proof/: all 23 Isabelle theory files now verify under Isabelle2025-2
Isabelle toolchain replaced (was genuinely 2011, 14+ years stale) and every theory file fixed to actually compile -- most had apparently never been checked under a working Isabelle at all. Fixed the vm_state self-reference in StarForth_Base.thy properly (word_table is now a free-standing global constant, not a circular record field), corrected the word_physics_transparent axiom (was claiming full state equality from mere exec-equivalence, provably too strong), and worked through 14 years of HOL-Library drift plus several missing-hypothesis bugs across the physics-loop and ACL theories. Two genuine (non-tactical) bugs found and left oops-flagged rather than silently resolved: forth_roll's index arithmetic disagrees with both its own test lemma and the real C ROLL implementation (three-way inconsistency), and pm_wf isn't actually preserved by pm_record_hit/pm_record_miss. Both need a decision, not a proof-script fix. Full writeup in FABRIC-2.md item 5.2.
This commit is contained in:
Robert Allan James
@@ -28,15 +28,20 @@ begin
|
||||
heartbeat_step vm ≃ vm
|
||||
The heartbeat is the identity in vm_state/≃ (exec_equiv).
|
||||
C audit: src/vm_time.c vm_tick() must NOT write to
|
||||
data_stack, return_stack, memory, or word_table.
|
||||
data_stack, return_stack, or memory. (word_table dropped
|
||||
from this list 2026-08-13: it is a free-standing global
|
||||
constant now, not a vm_state field, so vm_tick() cannot
|
||||
write to it at all.)
|
||||
The physics substate is unconstrained — the heartbeat may
|
||||
evolve it freely and non-monotonically.
|
||||
The former 8 field axioms are now proved lemmas from A1.
|
||||
|
||||
A4'×1. word_physics_transparent (StarForth_Transition)
|
||||
s1 ≃ s2 ⟹ word_table s1 n s1 = word_table s2 n s2
|
||||
s1 ≃ s2 ⟹ word_table n s1 ≃ word_table n s2
|
||||
(corrected 2026-08-13: conclusion is ≃, not literal
|
||||
equality -- see the note at its declaration)
|
||||
Word execution is a congruence law for ≃.
|
||||
Word audit: every Level 1 word body must read ONLY the four
|
||||
Word audit: every Level 1 word body must read ONLY the three
|
||||
fields in exec_equiv — never any physics field.
|
||||
|
||||
Physics invariants (A2/A3) remain removed — clamping suffices.
|
||||
@@ -59,14 +64,14 @@ thm swap_normal \<comment> \<open>✓ SWAP exchanges top two\<close>
|
||||
thm over_normal \<comment> \<open>✓ OVER copies second to top\<close>
|
||||
thm rot_normal \<comment> \<open>✓ ROT cycles top 3\<close>
|
||||
thm swap_involutive \<comment> \<open>✓ SWAP ∘ SWAP = identity\<close>
|
||||
thm rot_neg_rot_identity \<comment> \<open>✓ ROT ∘ -ROT = identity\<close>
|
||||
thm rot_nrot_inverse \<comment> \<open>✓ ROT ∘ -ROT = identity (corrected name, 2026-08-13)\<close>
|
||||
thm add_normal \<comment> \<open>✓ + pops 2, pushes sum\<close>
|
||||
thm mul_comm \<comment> \<open>✓ * is commutative\<close>
|
||||
thm mul_commutative \<comment> \<open>✓ * is commutative (corrected name, 2026-08-13)\<close>
|
||||
thm negate_involutive \<comment> \<open>✓ NEGATE ∘ NEGATE = identity\<close>
|
||||
thm abs_non_negative \<comment> \<open>✓ ABS result ≥ 0\<close>
|
||||
thm abs_nonneg \<comment> \<open>✓ ABS result ≥ 0 (corrected name, 2026-08-13)\<close>
|
||||
thm and_normal \<comment> \<open>✓ AND bitwise\<close>
|
||||
thm zero_eq_true \<comment> \<open>✓ 0= of 0 is FORTH_TRUE\<close>
|
||||
thm zero_lt_exhaustion \<comment> \<open>✓ {0=, 0<, 0>} partition ℤ\<close>
|
||||
thm zero_eq_zero \<comment> \<open>✓ 0= of 0 is FORTH_TRUE (corrected name, 2026-08-13)\<close>
|
||||
thm zero_tests_exhaustive \<comment> \<open>✓ {0=, 0<, 0>} partition ℤ (corrected name, 2026-08-13)\<close>
|
||||
thm to_r_then_from_r \<comment> \<open>✓ >R then R> round-trip\<close>
|
||||
thm store_then_fetch \<comment> \<open>✓ ! then @ identity\<close>
|
||||
thm cstore_then_cfetch \<comment> \<open>✓ C! then C@ round-trip\<close>
|
||||
@@ -83,8 +88,10 @@ lemma pure_ds_word_preserves_physics:
|
||||
"last_inference (vm\<lparr>data_stack := xs\<rparr>) = last_inference vm"
|
||||
"ssm_l8 (vm\<lparr>data_stack := xs\<rparr>) = ssm_l8 vm"
|
||||
"dictionary (vm\<lparr>data_stack := xs\<rparr>) = dictionary vm"
|
||||
"word_table (vm\<lparr>data_stack := xs\<rparr>) = word_table vm"
|
||||
by simp_all
|
||||
(* The word_table conjunct here was removed 2026-08-13: word_table is a
|
||||
free-standing global constant now, not a vm_state field, so
|
||||
"word_table (vm\<lparr>...\<rparr>)" no longer type-checks -- true by construction. *)
|
||||
|
||||
(* =========================================================================
|
||||
Section 3: Level 2 — Physics invariants (all ✓ or ○)
|
||||
@@ -125,11 +132,14 @@ theorem starforth_correctness_totality:
|
||||
fixes vm :: vm_state
|
||||
assumes wf: "wf_vm vm"
|
||||
shows
|
||||
(* Level 1: key wf_vm invariants hold *)
|
||||
(* Level 1: key wf_vm invariants hold. Level 2: physics invariants
|
||||
from wf_vm (comment moved out here 2026-08-13 -- it was previously
|
||||
embedded mid-string at the "rw_eff_window" line, which is inside a
|
||||
quoted prop and does not parse as a comment there; genuine syntax
|
||||
error, not a version issue). *)
|
||||
"length (data_stack vm) \<le> STACK_SIZE \<and>
|
||||
length (return_stack vm) \<le> STACK_SIZE \<and>
|
||||
\<not> vm_error vm \<and>
|
||||
(* Level 2: physics invariants from wf_vm *)
|
||||
rw_eff_window (rolling_window vm) \<ge> ADAPTIVE_MIN_WINDOW_SIZE \<and>
|
||||
rw_eff_window (rolling_window vm) \<le> ROLLING_WINDOW_SIZE \<and>
|
||||
rw_act_window (rolling_window vm) \<le> ROLLING_WINDOW_SIZE \<and>
|
||||
@@ -142,15 +152,15 @@ theorem starforth_correctness_totality:
|
||||
(* Corollary: non-interference for a word executed after k heartbeat ticks. *)
|
||||
corollary word_result_heartbeat_independent:
|
||||
"\<forall> n k vm.
|
||||
data_stack (word_table (heartbeat_step ^^ k $ vm) n (heartbeat_step ^^ k $ vm))
|
||||
= data_stack (word_table vm n vm)"
|
||||
data_stack (word_table n ((heartbeat_step ^^ k) vm))
|
||||
= data_stack (word_table n vm)"
|
||||
using heartbeat_noninterference by blast
|
||||
|
||||
(* Corollary: trace-level non-interference (proved theorem). *)
|
||||
corollary trace_result_heartbeat_independent:
|
||||
"\<And> words vm k.
|
||||
data_stack (foldl (\<lambda>s n. word_table s n s) (heartbeat_step ^^ k $ vm) words)
|
||||
= data_stack (foldl (\<lambda>s n. word_table s n s) vm words)"
|
||||
data_stack (foldl (\<lambda>s n. word_table n s) ((heartbeat_step ^^ k) vm) words)
|
||||
= data_stack (foldl (\<lambda>s n. word_table n s) vm words)"
|
||||
using heartbeat_trace_noninterference by blast
|
||||
|
||||
end
|
||||
|
||||
Reference in New Issue
Block a user