rocq/theories/Hi.v
The source-shaped body of tests/c/prog/hi.c at the trusted libc boundary. Entry and libc realization are premises, not proofs of the native launcher or libc. The body ignores all launcher words.
Main's one call has the exact checked IR result and argument syntax.
The two instructions emitted for hi.c: copy its literal, then call puts.
The source-shaped main returns an int and declares no parameters or locals.
The module's read-only hello literal includes its NUL.
The pointer assigned to the literal by the model's actual module layout.
The model's actual initialized module memory, before launcher/libc allocations.
Initializing the module succeeds and exposes the expected symbol pointers.
Explore proof 1 tactics
Initial goal
reflexivity
No remaining goals.
Qed
✓ Proof checked and closed by Rocq.
Source script
The initialized literal is a checked in-object C string, not an assumed address.
Explore proof 2 tactics
Initial goal
vm_compute
repeat split ; try reflexivity ; lia
No remaining goals.
Qed
✓ Proof checked and closed by Rocq.
Source script
A configuration in this main, with no caller/local objects or doom.
Main begins at its actual entry block.
Just before puts, its argument has been copied into v0.
Any launcher's argc/argv/environment produce the same main(void) frame.
Explore proof 1 tactics
Initial goal
reflexivity
No remaining goals.
Qed
✓ Proof checked and closed by Rocq.
Source script
Bind this body's own symbols; libc remains unresolved and contract-dispatched.
The linked model environment: this module and its initialized global symbols.
Main reaches the call by two ordinary core steps, preserving entry memory.
Explore proof 14 tactics
Initial goal
intros world m fuel s w registry Hfuel
eapply M.run_cons with trace := [ ] tail := [ ] mid := M.Runninghi_configm fuel − 1 [ ] ExecTAtom"start" hi_instructions JRetConst0, s w
2 open–apply M.step_core
2 openapply M.P.I.RM.mstep_next
2 openunfold Semantics.step , hi_entry , hi_config
2 openNo native implementation is inferred from the registry: only puts is covered.
This real call is unresolved, not free, not data, and not doomed.
The caller's obligation is checked independently of any invocation's existence.
Every completed puts invocation either returns its W result or exhausts resources; it cannot terminate the process or yield a capability panic.
Returned integers bind the source's v1 without consuming main's return.
Whatever puts returns, main's next real core instruction returns zero, and the retained snapshot is exactly the invocation's final memory.
An actual returning contract call followed by main's return reaches the existing machine terminal. No exit observation is appended here.
Before the call, the literal retains its actual global region and bytes.
This invariant establishes the entire NUL-inclusive argument check.
The initialized source module establishes the literal invariant.
A safepoint cannot free GlobalData as though it were a heap object; non-moving bytes preserve the first NUL and the literal's contents.
The source's copy point, after its entry block has consumed fuel.
After the call, return zero reads no old literal or argument state.
Entry consumes fuel or reports OutOfFuel; neither is a library transition.
The literal copy has no memory effect or dynamic allocation.
The no-locals return ignores puts' result, even EOF.
There is exactly one external-call syntax at the reached call point.
The four application phases and permitted terminals; none deletes a failed precondition or silently turns it into a native safety result.
This environment/library premise requires the opaque representation and writable roots to survive collector safepoints, including permitted rewriting of capabilities to already-freed objects. It is not an extra Runtime axiom. The literal preservation is proved above.
Only the facts main still needs are retained before its call; argv is unused.
Safepoints retain those facts under the explicit stdio-stability premise.
Safe finite application outcomes include resource refusal and fuel exhaustion, not unreachable/stuck/unchecked/capability-panic or contract-violation endings.
The actual configuration shape and the caller obligations at every phase.
Every external call in a body state is this puts, with its obligations proved.
Ordinary core steps retain the exact source phase and its needed facts.
simpl
2 openassert fuel =? 0 = false as E by apply Z.eqb_neq ; assumption
2 openrewrite E
2 openreflexivity
–eapply M.run_cons with trace := [ ] tail := [ ]
3 openfocused goal
+apply M.step_core
3 opendeferred goal
shelved goal
apply M.P.I.RM.mstep_next
3 opendeferred goal
reflexivity
deferred goal
+constructor
No remaining goals.
