vstd 0.0.0-2026-06-14-0213

Verus Standard Library: Useful specifications and lemmas for verifying Rust code
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93

use super::super::prelude::*;
use super::algebra::ResourceAlgebra;
use super::exclusive::ExclusiveRA;
#[cfg(verus_keep_ghost)]
use super::option::lemma_incl_opt_rev;
use super::pcm::PCM;
#[cfg(verus_keep_ghost)]
use super::relations::incl;
#[cfg(verus_keep_ghost)]
use super::relations::lemma_incl_transitive;

verus! {

pub struct AuthRA<RA: ResourceAlgebra> {
    pub auth: Option<ExclusiveRA<RA>>,
    pub frac: RA,
}

proof fn lemma_incl_valid<RA: ResourceAlgebra>(a: RA, b: RA)
    requires
        incl(a, b),
        b.valid(),
    ensures
        a.valid(),
{
    let c = choose|c| RA::op(a, c) == b;
    RA::valid_op(a, c);
}

impl<RA: ResourceAlgebra> ResourceAlgebra for AuthRA<RA> {
    open spec fn valid(self) -> bool {
        match self.auth {
            None => self.frac.valid(),
            Some(ExclusiveRA::Exclusive(a)) => a.valid() && incl(self.frac, a),
            Some(ExclusiveRA::Invalid) => false,
        }
    }

    open spec fn op(a: Self, b: Self) -> Self {
        let auth = Option::<ExclusiveRA::<RA>>::op(a.auth, b.auth);
        let frac = RA::op(a.frac, b.frac);
        AuthRA { auth, frac }
    }

    proof fn associative(a: Self, b: Self, c: Self) {
        Option::<ExclusiveRA::<RA>>::associative(a.auth, b.auth, c.auth);
        RA::associative(a.frac, b.frac, c.frac);
    }

    proof fn commutative(a: Self, b: Self) {
        Option::<ExclusiveRA::<RA>>::commutative(a.auth, b.auth);
        RA::commutative(a.frac, b.frac);
    }

    proof fn valid_op(a: Self, b: Self) {
        let op = Self::op(a, b);
        match op.auth {
            None => {
                RA::valid_op(a.frac, b.frac);
            },
            Some(auth) => {
                lemma_incl_valid(op.frac, auth->Exclusive_0);

                RA::valid_op(a.frac, b.frac);
                Option::<ExclusiveRA::<RA>>::valid_op(a.auth, b.auth);
                if a.auth is Some {
                    lemma_incl_opt_rev(a.auth->Some_0, auth);
                    if a.auth->Some_0 == auth {
                        lemma_incl_transitive(a.frac, op.frac, a.auth->Some_0->Exclusive_0);
                    }
                }
            },
        }
    }
}

impl<P: PCM> PCM for AuthRA<P> {
    open spec fn unit() -> Self {
        AuthRA { auth: None, frac: P::unit() }
    }

    proof fn op_unit(self) {
        Option::<ExclusiveRA::<P>>::op_unit(self.auth);
        P::op_unit(self.frac);
    }

    proof fn unit_valid() {
        Option::<ExclusiveRA::<P>>::unit_valid();
        P::unit_valid();
    }
}

} // verus!