|
| 1 | +// SPDX-License-Identifier: PMPL-1.0-or-later |
| 2 | +// Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk> |
| 3 | + |
| 4 | += Proof-Regression Workflow (Tangle's Lean 4 Integration) |
| 5 | +Jonathan Jewell (hyperpolymath) |
| 6 | +:toc: |
| 7 | + |
| 8 | +== Purpose |
| 9 | + |
| 10 | +Tangle is the only repo in the KRL stack with formal proofs integrated |
| 11 | +(Lean 4). This document records the workflow so it can be adopted by |
| 12 | +sibling repos (KnotTheory.jl, Skein.jl, KRLAdapter.jl, quandledb) that |
| 13 | +would benefit from proof-regression testing. |
| 14 | + |
| 15 | +== What "proof-regression" means (per CRG v2) |
| 16 | + |
| 17 | +A test category in the 16-category taxonomy. Definition: tests that verify |
| 18 | +formal proofs *still discharge* after code changes. Not code tests — |
| 19 | +proof tests. If a change breaks a previously-discharged proof, the change |
| 20 | +is blocked. |
| 21 | + |
| 22 | +Estate-wide gap from 2026-04-05 blitz: only tangle has this category. |
| 23 | +The other 4 KRL-stack repos score ✗ or ○. |
| 24 | + |
| 25 | +== Tangle's Lean 4 proof structure |
| 26 | + |
| 27 | +Location: `proofs/` at repo root. |
| 28 | + |
| 29 | +[cols="1,3",options="header"] |
| 30 | +|=== |
| 31 | +|File | Obligations |
| 32 | + |
| 33 | +|`proofs/Progress.lean` | Progress: well-typed terms reduce or are values |
| 34 | +|`proofs/Preservation.lean` | Preservation: reduction preserves type |
| 35 | +|`proofs/Determinism.lean` | Determinism: reduction relation is deterministic |
| 36 | +|=== |
| 37 | + |
| 38 | +(Exact file layout may vary — see `proofs/` directory for current state.) |
| 39 | + |
| 40 | +== The regression mechanism |
| 41 | + |
| 42 | +1. Proofs live as .lean files under `proofs/`. |
| 43 | +2. `lean --build` (or `lake build` if a `lakefile.lean` exists) checks all |
| 44 | + proofs. |
| 45 | +3. CI runs the Lean checker on every PR. |
| 46 | +4. If any proof fails to check, CI fails → PR blocked. |
| 47 | + |
| 48 | +The proof bodies *are* the regression tests. No separate assertions needed. |
| 49 | + |
| 50 | +== Workflow for adopting this in sibling repos |
| 51 | + |
| 52 | +=== Step 1 — Identify a proof candidate |
| 53 | + |
| 54 | +Look for a claim in the codebase that: |
| 55 | +- is stated in a natural-language doc (e.g. an invariant in EXPLAINME.adoc) |
| 56 | +- can be mechanised: expressible in some proof system's type theory |
| 57 | +- would catch a real bug if the proof breaks |
| 58 | + |
| 59 | +Examples for the KRL stack: |
| 60 | + |
| 61 | +- **KRLAdapter.jl**: `mirror` is an involution (sign-wise) — candidate for Idris2 or Lean 4 formalisation. |
| 62 | +- **Skein.jl**: schema migration v3→v4 preserves records (harder; needs a model of SQLite). |
| 63 | +- **KnotTheory.jl**: `simplify_pd` output is isotopic to input — complex, would |
| 64 | + benefit the whole field. |
| 65 | + |
| 66 | +=== Step 2 — Choose proof system |
| 67 | + |
| 68 | +Per hyperpolymath standard: Idris2 (preferred for dependently-typed ABI/FFI |
| 69 | +layer) or Lean 4 (if following tangle's pattern). ATS2 rejected. |
| 70 | + |
| 71 | +For the KRL stack specifically, Idris2 is the main choice given the |
| 72 | +standard Idris2 ABI + Zig FFI architecture. |
| 73 | + |
| 74 | +=== Step 3 — Write the proof |
| 75 | + |
| 76 | +- Translate the claim to a formal statement. |
| 77 | +- Build up lemmas as needed. |
| 78 | +- Discharge using tactics. |
| 79 | + |
| 80 | +=== Step 4 — Wire to CI |
| 81 | + |
| 82 | +Add a CI job that runs `idris2 --check-only` or `lake build` on your proofs |
| 83 | +directory. Fail the build if any proof fails. |
| 84 | + |
| 85 | +=== Step 5 — Document |
| 86 | + |
| 87 | +Update PROOF-NEEDS.md: move the claim from "Would benefit from formal proof" |
| 88 | +to "Currently verified (by Idris2/Lean 4)". |
| 89 | + |
| 90 | +== Current adoption status (2026-04-05) |
| 91 | + |
| 92 | +[cols="2,2,3",options="header"] |
| 93 | +|=== |
| 94 | +|Repo | Proof-regression | Notes |
| 95 | + |
| 96 | +|tangle | ✓ Lean 4 | Progress, preservation, determinism proved |
| 97 | +|KRLAdapter.jl | ✗ | Property tests stand in — see PROOF-NEEDS.md |
| 98 | +|KnotTheory.jl | ○ | PROOF-NEEDS.md exists, no discharged proofs |
| 99 | +|Skein.jl | ✗ | PROOF-NEEDS.md added 2026-04-05 |
| 100 | +|quandledb | ✗ | Has Idris2 ABI Types.idr but no proofs |
| 101 | +|=== |
| 102 | + |
| 103 | +== Why bother |
| 104 | + |
| 105 | +1. **Specification-by-construction.** The proof is the spec. No drift between |
| 106 | + documentation and behaviour. |
| 107 | +2. **Regression-blocker with zero false positives.** If the proof fails, the |
| 108 | + claim fails. No flaky tests. |
| 109 | +3. **Standard-raising for the estate.** CRG v2 taxonomy has proof-regression |
| 110 | + as a distinct test category; adopting it moves repos closer to grade A. |
| 111 | + |
| 112 | +== When not to bother |
| 113 | + |
| 114 | +- The claim is too narrow to justify proof infrastructure (e.g. trivially- |
| 115 | + checked by a 3-line property test). |
| 116 | +- The proof system doesn't have the libraries you need. |
| 117 | +- The cost of writing the proof exceeds the value of catching regressions |
| 118 | + (common for storage/IO layers). |
| 119 | + |
| 120 | +== See also |
| 121 | + |
| 122 | +- Tangle's `proofs/` directory |
| 123 | +- `https://leanprover-community.github.io/` (Lean 4 resources) |
| 124 | +- `https://www.idris-lang.org/` (Idris2 resources) |
| 125 | +- PROOF-NEEDS.md in sibling repos |
0 commit comments