Skip to content

feat: variant for up-to-bad call/proc tactics#1055

Draft
loutr wants to merge 2 commits into
EasyCrypt:mainfrom
loutr:main
Draft

feat: variant for up-to-bad call/proc tactics#1055
loutr wants to merge 2 commits into
EasyCrypt:mainfrom
loutr:main

Conversation

@loutr

@loutr loutr commented Jun 19, 2026

Copy link
Copy Markdown
Contributor

The premise:

∀O. is_lossless O => is_lossless A(O)         (1)

of the current up-to-bad tactics happens to be too restrictive in some cases. At first glance, it seems that it would be possible to allow another variant of the tactic that instead requires

is_lossless A(O_1) ∧ is_lossless A(O_2)       (2)

(possibly as two differents subgoals), which can be proved in some concrete instances of A, O_1, O_2, while (1) is not.

Simply introducing a variant of the tactic that replaces (1) with (2) is not satisfactory and is not ensured to be sound.

This is because commit 6534f3d (yes, some archeology was required) changed the premises of this tactic, which implicitly changes the proof of soundness of the tactic.

In order to have a sound variant of the tactic, this PR provides a way to use a different set of premises, which restores the original conditions required for applying up-to-bad tactics, as well as changes condition (1) with (2) (which is the original goal).

Some issues still need to be addressed w.r.t. parsing. Introducing a variant syntax in the spirit of call @[weaker_pre] causes shift/reduce conflicts.

loutr and others added 2 commits June 18, 2026 17:17
The premise:

    ∀O. is_lossless O => is_lossless A(O)         (1)

of the current up-to-bad tactics happens to be too restrictive in some
cases. At first glance, it seems that it would be possible to allow
another variant of the tactic that instead requires

    is_lossless A(O_1) ∧ is_lossless A(O_2)       (2)

(possibly as two differents subgoals), which can be proved in some
concrete instances of A, O_1, O_2, while (1) is not.

Simply introducing a variant of the tactic that replaces (1) with (2) is
not satisfactory and is not ensured to be sound.

This is because commit 6534f3d (yes,
some archeology was required) changed the premises of this tactic, which
implicitly changes the proof of soundness of the tactic.

In order to have a sound variant of the tactic, this PR provides a
way to use a different set of premises, which restores the original
conditions required for applying up-to-bad tactics, as well as changes
condition (1) with (2) (which is the original goal).

Some issues still need to be addressed w.r.t. parsing. Introducing a
variant syntax in the spirit of `call @[weaker_pre]` causes shift/reduce
conflicts.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants