Verified
High-level combinators for writing kernel-checked implementations.
Write programs with these combinators, then call v.verify to
type-check and extract a Nix function that is correct by construction.
Example
# Verified successor: Nat → Nat
v.verify (H.forall "x" H.nat (_: H.nat))
(v.fn "x" H.nat (x: H.succ x))
# → Nix function: n → n + 1
Literals
nat : Int → Hoas— natural number literal (S^n(zero))str : String → Hoas— string literalint_ : Int → Hoas— integer literalfloat_ : Float → Hoas— float literaltrue_,false_— boolean literalsnull_— unit value (tt)
Binding
fn : String → Hoas → (Hoas → Hoas) → Hoas— lambda abstractionlet_ : String → Hoas → Hoas → (Hoas → Hoas) → Hoas— let binding
Data Operations
pair,fst,snd— Σ-type construction and projectionfield : Hoas → String → Hoas → Hoas— record field projection by nameinl,inr— Sum injectionapp— function application
Eliminators (Constant Motive)
These auto-generate the motive λ_.resultTy, so you only supply
the result type and the branches:
if_ : Hoas → Hoas → { then_; else_; } → Hoas— Bool eliminationmatch : Hoas → Hoas → { zero; succ : k → ih → Hoas; } → Hoas— Nat eliminationmatchList : Hoas → Hoas → Hoas → { nil; cons : h → t → ih → Hoas; } → Hoas— List eliminationmatchSum : Hoas → Hoas → Hoas → Hoas → { left; right; } → Hoas— Sum elimination
Derived Combinators
map : Hoas → Hoas → Hoas → Hoas → Hoas— map f over a listfold : Hoas → Hoas → Hoas → Hoas → Hoas → Hoas— fold over a listfilter : Hoas → Hoas → Hoas → Hoas— filter a list by predicate
Pipeline
verify : Hoas → Hoas → NixValue— type-check + eval + extract