Topic · Spec to obligations

How do I turn a written spec into obligations I can check against the code?

Gist

A PDF shall is not an obligation. proof validate --preflight compiles the sentence or it does not. Then Kind2 is asked whether the set is even possible. proof audit --fail-level warn fails the merge when the compiled obligation has no witness. TLA+ and Dafny still win at arbitrary specs. Jama still authors the programme.

proof validate --preflight

The language of the shall lives on the FRETish page. The wire to a function lives on spec-to-source. This page is the compile step in between.

Request demo The PDF vs the obligation

01 · A sentence is not a check

The shall has to compile before anyone can fail the merge on it.

"The worker pool stays bounded" is a sentence people will sign. It does not say which helper, which bound, or what happens at 0. The compiler has to be given those slots.

How you write the sentence lives on FRETish. How you hang a lemma on a function lives on spec to source. How you ask Z3 about one helper lives on Z3 / Kind2. This page is the remaining question: the written spec has to become something the build can reject.

Three commands, in order. proof validate --preflight accepts the FRETish sentence or it does not. proof realize specs/system ./... --diagnose asks Kind2 whether the compiled set is realizable. proof audit --fail-level warn is the job that remains: exit 1 if a check fails, exit 2 if warnings remain when fail-level is warn.

id: SYS-REQ-041
statement: >
  The worker pool shall always clamp requested workers
  to the closed interval 1 to 20.
component: evaluation
priority: shall
response: clamp requested workers to 1..20

proof validate --preflight
proof realize specs/system ./... --diagnose
proof audit --fail-level warn

If the sentence is missing a slot, preflight fails before Kind2 runs. If two shalls contradict, Kind2 returns a counterexample for the class. If the compiled obligation has no witness on this branch, the audit fails the merge. A signed PDF next to the repo does none of that unless you re-compile it.

02 · The exhibit

Same bound. Two places it can live.

A paragraph in last quarter's spec can stay signed while this helper changes. Click the tabs.

The PDF

Where Last-quarter programme, signed
This push not asked

Looks approved

The helper

The clamp moved. The paragraph did not re-compile.

Unbound

The PDF

Still in docs/. Still last quarter.

File exists

Proof

Compile validate --preflight on the shall
Ask realize --diagnose on the set

Merge blocked if it fails

Same bound. Two places. Click the tabs.

Who	What they compile	What they lose
Jama / DOORS	Requirement IDs to other IDs	The cell is not a Kind2 obligation. Jama still authors the programme.
Dafny / SPARK	The spec is the language the compiler checks	They still win there. Proof sentences are not that stack.
TLA+ / Alloy	A model of the system	The model is not this helper unless you re-bind it.
Cucumber / SpecFlow	Gherkin examples	An example is a sample. Kind2 asks about the class.
Proof	FRETish shall to Kind2, then audit on the witness	288 templates. Not Dafny. Not TLA+ for sagas.

If the job is "prove this Ada or Dafny module in its own language," keep SPARK or Dafny. If the job is "this signed English still compiles, and Kind2 still accepts the set," the shall has to live in the repo and the compile has to run on this push. Proof does not invent the shall. It fails when the signed one does not compile, or when the compiled set is not realizable.

03 · The honest loss

This is not Dafny, and it is not TLA+.

Compiled means the 288 templates we ship. It does not mean an arbitrary formula in another language.

We have not run Proof and Dafny, or Proof and TLA+, on the same frozen corpus. SPARK, Frama-C, and CBMC still win on Ada and C. Dafny still wins when the spec is the source. Alloy and TLA+ still win on models that are not this function. Kind2 is not TLA+ for sagas. Jama still wins at programme authoring. FRETish does not cover nested sequencing. Someone still has to approve the shalls on one component.

The language of the shall stays on FRETish. The wire to a function stays on spec to source. The solver question stays on Z3 / Kind2. The CI gate of an executable requirement stays on executable requirements.

Request demo How the install is bought

04 · Nearby questions

What people type next.

How do I write FRETish requirements a compiler can check? The language. FRETish.

How do I connect a formal specification to my actual source code? The binding. Spec to source.

How do I prove a specific function meets its specification using something like Z3 or Kind2? The solver. Z3 / Kind2.

How do I make requirements executable so they're checked automatically? The CI gate. Executable requirements.