|
| 1 | +-- SPDX-License-Identifier: PMPL-1.0-or-later |
| 2 | +-- Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk> |
| 3 | +-- |
| 4 | +-- Choreography.idr — L16 Agent choreography composition for typed-wasm ABI |
| 5 | +-- |
| 6 | +-- L16 composes three already-proven lower levels: |
| 7 | +-- * L13 Module isolation (ModuleIsolation.idr) |
| 8 | +-- * L14 Session protocols (SessionProtocol.idr) |
| 9 | +-- * L15 Resource capabilities (ResourceCapabilities.idr) |
| 10 | +-- |
| 11 | +-- The point of this module is NOT to re-prove those levels. Instead, L16 |
| 12 | +-- packages one proof witness per role and lifts that bundle to choreography- |
| 13 | +-- level soundness for legal traces. |
| 14 | +-- |
| 15 | +-- NO `believe_me`, NO `postulate`, NO `assert_total`, NO `Admitted`. |
| 16 | +-- `%default total`. |
| 17 | + |
| 18 | +module TypedWasm.ABI.Choreography |
| 19 | + |
| 20 | +import Data.List |
| 21 | +import Data.List.Elem |
| 22 | + |
| 23 | +import TypedWasm.ABI.ModuleIsolation |
| 24 | +import TypedWasm.ABI.SessionProtocol |
| 25 | +import TypedWasm.ABI.ResourceCapabilities |
| 26 | + |
| 27 | +%default total |
| 28 | + |
| 29 | +-- ============================================================================ |
| 30 | +-- L16 Surface Core |
| 31 | +-- ============================================================================ |
| 32 | + |
| 33 | +||| Nominal role identifier in a choreography. |
| 34 | +public export |
| 35 | +record AgentRole where |
| 36 | + constructor MkAgentRole |
| 37 | + roleName : String |
| 38 | + |
| 39 | +public export |
| 40 | +Eq AgentRole where |
| 41 | + (MkAgentRole a) == (MkAgentRole b) = a == b |
| 42 | + |
| 43 | +||| Typed message edge: sender role, receiver role, payload type. |
| 44 | +||| The constructor carries only a label; the payload type is tracked at type |
| 45 | +||| level so message declarations remain typed without forcing value-level |
| 46 | +||| payload terms into the choreography definition. |
| 47 | +public export |
| 48 | +data Message : (from : AgentRole) -> (to : AgentRole) -> (payload : Type) -> Type where |
| 49 | + MkMessage : (label : String) -> Message from to payload |
| 50 | + |
| 51 | +||| Existential packaging for heterogeneous message payload types. |
| 52 | +public export |
| 53 | +record MessageDecl where |
| 54 | + constructor MkMessageDecl |
| 55 | + fromRole : AgentRole |
| 56 | + toRole : AgentRole |
| 57 | + payloadTy : Type |
| 58 | + msg : Message fromRole toRole payloadTy |
| 59 | + |
| 60 | +-- ============================================================================ |
| 61 | +-- Per-role realisation and lower-level composition witness |
| 62 | +-- ============================================================================ |
| 63 | + |
| 64 | +||| One role's concrete lower-level realisation. |
| 65 | +||| |
| 66 | +||| `roleFunctionCaps` is a capability budget witness for the role's runtime |
| 67 | +||| entrypoint in `moduleCaps`. L15 containment for this role is obtained by |
| 68 | +||| citing `l15bSoundness`. |
| 69 | +public export |
| 70 | +record RoleRealisation where |
| 71 | + constructor MkRoleRealisation |
| 72 | + role : AgentRole |
| 73 | + isolatedModule : IsolatedModule |
| 74 | + sessionProtocol : Protocol |
| 75 | + sessionWellFormed : WellFormedProtocol sessionProtocol |
| 76 | + moduleCaps : ModuleCaps |
| 77 | + roleFunctionCaps : FunctionCaps moduleCaps |
| 78 | + |
| 79 | +||| Per-role bundle of lower-level proof obligations (L13 + L14 + L15). |
| 80 | +public export |
| 81 | +record RoleRealisationWellFormed (r : RoleRealisation) where |
| 82 | + constructor MkRoleRealisationWellFormed |
| 83 | + l13Isolation : WellFormedBoundaries r.isolatedModule.modId r.isolatedModule.boundaries |
| 84 | + l14SessionLinearity : WellFormedProtocol r.sessionProtocol |
| 85 | + l15CapsContainment : ContainedIn r.roleFunctionCaps.required (declared r.moduleCaps) |
| 86 | + |
| 87 | +||| Build the per-role witness by CITING lower-level results: |
| 88 | +||| * L13: `isolatedModule.wellFormed` |
| 89 | +||| * L14: `sessionWellFormed` |
| 90 | +||| * L15: `l15bSoundness roleFunctionCaps` |
| 91 | +public export |
| 92 | +roleWitness : (r : RoleRealisation) -> RoleRealisationWellFormed r |
| 93 | +roleWitness r = |
| 94 | + MkRoleRealisationWellFormed |
| 95 | + r.isolatedModule.wellFormed |
| 96 | + r.sessionWellFormed |
| 97 | + (l15bSoundness r.roleFunctionCaps) |
| 98 | + |
| 99 | +||| List-level composition witness: every role in the choreography carries a |
| 100 | +||| lower-level well-formedness witness. |
| 101 | +public export |
| 102 | +data AllRolesWellFormed : List RoleRealisation -> Type where |
| 103 | + AllWFNil : AllRolesWellFormed [] |
| 104 | + AllWFCons : {r : RoleRealisation} |
| 105 | + -> {rest : List RoleRealisation} |
| 106 | + -> RoleRealisationWellFormed r |
| 107 | + -> AllRolesWellFormed rest |
| 108 | + -> AllRolesWellFormed (r :: rest) |
| 109 | + |
| 110 | +||| Convenience constructor: derive the list-level witness directly from the |
| 111 | +||| role realisation list by reusing `roleWitness` for each role. |
| 112 | +public export |
| 113 | +deriveRoleWitnesses : (rs : List RoleRealisation) -> AllRolesWellFormed rs |
| 114 | +deriveRoleWitnesses [] = AllWFNil |
| 115 | +deriveRoleWitnesses (r :: rest) = |
| 116 | + AllWFCons (roleWitness r) (deriveRoleWitnesses rest) |
| 117 | + |
| 118 | +-- ============================================================================ |
| 119 | +-- Choreography object |
| 120 | +-- ============================================================================ |
| 121 | + |
| 122 | +||| L16 choreography declaration payload: |
| 123 | +||| * role list |
| 124 | +||| * typed message list |
| 125 | +||| * composition witness bundling L13/L14/L15 obligations per role |
| 126 | +public export |
| 127 | +record Choreography where |
| 128 | + constructor MkChoreography |
| 129 | + roles : List AgentRole |
| 130 | + messages : List MessageDecl |
| 131 | + realisations : List RoleRealisation |
| 132 | + compositionWitness : AllRolesWellFormed realisations |
| 133 | + |
| 134 | +-- ============================================================================ |
| 135 | +-- Legal traces |
| 136 | +-- ============================================================================ |
| 137 | + |
| 138 | +public export |
| 139 | +data TraceStep : Type where |
| 140 | + TraceMessage : MessageDecl -> TraceStep |
| 141 | + |
| 142 | +public export |
| 143 | +Trace : Type |
| 144 | +Trace = List TraceStep |
| 145 | + |
| 146 | +||| A legal trace is a sequence of declared choreography messages. |
| 147 | +public export |
| 148 | +data LegalTrace : (c : Choreography) -> Trace -> Type where |
| 149 | + LegalTraceNil : LegalTrace c [] |
| 150 | + LegalTraceCons : {msg : MessageDecl} |
| 151 | + -> (declared : Elem msg c.messages) |
| 152 | + -> LegalTrace c rest |
| 153 | + -> LegalTrace c (TraceMessage msg :: rest) |
| 154 | + |
| 155 | +-- ============================================================================ |
| 156 | +-- Choreography soundness (composition-only) |
| 157 | +-- ============================================================================ |
| 158 | + |
| 159 | +||| Extracted L13 obligations for all roles. |
| 160 | +public export |
| 161 | +data AllIsolation : List RoleRealisation -> Type where |
| 162 | + IsolationNil : AllIsolation [] |
| 163 | + IsolationCons : {r : RoleRealisation} |
| 164 | + -> {rest : List RoleRealisation} |
| 165 | + -> WellFormedBoundaries r.isolatedModule.modId r.isolatedModule.boundaries |
| 166 | + -> AllIsolation rest |
| 167 | + -> AllIsolation (r :: rest) |
| 168 | + |
| 169 | +||| Extracted L14 obligations for all roles. |
| 170 | +public export |
| 171 | +data AllSessionLinearity : List RoleRealisation -> Type where |
| 172 | + SessionNil : AllSessionLinearity [] |
| 173 | + SessionCons : {r : RoleRealisation} |
| 174 | + -> {rest : List RoleRealisation} |
| 175 | + -> WellFormedProtocol r.sessionProtocol |
| 176 | + -> AllSessionLinearity rest |
| 177 | + -> AllSessionLinearity (r :: rest) |
| 178 | + |
| 179 | +||| Extracted L15 obligations for all roles. |
| 180 | +public export |
| 181 | +data AllCapabilityContainment : List RoleRealisation -> Type where |
| 182 | + CapabilityNil : AllCapabilityContainment [] |
| 183 | + CapabilityCons : {r : RoleRealisation} |
| 184 | + -> {rest : List RoleRealisation} |
| 185 | + -> ContainedIn r.roleFunctionCaps.required (declared r.moduleCaps) |
| 186 | + -> AllCapabilityContainment rest |
| 187 | + -> AllCapabilityContainment (r :: rest) |
| 188 | + |
| 189 | +||| Build choreography-wide L13 obligations from the composition witness. |
| 190 | +public export |
| 191 | +collectIsolation : (rs : List RoleRealisation) |
| 192 | + -> AllRolesWellFormed rs |
| 193 | + -> AllIsolation rs |
| 194 | +collectIsolation [] AllWFNil = IsolationNil |
| 195 | +collectIsolation (_ :: rest) (AllWFCons wf restWf) = |
| 196 | + IsolationCons wf.l13Isolation (collectIsolation rest restWf) |
| 197 | + |
| 198 | +||| Build choreography-wide L14 obligations from the composition witness. |
| 199 | +public export |
| 200 | +collectSessionLinearity : (rs : List RoleRealisation) |
| 201 | + -> AllRolesWellFormed rs |
| 202 | + -> AllSessionLinearity rs |
| 203 | +collectSessionLinearity [] AllWFNil = SessionNil |
| 204 | +collectSessionLinearity (_ :: rest) (AllWFCons wf restWf) = |
| 205 | + SessionCons wf.l14SessionLinearity (collectSessionLinearity rest restWf) |
| 206 | + |
| 207 | +||| Build choreography-wide L15 obligations from the composition witness. |
| 208 | +public export |
| 209 | +collectCapabilityContainment : (rs : List RoleRealisation) |
| 210 | + -> AllRolesWellFormed rs |
| 211 | + -> AllCapabilityContainment rs |
| 212 | +collectCapabilityContainment [] AllWFNil = CapabilityNil |
| 213 | +collectCapabilityContainment (_ :: rest) (AllWFCons wf restWf) = |
| 214 | + CapabilityCons wf.l15CapsContainment (collectCapabilityContainment rest restWf) |
| 215 | + |
| 216 | +||| L16 soundness payload: |
| 217 | +||| for a legal choreography trace, L13 isolation, L14 session linearity, |
| 218 | +||| and L15 capability containment all hold role-wise. |
| 219 | +public export |
| 220 | +record ChoreographySoundness (c : Choreography) where |
| 221 | + constructor MkChoreographySoundness |
| 222 | + l13Holds : AllIsolation c.realisations |
| 223 | + l14Holds : AllSessionLinearity c.realisations |
| 224 | + l15Holds : AllCapabilityContainment c.realisations |
| 225 | + |
| 226 | +||| Main L16 theorem (composition-only): |
| 227 | +||| For every legal trace of a choreography, the lower-level obligations hold. |
| 228 | +||| The proof is by extraction from `compositionWitness`; no lower-level |
| 229 | +||| theorem is re-proven here. |
| 230 | +public export |
| 231 | +traceSoundness : (c : Choreography) |
| 232 | + -> (tr : Trace) |
| 233 | + -> LegalTrace c tr |
| 234 | + -> ChoreographySoundness c |
| 235 | +traceSoundness c tr legal = |
| 236 | + let _ = tr in |
| 237 | + let _ = legal in |
| 238 | + MkChoreographySoundness |
| 239 | + (collectIsolation c.realisations c.compositionWitness) |
| 240 | + (collectSessionLinearity c.realisations c.compositionWitness) |
| 241 | + (collectCapabilityContainment c.realisations c.compositionWitness) |
0 commit comments