Qed
✓ Proof checked and closed by Rocq.
Source script
Explore proof 2 tactics
Initial goal
intros m fuel
repeat split ; reflexivity
No remaining goals.
Qed
✓ Proof checked and closed by Rocq.
Source script
Explore proof 12 tactics
Initial goal
intros rep requests m w fuel Hr Hw Hstr
exists puts_contractrep requests, WPtrhi_literal
split ; reflexivity |
split ; reflexivity |
split
2 openfocused goal
–split ; right ; exists TAtom"v1" ; reflexivity |
2 opendeferred goal
exists TmpTAtom"v0"
2 opendeferred goal
reflexivity
deferred goal
–split ; exact Hr |
split ; exact Hw |
exists hi_literal, hello_bytes
auto
No remaining goals.
Qed
✓ Proof checked and closed by Rocq.
Source script
Explore proof 11 tactics
Initial goal
intros rep requests s m w trace ending s′ m′ w′ H
destruct H
2 openfocused goal
–left
2 opendeferred goal
destruct H2 as p & bytes & acc & tail & n & _ & _ & _ & _ & _ & Hend & _
2 opendeferred goal
exists n
2 opendeferred goal
exact Hend
deferred goal
–right
exists why
repeat split ; auto
apply puts_no_capability_panic with rep := rep requests := requests
assumption
No remaining goals.
Qed
✓ Proof checked and closed by Rocq.
Source script
Explore proof 1 tactics
Initial goal
reflexivity
No remaining goals.
Qed
✓ Proof checked and closed by Rocq.
Source script
Explore proof 3 tactics
Initial goal
intros n m m′ fuel
exists TAtom"start", Const0
repeat split ; reflexivity
No remaining goals.
Qed
✓ Proof checked and closed by Rocq.
Explore proof 12 tactics
Initial goal
intros rep requests s m w trace n s′ m′ w′ fuel H
cbv zeta
rewrite <- app_nil_rtrace
eapply M.run_cons with trace := trace tail := [ ]
3 openfocused goal
shelved goal
–eapply M.step_return with site := hi_site values := WIntn ; apply hi_external_site | reflexivity | reflexivity | exact H | reflexivity
deferred goal
–eapply M.run_cons with trace := [ ] tail := [ ]
3 openfocused goal
shelved goal
+apply M.step_core_end
4 openfocused goal
deferred goal
shelved goal
∗intros site Hsite
4 opendeferred goal
deferred goal
shelved goal
pose proof external_site_stuck_ _ _ Hsite as Hstuck
4 opendeferred goal
deferred goal
shelved goal
discriminate Hstuck
3 opendeferred goal
deferred goal
shelved goal
∗exact proj1main_return_step_ _ _ hi_after_puts_returnn mod 2 ^ 32 m m′ fuel
deferred goal
+constructor
No remaining goals.
Qed
✓ Proof checked and closed by Rocq.
Source script
Explore proof 6 tactics
Initial goal
intros m Hreg Hbytes
split ; | exact Hbytes
unfold access_res , cap_access_res
simpl
rewrite Hreg
reflexivity
No remaining goals.
Qed
✓ Proof checked and closed by Rocq.
Source script
Explore proof 2 tactics
Initial goal
vm_compute
repeat split ; try reflexivity ; lia
No remaining goals.
Qed
✓ Proof checked and closed by Rocq.
Source script
Explore proof 18 tactics
Initial goal
intros s m s′ m′ Hsp Hreg Hbytes
assert Hexists : object_region65552 m_regionsm′ ≠ None
2 openfocused goal
{apply R.rooting_ _ _ _ Hsp
2 opendeferred goal
rewrite Hreg
2 opendeferred goal
discriminate
deferred goal
destruct object_region65552 m_regionsm′ as reg′ | eqn: E ; | contradiction
destruct R.safepoint_lifetime_ _ _ _ Hsp _ _ E as reg & Hr & Heq | Hheap _
2 openfocused goal
–rewrite Hreg in Hr
2 opendeferred goal
injection Hr as ←
2 opendeferred goal
subst reg′
2 opendeferred goal
split ; exact E |
2 opendeferred goal
eapply string_at_agree ; | exact Hbytes
2 opendeferred goal
intros a
2 opendeferred goal
rewrite R.non_moving_ _ _ _ Hsp
2 opendeferred goal
reflexivity
deferred goal
–rewrite Hreg in Hr
injection Hr as ←
discriminate Hheap
No remaining goals.
Qed
✓ Proof checked and closed by Rocq.
Source script
Explore proof 2 tactics
Source script
Explore proof 1 tactics
Explore proof 1 tactics
Explore proof 4 tactics
Initial goal
intros m fuel l r n args rest j _ & Hat & _
simpl in Hat
inversion Hat
reflexivity
No remaining goals.
Qed
✓ Proof checked and closed by Rocq.
Source script
Explore proof 5 tactics
Initial goal
intros s m s′ m′ w Hsp Hr Hw Hl
destruct stdio_stable_ _ _ _ _ Hsp Hr Hw as Hr′ Hw′
split ; exact Hr′ |
split ; exact Hw′ |
eapply hi_literal_safepoint ; eauto
No remaining goals.
Qed
✓ Proof checked and closed by Rocq.
Source script
Explore proof 15 tactics
Initial goal
intros c s w site Hinv Hsite
inversion Hinv ; subst
4 openfocused goal
focused goal
focused goal
–pose proof external_site_stuck_ _ _ Hsite as Hstuck
4 opendeferred goal
deferred goal
deferred goal
rewrite hi_entry_step in Hstuck
4 opendeferred goal
deferred goal
deferred goal
destruct fuel =? 0 ; discriminate
3 opendeferred goal
deferred goal
deferred goal
–pose proof external_site_stuck_ _ _ Hsite as Hstuck
3 opendeferred goal
deferred goal
rewrite hi_copy_step in Hstuck
3 opendeferred goal
deferred goal
discriminate
2 opendeferred goal
deferred goal
–pose proof hi_site_unique_ _ _ Hsite as →
2 opendeferred goal
split ; reflexivity |
2 opendeferred goal
match goal withHpre : hi_before_call_ _ |- _⇒destruct Hpre as Hr Hw Hlend
2 opendeferred goal
apply hi_call_admissible ; auto using hi_literal_checked
deferred goal
–pose proof external_site_stuck_ _ _ Hsite as Hstuck
rewrite hi_return_step in Hstuck
discriminate
No remaining goals.
Qed
✓ Proof checked and closed by Rocq.
Source script
Proof 33 steps Qed
An actual core terminal at a body phase is return zero or OutOfFuel.
Explore proof 12 tactics
Initial goal
intros c s w o Hinv Hdone
inversion Hinv ; subst
4 openfocused goal
focused goal
focused goal
–rewrite hi_entry_step in Hdone
4 opendeferred goal
deferred goal
deferred goal
destruct fuel =? 0 ; inversion Hdone
4 opendeferred goal
deferred goal
deferred goal
right ; left ; reflexivity
3 opendeferred goal
deferred goal
deferred goal
–rewrite hi_copy_step in Hdone
3 opendeferred goal
deferred goal
discriminate
2 opendeferred goal
deferred goal
–rewrite external_site_stuck_ _ _ hi_external_sitem fuel in Hdone
2 opendeferred goal
discriminate
deferred goal
–rewrite hi_return_step in Hdone
inversion Hdone
left ; reflexivity
No remaining goals.
Qed
✓ Proof checked and closed by Rocq.
Source script
Core stuck at a body phase is exactly the external call, never an unhandled core error. Missing coverage is still detected by the external rules.
