feat(verify): discharge Creusot VCs end-to-end
Make `just verify` actually invoke Why3 + alt-ergo + z3 against every
Pearlite VC, and fix the mutant + miri pipelines along the way.
Verification crate
- Drop the const-generic CAP types for EventQueue / TimerTable.
Mirror with std::vec::Vec, whose creusot-std specs carry the
proof burden. Capacity behavior is exercised by the runtime's
own unit tests + correspondence tests.
- View impls are #[logic(open)] over a pub field so contracts on
push/pop/etc. can see the link to the inner Vec's @ view.
- 14/14 VCs discharge: EventQueue {new, push, pop, is_empty, len,
clear, Default}; TimerTable {new, len, is_empty, Default};
Entry derives.
- `cargo creusot prove --no-cache` always runs the SMT solvers;
`time` shows ~7s CPU on ~1.2s wall-clock = real parallel work.
Tooling
- verification/mise.toml pins nightly-2025-11-13 + rust-src,
rustc-dev, llvm-tools-preview, rustfmt; declares opam, python,
uv, and the project-local .venv. Inherits root mise.toml's just
+ cargo-* tools.
- just verify clones creusot v0.9.0 to ~/.local/share/hsmc-verify/
and runs the canonical ./INSTALL — that's the only way the
bundled prelude-generator + creusot-rustc actually build.
- just verify --no-cache forces SMT re-runs every time.
- Drop bespoke pin/install of cargo-creusot from mise.toml; the
cargo backend goes through cargo-binstall which can't pin a
multi-bin git workspace at a tag.
Mutants — was missing every JournalSink mutant
- Recipe runs with --features tokio,journal so journal_* and det_*
tests (gated on both) actually execute.
- Add clear_journal_empties_the_journal test in journal_smoke.rs
to kill the JournalSink::clear with-() mutant.
- Remove dead JournalSink::len + is_empty (called nowhere; only
existed as mutation-bait).
Result: 0 missed, 42 caught, 211 unviable (proc-macro emitted
code that mutants can't standalone-compile).
Miri — was hitting the trybuild glob isolation issue
- --exclude hsmc-macros (trybuild ui test isn't UB-relevant)
- --exclude hsmc-verification (different pinned toolchain)
- 66 tests pass under Miri, 0 UB.
Gitignore
- /verif/, /why3find.json, /.why3find/, **/.venv/ — all
regenerated by `just verify`. Repo stays clean of per-machine
prover timings + venv artifacts.
Misc
- Fix root-state targetability: `on(Trig) => <ChartName>;` resolves
to root id 0 in both ir.rs::resolve_transitions and
validate.rs's separate name_map.
- `set shell` and `set script-interpreter` route every justfile
recipe through `mise exec`, so all subshells see the right
Rust + opam + cargo-* tools regardless of how `just` was
invoked. No shebangs anywhere.
This commit is contained in:
33 files changed
+2943
-2148
No files matched your search
+199
-96
@@ -11,8 +11,8 @@
|
||||
#![cfg(all(feature = "tokio", feature = "journal"))]
|
||||
#![allow(unexpected_cfgs)]
|
||||
|
||||
use hsmc::{statechart, ActionKind, TraceEvent};
|
||||
use core::time::Duration;
|
||||
use hsmc::{statechart, ActionKind, TraceEvent};
|
||||
|
||||
#[derive(Default)]
|
||||
pub struct Ctx;
|
||||
@@ -44,10 +44,10 @@ statechart! {
|
||||
}
|
||||
|
||||
impl TimActions for TimActionContext<'_> {
|
||||
async fn c_in(&mut self) {}
|
||||
async fn c_out(&mut self) {}
|
||||
async fn d_in(&mut self) {}
|
||||
async fn log_tick(&mut self){}
|
||||
async fn c_in(&mut self) {}
|
||||
async fn c_out(&mut self) {}
|
||||
async fn d_in(&mut self) {}
|
||||
async fn log_tick(&mut self) {}
|
||||
}
|
||||
|
||||
const SR: u16 = 0;
|
||||
@@ -58,124 +58,221 @@ const T_COUNTING: u16 = 0;
|
||||
const T_DONE: u16 = 1;
|
||||
|
||||
fn timer_events(j: &[TraceEvent]) -> Vec<&TraceEvent> {
|
||||
j.iter().filter(|e| matches!(
|
||||
e,
|
||||
TraceEvent::TimerArmed { .. }
|
||||
| TraceEvent::TimerCancelled { .. }
|
||||
| TraceEvent::TimerFired { .. }
|
||||
)).collect()
|
||||
j.iter()
|
||||
.filter(|e| {
|
||||
matches!(
|
||||
e,
|
||||
TraceEvent::TimerArmed { .. }
|
||||
| TraceEvent::TimerCancelled { .. }
|
||||
| TraceEvent::TimerFired { .. }
|
||||
)
|
||||
})
|
||||
.collect()
|
||||
}
|
||||
|
||||
#[tokio::test(flavor = "current_thread")]
|
||||
async fn det_timer_arms_on_entry() {
|
||||
// Spec: timer starts when its state is entered.
|
||||
tokio::task::LocalSet::new().run_until(async {
|
||||
let mut m = Tim::new(Ctx);
|
||||
let _ = m.dispatch(Ev::Stop).await;
|
||||
let j = m.take_journal();
|
||||
// First TimerArmed must be Counting's 50ms timer.
|
||||
let first_armed = j.iter().find(|e| matches!(e, TraceEvent::TimerArmed { .. }));
|
||||
assert!(matches!(
|
||||
first_armed,
|
||||
Some(TraceEvent::TimerArmed { state: SC, timer: T_COUNTING, ns: 50_000_000 })
|
||||
), "got: {:?}", first_armed);
|
||||
}).await;
|
||||
tokio::task::LocalSet::new()
|
||||
.run_until(async {
|
||||
let mut m = Tim::new(Ctx);
|
||||
let _ = m.dispatch(Ev::Stop).await;
|
||||
let j = m.take_journal();
|
||||
// First TimerArmed must be Counting's 50ms timer.
|
||||
let first_armed = j
|
||||
.iter()
|
||||
.find(|e| matches!(e, TraceEvent::TimerArmed { .. }));
|
||||
assert!(
|
||||
matches!(
|
||||
first_armed,
|
||||
Some(TraceEvent::TimerArmed {
|
||||
state: SC,
|
||||
timer: T_COUNTING,
|
||||
ns: 50_000_000
|
||||
})
|
||||
),
|
||||
"got: {:?}",
|
||||
first_armed
|
||||
);
|
||||
})
|
||||
.await;
|
||||
}
|
||||
|
||||
#[tokio::test(flavor = "current_thread")]
|
||||
async fn det_timer_cancels_on_exit() {
|
||||
// Spec: timer is cancelled when its state is exited.
|
||||
tokio::task::LocalSet::new().run_until(async {
|
||||
let mut m = Tim::new(Ctx);
|
||||
let _ = m.dispatch(Ev::Stop).await;
|
||||
let j = m.take_journal();
|
||||
// Stop transitions Counting → Done. Exit Counting must cancel its timer.
|
||||
let cancelled = j.iter().find(|e| matches!(
|
||||
e, TraceEvent::TimerCancelled { state: SC, timer: T_COUNTING }
|
||||
));
|
||||
assert!(cancelled.is_some(),
|
||||
"Counting's timer must be cancelled on exit, got: {:?}", j);
|
||||
}).await;
|
||||
tokio::task::LocalSet::new()
|
||||
.run_until(async {
|
||||
let mut m = Tim::new(Ctx);
|
||||
let _ = m.dispatch(Ev::Stop).await;
|
||||
let j = m.take_journal();
|
||||
// Stop transitions Counting → Done. Exit Counting must cancel its timer.
|
||||
let cancelled = j.iter().find(|e| {
|
||||
matches!(
|
||||
e,
|
||||
TraceEvent::TimerCancelled {
|
||||
state: SC,
|
||||
timer: T_COUNTING
|
||||
}
|
||||
)
|
||||
});
|
||||
assert!(
|
||||
cancelled.is_some(),
|
||||
"Counting's timer must be cancelled on exit, got: {:?}",
|
||||
j
|
||||
);
|
||||
})
|
||||
.await;
|
||||
}
|
||||
|
||||
#[tokio::test(flavor = "current_thread")]
|
||||
async fn det_timer_cancel_appears_before_exit_actions() {
|
||||
// Spec: "1. cancel durings 2. cancel timers 3. exit actions 4. Exited"
|
||||
tokio::task::LocalSet::new().run_until(async {
|
||||
let mut m = Tim::new(Ctx);
|
||||
let _ = m.dispatch(Ev::Stop).await;
|
||||
let j = m.take_journal();
|
||||
let cancel_idx = j.iter().position(|e| matches!(
|
||||
e, TraceEvent::TimerCancelled { state: SC, .. }
|
||||
)).unwrap();
|
||||
let exit_action_idx = j.iter().position(|e| matches!(
|
||||
e, TraceEvent::ActionInvoked { state: SC, kind: ActionKind::Exit, .. }
|
||||
)).unwrap();
|
||||
assert!(cancel_idx < exit_action_idx,
|
||||
"TimerCancelled at {} must precede ActionInvoked Exit at {}",
|
||||
cancel_idx, exit_action_idx);
|
||||
}).await;
|
||||
tokio::task::LocalSet::new()
|
||||
.run_until(async {
|
||||
let mut m = Tim::new(Ctx);
|
||||
let _ = m.dispatch(Ev::Stop).await;
|
||||
let j = m.take_journal();
|
||||
let cancel_idx = j
|
||||
.iter()
|
||||
.position(|e| matches!(e, TraceEvent::TimerCancelled { state: SC, .. }))
|
||||
.unwrap();
|
||||
let exit_action_idx = j
|
||||
.iter()
|
||||
.position(|e| {
|
||||
matches!(
|
||||
e,
|
||||
TraceEvent::ActionInvoked {
|
||||
state: SC,
|
||||
kind: ActionKind::Exit,
|
||||
..
|
||||
}
|
||||
)
|
||||
})
|
||||
.unwrap();
|
||||
assert!(
|
||||
cancel_idx < exit_action_idx,
|
||||
"TimerCancelled at {} must precede ActionInvoked Exit at {}",
|
||||
cancel_idx,
|
||||
exit_action_idx
|
||||
);
|
||||
})
|
||||
.await;
|
||||
}
|
||||
|
||||
#[tokio::test(flavor = "current_thread")]
|
||||
async fn det_timer_arm_appears_after_entry_actions() {
|
||||
// The TimerArmed must come AFTER the entry action invocation.
|
||||
tokio::task::LocalSet::new().run_until(async {
|
||||
let mut m = Tim::new(Ctx);
|
||||
let _ = m.dispatch(Ev::Stop).await;
|
||||
let j = m.take_journal();
|
||||
// First Entry-kind action on Counting:
|
||||
let entry_idx = j.iter().position(|e| matches!(
|
||||
e, TraceEvent::ActionInvoked { state: SC, kind: ActionKind::Entry, .. }
|
||||
)).unwrap();
|
||||
// First TimerArmed for Counting:
|
||||
let armed_idx = j.iter().position(|e| matches!(
|
||||
e, TraceEvent::TimerArmed { state: SC, .. }
|
||||
)).unwrap();
|
||||
assert!(entry_idx < armed_idx,
|
||||
"entry actions ({}) must fire before TimerArmed ({})",
|
||||
entry_idx, armed_idx);
|
||||
}).await;
|
||||
tokio::task::LocalSet::new()
|
||||
.run_until(async {
|
||||
let mut m = Tim::new(Ctx);
|
||||
let _ = m.dispatch(Ev::Stop).await;
|
||||
let j = m.take_journal();
|
||||
// First Entry-kind action on Counting:
|
||||
let entry_idx = j
|
||||
.iter()
|
||||
.position(|e| {
|
||||
matches!(
|
||||
e,
|
||||
TraceEvent::ActionInvoked {
|
||||
state: SC,
|
||||
kind: ActionKind::Entry,
|
||||
..
|
||||
}
|
||||
)
|
||||
})
|
||||
.unwrap();
|
||||
// First TimerArmed for Counting:
|
||||
let armed_idx = j
|
||||
.iter()
|
||||
.position(|e| matches!(e, TraceEvent::TimerArmed { state: SC, .. }))
|
||||
.unwrap();
|
||||
assert!(
|
||||
entry_idx < armed_idx,
|
||||
"entry actions ({}) must fire before TimerArmed ({})",
|
||||
entry_idx,
|
||||
armed_idx
|
||||
);
|
||||
})
|
||||
.await;
|
||||
}
|
||||
|
||||
#[tokio::test(flavor = "current_thread")]
|
||||
async fn det_timer_arm_each_state_in_path() {
|
||||
// Initial descent into Counting arms Counting's timer.
|
||||
tokio::task::LocalSet::new().run_until(async {
|
||||
let mut m = Tim::new(Ctx);
|
||||
let _ = m.dispatch(Ev::Halt).await;
|
||||
let armed: Vec<&TraceEvent> = m.journal().iter().filter(|e| matches!(
|
||||
e, TraceEvent::TimerArmed { .. }
|
||||
)).collect();
|
||||
// Only Counting has a timer in initial descent (Done is unreached).
|
||||
assert_eq!(armed.len(), 1, "expected 1 TimerArmed during initial descent, got {:?}", armed);
|
||||
}).await;
|
||||
tokio::task::LocalSet::new()
|
||||
.run_until(async {
|
||||
let mut m = Tim::new(Ctx);
|
||||
let _ = m.dispatch(Ev::Halt).await;
|
||||
let armed: Vec<&TraceEvent> = m
|
||||
.journal()
|
||||
.iter()
|
||||
.filter(|e| matches!(e, TraceEvent::TimerArmed { .. }))
|
||||
.collect();
|
||||
// Only Counting has a timer in initial descent (Done is unreached).
