2026-06-09 20:52:08 -07:00
|
|
|
|
import Spa.Analysis.Forward
|
|
|
|
|
|
import Spa.Analysis.Utils
|
2026-06-23 10:23:44 -05:00
|
|
|
|
import Spa.Interp
|
2026-06-09 20:52:08 -07:00
|
|
|
|
import Spa.Showable
|
|
|
|
|
|
|
|
|
|
|
|
namespace Spa
|
|
|
|
|
|
|
|
|
|
|
|
abbrev ConstLattice : Type := AboveBelow ℤ
|
|
|
|
|
|
|
|
|
|
|
|
namespace ConstAnalysis
|
|
|
|
|
|
|
|
|
|
|
|
open AboveBelow in
|
|
|
|
|
|
def plus : ConstLattice → ConstLattice → ConstLattice
|
|
|
|
|
|
| bot, _ => bot
|
|
|
|
|
|
| _, bot => bot
|
|
|
|
|
|
| top, _ => top
|
|
|
|
|
|
| _, top => top
|
|
|
|
|
|
| mk z₁, mk z₂ => mk (z₁ + z₂)
|
|
|
|
|
|
|
|
|
|
|
|
open AboveBelow in
|
|
|
|
|
|
def minus : ConstLattice → ConstLattice → ConstLattice
|
|
|
|
|
|
| bot, _ => bot
|
|
|
|
|
|
| _, bot => bot
|
|
|
|
|
|
| top, _ => top
|
|
|
|
|
|
| _, top => top
|
|
|
|
|
|
| mk z₁, mk z₂ => mk (z₁ - z₂)
|
|
|
|
|
|
|
Lean migration: typeclass-based parameter passing, as in the Agda original
The port had flattened Agda's instance arguments ({{flA}}, {{evaluator}},
{{latticeInterpretation}}, {{validEvaluator}}) into explicitly threaded
values (fhL, E, I, hE). Restore them as typeclasses:
- Spa.FiniteHeightLattice: now actually used — Fixedpoint takes the
instance instead of a FixedHeight value; FiniteMap gets the missing
instance (height = ks.length * height B), so varsFixedHeight /
statesFixedHeight / signFixedHeight / constFixedHeight plumbing
disappears (instance bottoms are defeq to the old ones)
- Spa.Analysis.Forward.Evaluation: StmtEvaluator/ExprEvaluator become
classes; the Valid* Props become Prop-classes, as in Agda
- Spa.Analysis.Forward.Adapters: the expr→stmt adapter and its validity
are instances (Agda: the ExprToStmtAdapter instances)
- LatticeInterpretation is a class; sign/const interpretations,
evaluators and validity proofs are instances; use sites read like the
Agda module applications: result SignLattice prog
Proof simplifications (same theorems, proofs factored):
- Spa.Lattice.AboveBelow.monotone₂_of_strict: any ⊥-strict/⊤-dominated
operation on a flat lattice is monotone — replaces the four near-
identical case bashes per analysis (postulates in Agda)
- Spa.Lattice.AboveBelow.interp_sup_of/interp_inf_of: the shared flat-
lattice interpretation case analysis, making interpSign_sup/inf and
interpConst_sup/inf one-liners
lake build green with zero warnings; lake exe spa output verified
byte-identical (diff) to the previous, Agda-verified output.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-06-09 23:32:38 -07:00
|
|
|
|
theorem plus_mono₂ : Monotone₂ plus :=
|
|
|
|
|
|
AboveBelow.monotone₂_of_strict plus
|
|
|
|
|
|
(fun y => by cases y <;> rfl) (fun x => by cases x <;> rfl)
|
|
|
|
|
|
(fun y hy => by cases y <;> first | exact absurd rfl hy | rfl)
|
|
|
|
|
|
(fun x hx => by cases x <;> first | exact absurd rfl hx | rfl)
|
|
|
|
|
|
|
|
|
|
|
|
theorem minus_mono₂ : Monotone₂ minus :=
|
|
|
|
|
|
AboveBelow.monotone₂_of_strict minus
|
|
|
|
|
|
(fun y => by cases y <;> rfl) (fun x => by cases x <;> rfl)
|
|
|
|
|
|
(fun y hy => by cases y <;> first | exact absurd rfl hy | rfl)
|
|
|
|
|
|
(fun x hx => by cases x <;> first | exact absurd rfl hx | rfl)
|
2026-06-09 20:52:08 -07:00
|
|
|
|
|
|
|
|
|
|
def interpConst : ConstLattice → Value → Prop
|
|
|
|
|
|
| .bot, _ => False
|
|
|
|
|
|
| .top, _ => True
|
|
|
|
|
|
| .mk z, v => v = .int z
|
|
|
|
|
|
|
|
|
|
|
|
theorem interpConst_mk_disjoint {z₁ z₂ : ℤ} (hne : z₁ ≠ z₂) {v : Value} :
|
2026-06-23 13:01:53 -05:00
|
|
|
|
¬(interpConst (.mk z₁) v ∧ interpConst (.mk z₂) v) := by
|
2026-06-09 20:52:08 -07:00
|
|
|
|
rintro ⟨h₁, h₂⟩
|
|
|
|
|
|
rw [h₁] at h₂
|
|
|
|
|
|
injection h₂ with hz
|
|
|
|
|
|
exact hne hz
|
|
|
|
|
|
|
Lean migration: typeclass-based parameter passing, as in the Agda original
The port had flattened Agda's instance arguments ({{flA}}, {{evaluator}},
{{latticeInterpretation}}, {{validEvaluator}}) into explicitly threaded
values (fhL, E, I, hE). Restore them as typeclasses:
- Spa.FiniteHeightLattice: now actually used — Fixedpoint takes the
instance instead of a FixedHeight value; FiniteMap gets the missing
instance (height = ks.length * height B), so varsFixedHeight /
statesFixedHeight / signFixedHeight / constFixedHeight plumbing
disappears (instance bottoms are defeq to the old ones)
- Spa.Analysis.Forward.Evaluation: StmtEvaluator/ExprEvaluator become
classes; the Valid* Props become Prop-classes, as in Agda
- Spa.Analysis.Forward.Adapters: the expr→stmt adapter and its validity
are instances (Agda: the ExprToStmtAdapter instances)
- LatticeInterpretation is a class; sign/const interpretations,
evaluators and validity proofs are instances; use sites read like the
Agda module applications: result SignLattice prog
Proof simplifications (same theorems, proofs factored):
- Spa.Lattice.AboveBelow.monotone₂_of_strict: any ⊥-strict/⊤-dominated
operation on a flat lattice is monotone — replaces the four near-
identical case bashes per analysis (postulates in Agda)
- Spa.Lattice.AboveBelow.interp_sup_of/interp_inf_of: the shared flat-
lattice interpretation case analysis, making interpSign_sup/inf and
interpConst_sup/inf one-liners
lake build green with zero warnings; lake exe spa output verified
byte-identical (diff) to the previous, Agda-verified output.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-06-09 23:32:38 -07:00
|
|
|
|
instance constInterpretation : LatticeInterpretation ConstLattice where
|
2026-06-09 20:52:08 -07:00
|
|
|
|
interp := interpConst
|
2026-06-23 13:01:53 -05:00
|
|
|
|
interp_sup := fun v h => AboveBelow.interp_sup_of (fun _ h => h) (fun _ => trivial) v h
|
|
|
|
|
|
interp_inf := fun v h => AboveBelow.interp_inf_of (fun hne _ => interpConst_mk_disjoint hne) v h
|
2026-06-09 20:52:08 -07:00
|
|
|
|
|
|
|
|
|
|
variable (prog : Program)
|
|
|
|
|
|
|
|
|
|
|
|
def eval : Expr → VariableValues ConstLattice prog → ConstLattice
|
|
|
|
|
|
| .add e₁ e₂, vs => plus (eval e₁ vs) (eval e₂ vs)
|
|
|
|
|
|
| .sub e₁ e₂, vs => minus (eval e₁ vs) (eval e₂ vs)
|
|
|
|
|
|
| .var k, vs =>
|
|
|
|
|
|
if h : FiniteMap.MemKey k vs then (FiniteMap.locate h).1 else .top
|
|
|
|
|
|
| .num n, _ => .mk n
|
|
|
|
|
|
|
|
|
|
|
|
theorem eval_mono (e : Expr) : Monotone (eval prog e) := by
|
|
|
|
|
|
induction e with
|
|
|
|
|
|
| add e₁ e₂ ih₁ ih₂ =>
|
|
|
|
|
|
intro vs₁ vs₂ h
|
|
|
|
|
|
exact eval_combine₂ plus_mono₂ (ih₁ h) (ih₂ h)
|
|
|
|
|
|
| sub e₁ e₂ ih₁ ih₂ =>
|
|
|
|
|
|
intro vs₁ vs₂ h
|
|
|
|
|
|
exact eval_combine₂ minus_mono₂ (ih₁ h) (ih₂ h)
|
|
|
|
|
|
| var k =>
|
|
|
|
|
|
intro vs₁ vs₂ h
|
|
|
|
|
|
simp only [eval]
|
|
|
|
|
|
by_cases hk : k ∈ prog.vars
|
|
|
|
|
|
· rw [dif_pos (FiniteMap.memKey_iff.mpr hk),
|
|
|
|
|
|
dif_pos (FiniteMap.memKey_iff.mpr hk)]
|
|
|
|
|
|
exact FiniteMap.le_of_mem_mem prog.vars_nodup h
|
|
|
|
|
|
(FiniteMap.locate _).2 (FiniteMap.locate _).2
|
|
|
|
|
|
· rw [dif_neg (fun hm => hk (FiniteMap.memKey_iff.mp hm)),
|
|
|
|
|
|
dif_neg (fun hm => hk (FiniteMap.memKey_iff.mp hm))]
|
|
|
|
|
|
| num n =>
|
|
|
|
|
|
intro vs₁ vs₂ _
|
|
|
|
|
|
exact le_refl _
|
|
|
|
|
|
|
Lean migration: typeclass-based parameter passing, as in the Agda original
The port had flattened Agda's instance arguments ({{flA}}, {{evaluator}},
{{latticeInterpretation}}, {{validEvaluator}}) into explicitly threaded
values (fhL, E, I, hE). Restore them as typeclasses:
- Spa.FiniteHeightLattice: now actually used — Fixedpoint takes the
instance instead of a FixedHeight value; FiniteMap gets the missing
instance (height = ks.length * height B), so varsFixedHeight /
statesFixedHeight / signFixedHeight / constFixedHeight plumbing
disappears (instance bottoms are defeq to the old ones)
- Spa.Analysis.Forward.Evaluation: StmtEvaluator/ExprEvaluator become
classes; the Valid* Props become Prop-classes, as in Agda
- Spa.Analysis.Forward.Adapters: the expr→stmt adapter and its validity
are instances (Agda: the ExprToStmtAdapter instances)
- LatticeInterpretation is a class; sign/const interpretations,
evaluators and validity proofs are instances; use sites read like the
Agda module applications: result SignLattice prog
Proof simplifications (same theorems, proofs factored):
- Spa.Lattice.AboveBelow.monotone₂_of_strict: any ⊥-strict/⊤-dominated
operation on a flat lattice is monotone — replaces the four near-
identical case bashes per analysis (postulates in Agda)
- Spa.Lattice.AboveBelow.interp_sup_of/interp_inf_of: the shared flat-
lattice interpretation case analysis, making interpSign_sup/inf and
interpConst_sup/inf one-liners
lake build green with zero warnings; lake exe spa output verified
byte-identical (diff) to the previous, Agda-verified output.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-06-09 23:32:38 -07:00
|
|
|
|
instance exprEvaluator : ExprEvaluator ConstLattice prog :=
|
2026-06-09 20:52:08 -07:00
|
|
|
|
⟨eval prog, eval_mono prog⟩
|
|
|
|
|
|
|
|
|
|
|
|
def output : String :=
|
Lean migration: typeclass-based parameter passing, as in the Agda original
The port had flattened Agda's instance arguments ({{flA}}, {{evaluator}},
{{latticeInterpretation}}, {{validEvaluator}}) into explicitly threaded
values (fhL, E, I, hE). Restore them as typeclasses:
- Spa.FiniteHeightLattice: now actually used — Fixedpoint takes the
instance instead of a FixedHeight value; FiniteMap gets the missing
instance (height = ks.length * height B), so varsFixedHeight /
statesFixedHeight / signFixedHeight / constFixedHeight plumbing
disappears (instance bottoms are defeq to the old ones)
- Spa.Analysis.Forward.Evaluation: StmtEvaluator/ExprEvaluator become
classes; the Valid* Props become Prop-classes, as in Agda
- Spa.Analysis.Forward.Adapters: the expr→stmt adapter and its validity
are instances (Agda: the ExprToStmtAdapter instances)
- LatticeInterpretation is a class; sign/const interpretations,
evaluators and validity proofs are instances; use sites read like the
Agda module applications: result SignLattice prog
Proof simplifications (same theorems, proofs factored):
- Spa.Lattice.AboveBelow.monotone₂_of_strict: any ⊥-strict/⊤-dominated
operation on a flat lattice is monotone — replaces the four near-
identical case bashes per analysis (postulates in Agda)
- Spa.Lattice.AboveBelow.interp_sup_of/interp_inf_of: the shared flat-
lattice interpretation case analysis, making interpSign_sup/inf and
interpConst_sup/inf one-liners
lake build green with zero warnings; lake exe spa output verified
byte-identical (diff) to the previous, Agda-verified output.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-06-09 23:32:38 -07:00
|
|
|
|
show' (result ConstLattice prog)
|
2026-06-09 20:52:08 -07:00
|
|
|
|
|
|
|
|
|
|
theorem plus_valid {g₁ g₂ : ConstLattice} {z₁ z₂ : ℤ}
|
2026-06-23 10:23:44 -05:00
|
|
|
|
(h₁ : ⟦g₁⟧ (.int z₁)) (h₂ : ⟦g₂⟧ (.int z₂)) :
|
|
|
|
|
|
⟦plus g₁ g₂⟧ (.int (z₁ + z₂)) := by
|
2026-06-09 20:52:08 -07:00
|
|
|
|
rcases g₁ with _ | _ | c₁
|
|
|
|
|
|
· exact h₁.elim
|
|
|
|
|
|
· rcases g₂ with _ | _ | c₂
|
|
|
|
|
|
· exact h₂.elim
|
|
|
|
|
|
· exact trivial
|
|
|
|
|
|
· exact trivial
|
|
|
|
|
|
· rcases g₂ with _ | _ | c₂
|
|
|
|
|
|
· exact h₂.elim
|
|
|
|
|
|
· exact trivial
|
|
|
|
|
|
· injection h₁ with hz₁
|
|
|
|
|
|
injection h₂ with hz₂
|
|
|
|
|
|
show Value.int (z₁ + z₂) = Value.int (c₁ + c₂)
|
|
|
|
|
|
rw [hz₁, hz₂]
|
|
|
|
|
|
|
|
|
|
|
|
theorem minus_valid {g₁ g₂ : ConstLattice} {z₁ z₂ : ℤ}
|
2026-06-23 10:23:44 -05:00
|
|
|
|
(h₁ : ⟦g₁⟧ (.int z₁)) (h₂ : ⟦g₂⟧ (.int z₂)) :
|
|
|
|
|
|
⟦minus g₁ g₂⟧ (.int (z₁ - z₂)) := by
|
2026-06-09 20:52:08 -07:00
|
|
|
|
rcases g₁ with _ | _ | c₁
|
|
|
|
|
|
· exact h₁.elim
|
|
|
|
|
|
· rcases g₂ with _ | _ | c₂
|
|
|
|
|
|
· exact h₂.elim
|
|
|
|
|
|
· exact trivial
|
|
|
|
|
|
· exact trivial
|
|
|
|
|
|
· rcases g₂ with _ | _ | c₂
|
|
|
|
|
|
· exact h₂.elim
|
|
|
|
|
|
· exact trivial
|
|
|
|
|
|
· injection h₁ with hz₁
|
|
|
|
|
|
injection h₂ with hz₂
|
|
|
|
|
|
show Value.int (z₁ - z₂) = Value.int (c₁ - c₂)
|
|
|
|
|
|
rw [hz₁, hz₂]
|
|
|
|
|
|
|
Lean migration: typeclass-based parameter passing, as in the Agda original
The port had flattened Agda's instance arguments ({{flA}}, {{evaluator}},
{{latticeInterpretation}}, {{validEvaluator}}) into explicitly threaded
values (fhL, E, I, hE). Restore them as typeclasses:
- Spa.FiniteHeightLattice: now actually used — Fixedpoint takes the
instance instead of a FixedHeight value; FiniteMap gets the missing
instance (height = ks.length * height B), so varsFixedHeight /
statesFixedHeight / signFixedHeight / constFixedHeight plumbing
disappears (instance bottoms are defeq to the old ones)
- Spa.Analysis.Forward.Evaluation: StmtEvaluator/ExprEvaluator become
classes; the Valid* Props become Prop-classes, as in Agda
- Spa.Analysis.Forward.Adapters: the expr→stmt adapter and its validity
are instances (Agda: the ExprToStmtAdapter instances)
- LatticeInterpretation is a class; sign/const interpretations,
evaluators and validity proofs are instances; use sites read like the
Agda module applications: result SignLattice prog
Proof simplifications (same theorems, proofs factored):
- Spa.Lattice.AboveBelow.monotone₂_of_strict: any ⊥-strict/⊤-dominated
operation on a flat lattice is monotone — replaces the four near-
identical case bashes per analysis (postulates in Agda)
- Spa.Lattice.AboveBelow.interp_sup_of/interp_inf_of: the shared flat-
lattice interpretation case analysis, making interpSign_sup/inf and
interpConst_sup/inf one-liners
lake build green with zero warnings; lake exe spa output verified
byte-identical (diff) to the previous, Agda-verified output.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-06-09 23:32:38 -07:00
|
|
|
|
instance eval_valid : ValidExprEvaluator ConstLattice prog := by
|
|
|
|
|
|
constructor
|
2026-06-09 20:52:08 -07:00
|
|
|
|
intro vs ρ e v hev
|
|
|
|
|
|
induction hev with
|
|
|
|
|
|
| num n =>
|
|
|
|
|
|
intro _
|
2026-06-23 10:23:44 -05:00
|
|
|
|
show ⟦eval prog (.num n) vs⟧ (.int n)
|
2026-06-09 20:52:08 -07:00
|
|
|
|
rfl
|
|
|
|
|
|
| var x v hxv =>
|
|
|
|
|
|
intro hvs
|
2026-06-23 10:23:44 -05:00
|
|
|
|
show ⟦eval prog (.var x) vs⟧ v
|
2026-06-09 20:52:08 -07:00
|
|
|
|
simp only [eval]
|
|
|
|
|
|
by_cases hk : FiniteMap.MemKey x vs
|
|
|
|
|
|
· rw [dif_pos hk]
|
|
|
|
|
|
exact hvs _ _ (FiniteMap.locate hk).2 _ hxv
|
|
|
|
|
|
· rw [dif_neg hk]
|
|
|
|
|
|
exact trivial
|
|
|
|
|
|
| add e₁ e₂ z₁ z₂ _ _ ih₁ ih₂ =>
|
|
|
|
|
|
intro hvs
|
2026-06-23 10:23:44 -05:00
|
|
|
|
have h₁ : ⟦eval prog e₁ vs⟧ (.int z₁) := ih₁ hvs
|
|
|
|
|
|
have h₂ : ⟦eval prog e₂ vs⟧ (.int z₂) := ih₂ hvs
|
|
|
|
|
|
show ⟦eval prog (.add e₁ e₂) vs⟧ (.int (z₁ + z₂))
|
2026-06-09 20:52:08 -07:00
|
|
|
|
exact plus_valid h₁ h₂
|
|
|
|
|
|
| sub e₁ e₂ z₁ z₂ _ _ ih₁ ih₂ =>
|
|
|
|
|
|
intro hvs
|
2026-06-23 10:23:44 -05:00
|
|
|
|
have h₁ : ⟦eval prog e₁ vs⟧ (.int z₁) := ih₁ hvs
|
|
|
|
|
|
have h₂ : ⟦eval prog e₂ vs⟧ (.int z₂) := ih₂ hvs
|
|
|
|
|
|
show ⟦eval prog (.sub e₁ e₂) vs⟧ (.int (z₁ - z₂))
|
2026-06-09 20:52:08 -07:00
|
|
|
|
exact minus_valid h₁ h₂
|
|
|
|
|
|
|
|
|
|
|
|
theorem analyze_correct {ρ : Env} (hrun : EvalStmt [] prog.rootStmt ρ) :
|
2026-06-23 13:29:54 -05:00
|
|
|
|
⟦ variablesAt prog.finalState (result ConstLattice prog) ⟧ ρ :=
|
Lean migration: typeclass-based parameter passing, as in the Agda original
The port had flattened Agda's instance arguments ({{flA}}, {{evaluator}},
{{latticeInterpretation}}, {{validEvaluator}}) into explicitly threaded
values (fhL, E, I, hE). Restore them as typeclasses:
- Spa.FiniteHeightLattice: now actually used — Fixedpoint takes the
instance instead of a FixedHeight value; FiniteMap gets the missing
instance (height = ks.length * height B), so varsFixedHeight /
statesFixedHeight / signFixedHeight / constFixedHeight plumbing
disappears (instance bottoms are defeq to the old ones)
- Spa.Analysis.Forward.Evaluation: StmtEvaluator/ExprEvaluator become
classes; the Valid* Props become Prop-classes, as in Agda
- Spa.Analysis.Forward.Adapters: the expr→stmt adapter and its validity
are instances (Agda: the ExprToStmtAdapter instances)
- LatticeInterpretation is a class; sign/const interpretations,
evaluators and validity proofs are instances; use sites read like the
Agda module applications: result SignLattice prog
Proof simplifications (same theorems, proofs factored):
- Spa.Lattice.AboveBelow.monotone₂_of_strict: any ⊥-strict/⊤-dominated
operation on a flat lattice is monotone — replaces the four near-
identical case bashes per analysis (postulates in Agda)
- Spa.Lattice.AboveBelow.interp_sup_of/interp_inf_of: the shared flat-
lattice interpretation case analysis, making interpSign_sup/inf and
interpConst_sup/inf one-liners
lake build green with zero warnings; lake exe spa output verified
byte-identical (diff) to the previous, Agda-verified output.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-06-09 23:32:38 -07:00
|
|
|
|
Spa.analyze_correct ConstLattice prog hrun
|
2026-06-09 20:52:08 -07:00
|
|
|
|
|
|
|
|
|
|
end ConstAnalysis
|
|
|
|
|
|
|
|
|
|
|
|
end Spa
|