Explore proof 10 tactics
Initial goal
intros c s w diagnostic Hinv Hstuck
inversion Hinv ; subst
4 openfocused goal
focused goal
focused goal
–rewrite hi_entry_step in Hstuck
4 opendeferred goal
deferred goal
deferred goal
destruct fuel =? 0 ; discriminate
3 opendeferred goal
deferred goal
deferred goal
–rewrite hi_copy_step in Hstuck
3 opendeferred goal
deferred goal
discriminate
2 opendeferred goal
deferred goal
–exists hi_site
2 opendeferred goal
apply hi_external_site
deferred goal
–rewrite hi_return_step in Hstuck
discriminate
No remaining goals.
Qed
✓ Proof checked and closed by Rocq.
Source script
No core allocation is hidden in this body. Puts' allocations remain in its contract.
Explore proof 10 tactics
Initial goal
intros c s w q k Hinv Hfresh
inversion Hinv ; subst
4 openfocused goal
focused goal
focused goal
–rewrite hi_entry_step in Hfresh
4 opendeferred goal
deferred goal
deferred goal
destruct fuel =? 0 ; discriminate
3 opendeferred goal
deferred goal
deferred goal
–rewrite hi_copy_step in Hfresh
3 opendeferred goal
deferred goal
discriminate
2 opendeferred goal
deferred goal
–rewrite external_site_stuck_ _ _ hi_external_sitem fuel in Hfresh
2 opendeferred goal
discriminate
deferred goal
–rewrite hi_return_step in Hfresh
discriminate
No remaining goals.
Qed
✓ Proof checked and closed by Rocq.
Source script
Dispatch and argument evaluation select exactly this contract and literal.
Explore proof 18 tactics
Initial goal
intros c s w site spec xs Hinv Hsite Hreg Hargs
destruct hi_reached_call_admissible_ _ _ _ Hinv Hsite as → _
change Someputs_contractrep requests = Somespec in Hreg
injection Hreg as ←
inversion Hinv ; subst
4 openfocused goal
focused goal
focused goal
–pose proof external_site_stuck_ _ _ Hsite as Hstuck
4 opendeferred goal
deferred goal
deferred goal
rewrite hi_entry_step in Hstuck
4 opendeferred goal
deferred goal
deferred goal
destruct fuel =? 0 ; discriminate
3 opendeferred goal
deferred goal
deferred goal
–pose proof external_site_stuck_ _ _ Hsite as Hstuck
3 opendeferred goal
deferred goal
rewrite hi_copy_step in Hstuck
3 opendeferred goal
deferred goal
discriminate
2 opendeferred goal
deferred goal
–change SomeWPtrhi_literal = Somexs in Hargs
2 opendeferred goal
injection Hargs as ←
2 opendeferred goal
exists m, fuel
2 opendeferred goal
repeat split ; reflexivity
deferred goal
–pose proof external_site_stuck_ _ _ Hsite as Hstuck
rewrite hi_return_step in Hstuck
discriminate
No remaining goals.
Qed
✓ Proof checked and closed by Rocq.
Source script
Every enabled labelled step retains the body invariant. Bad contracts are not filtered out: the concrete call's proved obligations contradict rejection.
Proof 31 steps Qed
Safety covers every represented finite run, including arbitrarily many permitted safepoints, not just the exhibited two-step path to puts.
Explore proof 5 tactics
Initial goal
intros st trace st′ H
induction H ; auto |
intros Hinv
apply IHrun
eapply hi_body_step ; eauto
No remaining goals.
Qed
✓ Proof checked and closed by Rocq.
Source script
Every reached external call meets its obligations, regardless of whether libc has a completed invocation there. No coverage-by-empty-relation claim.
Explore proof 6 tactics
Initial goal
intros m fuel s w trace c s′ w′ site Hpre Hrun Hsite
assert Hinv : hi_body_stateM.Runningc, s′ w′
2 openfocused goal
{eapply hi_body_run ; exact Hrun |
2 opendeferred goal
apply hi_body_entry
2 opendeferred goal
exact Hpre
deferred goal
exact proj2hi_reached_call_admissible_ _ _ _ Hinv Hsite
No remaining goals.
Qed
✓ Proof checked and closed by Rocq.
Source script
A stopped application can only have a declared resource/fuel ending or return zero, under the explicit entry and environment premises.
Explore proof 7 tactics
Initial goal
intros m fuel s w trace why ms w′ Hpre Hrun
assert Hinv : hi_body_stateM.Stoppedwhy ms w′
2 openfocused goal
{eapply hi_body_run ; exact Hrun |
2 opendeferred goal
apply hi_body_entry
2 opendeferred goal
exact Hpre
deferred goal
inversion Hinv
assumption
No remaining goals.
Qed
✓ Proof checked and closed by Rocq.
Source script
Inhabited interpreter boundary checks
These represent the selected contracts, not native libc implementations.
Retain the actual initialized literal and give the fixture its existing libc root.
The fixture supplies the body invariant without assuming call admissibility.
Explore proof 9 tactics
Initial goal
split ; split ; reflexivity |
split
2 openfocused goal
–split ; reflexivity |
2 opendeferred goal
constructor ; | constructor
2 opendeferred goal
split ; simpl ; lia |
2 opendeferred goal
exists 2048, mkRegion2048 2064 Heap Live
2 opendeferred goal
repeat split ; reflexivity
deferred goal
–vm_compute
repeat split ; try reflexivity ; lia
No remaining goals.
Qed
✓ Proof checked and closed by Rocq.
Identity safepoints supply the stability premise for any representation.
Explore proof 2 tactics
Initial goal
intros rep s m s′ m′ w _ →
auto
No remaining goals.
Qed
✓ Proof checked and closed by Rocq.
Source script
EOF may accept any prefix and still lets this exact main return zero.
Proof 36 steps Qed
The actual return-zero run after EOF, parameterized by the accepted bytes.
Every allowed EOF prefix can resume the actual source-shaped main.
Explore proof 4 tactics
Initial goal
intros acc tail Hb
unfold eof_main_returns_zero
apply H.hi_returning_runfixture_rep fixture_requests InterpRuntime.start memory hello_world StreamBytes1 acc 2 ^ 32 − 1 InterpRuntime.start memory hello_world 9
exact eof_invocationacc tail Hb
No remaining goals.
Qed
✓ Proof checked and closed by Rocq.
Source script
Empty acceptance is not mistaken for a successful full write.
Explore proof 2 tactics
Initial goal
apply eof_run_ hello_bytes ++ 10
reflexivity
No remaining goals.
Qed
✓ Proof checked and closed by Rocq.
Source script
Partial acceptance does not change the C source's return value.
Explore proof 2 tactics
Initial goal
apply eof_run_ 108; 108; 111; 10
reflexivity
No remaining goals.
Qed
✓ Proof checked and closed by Rocq.
Source script
EOF after accepting the full string and newline is also permitted.
Explore proof 2 tactics
Initial goal
apply eof_run_ [ ]
reflexivity
No remaining goals.
Qed
✓ Proof checked and closed by Rocq.
Source script
The safety premise is inhabited and the resulting theorem covers all finite runs.
Explore proof 2 tactics
Initial goal
intros trace why ms w′ Hrun
eapply H.hi_finite_safety ; apply interpreter_stdio_stable | exact entry_pre | exact Hrun
No remaining goals.
Qed
✓ Proof checked and closed by Rocq.
Source script
Without registry coverage the machine rejects even though no invoke exists.
Explore proof 3 tactics
Initial goal
eapply H.M.step_rejected with site := hi_site ; apply H.hi_external_site |
constructor
reflexivity
No remaining goals.
Qed
✓ Proof checked and closed by Rocq.
Source script
Freeing the protected fixture root destroys its representation. Such a program free is not a collector-safepoint action; the fixture still requires the root to be live at entry and throughout the puts contract.
Explore proof 11 tactics
Initial goal
split
2 open–intros _ Hreg
2 opendiscriminate
–intros _ Hroots
inversion Hroots as | root rest Hwrite Hrest ; subst
destruct Hwrite as _ base reg Hcap Hreg Hlive Haccess
simpl in Hcap
injection Hcap as ←
simpl in Hreg
injection Hreg as ←
discriminate
No remaining goals.
Qed
✓ Proof checked and closed by Rocq.