Proof. Request demo

Topic · Spec to source

How do I connect a formal specification to my actual source code?

Hang a Z3 lemma on the function and name that function from the shall. Then proof audit --fail-level warn fails the merge when the binding is stale. Dafny and SPARK still win when the spec is the language. Jama still authors the programme.

proof audit --fail-level warn

The solver question lives on the Z3 page. The matrix question lives on the RTM page. This page is the wire between them.

Request demo The model vs this function

01 · A model is not a binding

The spec has to name the function you merge, not a file next to it.

A TLA+ module can be true of a system that no longer matches this branch. The lemma has to sit on the helper.

How you write the shall lives on FRETish. How you ask Z3 about one function lives on Z3 / Kind2. How you keep IDs in a matrix lives on the traceability matrix. This page is the remaining question: the formal object has to point at the source that ships.

Two artefacts, both in the repo. The shall carries traces.implemented_by to the function. The function carries // reqproof:lemma. proof verify-lemma translates that lemma into SMT-LIB and asks Z3. UNSAT is PROVED for every parameter assignment the types allow. proof audit --fail-level warn is the job that remains: exit 1 if the check fails, exit 2 if warnings remain when fail-level is warn.

// reqproof:lemma bounded_worker_count_range func(n int) bool {
//   return boundedWorkerCount(n) >= 1 && boundedWorkerCount(n) <= 20
// }
func boundedWorkerCount(n int) int {
    if n < 1 { return 1 }
    if n > 20 { return 20 }
    return n
}
traces:
  implemented_by:
    - ./internal/governance/evaluation:boundedWorkerCount

proof verify-lemma ./internal/governance/evaluation
proof audit --fail-level warn

If the helper stops clamping, the lemma is no longer UNSAT and the merge fails. If the shall still points at a path that moved, the audit fails the stale binding. A model in another language does not do that unless you re-run it against this body.

02 · The exhibit

Same bound. Two places it can live.

A model next to the repo can stay true while this function changes. Click the tabs.

The model

  • Where TLA+ / Alloy / a Dafny file beside the tree
  • This push not asked
Looks proved

The function

The clamp moved. The model did not re-read it.

Unbound

The model

Still in docs/. Still last quarter.

File exists

Proof

  • Lemma // reqproof:lemma on boundedWorkerCount
  • Trace implemented_by names that symbol
Merge blocked if it fails

Same bound. Two places. Click the tabs.

Who What they connect What they lose
Jama / DOORS Requirement IDs to other IDs The cell is not this function. Jama still authors the programme.
Dafny / SPARK The spec is the language the compiler checks They still win there. Proof lemmas are not that stack.
Alloy / TLA+ A model of the system The model is not the helper you merge this week unless you re-bind it.
Frama-C / ACSL Annotations on C They still win on C. Proof lemmas are not that analyzer.
Proof Lemma on the function plus implemented_by on the shall Not Dafny. Not SPARK. Kind2 is not TLA+ for sagas.

If the job is "prove this Ada or Dafny module in its own language," keep SPARK or Dafny. If the job is "this Go helper still clamps, and the shall still names it," the lemma has to live on the helper and the trace has to survive the next rename. Proof does not invent the shall. It fails when the signed one has no witness, or when the lemma is not UNSAT.

03 · The honest loss

This is not Dafny, and it is not SPARK.

PROVED means the lemma you wrote, on the types we model. It does not mean the component is the model in another language.

We have not run Proof and Dafny, or Proof and SPARK, on the same frozen corpus. SPARK, Frama-C, and CBMC still win on Ada and C. Dafny still wins when the spec is the source. Alloy and TLA+ still win on models that are not this function. Kind2 is not TLA+ for sagas. Jama still wins at programme authoring. Expression lemmas do not model uint256 wraparound. Someone still has to approve the shalls on one component.

The solver question stays on Z3 / Kind2. The language of the shall stays on FRETish. The matrix stays on requirements traceability. The engagement that names formal verification stays on formal verification as a service.

Request demo How the install is bought

04 · Nearby questions

What people type next.

How do I prove a specific function meets its specification using something like Z3 or Kind2? You run the solver. Z3 / Kind2.

How do I write machine-checkable requirements for my software? The language. FRETish.

What is a requirements traceability matrix, and how do I keep it true? The IDs. Traceability matrix.

Is there a service that does formal verification of a component for me? The engagement. Formal verification as a service.