counted files; source inspection only", "size": "13 LOC in 1 `.v` file(s), scope `new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel_examples.v`", "source": "[new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel_examples.v](https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel_examples.v)", "source_url": "https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel_examples.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "Go channel fibonacci", "specifies": "channel fibonacci concurrent program", "safety": "channel/data-structure/client Hoare contracts", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "196 LOC in 1 `.v` file(s), scope `new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel_fibonacci.v`", "source": "[new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel_fibonacci.v](https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel_fibonacci.v)", "source_words": "“Lemma wp_fib_consumer: {{{ is_pkg_init channel_examples }}} @! channel_examples.fib_consumer #() {{{ sl, RET #(sl); sl ↦* (fib_list 10) }}}.”; [channel_fibonacci.v, line 135](https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel_fibonacci.v#L135)", "source_url": "https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel_fibonacci.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "Go channel dsp", "specifies": "channel dsp concurrent program", "safety": "channel/data-structure/client Hoare contracts", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "388 LOC in 1 `.v` file(s), scope `new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel_dsp.v`", "source": "[new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel_dsp.v](https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel_dsp.v)", "source_words": "“Lemma wp_makeGreeting : {{{ is_pkg_init channel_examples }}} @! channel_examples.makeGreeting #() {{{ RET #\"Hello, World!\"; True%I }}}.”; [channel_dsp.v, line 358](https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel_dsp.v#L358)", "source_url": "https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel_dsp.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "Go channel google", "specifies": "channel google concurrent program", "safety": "channel/data-structure/client Hoare contracts", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "415 LOC in 1 `.v` file(s), scope `new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel_google.v`", "source": "[new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel_google.v](https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel_google.v)", "source_words": "“Lemma wp_Google (q : go_string) : {{{ True }}} @! channel_examples.Google #q {{{ (sl : slice.t), RET #sl; ∃ xs, sl ↦* xs ∗ ⌜xs ≡ₚ google_expected q⌝ }}}.”; [channel_google.v, line 165](https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel_google.v#L165)", "source_url": "https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel_google.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "Go channel higher order", "specifies": "channel higher order concurrent program", "safety": "channel/data-structure/client Hoare contracts", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "152 LOC in 1 `.v` file(s), scope `new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel_higher_order.v`", "source": "[new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel_higher_order.v](https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel_higher_order.v)", "source_words": "“Lemma wp_HigherOrderExample : {{{ is_pkg_init channel_examples }}} @! channel_examples.HigherOrderExample #() {{{ (s:slice.t), RET #s; s ↦* [\"hello world\"%go; \"HELLO\"%go; \"world\"%go] }}}.”; [channel_higher_order.v, line 94](https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel_higher_order.v#L94)", "source_url": "https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel_higher_order.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "Go channel search replace", "specifies": "channel search replace concurrent program", "safety": "channel/data-structure/client Hoare contracts", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "240 LOC in 1 `.v` file(s), scope `new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel_search_replace.v`", "source": "[new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel_search_replace.v](https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel_search_replace.v)", "source_words": "“Lemma wp_SearchReplace (s: slice.t) (xs: list w64) (x y: w64) : {{{ is_pkg_init parallel_search_replace ∗ s ↦* xs ∗ ⌜ length xs ≤ 2^63 - 1000 ⌝ ∗ ⌜ length xs ≤ (2^31 - 1)*1000 ⌝ }}} @! parallel_search_replace.SearchReplace #s #x #y {{{ RET #(); s ↦* (search_replace x y xs) }}}.”; [channel_search_replace.v, line 129](https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel_search_replace.v#L129)", "source_url": "https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel_search_replace.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "Go channel select tricky examples", "specifies": "channel select tricky examples concurrent program", "safety": "channel/data-structure/client Hoare contracts", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "260 LOC in 1 `.v` file(s), scope `new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel_select_tricky_examples.v`", "source": "[new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel_select_tricky_examples.v](https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel_select_tricky_examples.v)", "source_words": "“Lemma wp_select_nb_full_buffer_not_ready : {{{ is_pkg_init channel_examples }}} @! channel_examples.select_nb_full_buffer_not_ready #() {{{ RET #(); True }}}.”; [channel_select_tricky_examples.v, line 219](https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel_select_tricky_examples.v#L219)", "source_url": "https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel_select_tricky_examples.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "Go elimination stack", "specifies": "elimination stack concurrent program", "safety": "channel/data-structure/client Hoare contracts", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "474 LOC in 1 `.v` file(s), scope `new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/elimination_stack.v`", "source": "[new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/elimination_stack.v](https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/elimination_stack.v)", "source_words": "“Lemma wp_EliminationStack__Pop γ s N : ∀ Φ, is_pkg_init elimination_stack ∗ is_EliminationStack s γ N -∗ (|={⊤∖↑N,∅}=> ∃ σ, ⟦σ⟧ ∗ (match σ with | [] => ⟦[]⟧ ={∅,⊤∖↑N}=∗ Φ (#\"\", #false)%V | v :: σ => ⟦σ⟧ ={∅,⊤∖↑N}=∗ Φ (#v, #true)%V end)) -∗ WP s @! (go.PointerType elimination_stack.EliminationStack) @! \"Pop\" #() {{ Φ }}.”; [elimination_stack.v, line 361](https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/elimination_stack.v#L361)", "source_url": "https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/elimination_stack.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "Go lock", "specifies": "lock concurrent program", "safety": "channel/data-structure/client Hoare contracts", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "122 LOC in 1 `.v` file(s), scope `new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/lock.v`", "source": "[new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/lock.v](https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/lock.v)", "source_words": "“Lemma wp_Lock__LockWithTimeout γ (l : Lock.t) (R : iProp Σ) (d : time.Duration.t) : {{{ is_pkg_init pkg_id.lock ∗ is_Lock γ l R }}} l @! lock.Lock @! \"LockWithTimeout\" #d {{{ (b : bool), RET #b; if b then R else True }}}.”; [lock.v, line 94](https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/lock.v#L94)", "source_url": "https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/lock.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "Go channel workq", "specifies": "workq concurrent program", "safety": "channel/session/client Hoare contracts", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "713 LOC in 1 `.v` file(s), scope `new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel/workq.v`", "source": "[new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel/workq.v](https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel/workq.v)", "source_words": "“Lemma wp_wordCount docs_sl docs : {{{ is_pkg_init workq ∗ \"Hdocs\" ∷ docs_sl ↦* docs }}} @! workq.wordCount #docs_sl {{{ RET #(W64 (sum_list (word_count <$> docs))); True }}}.”; [workq.v, line 487](https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel/workq.v#L487)", "source_url": "https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel/workq.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "Go channel etcd session", "specifies": "etcd session concurrent program", "safety": "channel/session/client Hoare contracts", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "205 LOC in 1 `.v` file(s), scope `new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel/etcd_session.v`", "source": "[new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel/etcd_session.v](https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel/etcd_session.v)", "source_words": "“Lemma waitSession A A' `{!ZeroVal A'} `{!TypedPointsto A'} `{!IntoValTyped A' A} cancel γcancel (Pcancel : A' → _) : {{{ is_pkg_init etcd_session ∗ \"#Hcancel\" ∷ is_chan_bag γcancel cancel Pcancel }}} #(functions etcd_session.waitSession [A]) #cancel {{{ (err : error.t), RET #err; match err with | interface.nil => True | _ => (∃ a, Pcancel a) end }}}.”; [etcd_session.v, line 167](https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel/etcd_session.v#L167)", "source_url": "https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/proof/github_com/mit_pdos/perennial/goose/testdata/examples/channel/etcd_session.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "Go channel idiom future", "specifies": "future channel protocol resource specification", "safety": "protocol send/receive/ownership rules", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "423 LOC in 1 `.v` file(s), scope `new/golang/theory/chan/idioms/future.v`", "source": "[new/golang/theory/chan/idioms/future.v](https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/golang/theory/chan/idioms/future.v)", "source_words": "“Lemma wp_future_await γ ch (pending : list (V → iProp Σ)) : {{{ is_future γ ch ∗ Await γ pending }}} chan.receive t #ch {{{ (v : V) (P : V → iProp Σ) (pre post : list (V → iProp Σ)), RET (#v, #true); ⌜pending = pre ++ P :: post⌝ ∗ P v ∗ Await γ (pre ++ post) }}}.”; [future.v, line 404](https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/golang/theory/chan/idioms/future.v#L404)", "source_url": "https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/golang/theory/chan/idioms/future.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "Go channel idiom spsc", "specifies": "spsc channel protocol resource specification", "safety": "protocol send/receive/ownership rules", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "668 LOC in 1 `.v` file(s), scope `new/golang/theory/chan/idioms/spsc.v`", "source": "[new/golang/theory/chan/idioms/spsc.v](https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/golang/theory/chan/idioms/spsc.v)", "source_words": "“Lemma wp_spsc_close γ ch P R sent `[ct ↓u go.ChannelType dir t] : {{{ is_spsc γ ch P R ∗ spsc_producer γ sent ∗ R sent }}} #(functions go.close [ct]) #ch {{{ RET #(); True }}}.”; [spsc.v, line 654](https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/golang/theory/chan/idioms/spsc.v#L654)", "source_url": "https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/golang/theory/chan/idioms/spsc.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "Go channel idiom broadcast", "specifies": "broadcast channel protocol resource specification", "safety": "protocol send/receive/ownership rules", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "186 LOC in 1 `.v` file(s), scope `new/golang/theory/chan/idioms/broadcast.v`", "source": "[new/golang/theory/chan/idioms/broadcast.v](https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/golang/theory/chan/idioms/broadcast.v)", "source_words": "“Lemma own_broadcast_chan_is_chan ch γ Q cl : own_broadcast_chan ch γ Q cl -∗ is_chan ch γ unit.”; [broadcast.v, line 181](https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/golang/theory/chan/idioms/broadcast.v#L181)", "source_url": "https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/golang/theory/chan/idioms/broadcast.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "Go channel idiom lock", "specifies": "lock channel protocol resource specification", "safety": "protocol send/receive/ownership rules", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "248 LOC in 1 `.v` file(s), scope `new/golang/theory/chan/idioms/lock.v`", "source": "[new/golang/theory/chan/idioms/lock.v](https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/golang/theory/chan/idioms/lock.v)", "source_words": "“Lemma wp_lock_channel_unlock γ ch (R : iProp Σ) : {{{ is_lock_channel γ ch R ∗ R }}} chan.receive t #ch {{{ (v : V), RET (#v, #true); True }}}.”; [lock.v, line 233](https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/golang/theory/chan/idioms/lock.v#L233)", "source_url": "https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/golang/theory/chan/idioms/lock.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "Go channel idiom handshake", "specifies": "handshake channel protocol resource specification", "safety": "protocol send/receive/ownership rules", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "152 LOC in 1 `.v` file(s), scope `new/golang/theory/chan/idioms/handshake.v`", "source": "[new/golang/theory/chan/idioms/handshake.v](https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/golang/theory/chan/idioms/handshake.v)", "source_words": "“Lemma wp_handshake_send γ ch v P Q : {{{ is_handshake γ ch P Q ∗ P v }}} chan.send t #ch #v {{{ RET (#()); Q }}}.”; [handshake.v, line 135](https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/golang/theory/chan/idioms/handshake.v#L135)", "source_url": "https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/golang/theory/chan/idioms/handshake.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "Go channel idiom bag", "specifies": "bag channel protocol resource specification", "safety": "protocol send/receive/ownership rules", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "281 LOC in 1 `.v` file(s), scope `new/golang/theory/chan/idioms/bag.v`", "source": "[new/golang/theory/chan/idioms/bag.v](https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/golang/theory/chan/idioms/bag.v)", "source_words": "“Lemma wp_bag_send γ ch v P : {{{ is_chan_bag γ ch P ∗ P v }}} chan.send t #ch #v {{{ RET #(); True }}}.”; [bag.v, line 268](https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/golang/theory/chan/idioms/bag.v#L268)", "source_url": "https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/golang/theory/chan/idioms/bag.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "Go channel idiom mpmc", "specifies": "mpmc channel protocol resource specification", "safety": "protocol send/receive/ownership rules", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "1,022 LOC in 1 `.v` file(s), scope `new/golang/theory/chan/idioms/mpmc.v`", "source": "[new/golang/theory/chan/idioms/mpmc.v](https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/golang/theory/chan/idioms/mpmc.v)", "source_words": "“Lemma mpmc_get_final_resource γ ch (n_prod n_cons : nat) P R (consumers : list (gmultiset V)) : length consumers = n_cons → £ 1 -∗ is_mpmc γ ch n_prod n_cons P R -∗ is_closed γ -∗ ([∗ list] r_i ∈ consumers, mpmc_consumer γ r_i) ={⊤}=∗ R (foldr disj_union ∅ consumers).”; [mpmc.v, line 967](https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/golang/theory/chan/idioms/mpmc.v#L967)", "source_url": "https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/golang/theory/chan/idioms/mpmc.v", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "etcd client model/spec", "specifies": "etcd client operations and abstract model", "safety": "partial model/specification and operation contracts; this row does not claim full production etcd verification", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts with 4 active admission tokens in counted files; incomplete artifact; source inspection only", "size": "895 LOC in 6 `.v` file(s), scope `new/proof/go_etcd_io/etcd/client/v3_proof`", "source": "[new/proof/go_etcd_io/etcd/client/v3_proof](https://github.com/mit-pdos/perennial/tree/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/proof/go_etcd_io/etcd/client/v3_proof)", "source_words": "“Lemma test req γ : ⊢ ∀ Φ, (∃ (σ : EtcdState.t), ghost_var γ 1%Qp σ ∗ (∀ resp (σ' : EtcdState.t), ghost_var γ 1%Qp σ' -∗ Φ resp)) -∗ GrantSpec req γ Φ.”; [spec.v, line 30](https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/proof/go_etcd_io/etcd/client/v3_proof/spec.v#L30)", "source_url": "https://github.com/mit-pdos/perennial/tree/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/proof/go_etcd_io/etcd/client/v3_proof", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "etcd lease protocol", "specifies": "lease/cache protocol definitions", "safety": "partial model/specification and operation contracts; this row does not claim full production etcd verification", "liveness": "not found in this row", "tool": "implementation/specification present; no active lemma/theorem found in counted files; source inspection only", "size": "203 LOC in 1 `.v` file(s), scope `new/proof/go_etcd_io/etcd/client/v3/leasing_proof`", "source": "[new/proof/go_etcd_io/etcd/client/v3/leasing_proof](https://github.com/mit-pdos/perennial/tree/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/proof/go_etcd_io/etcd/client/v3/leasing_proof)", "source_url": "https://github.com/mit-pdos/perennial/tree/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/proof/go_etcd_io/etcd/client/v3/leasing_proof", "has_liveness": false}
{"section": "Coq and Rocq", "group": "Coq / Perennial and Grove", "name": "etcd Raft protocol", "specifies": "Raft readonly and protocol proof definitions", "safety": "partial model/specification and operation contracts; this row does not claim full production etcd verification", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts with 16 active admission tokens in counted files; incomplete artifact; source inspection only", "size": "1,160 LOC in 3 `.v` file(s), scope `new/proof/go_etcd_io/raft/v3_proof`", "source": "[new/proof/go_etcd_io/raft/v3_proof](https://github.com/mit-pdos/perennial/tree/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/proof/go_etcd_io/raft/v3_proof)", "source_words": "“Lemma wp_raft__stepLeader_MsgReadIndex γ r (rf : raft.raft.t) (m : raftpb.Message.t) : {{{ \"Hr\" ∷ r ↦ rf ∗ \"Hrf\" ∷ own_raft γ rf ∗ \"%HmType\" ∷ ⌜ m.(raftpb.Message.Type') = MsgReadIndex ⌝ }}} @! raft.stepLeader #r #m {{{ RET #(); True }}}.”; [readonly.v, line 936](https://github.com/mit-pdos/perennial/blob/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/proof/go_etcd_io/raft/v3_proof/readonly.v#L936)", "source_url": "https://github.com/mit-pdos/perennial/tree/3e3e0a484d61d0a15b578f5d5887ead84f145d71/new/proof/go_etcd_io/raft/v3_proof", "has_liveness": false}
{"section": "Coq extra cases: causal stores and termination", "group": "Coq / Chapar", "name": "Chapar replicated KV algorithm 1", "specifies": "causally consistent replicated key-value implementation, algorithm 1", "safety": "causal consistency of execution history", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "2,500 LOC in 1 `.v` file(s), scope `theories/Algorithms/KVSAlg1.v`", "source": "[theories/Algorithms/KVSAlg1.v](https://github.com/rocq-community/chapar/blob/0553daf8bd6f64f791475dc79a219fe4205509aa/theories/Algorithms/KVSAlg1.v)", "source_words": "“Lemma CausallyConsistent: forall (p: Syntax.PProg)(h: list N.CExec.Label), N.CExec.history (N.CExec.init p) h -> exists (h': list AExec.Label), AExec.history (AExec.init p) h' /\\ N.CExec.ext_hist h = AExec.ext_hist h'.”; [KVSAlg1.v, line 2489](https://github.com/rocq-community/chapar/blob/0553daf8bd6f64f791475dc79a219fe4205509aa/theories/Algorithms/KVSAlg1.v#L2489)", "source_url": "https://github.com/rocq-community/chapar/blob/0553daf8bd6f64f791475dc79a219fe4205509aa/theories/Algorithms/KVSAlg1.v", "has_liveness": false}
{"section": "Coq extra cases: causal stores and termination", "group": "Coq / Chapar", "name": "Chapar replicated KV algorithm 2", "specifies": "causally consistent replicated key-value implementation, algorithm 2", "safety": "causal consistency of execution history", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "5,286 LOC in 1 `.v` file(s), scope `theories/Algorithms/KVSAlg2.v`", "source": "[theories/Algorithms/KVSAlg2.v](https://github.com/rocq-community/chapar/blob/0553daf8bd6f64f791475dc79a219fe4205509aa/theories/Algorithms/KVSAlg2.v)", "source_words": "“Lemma CausallyConsistent: forall (p: Syntax.PProg)(h: list N.CExec.Label), N.CExec.history (N.CExec.init p) h -> exists (h': list AExec.Label), AExec.history (AExec.init p) h' /\\ N.CExec.ext_hist h = AExec.ext_hist h'.”; [KVSAlg2.v, line 5275](https://github.com/rocq-community/chapar/blob/0553daf8bd6f64f791475dc79a219fe4205509aa/theories/Algorithms/KVSAlg2.v#L5275)", "source_url": "https://github.com/rocq-community/chapar/blob/0553daf8bd6f64f791475dc79a219fe4205509aa/theories/Algorithms/KVSAlg2.v", "has_liveness": false}
{"section": "Coq extra cases: causal stores and termination", "group": "Coq / Chapar", "name": "Chapar replicated KV algorithm 3", "specifies": "causally consistent replicated key-value implementation, algorithm 3", "safety": "causal consistency of execution history", "liveness": "not found in this row", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "3,378 LOC in 1 `.v` file(s), scope `theories/Algorithms/KVSAlg3.v`", "source": "[theories/Algorithms/KVSAlg3.v](https://github.com/rocq-community/chapar/blob/0553daf8bd6f64f791475dc79a219fe4205509aa/theories/Algorithms/KVSAlg3.v)", "source_words": "“Lemma CausallyConsistent: forall (p: Syntax.PProg)(h: list N.CExec.Label), N.CExec.history (N.CExec.init p) h -> exists (h': list AExec.Label), AExec.history (AExec.init p) h' /\\ N.CExec.ext_hist h = AExec.ext_hist h'.”; [KVSAlg3.v, line 3366](https://github.com/rocq-community/chapar/blob/0553daf8bd6f64f791475dc79a219fe4205509aa/theories/Algorithms/KVSAlg3.v#L3366)", "source_url": "https://github.com/rocq-community/chapar/blob/0553daf8bd6f64f791475dc79a219fe4205509aa/theories/Algorithms/KVSAlg3.v", "has_liveness": false}
{"section": "Coq extra cases: causal stores and termination", "group": "Coq / Chapar", "name": "Chapar photo upload client", "specifies": "upload photo, then advertise post; readers must not see advertised photo missing", "safety": "client fault-freedom from causally-content program contract", "liveness": "not found in this row", "tool": "Coq proof scripts using reflective automatic client checking, with proved checking semantics; not only an external model-checker result; source inspection only", "size": "250 LOC in 1 `.v` file(s), scope `theories/Examples/Clients.v`", "source": "[theories/Examples/Clients.v](https://github.com/rocq-community/chapar/blob/0553daf8bd6f64f791475dc79a219fe4205509aa/theories/Examples/Clients.v)", "source_words": "“Lemma CauseConsistent_Prog_PhotoUpload: forall h n, Alg.CExec.history (Alg.CExec.init prog_photo_upload) h -> forall l, List.In l h -> l <> Alg.CExec.fault_label n.”; [Clients.v, line 73](https://github.com/rocq-community/chapar/blob/0553daf8bd6f64f791475dc79a219fe4205509aa/theories/Examples/Clients.v#L73)", "source_url": "https://github.com/rocq-community/chapar/blob/0553daf8bd6f64f791475dc79a219fe4205509aa/theories/Examples/Clients.v", "has_liveness": false}
{"section": "Coq extra cases: causal stores and termination", "group": "Coq / Chapar", "name": "Chapar lost ring client", "specifies": "causal key-value lost-ring client program", "safety": "client fault-freedom from causally-content program contract", "liveness": "not found in this row", "tool": "Coq proof scripts using reflective automatic client checking, with proved checking semantics; not only an external model-checker result; source inspection only", "size": "250 LOC in 1 `.v` file(s), scope `theories/Examples/Clients.v`", "source": "[theories/Examples/Clients.v](https://github.com/rocq-community/chapar/blob/0553daf8bd6f64f791475dc79a219fe4205509aa/theories/Examples/Clients.v)", "source_words": "“Lemma CauseConsistent_Prog_LostRing: forall h n, Alg.CExec.history (Alg.CExec.init prog_lost_ring) h -> forall l, List.In l h -> l <> Alg.CExec.fault_label n.”; [Clients.v, line 117](https://github.com/rocq-community/chapar/blob/0553daf8bd6f64f791475dc79a219fe4205509aa/theories/Examples/Clients.v#L117)", "source_url": "https://github.com/rocq-community/chapar/blob/0553daf8bd6f64f791475dc79a219fe4205509aa/theories/Examples/Clients.v", "has_liveness": false}
{"section": "Coq extra cases: causal stores and termination", "group": "Coq / Chapar", "name": "Chapar photo album client", "specifies": "causal key-value photo-album client program", "safety": "client fault-freedom from causally-content program contract", "liveness": "not found in this row", "tool": "Coq proof scripts using reflective automatic client checking, with proved checking semantics; not only an external model-checker result; source inspection only", "size": "250 LOC in 1 `.v` file(s), scope `theories/Examples/Clients.v`", "source": "[theories/Examples/Clients.v](https://github.com/rocq-community/chapar/blob/0553daf8bd6f64f791475dc79a219fe4205509aa/theories/Examples/Clients.v)", "source_words": "“Lemma CauseConsistent_Prog_PhotoAlbum: forall h n, Alg.CExec.history (Alg.CExec.init prog_photo_album) h -> forall l, List.In l h -> l <> Alg.CExec.fault_label n.”; [Clients.v, line 153](https://github.com/rocq-community/chapar/blob/0553daf8bd6f64f791475dc79a219fe4205509aa/theories/Examples/Clients.v#L153)", "source_url": "https://github.com/rocq-community/chapar/blob/0553daf8bd6f64f791475dc79a219fe4205509aa/theories/Examples/Clients.v", "has_liveness": false}
{"section": "Coq extra cases: causal stores and termination", "group": "Coq / Chapar", "name": "Chapar linked-list client", "specifies": "writer inserts linked-list nodes while reader traverses distributed key-value list", "safety": "client fault-freedom under causal consistency", "liveness": "not found in this row", "tool": "Coq proof scripts using reflective automatic client checking, with proved checking semantics; source inspection only", "size": "151 LOC in 1 `.v` file(s), scope `theories/Examples/ListClient.v`", "source": "[theories/Examples/ListClient.v](https://github.com/rocq-community/chapar/blob/0553daf8bd6f64f791475dc79a219fe4205509aa/theories/Examples/ListClient.v)", "source_words": "“Lemma CausallyContent_Prog1: CausallyContent prog1.”; [ListClient.v, line 95](https://github.com/rocq-community/chapar/blob/0553daf8bd6f64f791475dc79a219fe4205509aa/theories/Examples/ListClient.v#L95)", "source_url": "https://github.com/rocq-community/chapar/blob/0553daf8bd6f64f791475dc79a219fe4205509aa/theories/Examples/ListClient.v", "has_liveness": false}
{"section": "Coq extra cases: causal stores and termination", "group": "Coq / Trillium Fairis", "name": "choose-natural-number concurrent program", "specifies": "nondeterministic natural-number choice using shared memory", "safety": "program/model simulation", "liveness": "fair termination", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "387 LOC in 2 `.v` file(s), scope `fairis/heap_lang/examples/choose_nat`", "source": "[fairis/heap_lang/examples/choose_nat](https://github.com/logsem/trillium/tree/d5c9cb8ec16ef9eebc41964e191a1cba4ab2cc48/fairis/heap_lang/examples/choose_nat)", "source_words": "“Theorem choose_nat_terminates l extr : trfirst extr = ([choose_nat_prog l #()], {| heap := {[l:=#-1]}; used_proph_id := ∅ |}) → extrace_fairly_terminating extr.”; [choose_nat_adequacy.v, line 81](https://github.com/logsem/trillium/blob/d5c9cb8ec16ef9eebc41964e191a1cba4ab2cc48/fairis/heap_lang/examples/choose_nat/choose_nat_adequacy.v#L81)", "source_url": "https://github.com/logsem/trillium/tree/d5c9cb8ec16ef9eebc41964e191a1cba4ab2cc48/fairis/heap_lang/examples/choose_nat", "has_liveness": true}
{"section": "Coq extra cases: causal stores and termination", "group": "Coq / Trillium Fairis", "name": "yes/no concurrent program", "specifies": "two concurrent yes/no workers and shared counter/state", "safety": "program/model simulation", "liveness": "termination under per-thread fair scheduling, with N > 1", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "716 LOC in 2 `.v` file(s), scope `fairis/heap_lang/examples/yesno`", "source": "[fairis/heap_lang/examples/yesno](https://github.com/logsem/trillium/tree/d5c9cb8ec16ef9eebc41964e191a1cba4ab2cc48/fairis/heap_lang/examples/yesno)", "source_words": "“Theorem yesno_terminates (N : nat) (HN: N > 1) (extr : heap_lang_extrace) (Hvex : extrace_valid extr) (Hexfirst : (trfirst extr).1 = [start #N]): (∀ tid, fair_ex tid extr) -> terminating_trace extr.”; [yesno_adequacy.v, line 223](https://github.com/logsem/trillium/blob/d5c9cb8ec16ef9eebc41964e191a1cba4ab2cc48/fairis/heap_lang/examples/yesno/yesno_adequacy.v#L223)", "source_url": "https://github.com/logsem/trillium/tree/d5c9cb8ec16ef9eebc41964e191a1cba4ab2cc48/fairis/heap_lang/examples/yesno", "has_liveness": true}
{"section": "Coq extra cases: causal stores and termination", "group": "Coq / Trillium Fairis", "name": "even/odd counter workers", "specifies": "two workers increment shared counter when parity permits", "safety": "counter monotonicity", "liveness": "counter progresses under maximal execution and fair per-thread scheduling", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "996 LOC in 2 `.v` file(s), scope `fairis/heap_lang/examples/even_odd`", "source": "[fairis/heap_lang/examples/even_odd](https://github.com/logsem/trillium/tree/d5c9cb8ec16ef9eebc41964e191a1cba4ab2cc48/fairis/heap_lang/examples/even_odd)", "source_words": "“Theorem evenodd_ex_liveness (l:loc) (extr : heap_lang_extrace) : extrace_maximal extr → (∀ tid, fair_ex tid extr) → trfirst extr = ([start #l], {| heap := {[l:=#0]}; used_proph_id := ∅ |}) → evenodd_ex_progress l extr ∧ evenodd_ex_mono l extr.”; [even_odd_adequacy.v, line 571](https://github.com/logsem/trillium/blob/d5c9cb8ec16ef9eebc41964e191a1cba4ab2cc48/fairis/heap_lang/examples/even_odd/even_odd_adequacy.v#L571)", "source_url": "https://github.com/logsem/trillium/tree/d5c9cb8ec16ef9eebc41964e191a1cba4ab2cc48/fairis/heap_lang/examples/even_odd", "has_liveness": true}
{"section": "Coq extra cases: causal stores and termination", "group": "Coq / Fairneris source branch", "name": "retransmission protocol model", "specifies": "abstract sender/receiver protocol with repeated transmissions", "safety": "model transitions and reception conditions", "liveness": "receiver role terminates under the explicit mtrace_fair premise", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "451 LOC in 1 `.v` file(s), scope `fairneris/examples/retransmit_model.v`", "source": "[fairneris/examples/retransmit_model.v](https://github.com/logsem/aneris/blob/89a740d17712ce7f37cc2278e75798425ebf3708/fairneris/examples/retransmit_model.v)", "source_words": "“Lemma retransmit_fair_traces_terminate_aux mtr : (trfirst mtr).1.1 = Received → retransmit_terminating_role (inl Brole) mtr.”; [retransmit_model.v, line 420](https://github.com/logsem/aneris/blob/89a740d17712ce7f37cc2278e75798425ebf3708/fairneris/examples/retransmit_model.v#L420)", "source_url": "https://github.com/logsem/aneris/blob/89a740d17712ce7f37cc2278e75798425ebf3708/fairneris/examples/retransmit_model.v", "has_liveness": true}
{"section": "Coq extra cases: causal stores and termination", "group": "Coq / Fairneris source branch", "name": "retransmission model in temporal logic", "specifies": "same retransmission protocol, LTL formulation of trace properties", "safety": "model/trace facts", "liveness": "eventual delivery/reception and receiver-role termination on fair traces", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "523 LOC in 1 `.v` file(s), scope `fairneris/examples/retransmit_model_ltl.v`", "source": "[fairneris/examples/retransmit_model_ltl.v](https://github.com/logsem/aneris/blob/89a740d17712ce7f37cc2278e75798425ebf3708/fairneris/examples/retransmit_model_ltl.v)", "source_words": "“Lemma retransmit_fair_traces_terminate mtr : mtrace_valid mtr → mtrace_fair mtr → retransmit_terminating_role (inl Brole) mtr.”; [retransmit_model_ltl.v, line 507](https://github.com/logsem/aneris/blob/89a740d17712ce7f37cc2278e75798425ebf3708/fairneris/examples/retransmit_model_ltl.v#L507)", "source_url": "https://github.com/logsem/aneris/blob/89a740d17712ce7f37cc2278e75798425ebf3708/fairneris/examples/retransmit_model_ltl.v", "has_liveness": true}
{"section": "Coq extra cases: causal stores and termination", "group": "Coq / Fairneris source branch", "name": "no-drop/duplicate network implementation refinement", "specifies": "concrete network send/receive nodes connected to a Fairneris model", "safety": "continued simulation of implementation and abstract model", "liveness": "local simulation statement found; no standalone concrete termination theorem in this counted file", "tool": "Coq/Rocq proof scripts with 3 active admission tokens in counted files; incomplete artifact; source inspection only", "size": "521 LOC in 1 `.v` file(s), scope `fairneris/examples/no_drop_dup.v`", "source": "[fairneris/examples/no_drop_dup.v](https://github.com/logsem/aneris/blob/89a740d17712ce7f37cc2278e75798425ebf3708/fairneris/examples/no_drop_dup.v)", "source_words": "“Lemma no_drop_dup_continued_simulation shA shB : fairly_terminating (initial_state shA shB).”; [no_drop_dup.v, line 482](https://github.com/logsem/aneris/blob/89a740d17712ce7f37cc2278e75798425ebf3708/fairneris/examples/no_drop_dup.v#L482)", "source_url": "https://github.com/logsem/aneris/blob/89a740d17712ce7f37cc2278e75798425ebf3708/fairneris/examples/no_drop_dup.v", "has_liveness": true}
{"section": "Coq extra cases: causal stores and termination", "group": "Coq / Aneris source implementation", "name": "Stenning retransmission protocol implementation", "specifies": "sender/receiver retransmission code in OCaml", "safety": "no proved property found alongside this implementation in inspected master and fairneris-stenning branches", "liveness": "no local Stenning theorem found; paper claims are not substituted for proof source", "tool": "OCaml implementation present; Coq/Aneris repository, proof location unresolved", "size": "47 physical LOC in `ml_sources/examples/stenning/stenning_code.ml`", "source": "[ml_sources/examples/stenning/stenning_code.ml](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/ml_sources/examples/stenning/stenning_code.ml)", "source_words": "“let server_aux addr j0 =”; [line 5](https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/ml_sources/examples/stenning/stenning_code.ml#L5)", "source_url": "https://github.com/logsem/aneris/blob/59ae37946838df77fb2c573803b68462a3af9d0f/ml_sources/examples/stenning/stenning_code.ml", "has_liveness": false}
{"section": "Coq extra cases: causal stores and termination", "group": "Rocq / Lawyer", "name": "Lawyer static-bound terminating worker", "specifies": "counter/worker with statically known bound", "safety": "program/model proof", "liveness": "termination with execution bound linear in N", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "309 LOC in 2 `.v` file(s), scope `lawyer/examples/const_term`", "source": "[lawyer/examples/const_term](https://github.com/logsem/lawyer/tree/6cb30b988c008af9f1ff083c450e616529938355/lawyer/examples/const_term)", "source_words": "“Theorem const_term_bound_termination N (prog := const_term N) (bound := (N + 2) * 10) (extr : heap_lang_extrace) (START: trfirst extr = ([prog #()], Build_state ∅ ∅)) (VALID: extrace_valid extr): trace_len_le extr (bound + 1).”; [const_term_adequacy.v, line 52](https://github.com/logsem/lawyer/blob/6cb30b988c008af9f1ff083c450e616529938355/lawyer/examples/const_term/const_term_adequacy.v#L52)", "source_url": "https://github.com/logsem/lawyer/tree/6cb30b988c008af9f1ff083c450e616529938355/lawyer/examples/const_term", "has_liveness": true}
{"section": "Coq extra cases: causal stores and termination", "group": "Rocq / Lawyer", "name": "Lawyer runtime-bound terminating worker", "specifies": "worker whose bound is obtained at runtime", "safety": "program/model proof", "liveness": "termination under fair scheduler", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "199 LOC in 2 `.v` file(s), scope `lawyer/examples/rt_bound`", "source": "[lawyer/examples/rt_bound](https://github.com/logsem/lawyer/tree/6cb30b988c008af9f1ff083c450e616529938355/lawyer/examples/rt_bound)", "source_words": "“Theorem rt_bound_termination (extr : heap_lang_extrace) (START: trfirst extr = ([rt_bound #()], Build_state ∅ ∅)) (VALID: extrace_valid extr): extrace_fairly_terminating extr.”; [rt_bound_adequacy.v, line 69](https://github.com/logsem/lawyer/blob/6cb30b988c008af9f1ff083c450e616529938355/lawyer/examples/rt_bound/rt_bound_adequacy.v#L69)", "source_url": "https://github.com/logsem/lawyer/tree/6cb30b988c008af9f1ff083c450e616529938355/lawyer/examples/rt_bound", "has_liveness": true}
{"section": "Coq extra cases: causal stores and termination", "group": "Rocq / Lawyer", "name": "Lawyer delaying lock-free counter client", "specifies": "concurrent counter and delaying worker", "safety": "program/model proof", "liveness": "client termination under any scheduler", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "539 LOC in 2 `.v` file(s), scope `lawyer/examples/lf_counter`", "source": "[lawyer/examples/lf_counter](https://github.com/logsem/lawyer/tree/6cb30b988c008af9f1ff083c450e616529938355/lawyer/examples/lf_counter)", "source_words": "“Theorem lf_counter_termination (extr : heap_lang_extrace) (START: trfirst extr = ([counter_client #()], Build_state ∅ ∅)) (VALID: extrace_valid extr): terminating_trace extr.”; [lf_counter_adequacy.v, line 58](https://github.com/logsem/lawyer/blob/6cb30b988c008af9f1ff083c450e616529938355/lawyer/examples/lf_counter/lf_counter_adequacy.v#L58)", "source_url": "https://github.com/logsem/lawyer/tree/6cb30b988c008af9f1ff083c450e616529938355/lawyer/examples/lf_counter", "has_liveness": true}
{"section": "Coq extra cases: causal stores and termination", "group": "Rocq / Lawyer", "name": "Lawyer finite even/odd workers", "specifies": "finite parity-directed concurrent workers", "safety": "program/model proof", "liveness": "fair termination", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "971 LOC in 2 `.v` file(s), scope `lawyer/examples/eo_fin`", "source": "[lawyer/examples/eo_fin](https://github.com/logsem/lawyer/tree/6cb30b988c008af9f1ff083c450e616529938355/lawyer/examples/eo_fin)", "source_words": "“Lemma eofin_terminates_impl (extr : heap_lang_extrace) (START: trfirst extr = ([start #(0%nat) #B], Build_state ∅ ∅)): extrace_fairly_terminating extr.”; [eo_fin_adequacy.v, line 51](https://github.com/logsem/lawyer/blob/6cb30b988c008af9f1ff083c450e616529938355/lawyer/examples/eo_fin/eo_fin_adequacy.v#L51)", "source_url": "https://github.com/logsem/lawyer/tree/6cb30b988c008af9f1ff083c450e616529938355/lawyer/examples/eo_fin", "has_liveness": true}
{"section": "Coq extra cases: causal stores and termination", "group": "Rocq / Lawyer", "name": "Lawyer nondeterministic blocking choice", "specifies": "blocking choice plus forked/parallel choice clients", "safety": "program/model proof", "liveness": "fair termination of blocking and parallel clients", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "995 LOC in 4 `.v` file(s), scope `lawyer/examples/nondet`", "source": "[lawyer/examples/nondet](https://github.com/logsem/lawyer/tree/6cb30b988c008af9f1ff083c450e616529938355/lawyer/examples/nondet)", "source_words": "“Theorem nondet_termination (extr : heap_lang_extrace) (START: trfirst extr = ([nondet #()], Build_state ∅ ∅)) (VALID: extrace_valid extr): extrace_fairly_terminating extr.”; [nondet_adequacy.v, line 54](https://github.com/logsem/lawyer/blob/6cb30b988c008af9f1ff083c450e616529938355/lawyer/examples/nondet/nondet_adequacy.v#L54)", "source_url": "https://github.com/logsem/lawyer/tree/6cb30b988c008af9f1ff083c450e616529938355/lawyer/examples/nondet", "has_liveness": true}
{"section": "Coq extra cases: causal stores and termination", "group": "Rocq / Lawyer", "name": "Lawyer ticket lock and releasing-lock clients", "specifies": "ticket lock, releasing-lock wrapper, closed and two-lock clients", "safety": "lock/resource specifications and proof scripts", "liveness": "fair termination of closed client and two-lock composition", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "3,528 LOC in 9 `.v` file(s), scope `lawyer/examples/ticketlock`", "source": "[lawyer/examples/ticketlock](https://github.com/logsem/lawyer/tree/6cb30b988c008af9f1ff083c450e616529938355/lawyer/examples/ticketlock)", "source_words": "“Lemma closed_program_terminates_impl (extr : heap_lang_extrace) (START: trfirst extr = ([client_prog RFLInstance' #()], Build_state ∅ ∅)): extrace_fairly_terminating extr.”; [closed_adequacy.v, line 169](https://github.com/logsem/lawyer/blob/6cb30b988c008af9f1ff083c450e616529938355/lawyer/examples/ticketlock/closed_adequacy.v#L169)", "source_url": "https://github.com/logsem/lawyer/tree/6cb30b988c008af9f1ff083c450e616529938355/lawyer/examples/ticketlock", "has_liveness": true}
{"section": "Coq extra cases: causal stores and termination", "group": "Rocq / Lawyer", "name": "Lawyer parallel nondeterministic choice", "specifies": "parallel composition of blocking-choice calls", "safety": "program/model proof", "liveness": "fair termination", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "462 LOC in 2 `.v` file(s), scope `lawyer/examples/nondet/nondet_par_adequacy.v` plus named companion files", "source": "[lawyer/examples/nondet/nondet_par_adequacy.v](https://github.com/logsem/lawyer/blob/6cb30b988c008af9f1ff083c450e616529938355/lawyer/examples/nondet/nondet_par_adequacy.v)", "source_words": "“Theorem nondet_par_termination (extr : heap_lang_extrace) (START: trfirst extr = ([nondet_par #()], Build_state ∅ ∅)) (VALID: extrace_valid extr): extrace_fairly_terminating extr.”; [nondet_par_adequacy.v, line 61](https://github.com/logsem/lawyer/blob/6cb30b988c008af9f1ff083c450e616529938355/lawyer/examples/nondet/nondet_par_adequacy.v#L61)", "source_url": "https://github.com/logsem/lawyer/blob/6cb30b988c008af9f1ff083c450e616529938355/lawyer/examples/nondet/nondet_par_adequacy.v", "has_liveness": true}
{"section": "Coq extra cases: causal stores and termination", "group": "Rocq / Lawyer", "name": "Lawyer two ticket-lock composition", "specifies": "client using two lock instances", "safety": "lock/client proof", "liveness": "fair termination", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "512 LOC in 2 `.v` file(s), scope `lawyer/examples/ticketlock/two_locks_adequacy.v` plus named companion files", "source": "[lawyer/examples/ticketlock/two_locks_adequacy.v](https://github.com/logsem/lawyer/blob/6cb30b988c008af9f1ff083c450e616529938355/lawyer/examples/ticketlock/two_locks_adequacy.v)", "source_words": "“Theorem two_locks_program_terminates: forall extr, trfirst extr = ([client_two RFLInstance'1 RFLInstance'2 #()], Build_state ∅ ∅) -> extrace_fairly_terminating extr.”; [two_locks_adequacy.v, line 199](https://github.com/logsem/lawyer/blob/6cb30b988c008af9f1ff083c450e616529938355/lawyer/examples/ticketlock/two_locks_adequacy.v#L199)", "source_url": "https://github.com/logsem/lawyer/blob/6cb30b988c008af9f1ff083c450e616529938355/lawyer/examples/ticketlock/two_locks_adequacy.v", "has_liveness": true}
{"section": "Coq extra cases: causal stores and termination", "group": "Rocq / Lawyer", "name": "Lawyer wait-free atomic counter", "specifies": "counter increment operation", "safety": "operation specifications and client-validity conditions", "liveness": "wait freedom of increment", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "151 LOC in 2 `.v` file(s), scope `lawyer/nonblocking/examples/counter`", "source": "[lawyer/nonblocking/examples/counter](https://github.com/logsem/lawyer/tree/6cb30b988c008af9f1ff083c450e616529938355/lawyer/nonblocking/examples/counter)", "source_words": "“Theorem counter_is_wait_free (l0: loc := Loc 0) : wait_free (incr l0) (counter_is_init_st l0) NotStuck any_arg.”; [counter_adequacy.v, line 5](https://github.com/logsem/lawyer/blob/6cb30b988c008af9f1ff083c450e616529938355/lawyer/nonblocking/examples/counter/counter_adequacy.v#L5)", "source_url": "https://github.com/logsem/lawyer/tree/6cb30b988c008af9f1ff083c450e616529938355/lawyer/nonblocking/examples/counter", "has_liveness": true}
{"section": "Coq extra cases: causal stores and termination", "group": "Rocq / Lawyer", "name": "Lawyer wait-free reference allocation", "specifies": "reference creation operation", "safety": "operation specifications and client-validity conditions", "liveness": "wait freedom of allocation", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "134 LOC in 2 `.v` file(s), scope `lawyer/nonblocking/examples/mk_ref`", "source": "[lawyer/nonblocking/examples/mk_ref](https://github.com/logsem/lawyer/tree/6cb30b988c008af9f1ff083c450e616529938355/lawyer/nonblocking/examples/mk_ref)", "source_words": "“Theorem mk_ref_is_wait_free: wait_free mk_ref (fun _ => True) NotStuck any_arg.”; [mk_ref_adequacy.v, line 5](https://github.com/logsem/lawyer/blob/6cb30b988c008af9f1ff083c450e616529938355/lawyer/nonblocking/examples/mk_ref/mk_ref_adequacy.v#L5)", "source_url": "https://github.com/logsem/lawyer/tree/6cb30b988c008af9f1ff083c450e616529938355/lawyer/nonblocking/examples/mk_ref", "has_liveness": true}
{"section": "Coq extra cases: causal stores and termination", "group": "Rocq / Lawyer", "name": "Lawyer wait-free higher-order list map with increment", "specifies": "list map parameterized by a wait-free counter operation", "safety": "operation specifications and client-validity conditions", "liveness": "possibly-stuck wait freedom of list_map(incr)", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "549 LOC in 2 `.v` file(s), scope `lawyer/nonblocking/examples/list_map`", "source": "[lawyer/nonblocking/examples/list_map](https://github.com/logsem/lawyer/tree/6cb30b988c008af9f1ff083c450e616529938355/lawyer/nonblocking/examples/list_map)", "source_words": "“Theorem list_map_incr_is_wait_free (l0: loc := Loc 0) : wait_free (λ: \"x\", hl_list_map_cur (incr l0) \"x\")%V (counter_is_init_st l0) MaybeStuck any_arg.”; [list_map_adequacy.v, line 8](https://github.com/logsem/lawyer/blob/6cb30b988c008af9f1ff083c450e616529938355/lawyer/nonblocking/examples/list_map/list_map_adequacy.v#L8)", "source_url": "https://github.com/logsem/lawyer/tree/6cb30b988c008af9f1ff083c450e616529938355/lawyer/nonblocking/examples/list_map", "has_liveness": true}
{"section": "Coq extra cases: causal stores and termination", "group": "Rocq / Lawyer", "name": "Lawyer wait-free simple concurrent queue", "specifies": "queue enqueue/dequeue algorithm and concurrent wrapper clients", "safety": "operation specifications and client-validity conditions", "liveness": "restricted wait freedom, under the source token/client conditions", "tool": "Coq/Rocq proof scripts present; no active admission token found in counted files; source inspection only", "size": "6,085 LOC in 17 `.v` file(s), scope `lawyer/nonblocking/examples/queue`", "source": "[lawyer/nonblocking/examples/queue](https://github.com/logsem/lawyer/tree/6cb30b988c008af9f1ff083c450e616529938355/lawyer/nonblocking/examples/queue)", "source_words": "“Theorem simple_queue_is_restr_wait_free (sq: SimpleQueue) ph pfl: wait_free_restr (queue_ms sq) (is_init_queue_cfg sq ph pfl #0) NotStuck any_arg.”; [simple_queue_adequacy.v, line 7](https://github.com/logsem/lawyer/blob/6cb30b988c008af9f1ff083c450e616529938355/lawyer/nonblocking/examples/queue/simple_queue_adequacy.v#L7)", "source_url": "https://github.com/logsem/lawyer/tree/6cb30b988c008af9f1ff083c450e616529938355/lawyer/nonblocking/examples/queue", "has_liveness": true}
{"section": "Dafny and Verus", "group": "Dafny / IronFleet", "name": "IronLock", "specifies": "a distributed token/lock transferred between hosts", "safety": "refines one serial history of lock holders", "liveness": "no liveness theorem found in this service", "tool": "Dafny theorem proof artifact; proof sources inspected, checker not rerun here", "size": "729 physical lines in 4 .dfy file(s) under `ironfleet/src/Dafny/Distributed/Services/Lock`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "core_system_size": "1,988 physical .dfy lines in 16 files across `Services/Lock`, `Protocol/Lock`, `Impl/Lock`; excludes shared Common/Libraries and C# environment", "source": "[exact artifact](https://github.com/microsoft/Ironclad/tree/2fe4dcdc323b92e93f759cc3e373521366b7f691/ironfleet/src/Dafny/Distributed/Services/Lock); evidence: “s'.history == s.history + [new_lock_holder]” ([source line](https://github.com/microsoft/Ironclad/blob/2fe4dcdc323b92e93f759cc3e373521366b7f691/ironfleet/src/Dafny/Distributed/Services/Lock/AbstractService.s.dfy#L28)); service folder size excludes its Protocol/Impl dependencies", "source_url": "https://github.com/microsoft/Ironclad/tree/2fe4dcdc323b92e93f759cc3e373521366b7f691/ironfleet/src/Dafny/Distributed/Services/Lock", "has_liveness": false}
{"section": "Dafny and Verus", "group": "Dafny / IronFleet", "name": "IronRSL (Paxos replicated state machine)", "specifies": "Paxos replication of an application state machine", "safety": "implementation refines the abstract service state machine", "liveness": "conditional request completion: valid behavior and live queues; non-Zeno time; bounded clock ambiguity; no overflow-protection activation; a sufficiently large live quorum executes periodically; client periodically retransmits a valid request without issuing a higher sequence number; bounded delivery between client and quorum after synchrony starts", "tool": "Dafny theorem proof artifact; proof sources inspected, checker not rerun here", "size": "1,435 physical lines in 5 .dfy file(s) under `ironfleet/src/Dafny/Distributed/Services/RSL`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "core_system_size": "34,890 physical .dfy lines in 128 files across `Services/RSL`, `Protocol/RSL`, `Impl/RSL`; excludes shared Common/Libraries and C# environment", "source": "[exact artifact](https://github.com/microsoft/Ironclad/tree/2fe4dcdc323b92e93f759cc3e373521366b7f691/ironfleet/src/Dafny/Distributed/Services/RSL); evidence: “predicate Service_Next(s:ServiceState, s':ServiceState)” ([source line](https://github.com/microsoft/Ironclad/blob/2fe4dcdc323b92e93f759cc3e373521366b7f691/ironfleet/src/Dafny/Distributed/Services/RSL/AbstractService.s.dfy#L63)); service folder size excludes its Protocol/Impl dependencies", "assumption_evidence": "“Overflow protection is never used” and “the persistent client never sends a request with a higher sequence number” ([full liveness assumptions](https://github.com/microsoft/Ironclad/blob/2fe4dcdc323b92e93f759cc3e373521366b7f691/ironfleet/src/Dafny/Distributed/Protocol/RSL/LivenessProof/Assumptions.i.dfy#L202))", "safety_boundary": "linearizability of executed application operations; “the specification does not require exactly-once semantics” ([service specification](https://github.com/microsoft/Ironclad/blob/2fe4dcdc323b92e93f759cc3e373521366b7f691/ironfleet/src/Dafny/Distributed/Services/RSL/AbstractService.s.dfy#L4)); applications are abstract/axiomatized: “function {:axiom} AppHandleRequest(m:AppState, request:AppRequest) : (AppState, AppReply)” ([application interface](https://github.com/microsoft/Ironclad/blob/2fe4dcdc323b92e93f759cc3e373521366b7f691/ironfleet/src/Dafny/Distributed/Services/RSL/AppStateMachine.s.dfy#L12))", "source_url": "https://github.com/microsoft/Ironclad/tree/2fe4dcdc323b92e93f759cc3e373521366b7f691/ironfleet/src/Dafny/Distributed/Services/RSL", "has_liveness": true}
{"section": "Dafny and Verus", "group": "Dafny / IronFleet", "name": "IronSHT / IronKV", "specifies": "a lease-based sharded key-value/hash-table service", "safety": "implementation refines abstract Get/Set hash-table operations", "liveness": "reliable delivery is proved separately below; do not read it as unconditional request completion", "tool": "Dafny theorem proof artifact; proof sources inspected, checker not rerun here", "size": "2,439 physical lines in 8 .dfy file(s) under `ironfleet/src/Dafny/Distributed/Services/SHT`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "core_system_size": "17,120 physical .dfy lines in 63 files across `Services/SHT`, `Protocol/SHT`, `Impl/SHT`, `Protocol/LiveSHT`, `Impl/LiveSHT`; excludes shared Common/Libraries and C# environment", "source": "[exact artifact](https://github.com/microsoft/Ironclad/tree/2fe4dcdc323b92e93f759cc3e373521366b7f691/ironfleet/src/Dafny/Distributed/Services/SHT); evidence: “predicate Set(h:Hashtable, h':Hashtable, k:Key, ov:OptionalValue)” ([source line](https://github.com/microsoft/Ironclad/blob/2fe4dcdc323b92e93f759cc3e373521366b7f691/ironfleet/src/Dafny/Distributed/Services/SHT/HT.s.dfy#L22)); service folder size excludes its Protocol/Impl dependencies", "source_url": "https://github.com/microsoft/Ironclad/tree/2fe4dcdc323b92e93f759cc3e373521366b7f691/ironfleet/src/Dafny/Distributed/Services/SHT", "has_liveness": true}
{"section": "Dafny and Verus", "group": "Dafny / IronFleet", "name": "IronRSL protocol and refinement", "specifies": "Paxos roles and refinement of the distributed implementation", "safety": "refinement to service specification", "liveness": "conditional request completion: valid behavior and live queues; non-Zeno time; bounded clock ambiguity; no overflow-protection activation; a sufficiently large live quorum executes periodically; client periodically retransmits a valid request without issuing a higher sequence number; bounded delivery between client and quorum after synchrony starts", "tool": "Dafny theorem proof artifact; proof sources inspected, checker not rerun here", "size": "19,116 physical lines in 76 .dfy file(s) under `ironfleet/src/Dafny/Distributed/Protocol/RSL`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/microsoft/Ironclad/tree/2fe4dcdc323b92e93f759cc3e373521366b7f691/ironfleet/src/Dafny/Distributed/Protocol/RSL); evidence: “Proof of liveness, specifically that if a client submits a request” ([source line](https://github.com/microsoft/Ironclad/blob/2fe4dcdc323b92e93f759cc3e373521366b7f691/ironfleet/CODE.md#L77))", "assumption_evidence": "“Overflow protection is never used” and “the persistent client never sends a request with a higher sequence number” ([full liveness assumptions](https://github.com/microsoft/Ironclad/blob/2fe4dcdc323b92e93f759cc3e373521366b7f691/ironfleet/src/Dafny/Distributed/Protocol/RSL/LivenessProof/Assumptions.i.dfy#L202))", "safety_boundary": "linearizability of executed application operations; “the specification does not require exactly-once semantics” ([service specification](https://github.com/microsoft/Ironclad/blob/2fe4dcdc323b92e93f759cc3e373521366b7f691/ironfleet/src/Dafny/Distributed/Services/RSL/AbstractService.s.dfy#L4)); applications are abstract/axiomatized: “function {:axiom} AppHandleRequest(m:AppState, request:AppRequest) : (AppState, AppReply)” ([application interface](https://github.com/microsoft/Ironclad/blob/2fe4dcdc323b92e93f759cc3e373521366b7f691/ironfleet/src/Dafny/Distributed/Services/RSL/AppStateMachine.s.dfy#L12))", "source_url": "https://github.com/microsoft/Ironclad/tree/2fe4dcdc323b92e93f759cc3e373521366b7f691/ironfleet/src/Dafny/Distributed/Protocol/RSL", "has_liveness": true}
{"section": "Dafny and Verus", "group": "Dafny / IronFleet", "name": "IronSHT protocol and refinement", "specifies": "shard delegation, ownership and key-value operations", "safety": "refinement to hash-table specification", "liveness": "no separate protocol-wide request liveness theorem found", "tool": "Dafny theorem proof artifact; proof sources inspected, checker not rerun here", "size": "5,013 physical lines in 14 .dfy file(s) under `ironfleet/src/Dafny/Distributed/Protocol/SHT`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/microsoft/Ironclad/tree/2fe4dcdc323b92e93f759cc3e373521366b7f691/ironfleet/src/Dafny/Distributed/Protocol/SHT); evidence: “Defines the protocol layer of our SHT system” ([source line](https://github.com/microsoft/Ironclad/blob/2fe4dcdc323b92e93f759cc3e373521366b7f691/ironfleet/CODE.md#L86))", "source_url": "https://github.com/microsoft/Ironclad/tree/2fe4dcdc323b92e93f759cc3e373521366b7f691/ironfleet/src/Dafny/Distributed/Protocol/SHT", "has_liveness": false}
{"section": "Dafny and Verus", "group": "Dafny / IronFleet", "name": "LiveSHT reliable-delivery layer", "specifies": "message retransmission, delivery queues and scheduling", "safety": "refines SHT; maintains reliable-delivery bookkeeping", "liveness": "submitted messages eventually reach recipient processing queues under valid behavior, live queues, every host scheduling infinitely often, bounded administrative shard requests, and weak network fairness", "tool": "Dafny theorem proof artifact; proof sources inspected, checker not rerun here", "size": "4,168 physical lines in 22 .dfy file(s) under `ironfleet/src/Dafny/Distributed/Protocol/LiveSHT`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/microsoft/Ironclad/tree/2fe4dcdc323b92e93f759cc3e373521366b7f691/ironfleet/src/Dafny/Distributed/Protocol/LiveSHT); evidence: “that if a message is submitted to the reliable-delivery” ([source line](https://github.com/microsoft/Ironclad/blob/2fe4dcdc323b92e93f759cc3e373521366b7f691/ironfleet/CODE.md#L97))", "assumption_evidence": "“Each host executes its scheduler infinitely often”, “Admin doesn't send too many shard requests”, and “Messages sent infinitely often are delivered infinitely often” ([full liveness assumptions](https://github.com/microsoft/Ironclad/blob/2fe4dcdc323b92e93f759cc3e373521366b7f691/ironfleet/src/Dafny/Distributed/Protocol/LiveSHT/LivenessProof/Assumptions.i.dfy#L113))", "source_url": "https://github.com/microsoft/Ironclad/tree/2fe4dcdc323b92e93f759cc3e373521366b7f691/ironfleet/src/Dafny/Distributed/Protocol/LiveSHT", "has_liveness": true}
{"section": "Dafny and Verus", "group": "Dafny / IronFleet", "name": "IronLock protocol and refinement", "specifies": "lock passing with intermediate protocol/history states", "safety": "implementation refines abstract lock ownership history", "liveness": "not found", "tool": "Dafny theorem proof artifact; proof sources inspected, checker not rerun here", "size": "394 physical lines in 5 .dfy file(s) under `ironfleet/src/Dafny/Distributed/Protocol/Lock`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/microsoft/Ironclad/tree/2fe4dcdc323b92e93f759cc3e373521366b7f691/ironfleet/src/Dafny/Distributed/Protocol/Lock); evidence: “Proof that the implementation refines the specification” ([source line](https://github.com/microsoft/Ironclad/blob/2fe4dcdc323b92e93f759cc3e373521366b7f691/ironfleet/CODE.md#L106))", "source_url": "https://github.com/microsoft/Ironclad/tree/2fe4dcdc323b92e93f759cc3e373521366b7f691/ironfleet/src/Dafny/Distributed/Protocol/Lock", "has_liveness": false}
{"section": "Dafny and Verus", "group": "Verus / Anvil and Welder", "name": "Anvil/Welder ReplicaSet", "specifies": "desired number of matching owned Pods", "safety": "controller request noninterference guarantee; own guarantee is established by CORE, while progress depends on rely conditions", "liveness": "eventually reaches desired resource state and remains there when desired state stays fixed; fairness/environment and dependency assumptions apply", "tool": "Verus theorem proof artifact (temporal logic embedding); proof sources inspected, checker not rerun here", "size": "10,144 physical lines in 25 .rs file(s) under `src/controllers/vreplicaset_controller`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/anvil-verifier/anvil/tree/a597f9de7dbeb056403bd60b0a2ca67f686a5e1f/src/controllers/vreplicaset_controller); evidence: “pub open spec fn vrs_eventually_stable_reconciliation() -> TempPred<ClusterState> {” ([source line](https://github.com/anvil-verifier/anvil/blob/a597f9de7dbeb056403bd60b0a2ca67f686a5e1f/src/controllers/vreplicaset_controller/trusted/liveness_theorem.rs#L13))", "source_url": "https://github.com/anvil-verifier/anvil/tree/a597f9de7dbeb056403bd60b0a2ca67f686a5e1f/src/controllers/vreplicaset_controller", "has_liveness": true}
{"section": "Dafny and Verus", "group": "Verus / Anvil and Welder", "name": "Anvil/Welder Deployment", "specifies": "desired workload via managed ReplicaSets", "safety": "controller request noninterference guarantee; own guarantee is established by CORE, while progress depends on rely conditions", "liveness": "eventually reaches desired resource state and remains there when desired state stays fixed; fairness/environment and dependency assumptions apply", "tool": "Verus theorem proof artifact (temporal logic embedding); proof sources inspected, checker not rerun here", "size": "12,923 physical lines in 30 .rs file(s) under `src/controllers/vdeployment_controller`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/anvil-verifier/anvil/tree/a597f9de7dbeb056403bd60b0a2ca67f686a5e1f/src/controllers/vdeployment_controller); evidence: “pub open spec fn composed_vd_eventually_stable_reconciliation() -> TempPred<ClusterState> {” ([source line](https://github.com/anvil-verifier/anvil/blob/a597f9de7dbeb056403bd60b0a2ca67f686a5e1f/src/controllers/vdeployment_controller/trusted/liveness_theorem.rs#L16))", "source_url": "https://github.com/anvil-verifier/anvil/tree/a597f9de7dbeb056403bd60b0a2ca67f686a5e1f/src/controllers/vdeployment_controller", "has_liveness": true}
{"section": "Dafny and Verus", "group": "Verus / Anvil and Welder", "name": "Anvil/Welder StatefulSet", "specifies": "ordinal Pods and persistent-volume claims", "safety": "controller request noninterference guarantee; own guarantee is established by CORE, while progress depends on rely conditions", "liveness": "eventually reaches desired resource state and remains there when desired state stays fixed; fairness/environment and dependency assumptions apply", "tool": "Verus theorem proof artifact (temporal logic embedding); proof sources inspected, checker not rerun here", "size": "17,229 physical lines in 27 .rs file(s) under `src/controllers/vstatefulset_controller`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/anvil-verifier/anvil/tree/a597f9de7dbeb056403bd60b0a2ca67f686a5e1f/src/controllers/vstatefulset_controller); evidence: “pub open spec fn vsts_eventually_stable_reconciliation() -> TempPred<ClusterState> {” ([source line](https://github.com/anvil-verifier/anvil/blob/a597f9de7dbeb056403bd60b0a2ca67f686a5e1f/src/controllers/vstatefulset_controller/trusted/liveness_theorem.rs#L13))", "source_url": "https://github.com/anvil-verifier/anvil/tree/a597f9de7dbeb056403bd60b0a2ca67f686a5e1f/src/controllers/vstatefulset_controller", "has_liveness": true}
{"section": "Dafny and Verus", "group": "Verus / Anvil and Welder", "name": "Anvil/Welder RabbitMQ controller", "specifies": "Kubernetes resources implementing a RabbitMQ cluster", "safety": "controller request noninterference guarantee; own guarantee is established by CORE, while progress depends on rely conditions; StatefulSet replica count never decreases while the object persists", "liveness": "eventually reaches desired resource state and remains there when desired state stays fixed; fairness/environment and dependency assumptions apply", "tool": "Verus theorem proof artifact (temporal logic embedding); proof sources inspected, checker not rerun here", "size": "14,134 physical lines in 55 .rs file(s) under `src/controllers/rabbitmq_controller`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/anvil-verifier/anvil/tree/a597f9de7dbeb056403bd60b0a2ca67f686a5e1f/src/controllers/rabbitmq_controller); evidence: “pub open spec fn rmq_composed_eventually_stable_reconciliation() -> TempPred<ClusterState> {” ([source line](https://github.com/anvil-verifier/anvil/blob/a597f9de7dbeb056403bd60b0a2ca67f686a5e1f/src/controllers/rabbitmq_controller/trusted/liveness_theorem.rs#L23))", "source_url": "https://github.com/anvil-verifier/anvil/tree/a597f9de7dbeb056403bd60b0a2ca67f686a5e1f/src/controllers/rabbitmq_controller", "has_liveness": true}
{"section": "Dafny and Verus", "group": "Verus / Anvil and Welder", "name": "Welder Deployment + ReplicaSet composition", "specifies": "Deployment progress depends on ReplicaSet reconciliation", "safety": "all component guarantee conditions; proved guarantee-to-rely compatibility", "liveness": "CORE establishes conditional eventually stable reconciliation for the composed controllers", "tool": "Verus composition proof artifact; proof sources inspected, checker not rerun here", "size": "406 physical lines in 1 .rs file(s) under `src/controllers/composition/compose_all.rs`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/anvil-verifier/anvil/blob/a597f9de7dbeb056403bd60b0a2ca67f686a5e1f/src/controllers/composition/compose_all.rs); evidence: “pub proof fn vrs_vd_core_holds(cluster: CoreCluster)” ([source line](https://github.com/anvil-verifier/anvil/blob/a597f9de7dbeb056403bd60b0a2ca67f686a5e1f/src/controllers/composition/compose_all.rs#L176))", "source_url": "https://github.com/anvil-verifier/anvil/blob/a597f9de7dbeb056403bd60b0a2ca67f686a5e1f/src/controllers/composition/compose_all.rs", "has_liveness": true}
{"section": "Dafny and Verus", "group": "Verus / Anvil and Welder", "name": "Welder RabbitMQ + StatefulSet composition", "specifies": "RabbitMQ progress depends on StatefulSet reconciliation", "safety": "all component guarantee conditions; proved guarantee-to-rely compatibility", "liveness": "CORE establishes conditional eventually stable reconciliation for the composed controllers", "tool": "Verus composition proof artifact; proof sources inspected, checker not rerun here", "size": "406 physical lines in 1 .rs file(s) under `src/controllers/composition/compose_all.rs`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/anvil-verifier/anvil/blob/a597f9de7dbeb056403bd60b0a2ca67f686a5e1f/src/controllers/composition/compose_all.rs); evidence: “pub proof fn vsts_rmq_core_holds(cluster: CoreCluster)” ([source line](https://github.com/anvil-verifier/anvil/blob/a597f9de7dbeb056403bd60b0a2ca67f686a5e1f/src/controllers/composition/compose_all.rs#L237))", "source_url": "https://github.com/anvil-verifier/anvil/blob/a597f9de7dbeb056403bd60b0a2ca67f686a5e1f/src/controllers/composition/compose_all.rs", "has_liveness": true}
{"section": "Dafny and Verus", "group": "Verus / Anvil and Welder", "name": "Welder all-four-controller composition", "specifies": "ReplicaSet, Deployment, StatefulSet and RabbitMQ coexist in one cluster", "safety": "all component guarantee conditions; proved guarantee-to-rely compatibility", "liveness": "CORE establishes conditional eventually stable reconciliation for the composed controllers", "tool": "Verus composition proof artifact; proof sources inspected, checker not rerun here", "size": "406 physical lines in 1 .rs file(s) under `src/controllers/composition/compose_all.rs`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/anvil-verifier/anvil/blob/a597f9de7dbeb056403bd60b0a2ca67f686a5e1f/src/controllers/composition/compose_all.rs); evidence: “pub proof fn core_holds()” ([source line](https://github.com/anvil-verifier/anvil/blob/a597f9de7dbeb056403bd60b0a2ca67f686a5e1f/src/controllers/composition/compose_all.rs#L397))", "source_url": "https://github.com/anvil-verifier/anvil/blob/a597f9de7dbeb056403bd60b0a2ca67f686a5e1f/src/controllers/composition/compose_all.rs", "has_liveness": true}
{"section": "Dafny and Verus", "group": "Verus / Anvil and Welder", "name": "Anvil OSDI24 ZooKeeper controller", "specifies": "Kubernetes resource reconciliation for ZooKeeper controller", "safety": "helper invariants/resource ownership and implementation-to-model agreement; not a generic service-level safety guarantee", "liveness": "eventually stable resource matching for a stable desired state, under cluster model assumptions", "tool": "Verus temporal theorem proof artifact; proof sources inspected, checker not rerun here", "size": "12,455 physical lines in 45 .rs file(s) under `src/controller_examples/zookeeper_controller`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/anvil-verifier/anvil/tree/8d27a89a18e8ae07cb609369f3e932fd5e8462b2/src/controller_examples/zookeeper_controller); evidence: “always(lift_state(desired_state_is(zookeeper))).leads_to(always(lift_state(current_state_matches::<M>(zookeeper))))” ([source line](https://github.com/anvil-verifier/anvil/blob/8d27a89a18e8ae07cb609369f3e932fd5e8462b2/src/controller_examples/zookeeper_controller/trusted/liveness_theorem.rs#L18))", "source_url": "https://github.com/anvil-verifier/anvil/tree/8d27a89a18e8ae07cb609369f3e932fd5e8462b2/src/controller_examples/zookeeper_controller", "has_liveness": true}
{"section": "Dafny and Verus", "group": "Verus / Anvil and Welder", "name": "Anvil OSDI24 RabbitMQ controller", "specifies": "Kubernetes resource reconciliation for RabbitMQ controller", "safety": "helper invariants/resource ownership and implementation-to-model agreement; not a generic service-level safety guarantee", "liveness": "eventually stable resource matching for a stable desired state, under cluster model assumptions", "tool": "Verus temporal theorem proof artifact; proof sources inspected, checker not rerun here", "size": "11,488 physical lines in 53 .rs file(s) under `src/controller_examples/rabbitmq_controller`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/anvil-verifier/anvil/tree/8d27a89a18e8ae07cb609369f3e932fd5e8462b2/src/controller_examples/rabbitmq_controller); evidence: “always(lift_state(desired_state_is(rabbitmq))).leads_to(always(lift_state(current_state_matches::<M>(rabbitmq))))” ([source line](https://github.com/anvil-verifier/anvil/blob/8d27a89a18e8ae07cb609369f3e932fd5e8462b2/src/controller_examples/rabbitmq_controller/trusted/liveness_theorem.rs#L18))", "source_url": "https://github.com/anvil-verifier/anvil/tree/8d27a89a18e8ae07cb609369f3e932fd5e8462b2/src/controller_examples/rabbitmq_controller", "has_liveness": true}
{"section": "Dafny and Verus", "group": "Verus / Anvil and Welder", "name": "Anvil OSDI24 FluentBit controller", "specifies": "Kubernetes resource reconciliation for FluentBit controller", "safety": "helper invariants/resource ownership and implementation-to-model agreement; not a generic service-level safety guarantee", "liveness": "eventually stable resource matching for a stable desired state, under cluster model assumptions", "tool": "Verus temporal theorem proof artifact; proof sources inspected, checker not rerun here", "size": "8,529 physical lines in 40 .rs file(s) under `src/controller_examples/fluent_controller/fluentbit`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/anvil-verifier/anvil/tree/8d27a89a18e8ae07cb609369f3e932fd5e8462b2/src/controller_examples/fluent_controller/fluentbit); evidence: “always(lift_state(desired_state_is(fb))).leads_to(always(lift_state(current_state_matches::<M>(fb))))” ([source line](https://github.com/anvil-verifier/anvil/blob/8d27a89a18e8ae07cb609369f3e932fd5e8462b2/src/controller_examples/fluent_controller/fluentbit/trusted/liveness_theorem.rs#L18))", "source_url": "https://github.com/anvil-verifier/anvil/tree/8d27a89a18e8ae07cb609369f3e932fd5e8462b2/src/controller_examples/fluent_controller/fluentbit", "has_liveness": true}
{"section": "Dafny and Verus", "group": "Verus / Anvil and Welder", "name": "Anvil OSDI24 FluentBit configuration controller", "specifies": "Kubernetes resource reconciliation for FluentBit configuration controller", "safety": "helper invariants/resource ownership and implementation-to-model agreement; not a generic service-level safety guarantee", "liveness": "eventually stable resource matching for a stable desired state, under cluster model assumptions", "tool": "Verus temporal theorem proof artifact; proof sources inspected, checker not rerun here", "size": "4,324 physical lines in 29 .rs file(s) under `src/controller_examples/fluent_controller/fluentbit_config`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/anvil-verifier/anvil/tree/8d27a89a18e8ae07cb609369f3e932fd5e8462b2/src/controller_examples/fluent_controller/fluentbit_config); evidence: “always(lift_state(desired_state_is(fbc))).leads_to(always(lift_state(current_state_matches::<M>(fbc))))” ([source line](https://github.com/anvil-verifier/anvil/blob/8d27a89a18e8ae07cb609369f3e932fd5e8462b2/src/controller_examples/fluent_controller/fluentbit_config/trusted/liveness_theorem.rs#L18))", "source_url": "https://github.com/anvil-verifier/anvil/tree/8d27a89a18e8ae07cb609369f3e932fd5e8462b2/src/controller_examples/fluent_controller/fluentbit_config", "has_liveness": true}
{"section": "Dafny and Verus", "group": "Verus / verified system repositories", "name": "IronSHT Rust host-program port", "specifies": "Rust implementation of the IronFleet SHT host state machine", "safety": "implementation-level host correctness only; distributed refinement layer explicitly omitted", "liveness": "no distributed liveness proof in this port", "tool": "Verus host proof artifact; proof sources inspected, checker not rerun here", "size": "10,923 physical lines in 34 .rs file(s) under `ironsht/src`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/verus-lang/verified-ironkv/tree/d99bf9fd65bc64802f9753f400259b7abe5336cb/ironsht/src); evidence: “This repository doesn't replicate” ([source line](https://github.com/verus-lang/verified-ironkv/blob/d99bf9fd65bc64802f9753f400259b7abe5336cb/README.md#L10))", "source_url": "https://github.com/verus-lang/verified-ironkv/tree/d99bf9fd65bc64802f9753f400259b7abe5336cb/ironsht/src", "has_liveness": false}
{"section": "Dafny and Verus", "group": "Verus / verified system repositories", "name": "Verified Node Replication", "specifies": "concurrent replicated in-memory data structure using log and flat combining", "safety": "linearization/refinement to an asynchronous singleton", "liveness": "no termination/starvation-freedom theorem found", "tool": "Verus implementation and refinement proof artifact; proof sources inspected, checker not rerun here", "size": "11,483 physical lines in 18 .rs file(s) under `verified-node-replication/src`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/verus-lang/verified-node-replication/tree/eb8e27244a4f1b7714defe55aa495c6173a1c330/verified-node-replication/src); evidence: “b.wf() && behavior_equiv(a, b) && state_refinement_relation(” ([source line](https://github.com/verus-lang/verified-node-replication/blob/eb8e27244a4f1b7714defe55aa495c6173a1c330/verified-node-replication/src/spec/linearization.rs#L57))", "source_url": "https://github.com/verus-lang/verified-node-replication/tree/eb8e27244a4f1b7714defe55aa495c6173a1c330/verified-node-replication/src", "has_liveness": false}
{"section": "Dafny and Verus", "group": "Verus / verified system repositories", "name": "NR simple-log specification", "specifies": "abstract log of updates and reads", "safety": "state-machine invariants and read/update consistency", "liveness": "not stated in this artifact", "tool": "Verus state-machine/refinement proof artifact; proof sources inspected, checker not rerun here", "size": "341 physical lines in 1 .rs file(s) under `verified-node-replication/src/spec/simple_log.rs`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/verus-lang/verified-node-replication/blob/eb8e27244a4f1b7714defe55aa495c6173a1c330/verified-node-replication/src/spec/simple_log.rs); evidence: “SimpleLog” ([source line](https://github.com/verus-lang/verified-node-replication/blob/eb8e27244a4f1b7714defe55aa495c6173a1c330/verified-node-replication/src/spec/simple_log.rs#L65))", "source_url": "https://github.com/verus-lang/verified-node-replication/blob/eb8e27244a4f1b7714defe55aa495c6173a1c330/verified-node-replication/src/spec/simple_log.rs", "has_liveness": false}
{"section": "Dafny and Verus", "group": "Verus / verified system repositories", "name": "NR unbounded-log protocol", "specifies": "replica execution against an unbounded shared log", "safety": "log/replica invariants", "liveness": "not stated in this artifact", "tool": "Verus state-machine/refinement proof artifact; proof sources inspected, checker not rerun here", "size": "2,063 physical lines in 1 .rs file(s) under `verified-node-replication/src/spec/unbounded_log.rs`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/verus-lang/verified-node-replication/blob/eb8e27244a4f1b7714defe55aa495c6173a1c330/verified-node-replication/src/spec/unbounded_log.rs); evidence: “UnboundedLog” ([source line](https://github.com/verus-lang/verified-node-replication/blob/eb8e27244a4f1b7714defe55aa495c6173a1c330/verified-node-replication/src/spec/unbounded_log.rs#L27))", "source_url": "https://github.com/verus-lang/verified-node-replication/blob/eb8e27244a4f1b7714defe55aa495c6173a1c330/verified-node-replication/src/spec/unbounded_log.rs", "has_liveness": false}
{"section": "Dafny and Verus", "group": "Verus / verified system repositories", "name": "NR unbounded-to-simple log refinement", "specifies": "refinement between two log models", "safety": "observable operations preserve the simpler model", "liveness": "not stated in this artifact", "tool": "Verus state-machine/refinement proof artifact; proof sources inspected, checker not rerun here", "size": "516 physical lines in 1 .rs file(s) under `verified-node-replication/src/spec/unbounded_log_refines_simplelog.rs`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/verus-lang/verified-node-replication/blob/eb8e27244a4f1b7714defe55aa495c6173a1c330/verified-node-replication/src/spec/unbounded_log_refines_simplelog.rs); evidence: “refines” ([source line](https://github.com/verus-lang/verified-node-replication/blob/eb8e27244a4f1b7714defe55aa495c6173a1c330/verified-node-replication/src/spec/unbounded_log_refines_simplelog.rs#L36))", "source_url": "https://github.com/verus-lang/verified-node-replication/blob/eb8e27244a4f1b7714defe55aa495c6173a1c330/verified-node-replication/src/spec/unbounded_log_refines_simplelog.rs", "has_liveness": false}
{"section": "Dafny and Verus", "group": "Verus / verified system repositories", "name": "NR cyclic buffer", "specifies": "bounded log with multiple readers and writers", "safety": "safe reservation, publication and reclamation with reader progress", "liveness": "not stated in this artifact", "tool": "Verus state-machine/refinement proof artifact; proof sources inspected, checker not rerun here", "size": "890 physical lines in 1 .rs file(s) under `verified-node-replication/src/spec/cyclicbuffer.rs`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/verus-lang/verified-node-replication/blob/eb8e27244a4f1b7714defe55aa495c6173a1c330/verified-node-replication/src/spec/cyclicbuffer.rs); evidence: “Log space can be reclaimed once all readers have advanced their read pointers accordingly.” ([source line](https://github.com/verus-lang/verified-node-replication/blob/eb8e27244a4f1b7714defe55aa495c6173a1c330/verified-node-replication/src/spec/cyclicbuffer.rs#L30))", "source_url": "https://github.com/verus-lang/verified-node-replication/blob/eb8e27244a4f1b7714defe55aa495c6173a1c330/verified-node-replication/src/spec/cyclicbuffer.rs", "has_liveness": false}
{"section": "Dafny and Verus", "group": "Verus / verified system repositories", "name": "NR flat combiner", "specifies": "clients post requests; combiner batches operations", "safety": "request/response ownership and client/combiner invariants", "liveness": "not stated in this artifact", "tool": "Verus state-machine/refinement proof artifact; proof sources inspected, checker not rerun here", "size": "408 physical lines in 1 .rs file(s) under `verified-node-replication/src/spec/flat_combiner.rs`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/verus-lang/verified-node-replication/blob/eb8e27244a4f1b7714defe55aa495c6173a1c330/verified-node-replication/src/spec/flat_combiner.rs); evidence: “// The flat combiner state machine” ([source line](https://github.com/verus-lang/verified-node-replication/blob/eb8e27244a4f1b7714defe55aa495c6173a1c330/verified-node-replication/src/spec/flat_combiner.rs#L80))", "source_url": "https://github.com/verus-lang/verified-node-replication/blob/eb8e27244a4f1b7714defe55aa495c6173a1c330/verified-node-replication/src/spec/flat_combiner.rs", "has_liveness": false}
{"section": "Dafny and Verus", "group": "Verus / verified system repositories", "name": "NR readers-writer lock", "specifies": "exclusive writer and distributed reader bookkeeping", "safety": "shared readers agree with storage; exclusive access controls storage", "liveness": "not stated in this artifact", "tool": "Verus state-machine/refinement proof artifact; proof sources inspected, checker not rerun here", "size": "307 physical lines in 1 .rs file(s) under `verified-node-replication/src/spec/rwlock.rs`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/verus-lang/verified-node-replication/blob/eb8e27244a4f1b7714defe55aa495c6173a1c330/verified-node-replication/src/spec/rwlock.rs); evidence: “#[invariant]” ([source line](https://github.com/verus-lang/verified-node-replication/blob/eb8e27244a4f1b7714defe55aa495c6173a1c330/verified-node-replication/src/spec/rwlock.rs#L167))", "source_url": "https://github.com/verus-lang/verified-node-replication/blob/eb8e27244a4f1b7714defe55aa495c6173a1c330/verified-node-replication/src/spec/rwlock.rs", "has_liveness": false}
{"section": "Dafny and Verus", "group": "Verus / verified system repositories", "name": "mimalloc-derived concurrent allocator", "specifies": "multithreaded allocator with thread-owned pages and remote frees", "safety": "ownership tokens, valid page/block state and safe cross-thread free-list transfer; platform/thread-id functions are trusted", "liveness": "no temporal progress theorem located", "tool": "Verus implementation/proof artifact; proof sources inspected, checker not rerun here", "size": "24,418 physical lines in 28 .rs file(s) under `verus-mimalloc`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/verus-lang/verified-memory-allocator/tree/9f99d4c22e26024be4e3e2d40b7501daab570860/verus-mimalloc); evidence: “ * `linked_list.rs` - Implements the free list (including atomic free list and normal free lists)” ([source line](https://github.com/verus-lang/verified-memory-allocator/blob/9f99d4c22e26024be4e3e2d40b7501daab570860/verus-mimalloc/README.md#L25))", "source_url": "https://github.com/verus-lang/verified-memory-allocator/tree/9f99d4c22e26024be4e3e2d40b7501daab570860/verus-mimalloc", "has_liveness": false}
{"section": "Dafny and Verus", "group": "Verus / verified system repositories", "name": "allocator ownership/remote-free protocol", "specifies": "thread, segment, page and block ownership state machine", "safety": "reservation and ownership invariants across thread/page transitions", "liveness": "not stated", "tool": "Verus tokenized-state-machine proof artifact; proof sources inspected, checker not rerun here", "size": "1,664 physical lines in 1 .rs file(s) under `verus-mimalloc/tokens.rs`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/verus-lang/verified-memory-allocator/blob/9f99d4c22e26024be4e3e2d40b7501daab570860/verus-mimalloc/tokens.rs); evidence: “tokenized_state_machine!{ Mim {” ([source line](https://github.com/verus-lang/verified-memory-allocator/blob/9f99d4c22e26024be4e3e2d40b7501daab570860/verus-mimalloc/tokens.rs#L296))", "source_url": "https://github.com/verus-lang/verified-memory-allocator/blob/9f99d4c22e26024be4e3e2d40b7501daab570860/verus-mimalloc/tokens.rs", "has_liveness": false}
{"section": "Dafny and Verus", "group": "Verus / verified system repositories", "name": "allocator atomic free-list protocol", "specifies": "cross-thread transfer of freed blocks in atomic linked lists", "safety": "list shape and allocation token agreement", "liveness": "not stated", "tool": "Verus concurrent implementation/proof artifact; proof sources inspected, checker not rerun here", "size": "2,245 physical lines in 1 .rs file(s) under `verus-mimalloc/linked_list.rs`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/verus-lang/verified-memory-allocator/blob/9f99d4c22e26024be4e3e2d40b7501daab570860/verus-mimalloc/linked_list.rs); evidence: “ * `linked_list.rs` - Implements the free list (including atomic free list and normal free lists)” ([source line](https://github.com/verus-lang/verified-memory-allocator/blob/9f99d4c22e26024be4e3e2d40b7501daab570860/verus-mimalloc/README.md#L25))", "source_url": "https://github.com/verus-lang/verified-memory-allocator/blob/9f99d4c22e26024be4e3e2d40b7501daab570860/verus-mimalloc/linked_list.rs", "has_liveness": false}
{"section": "Dafny and Verus", "group": "Verus / storage crash protocols (adjacent scope)", "name": "pmemlog crash-consistent append-only log", "specifies": "persistent-memory append-only log", "safety": "append-only abstract behavior across crashes; metadata corruption detection", "liveness": "none stated in repository README", "tool": "Verus proof artifact; proof sources inspected, checker not rerun here", "size": "3,415 physical lines in 9 .rs file(s) under `pmemlog/src`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/microsoft/verified-storage/tree/41cab95051229ebd457b4eed7fc111e3e7c9099c/pmemlog/src); evidence: “* `pmemlog` implements a persistent-memory append-only log. It handles crash” ([source line](https://github.com/microsoft/verified-storage/blob/41cab95051229ebd457b4eed7fc111e3e7c9099c/README.md#L13))", "source_url": "https://github.com/microsoft/verified-storage/tree/41cab95051229ebd457b4eed7fc111e3e7c9099c/pmemlog/src", "has_liveness": false}
{"section": "Dafny and Verus", "group": "Verus / storage crash protocols (adjacent scope)", "name": "multilog atomic append protocol", "specifies": "transactions appending to multiple persistent-memory logs", "safety": "atomic commits across logs despite crashes", "liveness": "none stated in repository README", "tool": "Verus proof artifact; proof sources inspected, checker not rerun here", "size": "11,332 physical lines in 23 .rs file(s) under `multilog/multilog/src`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/microsoft/verified-storage/tree/41cab95051229ebd457b4eed7fc111e3e7c9099c/multilog/multilog/src); evidence: “  atomically committing appends across those logs.” ([source line](https://github.com/microsoft/verified-storage/blob/41cab95051229ebd457b4eed7fc111e3e7c9099c/README.md#L20))", "source_url": "https://github.com/microsoft/verified-storage/tree/41cab95051229ebd457b4eed7fc111e3e7c9099c/multilog/multilog/src", "has_liveness": false}
{"section": "Dafny and Verus", "group": "Verus / storage crash protocols (adjacent scope)", "name": "CapybaraKV persistent key-value store", "specifies": "persistent-memory key-value store", "safety": "crash consistency and bit-corruption handling", "liveness": "none stated in repository README", "tool": "Verus proof artifact; proof sources inspected, checker not rerun here", "size": "33,702 physical lines in 95 .rs file(s) under `capybaraKV/capybarakv/src`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/microsoft/verified-storage/tree/41cab95051229ebd457b4eed7fc111e3e7c9099c/capybaraKV/capybarakv/src); evidence: “* `capybaraKV` is a persistent-memory key-value store, handling crash” ([source line](https://github.com/microsoft/verified-storage/blob/41cab95051229ebd457b4eed7fc111e3e7c9099c/README.md#L22))", "source_url": "https://github.com/microsoft/verified-storage/tree/41cab95051229ebd457b4eed7fc111e3e7c9099c/capybaraKV/capybarakv/src", "has_liveness": false}
{"section": "Dafny and Verus", "group": "Dafny / persistent notary protocol", "name": "CapybaraNS", "specifies": "persistent notary associating increasing counter values with messages and signing them", "safety": "successful advance increments counter by one; signatures bind counter and last message; crash/corruption handling", "liveness": "no temporal liveness theorem found", "tool": "Dafny proof artifact; proof sources inspected, checker not rerun here", "size": "2,283 physical lines in 12 .dfy file(s) under `capybaraNS/src`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/microsoft/verified-storage/tree/41cab95051229ebd457b4eed7fc111e3e7c9099c/capybaraNS/src); evidence: “&& state'.counter as int == state.counter as int + 1” ([source line](https://github.com/microsoft/verified-storage/blob/41cab95051229ebd457b4eed7fc111e3e7c9099c/capybaraNS/src/NotaryServer/NotarySpec_t.dfy#L80))", "source_url": "https://github.com/microsoft/verified-storage/tree/41cab95051229ebd457b4eed7fc111e3e7c9099c/capybaraNS/src", "has_liveness": false}
{"section": "Dafny and Verus", "group": "Verus / concrete concurrency and distributed examples", "name": "ring leader election", "specifies": "max-ID messages around a ring", "safety": "at most one leader", "liveness": "no temporal progress theorem stated", "tool": "Verus proof artifact; proof sources inspected, checker not rerun here", "size": "182 physical lines in 1 .rs file(s) under `examples/state_machines/leader_election_complete.rs`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/state_machines/leader_election_complete.rs); evidence: “self.is_leader(i) && self.is_leader(j) ==> i == j” ([source line](https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/state_machines/leader_election_complete.rs#L82))", "source_url": "https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/state_machines/leader_election_complete.rs", "has_liveness": false}
{"section": "Dafny and Verus", "group": "Verus / concrete concurrency and distributed examples", "name": "Peterson mutual exclusion", "specifies": "two-thread flag-and-turn lock", "safety": "never both threads in critical section", "liveness": "no temporal progress theorem stated", "tool": "Verus proof artifact; proof sources inspected, checker not rerun here", "size": "176 physical lines in 1 .rs file(s) under `examples/state_machines/petersons_algorithm.rs`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/state_machines/petersons_algorithm.rs); evidence: “&&& !(self.thread_0 === ThreadState::Critical && self.thread_1 === ThreadState::Critical)” ([source line](https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/state_machines/petersons_algorithm.rs#L31))", "source_url": "https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/state_machines/petersons_algorithm.rs", "has_liveness": false}
{"section": "Dafny and Verus", "group": "Verus / concrete concurrency and distributed examples", "name": "distributed readers-writer lock", "specifies": "lock with a collection of reference counters", "safety": "exclusive writer ownership and consistency of distributed reader counts", "liveness": "no temporal progress theorem stated", "tool": "Verus proof artifact; proof sources inspected, checker not rerun here", "size": "407 physical lines in 1 .rs file(s) under `examples/state_machines/dist_rwlock.rs`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/state_machines/dist_rwlock.rs); evidence: “pub fn shared_counts_agree(&self) -> bool {” ([source line](https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/state_machines/dist_rwlock.rs#L177))", "source_url": "https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/state_machines/dist_rwlock.rs", "has_liveness": false}
{"section": "Dafny and Verus", "group": "Verus / concrete concurrency and distributed examples", "name": "tokenized readers-writer lock", "specifies": "reader/writer flag state machine", "safety": "reader-count/storage agreement and exclusive writer permission", "liveness": "no temporal progress theorem stated", "tool": "Verus proof artifact; proof sources inspected, checker not rerun here", "size": "197 physical lines in 1 .rs file(s) under `examples/state_machines/rwlock.rs`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/state_machines/rwlock.rs); evidence: “pub fn count_matches(&self) -> bool {” ([source line](https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/state_machines/rwlock.rs#L152))", "source_url": "https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/state_machines/rwlock.rs", "has_liveness": false}
{"section": "Dafny and Verus", "group": "Verus / concrete concurrency and distributed examples", "name": "flat combining", "specifies": "clients submit requests into slots for a combiner", "safety": "request/response correspondence and token ownership", "liveness": "no temporal progress theorem stated", "tool": "Verus proof artifact; proof sources inspected, checker not rerun here", "size": "461 physical lines in 1 .rs file(s) under `examples/state_machines/flat_combine.rs`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/state_machines/flat_combine.rs); evidence: “pub fn request_stored_inv” ([source line](https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/state_machines/flat_combine.rs#L144))", "source_url": "https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/state_machines/flat_combine.rs", "has_liveness": false}
{"section": "Dafny and Verus", "group": "Verus / concrete concurrency and distributed examples", "name": "atomic reference counting", "specifies": "reference-counted shared allocation", "safety": "count matches readers; valid readers retain stored allocation", "liveness": "no temporal progress theorem stated", "tool": "Verus proof artifact; proof sources inspected, checker not rerun here", "size": "331 physical lines in 1 .rs file(s) under `examples/state_machines/arc.rs`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/state_machines/arc.rs); evidence: “pub fn counter_agrees_reader_count” ([source line](https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/state_machines/arc.rs#L50)); caveat: source explicitly uses `assume(count < 100000000)` for reference-count overflow", "source_url": "https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/state_machines/arc.rs", "has_liveness": false}
{"section": "Dafny and Verus", "group": "Verus / concrete concurrency and distributed examples", "name": "counting permissions", "specifies": "split/recombine shared read permissions", "safety": "read/write modes control exclusive stored value", "liveness": "no temporal progress theorem stated", "tool": "Verus proof artifact; proof sources inspected, checker not rerun here", "size": "267 physical lines in 1 .rs file(s) under `examples/state_machines/counting.rs`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/state_machines/counting.rs); evidence: “pub spec fn main_inv” ([source line](https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/state_machines/counting.rs#L95))", "source_url": "https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/state_machines/counting.rs", "has_liveness": false}
{"section": "Dafny and Verus", "group": "Verus / concrete concurrency and distributed examples", "name": "interning with shared fragments", "specifies": "canonical values and fragment handles", "safety": "equal handles iff equal values; stored entries distinct", "liveness": "no temporal progress theorem stated", "tool": "Verus proof artifact; proof sources inspected, checker not rerun here", "size": "293 physical lines in 1 .rs file(s) under `examples/state_machines/interner.rs`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/state_machines/interner.rs); evidence: “assert((idx1 == idx2) <==> (val1 === val2));” ([source line](https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/state_machines/interner.rs#L57))", "source_url": "https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/state_machines/interner.rs", "has_liveness": false}
{"section": "Dafny and Verus", "group": "Verus / concrete concurrency and distributed examples", "name": "SPSC FIFO queue", "specifies": "single-producer/single-consumer ring-buffer queue", "safety": "producer and consumer do not overlap occupied cells; in-bounds pointers", "liveness": "no temporal progress theorem stated", "tool": "Verus proof artifact; proof sources inspected, checker not rerun here", "size": "766 physical lines in 1 .rs file(s) under `examples/state_machines/tutorial/fifo.rs`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/state_machines/tutorial/fifo.rs); evidence: “pub fn not_overlapping(&self) -> bool {” ([source line](https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/state_machines/tutorial/fifo.rs#L86))", "source_url": "https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/state_machines/tutorial/fifo.rs", "has_liveness": false}
{"section": "Dafny and Verus", "group": "Verus / concrete concurrency and distributed examples", "name": "two-thread counter", "specifies": "two atomic increments and joins", "safety": "final observed count is 2 after joining both threads", "liveness": "no temporal progress theorem stated", "tool": "Verus proof artifact; proof sources inspected, checker not rerun here", "size": "209 physical lines in 1 .rs file(s) under `examples/state_machines/tutorial/counting_to_2.rs`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/state_machines/tutorial/counting_to_2.rs); evidence: “assert(x == 2);” ([source line](https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/state_machines/tutorial/counting_to_2.rs#L205))", "source_url": "https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/state_machines/tutorial/counting_to_2.rs", "has_liveness": false}
{"section": "Dafny and Verus", "group": "Verus / concrete concurrency and distributed examples", "name": "N-thread counter implementation", "specifies": "N atomic increments and joins", "safety": "final observed count equals number of threads", "liveness": "no temporal progress theorem stated", "tool": "Verus proof artifact; proof sources inspected, checker not rerun here", "size": "224 physical lines in 1 .rs file(s) under `examples/state_machines/tutorial/counting_to_n.rs`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/state_machines/tutorial/counting_to_n.rs); evidence: “assert(x == num_threads);” ([source line](https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/state_machines/tutorial/counting_to_n.rs#L216))", "source_url": "https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/state_machines/tutorial/counting_to_n.rs", "has_liveness": false}
{"section": "Dafny and Verus", "group": "Verus / concrete concurrency and distributed examples", "name": "N-thread counter abstract model", "specifies": "atomic increment state machine", "safety": "counter equals number of completed increments", "liveness": "no temporal progress theorem stated", "tool": "Verus proof artifact; proof sources inspected, checker not rerun here", "size": "62 physical lines in 1 .rs file(s) under `examples/state_machines/tutorial/counting_to_n_atomic.rs`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/state_machines/tutorial/counting_to_n_atomic.rs); evidence: “assert(pre.counter == pre.num_threads);” ([source line](https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/state_machines/tutorial/counting_to_n_atomic.rs#L48))", "source_url": "https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/state_machines/tutorial/counting_to_n_atomic.rs", "has_liveness": false}
{"section": "Dafny and Verus", "group": "Verus / concrete concurrency and distributed examples", "name": "reference counting (non-atomic)", "specifies": "allocation shared with cloned reference handles", "safety": "reference count matches permissions; deallocate only at final reference", "liveness": "no temporal progress theorem stated", "tool": "Verus proof artifact; proof sources inspected, checker not rerun here", "size": "335 physical lines in 1 .rs file(s) under `examples/state_machines/tutorial/rc.rs`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/state_machines/tutorial/rc.rs); evidence: “pub fn counter_agrees_reader_count” ([source line](https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/state_machines/tutorial/rc.rs#L49)); caveat: source explicitly uses `assume(count < 100000000)` for reference-count overflow", "source_url": "https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/state_machines/tutorial/rc.rs", "has_liveness": false}
{"section": "Dafny and Verus", "group": "Verus / concrete concurrency and distributed examples", "name": "RefCell dynamic borrowing", "specifies": "runtime shared/mutable borrow flag protocol", "safety": "exclusive mutable borrow or matching shared borrow permissions", "liveness": "no temporal progress theorem stated", "tool": "Verus proof artifact; proof sources inspected, checker not rerun here", "size": "435 physical lines in 1 .rs file(s) under `examples/state_machines/tutorial/ref_cell.rs`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/state_machines/tutorial/ref_cell.rs); evidence: “pub fn flag_inv” ([source line](https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/state_machines/tutorial/ref_cell.rs#L52))", "source_url": "https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/state_machines/tutorial/ref_cell.rs", "has_liveness": false}
{"section": "Dafny and Verus", "group": "Verus / concrete concurrency and distributed examples", "name": "spin lock with explicit atomic permissions", "specifies": "CAS-protected mutable cell", "safety": "unique cell permission while lock held", "liveness": "no temporal progress theorem stated", "tool": "Verus proof artifact; proof sources inspected, checker not rerun here", "size": "101 physical lines in 1 .rs file(s) under `examples/basic_lock1.rs`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/basic_lock1.rs); evidence: “impl<T> InvariantPredicate” ([source line](https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/basic_lock1.rs#L13))", "source_url": "https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/basic_lock1.rs", "has_liveness": false}
{"section": "Dafny and Verus", "group": "Verus / concrete concurrency and distributed examples", "name": "spin lock with atomic ghost state", "specifies": "CAS-protected mutable cell", "safety": "lock flag corresponds to stored cell permission", "liveness": "no temporal progress theorem stated", "tool": "Verus proof artifact; proof sources inspected, checker not rerun here", "size": "77 physical lines in 1 .rs file(s) under `examples/basic_lock2.rs`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/basic_lock2.rs); evidence: “pub atomic: AtomicBool” ([source line](https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/basic_lock2.rs#L12))", "source_url": "https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/basic_lock2.rs", "has_liveness": false}
{"section": "Dafny and Verus", "group": "Verus / concrete concurrency and distributed examples", "name": "atomic ghost spin lock", "specifies": "atomic boolean protecting optional value", "safety": "flag/value ownership invariant", "liveness": "no temporal progress theorem stated", "tool": "Verus proof artifact; proof sources inspected, checker not rerun here", "size": "139 physical lines in 1 .rs file(s) under `examples/atomics.rs`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/atomics.rs); evidence: “b === t is Some” ([source line](https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/atomics.rs#L18))", "source_url": "https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/atomics.rs", "has_liveness": false}
{"section": "Dafny and Verus", "group": "Verus / concrete concurrency and distributed examples", "name": "vstd readers-writer lock use", "specifies": "clients acquire/release library lock", "safety": "only invariant-satisfying values stored", "liveness": "no temporal progress theorem stated", "tool": "Verus proof artifact; proof sources inspected, checker not rerun here", "size": "65 physical lines in 1 .rs file(s) under `examples/rwlock_vstd.rs`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/rwlock_vstd.rs); evidence: “let lock = RwLock::<u64, spec_fn(u64) -> bool>::new(5, Ghost(|v| v == 5 || v == 13));” ([source line](https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/rwlock_vstd.rs#L12))", "source_url": "https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/rwlock_vstd.rs", "has_liveness": false}
{"section": "Dafny and Verus", "group": "Verus / concrete concurrency and distributed examples", "name": "storage-cache readers-writer protocol", "specifies": "cache bucket loading, shared reads, writeback and exclusive access", "safety": "bucket/reference-count/storage invariants", "liveness": "no temporal progress theorem stated", "tool": "Verus experimental specification/proof source; test harness explicitly marks it ignored; successful machine checking not established; proof sources inspected, checker not rerun here", "size": "1,180 physical lines in 1 .rs file(s) under `examples/scache/rwlock.rs`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/scache/rwlock.rs); evidence: “pub spec fn ref_count_invariant” ([source line](https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/scache/rwlock.rs#L554))", "source_url": "https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/scache/rwlock.rs", "has_liveness": false}
{"section": "Dafny and Verus", "group": "Verus / concrete concurrency and distributed examples", "name": "authoritative/fragment disk permissions", "specifies": "ghost map representing disk with fragments", "safety": "fragment permissions agree with authoritative map", "liveness": "no temporal progress theorem stated", "tool": "Verus experimental specification/proof source; test harness explicitly marks it ignored; successful machine checking not established; proof sources inspected, checker not rerun here", "size": "294 physical lines in 1 .rs file(s) under `examples/state_machines/disk_example.rs`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/state_machines/disk_example.rs); evidence: “AuthFrag” ([source line](https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/state_machines/disk_example.rs#L17))", "source_url": "https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/state_machines/disk_example.rs", "has_liveness": false}
{"section": "Dafny and Verus", "group": "Verus / concrete concurrency and distributed examples", "name": "concurrent lazy initialization", "specifies": "once-only initialization shared between threads", "safety": "0/1/2 atomic state matches uninitialized/initializing/initialized cell ownership", "liveness": "no termination theorem for waiting on initializer", "tool": "Verus atomic invariant proof artifact; proof sources inspected, checker not rerun here", "size": "173 physical lines in 1 .rs file(s) under `examples/statics.rs`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/statics.rs); evidence: “GhostState::Initialized(points_to) => {” ([source line](https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/statics.rs#L50))", "source_url": "https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/statics.rs", "has_liveness": false}
{"section": "Dafny and Verus", "group": "Verus / ghost coordination protocols", "name": "agreement resource", "specifies": "constant-value knowledge shared across threads", "safety": "resources for the same instance agree on value", "liveness": "no eventual-completion theorem stated", "tool": "Verus ghost proof API artifact; proof sources inspected, checker not rerun here", "size": "168 physical lines in 1 .rs file(s) under `examples/pcm/agreement.rs`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/pcm/agreement.rs); evidence: “//! An agreement resource constitutes knowledge of a constant value.” ([source line](https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/pcm/agreement.rs#L4))", "source_url": "https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/pcm/agreement.rs", "has_liveness": false}
{"section": "Dafny and Verus", "group": "Verus / ghost coordination protocols", "name": "append-only log resource", "specifies": "split append authority and shared prefix knowledge", "safety": "appends preserve known prefixes", "liveness": "no eventual-completion theorem stated", "tool": "Verus ghost proof API artifact; proof sources inspected, checker not rerun here", "size": "293 physical lines in 1 .rs file(s) under `examples/pcm/log.rs`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/pcm/log.rs); evidence: “pub proof fn deduce_prefix_relation” ([source line](https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/pcm/log.rs#L254))", "source_url": "https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/pcm/log.rs", "has_liveness": false}
{"section": "Dafny and Verus", "group": "Verus / ghost coordination protocols", "name": "monotonic counter resource", "specifies": "split increment authority and shared lower-bound knowledge", "safety": "counter only increases and lower bounds remain valid", "liveness": "no eventual-completion theorem stated", "tool": "Verus ghost proof API artifact; proof sources inspected, checker not rerun here", "size": "356 physical lines in 1 .rs file(s) under `examples/pcm/monotonic_counter.rs`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/pcm/monotonic_counter.rs); evidence: “pub proof fn lemma_lower_bound” ([source line](https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/pcm/monotonic_counter.rs#L305))", "source_url": "https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/pcm/monotonic_counter.rs", "has_liveness": false}
{"section": "Dafny and Verus", "group": "Verus / ghost coordination protocols", "name": "one-shot completion resource", "specifies": "split one-time completion authority", "safety": "completion cannot be undone; halves combine into authority", "liveness": "no eventual-completion theorem stated", "tool": "Verus ghost proof API artifact; proof sources inspected, checker not rerun here", "size": "284 physical lines in 1 .rs file(s) under `examples/pcm/oneshot.rs`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/pcm/oneshot.rs); evidence: “pub proof fn perform_using_two_halves” ([source line](https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/pcm/oneshot.rs#L209))", "source_url": "https://github.com/verus-lang/verus/blob/840fa612cd962b12be913429a1bd3e60f0196ebb/examples/pcm/oneshot.rs", "has_liveness": false}
{"section": "Dafny and Verus", "group": "Dafny / remote attestation protocols", "name": "Ironclad remote notary", "specifies": "remote signed monotonically increasing counter associated with messages", "safety": "counter increments by one and returned statement/signature bind message to new counter", "liveness": "no temporal progress theorem located", "tool": "Dafny proof artifact in verified Ironclad stack; proof sources inspected, checker not rerun here", "size": "743 physical lines in 8 .dfy file(s) under `ironclad-apps/src/Dafny/Apps/Notary`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/microsoft/Ironclad/tree/2fe4dcdc323b92e93f759cc3e373521366b7f691/ironclad-apps/src/Dafny/Apps/Notary); evidence: “out_state.counter == in_state.counter + 1 &&” ([source line](https://github.com/microsoft/Ironclad/blob/2fe4dcdc323b92e93f759cc3e373521366b7f691/ironclad-apps/src/Dafny/Apps/Notary/Notary.s.dfy#L41))", "source_url": "https://github.com/microsoft/Ironclad/tree/2fe4dcdc323b92e93f759cc3e373521366b7f691/ironclad-apps/src/Dafny/Apps/Notary", "has_liveness": false}
{"section": "Dafny and Verus", "group": "Dafny / remote attestation protocols", "name": "Ironclad TrInc counter attestation", "specifies": "authorized per-client monotonic counters and signed attestations", "safety": "only authorized signatures advance counters; counters cannot decrease; attestation binds old/new value and message", "liveness": "no temporal progress theorem located", "tool": "Dafny proof artifact in verified Ironclad stack; proof sources inspected, checker not rerun here", "size": "1,441 physical lines in 7 .dfy file(s) under `ironclad-apps/src/Dafny/Apps/TrInc`; includes blanks, comments, specifications, proofs and executable code; shared libraries excluded", "source": "[exact artifact](https://github.com/microsoft/Ironclad/tree/2fe4dcdc323b92e93f759cc3e373521366b7f691/ironclad-apps/src/Dafny/Apps/TrInc); evidence: “in_state.counters[counter_index_in].counter_value <= new_counter_value_in &&” ([source line](https://github.com/microsoft/Ironclad/blob/2fe4dcdc323b92e93f759cc3e373521366b7f691/ironclad-apps/src/Dafny/Apps/TrInc/TrInc.s.dfy#L86))", "source_url": "https://github.com/microsoft/Ironclad/tree/2fe4dcdc323b92e93f759cc3e373521366b7f691/ironclad-apps/src/Dafny/Apps/TrInc", "has_liveness": false}
{"section": "Isabelle/HOL source cases", "group": "", "name": "Heard-Of / Ate", "specifies": "round-based fault-tolerant consensus under the algorithm’s communication predicates", "safety": "agreement and validity: correct decisions do not conflict and satisfy the input restriction", "liveness": "termination under the stated heard-of communication predicates", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here; explicit axioms found", "size": "1,041 physical lines across 2 .thy files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/isabelle-prover/mirror-afp-devel/tree/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Heard_Of/ate)", "provenance": "AFP entry “Verifying Fault-Tolerant Distributed Algorithms in the Heard-Of Model”, dated 2012-07-27; authors Henri Debrat, Stephan Merz; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/Heard_Of.toml)", "proof_statement_excerpt": "`theorem ate_agreement: assumes run: \"SHORun Ate_M rho HOs SHOs\" and comm: \"\\<forall>r. SHOcommPerRd Ate_M (HOs r) (SHOs r)\" and p: \"decide (rho m p) = Some v\" and q: \"decide (rho n q) = Some w\" shows \"w = v\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Heard_Of/ate/AteProof.thy#L554)) | `theorem ate_validity: assumes run: \"SHORun Ate_M rho HOs SHOs\" and comm: \"\\<forall>r. SHOcommPerRd Ate_M (HOs r) (SHOs r)\" and initv: \"\\<forall>q. x (rho 0 q) = v\" and dp: \"decide (rho r p) = Some w\" shows \"w = v\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Heard_Of/ate/AteProof.thy#L261)) | `theorem ate_termination: assumes run: \"SHORun Ate_M rho HOs SHOs\" and commR: \"\\<forall>r. (SHOcommPerRd::((Proc, 'val::linorder pstate, 'val) SHOMachine) \\<Rightarrow> (Proc HO) \\<Rightarrow> (Proc HO) \\<Rightarrow> bool) Ate_M (HOs r) (SHOs r)\" and commG: \"SHOcommGlobal Ate_M HOs SHOs\" shows \"\\<exists>r v. decide (rho r p) = Some v\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Heard_Of/ate/AteProof.thy#L591))", "axiom_evidence": "`axiomatization where Proc_finite: \"OFCLASS(Proc, finite_class)\"` ([source line](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Heard_Of/ate/AteDefs.thy#L30)); 1 matching source lines in this row’s scope (lexical scan, not a dependency audit)", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/tree/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Heard_Of/ate", "has_liveness": true}
{"section": "Isabelle/HOL source cases", "group": "", "name": "Heard-Of / Ute", "specifies": "round-based fault-tolerant consensus under the algorithm’s communication predicates", "safety": "agreement and validity: correct decisions do not conflict and satisfy the input restriction", "liveness": "termination under the stated heard-of communication predicates", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here; explicit axioms found", "size": "1,394 physical lines across 2 .thy files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/isabelle-prover/mirror-afp-devel/tree/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Heard_Of/ute)", "provenance": "AFP entry “Verifying Fault-Tolerant Distributed Algorithms in the Heard-Of Model”, dated 2012-07-27; authors Henri Debrat, Stephan Merz; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/Heard_Of.toml)", "proof_statement_excerpt": "`theorem ute_agreement: assumes run: \"SHORun Ute_M rho HOs SHOs\" and comm: \"\\<forall>r. SHOcommPerRd Ute_M (HOs r) (SHOs r)\" and p: \"decide (rho m p) = Some v\" and q: \"decide (rho n q) = Some w\" shows \"v = w\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Heard_Of/ute/UteProof.thy#L612)) | `theorem ute_validity: assumes run: \"SHORun Ute_M rho HOs SHOs\" and comm: \"\\<forall>r. SHOcommPerRd Ute_M (HOs r) (SHOs r)\" and init: \"\\<forall>p. x (rho 0 p) = v\" and dw: \"decide (rho r p) = Some w\" shows \"v = w\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Heard_Of/ute/UteProof.thy#L744)) | `theorem ute_termination: assumes run: \"SHORun Ute_M rho HOs SHOs\" and commR: \"\\<forall>r. SHOcommPerRd Ute_M (HOs r) (SHOs r)\" and commG: \"SHOcommGlobal Ute_M HOs SHOs\" shows \"\\<exists>r v. decide (rho r p) = Some v\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Heard_Of/ute/UteProof.thy#L988))", "axiom_evidence": "`axiomatization where Proc_finite: \"OFCLASS(Proc, finite_class)\"` ([source line](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Heard_Of/ute/UteDefs.thy#L30)); 1 matching source lines in this row’s scope (lexical scan, not a dependency audit)", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/tree/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Heard_Of/ute", "has_liveness": true}
{"section": "Isabelle/HOL source cases", "group": "", "name": "Heard-Of / UniformVoting", "specifies": "round-based fault-tolerant consensus under the algorithm’s communication predicates", "safety": "agreement and validity: correct decisions do not conflict and satisfy the input restriction", "liveness": "termination under the stated heard-of communication predicates", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here; explicit axioms found", "size": "933 physical lines across 2 .thy files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/isabelle-prover/mirror-afp-devel/tree/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Heard_Of/uv)", "provenance": "AFP entry “Verifying Fault-Tolerant Distributed Algorithms in the Heard-Of Model”, dated 2012-07-27; authors Henri Debrat, Stephan Merz; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/Heard_Of.toml)", "proof_statement_excerpt": "`theorem uv_agreement: assumes run: \"HORun UV_M rho HOs\" and com: \"\\<forall>r. HOcommPerRd UV_M (HOs r)\" and p: \"decide (rho m p) = Some v\" and q: \"decide (rho n q) = Some w\" shows \"v = w\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Heard_Of/uv/UvProof.thy#L487)) | `theorem uv_termination: assumes run: \"HORun UV_M rho HOs\" and commR: \"\\<forall>r. HOcommPerRd UV_M (HOs r)\" and commG: \"HOcommGlobal UV_M HOs\" shows \"\\<exists>r v. decide (rho r p) = Some v\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Heard_Of/uv/UvProof.thy#L604))", "axiom_evidence": "`axiomatization where Proc_finite: \"OFCLASS(Proc, finite_class)\"` ([source line](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Heard_Of/uv/UvDefs.thy#L25)); 1 matching source lines in this row’s scope (lexical scan, not a dependency audit)", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/tree/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Heard_Of/uv", "has_liveness": true}
{"section": "Isabelle/HOL source cases", "group": "", "name": "Heard-Of / OneThirdRule", "specifies": "round-based fault-tolerant consensus under the algorithm’s communication predicates", "safety": "agreement and validity: correct decisions do not conflict and satisfy the input restriction", "liveness": "termination under the stated heard-of communication predicates", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here; explicit axioms found", "size": "708 physical lines across 2 .thy files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/isabelle-prover/mirror-afp-devel/tree/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Heard_Of/otr)", "provenance": "AFP entry “Verifying Fault-Tolerant Distributed Algorithms in the Heard-Of Model”, dated 2012-07-27; authors Henri Debrat, Stephan Merz; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/Heard_Of.toml)", "proof_statement_excerpt": "`theorem OTR_agreement: assumes run:\"HORun OTR_M rho HOs\" and p: \"decide (rho n p) = Some v\" and p': \"decide (rho m p') = Some w\" shows \"v = w\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Heard_Of/otr/OneThirdRuleProof.thy#L372)) | `theorem OTR_termination: assumes run: \"HORun OTR_M rho HOs\" and commG: \"HOcommGlobal OTR_M HOs\" shows \"\\<exists>r v. decide (rho r p) = Some v\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Heard_Of/otr/OneThirdRuleProof.thy#L404))", "axiom_evidence": "`axiomatization where Proc_finite: \"OFCLASS(Proc, finite_class)\"` ([source line](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Heard_Of/otr/OneThirdRuleDefs.thy#L29)); 1 matching source lines in this row’s scope (lexical scan, not a dependency audit)", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/tree/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Heard_Of/otr", "has_liveness": true}
{"section": "Isabelle/HOL source cases", "group": "", "name": "Heard-Of / LastVoting", "specifies": "round-based fault-tolerant consensus under the algorithm’s communication predicates", "safety": "agreement and validity: correct decisions do not conflict and satisfy the input restriction", "liveness": "termination under the stated heard-of communication predicates", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here; explicit axioms found", "size": "1,936 physical lines across 2 .thy files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/isabelle-prover/mirror-afp-devel/tree/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Heard_Of/lastvoting)", "provenance": "AFP entry “Verifying Fault-Tolerant Distributed Algorithms in the Heard-Of Model”, dated 2012-07-27; authors Henri Debrat, Stephan Merz; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/Heard_Of.toml)", "proof_statement_excerpt": "`theorem lv_agreement: assumes run: \"CHORun LV_M rho HOs coords\" and p: \"decide (rho m p) = Some v\" and q: \"decide (rho n q) = Some w\" shows \"v = w\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Heard_Of/lastvoting/LastVotingProof.thy#L1456)) | `theorem lv_termination: assumes run: \"CHORun LV_M rho HOs coords\" and commG:\"CHOcommGlobal LV_M HOs coords\" shows \"\\<exists>r. \\<forall>p. decide (rho r p) \\<noteq> None\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Heard_Of/lastvoting/LastVotingProof.thy#L1504))", "axiom_evidence": "`axiomatization where Proc_finite: \"OFCLASS(Proc, finite_class)\"` ([source line](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Heard_Of/lastvoting/LastVotingDefs.thy#L25)); 1 matching source lines in this row’s scope (lexical scan, not a dependency audit)", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/tree/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Heard_Of/lastvoting", "has_liveness": true}
{"section": "Isabelle/HOL source cases", "group": "", "name": "Heard-Of / EIG Byzantine agreement", "specifies": "round-based fault-tolerant consensus under the algorithm’s communication predicates", "safety": "agreement and validity: correct decisions do not conflict and satisfy the input restriction", "liveness": "termination under the stated heard-of communication predicates", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here; explicit axioms found", "size": "1,196 physical lines across 2 .thy files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/isabelle-prover/mirror-afp-devel/tree/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Heard_Of/eigbyz)", "provenance": "AFP entry “Verifying Fault-Tolerant Distributed Algorithms in the Heard-Of Model”, dated 2012-07-27; authors Henri Debrat, Stephan Merz; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/Heard_Of.toml)", "proof_statement_excerpt": "`theorem Agreement: assumes run: \"SHORun EIG_M rho HOs SHOs\" and commG: \"EIG_commGlobal HOs SHOs\" and commR:  \"\\<forall>r. EIG_commPerRd (HOs r) (SHOs r)\" and p: \"decide (rho m p) = Some v\" and q: \"decide (rho n q) = Some w\" shows \"v = w\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Heard_Of/eigbyz/EigbyzProof.thy#L773)) | `theorem Validity: assumes run: \"SHORun EIG_M rho HOs SHOs\" and commR: \"\\<forall>r. EIG_commPerRd (HOs r) (SHOs r)\" and initv: \"\\<forall>q. the (vals (rho 0 q) root_node) = v\" and dp: \"decide (rho r p) = Some w\" shows \"v = w\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Heard_Of/eigbyz/EigbyzProof.thy#L795)) | `theorem Termination: assumes \"SHORun EIG_M rho HOs SHOs\" shows \"\\<exists>r v. decide (rho r p) = Some v\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Heard_Of/eigbyz/EigbyzProof.thy#L841))", "axiom_evidence": "`axiomatization where Proc_finite: \"OFCLASS(Proc, finite_class)\"` ([source line](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Heard_Of/eigbyz/EigbyzDefs.thy#L20)); 2 matching source lines in this row’s scope (lexical scan, not a dependency audit)", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/tree/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Heard_Of/eigbyz", "has_liveness": true}
{"section": "Isabelle/HOL source cases", "group": "", "name": "Consensus Refined / Paxos / defs", "specifies": "round-based consensus transition definitions", "safety": "consensus validity/agreement through refinement; see exact declarations", "liveness": "conditional termination where a termination declaration is quoted; otherwise not identified in this file", "tool": "Isabelle/HOL; specification/definition source; no proof declaration identified in this scope", "size": "203 physical lines across 1 .thy files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/MRU/Paxos_Defs.thy)", "provenance": "AFP entry “Consensus Refined”, dated 2015-03-18; authors Ognjen Marić, Christoph Sprenger; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/Consensus_Refined.toml)", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/MRU/Paxos_Defs.thy", "has_liveness": true}
{"section": "Isabelle/HOL source cases", "group": "", "name": "Consensus Refined / Paxos / proofs", "specifies": "round-based consensus refinement/termination proofs", "safety": "consensus validity/agreement through refinement; see exact declarations", "liveness": "conditional termination where a termination declaration is quoted; otherwise not identified in this file", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here", "size": "365 physical lines across 1 .thy files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/MRU/Paxos_Proofs.thy)", "provenance": "AFP entry “Consensus Refined”, dated 2015-03-18; authors Ognjen Marić, Christoph Sprenger; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/Consensus_Refined.toml)", "proof_statement_excerpt": "`lemma Paxos_Refines_ThreeStep_MRU: \"PO_refines paxos_ref_rel majorities.ts_mru_TS (Paxos_TS HOs HOs crds)\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/MRU/Paxos_Proofs.thy#L260)) | `theorem Paxos_termination: assumes run: \"CHORun Paxos_Alg rho HOs crds\" and commR: \"\\<forall>r. CHOcommPerRd Paxos_M r (HOs r) (crds r)\" and commG: \"CHOcommGlobal Paxos_M HOs crds\" shows \"\\<exists>r v. decide (rho r p) = Some v\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/MRU/Paxos_Proofs.thy#L279))", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/MRU/Paxos_Proofs.thy", "has_liveness": true}
{"section": "Isabelle/HOL source cases", "group": "", "name": "Consensus Refined / Chandra–Toueg / defs", "specifies": "round-based consensus transition definitions", "safety": "consensus validity/agreement through refinement; see exact declarations", "liveness": "conditional termination where a termination declaration is quoted; otherwise not identified in this file", "tool": "Isabelle/HOL; specification/definition source; no proof declaration identified in this scope", "size": "202 physical lines across 1 .thy files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/MRU/CT_Defs.thy)", "provenance": "AFP entry “Consensus Refined”, dated 2015-03-18; authors Ognjen Marić, Christoph Sprenger; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/Consensus_Refined.toml)", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/MRU/CT_Defs.thy", "has_liveness": true}
{"section": "Isabelle/HOL source cases", "group": "", "name": "Consensus Refined / Chandra–Toueg / proofs", "specifies": "round-based consensus refinement/termination proofs", "safety": "consensus validity/agreement through refinement; see exact declarations", "liveness": "conditional termination where a termination declaration is quoted; otherwise not identified in this file", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here", "size": "362 physical lines across 1 .thy files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/MRU/CT_Proofs.thy)", "provenance": "AFP entry “Consensus Refined”, dated 2015-03-18; authors Ognjen Marić, Christoph Sprenger; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/Consensus_Refined.toml)", "proof_statement_excerpt": "`lemma CT_Refines_ThreeStep_MRU: \"PO_refines ct_ref_rel majorities.ts_mru_TS (CT_TS HOs HOs crds)\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/MRU/CT_Proofs.thy#L262)) | `theorem CT_termination: assumes run: \"CHORun CT_Alg rho HOs crds\" and commR: \"\\<forall>r. CHOcommPerRd CT_M r (HOs r) (crds r)\" and commG: \"CHOcommGlobal CT_M HOs crds\" shows \"\\<exists>r v. decide (rho r p) = Some v\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/MRU/CT_Proofs.thy#L281))", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/MRU/CT_Proofs.thy", "has_liveness": true}
{"section": "Isabelle/HOL source cases", "group": "", "name": "Consensus Refined / new MRU consensus algorithm / defs", "specifies": "round-based consensus transition definitions", "safety": "consensus validity/agreement through refinement; see exact declarations", "liveness": "conditional termination where a termination declaration is quoted; otherwise not identified in this file", "tool": "Isabelle/HOL; specification/definition source; no proof declaration identified in this scope; explicit axioms found", "size": "175 physical lines across 1 .thy files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/MRU/New_Algorithm_Defs.thy)", "provenance": "AFP entry “Consensus Refined”, dated 2015-03-18; authors Ognjen Marić, Christoph Sprenger; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/Consensus_Refined.toml)", "axiom_evidence": "`axiomatization where val_linorder:` ([source line](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/MRU/New_Algorithm_Defs.thy#L10)); 1 matching source lines in this row’s scope (lexical scan, not a dependency audit)", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/MRU/New_Algorithm_Defs.thy", "has_liveness": true}
{"section": "Isabelle/HOL source cases", "group": "", "name": "Consensus Refined / new MRU consensus algorithm / proofs", "specifies": "round-based consensus refinement/termination proofs", "safety": "consensus validity/agreement through refinement; see exact declarations", "liveness": "conditional termination where a termination declaration is quoted; otherwise not identified in this file", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here", "size": "420 physical lines across 1 .thy files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/MRU/New_Algorithm_Proofs.thy)", "provenance": "AFP entry “Consensus Refined”, dated 2015-03-18; authors Ognjen Marić, Christoph Sprenger; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/Consensus_Refined.toml)", "proof_statement_excerpt": "`lemma New_Algo_Refines_votes: \"PO_refines new_algo_ref_rel majorities.ts_mru_TS (New_Algo_TS HOs HOs crds)\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/MRU/New_Algorithm_Proofs.thy#L302)) | `theorem New_Algo_termination: assumes run: \"HORun New_Algo_Alg rho HOs\" and commR: \"\\<forall>r. HOcommPerRd New_Algo_M (HOs r)\" and commG: \"HOcommGlobal New_Algo_M HOs\" shows \"\\<exists>r v. decide (rho r p) = Some v\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/MRU/New_Algorithm_Proofs.thy#L320))", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/MRU/New_Algorithm_Proofs.thy", "has_liveness": true}
{"section": "Isabelle/HOL source cases", "group": "", "name": "Consensus Refined / Ben-Or / defs", "specifies": "round-based consensus transition definitions", "safety": "consensus validity/agreement through refinement; see exact declarations", "liveness": "conditional termination where a termination declaration is quoted; otherwise not identified in this file", "tool": "Isabelle/HOL; specification/definition source; no proof declaration identified in this scope", "size": "103 physical lines across 1 .thy files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/Observing/BenOr_Defs.thy)", "provenance": "AFP entry “Consensus Refined”, dated 2015-03-18; authors Ognjen Marić, Christoph Sprenger; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/Consensus_Refined.toml)", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/Observing/BenOr_Defs.thy", "has_liveness": true}
{"section": "Isabelle/HOL source cases", "group": "", "name": "Consensus Refined / Ben-Or / proofs", "specifies": "round-based consensus refinement/termination proofs", "safety": "consensus validity/agreement through refinement; see exact declarations", "liveness": "conditional termination where a termination declaration is quoted; otherwise not identified in this file", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here; explicit axioms found", "size": "468 physical lines across 1 .thy files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/Observing/BenOr_Proofs.thy)", "provenance": "AFP entry “Consensus Refined”, dated 2015-03-18; authors Ognjen Marić, Christoph Sprenger; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/Consensus_Refined.toml)", "proof_statement_excerpt": "`lemma BenOr_Refines_Two_Step_Obs: \"PO_refines (ref_rel \\<inter> (TSO_inv1 \\<inter> TSO_inv2) \\<times> UNIV) tso_TS (BenOr_TS HOs HOs crds)\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/Observing/BenOr_Proofs.thy#L355)) | `theorem BenOr_termination: shows \"\\<exists>r v. decide (rho r p) = Some v\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/Observing/BenOr_Proofs.thy#L384))", "axiom_evidence": "`axiomatization where` ([source line](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/Observing/BenOr_Proofs.thy#L17)); 1 matching source lines in this row’s scope (lexical scan, not a dependency audit)", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/Observing/BenOr_Proofs.thy", "has_liveness": true}
{"section": "Isabelle/HOL source cases", "group": "", "name": "Consensus Refined / UniformVoting / defs", "specifies": "round-based consensus transition definitions", "safety": "consensus validity/agreement through refinement; see exact declarations", "liveness": "conditional termination where a termination declaration is quoted; otherwise not identified in this file", "tool": "Isabelle/HOL; specification/definition source; no proof declaration identified in this scope", "size": "168 physical lines across 1 .thy files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/Observing/Uv_Defs.thy)", "provenance": "AFP entry “Consensus Refined”, dated 2015-03-18; authors Ognjen Marić, Christoph Sprenger; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/Consensus_Refined.toml)", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/Observing/Uv_Defs.thy", "has_liveness": true}
{"section": "Isabelle/HOL source cases", "group": "", "name": "Consensus Refined / UniformVoting / proofs", "specifies": "round-based consensus refinement/termination proofs", "safety": "consensus validity/agreement through refinement; see exact declarations", "liveness": "conditional termination where a termination declaration is quoted; otherwise not identified in this file", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here; explicit axioms found", "size": "440 physical lines across 1 .thy files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/Observing/Uv_Proofs.thy)", "provenance": "AFP entry “Consensus Refined”, dated 2015-03-18; authors Ognjen Marić, Christoph Sprenger; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/Consensus_Refined.toml)", "proof_statement_excerpt": "`lemma UV_Refines_votes: \"PO_refines (ref_rel \\<inter> (TSO_inv1 \\<inter> TSO_inv2) \\<times> UV_inv1) tso_TS (UV_TS HOs HOs crds)\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/Observing/Uv_Proofs.thy#L414))", "axiom_evidence": "`axiomatization where val_linorder:` ([source line](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/Observing/Uv_Proofs.thy#L11)); 1 matching source lines in this row’s scope (lexical scan, not a dependency audit)", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/Observing/Uv_Proofs.thy", "has_liveness": true}
{"section": "Isabelle/HOL source cases", "group": "", "name": "Consensus Refined / Ate / defs", "specifies": "round-based consensus transition definitions", "safety": "consensus validity/agreement through refinement; see exact declarations", "liveness": "conditional termination where a termination declaration is quoted; otherwise not identified in this file", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here", "size": "128 physical lines across 1 .thy files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/Voting/Ate_Defs.thy)", "provenance": "AFP entry “Consensus Refined”, dated 2015-03-18; authors Ognjen Marić, Christoph Sprenger; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/Consensus_Refined.toml)", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/Voting/Ate_Defs.thy", "has_liveness": true}
{"section": "Isabelle/HOL source cases", "group": "", "name": "Consensus Refined / Ate / proofs", "specifies": "round-based consensus refinement/termination proofs", "safety": "consensus validity/agreement through refinement; see exact declarations", "liveness": "conditional termination where a termination declaration is quoted; otherwise not identified in this file", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here; explicit axioms found", "size": "267 physical lines across 1 .thy files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/Voting/Ate_Proofs.thy)", "provenance": "AFP entry “Consensus Refined”, dated 2015-03-18; authors Ognjen Marić, Christoph Sprenger; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/Consensus_Refined.toml)", "proof_statement_excerpt": "`lemma Ate_Refines_LV_VOting: \"PO_refines (ate_ref_rel) majorities.flv_TS (Ate_TS HOs HOs crds)\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/Voting/Ate_Proofs.thy#L242))", "axiom_evidence": "`axiomatization where val_linorder:` ([source line](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/Voting/Ate_Proofs.thy#L9)); 1 matching source lines in this row’s scope (lexical scan, not a dependency audit)", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/Voting/Ate_Proofs.thy", "has_liveness": true}
{"section": "Isabelle/HOL source cases", "group": "", "name": "Consensus Refined / OneThirdRule / defs", "specifies": "round-based consensus transition definitions", "safety": "consensus validity/agreement through refinement; see exact declarations", "liveness": "conditional termination where a termination declaration is quoted; otherwise not identified in this file", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here", "size": "174 physical lines across 1 .thy files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/Voting/OneThirdRule_Defs.thy)", "provenance": "AFP entry “Consensus Refined”, dated 2015-03-18; authors Ognjen Marić, Christoph Sprenger; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/Consensus_Refined.toml)", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/Voting/OneThirdRule_Defs.thy", "has_liveness": true}
{"section": "Isabelle/HOL source cases", "group": "", "name": "Consensus Refined / OneThirdRule / proofs", "specifies": "round-based consensus refinement/termination proofs", "safety": "consensus validity/agreement through refinement; see exact declarations", "liveness": "conditional termination where a termination declaration is quoted; otherwise not identified in this file", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here; explicit axioms found", "size": "294 physical lines across 1 .thy files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/Voting/OneThirdRule_Proofs.thy)", "provenance": "AFP entry “Consensus Refined”, dated 2015-03-18; authors Ognjen Marić, Christoph Sprenger; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/Consensus_Refined.toml)", "proof_statement_excerpt": "`lemma OTR_Refines_LV_VOting: \"PO_refines (otr_ref_rel) majorities.flv_TS (OTR_TS HOs HOs crds)\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/Voting/OneThirdRule_Proofs.thy#L271))", "axiom_evidence": "`axiomatization where val_linorder:` ([source line](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/Voting/OneThirdRule_Proofs.thy#L83)); 1 matching source lines in this row’s scope (lexical scan, not a dependency audit)", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/Voting/OneThirdRule_Proofs.thy", "has_liveness": true}
{"section": "Isabelle/HOL source cases", "group": "", "name": "Consensus Refined / abstract Voting", "specifies": "abstract voting machine used in consensus refinements", "safety": "vote/decision invariants and refinement; abstract layer rather than additional deployed protocol", "liveness": "no progress theorem identified in this row’s source", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here", "size": "416 physical lines across 1 .thy files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/Voting.thy)", "provenance": "AFP entry “Consensus Refined”, dated 2015-03-18; authors Ognjen Marić, Christoph Sprenger; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/Consensus_Refined.toml)", "proof_statement_excerpt": "`lemma Voting_agreement: assumes beh: \"tr \\<in> beh v_TS\" and len: \"i < length tr\" and s: \"s = nth tr i\" and t: \"t = nth tr (i - j)\" and dec: \"decisions s p = Some v\" \"decisions t q = Some w\" shows \"w = v\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/Voting.thy#L363)) | `lemma Vinv3_invariant: \"reach v_TS \\<subseteq> Vinv3\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/Voting.thy#L239))", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/Voting.thy", "has_liveness": false}
{"section": "Isabelle/HOL source cases", "group": "", "name": "Consensus Refined / abstract Voting_Opt", "specifies": "abstract voting machine used in consensus refinements", "safety": "vote/decision invariants and refinement; abstract layer rather than additional deployed protocol", "liveness": "no progress theorem identified in this row’s source", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here", "size": "195 physical lines across 1 .thy files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/Voting_Opt.thy)", "provenance": "AFP entry “Consensus Refined”, dated 2015-03-18; authors Ognjen Marić, Christoph Sprenger; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/Consensus_Refined.toml)", "proof_statement_excerpt": "`lemma Last_Voting_Refines: \"PO_refines (flv_ref_rel \\<inter> (Vinv1 \\<inter> Vinv2) \\<times> UNIV) v_TS flv_TS\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/Voting_Opt.thy#L174))", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/Voting_Opt.thy", "has_liveness": false}
{"section": "Isabelle/HOL source cases", "group": "", "name": "Consensus Refined / abstract Observing_Quorums", "specifies": "abstract voting machine used in consensus refinements", "safety": "vote/decision invariants and refinement; abstract layer rather than additional deployed protocol", "liveness": "no progress theorem identified in this row’s source", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here", "size": "213 physical lines across 1 .thy files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/Observing_Quorums.thy)", "provenance": "AFP entry “Consensus Refined”, dated 2015-03-18; authors Ognjen Marić, Christoph Sprenger; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/Consensus_Refined.toml)", "proof_statement_excerpt": "`lemma Observable_Refines: \"PO_refines (obsv_ref_rel \\<inter> UNIV \\<times> OV_inv1) sv_TS obsv_TS\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/Observing_Quorums.thy#L113))", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/Observing_Quorums.thy", "has_liveness": false}
{"section": "Isabelle/HOL source cases", "group": "", "name": "Consensus Refined / abstract Observing_Quorums_Opt", "specifies": "abstract voting machine used in consensus refinements", "safety": "vote/decision invariants and refinement; abstract layer rather than additional deployed protocol", "liveness": "no progress theorem identified in this row’s source", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here", "size": "156 physical lines across 1 .thy files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/Observing_Quorums_Opt.thy)", "provenance": "AFP entry “Consensus Refined”, dated 2015-03-18; authors Ognjen Marić, Christoph Sprenger; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/Consensus_Refined.toml)", "proof_statement_excerpt": "`lemma OLV_Refines: \"PO_refines (olv_ref_rel \\<inter> (OV_inv2 \\<inter> OV_inv3 \\<inter> OV_inv4) \\<times> UNIV) obsv_TS olv_TS\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/Observing_Quorums_Opt.thy#L139))", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/Observing_Quorums_Opt.thy", "has_liveness": false}
{"section": "Isabelle/HOL source cases", "group": "", "name": "Consensus Refined / abstract MRU_Vote", "specifies": "abstract voting machine used in consensus refinements", "safety": "vote/decision invariants and refinement; abstract layer rather than additional deployed protocol", "liveness": "no progress theorem identified in this row’s source", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here", "size": "67 physical lines across 1 .thy files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/MRU_Vote.thy)", "provenance": "AFP entry “Consensus Refined”, dated 2015-03-18; authors Ognjen Marić, Christoph Sprenger; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/Consensus_Refined.toml)", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/MRU_Vote.thy", "has_liveness": false}
{"section": "Isabelle/HOL source cases", "group": "", "name": "Consensus Refined / abstract MRU_Vote_Opt", "specifies": "abstract voting machine used in consensus refinements", "safety": "vote/decision invariants and refinement; abstract layer rather than additional deployed protocol", "liveness": "no progress theorem identified in this row’s source", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here", "size": "217 physical lines across 1 .thy files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/MRU_Vote_Opt.thy)", "provenance": "AFP entry “Consensus Refined”, dated 2015-03-18; authors Ognjen Marić, Christoph Sprenger; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/Consensus_Refined.toml)", "proof_statement_excerpt": "`lemma Opt_MRU_Vote_Refines: \"PO_refines (lv_ref_rel \\<inter> (Vinv1 \\<inter> Vinv2 \\<inter> SV_inv3 \\<inter> SV_inv4) \\<times> UNIV) sv_TS mru_opt_TS\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/MRU_Vote_Opt.thy#L176))", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/MRU_Vote_Opt.thy", "has_liveness": false}
{"section": "Isabelle/HOL source cases", "group": "", "name": "Consensus Refined / abstract Same_Vote", "specifies": "abstract voting machine used in consensus refinements", "safety": "vote/decision invariants and refinement; abstract layer rather than additional deployed protocol", "liveness": "no progress theorem identified in this row’s source", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here", "size": "183 physical lines across 1 .thy files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/Same_Vote.thy)", "provenance": "AFP entry “Consensus Refined”, dated 2015-03-18; authors Ognjen Marić, Christoph Sprenger; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/Consensus_Refined.toml)", "proof_statement_excerpt": "`lemma Same_Vote_Refines: \"PO_refines Id v_TS sv_TS\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/Same_Vote.thy#L63)) | `lemma SV_inv4_invariant: \"reach sv_TS \\<subseteq> SV_inv4\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/Same_Vote.thy#L177))", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Consensus_Refined/Same_Vote.thy", "has_liveness": false}
{"section": "Isabelle/HOL source cases", "group": "", "name": "Disk Paxos", "specifies": "disk-based fault-tolerant consensus", "safety": "chosen-value agreement and state invariants", "liveness": "no progress theorem identified in this row’s source", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here; explicit axioms found", "size": "6,954 physical lines across 10 .thy files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/isabelle-prover/mirror-afp-devel/tree/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/DiskPaxos)", "provenance": "AFP entry “Proving the Correctness of Disk Paxos”, dated 2005-06-22; authors Mauro Jaskelioff, Stephan Merz; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/DiskPaxos.toml)", "proof_statement_excerpt": "`lemma outpt_chosen_2: assumes outpt: \"outpt s' = (outpt s) (p:= NotAnInput)\" and inv2c: \"Inv2c s\" and nextp: \"HNextPart s s'\" shows \"chosen s = chosen s'\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/DiskPaxos/DiskPaxos_Inv6.thy#L568))", "axiom_evidence": "`axiomatization` ([source line](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/DiskPaxos/DiskPaxos_Model.thy#L17)); 1 matching source lines in this row’s scope (lexical scan, not a dependency audit)", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/tree/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/DiskPaxos", "has_liveness": false}
{"section": "Isabelle/HOL source cases", "group": "", "name": "Chandy–Lamport snapshot", "specifies": "distributed consistent snapshot and stable-property detection", "safety": "snapshot matches a consistent global state", "liveness": "snapshot termination; stable-property detection under source assumptions", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here", "size": "10,220 physical lines across 7 .thy files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/isabelle-prover/mirror-afp-devel/tree/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Chandy_Lamport)", "provenance": "AFP entry “A Formal Proof of The Chandy--Lamport Distributed Snapshot Algorithm”, dated 2020-07-21; authors Ben Fiedler, Dmitriy Traytel; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/Chandy_Lamport.toml)", "proof_statement_excerpt": "`theorem snapshot_algorithm_is_correct: assumes \"trace init t final\" shows \"\\<exists>t' i. trace init t' final \\<and> mset t' = mset t \\<and> state_equal_to_snapshot (S t' i) final \\<and> i \\<le> length t'\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Chandy_Lamport/Snapshot.thy#L5215)) | `theorem Stable_Property_Detection: assumes \"stable p\" and \"trace init t final\" and \"(t', i) = some_snapshot_state t\" and \"p (S t' i)\" shows \"p final\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Chandy_Lamport/Snapshot.thy#L5262))", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/tree/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Chandy_Lamport", "has_liveness": true}
{"section": "Isabelle/HOL source cases", "group": "", "name": "Schneider generalized Byzantine clock synchronization", "specifies": "local clocks corrected using a convergence function", "safety": "correct clocks stay within the stated skew bound", "liveness": "periodic synchronization assumptions are premises; separate eventual-progress theorem not identified", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here; explicit axioms found", "size": "1,357 physical lines across 1 .thy files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/isabelle-prover/mirror-afp-devel/tree/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/GenClock)", "provenance": "AFP entry “Formalization of a Generalized Protocol for Clock Synchronization”, dated 2005-06-24; authors Alwen Tiu; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/GenClock.toml)", "proof_statement_excerpt": "`theorem agreement: assumes ie1: \"\\<beta> \\<le> rmin\" and ie2: \"\\<mu> \\<le> \\<delta>S\" and ie3: \"\\<gamma>1 \\<delta>S \\<le> \\<delta>S\" and ie4: \"\\<gamma>2 \\<delta>S \\<le> \\<delta>\" and ie5: \"\\<gamma>3 \\<delta>S \\<le> \\<delta>\" and ie6: \"0 \\<le> t\" and cpq: \"correct p t \\<and> correct q t\" shows \"\\<bar>VC p t - VC q t\\<bar> \\<le> \\<delta>\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/GenClock/GenClock.thy#L1336))", "axiom_evidence": "`axiomatization` ([source line](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/GenClock/GenClock.thy#L18)); 16 matching source lines in this row’s scope (lexical scan, not a dependency audit)", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/tree/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/GenClock", "has_liveness": true}
{"section": "Isabelle/HOL source cases", "group": "", "name": "interactive convergence clock synchronization", "specifies": "concrete convergence function for generalized clock synchronization", "safety": "precision enhancement and accuracy preservation", "liveness": "no progress theorem identified in this row’s source", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here; explicit axioms found", "size": "688 physical lines across 1 .thy files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/ClockSynchInst/ICAInstance.thy)", "provenance": "AFP entry “Instances of Schneider's generalized protocol of clock synchronization”, dated 2006-03-15; authors Damián Barsotti; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/ClockSynchInst.toml)", "proof_statement_excerpt": "`theorem prec_enh: assumes hC: \"C \\<subseteq> PR\" and hbx: \"\\<forall> l\\<in>C. \\<bar>f l - g l\\<bar> <= x\" and hby1: \"\\<forall> l\\<in>C. \\<forall> m\\<in>C. \\<bar>f l - f m\\<bar> <= y\" and hby2: \"\\<forall> l\\<in>C. \\<forall> m\\<in>C. \\<bar>g l - g m\\<bar> <= y\" and hpC: \"p\\<in>C\" and hqC: \"q\\<in>C\" shows \"\\<bar> cfni p f - cfni q g \\<bar> <= (real (card C) * (x + (if (y <= \\<Delta>) then 0 else y)) + real (card ({..<np} - C)) * (2 * \\<Delta> + x + y)) / real np\" (is \"\\<bar> ?dif_div_np \\<bar> <= ?B\")` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/ClockSynchInst/ICAInstance.thy#L442)) | `lemma accur_pres: assumes hC: \"C \\<subseteq> PR\" and hby: \"\\<forall> l\\<in>C. \\<forall> m\\<in>C. \\<bar>f l - f m\\<bar> <= x\" and hpC: \"p\\<in>C\" and hqC: \"q\\<in>C\" shows \"\\<bar> cfni p f - f q \\<bar> <= (real (card C) * x + real (card ({..<np} - C)) * (x + \\<Delta>))/ real np\" (is \"?abs1 <= (?bC + ?bnpC)/real np\")` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/ClockSynchInst/ICAInstance.thy#L591))", "axiom_evidence": "`axiomatization` ([source line](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/ClockSynchInst/ICAInstance.thy#L39)); 1 matching source lines in this row’s scope (lexical scan, not a dependency audit)", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/ClockSynchInst/ICAInstance.thy", "has_liveness": false}
{"section": "Isabelle/HOL source cases", "group": "", "name": "Lynch clock synchronization", "specifies": "concrete convergence function for generalized clock synchronization", "safety": "precision enhancement and accuracy preservation", "liveness": "no progress theorem identified in this row’s source", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here; explicit axioms found", "size": "1,032 physical lines across 1 .thy files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/ClockSynchInst/LynchInstance.thy)", "provenance": "AFP entry “Instances of Schneider's generalized protocol of clock synchronization”, dated 2006-03-15; authors Damián Barsotti; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/ClockSynchInst.toml)", "proof_statement_excerpt": "`theorem prec_enh: assumes hC: \"C \\<subseteq> PR\" and hCF: \"np - nF <= card C\" and hFn: \"3 * nF < np\" and hFk: \"nF = khl\" and hbx: \"\\<forall> l\\<in>C. \\<bar>f l - g l\\<bar> <= x\" and hby1: \"\\<forall> l\\<in>C. \\<forall> m\\<in>C. \\<bar>f l - f m\\<bar> <= y\" and hby2: \"\\<forall> l\\<in>C. \\<forall> m\\<in>C. \\<bar>g l - g m\\<bar> <= y\" and hpC: \"p\\<in>C\" and hqC: \"q\\<in>C\" shows \"\\<bar> cfnl p f - cfnl q g \\<bar> <= y / 2 + x\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/ClockSynchInst/LynchInstance.thy#L838)) | `theorem accur_pres: assumes hC: \"C \\<subseteq> PR\" and hCF: \"np - nF <= card C\" and hFk: \"nF = khl\" and hby: \"\\<forall> l\\<in>C. \\<forall> m\\<in>C. \\<bar>f l - f m\\<bar> <= y\" and hqC: \"q\\<in>C\" shows \"\\<bar> cfnl p f - f q \\<bar> <= y\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/ClockSynchInst/LynchInstance.thy#L979))", "axiom_evidence": "`axiomatization` ([source line](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/ClockSynchInst/LynchInstance.thy#L35)); 1 matching source lines in this row’s scope (lexical scan, not a dependency audit)", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/ClockSynchInst/LynchInstance.thy", "has_liveness": false}
{"section": "Isabelle/HOL source cases", "group": "", "name": "CRDT / operation-based counter", "specifies": "replicated datatype operations under a causal network model", "safety": "concurrent operations commute; convergence via imported framework", "liveness": "framework sec_progress concerns operations being applicable; eventual network delivery must not be inferred", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here", "size": "57 physical lines across 1 .thy files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/CRDT/Counter.thy)", "provenance": "AFP entry “A framework for establishing Strong Eventual Consistency for Conflict-free Replicated Datatypes”, dated 2017-07-07; authors Victor B. F. Gomes, Martin Kleppmann, Dominic P. Mulligan, Alastair R. Beresford; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/CRDT.toml)", "proof_statement_excerpt": "`lemma (in counter) concurrent_operations_commute: assumes \"xs prefix of i\" shows \"hb.concurrent_ops_commute (node_deliver_messages xs)\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/CRDT/Counter.thy#L29))", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/CRDT/Counter.thy", "has_liveness": true}
{"section": "Isabelle/HOL source cases", "group": "", "name": "CRDT / observed-remove set", "specifies": "replicated datatype operations under a causal network model", "safety": "concurrent operations commute; convergence via imported framework", "liveness": "framework sec_progress concerns operations being applicable; eventual network delivery must not be inferred", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here", "size": "248 physical lines across 1 .thy files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/CRDT/ORSet.thy)", "provenance": "AFP entry “A framework for establishing Strong Eventual Consistency for Conflict-free Replicated Datatypes”, dated 2017-07-07; authors Victor B. F. Gomes, Martin Kleppmann, Dominic P. Mulligan, Alastair R. Beresford; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/CRDT.toml)", "proof_statement_excerpt": "`theorem (in orset) convergence: assumes \"set (node_deliver_messages xs) = set (node_deliver_messages ys)\" and \"xs prefix of i\" and \"ys prefix of j\" shows \"apply_operations xs = apply_operations ys\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/CRDT/ORSet.thy#L229)) | `lemma (in orset) concurrent_operations_commute: assumes \"xs prefix of i\" shows \"hb.concurrent_ops_commute (node_deliver_messages xs)\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/CRDT/ORSet.thy#L213)) | `lemma (in orset) apply_operations_never_fails: assumes \"xs prefix of i\" shows \"apply_operations xs \\<noteq> None\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/CRDT/ORSet.thy#L48))", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/CRDT/ORSet.thy", "has_liveness": true}
{"section": "Isabelle/HOL source cases", "group": "", "name": "CRDT / replicated growable array", "specifies": "replicated datatype operations under a causal network model", "safety": "concurrent operations commute; convergence via imported framework", "liveness": "framework sec_progress concerns operations being applicable; eventual network delivery must not be inferred", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here", "size": "530 physical lines across 1 .thy files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/CRDT/RGA.thy)", "provenance": "AFP entry “A framework for establishing Strong Eventual Consistency for Conflict-free Replicated Datatypes”, dated 2017-07-07; authors Victor B. F. Gomes, Martin Kleppmann, Dominic P. Mulligan, Alastair R. Beresford; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/CRDT.toml)", "proof_statement_excerpt": "`lemma (in rga) concurrent_operations_commute: assumes \"xs prefix of i\" shows \"hb.concurrent_ops_commute (node_deliver_messages xs)\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/CRDT/RGA.thy#L330)) | `lemma (in rga) apply_operations_never_fails': shows \"apply_operations (history i) \\<noteq> None\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/CRDT/RGA.thy#L475))", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/CRDT/RGA.thy", "has_liveness": true}
{"section": "Isabelle/HOL source cases", "group": "", "name": "CRDT / convergence framework", "specifies": "reordering and applying concurrent replicated updates", "safety": "same delivered update set gives equal state", "liveness": "sec_progress: valid delivery/applicability, not an unconditional eventual-delivery guarantee", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here", "size": "385 physical lines across 1 .thy files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/CRDT/Convergence.thy)", "provenance": "AFP entry “A framework for establishing Strong Eventual Consistency for Conflict-free Replicated Datatypes”, dated 2017-07-07; authors Victor B. F. Gomes, Martin Kleppmann, Dominic P. Mulligan, Alastair R. Beresford; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/CRDT.toml)", "proof_statement_excerpt": "`theorem sec_convergence: assumes \"set xs = set ys\" \"op_history xs\" \"op_history ys\" shows   \"apply_operations xs = apply_operations ys\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/CRDT/Convergence.thy#L363)) | `theorem sec_progress: assumes \"op_history xs\" shows   \"apply_operations xs initial_state \\<noteq> None\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/CRDT/Convergence.thy#L370))", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/CRDT/Convergence.thy", "has_liveness": true}
{"section": "Isabelle/HOL source cases", "group": "", "name": "IMAP replicated mailbox", "specifies": "replicated IMAP operations", "safety": "commutativity and strong convergence", "liveness": "delivery fairness not proved by commutativity alone", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here", "size": "1,100 physical lines across 5 .thy files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/isabelle-prover/mirror-afp-devel/tree/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/IMAP-CRDT)", "provenance": "AFP entry “The IMAP CmRDT”, dated 2017-11-09; authors Tim Jungnickel, Lennart Oldenburg, Matthias Loibl; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/IMAP-CRDT.toml)", "proof_statement_excerpt": "`lemma (in imap) concurrent_operations_commute: assumes \"xs prefix of i\" shows \"hb.concurrent_ops_commute (node_deliver_messages xs)\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/IMAP-CRDT/IMAP-proof.thy#L96)) | `theorem (in imap) convergence: assumes \"set (node_deliver_messages xs) = set (node_deliver_messages ys)\" and \"xs prefix of i\" and \"ys prefix of j\" shows \"apply_operations xs = apply_operations ys\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/IMAP-CRDT/IMAP-proof.thy#L151))", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/tree/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/IMAP-CRDT", "has_liveness": true}
{"section": "Isabelle/HOL source cases", "group": "", "name": "WOOT collaborative editor", "specifies": "replicated text editing with causal delivery", "safety": "same operations produce same text; delivery does not fail", "liveness": "network delivery assumptions are explicit; unconditional eventual delivery not established", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here", "size": "2,922 physical lines across 15 .thy files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/isabelle-prover/mirror-afp-devel/tree/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/WOOT_Strong_Eventual_Consistency)", "provenance": "AFP entry “Strong Eventual Consistency of the Collaborative Editing Framework WOOT”, dated 2020-03-25; authors Emin Karayel, Edgar Gonzàlez; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/WOOT_Strong_Eventual_Consistency.toml)", "proof_statement_excerpt": "`theorem (in dist_execution) no_failure: fixes i assumes \"is_valid_state_id i\" shows \"isOK (state i)\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/WOOT_Strong_Eventual_Consistency/SEC.thy#L11)) | `theorem (in dist_execution) strong_convergence: assumes \"is_valid_state_id i\" assumes \"is_valid_state_id j\" assumes \"set (received_messages i) = set (received_messages j)\" shows \"state i = state j\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/WOOT_Strong_Eventual_Consistency/SEC.thy#L21))", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/tree/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/WOOT_Strong_Eventual_Consistency", "has_liveness": true}
{"section": "Isabelle/HOL source cases", "group": "", "name": "OpSets / RGA and noninterleaving text specification", "specifies": "replicated list semantics and concurrent insertion blocks", "safety": "RGA meets sequential spec; ordered insertion and no interleaving", "liveness": "no progress theorem identified in this row’s source", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here", "size": "4,034 physical lines across 5 .thy files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/isabelle-prover/mirror-afp-devel/tree/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/OpSets)", "provenance": "AFP entry “OpSets: Sequential Specifications for Replicated Datatypes”, dated 2018-05-10; authors Martin Kleppmann, Victor B. F. Gomes, Dominic P. Mulligan, Alastair R. Beresford; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/OpSets.toml)", "proof_statement_excerpt": "`theorem rga_meets_spec: assumes \"rga_ops xs\" shows \"\\<exists>ys. set ys = set xs \\<and> insert_ops ys \\<and> interp_ins ys = interp_rga xs\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/OpSets/RGA.thy#L449)) | `theorem no_interleaving: assumes \"insert_ops ops\" and \"insert_seq start xs\" and \"insert_ops xs\" and \"insert_seq start ys\" and \"insert_ops ys\" and \"set xs \\<subseteq> set ops\" and \"set ys \\<subseteq> set ops\" and \"distinct (map fst xs @ map fst ys)\" and \"start = None \\<or> (\\<exists>r. start = Some r \\<and> r \\<in> set (interp_ins ops))\" shows \"(\\<forall>x \\<in> set (map fst xs). \\<forall>y \\<in> set (map fst ys). list_order ops x y) \\<or> (\\<forall>x \\<in> set (map fst xs). \\<forall>y \\<in> set (map fst ys). list_order ops y x)\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/OpSets/Interleaving.thy#L995)) | `theorem list_order_total: assumes \"list_ops ops\" and \"x \\<in> set (fst (interp_ops ops))\" and \"y \\<in> set (fst (interp_ops ops))\" and \"x \\<noteq> y\" shows \"list_order ops x y \\<or> list_order ops y x\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/OpSets/List_Spec.thy#L701))", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/tree/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/OpSets", "has_liveness": false}
{"section": "Isabelle/HOL source cases", "group": "", "name": "Timely Dataflow progress tracking", "specifies": "distributed capability/message accounting and frontiers", "safety": "frontier does not incorrectly announce completed work", "liveness": "no progress theorem identified in this row’s source", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here", "size": "7,972 physical lines across 7 .thy files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/isabelle-prover/mirror-afp-devel/tree/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Progress_Tracking)", "provenance": "AFP entry “Formalization of Timely Dataflow's Progress Tracking Protocol”, dated 2021-04-13; authors Matthias Brun, Sára Decova, Andrea Lattuada, Dmitriy Traytel; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/Progress_Tracking.toml)", "proof_statement_excerpt": "`lemma alw_safe_combined2: \"FullSpec s \\<Longrightarrow> alw (holds safe_combined2) s\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Progress_Tracking/Combined.thy#L1208)) | `lemma spec_imp_SafeStickyGlobVacantUpto: \"spec s \\<Longrightarrow> alw SafeStickyGlobVacantUpto s\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Progress_Tracking/Exchange_Abadi.thy#L888))", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/tree/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Progress_Tracking", "has_liveness": false}
{"section": "Isabelle/HOL source cases", "group": "", "name": "strict two-phase locking", "specifies": "transaction schedules and lock acquisition/release", "safety": "strict two-phase locking implies conflict serializability", "liveness": "no progress theorem identified in this row’s source", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here", "size": "499 physical lines across 1 .thy files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/isabelle-prover/mirror-afp-devel/tree/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Serializable)", "provenance": "AFP entry “Formalization of (Conflict-)Serializability and Strict Two-Phase Locking”, dated 2025-02-01; authors Dmitriy Traytel; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/Serializable.toml)", "proof_statement_excerpt": "`theorem s2pl_conflict_serializable: \\<open>s2pl (\\<lambda>_. {}) s \\<Longrightarrow> conflict_serializable s\\<close>` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Serializable/Serializable.thy#L369))", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/tree/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Serializable", "has_liveness": false}
{"section": "Isabelle/HOL source cases", "group": "", "name": "concurrent revisions", "specifies": "fork/join revision-based shared state", "safety": "determinacy independent of scheduling", "liveness": "no progress theorem identified in this row’s source", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here", "size": "3,055 physical lines across 7 .thy files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/isabelle-prover/mirror-afp-devel/tree/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Concurrent_Revisions)", "provenance": "AFP entry “Formalization of Concurrent Revisions”, dated 2018-12-25; authors Roy Overbeek; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/Concurrent_Revisions.toml)", "proof_statement_excerpt": "`theorem determinacy: assumes prog_expr: \"program_expr e\" and e_terminates_in_s: \"e \\<down> s\" and e_terminates_in_s': \"e \\<down> s'\" and lid_inf: \"infinite (UNIV :: 'l set)\" and rid_inf: \"infinite (UNIV :: 'r set)\" shows \"s \\<approx> s'\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Concurrent_Revisions/Determinacy.thy#L1034))", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/tree/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Concurrent_Revisions", "has_liveness": false}
{"section": "Isabelle/HOL source cases", "group": "", "name": "Schism concurrent garbage collector on x86-TSO", "specifies": "mutator/collector and weak-memory execution", "safety": "collection safety and valid references", "liveness": "no progress theorem identified in this row’s source", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here", "size": "8,004 physical lines across 19 .thy files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/isabelle-prover/mirror-afp-devel/tree/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/ConcurrentGC)", "provenance": "AFP entry “Relaxing Safely: Verified On-the-Fly Garbage Collection for x86-TSO”, dated 2015-04-13; authors Peter Gammie, Tony Hosking, Kai Engelhardt; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/ConcurrentGC.toml)", "proof_statement_excerpt": "`lemma (in sys) valid_refs_inv[intro]: \"\\<lbrace> LSTP (valid_refs_inv \\<^bold>\\<and> tso_store_inv) \\<rbrace> sys \\<lbrace> LSTP valid_refs_inv \\<rbrace>\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/ConcurrentGC/Valid_Refs.thy#L118))", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/tree/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/ConcurrentGC", "has_liveness": false}
{"section": "Isabelle/HOL source cases", "group": "", "name": "CoSMeDis distributed social-media platform", "specifies": "networked users, posts, friendship and API transitions", "safety": "confidentiality and state safety", "liveness": "no progress theorem identified in this row’s source", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here", "size": "16,273 physical lines across 55 .thy files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/isabelle-prover/mirror-afp-devel/tree/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/CoSMeDis)", "provenance": "AFP entry “CoSMeDis: A confidentiality-verified distributed social media platform”, dated 2021-08-16; authors Thomas Bauereiss, Andrei Popescu; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/CoSMeDis.toml)", "proof_statement_excerpt": "`theorem Post_secure: secure` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/CoSMeDis/Post_Confidentiality/Post_RECEIVER.thy#L297))", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/tree/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/CoSMeDis", "has_liveness": false}
{"section": "Isabelle/HOL source cases", "group": "", "name": "FLP impossibility", "specifies": "asynchronous consensus with one possible failure", "safety": "formal system validity assumptions", "liveness": "impossibility of guaranteeing consensus termination; negative result", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here", "size": "4,521 physical lines across 7 .thy files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/isabelle-prover/mirror-afp-devel/tree/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/FLP)", "provenance": "AFP entry “A Constructive Proof for FLP”, dated 2016-05-18; authors Benjamin Bisping, Paul-David Brodmann, Tim Jungnickel, Christina Rickmann, Henning Seidler, Anke Stüber, Arno Wilhelm-Weidner, Kirstin Peters, Uwe Nestmann; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/FLP.toml)", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/tree/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/FLP", "has_liveness": true}
{"section": "Isabelle/HOL source cases", "group": "", "name": "Stellar / personal Byzantine quorum systems", "specifies": "static quorum intersection and trust restrictions", "safety": "quorum-set safety; no full message-level consensus model", "liveness": "no progress theorem identified in this row’s source", "tool": "Isabelle/HOL; incomplete proof source: omission tokens found; no completed proof claim", "size": "613 physical lines across 1 .thy files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/isabelle-prover/mirror-afp-devel/tree/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Stellar_Quorums)", "provenance": "AFP entry “Stellar Quorum Systems”, dated 2019-08-01; authors Giuliano Losa; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/Stellar_Quorums.toml)", "proof_statement_excerpt": "`theorem union_quorum_intersection: assumes \"proj.quorum Q\\<^sub>1\" and \"proj.quorum Q\\<^sub>2\" and \"Q\\<^sub>1 \\<inter> (I\\<^sub>1\\<union>I\\<^sub>2) \\<noteq> {}\" and \"Q\\<^sub>2 \\<inter> (I\\<^sub>1\\<union>I\\<^sub>2) \\<noteq> {}\" shows \"Q\\<^sub>1 \\<inter> Q\\<^sub>2 \\<inter> (I\\<^sub>1\\<union>I\\<^sub>2) \\<noteq> {}\" \\<comment> \\<open>Any two sets that intersect @{term \\<open>I\\<^sub>1\\<union>I\\<^sub>2\\<close>} and that are quorums in the system projected on @{term \\<open>I\\<^sub>1\\<union>I\\<^sub>2\\<close>} intersect in @{term \\<open>I\\<^sub>1\\<union>I\\<^sub>2\\<close>}.\\<close>` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Stellar_Quorums/Stellar_Quorums.thy#L555)) | `theorem blocking_safe: \\<comment> \\<open>A set that blocks an intact node contains an intact node. If this were not the case, quorum availability would trivially be violated.\\<close> fixes S n assumes \"n\\<in>I\" and \"\\<forall> Sl\\<in> slices n .Sl\\<inter>S \\<noteq> {}\" shows \"S \\<inter> I \\<noteq> {}\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Stellar_Quorums/Stellar_Quorums.thy#L504))", "unfinished_step_evidence": "`oops` ([source line](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Stellar_Quorums/Stellar_Quorums.thy#L110)); 1 matching source lines in this row’s scope (lexical scan, not a dependency audit)", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/tree/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Stellar_Quorums", "has_liveness": false}
{"section": "Isabelle/HOL source cases", "group": "", "name": "abortable linearizable modules / consensus", "specifies": "abortable consensus modules and their composition", "safety": "linearizable composition/idempotence", "liveness": "no progress theorem identified in this row’s source", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here", "size": "3,185 physical lines across 7 .thy files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/isabelle-prover/mirror-afp-devel/tree/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Abortable_Linearizable_Modules)", "provenance": "AFP entry “Abortable Linearizable Modules”, dated 2012-03-01; authors Rachid Guerraoui, Viktor Kuncak, Giuliano Losa; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/Abortable_Linearizable_Modules.toml)", "proof_statement_excerpt": "`theorem idempotence: shows \"((composition) =<| (ioa 0 id2))\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Abortable_Linearizable_Modules/Idempotence.thy#L1374)) | `lemma single_use: fixes r rs shows  \"\\<bottom> \\<star> ([r]@rs) = Some (snd r)\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Abortable_Linearizable_Modules/Consensus.thy#L30))", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/tree/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Abortable_Linearizable_Modules", "has_liveness": false}
{"section": "Isabelle/HOL source cases", "group": "", "name": "AODV main", "specifies": "wireless routing transition specification", "safety": "loop freedom supplied by corresponding *_Loop_Freedom theory, not necessarily proved in this model file", "liveness": "no progress theorem identified in this row’s source", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here", "size": "536 physical lines across 1 .thy files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/AODV/Aodv.thy)", "provenance": "AFP entry “Loop freedom of the (untimed) AODV routing protocol”, dated 2014-10-23; authors Timothy Bourke, Peter Höfner; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/AODV.toml)", "proof_statement_excerpt": "`lemma aodv_init_sip_not_i [simp]: assumes \"(\\<xi>, p) \\<in> \\<sigma>\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V i\" shows \"sip \\<xi> \\<noteq> i\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/AODV/Aodv.thy#L513))", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/AODV/Aodv.thy", "has_liveness": false}
{"section": "Isabelle/HOL source cases", "group": "", "name": "AODV variant A", "specifies": "wireless routing transition specification", "safety": "loop freedom supplied by corresponding *_Loop_Freedom theory, not necessarily proved in this model file", "liveness": "no progress theorem identified in this row’s source", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here", "size": "532 physical lines across 1 .thy files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/AODV/variants/a_norreqid/A_Aodv.thy)", "provenance": "AFP entry “Loop freedom of the (untimed) AODV routing protocol”, dated 2014-10-23; authors Timothy Bourke, Peter Höfner; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/AODV.toml)", "proof_statement_excerpt": "`lemma aodv_init_sip_not_i [simp]: assumes \"(\\<xi>, p) \\<in> \\<sigma>\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V i\" shows \"sip \\<xi> \\<noteq> i\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/AODV/variants/a_norreqid/A_Aodv.thy#L509))", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/AODV/variants/a_norreqid/A_Aodv.thy", "has_liveness": false}
{"section": "Isabelle/HOL source cases", "group": "", "name": "AODV variant B", "specifies": "wireless routing transition specification", "safety": "loop freedom supplied by corresponding *_Loop_Freedom theory, not necessarily proved in this model file", "liveness": "no progress theorem identified in this row’s source", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here", "size": "532 physical lines across 1 .thy files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/AODV/variants/b_fwdrreps/B_Aodv.thy)", "provenance": "AFP entry “Loop freedom of the (untimed) AODV routing protocol”, dated 2014-10-23; authors Timothy Bourke, Peter Höfner; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/AODV.toml)", "proof_statement_excerpt": "`lemma aodv_init_sip_not_i [simp]: assumes \"(\\<xi>, p) \\<in> \\<sigma>\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V i\" shows \"sip \\<xi> \\<noteq> i\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/AODV/variants/b_fwdrreps/B_Aodv.thy#L509))", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/AODV/variants/b_fwdrreps/B_Aodv.thy", "has_liveness": false}
{"section": "Isabelle/HOL source cases", "group": "", "name": "AODV variant C", "specifies": "wireless routing transition specification", "safety": "loop freedom supplied by corresponding *_Loop_Freedom theory, not necessarily proved in this model file", "liveness": "no progress theorem identified in this row’s source", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here", "size": "517 physical lines across 1 .thy files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/AODV/variants/c_gtobcast/C_Aodv.thy)", "provenance": "AFP entry “Loop freedom of the (untimed) AODV routing protocol”, dated 2014-10-23; authors Timothy Bourke, Peter Höfner; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/AODV.toml)", "proof_statement_excerpt": "`lemma aodv_init_sip_not_i [simp]: assumes \"(\\<xi>, p) \\<in> \\<sigma>\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V i\" shows \"sip \\<xi> \\<noteq> i\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/AODV/variants/c_gtobcast/C_Aodv.thy#L494))", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/AODV/variants/c_gtobcast/C_Aodv.thy", "has_liveness": false}
{"section": "Isabelle/HOL source cases", "group": "", "name": "AODV variant D", "specifies": "wireless routing transition specification", "safety": "loop freedom supplied by corresponding *_Loop_Freedom theory, not necessarily proved in this model file", "liveness": "no progress theorem identified in this row’s source", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here", "size": "551 physical lines across 1 .thy files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/AODV/variants/d_fwdrreqs/D_Aodv.thy)", "provenance": "AFP entry “Loop freedom of the (untimed) AODV routing protocol”, dated 2014-10-23; authors Timothy Bourke, Peter Höfner; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/AODV.toml)", "proof_statement_excerpt": "`lemma aodv_init_sip_not_i [simp]: assumes \"(\\<xi>, p) \\<in> \\<sigma>\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V i\" shows \"sip \\<xi> \\<noteq> i\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/AODV/variants/d_fwdrreqs/D_Aodv.thy#L528))", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/AODV/variants/d_fwdrreqs/D_Aodv.thy", "has_liveness": false}
{"section": "Isabelle/HOL source cases", "group": "", "name": "AODV variant E", "specifies": "wireless routing transition specification", "safety": "loop freedom supplied by corresponding *_Loop_Freedom theory, not necessarily proved in this model file", "liveness": "no progress theorem identified in this row’s source", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here", "size": "524 physical lines across 1 .thy files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/AODV/variants/e_all_abcd/E_Aodv.thy)", "provenance": "AFP entry “Loop freedom of the (untimed) AODV routing protocol”, dated 2014-10-23; authors Timothy Bourke, Peter Höfner; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/AODV.toml)", "proof_statement_excerpt": "`lemma aodv_init_sip_not_i [simp]: assumes \"(\\<xi>, p) \\<in> \\<sigma>\\<^sub>A\\<^sub>O\\<^sub>D\\<^sub>V i\" shows \"sip \\<xi> \\<noteq> i\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/AODV/variants/e_all_abcd/E_Aodv.thy#L501))", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/AODV/variants/e_all_abcd/E_Aodv.thy", "has_liveness": false}
{"section": "Isabelle/HOL source cases", "group": "", "name": "AODV / loop-freedom proof", "specifies": "main routing model’s loop-freedom theorem", "safety": "no routing loops", "liveness": "no progress theorem identified in this row’s source", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here", "size": "369 physical lines across 1 .thy files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/AODV/Aodv_Loop_Freedom.thy)", "provenance": "AFP entry “Loop freedom of the (untimed) AODV routing protocol”, dated 2014-10-23; authors Timothy Bourke, Peter Höfner; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/AODV.toml)", "proof_statement_excerpt": "`theorem aodv_loop_freedom: assumes \"wf_net_tree n\" shows \"closed (pnet (\\<lambda>i. paodv i \\<langle>\\<langle> qmsg) n) \\<TTurnstile> netglobal (\\<lambda>\\<sigma>. \\<forall>dip. irrefl ((rt_graph \\<sigma> dip)\\<^sup>+))\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/AODV/Aodv_Loop_Freedom.thy#L363))", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/AODV/Aodv_Loop_Freedom.thy", "has_liveness": false}
{"section": "Isabelle/HOL source cases", "group": "", "name": "ticket lock", "specifies": "concurrent acquire/release using rely/guarantee contracts", "safety": "global/local lock contract preservation", "liveness": "termination/starvation freedom not identified", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here", "size": "421 physical lines across 1 .thy files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/RG_Locks/Lock_Ticket.thy)", "provenance": "AFP entry “Rely-Guarantee Extensions and Locks”, dated 2025-11-21; authors Robert J. Colvin, Scott Heiner, Peter Höfner, Roger C. Su; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/RG_Locks.toml)", "proof_statement_excerpt": "`theorem tktlock_global: assumes \"0 < n\" shows \"valid_multipar: annotated global_init: \\<lbrace> \\<acute>now_serving = 1 \\<and> \\<acute>next_ticket = 1 \\<and> \\<acute>myticket = (\\<lambda>j. 0) \\<and> \\<acute>aux_queue = [] \\<rbrace> global_rely: Id \\<parallel> i < n @ { \\<lbrace> \\<acute>myticket i < \\<acute>now_serving \\<and> i \\<notin> set \\<acute>aux_queue\\<rbrace>, tktlock_rely i } FOREVER ( \\<lbrace> \\<acute>myticket i < \\<acute>now_serving \\<and> i \\<notin> set \\<acute>aux_queue \\<rbrace> / \\<langle>\\<acute>myticket[i] := \\<acute>next_ticket ;; \\<acute>next_ticket := \\<acute>next_ticket + 1 ;; \\<acute>aux_queue := \\<acute>aux_queue @ [i] \\<rangle> .; \\<lbrace> \\<acute>now_serving \\<le> \\<acute>myticket i \\<and> i \\<in> set \\<acute>aux_queue \\<rbrace> SPIN \\<acute>now_serving \\<noteq> \\<acute>myticket i .; {\\<lbrace> \\<acute>now_serving = \\<acute>myticket i \\<and> at_head i \\<acute>aux_queue \\<rbrace>} \\<langle>\\<acute>now_serving := \\<acute>now_serving + 1 ;; \\<acute>aux_queue := tl \\<acute>aux_queue \\<rangle>a ) \\<sslash> tktlock_inv { for_others tktlock_rely i, {} } global_guar: UNIV global_post: \\<lbrace> \\<acute>aux_queue = [] \\<rbrace>\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/RG_Locks/Lock_Ticket.thy#L361)) | `theorem tktlock_acq2: \"rely: tktlock_rely i  guar: for_others tktlock_rely i inv:  tktlock_inv     code: { \\<lbrace> \\<acute>now_serving \\<le> \\<acute>myticket i \\<and> i \\<in> set \\<acute>aux_queue \\<rbrace> } WHILE \\<acute>now_serving \\<noteq> \\<acute>myticket i DO SKIP OD { \\<lbrace> \\<acute>now_serving = \\<acute>myticket i \\<and> at_head i \\<acute>aux_queue \\<rbrace> }\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/RG_Locks/Lock_Ticket.thy#L295)) | `theorem tktlock_rel: \"rely: tktlock_rely i  guar: for_others tktlock_rely i inv:  tktlock_inv     code: { \\<lbrace> \\<acute>now_serving = \\<acute>myticket i \\<and> at_head i \\<acute>aux_queue \\<rbrace> } Basic ((\\<acute>now_serving \\<leftarrow> \\<acute>now_serving + 1) \\<circ>> (\\<acute>aux_queue \\<leftarrow> tl \\<acute>aux_queue)) { \\<lbrace> \\<acute>myticket i < \\<acute>now_serving \\<and> i \\<notin> set \\<acute>aux_queue \\<rbrace> }\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/RG_Locks/Lock_Ticket.thy#L313))", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/RG_Locks/Lock_Ticket.thy", "has_liveness": true}
{"section": "Isabelle/HOL source cases", "group": "", "name": "circular-buffer lock", "specifies": "concurrent acquire/release using rely/guarantee contracts", "safety": "global/local lock contract preservation", "liveness": "termination/starvation freedom not identified", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here", "size": "988 physical lines across 1 .thy files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/RG_Locks/Lock_Circular_Buffer.thy)", "provenance": "AFP entry “Rely-Guarantee Extensions and Locks”, dated 2025-11-21; authors Robert J. Colvin, Scott Heiner, Peter Höfner, Roger C. Su; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/RG_Locks.toml)", "proof_statement_excerpt": "`theorem cblock_global: \"valid_multipar: annotated global_init: cblock_init global_rely: Id \\<parallel> i < NumThreads @ { \\<lbrace> i \\<notin> set \\<acute>aux_queue \\<rbrace>, cblock_rely i } FOREVER (cblock_local i) \\<sslash> cblock_invar i { for_others cblock_rely i, {} } global_guar: UNIV global_post: {}\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/RG_Locks/Lock_Circular_Buffer.thy#L970)) | `theorem cblock_acq: \"annquin_valid rely: cblock_rely  i  guar: for_others cblock_rely i inv: cblock_invar i  annotated_code: { \\<lbrace> i \\<notin> set \\<acute>aux_queue \\<rbrace> } BasicAnno (acq_line1 i) .; { \\<lbrace> i \\<in> set \\<acute>aux_queue \\<rbrace> } (SPIN \\<acute>flag_mapping (\\<acute>myindex i) = Pending ) { \\<lbrace> at_head i \\<acute>aux_queue \\<and> \\<acute>aux_mid_release = None \\<rbrace> }\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/RG_Locks/Lock_Circular_Buffer.thy#L880)) | `theorem cblock_rel: \"annquin_valid rely: cblock_rely  i  guar: for_others cblock_rely i inv: cblock_invar i  annotated_code: { \\<lbrace> at_head i \\<acute>aux_queue \\<and> \\<acute>aux_mid_release = None \\<rbrace> } BasicAnno (rel_line1 i) .; { \\<lbrace> at_head i \\<acute>aux_queue \\<and> \\<acute>aux_mid_release = Some i \\<rbrace> } BasicAnno (rel_line2 i) { \\<lbrace> i \\<notin> set \\<acute>aux_queue \\<rbrace> }\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/RG_Locks/Lock_Circular_Buffer.thy#L904))", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/RG_Locks/Lock_Circular_Buffer.thy", "has_liveness": true}
{"section": "Isabelle/HOL source cases", "group": "", "name": "abstract queue lock", "specifies": "concurrent acquire/release using rely/guarantee contracts", "safety": "global/local lock contract preservation", "liveness": "termination/starvation freedom not identified", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here", "size": "288 physical lines across 1 .thy files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/RG_Locks/Lock_Abstract_Queue.thy)", "provenance": "AFP entry “Rely-Guarantee Extensions and Locks”, dated 2025-11-21; authors Robert J. Colvin, Scott Heiner, Peter Höfner, Roger C. Su; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/RG_Locks.toml)", "proof_statement_excerpt": "`theorem qlock_global_anno: assumes \"0 < N\" shows \"valid_multipar: annotated global_init: \\<lbrace> \\<acute>queue = [] \\<rbrace>  global_rely: Id \\<parallel> i < N @ { \\<lbrace> i \\<notin> set \\<acute>queue \\<rbrace>, qlock_rely i } FOREVER ( \\<acute>queue := \\<acute>queue @ [i] ..; \\<lbrace> i \\<in> set \\<acute>queue \\<rbrace> SPIN hd \\<acute>queue \\<noteq> i  .; {\\<lbrace> at_head i \\<acute>queue \\<rbrace>} (\\<acute>queue := tl \\<acute>queue)- ) \\<sslash> qlock_invar { for_others qlock_rely i, \\<lbrace> i \\<notin> set \\<acute>queue \\<rbrace> } global_guar: UNIV  global_post: \\<lbrace> \\<acute>queue = [] \\<rbrace>\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/RG_Locks/Lock_Abstract_Queue.thy#L258)) | `lemma qlock_rel: \"rely: qlock_rely i  guar: for_others qlock_rely i inv: qlock_invar   code: { \\<lbrace> at_head i \\<acute>queue \\<rbrace> } \\<acute>queue` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/RG_Locks/Lock_Abstract_Queue.thy#L124))", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/RG_Locks/Lock_Abstract_Queue.thy", "has_liveness": true}
{"section": "Isabelle/HOL source cases", "group": "", "name": "COMPLX / Peterson and concurrency examples", "specifies": "two-thread mutual exclusion plus simple parallel programs", "safety": "Peterson mutual exclusion and assertions", "liveness": "no progress theorem identified in this row’s source", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here", "size": "265 physical lines across 1 .thy files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Complx/ex/Examples.thy)", "provenance": "AFP entry “COMPLX: A Verification Framework for Concurrent Imperative Programs”, dated 2016-11-29; authors Sidney Amani, June Andronick, Maksym Bortin, Corey Lewis, Christine Rizkallah, Joseph Tuong; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/Complx.toml)", "proof_statement_excerpt": "`lemma Petersons_mutex_1: \"\\<Gamma>, \\<Theta> |\\<tturnstile>\\<^bsub>/F\\<^esub> \\<lbrace>\\<acute>pr1=0 \\<and> \\<not>\\<acute>in1 \\<and> \\<acute>pr2=0 \\<and> \\<not>\\<acute>in2 \\<rbrace> COBEGIN \\<lbrace>\\<acute>pr1=0 \\<and> \\<not>\\<acute>in1 \\<rbrace>  WHILE True INV \\<lbrace>\\<acute>pr1=0 \\<and> \\<not>\\<acute>in1\\<rbrace> DO \\<lbrace>\\<acute>pr1=0 \\<and> \\<not>\\<acute>in1\\<rbrace> \\<langle> \\<acute>in1` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Complx/ex/Examples.thy#L235))", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Complx/ex/Examples.thy", "has_liveness": false}
{"section": "Isabelle/HOL source cases", "group": "", "name": "COMPLX / parallel array summation", "specifies": "parallel array traversal and sums", "safety": "sum result satisfies specification", "liveness": "no progress theorem identified in this row’s source", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here", "size": "470 physical lines across 1 .thy files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Complx/ex/SumArr.thy)", "provenance": "AFP entry “COMPLX: A Verification Framework for Concurrent Imperative Programs”, dated 2016-11-29; authors Sidney Amani, June Andronick, Maksym Bortin, Corey Lewis, Christine Rizkallah, Joseph Tuong; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/Complx.toml)", "proof_statement_excerpt": "`lemma sumarr_correct: \"\\<Gamma>, \\<Theta> |\\<tturnstile>\\<^bsub>/F\\<^esub> \\<lbrace>\\<acute>precond\\<rbrace> COBEGIN SCHEME [0 \\<le> m < 2] call_sumarr m \\<lbrace>\\<acute>local_postcond m\\<rbrace>,\\<lbrace>False\\<rbrace> COEND \\<lbrace>\\<acute>postcond\\<rbrace>, \\<lbrace>False\\<rbrace>\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Complx/ex/SumArr.thy#L454))", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Complx/ex/SumArr.thy", "has_liveness": false}
{"section": "Isabelle/HOL source cases", "group": "", "name": "CSP / dining philosophers", "specifies": "parameterized philosophers and forks", "safety": "reachable-state invariants", "liveness": "deadlock freedom (a finite-state refusal property); not starvation freedom", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here", "size": "969 physical lines across 1 .thy files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/CSP_RefTK/DiningPhilosophers.thy)", "provenance": "AFP entry “The HOL-CSP Refinement Toolkit”, dated 2020-11-19; authors Safouan Taha, Burkhart Wolff, Lina Ye; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/CSP_RefTK.toml)", "proof_statement_excerpt": "`lemma inv_implies_DF:\"inv_dining ps fs \\<Longrightarrow> Tr\\<^sub>D N (ps, fs) \\<noteq> {}\" unfolding inv_dining_def` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/CSP_RefTK/DiningPhilosophers.thy#L835))", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/CSP_RefTK/DiningPhilosophers.thy", "has_liveness": true}
{"section": "Isabelle/HOL source cases", "group": "", "name": "CSP / copy buffer", "specifies": "communicating copy/buffer pipeline", "safety": "CSP refinement", "liveness": "deadlock freedom; no starvation assertion identified", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here", "size": "87 physical lines across 1 .thy files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/CSP_RefTK/CopyBuffer_props.thy)", "provenance": "AFP entry “The HOL-CSP Refinement Toolkit”, dated 2020-11-19; authors Safouan Taha, Burkhart Wolff, Lina Ye; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/CSP_RefTK.toml)", "proof_statement_excerpt": "`lemma DF_SYSTEM: \"DF UNIV \\<sqsubseteq>\\<^sub>F\\<^sub>D SYSTEM\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/CSP_RefTK/CopyBuffer_props.thy#L71))", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/CSP_RefTK/CopyBuffer_props.thy", "has_liveness": true}
{"section": "Isabelle/HOL source cases", "group": "", "name": "ConcurrentHOL / parallel predicate search", "specifies": "concurrent programs with trace/assume-guarantee semantics", "safety": "refinement or program contract as declared", "liveness": "termination only where covered by exact contract; not inferred", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here", "size": "333 physical lines across 1 .thy files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/ConcurrentHOL/ex/FindP.thy)", "provenance": "AFP entry “ConcurrentHOL”, dated 2024-04-16; authors Peter Gammie; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/ConcurrentHOL.toml)", "proof_statement_excerpt": "`lemma ag_findP_coprime: \\<comment>\\<open> Shuffle the parameter to the precondition, exploiting purity. \\<close> shows \"prog.p2s findP_coprime \\<le> \\<lbrace>\\<langle>a\\<rangle> \\<^bold>= get\\<^bsub>fst\\<^sub>L\\<^esub>\\<rbrace>, Id \\<turnstile> Id, \\<lbrace>\\<lambda>rv s. rv = (LEAST i. i < length (get\\<^bsub>snd\\<^sub>L\\<^esub> s) \\<longrightarrow> coprime a (get\\<^bsub>snd\\<^sub>L\\<^esub> s ! i))\\<rbrace>\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/ConcurrentHOL/ex/FindP.thy#L322))", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/ConcurrentHOL/ex/FindP.thy", "has_liveness": true}
{"section": "Isabelle/HOL source cases", "group": "", "name": "ConcurrentHOL / breadth-first search refinement", "specifies": "concurrent programs with trace/assume-guarantee semantics", "safety": "refinement or program contract as declared", "liveness": "termination only where covered by exact contract; not inferred", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here", "size": "457 physical lines across 1 .thy files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/ConcurrentHOL/ex/BFS.thy)", "provenance": "AFP entry “ConcurrentHOL”, dated 2024-04-16; authors Peter Gammie; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/ConcurrentHOL.toml)", "proof_statement_excerpt": "`theorem ref_bfs: shows \"bfs f P x \\<le> asearch f P x\" unfolding search_def` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/ConcurrentHOL/ex/BFS.thy#L433))", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/ConcurrentHOL/ex/BFS.thy", "has_liveness": true}
{"section": "Isabelle/HOL source cases", "group": "", "name": "ConcurrentHOL / shared-variable increments", "specifies": "concurrent programs with trace/assume-guarantee semantics", "safety": "refinement or program contract as declared", "liveness": "termination only where covered by exact contract; not inferred", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here", "size": "372 physical lines across 1 .thy files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/ConcurrentHOL/ex/WickersonDoddsParkinson.thy)", "provenance": "AFP entry “ConcurrentHOL”, dated 2024-04-16; authors Peter Gammie; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/ConcurrentHOL.toml)", "proof_statement_excerpt": "`lemma pag_incr: \\<comment>\\<open> postcondition can be simplified wrt \\<open>comm_xpp\\<close> \\<close> shows \"prog.p2s incr \\<le> \\<lbrace>\\<lambda>A. wdp.ceiling A ((=) c)\\<rbrace>, comm_xpp \\<turnstile>\\<^sub>P increases, \\<lbrace>\\<lambda>A. \\<langle>wdp.ceiling A ((=) (c + 1))\\<rangle>\\<rbrace>\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/ConcurrentHOL/ex/WickersonDoddsParkinson.thy#L346))", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/ConcurrentHOL/ex/WickersonDoddsParkinson.thy", "has_liveness": true}
{"section": "Isabelle/HOL source cases", "group": "", "name": "ConcurrentHOL / TSO weak-memory litmus tests", "specifies": "concurrent programs with trace/assume-guarantee semantics", "safety": "refinement or program contract as declared", "liveness": "termination only where covered by exact contract; not inferred", "tool": "Isabelle/HOL; specification/definition source; no proof declaration identified in this scope", "size": "127 physical lines across 1 .thy files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/ConcurrentHOL/CImperativeHOL/ex/TSO_litmus.thy)", "provenance": "AFP entry “ConcurrentHOL”, dated 2024-04-16; authors Peter Gammie; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/ConcurrentHOL.toml)", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/ConcurrentHOL/CImperativeHOL/ex/TSO_litmus.thy", "has_liveness": true}
{"section": "Isabelle/HOL source cases", "group": "", "name": "concurrent IMP / semaphore threads", "specifies": "thread-local/global variables, locks, interleaving", "safety": "program correctness", "liveness": "deadlock freedom for particular modeled threads", "tool": "Isabelle/HOL; incomplete proof source: omission tokens found; no completed proof claim", "size": "977 physical lines across 1 .thy files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/IMP_concur/IMP_concur.thy)", "provenance": "AFP entry “IMP_concur - A Semantics for a Language with Concurrency based on HOL-CSP”, dated 2026-08-31; authors Burkhart Wolff; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/IMP_concur.toml)", "proof_statement_excerpt": "`theorem correct: assumes \\<open>\\<forall> i \\<in> set[1..NP]. A'(array(''A'',idx)) = A!(nat(idx-1))\\<close> and    \\<open>length A = nat NP\\<close> shows   \\<open>deadlock_free (Thread7_sem A A')\\<close> unfolding deadlock_free_def Thread7_sem_def Sem_def Thread7_def oops` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/IMP_concur/IMP_concur.thy#L899)) | `theorem bullocks2 :  \\<open>deadlock_free Thread6_sem\\<close> unfolding Thread6_sem_def Sem_def Thread5_def Thread6_def` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/IMP_concur/IMP_concur.thy#L762))", "unfinished_step_evidence": "`oops` ([source line](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/IMP_concur/IMP_concur.thy#L904)); 1 matching source lines in this row’s scope (lexical scan, not a dependency audit)", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/IMP_concur/IMP_concur.thy", "has_liveness": true}
{"section": "Isabelle/HOL source cases", "group": "", "name": "Igloo / leader-election", "specifies": "successive abstract-to-I/O refinements of leader-election", "safety": "event/state invariants and refinement; security models additionally state authentication", "liveness": "no standalone eventual-progress claim identified", "tool": "Isabelle/HOL; Isabelle proof source; not rebuilt; scope includes refinement levels", "size": "1,207 physical lines across 6 .thy files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/b4er/igloo-isabelle/tree/7f8297df1e21bc8f39db2725942536afc2c89b17/case-studies/leader-election)", "proof_statement_excerpt": "`lemma tr2_refines_tr1: \"tr2 \\<sqsubseteq>\\<^sub>\\<pi>2 tr1\"` ([full source statement](https://github.com/b4er/igloo-isabelle/blob/7f8297df1e21bc8f39db2725942536afc2c89b17/case-studies/leader-election/Leader_Election_2.thy#L197)) | `lemma leader_election_node_iospec: \"IOspec t i ad s = (\\<forall>\\<^sup>\\<star> (\\<lambda>v. if v = Unit then ExT (\\<lambda>t'. ExV (\\<lambda>w. CBio B_set_up3s t v w t' \\<star> IOspec t' i ad (s\\<lparr>obuf2 := insert i (obuf2 s)\\<rparr>))) else Bool True) \\<star> (\\<forall>\\<^sup>\\<star> (\\<lambda>v. if v = Unit then ExT (\\<lambda>t'. ExV (\\<lambda>w. CBio B_receive3s t v w t' \\<star>  IOspec t' i ad (s\\<lparr>ibuf2 := insert (MsgD w) (ibuf2 s)\\<rparr>))) else Bool True) \\<star> (\\<forall>\\<^sup>\\<star> (\\<lambda>v. if case v of Msg msg \\<Rightarrow> msg \\<in> ibuf2 s \\<and> i \\<^bold>< msg | _ \\<Rightarrow> False then ExT (\\<lambda>t'. ExV (\\<lambda>w. CBio B_accept3s t v w t' \\<star> IOspec t' i ad (s\\<lparr>obuf2 := insert (MsgD v) (obuf2 s)\\<rparr>))) else Bool True) \\<star> (\\<forall>\\<^sup>\\<star> (\\<lambda>v. if case v of AddrMsg msg ad' \\<Rightarrow> msg \\<in> obuf2 s \\<and> ad' = ad | _ \\<Rightarrow> False then ExT (\\<lambda>t'. ExV (\\<lambda>w. UDP_send t v w t' \\<star> IOspec t' i ad s)) else Bool True) \\<star> (\\<forall>\\<^sup>\\<star> (\\<lambda>v. if i \\<in> ibuf2 s \\<and> v = Unit then ExT (\\<lambda>t'. ExV (\\<lambda>w. CBio B_elect3s t v w t' \\<star> IOspec t' i ad (s\\<lparr>leader2 := True\\<rparr>))) else Bool True) \\<star> (\\<forall>\\<^sup>\\<star> (\\<lambda>v. ExT (\\<lambda>t'. ExV (\\<lambda>w. CBio B_skip3s t v w t' \\<star> IOspec t' i ad s))) \\<star> Bool True))))))\" \\<comment> \\<open>Note first part of proof only work on LHS (in particular, lPr.code).\\<close>` ([full source statement](https://github.com/b4er/igloo-isabelle/blob/7f8297df1e21bc8f39db2725942536afc2c89b17/case-studies/leader-election/Leader_Election_4.thy#L92))", "source_url": "https://github.com/b4er/igloo-isabelle/tree/7f8297df1e21bc8f39db2725942536afc2c89b17/case-studies/leader-election", "has_liveness": false}
{"section": "Isabelle/HOL source cases", "group": "", "name": "Igloo / replication", "specifies": "successive abstract-to-I/O refinements of replication", "safety": "event/state invariants and refinement; security models additionally state authentication", "liveness": "no standalone eventual-progress claim identified", "tool": "Isabelle/HOL; Isabelle proof source; not rebuilt; scope includes refinement levels", "size": "3,746 physical lines across 4 .thy files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/b4er/igloo-isabelle/tree/7f8297df1e21bc8f39db2725942536afc2c89b17/case-studies/replication)", "proof_statement_excerpt": "`lemma cval_case_const: \"(case cval of cUnit \\<Rightarrow> c | cUpdate _ _ \\<Rightarrow> c | cInt1 _ _ \\<Rightarrow> c | cInt2 _ _ _ \\<Rightarrow> c | cInt3 _ \\<Rightarrow> c) = c\"` ([full source statement](https://github.com/b4er/igloo-isabelle/blob/7f8297df1e21bc8f39db2725942536afc2c89b17/case-studies/replication/Primary_Backup_3.thy#L26)) | `lemma multiple_Inv: \"\\<lbrakk>Inv E I; Inv E J\\<rbrakk> \\<Longrightarrow> Inv E (\\<lambda>s. I s \\<and> J s)\"` ([full source statement](https://github.com/b4er/igloo-isabelle/blob/7f8297df1e21bc8f39db2725942536afc2c89b17/case-studies/replication/Utils.thy#L36))", "source_url": "https://github.com/b4er/igloo-isabelle/tree/7f8297df1e21bc8f39db2725942536afc2c89b17/case-studies/replication", "has_liveness": false}
{"section": "Isabelle/HOL source cases", "group": "", "name": "Igloo / security-protocols", "specifies": "successive abstract-to-I/O refinements of security-protocols", "safety": "event/state invariants and refinement; security models additionally state authentication", "liveness": "no standalone eventual-progress claim identified", "tool": "Isabelle/HOL; Isabelle proof source; not rebuilt; scope includes refinement levels", "size": "4,798 physical lines across 16 .thy files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/b4er/igloo-isabelle/tree/7f8297df1e21bc8f39db2725942536afc2c89b17/case-studies/security-protocols)", "proof_statement_excerpt": "`theorem m4_refines_m3: \"m4 \\<sqsubseteq>\\<^sub>\\<pi>\\<^sub>4 m3\"` ([full source statement](https://github.com/b4er/igloo-isabelle/blob/7f8297df1e21bc8f39db2725942536afc2c89b17/case-studies/security-protocols/m4_sig.thy#L609)) | `lemma PO_m2_inv2 [simp, intro]: \"reach m2 s \\<Longrightarrow> m2_inv1_auth s\"` ([full source statement](https://github.com/b4er/igloo-isabelle/blob/7f8297df1e21bc8f39db2725942536afc2c89b17/case-studies/security-protocols/m2_auth_chan.thy#L225))", "source_url": "https://github.com/b4er/igloo-isabelle/tree/7f8297df1e21bc8f39db2725942536afc2c89b17/case-studies/security-protocols", "has_liveness": false}
{"section": "Isabelle/HOL source cases", "group": "", "name": "AWN / toy forwarding protocol", "specifies": "packet forwarding through network node and queue semantics", "safety": "node/next-hop sequence numbers preserve ordered invariant", "liveness": "no progress theorem identified in this row’s source", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here", "size": "875 physical lines across 1 .thy files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/AWN/Toy.thy)", "provenance": "AFP entry “Mechanization of the Algebra for Wireless Networks (AWN)”, dated 2014-03-08; authors Timothy Bourke; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/AWN.toml)", "proof_statement_excerpt": "`lemma bigger_than_next: assumes \"wf_net_tree n\" shows \"closed (pnet (\\<lambda>i. ptoy i \\<langle>\\<langle> qmsg) n) \\<TTurnstile> netglobal (\\<lambda>\\<sigma>. \\<forall>i. no (\\<sigma> i) \\<le> no (\\<sigma> (nhid (\\<sigma> i))))\" (is \"_ \\<TTurnstile> netglobal (\\<lambda>\\<sigma>. \\<forall>i. ?inv \\<sigma> i)\")` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/AWN/Toy.thy#L843))", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/AWN/Toy.thy", "has_liveness": false}
{"section": "Isabelle/HOL source cases", "group": "", "name": "ConcurrentHOL / parallel Floyd–Warshall", "specifies": "parallel updates of shortest-path adjacency matrix", "safety": "parallel program refines chaotic specification; graph complete and numeric limits abstracted", "liveness": "no progress theorem identified in this row’s source", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here", "size": "439 physical lines across 1 .thy files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/ConcurrentHOL/CImperativeHOL/ex/Floyd_Warshall.thy)", "provenance": "AFP entry “ConcurrentHOL”, dated 2024-04-16; authors Peter Gammie; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/ConcurrentHOL.toml)", "proof_statement_excerpt": "`lemma fw_fw_chaotic_le: \\<comment>\\<open> the executable program refines the specification \\<close> shows \"fw a \\<le> fw_chaotic a\" unfolding fw_chaotic_def fw_def` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/ConcurrentHOL/CImperativeHOL/ex/Floyd_Warshall.thy#L56))", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/ConcurrentHOL/CImperativeHOL/ex/Floyd_Warshall.thy", "has_liveness": false}
{"section": "Isabelle/HOL source cases", "group": "", "name": "distributed distinct-element cardinality estimator", "specifies": "randomized mergeable cardinality sketch supporting parallel operation", "safety": "probabilistic approximation and space bounds; network consensus not part of this model", "liveness": "no network/scheduler progress assertion identified", "tool": "Isabelle/HOL; machine-checkable proof source present; not rebuilt here", "size": "6,538 physical lines across 8 .thy files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/isabelle-prover/mirror-afp-devel/tree/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Distributed_Distinct_Elements)", "provenance": "AFP entry “Distributed Distinct Elements”, dated 2023-04-03; authors Emin Karayel; [metadata](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/metadata/entries/Distributed_Distinct_Elements.toml)", "proof_statement_excerpt": "`theorem correctness: fixes X assumes \"sketch_tree_set t \\<subseteq> {..<n}\" defines \"p \\<equiv> pmf_of_set {..<pro_size \\<Theta>}\" defines \"X \\<equiv> real (card (sketch_tree_set t))\" shows \"measure p {\\<omega>. \\<bar>estimate (eval \\<omega> t) - X\\<bar> > \\<epsilon> * X} \\<le> \\<delta>\" (is \"?L \\<le> ?R\")` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Distributed_Distinct_Elements/Distributed_Distinct_Elements_Outer_Algorithm.thy#L542)) | `lemma accuracy_without_cutoff: \"measure \\<Psi> {(f,g,h). \\<bar>Y (f,g,h) - real X\\<bar> > \\<epsilon> * X \\<or> s f < q_max} \\<le> 1/2^4\" (is \"?L \\<le> ?R\")` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Distributed_Distinct_Elements/Distributed_Distinct_Elements_Accuracy_Without_Cutoff.thy#L874)) | `theorem asymptotic_space_complexity: \"space_usage \\<in> O[at_top \\<times>\\<^sub>F at_right 0 \\<times>\\<^sub>F at_right 0](\\<lambda>(n, \\<epsilon>, \\<delta>). ln (1/\\<delta>)/\\<epsilon>^2 + ln n)\"` ([full source statement](https://github.com/isabelle-prover/mirror-afp-devel/blob/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Distributed_Distinct_Elements/Distributed_Distinct_Elements_Outer_Algorithm.thy#L721))", "source_url": "https://github.com/isabelle-prover/mirror-afp-devel/tree/97c7d8847a898346f2e20da3e11ad2a11dca76a0/thys/Distributed_Distinct_Elements", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Basic Paxos / history-variable model", "specifies": "phase 1/2 message-set transitions", "safety": "Agreement: two chosen values cannot differ", "liveness": "no liveness claim identified", "tool": "Lean 4; machine-checkable proof source present; not rebuilt here; explicit axioms found", "size": "1,020 physical lines across 4 .lean files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/xinhong3/PaxosProofLean/tree/98190ec68a432aa8752e3840e27225751eaf82ac/Paxos)", "proof_statement_excerpt": "`theorem Agreement {σ : ℕ → Set Message} (hSpec : PaxosSpec Quorums σ) : ∀ n, Agree (σ n) Quorums` ([full source statement](https://github.com/xinhong3/PaxosProofLean/blob/98190ec68a432aa8752e3840e27225751eaf82ac/Paxos/Proof.lean#L595))", "axiom_evidence": "`axiom QuorumAssumption (h1 : Q₁ ∈ Quorums) (h2 : Q₂ ∈ Quorums) : Q₁ ∩ Q₂ ≠ ∅` ([source line](https://github.com/xinhong3/PaxosProofLean/blob/98190ec68a432aa8752e3840e27225751eaf82ac/Paxos/Spec.lean#L36)); 1 matching source lines in this row’s scope (lexical scan, not a dependency audit)", "source_url": "https://github.com/xinhong3/PaxosProofLean/tree/98190ec68a432aa8752e3840e27225751eaf82ac/Paxos", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "LeanDA / two-phase commit", "specifies": "two-phase commit", "safety": "commit/abort consistency and inductive invariants", "liveness": "no protocol termination proof identified", "tool": "Lean 4; machine-checkable proof source present; not rebuilt here", "size": "1,846 physical lines across 5 .lean files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/konnov/leanda/tree/f7abaa1d043e2902f0081937f0b29eb9f302736e/twophase/Twophase)", "proof_statement_excerpt": "`theorem invariant_implies_consistency (s: ProtocolState RM) (h_inv: invariant s): consistency s` ([full source statement](https://github.com/konnov/leanda/blob/f7abaa1d043e2902f0081937f0b29eb9f302736e/twophase/Twophase/InductiveProofs.lean#L75))", "source_url": "https://github.com/konnov/leanda/tree/f7abaa1d043e2902f0081937f0b29eb9f302736e/twophase/Twophase", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "LeanDA / eventually perfect failure detector", "specifies": "eventually perfect failure detector", "safety": "no separate safety theorem identified; eventual accuracy is a progress property, not safety", "liveness": "strong completeness on fair runs: failed processes eventually stay suspected; eventual strong accuracy remains an unproved commented-out draft", "tool": "Lean 4; machine-checkable proof source present; not rebuilt here", "size": "1,476 physical lines across 4 .lean files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/konnov/leanda/tree/f7abaa1d043e2902f0081937f0b29eb9f302736e/epfd/Epfd)", "proof_statement_excerpt": "`theorem strong_completeness_on_states (tr: Trace Proc) (h_is_fair_run: is_fair_run Proc InitDelay GST MsgDelay tr) (Crashed: Finset Proc): is_strongly_complete Proc Crashed (states_of_trace Proc tr)` ([full source statement](https://github.com/konnov/leanda/blob/f7abaa1d043e2902f0081937f0b29eb9f302736e/epfd/Epfd/PropositionalProofs.lean#L902))", "source_url": "https://github.com/konnov/leanda/tree/f7abaa1d043e2902f0081937f0b29eb9f302736e/epfd/Epfd", "has_liveness": true}
{"section": "Lean 4 source cases", "group": "", "name": "LeanDA / Ben-Or Byzantine agreement", "specifies": "Ben-Or Byzantine agreement", "safety": "agreement invariant over generated definitions", "liveness": "no probabilistic termination theorem identified", "tool": "Lean 4; machine-checkable proof source present; not rebuilt here", "size": "7,063 physical lines across 3 .lean files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/konnov/leanda/tree/f7abaa1d043e2902f0081937f0b29eb9f302736e/Ben-Or/BenOr)", "proof_statement_excerpt": "`theorem agreement_inv_invariant {tr : Nat → State} (hmodel : ∀ i, model_assumptions (tr i)) (htype : ∀ i, type_ok (tr i)) (hinit : init_with_faults (tr 0)) (hnext : ∀ i, Next (tr i) (tr (i + 1))) : ∀ i, agreement_inv (tr i)` ([full source statement](https://github.com/konnov/leanda/blob/f7abaa1d043e2902f0081937f0b29eb9f302736e/Ben-Or/BenOr/Proofs.lean#L6671))", "source_url": "https://github.com/konnov/leanda/tree/f7abaa1d043e2902f0081937f0b29eb9f302736e/Ben-Or/BenOr", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "LeanDA / single-height Tendermint", "specifies": "single-height Tendermint", "safety": "run_agreement and inductive invariant", "liveness": "no termination theorem identified", "tool": "Lean 4; machine-checkable proof source present; not rebuilt here", "size": "8,571 physical lines across 6 .lean files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/konnov/leanda/tree/f7abaa1d043e2902f0081937f0b29eb9f302736e/tendermint-single/TendermintSingle)", "proof_statement_excerpt": "`theorem run_agreement {tr : Nat → State} (hmodel : model_assumptions (tr 0)) (hrun : IsRun tr) (i : Nat) : agreement (tr i)` ([full source statement](https://github.com/konnov/leanda/blob/f7abaa1d043e2902f0081937f0b29eb9f302736e/tendermint-single/TendermintSingle/Proofs/Agreement.lean#L129))", "source_url": "https://github.com/konnov/leanda/tree/f7abaa1d043e2902f0081937f0b29eb9f302736e/tendermint-single/TendermintSingle", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Zug atomic broadcast", "specifies": "round leader, reliable broadcast and weak binary agreement", "safety": "ordered outputs agree and are valid", "liveness": "censorship resilience and eventual outputs under partial synchrony", "tool": "Lean 4; machine-checkable proof source present; not rebuilt here", "size": "3,621 physical lines across 24 .lean files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/SamuelSchlesinger/zug-consensus-formalization/tree/90e1bdab8196b7df1c9598f6f2c0ef0706e57e23/Zug)", "proof_statement_excerpt": "`theorem atomic_broadcast_correctness (pb : ProtocolBehavior V ctx) (L : NodeId) (hL : ctx.correct L) (v : V) (t₀ : Time) (hgst₀ : ctx.sync.gst ≤ t₀) (hpending : ∀ t, t₀ ≤ t → ctx.pending L t v ∨ ∃ k, KthOutputAt ctx.views L t k v) : (∀ N, ctx.correct N → ∀ k w, KthOutput ctx.views N k w → ∀ N', ctx.correct N' → KthOutput ctx.views N' k w) ∧ ∃ k, ∀ N, ctx.correct N → KthOutput ctx.views N k v` ([full source statement](https://github.com/SamuelSchlesinger/zug-consensus-formalization/blob/90e1bdab8196b7df1c9598f6f2c0ef0706e57e23/Zug/Liveness/Theorem.lean#L109)) | `theorem censorship_resilience (pb : ProtocolBehavior V ctx) (L : NodeId) (hL : ctx.correct L) (v : V) (t₀ : Time) (hgst₀ : ctx.sync.gst ≤ t₀) (hpending : ∀ t, t₀ ≤ t → ctx.pending L t v ∨ ∃ k, KthOutputAt ctx.views L t k v) : ∃ k, ∀ N, ctx.correct N → KthOutput ctx.views N k v` ([full source statement](https://github.com/SamuelSchlesinger/zug-consensus-formalization/blob/90e1bdab8196b7df1c9598f6f2c0ef0706e57e23/Zug/Liveness/Theorem.lean#L85)) | `theorem kth_output_agreement (agreement : SubprotocolAgreement V correct views) {N : NodeId} (hN : correct N) {k : Nat} {v : V} (hout : KthOutput views N k v) : ∀ N', correct N' → KthOutput views N' k v` ([full source statement](https://github.com/SamuelSchlesinger/zug-consensus-formalization/blob/90e1bdab8196b7df1c9598f6f2c0ef0706e57e23/Zug/Safety/Theorem.lean#L425))", "source_url": "https://github.com/SamuelSchlesinger/zug-consensus-formalization/tree/90e1bdab8196b7df1c9598f6f2c0ef0706e57e23/Zug", "has_liveness": true}
{"section": "Lean 4 source cases", "group": "", "name": "Zug / reliable broadcast", "specifies": "reliable broadcast", "safety": "agreement and validity", "liveness": "conditional weak termination", "tool": "Lean 4; machine-checkable proof source present; not rebuilt here", "size": "438 physical lines across 5 .lean files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/SamuelSchlesinger/zug-consensus-formalization/tree/90e1bdab8196b7df1c9598f6f2c0ef0706e57e23/Zug/Concrete/RB)", "proof_statement_excerpt": "`theorem rb_agreement {inst : RBInstance V} {qa : QuorumAxioms inst.cfg inst.correct} {np : NetworkProperties (Msg V) inst.correct inst.net inst.gst inst.delta_net} (beh : RBBehavior inst qa np) : RBAgreement inst.correct (mkRBView inst) where persistent` ([full source statement](https://github.com/SamuelSchlesinger/zug-consensus-formalization/blob/90e1bdab8196b7df1c9598f6f2c0ef0706e57e23/Zug/Concrete/RB/Agreement.lean#L51)) | `theorem rb_validity {V : Type} {inst : RBInstance V} {qa : QuorumAxioms inst.cfg inst.correct} {np : NetworkProperties (Msg V) inst.correct inst.net inst.gst inst.delta_net} (beh : RBBehavior inst qa np) : RBValidity inst.correct (mkRBView inst) inst.proposer inst.input_at where validity` ([full source statement](https://github.com/SamuelSchlesinger/zug-consensus-formalization/blob/90e1bdab8196b7df1c9598f6f2c0ef0706e57e23/Zug/Concrete/RB/Validity.lean#L13)) | `theorem rb_weak_termination {inst : RBInstance V} {qa : QuorumAxioms inst.cfg inst.correct} {np : NetworkProperties (Msg V) inst.correct inst.net inst.gst inst.delta_net} (beh : RBBehavior inst qa np) : RBTimedWeakTermination inst.correct (mkRBView inst) inst.proposer inst.input_at inst.gst (3 * inst.delta_net) where weak_termination` ([full source statement](https://github.com/SamuelSchlesinger/zug-consensus-formalization/blob/90e1bdab8196b7df1c9598f6f2c0ef0706e57e23/Zug/Concrete/RB/WeakTermination.lean#L29))", "source_url": "https://github.com/SamuelSchlesinger/zug-consensus-formalization/tree/90e1bdab8196b7df1c9598f6f2c0ef0706e57e23/Zug/Concrete/RB", "has_liveness": true}
{"section": "Lean 4 source cases", "group": "", "name": "Zug / weakly terminating binary agreement", "specifies": "weakly terminating binary agreement", "safety": "agreement and validity", "liveness": "conditional weak termination", "tool": "Lean 4; machine-checkable proof source present; not rebuilt here", "size": "375 physical lines across 4 .lean files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/SamuelSchlesinger/zug-consensus-formalization/tree/90e1bdab8196b7df1c9598f6f2c0ef0706e57e23/Zug/Concrete/WBA)", "proof_statement_excerpt": "`theorem wba_agreement {inst : WBAInstance} {qa : QuorumAxioms inst.cfg inst.correct} {np : NetworkProperties Msg inst.correct inst.net inst.gst inst.delta_net} (beh : WBABehavior inst qa np) : WBAAgreement inst.correct (mkWBAView inst) where persistent` ([full source statement](https://github.com/SamuelSchlesinger/zug-consensus-formalization/blob/90e1bdab8196b7df1c9598f6f2c0ef0706e57e23/Zug/Concrete/WBA/Agreement.lean#L48)) | `theorem wba_validity {inst : WBAInstance} {qa : QuorumAxioms inst.cfg inst.correct} {np : NetworkProperties Msg inst.correct inst.net inst.gst inst.delta_net} (beh : WBABehavior inst qa np) : WBAValidity inst.cfg inst.correct (mkWBAView inst) inst.input_at where validity` ([full source statement](https://github.com/SamuelSchlesinger/zug-consensus-formalization/blob/90e1bdab8196b7df1c9598f6f2c0ef0706e57e23/Zug/Concrete/WBA/Validity.lean#L14)) | `theorem wba_weak_termination {inst : WBAInstance} {qa : QuorumAxioms inst.cfg inst.correct} {np : NetworkProperties Msg inst.correct inst.net inst.gst inst.delta_net} (beh : WBABehavior inst qa np) : WBATimedWeakTermination inst.cfg inst.correct (mkWBAView inst) inst.gst (3 * inst.delta_net) inst.input_at where weak_termination` ([full source statement](https://github.com/SamuelSchlesinger/zug-consensus-formalization/blob/90e1bdab8196b7df1c9598f6f2c0ef0706e57e23/Zug/Concrete/WBA/TimedDelay.lean#L79))", "source_url": "https://github.com/SamuelSchlesinger/zug-consensus-formalization/tree/90e1bdab8196b7df1c9598f6f2c0ef0706e57e23/Zug/Concrete/WBA", "has_liveness": true}
{"section": "Lean 4 source cases", "group": "", "name": "Zug / earlier prototype", "specifies": "network and protocol skeleton", "safety": "partial proof definitions; unfinished statement", "liveness": "not established", "tool": "Lean 4; incomplete Lean prototype; source includes sorry", "size": "116 physical lines across 3 .lean files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/cspr-rad/cspr-consensus-formal/tree/ca67b8a3b39e38a15b7762821235fbc64a8301cd/src/Zug)", "unfinished_step_evidence": "`by sorry` ([source line](https://github.com/cspr-rad/cspr-consensus-formal/blob/ca67b8a3b39e38a15b7762821235fbc64a8301cd/src/Zug/Protocol.lean#L65)); 1 matching source lines in this row’s scope (lexical scan, not a dependency audit)", "source_url": "https://github.com/cspr-rad/cspr-consensus-formal/tree/ca67b8a3b39e38a15b7762821235fbc64a8301cd/src/Zug", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Raft / structural model with proof stubs", "specifies": "Raft roles, persistent log, RPCs and network soup", "safety": "states log matching, network matching and state machine safety; theorem bodies include sorry", "liveness": "not identified", "tool": "Lean 4; specification plus unfinished proof stubs; not a completed Raft proof", "size": "654 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/nocaptheorem/RaftFormalModel/blob/51f60b20d20710ce2b7f06df867a721e47d8ce8d/RaftFormalModel.lean)", "proof_statement_excerpt": "`theorem raft_is_safe (w : NetworkWorld) (trace : List Packet) (h_init : InitState w) : RaftInvariant (applyTrace w trace)` ([full source statement](https://github.com/nocaptheorem/RaftFormalModel/blob/51f60b20d20710ce2b7f06df867a721e47d8ce8d/RaftFormalModel.lean#L570)) | `theorem no_double_voting (node : NodeState) (cA cB term lIdx lTerm : Nat) (h_diff : cA ≠ cB) : let (stateAfterA, grantedA)` ([full source statement](https://github.com/nocaptheorem/RaftFormalModel/blob/51f60b20d20710ce2b7f06df867a721e47d8ce8d/RaftFormalModel.lean#L579)) | `theorem invariant_preserved_over_trace (w : NetworkWorld) (trace : List Packet) (h_inv : RaftInvariant w) : RaftInvariant (applyTrace w trace)` ([full source statement](https://github.com/nocaptheorem/RaftFormalModel/blob/51f60b20d20710ce2b7f06df867a721e47d8ce8d/RaftFormalModel.lean#L564))", "unfinished_step_evidence": "`h_commit_bounds := by sorry` ([source line](https://github.com/nocaptheorem/RaftFormalModel/blob/51f60b20d20710ce2b7f06df867a721e47d8ce8d/RaftFormalModel.lean#L213)); 18 matching source lines in this row’s scope (lexical scan, not a dependency audit)", "source_url": "https://github.com/nocaptheorem/RaftFormalModel/blob/51f60b20d20710ce2b7f06df867a721e47d8ce8d/RaftFormalModel.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "quorum safety / quorum intersection", "specifies": "quorum intersection", "safety": "quorums pairwise intersect", "liveness": "explicitly outside this safety-only model", "tool": "Lean 4; machine-checkable proof source present; not rebuilt here", "size": "85 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/velvetmonkey/consensus-lean/blob/e26358c17682774b14514172f6894c4d6c15f31c/Consensus/Quorum.lean)", "proof_statement_excerpt": "`theorem agreement (qs : QuorumSystem α) (vote : α → Option V) {v v' : V} (h : Chosen qs vote v) (h' : Chosen qs vote v') : v = v'` ([full source statement](https://github.com/velvetmonkey/consensus-lean/blob/e26358c17682774b14514172f6894c4d6c15f31c/Consensus/Quorum.lean#L67))", "source_url": "https://github.com/velvetmonkey/consensus-lean/blob/e26358c17682774b14514172f6894c4d6c15f31c/Consensus/Quorum.lean", "has_liveness": true}
{"section": "Lean 4 source cases", "group": "", "name": "quorum safety / strict-majority quorum instance", "specifies": "strict-majority quorum instance", "safety": "strict majority implies intersection", "liveness": "explicitly outside this safety-only model", "tool": "Lean 4; machine-checkable proof source present; not rebuilt here", "size": "61 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/velvetmonkey/consensus-lean/blob/e26358c17682774b14514172f6894c4d6c15f31c/Consensus/Majority.lean)", "proof_statement_excerpt": "`theorem majority_agreement {V : Type*} (vote : α → Option V) {v v' : V} (h : Chosen (majorityQuorums α) vote v) (h' : Chosen (majorityQuorums α) vote v') : v = v'` ([full source statement](https://github.com/velvetmonkey/consensus-lean/blob/e26358c17682774b14514172f6894c4d6c15f31c/Consensus/Majority.lean#L51))", "source_url": "https://github.com/velvetmonkey/consensus-lean/blob/e26358c17682774b14514172f6894c4d6c15f31c/Consensus/Majority.lean", "has_liveness": true}
{"section": "Lean 4 source cases", "group": "", "name": "quorum safety / single-decree agreement", "specifies": "single-decree agreement", "safety": "same single-valued vote assignment cannot choose two values", "liveness": "explicitly outside this safety-only model", "tool": "Lean 4; machine-checkable proof source present; not rebuilt here", "size": "142 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/velvetmonkey/consensus-lean/blob/e26358c17682774b14514172f6894c4d6c15f31c/Consensus/Certificate.lean)", "proof_statement_excerpt": "`theorem cert_agreement_cross (cfg cfg' : Config α) (vote : α → Option V) (c c' : Cert α V) (h : Valid cfg vote c) (h' : Valid cfg' vote c') (hoverlap : c.voters.card + c'.voters.card > (cfg.members ∪ cfg'.members).card) : c.value = c'.value` ([full source statement](https://github.com/velvetmonkey/consensus-lean/blob/e26358c17682774b14514172f6894c4d6c15f31c/Consensus/Certificate.lean#L129))", "source_url": "https://github.com/velvetmonkey/consensus-lean/blob/e26358c17682774b14514172f6894c4d6c15f31c/Consensus/Certificate.lean", "has_liveness": true}
{"section": "Lean 4 source cases", "group": "", "name": "quorum safety / quorum reconfiguration", "specifies": "quorum reconfiguration", "safety": "agreement across configurations under shared-vote premise", "liveness": "explicitly outside this safety-only model", "tool": "Lean 4; machine-checkable proof source present; not rebuilt here", "size": "118 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/velvetmonkey/consensus-lean/blob/e26358c17682774b14514172f6894c4d6c15f31c/Consensus/Reconfig.lean)", "proof_statement_excerpt": "`theorem agreement_history (configs : ℕ → QuorumSystem α) (hcompat : ∀ i j, Compatible (configs i) (configs j)) (vote : α → Option V) {i j : ℕ} {v v' : V} (h : Chosen (configs i) vote v) (h' : Chosen (configs j) vote v') : v = v'` ([full source statement](https://github.com/velvetmonkey/consensus-lean/blob/e26358c17682774b14514172f6894c4d6c15f31c/Consensus/Reconfig.lean#L99))", "source_url": "https://github.com/velvetmonkey/consensus-lean/blob/e26358c17682774b14514172f6894c4d6c15f31c/Consensus/Reconfig.lean", "has_liveness": true}
{"section": "Lean 4 source cases", "group": "", "name": "quorum safety / certificate checker soundness", "specifies": "certificate checker soundness", "safety": "accepted certificates cannot carry conflicting values", "liveness": "explicitly outside this safety-only model", "tool": "Lean 4; machine-checkable proof source present; not rebuilt here", "size": "126 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/velvetmonkey/consensus-lean/blob/e26358c17682774b14514172f6894c4d6c15f31c/Consensus/CheckerBridge.lean)", "proof_statement_excerpt": "`theorem agreement_via_bridge (members : List Nat) (votes : Votes) (c c' : Checker.Cert) (h : validB members votes c = true) (h' : validB members votes c' = true) : c.value = c'.value` ([full source statement](https://github.com/velvetmonkey/consensus-lean/blob/e26358c17682774b14514172f6894c4d6c15f31c/Consensus/CheckerBridge.lean#L119))", "source_url": "https://github.com/velvetmonkey/consensus-lean/blob/e26358c17682774b14514172f6894c4d6c15f31c/Consensus/CheckerBridge.lean", "has_liveness": true}
{"section": "Lean 4 source cases", "group": "", "name": "CRDT / generic state-based CRDT", "specifies": "generic state-based CRDT", "safety": "equal delivered update sets give equal state", "liveness": "none in this file", "tool": "Lean 4; machine-checkable proof source present; not rebuilt here", "size": "87 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/velvetmonkey/crdt-lean/blob/34e36a8c61fd814ae32ef5a22579b8351cb9f84d/Crdt/Convergence.lean)", "proof_statement_excerpt": "`theorem strong_eventual_consistency (l₁ l₂ : List S) (h : l₁.toFinset = l₂.toFinset) : l₁.foldr merge ⊥ = l₂.foldr merge ⊥` ([full source statement](https://github.com/velvetmonkey/crdt-lean/blob/34e36a8c61fd814ae32ef5a22579b8351cb9f84d/Crdt/Convergence.lean#L47))", "source_url": "https://github.com/velvetmonkey/crdt-lean/blob/34e36a8c61fd814ae32ef5a22579b8351cb9f84d/Crdt/Convergence.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "CRDT / add-wins observed-remove set", "specifies": "add-wins observed-remove set", "safety": "strong eventual consistency", "liveness": "conditional eventual agreement", "tool": "Lean 4; machine-checkable proof source present; not rebuilt here", "size": "147 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/velvetmonkey/crdt-lean/blob/34e36a8c61fd814ae32ef5a22579b8351cb9f84d/Crdt/ORSet.lean)", "proof_statement_excerpt": "`theorem strong_eventual_consistency (l₁ l₂ : List (State α τ)) (h : l₁.toFinset = l₂.toFinset) : l₁.foldr merge ⊥ = l₂.foldr merge ⊥` ([full source statement](https://github.com/velvetmonkey/crdt-lean/blob/34e36a8c61fd814ae32ef5a22579b8351cb9f84d/Crdt/ORSet.lean#L136)) | `theorem eventual_agreement {ι : Type*} (sys : DeliverySystem ι (State α τ)) (r₁ r₂ : ι) : ∃ T, ∀ t, T ≤ t → replicaState (sys.delivered r₁ t) = replicaState (sys.delivered r₂ t)` ([full source statement](https://github.com/velvetmonkey/crdt-lean/blob/34e36a8c61fd814ae32ef5a22579b8351cb9f84d/Crdt/ORSet.lean#L142))", "source_url": "https://github.com/velvetmonkey/crdt-lean/blob/34e36a8c61fd814ae32ef5a22579b8351cb9f84d/Crdt/ORSet.lean", "has_liveness": true}
{"section": "Lean 4 source cases", "group": "", "name": "CRDT / ordered replicated sequence", "specifies": "ordered replicated sequence", "safety": "read strong eventual consistency", "liveness": "conditional eventual agreement", "tool": "Lean 4; machine-checkable proof source present; not rebuilt here", "size": "141 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/velvetmonkey/crdt-lean/blob/34e36a8c61fd814ae32ef5a22579b8351cb9f84d/Crdt/Sequence.lean)", "proof_statement_excerpt": "`theorem read_strong_eventual_consistency (l₁ l₂ : List (State ι α)) (h : l₁.toFinset = l₂.toFinset) : read (l₁.foldr merge ⊥) = read (l₂.foldr merge ⊥)` ([full source statement](https://github.com/velvetmonkey/crdt-lean/blob/34e36a8c61fd814ae32ef5a22579b8351cb9f84d/Crdt/Sequence.lean#L122)) | `theorem eventual_agreement {κ : Type*} (sys : DeliverySystem κ (State ι α)) (r₁ r₂ : κ) : ∃ T, ∀ t, T ≤ t → replicaState (sys.delivered r₁ t) = replicaState (sys.delivered r₂ t)` ([full source statement](https://github.com/velvetmonkey/crdt-lean/blob/34e36a8c61fd814ae32ef5a22579b8351cb9f84d/Crdt/Sequence.lean#L136))", "source_url": "https://github.com/velvetmonkey/crdt-lean/blob/34e36a8c61fd814ae32ef5a22579b8351cb9f84d/Crdt/Sequence.lean", "has_liveness": true}
{"section": "Lean 4 source cases", "group": "", "name": "CRDT / replica delivery system", "specifies": "replica delivery system", "safety": "agreed converged state", "liveness": "all replicas eventually reach and stay at join of all updates under fairness", "tool": "Lean 4; machine-checkable proof source present; not rebuilt here", "size": "106 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/velvetmonkey/crdt-lean/blob/34e36a8c61fd814ae32ef5a22579b8351cb9f84d/Crdt/Liveness.lean)", "proof_statement_excerpt": "`theorem DeliverySystem.eventual_agreement (sys : DeliverySystem ι S) (r₁ r₂ : ι) : ∃ T, ∀ t, T ≤ t → replicaState (sys.delivered r₁ t) = replicaState (sys.delivered r₂ t)` ([full source statement](https://github.com/velvetmonkey/crdt-lean/blob/34e36a8c61fd814ae32ef5a22579b8351cb9f84d/Crdt/Liveness.lean#L99))", "source_url": "https://github.com/velvetmonkey/crdt-lean/blob/34e36a8c61fd814ae32ef5a22579b8351cb9f84d/Crdt/Liveness.lean", "has_liveness": true}
{"section": "Lean 4 source cases", "group": "", "name": "CRDT / partitioned single-use authority and handoff", "specifies": "partitioned single-use authority and handoff", "safety": "no double spend/unique live authority under sealing premises", "liveness": "handoff constraints and modeled availability; source live predicates are not automatically temporal progress", "tool": "Lean 4; machine-checkable proof source present; not rebuilt here", "size": "1,506 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/velvetmonkey/crdt-lean/blob/34e36a8c61fd814ae32ef5a22579b8351cb9f84d/Crdt/AuthorityFrontier.lean)", "proof_statement_excerpt": "`theorem no_silent_handoff (S : AuthoritySystem D) (hsafe : Safe S) (hdis : ∀ c, S.reachable c → ∀ d₁ d₂ : D, d₁ ≠ d₂ → S.disconnected c d₁ d₂) {c₁ c₂ : S.Config} {d₁ d₂ : D} (hr : S.reachable c₁) (hchain : StepChain S c₁ c₂) (h₁ : S.live c₁ d₁) (h₂ : S.live c₂ d₂) : d₁ = d₂` ([full source statement](https://github.com/velvetmonkey/crdt-lean/blob/34e36a8c61fd814ae32ef5a22579b8351cb9f84d/Crdt/AuthorityFrontier.lean#L1463)) | `theorem sealed_handoff_safe (w : CutWorld) (h : w.SealedHandoff) : ∀ C : Finset PE, w.closedCut C → w.validCut C → (w.cutReceipts C).card ≤ 1` ([full source statement](https://github.com/velvetmonkey/crdt-lean/blob/34e36a8c61fd814ae32ef5a22579b8351cb9f84d/Crdt/AuthorityFrontier.lean#L488))", "source_url": "https://github.com/velvetmonkey/crdt-lean/blob/34e36a8c61fd814ae32ef5a22579b8351cb9f84d/Crdt/AuthorityFrontier.lean", "has_liveness": true}
{"section": "Lean 4 source cases", "group": "", "name": "CRDT / G-Set", "specifies": "G-Set merge carrier", "safety": "strong eventual consistency of this carrier", "liveness": "eventual agreement under DeliverySystem fairness", "tool": "Lean 4; machine-checkable proof source present; not rebuilt here", "size": "164 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/velvetmonkey/crdt-lean/blob/34e36a8c61fd814ae32ef5a22579b8351cb9f84d/Crdt/Instances.lean)", "proof_statement_excerpt": "`theorem gset_strong_eventual_consistency (l₁ l₂ : List (Finset α)) (h : l₁.toFinset = l₂.toFinset) : l₁.foldr merge ⊥ = l₂.foldr merge ⊥` ([full source statement](https://github.com/velvetmonkey/crdt-lean/blob/34e36a8c61fd814ae32ef5a22579b8351cb9f84d/Crdt/Instances.lean#L56)) | `theorem gset_eventual_agreement {ι : Type*} (sys : DeliverySystem ι (Finset α)) (r₁ r₂ : ι) : ∃ T, ∀ t, T ≤ t → replicaState (sys.delivered r₁ t) = replicaState (sys.delivered r₂ t)` ([full source statement](https://github.com/velvetmonkey/crdt-lean/blob/34e36a8c61fd814ae32ef5a22579b8351cb9f84d/Crdt/Instances.lean#L62))", "source_url": "https://github.com/velvetmonkey/crdt-lean/blob/34e36a8c61fd814ae32ef5a22579b8351cb9f84d/Crdt/Instances.lean", "has_liveness": true}
{"section": "Lean 4 source cases", "group": "", "name": "CRDT / G-Counter", "specifies": "G-Counter merge carrier", "safety": "strong eventual consistency of this carrier", "liveness": "eventual agreement under DeliverySystem fairness", "tool": "Lean 4; machine-checkable proof source present; not rebuilt here", "size": "164 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/velvetmonkey/crdt-lean/blob/34e36a8c61fd814ae32ef5a22579b8351cb9f84d/Crdt/Instances.lean)", "proof_statement_excerpt": "`theorem gcounter_strong_eventual_consistency (l₁ l₂ : List (GCounter ι)) (h : l₁.toFinset = l₂.toFinset) : l₁.foldr merge ⊥ = l₂.foldr merge ⊥` ([full source statement](https://github.com/velvetmonkey/crdt-lean/blob/34e36a8c61fd814ae32ef5a22579b8351cb9f84d/Crdt/Instances.lean#L98)) | `theorem gcounter_eventual_agreement (sys : DeliverySystem ι (GCounter ι)) (r₁ r₂ : ι) : ∃ T, ∀ t, T ≤ t → replicaState (sys.delivered r₁ t) = replicaState (sys.delivered r₂ t)` ([full source statement](https://github.com/velvetmonkey/crdt-lean/blob/34e36a8c61fd814ae32ef5a22579b8351cb9f84d/Crdt/Instances.lean#L104))", "source_url": "https://github.com/velvetmonkey/crdt-lean/blob/34e36a8c61fd814ae32ef5a22579b8351cb9f84d/Crdt/Instances.lean", "has_liveness": true}
{"section": "Lean 4 source cases", "group": "", "name": "CRDT / PN-Counter", "specifies": "PN-Counter merge carrier", "safety": "strong eventual consistency of this carrier", "liveness": "eventual agreement under DeliverySystem fairness", "tool": "Lean 4; machine-checkable proof source present; not rebuilt here", "size": "164 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/velvetmonkey/crdt-lean/blob/34e36a8c61fd814ae32ef5a22579b8351cb9f84d/Crdt/Instances.lean)", "proof_statement_excerpt": "`theorem pncounter_strong_eventual_consistency (l₁ l₂ : List (PNCounter ι)) (h : l₁.toFinset = l₂.toFinset) : l₁.foldr merge ⊥ = l₂.foldr merge ⊥` ([full source statement](https://github.com/velvetmonkey/crdt-lean/blob/34e36a8c61fd814ae32ef5a22579b8351cb9f84d/Crdt/Instances.lean#L151)) | `theorem pncounter_eventual_agreement (sys : DeliverySystem ι (PNCounter ι)) (r₁ r₂ : ι) : ∃ T, ∀ t, T ≤ t → replicaState (sys.delivered r₁ t) = replicaState (sys.delivered r₂ t)` ([full source statement](https://github.com/velvetmonkey/crdt-lean/blob/34e36a8c61fd814ae32ef5a22579b8351cb9f84d/Crdt/Instances.lean#L157))", "source_url": "https://github.com/velvetmonkey/crdt-lean/blob/34e36a8c61fd814ae32ef5a22579b8351cb9f84d/Crdt/Instances.lean", "has_liveness": true}
{"section": "Lean 4 source cases", "group": "", "name": "decoupled consensus / review theorem", "specifies": "executable consensus model’s bundled guarantees", "safety": "finality safety, monotonicity, accountability and honest-unslashability", "liveness": "availability, finality and recovery under delivery, participation and proposer-recurrence premises", "tool": "Lean 4; Lean theorem source; repository README claims complete proof; this one-file LOC excludes 1,000+ supporting modules", "size": "445 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/fradamt/verified-consensus/blob/b241081d344555797205f8718eeb23a8a0e3eb4c/DecoupledConsensusProofs/ReviewTheorem.lean)", "proof_statement_excerpt": "`theorem concreteConsensus (S : Setup V) : Statements.Instantiation.Consensus S` ([full source statement](https://github.com/fradamt/verified-consensus/blob/b241081d344555797205f8718eeb23a8a0e3eb4c/DecoupledConsensusProofs/ReviewTheorem.lean#L288))", "source_url": "https://github.com/fradamt/verified-consensus/blob/b241081d344555797205f8718eeb23a8a0e3eb4c/DecoupledConsensusProofs/ReviewTheorem.lean", "has_liveness": true}
{"section": "Lean 4 source cases", "group": "", "name": "decoupled consensus / algorithm specification", "specifies": "Goldfish/stable-grade/finality stores, voting, healing and duties", "safety": "algorithm definitions; protocol-level safety theorem not identified", "liveness": "protocol-level liveness theorem not identified", "tool": "Lean 4; Lean specification source, no full consensus proof identified in this scope", "size": "3,605 physical lines across 18 .lean files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/saltiniroberto/decoupled-consensus-lean/tree/3d883df3577282c136c36b75f512caf5969bb96b/lean/Spec)", "source_url": "https://github.com/saltiniroberto/decoupled-consensus-lean/tree/3d883df3577282c136c36b75f512caf5969bb96b/lean/Spec", "has_liveness": true}
{"section": "Lean 4 source cases", "group": "", "name": "synchronous Goldfish security", "specifies": "synchronous Goldfish security", "safety": "ledger safety under explicit good-event assumptions", "liveness": "ledger liveness under synchronous assumptions", "tool": "Lean 4; Lean conditional theorem source; external and probabilistic axioms in Goldfish/Axioms.lean must be included in trust assessment", "size": "236 physical lines across 5 .lean files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/NyxFoundation/goldfish-fv/tree/18b89e7ebf72fac7a8e96370b93edf3ecf0dab0e/Goldfish/SynchronousSecurity)", "proof_statement_excerpt": "`theorem theorem1 (S : Spec E) {lead : Validator} {t : Slot} (hmaj : HonestMajorityPerSlot E) (hlead : E.leader lead t) : ∀ t' : Slot, t < t' → ∀ id : Validator, E.awakeHonest id (E.voteRound t') → E.eligibleVote id t' → E.proposalBlock lead t ≤ E.forkChoice id (E.voteRound t')` ([full source statement](https://github.com/NyxFoundation/goldfish-fv/blob/18b89e7ebf72fac7a8e96370b93edf3ecf0dab0e/Goldfish/SynchronousSecurity/Theorem1.lean#L49)) | `theorem theorem2 (S : Spec E) (L : Ledger E κ) (TX : TxModel E) (hmaj : HonestMajorityPerSlot E) (hwin : HonestLeaderEveryWindow E κ) : L.Safe ∧ TX.Live L ((2 * κ + 2) * (3 * E.Δ))` ([full source statement](https://github.com/NyxFoundation/goldfish-fv/blob/18b89e7ebf72fac7a8e96370b93edf3ecf0dab0e/Goldfish/SynchronousSecurity/Theorem2.lean#L50))", "source_url": "https://github.com/NyxFoundation/goldfish-fv/tree/18b89e7ebf72fac7a8e96370b93edf3ecf0dab0e/Goldfish/SynchronousSecurity", "has_liveness": true}
{"section": "Lean 4 source cases", "group": "", "name": "Goldfish fast confirmation", "specifies": "Goldfish fast confirmation", "safety": "safe fast confirmation", "liveness": "conditional confirmation latency", "tool": "Lean 4; Lean conditional theorem source; external and probabilistic axioms in Goldfish/Axioms.lean must be included in trust assessment", "size": "418 physical lines across 6 .lean files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/NyxFoundation/goldfish-fv/tree/18b89e7ebf72fac7a8e96370b93edf3ecf0dab0e/Goldfish/FastConfirmation)", "proof_statement_excerpt": "`theorem theorem5 (FS : Spec4Δ E) (FL : Ledger4Δ E κ) (hmaj : HonestMajorityPerSlot E) {idc : Validator} {t : Slot} {B : Block} (hfc : E.fastConfirms idc t B) : FL.Safe ∧ ∀ {r : Round} {id : Validator}, 4 * E.Δ * (t + κ) + 2 * E.Δ ≤ r → E.awakeHonest id r → B ≤ FL.chain id r` ([full source statement](https://github.com/NyxFoundation/goldfish-fv/blob/18b89e7ebf72fac7a8e96370b93edf3ecf0dab0e/Goldfish/FastConfirmation/Theorem5.lean#L26)) | `theorem theorem6 (FS : Spec4Δ E) (FL : Ledger4Δ E κ) (TX : TxModel4Δ E) (hmaj : HonestMajorityPerSlot E) (hwin : HonestLeaderEveryWindow E κ) {lead : Validator} {t : Slot} (hlead : E.leader lead t) {idc : Validator} (hwake_idc : E.awakeHonest idc (E.fastConfirmRound t)) : TX.Live FL ((2 * κ + 2) * (4 * E.Δ)) ∧ E.fastConfirms idc t (E.proposalBlock lead t)` ([full source statement](https://github.com/NyxFoundation/goldfish-fv/blob/18b89e7ebf72fac7a8e96370b93edf3ecf0dab0e/Goldfish/FastConfirmation/Theorem6.lean#L85))", "source_url": "https://github.com/NyxFoundation/goldfish-fv/tree/18b89e7ebf72fac7a8e96370b93edf3ecf0dab0e/Goldfish/FastConfirmation", "has_liveness": true}
{"section": "Lean 4 source cases", "group": "", "name": "Goldfish ebb-and-flow composition", "specifies": "Goldfish ebb-and-flow composition", "safety": "accountable finality under gadget assumptions", "liveness": "healing/liveness under stated assumptions", "tool": "Lean 4; Lean conditional theorem source; external and probabilistic axioms in Goldfish/Axioms.lean must be included in trust assessment", "size": "612 physical lines across 8 .lean files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/NyxFoundation/goldfish-fv/tree/18b89e7ebf72fac7a8e96370b93edf3ecf0dab0e/Goldfish/EbbAndFlow)", "proof_statement_excerpt": "`theorem theorem7 {κ : ℕ} {G : Gadget E} (S : Spec E) (L : Ledger E κ) (TX : TxModel E) (Tacc : ℕ) (hmaj : HonestMajorityPerSlot E) (hwin : HonestLeaderEveryWindow E κ) (hchava : ∀ {id : Validator} {r : Round}, G.chava id r = L.chain id r) (hrecency : ∀ {idc : Validator} {r : Round} {B : Block}, G.checkpointed idc r B → G.maxGAS < r → G.Recent L B r) (healing_liveness : HonestLeaderEveryWindow E κ → (∀ {idc : Validator} {r : Round} {B : Block}, G.checkpointed idc r B → G.maxGAS < r → G.Recent L B r) → (∀ {id : Validator} {r r' : Round} {B B' : Block}, G.checkpointed id r B → G.checkpointed id r' B' → r ≤ r' → r' < r + G.Tchkpt → B = B') → G.LiveAfter TX G.chava (G.maxGAS + E.Δ + 2 * G.Tchkpt) (G.Tchkpt + G.Ttmout + G.Tbft)) (accountable_liveness : G.SecureAfter TX G.chava (G.maxGAS + E.Δ + 2 * G.Tchkpt) (G.Tchkpt + G.Ttmout + G.Tbft) → (∀ {id id' : Validator} {r r' : Round} {B B' : Block}, G.checkpointed id r B → G.checkpointed id' r' B' → BlockTree.Consistent B B') → G.LiveAfter TX G.chacc (G.maxGAS + E.Δ + 2 * G.Tchkpt) Tacc) : EbbAndFlowProperty G TX ((2 * κ + 2) * (3 * E.Δ)) (G.maxGAS + E.Δ + 2 * G.Tchkpt) Tacc` ([full source statement](https://github.com/NyxFoundation/goldfish-fv/blob/18b89e7ebf72fac7a8e96370b93edf3ecf0dab0e/Goldfish/EbbAndFlow/Theorem7.lean#L51))", "axiom_evidence": "`axiom proposition3 (G : Gadget E) :` ([source line](https://github.com/NyxFoundation/goldfish-fv/blob/18b89e7ebf72fac7a8e96370b93edf3ecf0dab0e/Goldfish/EbbAndFlow/External.lean#L36)); 5 matching source lines in this row’s scope (lexical scan, not a dependency audit)", "source_url": "https://github.com/NyxFoundation/goldfish-fv/tree/18b89e7ebf72fac7a8e96370b93edf3ecf0dab0e/Goldfish/EbbAndFlow", "has_liveness": true}
{"section": "Lean 4 source cases", "group": "", "name": "bounded Paxos learning model", "specifies": "three-node Python/reactive-module model and network histories", "safety": "Safety stated but universal safety proof remains open; finite replay/interpreter proofs present", "liveness": "unfair-run counterexample to unconditional proposal progress; fair liveness remains open", "tool": "Lean 4; mixed Lean finite witnesses/interpreter proofs and Z3 checks; not a universal Paxos correctness proof", "size": "691 physical lines across 6 .lean files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/Flecart/paxos/tree/7820e324ff828a413ac817d575026d2dc3563370/formal/lean/PaxosFormal)", "proof_statement_excerpt": "`theorem stalled_not_live : ¬ ProposalLiveness stalledTrace` ([full source statement](https://github.com/Flecart/paxos/blob/7820e324ff828a413ac817d575026d2dc3563370/formal/lean/PaxosFormal/Liveness.lean#L70))", "source_url": "https://github.com/Flecart/paxos/tree/7820e324ff828a413ac817d575026d2dc3563370/formal/lean/PaxosFormal", "has_liveness": true}
{"section": "Lean 4 source cases", "group": "", "name": "EPFL prototype / Paxos model", "specifies": "Paxos model", "safety": "model invariant/commit-input consistency where declared; see proof omission scan", "liveness": "not identified", "tool": "Lean 4; prototype definitions/proof attempts; imports include admitted helper lemmas; no complete protocol-proof claim", "size": "165 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/VCA-EPFL/distributed-verification/blob/30ebc19c5a5cc161f6f48b0b8b6a91878b6d100c/Distributed/paxos_model.lean)", "source_url": "https://github.com/VCA-EPFL/distributed-verification/blob/30ebc19c5a5cc161f6f48b0b8b6a91878b6d100c/Distributed/paxos_model.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "EPFL prototype / Paxos proof attempt", "specifies": "Paxos proof attempt", "safety": "model invariant/commit-input consistency where declared; see proof omission scan", "liveness": "not identified", "tool": "Lean 4; prototype definitions/proof attempts; imports include admitted helper lemmas; no complete protocol-proof claim", "size": "109 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/VCA-EPFL/distributed-verification/blob/30ebc19c5a5cc161f6f48b0b8b6a91878b6d100c/Distributed/paxos_proof.lean)", "proof_statement_excerpt": "`theorem inv_proof (s1 s2: System a l p) (v: Value): step s1 s2 -> ∀ j, (s2.learners j).decide ≠ some v -> (s1.learners j).decide ≠ some v` ([full source statement](https://github.com/VCA-EPFL/distributed-verification/blob/30ebc19c5a5cc161f6f48b0b8b6a91878b6d100c/Distributed/paxos_proof.lean#L53))", "source_url": "https://github.com/VCA-EPFL/distributed-verification/blob/30ebc19c5a5cc161f6f48b0b8b6a91878b6d100c/Distributed/paxos_proof.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "EPFL prototype / Paxos proof variant 2", "specifies": "Paxos proof variant 2", "safety": "model invariant/commit-input consistency where declared; see proof omission scan", "liveness": "not identified", "tool": "Lean 4; prototype definitions/proof attempts; imports include admitted helper lemmas; no complete protocol-proof claim", "size": "198 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/VCA-EPFL/distributed-verification/blob/30ebc19c5a5cc161f6f48b0b8b6a91878b6d100c/Distributed/paxos_proof2.lean)", "unfinished_step_evidence": "`sorry` ([source line](https://github.com/VCA-EPFL/distributed-verification/blob/30ebc19c5a5cc161f6f48b0b8b6a91878b6d100c/Distributed/paxos_proof2.lean#L64)); 7 matching source lines in this row’s scope (lexical scan, not a dependency audit)", "source_url": "https://github.com/VCA-EPFL/distributed-verification/blob/30ebc19c5a5cc161f6f48b0b8b6a91878b6d100c/Distributed/paxos_proof2.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "EPFL prototype / Paxos proof variant 3", "specifies": "Paxos proof variant 3", "safety": "model invariant/commit-input consistency where declared; see proof omission scan", "liveness": "not identified", "tool": "Lean 4; prototype definitions/proof attempts; imports include admitted helper lemmas; no complete protocol-proof claim", "size": "65 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/VCA-EPFL/distributed-verification/blob/30ebc19c5a5cc161f6f48b0b8b6a91878b6d100c/Distributed/paxos_proof3.lean)", "proof_statement_excerpt": "`theorem set_inv_is_unique (s: System a l p) (v1 v2: Value) (i j: Fin l): a >=  2 -> set_invariant s v1 i -> set_invariant s v2 j -> v1 = v2` ([full source statement](https://github.com/VCA-EPFL/distributed-verification/blob/30ebc19c5a5cc161f6f48b0b8b6a91878b6d100c/Distributed/paxos_proof3.lean#L44))", "source_url": "https://github.com/VCA-EPFL/distributed-verification/blob/30ebc19c5a5cc161f6f48b0b8b6a91878b6d100c/Distributed/paxos_proof3.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "EPFL prototype / Paxos proof variant 4", "specifies": "Paxos proof variant 4", "safety": "model invariant/commit-input consistency where declared; see proof omission scan", "liveness": "not identified", "tool": "Lean 4; prototype definitions/proof attempts; imports include admitted helper lemmas; no complete protocol-proof claim", "size": "113 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/VCA-EPFL/distributed-verification/blob/30ebc19c5a5cc161f6f48b0b8b6a91878b6d100c/Distributed/paxos_proof4.lean)", "proof_statement_excerpt": "`theorem inv_app (s : System a l p): ∀ i v1 v2, systemIsValid s -> inv_1 s.learners v1 i ∧ inv_2 s.learners s.acceptors i ∧ inv_3 s.acceptors v1 v2` ([full source statement](https://github.com/VCA-EPFL/distributed-verification/blob/30ebc19c5a5cc161f6f48b0b8b6a91878b6d100c/Distributed/paxos_proof4.lean#L80))", "unfinished_step_evidence": "`sorry` ([source line](https://github.com/VCA-EPFL/distributed-verification/blob/30ebc19c5a5cc161f6f48b0b8b6a91878b6d100c/Distributed/paxos_proof4.lean#L30)); 6 matching source lines in this row’s scope (lexical scan, not a dependency audit)", "source_url": "https://github.com/VCA-EPFL/distributed-verification/blob/30ebc19c5a5cc161f6f48b0b8b6a91878b6d100c/Distributed/paxos_proof4.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "EPFL prototype / Paxos proof variant 5", "specifies": "Paxos proof variant 5", "safety": "model invariant/commit-input consistency where declared; see proof omission scan", "liveness": "not identified", "tool": "Lean 4; prototype definitions/proof attempts; imports include admitted helper lemmas; no complete protocol-proof claim", "size": "82 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/VCA-EPFL/distributed-verification/blob/30ebc19c5a5cc161f6f48b0b8b6a91878b6d100c/Distributed/paxos_proof5.lean)", "proof_statement_excerpt": "`theorem decide_imp_set_invariant (s: System a l p) (j: Fin l) (v: Value) : systemIsValid s → (s.learners j).decide = some v → set_invariant s v j` ([full source statement](https://github.com/VCA-EPFL/distributed-verification/blob/30ebc19c5a5cc161f6f48b0b8b6a91878b6d100c/Distributed/paxos_proof5.lean#L56))", "unfinished_step_evidence": "`. sorry` ([source line](https://github.com/VCA-EPFL/distributed-verification/blob/30ebc19c5a5cc161f6f48b0b8b6a91878b6d100c/Distributed/paxos_proof5.lean#L68)); 1 matching source lines in this row’s scope (lexical scan, not a dependency audit)", "source_url": "https://github.com/VCA-EPFL/distributed-verification/blob/30ebc19c5a5cc161f6f48b0b8b6a91878b6d100c/Distributed/paxos_proof5.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "EPFL prototype / Paxos proof variant 6", "specifies": "Paxos proof variant 6", "safety": "model invariant/commit-input consistency where declared; see proof omission scan", "liveness": "not identified", "tool": "Lean 4; prototype definitions/proof attempts; imports include admitted helper lemmas; no complete protocol-proof claim", "size": "151 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/VCA-EPFL/distributed-verification/blob/30ebc19c5a5cc161f6f48b0b8b6a91878b6d100c/Distributed/paxos_proof6.lean)", "proof_statement_excerpt": "`theorem full_inv_proof (s: System a l p) (v : Value) (j: Fin l): systemIsValid s -> ((s.learners j).decide = some v -> learn_invariant s v j) ∧ (learn_invariant s v j -> mess_invariant s v) ∧ (mess_invariant s v -> acc_invariant s v)` ([full source statement](https://github.com/VCA-EPFL/distributed-verification/blob/30ebc19c5a5cc161f6f48b0b8b6a91878b6d100c/Distributed/paxos_proof6.lean#L104))", "unfinished_step_evidence": "`-> Message.Learn (i, v, id) ∈ s1.network.messages) := by sorry` ([source line](https://github.com/VCA-EPFL/distributed-verification/blob/30ebc19c5a5cc161f6f48b0b8b6a91878b6d100c/Distributed/paxos_proof6.lean#L43)); 2 matching source lines in this row’s scope (lexical scan, not a dependency audit)", "source_url": "https://github.com/VCA-EPFL/distributed-verification/blob/30ebc19c5a5cc161f6f48b0b8b6a91878b6d100c/Distributed/paxos_proof6.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "EPFL prototype / two-phase commit model", "specifies": "two-phase commit model", "safety": "model invariant/commit-input consistency where declared; see proof omission scan", "liveness": "not identified", "tool": "Lean 4; prototype definitions/proof attempts; imports include admitted helper lemmas; no complete protocol-proof claim", "size": "100 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/VCA-EPFL/distributed-verification/blob/30ebc19c5a5cc161f6f48b0b8b6a91878b6d100c/Distributed/paper_model.lean)", "source_url": "https://github.com/VCA-EPFL/distributed-verification/blob/30ebc19c5a5cc161f6f48b0b8b6a91878b6d100c/Distributed/paper_model.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "EPFL prototype / two-phase commit proof", "specifies": "two-phase commit proof", "safety": "model invariant/commit-input consistency where declared; see proof omission scan", "liveness": "not identified", "tool": "Lean 4; prototype definitions/proof attempts; imports include admitted helper lemmas; no complete protocol-proof claim", "size": "127 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/VCA-EPFL/distributed-verification/blob/30ebc19c5a5cc161f6f48b0b8b6a91878b6d100c/Distributed/paper_proofs.lean)", "proof_statement_excerpt": "`theorem commitImpliesPreference (s: System n) : validSystem s -> (∃ i, (s.participants i).decision = Decision.Commit) -> ∀ i, (s.participants i).preference = Preference.Yes` ([full source statement](https://github.com/VCA-EPFL/distributed-verification/blob/30ebc19c5a5cc161f6f48b0b8b6a91878b6d100c/Distributed/paper_proofs.lean#L117)) | `theorem acceptImpliesMessageSentINV (s: System n) (i: Fin n): validSystem s -> (s.participants i).preference ≠ Preference.Yes -> s.coordinator.yesVotes i = false ∧ Message.Vote Preference.Yes i ∉ s.network.network` ([full source statement](https://github.com/VCA-EPFL/distributed-verification/blob/30ebc19c5a5cc161f6f48b0b8b6a91878b6d100c/Distributed/paper_proofs.lean#L60))", "source_url": "https://github.com/VCA-EPFL/distributed-verification/blob/30ebc19c5a5cc161f6f48b0b8b6a91878b6d100c/Distributed/paper_proofs.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "EPFL prototype / two-phase commit alternate model", "specifies": "two-phase commit alternate model", "safety": "model invariant/commit-input consistency where declared; see proof omission scan", "liveness": "not identified", "tool": "Lean 4; prototype definitions/proof attempts; imports include admitted helper lemmas; no complete protocol-proof claim", "size": "95 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/VCA-EPFL/distributed-verification/blob/30ebc19c5a5cc161f6f48b0b8b6a91878b6d100c/Distributed/two_phase_commit.lean)", "source_url": "https://github.com/VCA-EPFL/distributed-verification/blob/30ebc19c5a5cc161f6f48b0b8b6a91878b6d100c/Distributed/two_phase_commit.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "lean-dag / Mysticeti", "specifies": "uncertified DAG consensus with quorum-supported commit and skip rules", "safety": "agreement/commit exclusion or checkpoint safety properties are specified; proof coverage is established only by the exact theorem excerpts below", "liveness": "conditional commits/decisions where quoted; no unconditional network-delivery inference", "tool": "Lean 4; Lean definitions and proof artifacts; a def/property declaration does not itself prove the stated guarantee; exact theorem excerpts identify covered claims; not rebuilt", "size": "3,189 physical lines across 9 .lean files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/gdanezis/lean-dag/tree/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Mysticeti)", "proof_statement_excerpt": "`theorem safety : Properties.Safe (mysticetiRule (Validator := Validator) (BlockId := BlockId) (Payload := Payload))` ([full source statement](https://github.com/gdanezis/lean-dag/blob/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Mysticeti/Properties.lean#L799)) | `theorem commits_recur_local_of_pace (vp : ViewPace U T N) (hcard : quorumCard Validator ≤ T.card) (fair : FairScheduleOn T) (R : ℕ) (hgst : vp.gst ≤ R) (hbackoff : ∀ n, R ≤ n → 2 * vp.delay + vp.proc ≤ vp.timeout n) (k : ℕ) : ∃ k', k ≤ k' ∧ R ≤ S.slotRound k' ∧ (S.slotRound k' + 2 ≤ N → ∃ L : BlockId, IsLeaderBlock U k' L ∧ ∀ v ∈ T, Decided U (vp.viewAt v (vp.latest (S.slotRound k' + 2) + vp.delay)) k' (some L))` ([full source statement](https://github.com/gdanezis/lean-dag/blob/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Mysticeti/ViewPace.lean#L555)) | `theorem decided_of_wait (vp : ViewPace U T N) (hcard : quorumCard Validator ≤ T.card) (hgst : vp.gst ≤ R) (hwait : ∀ n, R ≤ n → 2 * vp.delay + vp.proc ≤ vp.timeout n) (hR : R ≤ S.slotRound k) (hN : S.slotRound k + 2 ≤ N) (hlead : S.leader k ∈ T) : ∃ L, IsLeaderBlock U k L ∧ Decided U (View.full U) k (some L)` ([full source statement](https://github.com/gdanezis/lean-dag/blob/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Mysticeti/ViewPace.lean#L721)) | `theorem liveness : Properties.Support.Lives (R := mysticetiRule (Validator := Validator) (BlockId := BlockId) (Payload := Payload)) coreSupport (coreReliability Validator)` ([full source statement](https://github.com/gdanezis/lean-dag/blob/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Mysticeti/Properties.lean#L805))", "source_url": "https://github.com/gdanezis/lean-dag/tree/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Mysticeti", "has_liveness": true}
{"section": "Lean 4 source cases", "group": "", "name": "lean-dag / MahiMahi", "specifies": "wave-based DAG consensus with cone votes", "safety": "agreement/commit exclusion or checkpoint safety properties are specified; proof coverage is established only by the exact theorem excerpts below", "liveness": "conditional commits/decisions where quoted; no unconditional network-delivery inference", "tool": "Lean 4; Lean definitions and proof artifacts; a def/property declaration does not itself prove the stated guarantee; exact theorem excerpts identify covered claims; not rebuilt", "size": "2,428 physical lines across 20 .lean files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/gdanezis/lean-dag/tree/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/MahiMahi)", "proof_statement_excerpt": "`theorem safety (hw : 2 ≤ w) : Properties.Safe (mahiMahiRule (Validator := Validator) (BlockId := BlockId) (Payload := Payload) w)` ([full source statement](https://github.com/gdanezis/lean-dag/blob/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/MahiMahi/Properties.lean#L407)) | `theorem mmSupport_commits {w : ℕ} (hw : 2 ≤ w) : Support.Commits (R := mahiMahiRule (Validator := Validator) (BlockId := BlockId) (Payload := Payload) w) (mmSupport w) (coreReliability Validator)` ([full source statement](https://github.com/gdanezis/lean-dag/blob/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/MahiMahi/Properties.lean#L344)) | `theorem allDecidedBelow {w c d N : ℕ} (hspan : (mahiMahiAnchored Validator BlockId Payload w).SpansEligible d) (hrun : UnpredictableRunWithin U w c d N) (k : ℕ) (hk : (mahiMahiAnchored Validator BlockId Payload w).decisionRound (k + c + d - 1) ≤ N) : ∃ b, k ≤ b ∧ ∀ i, i < b → ∃ v, Decided w U (View.full U) i v` ([full source statement](https://github.com/gdanezis/lean-dag/blob/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/MahiMahi/Helpers/Liveness.lean#L53))", "source_url": "https://github.com/gdanezis/lean-dag/tree/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/MahiMahi", "has_liveness": true}
{"section": "Lean 4 source cases", "group": "", "name": "lean-dag / AsyncBlueBottle", "specifies": "asynchronous DAG commit variant with a weak cone test", "safety": "agreement/commit exclusion or checkpoint safety properties are specified; proof coverage is established only by the exact theorem excerpts below", "liveness": "conditional commits/decisions where quoted; no unconditional network-delivery inference", "tool": "Lean 4; Lean definitions and proof artifacts; a def/property declaration does not itself prove the stated guarantee; exact theorem excerpts identify covered claims; not rebuilt", "size": "2,179 physical lines across 20 .lean files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/gdanezis/lean-dag/tree/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/AsyncBlueBottle)", "proof_statement_excerpt": "`theorem safety : Properties.Safe (asyncBlueBottleRule (Validator := Validator) (BlockId := BlockId) (Payload := Payload))` ([full source statement](https://github.com/gdanezis/lean-dag/blob/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/AsyncBlueBottle/Properties.lean#L316)) | `theorem abbSupport_commits : Support.Commits (R := asyncBlueBottleRule (Validator := Validator) (BlockId := BlockId) (Payload := Payload)) abbSupport (coreReliability Validator)` ([full source statement](https://github.com/gdanezis/lean-dag/blob/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/AsyncBlueBottle/Properties.lean#L262)) | `theorem allDecidedBelow {c d N : ℕ} {V : View Validator BlockId Payload U} (hspan : (asyncBlueBottleAnchored Validator BlockId Payload).SpansEligible d) (hrun : UnpredictableRunWithin U c d N) (hV : V.CoversUpto N) (k : ℕ) (hk : (asyncBlueBottleAnchored Validator BlockId Payload).decisionRound (k + c + d - 1) ≤ N) : ∃ b, k ≤ b ∧ ∀ i, i < b → ∃ v, Decided U V i v` ([full source statement](https://github.com/gdanezis/lean-dag/blob/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/AsyncBlueBottle/Helpers/Liveness.lean#L47))", "source_url": "https://github.com/gdanezis/lean-dag/tree/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/AsyncBlueBottle", "has_liveness": true}
{"section": "Lean 4 source cases", "group": "", "name": "lean-dag / Bluestreak", "specifies": "sparse DAG with referenceable claims and pull pacemaker", "safety": "agreement/commit exclusion or checkpoint safety properties are specified; proof coverage is established only by the exact theorem excerpts below", "liveness": "conditional commits/decisions where quoted; no unconditional network-delivery inference", "tool": "Lean 4; Lean definitions and proof artifacts; a def/property declaration does not itself prove the stated guarantee; exact theorem excerpts identify covered claims; not rebuilt", "size": "1,112 physical lines across 5 .lean files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/gdanezis/lean-dag/tree/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Bluestreak)", "proof_statement_excerpt": "`theorem safety : Properties.Safe (bluestreakRule (Validator := Validator) (BlockId := BlockId) (Payload := Payload))` ([full source statement](https://github.com/gdanezis/lean-dag/blob/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Bluestreak/Carrier.lean#L328)) | `theorem commits : (bluestreakSupport (Validator := Validator) (BlockId := BlockId) (Payload := Payload)).Commits (R := bluestreakRule) (bluestreakReliability Validator)` ([full source statement](https://github.com/gdanezis/lean-dag/blob/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Bluestreak/Carrier.lean#L114)) | `theorem decided_below_of_run (hT : T ⊆ (Correct : Finset Validator)) (hcard : quorumCard Validator ≤ T.card) (hgst : rb.gst ≤ R) (hto : ∀ n, R ≤ n → 2 * rb.delay + rb.proc ≤ rb.timeout n) (hspan : (bluestreakAnchored Validator BlockId Payload).SpansEligible (S := S) 3) {b : ℕ} (hR : R ≤ S.slotRound b) (hN : S.slotRound (b + 2) + 2 ≤ N) (hrun : ∀ i, i < 3 → S.leader (b + i) ∈ T) : ∀ i, i < b → ∃ v, Decided U (View.full U) i v` ([full source statement](https://github.com/gdanezis/lean-dag/blob/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Bluestreak/Reactive.lean#L255)) | `theorem liveness : Properties.Support.Lives (R := bluestreakRule (Validator := Validator) (BlockId := BlockId) (Payload := Payload)) bluestreakSupport (bluestreakReliability Validator)` ([full source statement](https://github.com/gdanezis/lean-dag/blob/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Bluestreak/Carrier.lean#L335))", "source_url": "https://github.com/gdanezis/lean-dag/tree/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Bluestreak", "has_liveness": true}
{"section": "Lean 4 source cases", "group": "", "name": "lean-dag / Nemo", "specifies": "two-round crash-fault DAG consensus", "safety": "agreement/commit exclusion or checkpoint safety properties are specified; proof coverage is established only by the exact theorem excerpts below", "liveness": "conditional commits/decisions where quoted; no unconditional network-delivery inference", "tool": "Lean 4; Lean definitions and proof artifacts; a def/property declaration does not itself prove the stated guarantee; exact theorem excerpts identify covered claims; not rebuilt", "size": "928 physical lines across 7 .lean files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/gdanezis/lean-dag/tree/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Nemo)", "proof_statement_excerpt": "`theorem safety : Properties.Safe (nemoRule (Validator := Validator) (BlockId := BlockId) (Payload := Payload))` ([full source statement](https://github.com/gdanezis/lean-dag/blob/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Nemo/Properties.lean#L238)) | `theorem voteSupport_commits (hn : 0 < Fintype.card Validator) : (voteSupport (nemoRule (Validator := Validator) (BlockId := BlockId) (Payload := Payload))).Commits (nemoReliability Validator hn)` ([full source statement](https://github.com/gdanezis/lean-dag/blob/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Nemo/Properties.lean#L111)) | `theorem all_decided_below_of_fairRun_live {c : ℕ} (hc : 0 < c) (hspan : (Nemo.nemoAnchored Validator BlockId Payload).SpansEligible c) (fair : FairRunOn (Live Validator) c) (R : ℕ) (s : ℕ) : ∃ b, s ≤ b ∧ R ≤ S.slotRound b ∧ ∀ (U : Universe Validator BlockId Payload) (N : ℕ) (V : View Validator BlockId Payload U), (∀ r ≤ N, Populated U r) → Synchronised U R → S.slotRound (b + c - 1) + 1 ≤ N → V.CoversUpto N → ∀ i, i < b → ∃ v, Decided U V i v` ([full source statement](https://github.com/gdanezis/lean-dag/blob/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Nemo/Properties.lean#L214))", "source_url": "https://github.com/gdanezis/lean-dag/tree/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Nemo", "has_liveness": true}
{"section": "Lean 4 source cases", "group": "", "name": "lean-dag / Odontoceti", "specifies": "two-round Byzantine DAG consensus", "safety": "agreement/commit exclusion or checkpoint safety properties are specified; proof coverage is established only by the exact theorem excerpts below", "liveness": "conditional commits/decisions where quoted; no unconditional network-delivery inference", "tool": "Lean 4; Lean definitions and proof artifacts; a def/property declaration does not itself prove the stated guarantee; exact theorem excerpts identify covered claims; not rebuilt", "size": "990 physical lines across 6 .lean files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/gdanezis/lean-dag/tree/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Odontoceti)", "proof_statement_excerpt": "`theorem safety : Properties.Safe (odontocetiRule (Validator := Validator) (BlockId := BlockId) (Payload := Payload))` ([full source statement](https://github.com/gdanezis/lean-dag/blob/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Odontoceti/Properties.lean#L251)) | `theorem voteSupport_commits : (voteSupport (odontocetiRule (Validator := Validator) (BlockId := BlockId) (Payload := Payload))).Commits (coreReliability Validator)` ([full source statement](https://github.com/gdanezis/lean-dag/blob/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Odontoceti/Properties.lean#L129)) | `theorem decided_none_fresh_agree_odontoceti [S : Slots Validator] (sk : SkipMsg W) {V : View Validator B Payload W} {T : Finset Validator} {k : ℕ} (hcard : quorumCard Validator ≤ T.card) (hlead : S.leader k = sk.v1) (hk1 : sk.r0 < S.slotRound k) (hk2 : S.slotRound k ≤ sk.r) (hpres : PresentAt (OdontocetiProperties.odontocetiRule (Payload := Payload)) V T (S.slotRound k + 1)) {U'' : BlockUniverse Validator B Payload} (he' : Extends (OdontocetiProperties.odontocetiRule (Payload := Payload)) sk.skipFill U'') {V'' Y : View Validator B Payload U''} (hsub : (sk.liftView V).ids ⊆ V''.ids) {v : Option B} (hY : Odontoceti.Decided U'' Y k v) : v = none` ([full source statement](https://github.com/gdanezis/lean-dag/blob/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Odontoceti/Record.lean#L83)) | `theorem liveness : Properties.Support.Lives (Properties.voteSupport (odontocetiRule (Validator := Validator) (BlockId := BlockId) (Payload := Payload))) (coreReliability Validator)` ([full source statement](https://github.com/gdanezis/lean-dag/blob/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Odontoceti/Properties.lean#L255))", "source_url": "https://github.com/gdanezis/lean-dag/tree/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Odontoceti", "has_liveness": true}
{"section": "Lean 4 source cases", "group": "", "name": "lean-dag / FinWhale", "specifies": "DAG consensus with a fast path and variable fault thresholds", "safety": "agreement/commit exclusion or checkpoint safety properties are specified; proof coverage is established only by the exact theorem excerpts below", "liveness": "conditional commits/decisions where quoted; no unconditional network-delivery inference", "tool": "Lean 4; Lean definitions and proof artifacts; a def/property declaration does not itself prove the stated guarantee; exact theorem excerpts identify covered claims; not rebuilt", "size": "5,938 physical lines across 46 .lean files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/gdanezis/lean-dag/tree/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/FinWhale)", "proof_statement_excerpt": "`theorem agreement_of_commits [LinearOrder BlockId] {V V' : D.View} {dec dec' : ℕ → Verdict BlockId} (hwf : WellFormed (EligibleAt (S := S) 2) (viewCommit S D V) (viewSkip S D V) (chooseLeast S D) dec) (hwf' : WellFormed (EligibleAt (S := S) 2) (viewCommit S D V') (viewSkip S D V') (chooseLeast S D) dec') {M : ℕ} (hbound : ∀ s, M ≤ s → dec s = Verdict.undecided ∧ dec' s = Verdict.undecided) {R N : ℕ} (hsees : SeesCommits S D (viewCommit S D V) R N) (hsees' : SeesCommits S D (viewCommit S D V') R N) (hrr : RoundRobin S.leader) (hid : ∀ s, S.slotRound s = s) {k : ℕ} (hkN : max k R + (3 * F.f + 5) ≤ N) (hist : BlockId → List BlockId) : linearise hist (commitSeq dec k) = linearise hist (commitSeq dec' k)` ([full source statement](https://github.com/gdanezis/lean-dag/blob/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/FinWhale/Procedure/View.lean#L107)) | `theorem safety : Properties.Safe (finWhaleRule (Validator := Validator) (BlockId := BlockId) (Payload := Payload))` ([full source statement](https://github.com/gdanezis/lean-dag/blob/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/FinWhale/Carrier.lean#L356)) | `theorem sees_of_commits_of_held {V : D.View} {R N : ℕ} (hcommits : CommitsCorrectLeaders S D R N) (hheld : ∀ n, R ≤ n → n ≤ N → ∀ b ∈ blocksAt D n, (D.block b).creator ∈ (Correct : Finset Validator) → b ∈ V.ids) : SeesCommits S D (viewCommit S D V ) R N` ([full source statement](https://github.com/gdanezis/lean-dag/blob/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/FinWhale/View.lean#L340)) | `theorem decided_of_wellFormed {V : D.View} {dec : ℕ → Verdict BlockId} (hwf : WellFormed (EligibleAt (S := S) 2) (viewCommit S D V) (viewSkip S D V) (chooseLeast S D) dec) {N : ℕ} (hN : ∀ s, N ≤ s → dec s = Verdict.undecided) : ∀ r, dec r ≠ Verdict.undecided → Decided D V r (dec r).optOf` ([full source statement](https://github.com/gdanezis/lean-dag/blob/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/FinWhale/Procedure/View.lean#L52))", "source_url": "https://github.com/gdanezis/lean-dag/tree/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/FinWhale", "has_liveness": true}
{"section": "Lean 4 source cases", "group": "", "name": "lean-dag / Hydrozoan", "specifies": "DAG consensus with fast/slow commit routes", "safety": "agreement/commit exclusion or checkpoint safety properties are specified; proof coverage is established only by the exact theorem excerpts below", "liveness": "conditional commits/decisions where quoted; no unconditional network-delivery inference", "tool": "Lean 4; Lean definitions and proof artifacts; a def/property declaration does not itself prove the stated guarantee; exact theorem excerpts identify covered claims; not rebuilt", "size": "4,021 physical lines across 47 .lean files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/gdanezis/lean-dag/tree/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Hydrozoan)", "proof_statement_excerpt": "`theorem seqAgreement : SeqAgreement U` ([full source statement](https://github.com/gdanezis/lean-dag/blob/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Hydrozoan/PrefixAgreement/Proof.lean#L25)) | `theorem safety : LeanDag.Properties.Safe (rule (Replica := Replica) (BlockId := BlockId))` ([full source statement](https://github.com/gdanezis/lean-dag/blob/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Hydrozoan/Properties/Proof.lean#L44)) | `theorem commitSeq_prefix {g : ℕ → Option BlockId} {n₁ n₂ : ℕ} (h : n₁ ≤ n₂) : commitSeq g n₁ <+: commitSeq g n₂` ([full source statement](https://github.com/gdanezis/lean-dag/blob/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Hydrozoan/PrefixAgreement/Proof.lean#L34))", "source_url": "https://github.com/gdanezis/lean-dag/tree/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Hydrozoan", "has_liveness": true}
{"section": "Lean 4 source cases", "group": "", "name": "lean-dag / OptimalHydrozoan", "specifies": "optimized Hydrozoan with pruning and recovery", "safety": "agreement/commit exclusion or checkpoint safety properties are specified; proof coverage is established only by the exact theorem excerpts below", "liveness": "conditional commits/decisions where quoted; no unconditional network-delivery inference", "tool": "Lean 4; Lean definitions and proof artifacts; a def/property declaration does not itself prove the stated guarantee; exact theorem excerpts identify covered claims; not rebuilt", "size": "3,533 physical lines across 36 .lean files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/gdanezis/lean-dag/tree/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/OptimalHydrozoan)", "proof_statement_excerpt": "`theorem seqAgreement : SeqAgreement U` ([full source statement](https://github.com/gdanezis/lean-dag/blob/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/OptimalHydrozoan/PrefixAgreement/Proof.lean#L30)) | `theorem safety : Properties.Safe (optimalRule (Replica := Replica) (BlockId := BlockId))` ([full source statement](https://github.com/gdanezis/lean-dag/blob/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/OptimalHydrozoan/Carrier.lean#L286)) | `theorem voteSupport_fast_commits (h : (O.byzantine ∪ O.crashed).card ≤ LeanDag.OptimalHydrozoan.pOpt Replica) (hmin : 2 * LeanDag.OptimalHydrozoan.pOpt Replica < Fintype.card Replica) : Support.Commits (R := optimalRule (Replica := Replica) (BlockId := BlockId)) (voteSupport (optimalRule (Replica := Replica) (BlockId := BlockId))) (optFastReliability Replica h hmin)` ([full source statement](https://github.com/gdanezis/lean-dag/blob/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/OptimalHydrozoan/Carrier.lean#L226))", "source_url": "https://github.com/gdanezis/lean-dag/tree/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/OptimalHydrozoan", "has_liveness": true}
{"section": "Lean 4 source cases", "group": "", "name": "lean-dag / Hybrid", "specifies": "DAG consensus separating Byzantine and crash faults", "safety": "agreement/commit exclusion or checkpoint safety properties are specified; proof coverage is established only by the exact theorem excerpts below", "liveness": "conditional commits/decisions where quoted; no unconditional network-delivery inference", "tool": "Lean 4; Lean definitions and proof artifacts; a def/property declaration does not itself prove the stated guarantee; exact theorem excerpts identify covered claims; not rebuilt", "size": "1,202 physical lines across 8 .lean files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/gdanezis/lean-dag/tree/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Hybrid)", "proof_statement_excerpt": "`theorem safety {kt : ℕ} (hpos : 0 < kt) (hk : Hybrid.Admissible Validator kt) : Properties.Safe (hybridRule (Validator := Validator) (BlockId := BlockId) (Payload := Payload) kt)` ([full source statement](https://github.com/gdanezis/lean-dag/blob/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Hybrid/Properties.lean#L160)) | `theorem voteSupport_commits (kt : ℕ) : (voteSupport (hybridRule (Validator := Validator) (BlockId := BlockId) (Payload := Payload) kt)).Commits (coreReliability Validator)` ([full source statement](https://github.com/gdanezis/lean-dag/blob/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Hybrid/Properties.lean#L100)) | `theorem decided_none_fresh_agree {U : (HybridProperties.hybridRule (Validator := Validator) (BlockId := BlockId) (Payload := Payload) kt).Universe} (sk : SkipMsg U.val) (hpos : 0 < kt) (hk : Hybrid.Admissible Validator kt) {V : View Validator BlockId Payload U.val} {T : Finset Validator} {k : ℕ} (hq : Hybrid.q Validator ≤ T.card) (hlead : S.leader k = sk.v1) (hk1 : sk.r0 < S.slotRound k) (hk2 : S.slotRound k ≤ sk.r) (hpres : PresentAt (HybridProperties.hybridRule (Validator := Validator) (BlockId := BlockId) (Payload := Payload) kt) V T (S.slotRound k + 1)) {U'' : (HybridProperties.hybridRule (Validator := Validator) (BlockId := BlockId) (Payload := Payload) kt).Universe} (he' : Extends (HybridProperties.hybridRule (Validator := Validator) (BlockId := BlockId) (Payload := Payload) kt) (fill U sk) U'') {V'' W : View Validator BlockId Payload U''.val} (hsub : (sk.liftView V).ids ⊆ V''.ids) {v : Option BlockId} (hW : (HybridProperties.hybridRule (Validator := Validator) (BlockId := BlockId) (Payload := Payload) kt).Decided S (U := U'') W k v) : v = none` ([full source statement](https://github.com/gdanezis/lean-dag/blob/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Hybrid/Record.lean#L89)) | `theorem liveness (kt : ℕ) : Properties.Support.Lives (Properties.voteSupport (hybridRule (Validator := Validator) (BlockId := BlockId) (Payload := Payload) kt)) (coreReliability Validator)` ([full source statement](https://github.com/gdanezis/lean-dag/blob/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Hybrid/Properties.lean#L165))", "source_url": "https://github.com/gdanezis/lean-dag/tree/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Hybrid", "has_liveness": true}
{"section": "Lean 4 source cases", "group": "", "name": "lean-dag / Barnacle", "specifies": "DAG schedule reconfiguration across pruning cuts", "safety": "agreement/commit exclusion or checkpoint safety properties are specified; proof coverage is established only by the exact theorem excerpts below", "liveness": "conditional commits/decisions where quoted; no unconditional network-delivery inference", "tool": "Lean 4; Lean definitions and proof artifacts; a def/property declaration does not itself prove the stated guarantee; exact theorem excerpts identify covered claims; not rebuilt", "size": "3,851 physical lines across 40 .lean files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/gdanezis/lean-dag/tree/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Barnacle)", "proof_statement_excerpt": "`theorem rangeLedger_disjoint (hR : Properties.CommitsCandidate R.toDagRule) (Rn : Run R P B upd C₀ U V K) {k k' : ℕ} (h : k < k') (hK : k' < K) : (Rn.rangeLedger k).Disjoint (Rn.rangeLedger k')` ([full source statement](https://github.com/gdanezis/lean-dag/blob/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Barnacle/Helpers/Ledger.lean#L164)) | `theorem decided_and_not_output (Rn : Run R P B upd C₀ U V K) {k : ℕ} (hk : k < K) {κ : ℕ} (hlo : Rn.start (k + 1) < (Rn.cfg k).roundOf κ) (hhi : (Rn.cfg k).roundOf κ ≤ (Rn.cfg k).roundOf (Rn.anchor k)) : R.Decided (Rn.cfg k).sched V κ (Rn.vdct k κ) ∧ (Rn.cfg k).cum (Rn.start (k + 1) + 1) ≤ κ` ([full source statement](https://github.com/gdanezis/lean-dag/blob/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Barnacle/Helpers/Ledger.lean#L132)) | `theorem liveOn_roundRobin {n : ℕ} (hn : 0 < n) {BlockId : Type} [DecidableEq BlockId] {Payload : Type} (R : LiveRule (Fin n) BlockId Payload) {slack : ℕ} (hD : R.Descent slack) (hw : 0 < R.waveLength) (hbound : R.waveLength * slack + 1 ≤ n) (C : Config (Fin n)) (hhead : C.head = roundRobin n hn) : R.LiveOn C.sched (n + R.waveLength - 1)` ([full source statement](https://github.com/gdanezis/lean-dag/blob/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Barnacle/Helpers/Heads.lean#L359))", "source_url": "https://github.com/gdanezis/lean-dag/tree/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Barnacle", "has_liveness": true}
{"section": "Lean 4 source cases", "group": "", "name": "lean-dag / BlackMarlin", "specifies": "three-round anchor delivery and cross-view chain agreement", "safety": "commit/chain agreement model and supporting ledger lemmas; no complete cross-view safety theorem identified in this row", "liveness": "no protocol progress theorem identified in this scope", "tool": "Lean 4; Lean definitions and proof artifacts; a def/property declaration does not itself prove the stated guarantee; exact theorem excerpts identify covered claims; not rebuilt", "size": "1,509 physical lines across 10 .lean files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/gdanezis/lean-dag/tree/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/BlackMarlin)", "proof_statement_excerpt": "`theorem deliverSeq_of_correct {b : BlockId} (hb : b ∈ ledgerSeq U f τ n) (hc : (U.block b).creator ∈ (Correct : Finset Validator)) : b ∈ deliverSeq U f τ n` ([full source statement](https://github.com/gdanezis/lean-dag/blob/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/BlackMarlin/Helpers/Order.lean#L232))", "source_url": "https://github.com/gdanezis/lean-dag/tree/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/BlackMarlin", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "lean-dag / Minnow", "specifies": "S-Minnow commit-rule model used to prove blocking counterexamples", "safety": "agreement/commit exclusion or checkpoint safety properties are specified; proof coverage is established only by the exact theorem excerpts below", "liveness": "negative progress cases: a dead/unquorate unresolved slot blocks later commits", "tool": "Lean 4; Lean definitions and proof artifacts; a def/property declaration does not itself prove the stated guarantee; exact theorem excerpts identify covered claims; not rebuilt", "size": "221 physical lines across 2 .lean files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/gdanezis/lean-dag/tree/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Minnow)", "proof_statement_excerpt": "`theorem quorum_of_committedAt : ∀ {k : ℕ} {l : BlockId}, CommittedAt D L k l → Quorum D l | 0, _, h =>` ([full source statement](https://github.com/gdanezis/lean-dag/blob/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Minnow/Blocking.lean#L24))", "source_url": "https://github.com/gdanezis/lean-dag/tree/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Minnow", "has_liveness": true}
{"section": "Lean 4 source cases", "group": "", "name": "lean-dag / RedSnapper", "specifies": "transaction/object DAG protocol with conflicting inputs, skips and unlocks", "safety": "agreement/commit exclusion or checkpoint safety properties are specified; proof coverage is established only by the exact theorem excerpts below", "liveness": "conditional commits/decisions where quoted; no unconditional network-delivery inference", "tool": "Lean 4; Lean definitions and proof artifacts; a def/property declaration does not itself prove the stated guarantee; exact theorem excerpts identify covered claims; not rebuilt", "size": "8,220 physical lines across 68 .lean files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/gdanezis/lean-dag/tree/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/RedSnapper)", "proof_statement_excerpt": "`theorem verdictAgreement (hdisc : StanceDiscipline U) {A : Anchors U} : VerdictAgreement U A` ([full source statement](https://github.com/gdanezis/lean-dag/blob/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/RedSnapper/TxAgreement/Proof.lean#L84)) | `theorem recoverySafetyWin (hfd : FreezeDiscipline U) : RecoverySafetyWin U` ([full source statement](https://github.com/gdanezis/lean-dag/blob/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/RedSnapper/Five/RecoverySafety/Proof.lean#L95)) | `theorem decidedOrdered : DecidedOrdered U` ([full source statement](https://github.com/gdanezis/lean-dag/blob/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/RedSnapper/Termination/Proof.lean#L98)) | `theorem fastLiveness : FastLiveness U` ([full source statement](https://github.com/gdanezis/lean-dag/blob/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/RedSnapper/Uncontested/Proof.lean#L81))", "source_url": "https://github.com/gdanezis/lean-dag/tree/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/RedSnapper", "has_liveness": true}
{"section": "Lean 4 source cases", "group": "", "name": "lean-dag / Steelhead", "specifies": "adaptive wave lengths and control-slot decisions", "safety": "agreement/commit exclusion or checkpoint safety properties are specified; proof coverage is established only by the exact theorem excerpts below", "liveness": "conditional commits/decisions where quoted; no unconditional network-delivery inference", "tool": "Lean 4; Lean definitions and proof artifacts; a def/property declaration does not itself prove the stated guarantee; exact theorem excerpts identify covered claims; not rebuilt", "size": "17,608 physical lines across 83 .lean files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/gdanezis/lean-dag/tree/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Steelhead)", "proof_statement_excerpt": "`theorem pairAgreement [S : Slots Validator] : PairAgreement (S := S) U` ([full source statement](https://github.com/gdanezis/lean-dag/blob/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Steelhead/Helpers/BlueBottlePair.lean#L82)) | `theorem safety {w : ℕ → ℕ} (hw : ∀ κ, 2 ≤ w κ) : Properties.Safe (steelheadRule (Validator := Validator) (BlockId := BlockId) (Payload := Payload) w)` ([full source statement](https://github.com/gdanezis/lean-dag/blob/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Steelhead/Properties.lean#L164)) | `theorem shSupport_commits {w : ℕ → ℕ} (hw : ∀ κ, 2 ≤ w κ) : Support.Commits (R := steelheadRule (Validator := Validator) (BlockId := BlockId) (Payload := Payload) w) (shSupport w) (coreReliability Validator)` ([full source statement](https://github.com/gdanezis/lean-dag/blob/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Steelhead/Properties.lean#L280)) | `theorem compose_decided_iff {rules : ℕ → AnchoredRule Validator BlockId Payload P honest} {κ : ℕ} (hr : ∀ r, (rules r).rungs = (rules 0).rungs) (ht : ∀ r, (rules r).tie = (rules 0).tie) {S : Slots Validator} (hkind : ∀ k, S.kind k = κ) {U : BlockRecord Validator BlockId Payload P honest} {V : U.View} {k : ℕ} {v : Option BlockId} : (compose rules).Decided (S := S) U V k v ↔ (rules κ).Decided (S := S) U V k v` ([full source statement](https://github.com/gdanezis/lean-dag/blob/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Steelhead/Helpers/Safety.lean#L58))", "source_url": "https://github.com/gdanezis/lean-dag/tree/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Steelhead", "has_liveness": true}
{"section": "Lean 4 source cases", "group": "", "name": "lean-dag / Checkpoint", "specifies": "signed resilient checkpoints and recovery selection", "safety": "agreement/commit exclusion or checkpoint safety properties are specified; proof coverage is established only by the exact theorem excerpts below", "liveness": "conditional commits/decisions where quoted; no unconditional network-delivery inference", "tool": "Lean 4; Lean definitions and proof artifacts; a def/property declaration does not itself prove the stated guarantee; exact theorem excerpts identify covered claims; not rebuilt", "size": "1,051 physical lines across 6 .lean files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/gdanezis/lean-dag/tree/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Checkpoint)", "proof_statement_excerpt": "`theorem selection_agreement {v w : Validator} (hv : v ∈ M.recoveryCorrect) (hw : w ∈ M.recoveryCorrect) : select M E R v = select M E R w` ([full source statement](https://github.com/gdanezis/lean-dag/blob/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Checkpoint/RecoveryProofs.lean#L142)) | `theorem emitted_of_decided (ha : Agree R) (P : SigningRule M E R S U vm) {V : R.View U} {slot : ℕ} {block : BlockId} (commit : R.Decided S V slot (some block)) {v : Validator} (hv : v ∈ M.recoveryCorrect) {b : BlockId} (hb : R.Decided S (P.view v) slot (some b)) : E.emitted ⟨v, vm.checkpointAfterCommit slot block⟩` ([full source statement](https://github.com/gdanezis/lean-dag/blob/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Checkpoint/CommitProofs.lean#L33)) | `theorem liveCommitFinalized (sp : Support R) (rel : Reliability Validator) : LiveCommitFinalized M E R sp rel vm` ([full source statement](https://github.com/gdanezis/lean-dag/blob/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Checkpoint/CommitProofs.lean#L88)) | `theorem finalized_prefix_next_checkpoint {receiver : Validator} (T : EpochTransition M E R receiver) {old new : CheckpointData Value} (F : SigningFaults.Execution.FinalityQC M E old) (hold_epoch : old.epoch = epoch) (Q : SigningFaults.Execution.CheckpointQC M E new) (hne : new.epoch = T.next_epoch) : old.history.IsPrefix new.history` ([full source statement](https://github.com/gdanezis/lean-dag/blob/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Checkpoint/RecoveryProofs.lean#L263))", "source_url": "https://github.com/gdanezis/lean-dag/tree/8a99c22b290eb471a3826d77e5440f23a3ff374a/LeanDag/Checkpoint", "has_liveness": true}
{"section": "Lean 4 source cases", "group": "", "name": "three-state approximate-majority population protocol", "specifies": "random uniform ordered-pair interactions among X, Y and blank opinions", "safety": "population size and absorbing unanimity; winning initial-majority correctness is outside headline theorem", "liveness": "probabilistic consensus-time bound and high-probability convergence, excluding all-blank start", "tool": "Lean 4; machine-checkable proof source present; not rebuilt here", "size": "9,245 physical lines across 33 .lean files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/xiangyazi24/pp-proof/tree/a7b64c92ed34e77759ba657a7eb2d3d785721926/PopProto)", "proof_statement_excerpt": "`theorem convergence_time_bound_exp (hn : n ≥ 16) (c₀ : Config n) (hop : c₀.hasOpinion) (k : ℕ) : ((transitionKernel (show n ≥ 2` ([full source statement](https://github.com/xiangyazi24/pp-proof/blob/a7b64c92ed34e77759ba657a7eb2d3d785721926/PopProto/Convergence/GlobalConvergenceRate.lean#L37)) | `theorem convergence_time_high_probability (hn : n ≥ 16) (c₀ : Config n) (hop : c₀.hasOpinion) (r : ℝ) (k : ℕ) (hk : 15000*(n : ℝ)*(Real.log (3*(n : ℝ)^2) + r*Real.log (n : ℝ)) ≤ (k : ℝ)) : ((transitionKernel (show n ≥ 2` ([full source statement](https://github.com/xiangyazi24/pp-proof/blob/a7b64c92ed34e77759ba657a7eb2d3d785721926/PopProto/Convergence/GlobalConvergenceRate.lean#L95))", "source_url": "https://github.com/xiangyazi24/pp-proof/tree/a7b64c92ed34e77759ba657a7eb2d3d785721926/PopProto", "has_liveness": true}
{"section": "Lean 4 source cases", "group": "", "name": "Minimmit BFT consensus", "specifies": "notarization/finalization with different quorum thresholds", "safety": "consistency and quorum-intersection lemmas", "liveness": "conditional liveness and optimistic responsiveness", "tool": "Lean 4; Lean conditional proof source; cryptographic axioms explicit; not rebuilt", "size": "2,923 physical lines across 22 .lean files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/NyxFoundation/minimmit-fv/tree/145f1089f3df1e9f0e0e373eab445d260e2d5061/Minimmit)", "proof_statement_excerpt": "`theorem consistency_logs {n f : Nat} (sv : StateView n Block Message Tx) (e : Execution n Message) (lv : LogView n Block Tx) (hd : sv.VoteDiscipline e) (hrd : sv.ReceiptDiscipline e) (hnd : sv.NullifyDiscipline e f) (hpd : sv.ProposalDiscipline e f) (hnf : 5 * f + 1 ≤ n) (hfb : e.FaultBound f) (hld : LogDiscipline sv lv e f) {p q : Processor n} (hp : e.Correct p) (hq : e.Correct q) (t t' : Time) : lv.log p t <+: lv.log q t' ∨ lv.log q t' <+: lv.log p t` ([full source statement](https://github.com/NyxFoundation/minimmit-fv/blob/145f1089f3df1e9f0e0e373eab445d260e2d5061/Minimmit/Consistency/LogLevel.lean#L83))", "axiom_evidence": "`axiom signature_unforgeable {n : Nat} {Message : Type} (e : Execution n Message) :` ([source line](https://github.com/NyxFoundation/minimmit-fv/blob/145f1089f3df1e9f0e0e373eab445d260e2d5061/Minimmit/Axioms.lean#L19)); 2 matching source lines in this row’s scope (lexical scan, not a dependency audit)", "source_url": "https://github.com/NyxFoundation/minimmit-fv/tree/145f1089f3df1e9f0e0e373eab445d260e2d5061/Minimmit", "has_liveness": true}
{"section": "Lean 4 source cases", "group": "", "name": "Ethereum / Fulu consensus spec", "specifies": "Fulu beacon state transition, operations, fork choice and upgrade", "safety": "executable specification plus local component proof statements; not a complete consensus-safety theorem", "liveness": "no protocol-level liveness proof identified", "tool": "Lean 4; Lean executable spec; upstream conformance-test claim in README; proof ledger separates proven components from unproved bodies; tests not rerun", "size": "4,292 physical lines across 32 .lean files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/etheorem/etheorem/tree/6e00d37f96332db5ce48648a0e897f8fd7024d12/packages/EthCLSpecs/EthCLSpecs/Fulu)", "source_url": "https://github.com/etheorem/etheorem/tree/6e00d37f96332db5ce48648a0e897f8fd7024d12/packages/EthCLSpecs/EthCLSpecs/Fulu", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Ethereum / Gloas consensus spec", "specifies": "Gloas beacon state transition, operations, fork choice and upgrade", "safety": "executable specification plus local component proof statements; not a complete consensus-safety theorem", "liveness": "no protocol-level liveness proof identified", "tool": "Lean 4; Lean executable spec; upstream conformance-test claim in README; proof ledger separates proven components from unproved bodies; tests not rerun", "size": "3,688 physical lines across 20 .lean files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/etheorem/etheorem/tree/6e00d37f96332db5ce48648a0e897f8fd7024d12/packages/EthCLSpecs/EthCLSpecs/Gloas)", "source_url": "https://github.com/etheorem/etheorem/tree/6e00d37f96332db5ce48648a0e897f8fd7024d12/packages/EthCLSpecs/EthCLSpecs/Gloas", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Ethereum / Heze consensus spec", "specifies": "Heze beacon state transition, operations, fork choice and upgrade", "safety": "executable specification plus local component proof statements; not a complete consensus-safety theorem", "liveness": "no protocol-level liveness proof identified", "tool": "Lean 4; Lean executable spec; upstream conformance-test claim in README; proof ledger separates proven components from unproved bodies; tests not rerun", "size": "1,869 physical lines across 17 .lean files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/etheorem/etheorem/tree/6e00d37f96332db5ce48648a0e897f8fd7024d12/packages/EthCLSpecs/EthCLSpecs/Heze)", "source_url": "https://github.com/etheorem/etheorem/tree/6e00d37f96332db5ce48648a0e897f8fd7024d12/packages/EthCLSpecs/EthCLSpecs/Heze", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "3SF-mini block/attestation state transition", "specifies": "Aeneas translation from Rust of 3SF-mini block/attestation state transition", "safety": "algorithm definition; full safety theorem not identified", "liveness": "none identified", "tool": "Lean 4; generated Lean functional model; external function axioms are in FunsExternal.lean; no protocol proof claim", "size": "1,402 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/NyxFoundation/consensus-ffi-poc/blob/375e5a1c19920db0aea809a9e05ab834a63ca532/ConsensusLean4/Funs/StateTransition.lean)", "source_url": "https://github.com/NyxFoundation/consensus-ffi-poc/blob/375e5a1c19920db0aea809a9e05ab834a63ca532/ConsensusLean4/Funs/StateTransition.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "LMD-GHOST fork choice", "specifies": "Aeneas translation from Rust of LMD-GHOST fork choice", "safety": "algorithm definition; full safety theorem not identified", "liveness": "none identified", "tool": "Lean 4; generated Lean functional model; external function axioms are in FunsExternal.lean; no protocol proof claim", "size": "1,043 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/NyxFoundation/consensus-ffi-poc/blob/375e5a1c19920db0aea809a9e05ab834a63ca532/ConsensusLean4/Funs/ForkChoice.lean)", "source_url": "https://github.com/NyxFoundation/consensus-ffi-poc/blob/375e5a1c19920db0aea809a9e05ab834a63ca532/ConsensusLean4/Funs/ForkChoice.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "justified-slot tracking", "specifies": "Aeneas translation from Rust of justified-slot tracking", "safety": "algorithm definition; full safety theorem not identified", "liveness": "none identified", "tool": "Lean 4; generated Lean functional model; external function axioms are in FunsExternal.lean; no protocol proof claim", "size": "187 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/NyxFoundation/consensus-ffi-poc/blob/375e5a1c19920db0aea809a9e05ab834a63ca532/ConsensusLean4/Funs/JustifiedSlots.lean)", "source_url": "https://github.com/NyxFoundation/consensus-ffi-poc/blob/375e5a1c19920db0aea809a9e05ab834a63ca532/ConsensusLean4/Funs/JustifiedSlots.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Simplex / Rust-to-Lean translation scaffold", "specifies": "Rust consensus machine with Charon/Aeneas generation instructions", "safety": "complete protocol safety proof not found in tracked proof files", "liveness": "not found", "tool": "Lean 4; proof scaffold only; README says generated Consensus.lean excluded from git; Basic.lean is hello-world", "size": "403 physical lines across 5 .lean files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/mennanov/simplex/tree/8ed0a2adf104ee267abe259c34d3c19b2b66a601/proof)", "axiom_evidence": "`axiom Array.Insts.CoreHashHash.hash` ([source line](https://github.com/mennanov/simplex/blob/8ed0a2adf104ee267abe259c34d3c19b2b66a601/proof/Simplex/FunsExternal.lean#L20)); 42 matching source lines in this row’s scope (lexical scan, not a dependency audit)", "source_url": "https://github.com/mennanov/simplex/tree/8ed0a2adf104ee267abe259c34d3c19b2b66a601/proof", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "co-located Paxos constraints", "specifies": "co-located Paxos constraints", "safety": "constraints imply consensus safety / at most one chosen value", "liveness": "no progress proof identified", "tool": "Lean 4; machine-checkable proof source present; not rebuilt here", "size": "794 physical lines across 5 .lean files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/gnanabite/colocated-paxos/tree/f60308e27d3013665809077fe80a4b2af8a42278/src/guidelines)", "proof_statement_excerpt": "`theorem requirements_give_safety_v2 : requirements proto defs → safety_v2 proto defs` ([full source statement](https://github.com/gnanabite/colocated-paxos/blob/f60308e27d3013665809077fe80a4b2af8a42278/src/guidelines/proof.lean#L166))", "source_url": "https://github.com/gnanabite/colocated-paxos/tree/f60308e27d3013665809077fe80a4b2af8a42278/src/guidelines", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "co-located Paxos implementation model", "specifies": "co-located Paxos implementation model", "safety": "constraints imply consensus safety / at most one chosen value", "liveness": "no progress proof identified", "tool": "Lean 4; machine-checkable proof source present; not rebuilt here", "size": "2,787 physical lines across 16 .lean files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/gnanabite/colocated-paxos/tree/f60308e27d3013665809077fe80a4b2af8a42278/src/implementation)", "proof_statement_excerpt": "`theorem at_most_one_value_chosen : predicate.invariant (λ s : sys_state pid_t (server pid_t value_t is_quorum vals) (message pid_t value_t), safety s)` ([full source statement](https://github.com/gnanabite/colocated-paxos/blob/f60308e27d3013665809077fe80a4b2af8a42278/src/implementation/proof/main.lean#L334))", "source_url": "https://github.com/gnanabite/colocated-paxos/tree/f60308e27d3013665809077fe80a4b2af8a42278/src/implementation", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Raft Lean squad / AEBroadcastInvariant", "specifies": "Raft Rust-component model/proof: AEBroadcastInvariant", "safety": "source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately", "liveness": "no temporal eventual-progress guarantee inferred from a Progress-named component", "tool": "Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt", "size": "337 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/AEBroadcastInvariant.lean)", "proof_statement_excerpt": "`theorem hqc_preserved_of_broadcast [DecidableEq E] {cs cs' : ClusterState E} {lead v : Nat} {msg : AppendEntriesMsg E} (hstep : ValidAEStep E cs lead v msg cs') : ∀ k e, isQuorumCommitted cs.voters cs.logs k e → isQuorumCommitted cs'.voters cs'.logs k e` ([full source statement](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/AEBroadcastInvariant.lean#L253)) | `theorem hae_broadcast_invariant_schema (E : Type) [DecidableEq E] : ∀ (lead : Nat) (voterIdx : Nat → Nat) (covered : List Nat) (cs cs' : ClusterState E) (v : Nat) (msg : AppendEntriesMsg E), ValidAEStep E cs lead v msg cs' → msg.prevLogIndex = 0 → lead ≠ v → 1 ≤ voterIdx v → HaeCovered E covered cs.logs lead voterIdx → HaeCovered E (v :: covered) cs'.logs lead voterIdx` ([full source statement](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/AEBroadcastInvariant.lean#L280))", "source_url": "https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/AEBroadcastInvariant.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Raft Lean squad / Basic", "specifies": "Raft Rust-component model/proof: Basic", "safety": "source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately", "liveness": "no temporal eventual-progress guarantee inferred from a Progress-named component", "tool": "Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt", "size": "1 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/Basic.lean)", "source_url": "https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/Basic.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Raft Lean squad / BroadcastLifecycle", "specifies": "Raft Rust-component model/proof: BroadcastLifecycle", "safety": "source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately", "liveness": "no temporal eventual-progress guarantee inferred from a Progress-named component", "tool": "Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt", "size": "134 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/BroadcastLifecycle.lean)", "proof_statement_excerpt": "`theorem broadcastSeq_to_validAEList (E : Type) [DecidableEq E] (lead : Nat) (voterIdx : Nat → Nat) (vs : List Nat) (cs_init cs_final : ClusterState E) (hseq : BroadcastSeq E lead voterIdx vs cs_init cs_final) : ValidAEList E cs_init cs_final` ([full source statement](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/BroadcastLifecycle.lean#L79))", "source_url": "https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/BroadcastLifecycle.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Raft Lean squad / CommitRule", "specifies": "Raft Rust-component model/proof: CommitRule", "safety": "source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately", "liveness": "no temporal eventual-progress guarantee inferred from a Progress-named component", "tool": "Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt", "size": "300 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/CommitRule.lean)", "proof_statement_excerpt": "`theorem commitRule_and_preservation_implies_cci [DecidableEq E] (cs cs' : ClusterState E) (hvoters : cs.voters = cs'.voters) (hcrv : CommitRuleValid cs cs') (hqc_preserved : ∀ k e, isQuorumCommitted cs.voters cs.logs k e → ∀ w, cs'.logs w k = cs.logs w k) (hlog_preserved : ∀ w k, cs.committed w ≥ k → cs'.logs w k = cs.logs w k) (hcci : CommitCertInvariant cs) : CommitCertInvariant cs'` ([full source statement](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/CommitRule.lean#L270))", "source_url": "https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/CommitRule.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Raft Lean squad / CommittedIndex", "specifies": "Raft Rust-component model/proof: CommittedIndex", "safety": "source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately", "liveness": "no temporal eventual-progress guarantee inferred from a Progress-named component", "tool": "Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt", "size": "417 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/CommittedIndex.lean)", "proof_statement_excerpt": "`theorem committedIndex_safety (voters : List Nat) (acked : AckedFn) (hn : 0 < voters.length) : majority voters.length ≤ countGe voters acked (committedIndex voters acked)` ([full source statement](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/CommittedIndex.lean#L352)) | `theorem committedIndex_mono (voters : List Nat) (acked1 acked2 : AckedFn) (hle : ∀ v, acked1 v ≤ acked2 v) : committedIndex voters acked1 ≤ committedIndex voters acked2` ([full source statement](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/CommittedIndex.lean#L404))", "source_url": "https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/CommittedIndex.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Raft Lean squad / ConcreteProtocolStep", "specifies": "Raft Rust-component model/proof: ConcreteProtocolStep", "safety": "source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately", "liveness": "no temporal eventual-progress guarantee inferred from a Progress-named component", "tool": "Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt", "size": "538 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/ConcreteProtocolStep.lean)", "proof_statement_excerpt": "`theorem validAEStep_hqc_preserved_from_lc [DecidableEq E] {cs cs' : ClusterState E} {lead v : Nat} {msg : AppendEntriesMsg E} (hstep : ValidAEStep E cs lead v msg cs') (hd : Nat) (tl : List Nat) (hvoters : cs.voters = hd :: tl) (record : VoteRecord) (term : Nat) (hwin : wonInTerm (hd :: tl) record term lead = true) (hcovers : CandidateLogCovers E (hd :: tl) record term lead cs.logs (cs.logs lead)) : ∀ k e, isQuorumCommitted cs.voters cs.logs k e → isQuorumCommitted cs'.voters cs'.logs k e` ([full source statement](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/ConcreteProtocolStep.lean#L489)) | `theorem validAEStep_committed_invariant (E : Type) [DecidableEq E] {cs cs' : ClusterState E} {lead v : Nat} {msg : AppendEntriesMsg E} (_hstep : ValidAEStep E cs lead v msg cs') (_w : Nat) (_hw : _w ≠ v) (hother_eq : cs'.committed _w = cs.committed _w) : cs'.committed _w = cs.committed _w` ([full source statement](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/ConcreteProtocolStep.lean#L454))", "source_url": "https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/ConcreteProtocolStep.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Raft Lean squad / ConcreteTransitions", "specifies": "Raft Rust-component model/proof: ConcreteTransitions", "safety": "source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately", "liveness": "no temporal eventual-progress guarantee inferred from a Progress-named component", "tool": "Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt", "size": "502 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/ConcreteTransitions.lean)", "proof_statement_excerpt": "`theorem clm_preserved_single_step (E : Type) (logs : VoterLogs E) (candLog : Nat → Option E) (msg : AppendEntriesMsg E) (v : Nat) (hclm : CandLogMatching E logs candLog) (hprev : candLog msg.prevLogIndex = logs v msg.prevLogIndex) (hnew : ∀ k > msg.prevLogIndex, applyAppendEntries E (logs v) msg k = candLog k) : CandLogMatching E (fun w i => if w = v then applyAppendEntries E (logs v) msg i else logs w i) candLog` ([full source statement](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/ConcreteTransitions.lean#L391))", "source_url": "https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/ConcreteTransitions.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Raft Lean squad / ConfigValidate", "specifies": "Raft Rust-component model/proof: ConfigValidate", "safety": "source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately", "liveness": "no temporal eventual-progress guarantee inferred from a Progress-named component", "tool": "Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt", "size": "268 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/ConfigValidate.lean)", "proof_statement_excerpt": "`theorem uncommitted_less_than_msg_invalid (c : Config) (h : c.max_uncommitted_size < c.max_size_per_msg) : configValidate c = false` ([full source statement](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/ConfigValidate.lean#L226))", "source_url": "https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/ConfigValidate.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Raft Lean squad / ConfigurationInvariants", "specifies": "Raft Rust-component model/proof: ConfigurationInvariants", "safety": "source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately", "liveness": "no temporal eventual-progress guarantee inferred from a Progress-named component", "tool": "Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt", "size": "349 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/ConfigurationInvariants.lean)", "proof_statement_excerpt": "`theorem CI7_finalise_preserves_incoming_disjoint (cfg : Configuration) (hinv : VotersLearnersDisjoint cfg) : ∀ id, id ∈ cfg.incoming_voters → id ∉ (cfg.learners ++ cfg.learners_next)` ([full source statement](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/ConfigurationInvariants.lean#L187)) | `theorem CI3_empty_satisfies_invariant : VotersLearnersDisjoint emptyConfiguration` ([full source statement](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/ConfigurationInvariants.lean#L114))", "source_url": "https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/ConfigurationInvariants.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Raft Lean squad / CrossModuleComposition", "specifies": "Raft Rust-component model/proof: CrossModuleComposition", "safety": "source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately", "liveness": "no temporal eventual-progress guarantee inferred from a Progress-named component", "tool": "Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt", "size": "260 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/CrossModuleComposition.lean)", "proof_statement_excerpt": "`theorem CMC7_maybeAppend_safety_composition [DecidableEq E] (hd : Nat) (tl : List Nat) (logs : VoterLogs E) (k : Nat) (e1 e2 : E) (h1 : isQuorumCommitted (hd :: tl) logs k e1) (h2 : isQuorumCommitted (hd :: tl) logs k e2) : e1 = e2` ([full source statement](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/CrossModuleComposition.lean#L234)) | `theorem CMC6_committed_index_entry_bridge (hd : Nat) (tl : List Nat) (acked : AckedFn) (logs : VoterLogs Nat) (k : Nat) (hci : committedIndex (hd :: tl) acked ≥ k) (hbridge : ∃ e, ∀ v, acked v ≥ k → logs v k = some e) : ∃ e, hasQuorum (hd :: tl) (fun v => decide (logs v k = some e)) = true` ([full source statement](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/CrossModuleComposition.lean#L204))", "source_url": "https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/CrossModuleComposition.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Raft Lean squad / ElectionBroadcastChain", "specifies": "Raft Rust-component model/proof: ElectionBroadcastChain", "safety": "source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately", "liveness": "no temporal eventual-progress guarantee inferred from a Progress-named component", "tool": "Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt", "size": "267 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/ElectionBroadcastChain.lean)", "proof_statement_excerpt": "`theorem broadcastSeq_hqc_preserved [DecidableEq E] (lead : Nat) (voterLog : Nat → LogId) (hd : Nat) (tl : List Nat) (cs_bc cs_post : ClusterState E) (hseq : BroadcastSeq E lead (fun w => (voterLog w).index) (hd :: tl) cs_bc cs_post) (hlead_not_in : lead ∉ (hd :: tl)) {cs_next : ClusterState E} {v_next : Nat} {msg_next : AppendEntriesMsg E} (hstep : ValidAEStep E cs_post lead v_next msg_next cs_next) (hvoters : cs_post.voters = hd :: tl) (record : VoteRecord) (term : Nat) (candLastTerm candLastIndex : Nat → Nat) (hwin      : wonInTerm (hd :: tl) record term lead = true) (hnv_hae   : ∀ w, w ∉ (hd :: tl) → ∀ k, k ≤ (voterLog w).index → cs_post.logs w k = cs_post.logs lead k) (hlog_none : ∀ w k, k > (voterLog w).index → cs_post.logs w k = none) (hcand_mono : ∀ j k, j ≤ k → cs_post.logs lead k = none → cs_post.logs lead j = none) (hconsist  : VoteRecordConsistency record voterLog candLastTerm candLastIndex) (hvoter_idx : ∀ w k e, w ∈ (hd :: tl) → cs_post.logs w k = some e → k ≤ (voterLog w).index) : ∀ k e, isQuorumCommitted cs_post.voters cs_post.logs k e → isQuorumCommitted cs_next.voters cs_next.logs k e` ([full source statement](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/ElectionBroadcastChain.lean#L234))", "source_url": "https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/ElectionBroadcastChain.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Raft Lean squad / ElectionConcreteModel", "specifies": "Raft Rust-component model/proof: ElectionConcreteModel", "safety": "source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately", "liveness": "no temporal eventual-progress guarantee inferred from a Progress-named component", "tool": "Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt", "size": "307 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/ElectionConcreteModel.lean)", "proof_statement_excerpt": "`theorem hqc_preserved_of_validAEStep [DecidableEq E] {cs cs' : ClusterState E} {lead v : Nat} {msg : AppendEntriesMsg E} (hstep  : ValidAEStep E cs lead v msg cs') (hd     : Nat) (tl : List Nat) (hvoters : cs.voters = hd :: tl) (record : VoteRecord) (term : Nat) (voterLog : Nat → LogId) (candLastTerm candLastIndex : Nat → Nat) (hwin      : wonInTerm (hd :: tl) record term lead = true) (hae       : ∀ w k, k ≤ (voterLog w).index → cs.logs w k = cs.logs lead k) (hlog_none : ∀ w k, k > (voterLog w).index → cs.logs w k = none) (hcand_mono : ∀ j k, j ≤ k → cs.logs lead k = none → cs.logs lead j = none) (hconsist  : VoteRecordConsistency record voterLog candLastTerm candLastIndex) (hvoter_idx : ∀ w k e, w ∈ (hd :: tl) → cs.logs w k = some e → k ≤ (voterLog w).index) : ∀ k e, isQuorumCommitted cs.voters cs.logs k e → isQuorumCommitted cs'.voters cs'.logs k e` ([full source statement](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/ElectionConcreteModel.lean#L237))", "source_url": "https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/ElectionConcreteModel.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Raft Lean squad / ElectionLifecycle", "specifies": "Raft Rust-component model/proof: ElectionLifecycle", "safety": "source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately", "liveness": "no temporal eventual-progress guarantee inferred from a Progress-named component", "tool": "Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt", "size": "260 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/ElectionLifecycle.lean)", "proof_statement_excerpt": "`theorem fullProtocolStep_safe {E : Type} [DecidableEq E] {lead hd : Nat} {tl : List Nat} {cs_pre cs_post cs_next : ClusterState E} (hreach_pre : RaftReachable cs_pre) (epoch : ElectionEpoch E lead hd tl cs_pre cs_post) {v_next : Nat} {msg_next : AppendEntriesMsg E} (hstep : ValidAEStep E cs_post lead v_next msg_next cs_next) (hvoters_next : cs_next.voters = hd :: tl) : isClusterSafe cs_next` ([full source statement](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/ElectionLifecycle.lean#L248)) | `theorem electionEpoch_full_safety {E : Type} [DecidableEq E] {lead hd : Nat} {tl : List Nat} {cs_pre cs_post cs_next : ClusterState E} (epoch : ElectionEpoch E lead hd tl cs_pre cs_post) (hreach_post : RaftReachable cs_post) {v_next : Nat} {msg_next : AppendEntriesMsg E} (hstep : ValidAEStep E cs_post lead v_next msg_next cs_next) (hvoters_next : cs_next.voters = hd :: tl) : isClusterSafe cs_next` ([full source statement](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/ElectionLifecycle.lean#L178)) | `theorem electionEpoch_hqc_preserved {E : Type} [DecidableEq E] {lead hd : Nat} {tl : List Nat} {cs_pre cs_post cs_next : ClusterState E} (epoch : ElectionEpoch E lead hd tl cs_pre cs_post) {v_next : Nat} {msg_next : AppendEntriesMsg E} (hstep : ValidAEStep E cs_post lead v_next msg_next cs_next) : ∀ k e, isQuorumCommitted cs_post.voters cs_post.logs k e → isQuorumCommitted cs_next.voters cs_next.logs k e` ([full source statement](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/ElectionLifecycle.lean#L130))", "source_url": "https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/ElectionLifecycle.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Raft Lean squad / ElectionReachability", "specifies": "Raft Rust-component model/proof: ElectionReachability", "safety": "source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately", "liveness": "no temporal eventual-progress guarantee inferred from a Progress-named component", "tool": "Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt", "size": "421 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/ElectionReachability.lean)", "proof_statement_excerpt": "`theorem candLogCoversLastIndex_of_highWaterMark (E : Type) (voterLog : Nat → LogId) (logs : VoterLogs E) (candLog : Nat → Option E) (hclm : CandLogMatching E logs candLog) (hwm : ∀ w, ∃ j, (voterLog w).index ≤ j ∧ candLog j = logs w j) : CandLogCoversLastIndex E voterLog logs candLog` ([full source statement](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/ElectionReachability.lean#L96))", "source_url": "https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/ElectionReachability.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Raft Lean squad / FindConflict", "specifies": "Raft Rust-component model/proof: FindConflict", "safety": "source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately", "liveness": "no temporal eventual-progress guarantee inferred from a Progress-named component", "tool": "Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt", "size": "211 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/FindConflict.lean)", "source_url": "https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/FindConflict.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Raft Lean squad / FindConflictByTerm", "specifies": "Raft Rust-component model/proof: FindConflictByTerm", "safety": "source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately", "liveness": "no temporal eventual-progress guarantee inferred from a Progress-named component", "tool": "Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt", "size": "227 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/FindConflictByTerm.lean)", "source_url": "https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/FindConflictByTerm.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Raft Lean squad / HasNextEntries", "specifies": "Raft Rust-component model/proof: HasNextEntries", "safety": "source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately", "liveness": "no temporal eventual-progress guarantee inferred from a Progress-named component", "tool": "Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt", "size": "215 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/HasNextEntries.lean)", "proof_statement_excerpt": "`theorem HNE12_hasNextEntriesSince_mono_committed (firstIndex c1 c2 persisted limit sinceIdx : Nat) (hle : c1 ≤ c2) (htrue : hasNextEntriesSince firstIndex c1 persisted limit sinceIdx = true) : hasNextEntriesSince firstIndex c2 persisted limit sinceIdx = true` ([full source statement](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/HasNextEntries.lean#L166))", "source_url": "https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/HasNextEntries.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Raft Lean squad / HasQuorum", "specifies": "Raft Rust-component model/proof: HasQuorum", "safety": "source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately", "liveness": "no temporal eventual-progress guarantee inferred from a Progress-named component", "tool": "Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt", "size": "337 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/HasQuorum.lean)", "source_url": "https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/HasQuorum.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Raft Lean squad / Inflights", "specifies": "Raft Rust-component model/proof: Inflights", "safety": "source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately", "liveness": "no temporal eventual-progress guarantee inferred from a Progress-named component", "tool": "Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt", "size": "779 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/Inflights.lean)", "proof_statement_excerpt": "`theorem inflights_freeTo_preserves_gt (inf : Inflights) (to : Nat) (hsort : inf.queue.Pairwise (· ≤ ·)) (x : Nat) (hx : x ∈ inf.queue) (hgt : x > to) : x ∈ (inf.freeTo to).queue` ([full source statement](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/Inflights.lean#L326)) | `theorem inflightsConc_reset_correct (s : InflightsConc) : s.resetConc.toAbstract = s.toAbstract.reset` ([full source statement](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/Inflights.lean#L774))", "source_url": "https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/Inflights.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Raft Lean squad / IsContinuousEnts", "specifies": "Raft Rust-component model/proof: IsContinuousEnts", "safety": "source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately", "liveness": "no temporal eventual-progress guarantee inferred from a Progress-named component", "tool": "Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt", "size": "115 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/IsContinuousEnts.lean)", "source_url": "https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/IsContinuousEnts.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Raft Lean squad / IsUpToDate", "specifies": "Raft Rust-component model/proof: IsUpToDate", "safety": "source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately", "liveness": "no temporal eventual-progress guarantee inferred from a Progress-named component", "tool": "Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt", "size": "226 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/IsUpToDate.lean)", "source_url": "https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/IsUpToDate.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Raft Lean squad / JointCommittedIndex", "specifies": "Raft Rust-component model/proof: JointCommittedIndex", "safety": "source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately", "liveness": "no temporal eventual-progress guarantee inferred from a Progress-named component", "tool": "Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt", "size": "214 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/JointCommittedIndex.lean)", "proof_statement_excerpt": "`theorem jointCommittedIndex_safety_out (incoming outgoing : List Nat) (acked : AckedFn) (hn : 0 < outgoing.length) : majority outgoing.length ≤ countGe outgoing acked (jointCommittedIndex incoming outgoing acked)` ([full source statement](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/JointCommittedIndex.lean#L126)) | `theorem jointCommittedIndex_empty_out (incoming : List Nat) (acked : AckedFn) : jointCommittedIndex incoming [] acked = 0` ([full source statement](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/JointCommittedIndex.lean#L208))", "source_url": "https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/JointCommittedIndex.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Raft Lean squad / JointSafetyComposition", "specifies": "Raft Rust-component model/proof: JointSafetyComposition", "safety": "source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately", "liveness": "no temporal eventual-progress guarantee inferred from a Progress-named component", "tool": "Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt", "size": "252 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/JointSafetyComposition.lean)", "proof_statement_excerpt": "`theorem JSC7_joint_raft_log_safety (hi : Nat) (ti : List Nat) (ho : Nat) (to : List Nat) (a1 a2 : AckedFn) : (∃ w_in ∈ (hi :: ti), a1 w_in ≥ jointCommittedIndex (hi :: ti) (ho :: to) a1 ∧ a2 w_in ≥ jointCommittedIndex (hi :: ti) (ho :: to) a2) ∧ (∃ w_out ∈ (ho :: to), a1 w_out ≥ jointCommittedIndex (hi :: ti) (ho :: to) a1 ∧ a2 w_out ≥ jointCommittedIndex (hi :: ti) (ho :: to) a2)` ([full source statement](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/JointSafetyComposition.lean#L172))", "source_url": "https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/JointSafetyComposition.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Raft Lean squad / JointTally", "specifies": "Raft Rust-component model/proof: JointTally", "safety": "source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately", "liveness": "no temporal eventual-progress guarantee inferred from a Progress-named component", "tool": "Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt", "size": "289 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/JointTally.lean)", "source_url": "https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/JointTally.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Raft Lean squad / JointVote", "specifies": "Raft Rust-component model/proof: JointVote", "safety": "source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately", "liveness": "no temporal eventual-progress guarantee inferred from a Progress-named component", "tool": "Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt", "size": "195 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/JointVote.lean)", "source_url": "https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/JointVote.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Raft Lean squad / LeaderCompleteness", "specifies": "Raft Rust-component model/proof: LeaderCompleteness", "safety": "source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately", "liveness": "no temporal eventual-progress guarantee inferred from a Progress-named component", "tool": "Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt", "size": "393 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/LeaderCompleteness.lean)", "proof_statement_excerpt": "`theorem hqc_preserved_from_leaderBroadcast [DecidableEq E] (hd : Nat) (tl : List Nat) (record : VoteRecord) (term leader : Nat) (logs logs' : VoterLogs E) (hwin    : wonInTerm (hd :: tl) record term leader = true) (hcovers : CandidateLogCovers E (hd :: tl) record term leader logs (logs leader)) (happend : ∀ k e, isQuorumCommitted (hd :: tl) logs k e → ∀ w', logs' w' k = logs leader k) : ∀ k e, isQuorumCommitted (hd :: tl) logs k e → isQuorumCommitted (hd :: tl) logs' k e` ([full source statement](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/LeaderCompleteness.lean#L285)) | `theorem electionWinner_overlaps_commitQuorum [DecidableEq E] (hd : Nat) (tl : List Nat) (record : VoteRecord) (term cand : Nat) (logs : VoterLogs E) (k : Nat) (e : E) (hwin    : wonInTerm (hd :: tl) record term cand = true) (hcommit : isQuorumCommitted (hd :: tl) logs k e) : ∃ w ∈ (hd :: tl), record term w = some cand ∧ logs w k = some e` ([full source statement](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/LeaderCompleteness.lean#L156))", "source_url": "https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/LeaderCompleteness.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Raft Lean squad / LimitSize", "specifies": "Raft Rust-component model/proof: LimitSize", "safety": "source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately", "liveness": "no temporal eventual-progress guarantee inferred from a Progress-named component", "tool": "Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt", "size": "507 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/LimitSize.lean)", "source_url": "https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/LimitSize.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Raft Lean squad / LogUnstable", "specifies": "Raft Rust-component model/proof: LogUnstable", "safety": "source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately", "liveness": "no temporal eventual-progress guarantee inferred from a Progress-named component", "tool": "Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt", "size": "481 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/LogUnstable.lean)", "proof_statement_excerpt": "`theorem truncateAndAppend_snapshot_preserved (u : Unstable) (newTerms : List Nat) (after : Nat) : (truncateAndAppend u newTerms after).snapshot = u.snapshot` ([full source statement](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/LogUnstable.lean#L349))", "source_url": "https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/LogUnstable.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Raft Lean squad / MajorityVote", "specifies": "Raft Rust-component model/proof: MajorityVote", "safety": "source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately", "liveness": "no temporal eventual-progress guarantee inferred from a Progress-named component", "tool": "Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt", "size": "300 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/MajorityVote.lean)", "source_url": "https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/MajorityVote.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Raft Lean squad / MaybeAppend", "specifies": "Raft Rust-component model/proof: MaybeAppend", "safety": "source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately", "liveness": "no temporal eventual-progress guarantee inferred from a Progress-named component", "tool": "Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt", "size": "309 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/MaybeAppend.lean)", "proof_statement_excerpt": "`theorem maybeAppend_log_prefix_preserved (s : RaftState) (idx term ca : Nat) (ents : List LogEntry) (h : matchTerm s.log idx term = true) (hc : findConflict s.log ents > 0) (hsuf : ∀ e ∈ ents.drop (findConflict s.log ents - (idx + 1)), findConflict s.log ents ≤ e.index) (i : Nat) (hi : i < findConflict s.log ents) : (maybeAppend s idx term ca ents).2.log i = s.log i` ([full source statement](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/MaybeAppend.lean#L243)) | `theorem maybeAppend_committed_eq_min (s : RaftState) (idx term ca : Nat) (ents : List LogEntry) (h : matchTerm s.log idx term = true) (hca   : s.committed ≤ ca) (hlast : s.committed ≤ idx + ents.length) : (maybeAppend s idx term ca ents).2.committed = min ca (idx + ents.length)` ([full source statement](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/MaybeAppend.lean#L183))", "source_url": "https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/MaybeAppend.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Raft Lean squad / MaybeCommit", "specifies": "Raft Rust-component model/proof: MaybeCommit", "safety": "source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately", "liveness": "no temporal eventual-progress guarantee inferred from a Progress-named component", "tool": "Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt", "size": "319 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/MaybeCommit.lean)", "proof_statement_excerpt": "`theorem maybeCommit_eq_commitTo (log : LogTerm) (committed maxIndex term : Nat) (hterm : log maxIndex = some term) : maybeCommit log committed maxIndex term = commitTo committed maxIndex` ([full source statement](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/MaybeCommit.lean#L306))", "source_url": "https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/MaybeCommit.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Raft Lean squad / MaybePersist", "specifies": "Raft Rust-component model/proof: MaybePersist", "safety": "source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately", "liveness": "no temporal eventual-progress guarantee inferred from a Progress-named component", "tool": "Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt", "size": "237 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/MaybePersist.lean)", "source_url": "https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/MaybePersist.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Raft Lean squad / MaybePersistFUI", "specifies": "Raft Rust-component model/proof: MaybePersistFUI", "safety": "source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately", "liveness": "no temporal eventual-progress guarantee inferred from a Progress-named component", "tool": "Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt", "size": "211 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/MaybePersistFUI.lean)", "source_url": "https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/MaybePersistFUI.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Raft Lean squad / MemStorage", "specifies": "Raft Rust-component model/proof: MemStorage", "safety": "source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately", "liveness": "no temporal eventual-progress guarantee inferred from a Progress-named component", "tool": "Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt", "size": "342 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/MemStorage.lean)", "proof_statement_excerpt": "`theorem MS12_append_at_end_preserves (s : MemStorageCore) (newTerms : List Nat) (hne : newTerms ≠ []) : (append s (lastIndex s + 1) newTerms).terms = s.terms ++ newTerms` ([full source statement](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/MemStorage.lean#L310))", "source_url": "https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/MemStorage.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Raft Lean squad / MultiStepReachability", "specifies": "Raft Rust-component model/proof: MultiStepReachability", "safety": "source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately", "liveness": "no temporal eventual-progress guarantee inferred from a Progress-named component", "tool": "Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt", "size": "182 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/MultiStepReachability.lean)", "proof_statement_excerpt": "`theorem listStep_safe_from_init [DecidableEq E] {cs' : ClusterState E} (hd : Nat) (tl : List Nat) (hvoters : cs'.voters = hd :: tl) (hlist : ValidAEList E (initialCluster (hd :: tl)) cs') : isClusterSafe cs'` ([full source statement](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/MultiStepReachability.lean#L122)) | `theorem listStep_committed_mono [DecidableEq E] {cs cs' : ClusterState E} (hlist : ValidAEList E cs cs') : ∀ (w : Nat), cs'.committed w ≥ cs.committed w` ([full source statement](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/MultiStepReachability.lean#L144))", "source_url": "https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/MultiStepReachability.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Raft Lean squad / NextEntries", "specifies": "Raft Rust-component model/proof: NextEntries", "safety": "source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately", "liveness": "no temporal eventual-progress guarantee inferred from a Progress-named component", "tool": "Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt", "size": "195 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/NextEntries.lean)", "proof_statement_excerpt": "`theorem NE5_mono_committed (fi c1 c2 p l si : Nat) (hle : c1 ≤ c2) (h1 : (nextEntriesSince fi c1 p l si).isSome = true) : (nextEntriesSince fi c2 p l si).isSome = true` ([full source statement](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/NextEntries.lean#L145))", "source_url": "https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/NextEntries.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Raft Lean squad / Progress", "specifies": "Raft Rust-component model/proof: Progress", "safety": "source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately", "liveness": "no temporal eventual-progress guarantee inferred from a Progress-named component", "tool": "Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt", "size": "538 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/Progress.lean)", "proof_statement_excerpt": "`theorem PR35_optimisticUpdate_preserves_wf (p : Progress) (n : Nat) (hn : p.matched ≤ n) : (p.optimisticUpdate n).wf` ([full source statement](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/Progress.lean#L532))", "source_url": "https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/Progress.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Raft Lean squad / ProgressSet", "specifies": "Raft Rust-component model/proof: ProgressSet", "safety": "source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately", "liveness": "no temporal eventual-progress guarantee inferred from a Progress-named component", "tool": "Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt", "size": "350 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/ProgressSet.lean)", "proof_statement_excerpt": "`theorem PS7_resetActive_preserves_all_wf (ps : ProgressSet) (perspectiveOf : Nat) (h : all_wf_fn ps) : all_wf_fn (resetActive ps perspectiveOf)` ([full source statement](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/ProgressSet.lean#L278))", "source_url": "https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/ProgressSet.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Raft Lean squad / ProgressTracker", "specifies": "Raft Rust-component model/proof: ProgressTracker", "safety": "source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately", "liveness": "no temporal eventual-progress guarantee inferred from a Progress-named component", "tool": "Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt", "size": "520 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/ProgressTracker.lean)", "proof_statement_excerpt": "`theorem PT25_initTracker_applyChanges_preserves_member (ids : List Nat) (next_idx : Nat) (changes : List (Nat × ChangeType)) (next_idx2 id : Nat) (hmem    : id ∈ ids) (habsent : id ∉ changes.map (·.1)) : hasPeer (applyChanges (initTracker ids next_idx) changes next_idx2) id = true` ([full source statement](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/ProgressTracker.lean#L491))", "source_url": "https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/ProgressTracker.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Raft Lean squad / QuorumRecentlyActive", "specifies": "Raft Rust-component model/proof: QuorumRecentlyActive", "safety": "source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately", "liveness": "no temporal eventual-progress guarantee inferred from a Progress-named component", "tool": "Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt", "size": "270 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/QuorumRecentlyActive.lean)", "source_url": "https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/QuorumRecentlyActive.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Raft Lean squad / RaftElection", "specifies": "Raft Rust-component model/proof: RaftElection", "safety": "source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately", "liveness": "no temporal eventual-progress guarantee inferred from a Progress-named component", "tool": "Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt", "size": "1,013 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/RaftElection.lean)", "proof_statement_excerpt": "`theorem electionSafety_two_leaders (hd : Nat) (tl : List Nat) (record : VoteRecord) (term n1 n2 : Nat) (hw1 : wonInTerm (hd :: tl) record term n1 = true) (hw2 : wonInTerm (hd :: tl) record term n2 = true) : n1 = n2` ([full source statement](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/RaftElection.lean#L445)) | `theorem RT14_becomeFollower_same_term_preserves_vote (s : NodeState) (selfId : Nat) : (becomeFollower (becomeCandidate s selfId) (s.currentTerm + 1)).votedFor = some selfId` ([full source statement](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/RaftElection.lean#L618))", "source_url": "https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/RaftElection.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Raft Lean squad / RaftLogAppend", "specifies": "Raft Rust-component model/proof: RaftLogAppend", "safety": "source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately", "liveness": "no temporal eventual-progress guarantee inferred from a Progress-named component", "tool": "Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt", "size": "442 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/RaftLogAppend.lean)", "proof_statement_excerpt": "`theorem ra_committed_prefix_preserved (rl : RaftLog) (first : Entry) (rest : List Entry) (k : Nat) (hk : k ≤ rl.committed) (hguard : rl.committed < first.1) (hle : first.1 ≤ rl.unstable.offset + rl.unstable.entries.length) : maybeTerm (raftLogAppend rl (first :: rest)).1.unstable k = maybeTerm rl.unstable k` ([full source statement](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/RaftLogAppend.lean#L334))", "source_url": "https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/RaftLogAppend.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Raft Lean squad / RaftProtocol", "specifies": "Raft Rust-component model/proof: RaftProtocol", "safety": "source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately", "liveness": "no temporal eventual-progress guarantee inferred from a Progress-named component", "tool": "Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt", "size": "446 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/RaftProtocol.lean)", "proof_statement_excerpt": "`theorem appendEntries_preserves_log_matching (logs : Nat → LogTerm) (args : AppendEntriesArgs) (v : Nat) (s : RaftState) (hs   : logs v = s.log) (hlm  : LogMatchingInvariant logs) (hleader_lmi : ∀ w, w ≠ v → ∀ k, (maybeAppend s args.prevLogIndex args.prevLogTerm args.leaderCommit args.entries).2.log k = logs w k → ∀ j ≤ k, (maybeAppend s args.prevLogIndex args.prevLogTerm args.leaderCommit args.entries).2.log j = logs w j) : let s'` ([full source statement](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/RaftProtocol.lean#L340)) | `theorem rss3_from_logMatchInvariant (logs : VoterLogs Nat) (hlm : LogMatchingInvariant logs) (v1 v2 : Nat) (k : Nat) (hmatch : logs v1 k = logs v2 k) : ∀ j ≤ k, logs v1 j = logs v2 j` ([full source statement](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/RaftProtocol.lean#L189))", "source_url": "https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/RaftProtocol.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Raft Lean squad / RaftSafety", "specifies": "Raft Rust-component model/proof: RaftSafety", "safety": "source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately", "liveness": "no temporal eventual-progress guarantee inferred from a Progress-named component", "tool": "Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt", "size": "426 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/RaftSafety.lean)", "proof_statement_excerpt": "`theorem raft_end_to_end_safety_full [DecidableEq E] (hd : Nat) (tl : List Nat) (cs : ClusterState E) (hvoters : cs.voters = hd :: tl) (hcci : CommitCertInvariant cs) : isClusterSafe cs` ([full source statement](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/RaftSafety.lean#L400)) | `theorem raft_committed_no_rollback [DecidableEq E] (hd : Nat) (tl : List Nat) (logs₀ logs₁ : VoterLogs E) (k : Nat) (e : E) (hnr     : NoRollbackInvariantFor E (hd :: tl) logs₀ logs₁) (hcommit : isQuorumCommitted (hd :: tl) logs₀ k e) : isQuorumCommitted (hd :: tl) logs₁ k e` ([full source statement](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/RaftSafety.lean#L242))", "source_url": "https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/RaftSafety.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Raft Lean squad / RaftTrace", "specifies": "Raft Rust-component model/proof: RaftTrace", "safety": "source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately", "liveness": "no temporal eventual-progress guarantee inferred from a Progress-named component", "tool": "Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt", "size": "243 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/RaftTrace.lean)", "proof_statement_excerpt": "`theorem initialCluster_safe : isClusterSafe (initialCluster (E := Nat) [1, 2, 3])` ([full source statement](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/RaftTrace.lean#L239))", "source_url": "https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/RaftTrace.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Raft Lean squad / ReadOnly", "specifies": "Raft Rust-component model/proof: ReadOnly", "safety": "source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately", "liveness": "no temporal eventual-progress guarantee inferred from a Progress-named component", "tool": "Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt", "size": "442 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/ReadOnly.lean)", "proof_statement_excerpt": "`theorem RO14_advance_preserves_nodup (ro : ReadOnly) (ctx : Ctx) (hnd : ro.queue.Nodup) : (advance ro ctx).2.queue.Nodup` ([full source statement](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/ReadOnly.lean#L349))", "source_url": "https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/ReadOnly.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Raft Lean squad / Restore", "specifies": "Raft Rust-component model/proof: Restore", "safety": "source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately", "liveness": "no temporal eventual-progress guarantee inferred from a Progress-named component", "tool": "Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt", "size": "149 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/Restore.lean)", "proof_statement_excerpt": "`theorem restore_invariant_ordering (s : RaftLogState) (idx : Nat) (hwf : s.wellFormed) (hpre : idx ≥ s.committed) : (restore s idx).wellFormed` ([full source statement](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/Restore.lean#L135)) | `theorem restore_idempotent_committed (s : RaftLogState) : (restore s s.committed).committed = s.committed` ([full source statement](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/Restore.lean#L145))", "source_url": "https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/Restore.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Raft Lean squad / SafetyComposition", "specifies": "Raft Rust-component model/proof: SafetyComposition", "safety": "source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately", "liveness": "no temporal eventual-progress guarantee inferred from a Progress-named component", "tool": "Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt", "size": "283 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/SafetyComposition.lean)", "proof_statement_excerpt": "`theorem SC4_raft_log_safety (hd : Nat) (tl : List Nat) (acked1 acked2 : AckedFn) : ∃ w ∈ (hd :: tl), acked1 w ≥ committedIndex (hd :: tl) acked1 ∧ acked2 w ≥ committedIndex (hd :: tl) acked2` ([full source statement](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/SafetyComposition.lean#L138)) | `theorem SC9_quorumActive_and_commit_share_voter (hd : Nat) (tl : List Nat) (acked : AckedFn) (entries : List (Nat × Progress)) (perspectiveOf : Nat) (hqra : quorumRecentlyActive (hd :: tl) entries perspectiveOf = true) : ∃ w ∈ (hd :: tl), isActive entries perspectiveOf w = true ∧ acked w ≥ committedIndex (hd :: tl) acked` ([full source statement](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/SafetyComposition.lean#L251))", "source_url": "https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/SafetyComposition.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Raft Lean squad / TallyVotes", "specifies": "Raft Rust-component model/proof: TallyVotes", "safety": "source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately", "liveness": "no temporal eventual-progress guarantee inferred from a Progress-named component", "tool": "Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt", "size": "335 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/TallyVotes.lean)", "source_url": "https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/TallyVotes.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Raft Lean squad / UncommittedState", "specifies": "Raft Rust-component model/proof: UncommittedState", "safety": "source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately", "liveness": "no temporal eventual-progress guarantee inferred from a Progress-named component", "tool": "Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt", "size": "319 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/UncommittedState.lean)", "proof_statement_excerpt": "`theorem US4_zeroUncommitted_increase_true (s : US) (size : Nat) (hz : s.uncommittedSize = 0) : (maybeIncrease s size).2 = true` ([full source statement](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/UncommittedState.lean#L95))", "source_url": "https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/UncommittedState.lean", "has_liveness": false}
{"section": "Lean 4 source cases", "group": "", "name": "Raft Lean squad / UnstablePersistBridge", "specifies": "Raft Rust-component model/proof: UnstablePersistBridge", "safety": "source function/cluster invariant or contract as quoted; correspondence to Rust is tested separately", "liveness": "no temporal eventual-progress guarantee inferred from a Progress-named component", "tool": "Lean 4; Lean component/cluster proof source; Rust correspondence based on separate tests, not end-to-end compiler refinement; not rebuilt", "size": "231 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/UnstablePersistBridge.lean)", "source_url": "https://github.com/dsyme/raft-lean-squad/blob/ab7a184fbdfe22ac3b894e92791fb9f324e2ccbc/formal-verification/lean/FVSquad/UnstablePersistBridge.lean", "has_liveness": false}
{"section": "Lean 4 / Veil source cases", "group": "", "name": "Chorus per-slot consensus", "specifies": "Chorus per-slot consensus", "safety": "state/decision invariants and contract implementation", "liveness": "conditional termination/progress over explicit fairness and primitive contracts", "tool": "Lean 4 / Veil; Veil configured for reconstructed Lean proofs (veil.smt.trust false); Lean theorem/axiom audit source; no fresh build", "size": "15,397 physical lines across 63 .lean files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/larskuhtz/cadence/tree/54ee1d41f0949d6ab140ee1a20b274fd361f23d6/Cadence/Chorus)", "proof_statement_excerpt": "`theorem not_decided (n : Nat) (i : Fin 4) (v : V) : ¬ (Mvba.mvbaSafety thM).decided (mst n) i v` ([full source statement](https://github.com/larskuhtz/cadence/blob/54ee1d41f0949d6ab140ee1a20b274fd361f23d6/Cadence/Chorus/Witness.lean#L419)) | `theorem timedTermination_premises_satisfiable : ∃ (n f : Nat) (hf : n = 3 * f + 1) (is_byz : Fin n → Prop) (_ : DecidablePred is_byz) (hbyz : (List.ofFn (n := n) id |>.filter (fun i => decide (is_byz i))).length ≤ f) (slot merkle_root view Phase PathChoice : Type) (_ : Inhabited slot) (_ : Inhabited merkle_root) (_ : Inhabited view) (_ : Inhabited Phase) (_ : Inhabited PathChoice) (vord : TotalOrderWithMinimum view) (_ : Chorus.Phase_EnumClass Phase) (_ : Chorus.PathChoice_EnumClass PathChoice) (_ : Inhabited (Fin n)) (vfin : Cadence.ViewOrderEnum view vord) (time : Type) (_ : LinearOrder time) (_ : AddCommMonoid time) (_ : IsOrderedCancelAddMonoid time) (_ : Archimedean time) (_ : ByzNodeSetHonestQuorum (Fin n) (ByzNSet n) (byzNodeSetFin n f hf is_byz hbyz)) (is_proposer : Fin n → Bool) (well_encoded : merkle_root → Bool) (mvba_init_state : Mvba.State (Mvba.FieldAbstractType (Fin n) (ByzNSet n) (MetaBlock (Fin n) merkle_root) (Fin n → Option merkle_root) view)) (thM : Mvba.Theory (Fin n) (ByzNSet n) (MetaBlock (Fin n) merkle_root) (Fin n → Option merkle_root) view) (sch : Chorus.Schedule view time) (_ : Mvba.LeaderRotation (nset := byzNodeSetFin n f hf is_byz hbyz) vfin sch.mvba.k thM), (atMvba (nset := byzNodeSetFin n f hf is_byz hbyz) (slot := slot) (Phase := Phase) (PathChoice := PathChoice) thM).assumptions (Cadence.chorusTheory (slot := slot) (Phase := Phase) (PathChoice := PathChoice) is_proposer well_encoded mvba_init_state) ∧ ∃ (r : TChorusRun (nset := byzNodeSetFin n f hf is_byz hbyz) (Cadence.chorusTheory (slot := slot) (Phase := Phase) (PathChoice := PathChoice) is_proposer well_encoded mvba_init_state) thM time) (t : time), SyncAtMvba (nset := byzNodeSetFin n f hf is_byz hbyz) sch r ∧ ValidBridge (nset := byzNodeSetFin n f hf is_byz hbyz) r.toLRun ∧ SyncParticipationWithin (nset := byzNodeSetFin n f hf is_byz hbyz) sch.Δ r ∧ NoAbandonBeforeFinalizing (nset := byzNodeSetFin n f hf is_byz hbyz) r.toLRun ∧ NoEarlyStart (nset := byzNodeSetFin n f hf is_byz hbyz) sch r ∧ AllParticipateBy (nset := byzNodeSetFin n f hf is_byz hbyz) t r` ([full source statement](https://github.com/larskuhtz/cadence/blob/54ee1d41f0949d6ab140ee1a20b274fd361f23d6/Cadence/Chorus/Witness.lean#L1138)) | `theorem mvbaOwn : Mvba.BoundedJustice schC.mvba proj.timed ∧ Mvba.TimerPunctual schC.mvba proj.timed` ([full source statement](https://github.com/larskuhtz/cadence/blob/54ee1d41f0949d6ab140ee1a20b274fd361f23d6/Cadence/Chorus/Witness.lean#L871))", "source_url": "https://github.com/larskuhtz/cadence/tree/54ee1d41f0949d6ab140ee1a20b274fd361f23d6/Cadence/Chorus", "has_liveness": true}
{"section": "Lean 4 / Veil source cases", "group": "", "name": "Conductor window orchestration", "specifies": "Conductor window orchestration", "safety": "state/decision invariants and contract implementation", "liveness": "conditional termination/progress over explicit fairness and primitive contracts", "tool": "Lean 4 / Veil; Veil configured for reconstructed Lean proofs (veil.smt.trust false); Lean theorem/axiom audit source; no fresh build", "size": "4,853 physical lines across 6 .lean files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/larskuhtz/cadence/tree/54ee1d41f0949d6ab140ee1a20b274fd361f23d6/Cadence/Conductor)", "proof_statement_excerpt": "`theorem conductorFull_toSafety (sch : ConductorSchedule view time vfin) (TA : ACSTemporal node ℕ acsstate time msg fm.byz) (th : Conductor.Theory ℕ window time node acsstate) (hstart : StartTimes sch th) (hshift : WindowShifts sch th) (hunb : StartsUnbounded th) (hwin : WindowsUnbounded window) (hΔ : TA.Δ = sch.Δ) (hℓ : TA.ℓ = sch.ℓ) (hfault : (Finset.univ.filter fm.byz).card ≤ TA.fault_bound) : (conductorFull sch TA th hstart hshift hunb hwin hΔ hℓ hfault).toOrchestratorSafety = orchestratorSafety th` ([full source statement](https://github.com/larskuhtz/cadence/blob/54ee1d41f0949d6ab140ee1a20b274fd361f23d6/Cadence/Conductor/Temporal.lean#L714)) | `theorem startsUnbounded_of_startTimes [Archimedean time] {sch : ConductorSchedule view time vfin} {th : Conductor.Theory ℕ window time node acsstate} (hstart : StartTimes sch th) (h0 : 0 ≤ sch.start₀) : StartsUnbounded th` ([full source statement](https://github.com/larskuhtz/cadence/blob/54ee1d41f0949d6ab140ee1a20b274fd361f23d6/Cadence/Conductor/Temporal.lean#L805))", "source_url": "https://github.com/larskuhtz/cadence/tree/54ee1d41f0949d6ab140ee1a20b274fd361f23d6/Cadence/Conductor", "has_liveness": true}
{"section": "Lean 4 / Veil source cases", "group": "", "name": "composed Cadence", "specifies": "composed Cadence", "safety": "state/decision invariants and contract implementation", "liveness": "conditional termination/progress over explicit fairness and primitive contracts", "tool": "Lean 4 / Veil; Veil configured for reconstructed Lean proofs (veil.smt.trust false); Lean theorem/axiom audit source; no fresh build", "size": "5,625 physical lines across 15 .lean files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/larskuhtz/cadence/tree/54ee1d41f0949d6ab140ee1a20b274fd361f23d6/Cadence/Composed)", "proof_statement_excerpt": "`theorem mno_stutter_step : ¬ (Mvba.mvbaSafety thM).step (mst 0) (mst 0)` ([full source statement](https://github.com/larskuhtz/cadence/blob/54ee1d41f0949d6ab140ee1a20b274fd361f23d6/Cadence/Composed/Witness/Slot.lean#L402)) | `theorem corollary4_termination {x : ℕ} (ps : (PS x).Projection ((LS x) r).toLRun) (hps : (CT).Admissible (partRun ps)) : (∀ i, ¬ (byzNodeSetFin n f hf is_byz hbyz).is_byz i = true → (partRun ps).eventually (fun st => (SCI).participating st i)) → ∀ j, ¬ (byzNodeSetFin n f hf is_byz hbyz).is_byz j = true → (partRun ps).eventually (fun st => ∃ V, (SCI).finalized st j V)` ([full source statement](https://github.com/larskuhtz/cadence/blob/54ee1d41f0949d6ab140ee1a20b274fd361f23d6/Cadence/Composed/Corollary4.lean#L502)) | `theorem liveness_premises_satisfiable : ∃ (sch : ConductorSchedule ℕ ℕ natViewOrderEnum) (TA : ACSTemporal (Fin 4) ℕ ACSt ℕ Unit (fmF 4 1 rfl isByz Chorus.Witness.hbyz).byz) (thO : Conductor.Theory ℕ ℕ ℕ (Fin 4) ACSt) (is_proposer : Fin 4 → Bool) (well_encoded : Unit → Bool) (mvba_init_state : MS) (mvalid : V → Bool) (mleader : ℕ → Fin 4 → Bool) (_ : ∃ J, is_proposer J = true) (_ : Mvba.LeaderRotation (nset := byzNodeSetFin 4 1 rfl isByz Chorus.Witness.hbyz) natViewOrderEnum sch.mvba.k (Cadence.mvbaTheory (nodeset := ByzNSet 4) mvalid mleader)) (thG : GTheory Unit ℕ Ph PC ℕ ℕ ACSt 4) (r : TSysRun 4 1 rfl isByz Chorus.Witness.hbyz thO (Cadence.chorusTheory (slot := ℕ) (Phase := Ph) (PathChoice := PC) is_proposer well_encoded mvba_init_state) (Cadence.mvbaTheory (nodeset := ByzNSet 4) mvalid mleader) thG), StartTimes sch thO ∧ WindowShifts sch thO ∧ StartsUnbounded thO ∧ WindowsUnbounded ℕ ∧ TA.Δ = sch.Δ ∧ TA.ℓ = sch.ℓ ∧ (Finset.univ.filter (fmF 4 1 rfl isByz Chorus.Witness.hbyz).byz).card ≤ TA.fault_bound ∧ SysSync 4 1 rfl isByz Chorus.Witness.hbyz sch TA r` ([full source statement](https://github.com/larskuhtz/cadence/blob/54ee1d41f0949d6ab140ee1a20b274fd361f23d6/Cadence/Composed/Witness.lean#L156)) | `theorem censorship_premises_satisfiable : ∃ (sch : ConductorSchedule ℕ ℕ natViewOrderEnum) (TA : ACSTemporal (Fin 4) ℕ ACSt ℕ Unit (fmF 4 1 rfl isByz Chorus.Witness.hbyz).byz) (thO : Conductor.Theory ℕ ℕ ℕ (Fin 4) ACSt) (is_proposer : Fin 4 → Bool) (well_encoded : Unit → Bool) (mvba_init_state : MS) (mvalid : V → Bool) (mleader : ℕ → Fin 4 → Bool) (_ : ∃ J, is_proposer J = true) (_ : Mvba.LeaderRotation (nset := byzNodeSetFin 4 1 rfl isByz Chorus.Witness.hbyz) natViewOrderEnum sch.mvba.k (Cadence.mvbaTheory (nodeset := ByzNSet 4) mvalid mleader)) (o : OrchSt ℕ ℕ ACSt 4) (sci : ℕ → SlotSt Unit ℕ Ph PC 4) (r : TSysRun 4 1 rfl isByz Chorus.Witness.hbyz thO (Cadence.chorusTheory (slot := ℕ) (Phase := Ph) (PathChoice := PC) is_proposer well_encoded mvba_init_state) (Cadence.mvbaTheory (nodeset := ByzNSet 4) mvalid mleader) ⟨fun j _ => is_proposer j, o, sci⟩), StartTimes sch thO ∧ WindowShifts sch thO ∧ StartsUnbounded thO ∧ WindowsUnbounded ℕ ∧ TA.Δ = sch.Δ ∧ TA.ℓ = sch.ℓ ∧ (Finset.univ.filter (fmF 4 1 rfl isByz Chorus.Witness.hbyz).byz).card ≤ TA.fault_bound ∧ (∃ m, well_encoded m = true) ∧ SysSync 4 1 rfl isByz Chorus.Witness.hbyz sch TA r ∧ SlotInclusive 4 1 rfl isByz Chorus.Witness.hbyz sch r` ([full source statement](https://github.com/larskuhtz/cadence/blob/54ee1d41f0949d6ab140ee1a20b274fd361f23d6/Cadence/Composed/Witness.lean#L183))", "source_url": "https://github.com/larskuhtz/cadence/tree/54ee1d41f0949d6ab140ee1a20b274fd361f23d6/Cadence/Composed", "has_liveness": true}
{"section": "Lean 4 / Veil source cases", "group": "", "name": "multi-valued Byzantine agreement", "specifies": "multi-valued Byzantine agreement", "safety": "state/decision invariants and contract implementation", "liveness": "conditional termination/progress over explicit fairness and primitive contracts", "tool": "Lean 4 / Veil; Veil configured for reconstructed Lean proofs (veil.smt.trust false); Lean theorem/axiom audit source; no fresh build", "size": "11,713 physical lines across 40 .lean files in this directory; imports outside this scope excluded", "source": "[exact directory](https://github.com/larskuhtz/cadence/tree/54ee1d41f0949d6ab140ee1a20b274fd361f23d6/Cadence/Mvba)", "proof_statement_excerpt": "`theorem mvbaFull_toSafety [IsOrderedCancelAddMonoid time] [Archimedean time] [Fintype node] (th : Theory node nodeset value evec view) (hqe : ByzNodeSetHonestQuorum node nodeset nset) (sch : Schedule view time) (vfin : ViewOrderEnum view vord) (hrot : LeaderRotation vfin sch.k th) : (mvbaFull th hqe sch vfin hrot).toMVBASafety = mvbaSafety th` ([full source statement](https://github.com/larskuhtz/cadence/blob/54ee1d41f0949d6ab140ee1a20b274fd361f23d6/Cadence/Mvba/Temporal.lean#L332)) | `theorem termination_premises_satisfiable : ∃ (node nodeset value evec view : Type) (_ : Inhabited node) (_ : Inhabited nodeset) (_ : Inhabited value) (_ : Inhabited evec) (_ : Inhabited view) (nset : ByzNodeSet node nodeset) (vord : TotalOrderWithMinimum view) (_ : Fintype node) (_ : ByzNodeSetHonestQuorum node nodeset nset) (_ : ViewOrderEnum view vord) (th : Theory node nodeset value evec view), (Mvba.relationalTransitionSystem node nodeset value evec view).assumptions th ∧ ∃ r : MvbaRun th, FJustice r ∧ AViewSync r ∧ FAvail r ∧ AllPropose r ∧ NoEarlyAbandon r ∧ FRelay r` ([full source statement](https://github.com/larskuhtz/cadence/blob/54ee1d41f0949d6ab140ee1a20b274fd361f23d6/Cadence/Mvba/Witness.lean#L620)) | `theorem sync : Sync schW run` ([full source statement](https://github.com/larskuhtz/cadence/blob/54ee1d41f0949d6ab140ee1a20b274fd361f23d6/Cadence/Mvba/Witness.lean#L449))", "source_url": "https://github.com/larskuhtz/cadence/tree/54ee1d41f0949d6ab140ee1a20b274fd361f23d6/Cadence/Mvba", "has_liveness": true}
{"section": "Lean 4 / Veil source cases", "group": "", "name": "Cadence / Chorus transition model", "specifies": "Chorus transition state machine", "safety": "declared protocol invariants; associated proof directories supply preservation", "liveness": "eventual progress treated separately in Lean temporal proof modules", "tool": "Lean 4 / Veil; Veil source model; trust false proof reconstruction configured; not built here", "size": "2,899 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/larskuhtz/cadence/blob/54ee1d41f0949d6ab140ee1a20b274fd361f23d6/Cadence/Chorus.lean)", "source_url": "https://github.com/larskuhtz/cadence/blob/54ee1d41f0949d6ab140ee1a20b274fd361f23d6/Cadence/Chorus.lean", "has_liveness": true}
{"section": "Lean 4 / Veil source cases", "group": "", "name": "Cadence / Conductor transition model", "specifies": "Conductor transition state machine", "safety": "declared protocol invariants; associated proof directories supply preservation", "liveness": "eventual progress treated separately in Lean temporal proof modules", "tool": "Lean 4 / Veil; Veil source model; trust false proof reconstruction configured; not built here", "size": "919 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/larskuhtz/cadence/blob/54ee1d41f0949d6ab140ee1a20b274fd361f23d6/Cadence/Conductor.lean)", "source_url": "https://github.com/larskuhtz/cadence/blob/54ee1d41f0949d6ab140ee1a20b274fd361f23d6/Cadence/Conductor.lean", "has_liveness": true}
{"section": "Lean 4 / Veil source cases", "group": "", "name": "Cadence / Mvba transition model", "specifies": "Mvba transition state machine", "safety": "declared protocol invariants; associated proof directories supply preservation", "liveness": "eventual progress treated separately in Lean temporal proof modules", "tool": "Lean 4 / Veil; Veil source model; trust false proof reconstruction configured; not built here", "size": "1,407 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/larskuhtz/cadence/blob/54ee1d41f0949d6ab140ee1a20b274fd361f23d6/Cadence/Mvba.lean)", "source_url": "https://github.com/larskuhtz/cadence/blob/54ee1d41f0949d6ab140ee1a20b274fd361f23d6/Cadence/Mvba.lean", "has_liveness": true}
{"section": "Lean 4 / Veil source cases", "group": "", "name": "Cadence / Cadence transition model", "specifies": "Cadence transition state machine", "safety": "declared protocol invariants; associated proof directories supply preservation", "liveness": "eventual progress treated separately in Lean temporal proof modules", "tool": "Lean 4 / Veil; Veil source model; trust false proof reconstruction configured; not built here", "size": "799 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/larskuhtz/cadence/blob/54ee1d41f0949d6ab140ee1a20b274fd361f23d6/Cadence/Cadence.lean)", "source_url": "https://github.com/larskuhtz/cadence/blob/54ee1d41f0949d6ab140ee1a20b274fd361f23d6/Cadence/Cadence.lean", "has_liveness": true}
{"section": "Lean 4 / Veil source cases", "group": "", "name": "Cadence / FallbackReceipt transition model", "specifies": "FallbackReceipt transition state machine", "safety": "declared protocol invariants; associated proof directories supply preservation", "liveness": "eventual progress treated separately in Lean temporal proof modules", "tool": "Lean 4 / Veil; Veil source model; trust false proof reconstruction configured; not built here", "size": "513 physical lines across 1 .lean files in this file; imports outside this scope excluded", "source": "[exact file](https://github.com/larskuhtz/cadence/blob/54ee1d41f0949d6ab140ee1a20b274fd361f23d6/Cadence/FallbackReceipt.lean)", "source_url": "https://github.com/larskuhtz/cadence/blob/54ee1d41f0949d6ab140ee1a20b274fd361f23d6/Cadence/FallbackReceipt.lean", "has_liveness": true}