swaits
e183cdd95e
Make `just verify` actually invoke Why3 + alt-ergo + z3 against every
Pearlite VC, and fix the mutant + miri pipelines along the way.
Verification crate
- Drop the const-generic CAP types for EventQueue / TimerTable.
Mirror with std::vec::Vec, whose creusot-std specs carry the
proof burden. Capacity behavior is exercised by the runtime's
own unit tests + correspondence tests.
- View impls are #[logic(open)] over a pub field so contracts on
push/pop/etc. can see the link to the inner Vec's @ view.
- 14/14 VCs discharge: EventQueue {new, push, pop, is_empty, len,
clear, Default}; TimerTable {new, len, is_empty, Default};
Entry derives.
- `cargo creusot prove --no-cache` always runs the SMT solvers;
`time` shows ~7s CPU on ~1.2s wall-clock = real parallel work.
Tooling
- verification/mise.toml pins nightly-2025-11-13 + rust-src,
rustc-dev, llvm-tools-preview, rustfmt; declares opam, python,
uv, and the project-local .venv. Inherits root mise.toml's just
+ cargo-* tools.
- just verify clones creusot v0.9.0 to ~/.local/share/hsmc-verify/
and runs the canonical ./INSTALL — that's the only way the
bundled prelude-generator + creusot-rustc actually build.
- just verify --no-cache forces SMT re-runs every time.
- Drop bespoke pin/install of cargo-creusot from mise.toml; the
cargo backend goes through cargo-binstall which can't pin a
multi-bin git workspace at a tag.
Mutants — was missing every JournalSink mutant
- Recipe runs with --features tokio,journal so journal_* and det_*
tests (gated on both) actually execute.
- Add clear_journal_empties_the_journal test in journal_smoke.rs
to kill the JournalSink::clear with-() mutant.
- Remove dead JournalSink::len + is_empty (called nowhere; only
existed as mutation-bait).
Result: 0 missed, 42 caught, 211 unviable (proc-macro emitted
code that mutants can't standalone-compile).
Miri — was hitting the trybuild glob isolation issue
- --exclude hsmc-macros (trybuild ui test isn't UB-relevant)
- --exclude hsmc-verification (different pinned toolchain)
- 66 tests pass under Miri, 0 UB.
Gitignore
- /verif/, /why3find.json, /.why3find/, **/.venv/ — all
regenerated by `just verify`. Repo stays clean of per-machine
prover timings + venv artifacts.
Misc
- Fix root-state targetability: `on(Trig) => <ChartName>;` resolves
to root id 0 in both ir.rs::resolve_transitions and
validate.rs's separate name_map.
- `set shell` and `set script-interpreter` route every justfile
recipe through `mise exec`, so all subshells see the right
Rust + opam + cargo-* tools regardless of how `just` was
invoked. No shebangs anywhere.
40 lines
1.7 KiB
TOML
40 lines
1.7 KiB
TOML
[package]
|
|
name = "hsmc-verification"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
license.workspace = true
|
|
authors.workspace = true
|
|
repository.workspace = true
|
|
homepage.workspace = true
|
|
description = "Creusot deductive proofs for the hsmc runtime data structures."
|
|
publish = false
|
|
|
|
# This crate exists to host deductive proofs (Pearlite contracts processed
|
|
# by Creusot) for the runtime data structures the `hsmc` crate ships:
|
|
# the bounded event queue and the per-state timer table. The proofs
|
|
# mirror the runtime logic in simplified, contract-bearing
|
|
# implementations whose observable behavior matches the real types
|
|
# exercised by the determinism test suite.
|
|
#
|
|
# Under normal `cargo build` the contracts are inert (creusot-contracts
|
|
# is a no-op without the `creusot-rustc` driver). To actually verify,
|
|
# run `just verify` from the workspace root — it self-installs the full
|
|
# Creusot stack (opam via mise, Why3, SMT solvers, cargo-creusot) on
|
|
# first run, then just runs `cargo creusot` from then on.
|
|
#
|
|
# See `INVARIANTS.md` for the spec-rule → proof mapping.
|
|
|
|
[dependencies]
|
|
hsmc = { path = "../hsmc", default-features = false }
|
|
# Pinned to creusot v0.9.0 — last tagged release with `creusot-std`.
|
|
# `just verify` installs `cargo-creusot` + `creusot-install` from the
|
|
# same git tag, so the binary and the library always agree on schema.
|
|
creusot-std = "0.9.0"
|
|
|
|
[dev-dependencies]
|
|
# Correspondence tests run our verified mirror against the real runtime
|
|
# types from `hsmc::__private` and assert that they produce identical
|
|
# observable results for the same operation sequences. This is how we
|
|
# tie the proofs to the shipped code.
|
|
hsmc = { path = "../hsmc", default-features = false }
|