|
1 | 1 | # elicit_proofs |
2 | 2 |
|
3 | | -Formal verification proof harnesses for the [elicitation] MCP server ecosystem. |
4 | | -Contains generated and manual proof harnesses for [Kani], [Verus], and [Creusot], |
5 | | -verifying the state-machine transitions in [`elicit_server`]. |
| 3 | +> **Auto-generated** — do not edit by hand. |
| 4 | +> Regenerate with `elicitation generate proof-crate`. |
6 | 5 |
|
7 | | -## What's in this crate |
| 6 | +Kani, Creusot, and Verus proof harnesses for [`elicit_server`], |
| 7 | +produced by [elicitation](https://crates.io/crates/elicitation). |
8 | 8 |
|
9 | | -| Module | Contents | |
10 | | -|---|---| |
11 | | -| `kani/generated/` | Auto-generated `proof_for_contract` harnesses — one per VSM transition | |
12 | | -| `kani/composition.rs` | Manual two-step composition proofs (leaf × stub) | |
13 | | -| `kani/diag.rs` | Diagnostic harnesses for troubleshooting individual transitions | |
14 | | -| `kani/gallery/` | Numbered gallery of verification patterns and known results | |
15 | | -| `kani/suite.rs` | Framework correctness tests for `KaniCompose` | |
16 | | -| `creusot/generated/` | Auto-generated Creusot companion proofs | |
17 | | -| `verus/generated/` | Auto-generated Verus companion proofs | |
| 9 | +## Verifiers |
18 | 10 |
|
19 | | -## Generating proofs |
| 11 | +| Backend | Feature flag | Run command | |
| 12 | +|----------|-------------|-----------------------------------| |
| 13 | +| Kani | `kani` | `cargo kani` | |
| 14 | +| Creusot | `creusot` | `cargo creusot prove` | |
| 15 | +| Verus | `verus` | `verus src/lib.rs` | |
20 | 16 |
|
21 | | -After changing VSM source files in `elicit_server`, regenerate all three backends at once: |
| 17 | +## Regenerating |
22 | 18 |
|
23 | 19 | ```sh |
24 | | -elicitation generate all \ |
25 | | - --crate-path crates/elicit_server/src/archive/vsm \ |
26 | | - --out crates/elicit_proofs/src |
| 20 | +elicitation generate proof-crate \ |
| 21 | + --crate-path <path-to-elicit_server> \ |
| 22 | + --crate-name elicit_proofs \ |
| 23 | + --out <path-to-this-crate> |
27 | 24 | ``` |
28 | | - |
29 | | -Or individually: |
30 | | - |
31 | | -```sh |
32 | | -elicitation generate kani --crate-path crates/elicit_server/src/archive/vsm \ |
33 | | - --out crates/elicit_proofs/src/kani/generated |
34 | | -elicitation generate creusot --crate-path crates/elicit_server/src/archive/vsm \ |
35 | | - --out crates/elicit_proofs/src/creusot/generated |
36 | | -elicitation generate verus --crate-path crates/elicit_server/src/archive/vsm \ |
37 | | - --out crates/elicit_proofs/src/verus/generated |
38 | | -``` |
39 | | - |
40 | | -## Running proofs |
41 | | - |
42 | | -Configure backends in `.env` at the workspace root (see `.env` for all options), |
43 | | -then run with `elicitation prove`: |
44 | | - |
45 | | -```sh |
46 | | -# All backends |
47 | | -elicitation prove --kani --verus --creusot |
48 | | - |
49 | | -# Single backend |
50 | | -elicitation prove --kani |
51 | | -elicitation prove --verus |
52 | | -elicitation prove --creusot |
53 | | - |
54 | | -# Target a specific Kani harness |
55 | | -elicitation prove --kani --kani-harness my_harness |
56 | | - |
57 | | -# Record results to CSV and resume interrupted runs |
58 | | -elicitation prove --kani --csv --resume |
59 | | -``` |
60 | | - |
61 | | -Key `.env` settings: |
62 | | - |
63 | | -```sh |
64 | | -KANI_PACKAGE=elicit_proofs |
65 | | -KANI_FLAGS="--lib --features kani -Z function-contracts -Z stubbing" |
66 | | -CREUSOT_PACKAGE=elicit_proofs |
67 | | -VERUS_PATH=~/repos/verus/... # Path to Verus binary |
68 | | -VERUS_FILE=crates/elicitation_verus/src/lib.rs |
69 | | -``` |
70 | | - |
71 | | -`elicit_proofs` is the target for the generated Kani and Creusot proof code. |
72 | | -Verus does not run cleanly from the combined proofs crate, so `elicitation prove |
73 | | ---verus` should point at the dedicated `elicitation_verus` crate instead. |
74 | | - |
75 | | -## Induction strategy for String |
76 | | - |
77 | | -Proofs involving `String` fields use depth-based induction via [`KaniCompose`]: |
78 | | -`kani_depth1()` returns a one-character symbolic string (`kani::any::<char>().to_string()`), |
79 | | -ensuring non-emptiness invariants are genuinely checked rather than vacuously skipped. |
80 | | - |
81 | | -## Dependencies |
82 | | - |
83 | | -```toml |
84 | | -[dependencies] |
85 | | -elicit_proofs = "0.11" |
86 | | -``` |
87 | | - |
88 | | -[elicitation]: https://crates.io/crates/elicitation |
89 | | -[`elicit_server`]: https://crates.io/crates/elicit_server |
90 | | -[`KaniCompose`]: https://docs.rs/elicitation/latest/elicitation/trait.KaniCompose.html |
91 | | -[Kani]: https://model-checking.github.io/kani/ |
92 | | -[Verus]: https://verus-lang.github.io/verus/ |
93 | | -[Creusot]: https://github.com/creusot-rs/creusot |
0 commit comments