|
||||
assert_eq!(
|
||||
armed.len(),
|
||||
1,
|
||||
"expected 1 TimerArmed during initial descent, got {:?}",
|
||||
armed
|
||||
);
|
||||
})
|
||||
.await;
|
||||
}
|
||||
|
||||
#[tokio::test(flavor = "current_thread")]
|
||||
async fn det_timer_two_lifecycles_arm_then_cancel_each() {
|
||||
// GoChild then UpToCounting (no such event — use Stop for full exit).
|
||||
// Just check Stop's full sequence: arm → cancel.
|
||||
tokio::task::LocalSet::new().run_until(async {
|
||||
let mut m = Tim::new(Ctx);
|
||||
let _ = m.dispatch(Ev::Stop).await;
|
||||
let evs = timer_events(m.journal());
|
||||
assert_eq!(evs.len(), 3, "expected arm → cancel → arm (Done's timer), got {:?}", evs);
|
||||
assert!(matches!(evs[0], TraceEvent::TimerArmed { state: SC, timer: T_COUNTING, ns: 50_000_000 }));
|
||||
assert!(matches!(evs[1], TraceEvent::TimerCancelled { state: SC, timer: T_COUNTING }));
|
||||
assert!(matches!(evs[2], TraceEvent::TimerArmed { state: SD, timer: T_DONE, ns: 20_000_000 }));
|
||||
}).await;
|
||||
tokio::task::LocalSet::new()
|
||||
.run_until(async {
|
||||
let mut m = Tim::new(Ctx);
|
||||
let _ = m.dispatch(Ev::Stop).await;
|
||||
let evs = timer_events(m.journal());
|
||||
assert_eq!(
|
||||
evs.len(),
|
||||
3,
|
||||
"expected arm → cancel → arm (Done's timer), got {:?}",
|
||||
evs
|
||||
);
|
||||
assert!(matches!(
|
||||
evs[0],
|
||||
TraceEvent::TimerArmed {
|
||||
state: SC,
|
||||
timer: T_COUNTING,
|
||||
ns: 50_000_000
|
||||
}
|
||||
));
|
||||
assert!(matches!(
|
||||
evs[1],
|
||||
TraceEvent::TimerCancelled {
|
||||
state: SC,
|
||||
timer: T_COUNTING
|
||||
}
|
||||
));
|
||||
assert!(matches!(
|
||||
evs[2],
|
||||
TraceEvent::TimerArmed {
|
||||
state: SD,
|
||||
timer: T_DONE,
|
||||
ns: 20_000_000
|
||||
}
|
||||
));
|
||||
})
|
||||
.await;
|
||||
}
|
||||
|
||||
#[tokio::test(flavor = "current_thread")]
|
||||
async fn det_timer_byte_deterministic() {
|
||||
let run = || async {
|
||||
tokio::task::LocalSet::new().run_until(async {
|
||||
let mut m = Tim::new(Ctx);
|
||||
let _ = m.dispatch(Ev::Stop).await;
|
||||
let _ = m.dispatch(Ev::Halt).await;
|
||||
m.take_journal()
|
||||
}).await
|
||||
tokio::task::LocalSet::new()
|
||||
.run_until(async {
|
||||
let mut m = Tim::new(Ctx);
|
||||
let _ = m.dispatch(Ev::Stop).await;
|
||||
let _ = m.dispatch(Ev::Halt).await;
|
||||
m.take_journal()
|
||||
})
|
||||
.await
|
||||
};
|
||||
let first = run().await;
|
||||
for i in 1..10 {
|
||||
@@ -186,13 +283,19 @@ async fn det_timer_byte_deterministic() {
|
||||
#[tokio::test(flavor = "current_thread")]
|
||||
async fn det_timer_state_cancel_uses_correct_state_id() {
|
||||
// The TimerCancelled.state must be SC, not SR or any other.
|
||||
tokio::task::LocalSet::new().run_until(async {
|
||||
let mut m = Tim::new(Ctx);
|
||||
let _ = m.dispatch(Ev::Stop).await;
|
||||
let cancels: Vec<u16> = m.journal().iter().filter_map(|e| match e {
|
||||
TraceEvent::TimerCancelled { state, .. } => Some(*state),
|
||||
_ => None,
|
||||
}).collect();
|
||||
assert_eq!(cancels, vec![SC]);
|
||||
}).await;
|
||||
tokio::task::LocalSet::new()
|
||||
.run_until(async {
|
||||
let mut m = Tim::new(Ctx);
|
||||
let _ = m.dispatch(Ev::Stop).await;
|
||||
let cancels: Vec<u16> = m
|
||||
.journal()
|
||||
.iter()
|
||||
.filter_map(|e| match e {
|
||||
TraceEvent::TimerCancelled { state, .. } => Some(*state),
|
||||
_ => None,
|
||||
})
|
||||
.collect();
|
||||
assert_eq!(cancels, vec![SC]);
|
||||
})
|
||||
.await;
|
||||
}
|
||||
Reference in new issue
Block a user