refactor: derive vcgen's exception postcondition rules from a type class - #14827
Draft
sgraf812 wants to merge 1 commit into
Draft
refactor: derive vcgen's exception postcondition rules from a type class#14827sgraf812 wants to merge 1 commit into
vcgen's exception postcondition rules from a type class#14827sgraf812 wants to merge 1 commit into
Conversation
|
Mathlib CI status (docs):
|
Collaborator
|
Reference manual CI status:
|
Contributor
Author
|
!bench |
|
Benchmark results for 5e7ac81 against 0bdfa79 are in. No significant results found. @sgraf812
Small changes (3🟥)
|
sgraf812
force-pushed
the
sg/epred-prod
branch
from
August 19, 2026 08:11
5e7ac81 to
f7cff5b
Compare
…class This PR lets `vcgen` weaken the exception postcondition of a spec for any exception postcondition type that converts into an assertion stack, not only for the `Prod`/`Unit` stacks themselves. `AssertionHom E T hom` converts an assertion `E` into a stack `T` whose factors are the assertions of the individual exception layers, reflects an entailment between the images back to an entailment between the arguments, and identifies the image of `⊥`. `decomposeProdRel` decomposes bare stacks directly; for an exception postcondition type with an `AssertionHom` instance it converts both sides once, decomposes the entailment between the images factor by factor, and reflects it back with `AssertionHom.le_of_hom_le`. A factor of the converted spec value is a projection of a literal, which the construction reduces so a schematic factor is assigned and a concrete factor's verification condition states the assertion the user wrote. The instance lookup runs during rule construction, which is cached per spec theorem, `WPMonad` instance and excess-argument count, so no goal pays for it.
sgraf812
force-pushed
the
sg/epred-prod
branch
from
August 21, 2026 09:47
f7cff5b to
1f7d5ca
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR lets
vcgenweaken the exception postcondition of a spec for any exception postcondition type that converts into an assertion stack, not only for theProd/Unitstacks themselves.AssertionHom E T homconverts an assertionEinto a stackTwhose factors are the assertions of the individual exception layers, reflects an entailment between the images back to an entailment between the arguments, and identifies the image of⊥. The spec rule construction decomposesepostSpec ⊑ epostover bareProd/Unitstacks directly; for an exception postcondition type with anAssertionHominstance it converts both sides once, decomposes the entailment between the images factor by factor, and reflects it back withAssertionHom.le_of_hom_le. A factor of the converted spec value is a projection of a literal, which the construction reduces so each verification condition states the assertion the user wrote. The instance lookup runs during rule construction, which is cached per spec theorem,WPMonadinstance and excess-argument count, so no goal pays for it.The test's
Thrownstructure, converting toEStack⟨String → Prop⟩, is the motivating instance: a concrete factor yields a pointwise verification condition, and a schematic factor is assigned the goal's factor instead of yielding one.