Skip to content

Add static-python spec verifying core Raft consensus invariants - #21

Open
adsharma wants to merge 1 commit into
masterfrom
verify/raft-core-lean
Open

Add static-python spec verifying core Raft consensus invariants#21
adsharma wants to merge 1 commit into
masterfrom
verify/raft-core-lean

Conversation

@adsharma

@adsharma adsharma commented Aug 6, 2026

Copy link
Copy Markdown
Owner

Related: py2many/py2many#825

Transpile-and-verify spec of the safety-critical Raft decision logic using the static-python subset (CHECKER.pre/post/invariant, @lemma/@by). Proofs checked by py2many --lean + lake build (exit 0 == all pre/post/invariants/lemmas proved):

  • ConsensusState class invariant (non-negative term/commit/last-log, commitIndex <= lastLogIndex) re-discharged by omega on every mutation
  • Election restriction (Voter.on_vote_request): is_up_to_date / grant_vote
  • Quorum intersection: general omega lemmas quorums_overlap and strict_majority_exceeds_half
  • Log Matching guard (Follower.on_append_entries): log_matching_ok / logs_match
  • Commit-advance rule (Leader.on_response_received): can_commit / commit_advance_rule
  • clamp_commit (Follower._update_commit_index)
  • 6 concrete native_decide behavioral lemmas

Adds docs/theorem_prover.md with reproduction steps and gotchas.

…Lean

Transpile-and-verify spec of the safety-critical Raft decision logic using the
static-python subset (CHECKER.pre/post/invariant, @lemma/@by). Proofs checked
by py2many --lean + lake build (exit 0 == all pre/post/invariants/lemmas proved):

- ConsensusState class invariant (non-negative term/commit/last-log,
  commitIndex <= lastLogIndex) re-discharged by omega on every mutation
- Election restriction (Voter.on_vote_request): is_up_to_date / grant_vote
- Quorum intersection: general omega lemmas quorums_overlap and
  strict_majority_exceeds_half
- Log Matching guard (Follower.on_append_entries): log_matching_ok / logs_match
- Commit-advance rule (Leader.on_response_received): can_commit / commit_advance_rule
- clamp_commit (Follower._update_commit_index)
- 6 concrete native_decide behavioral lemmas

Adds static/README.md with reproduction steps and gotchas.
@adsharma
adsharma force-pushed the verify/raft-core-lean branch from 6123c7b to e359e25 Compare August 6, 2026 21:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant