-
Notifications
You must be signed in to change notification settings - Fork 2
[#14953] feat: remove deprecated in-kernel native reduction #27
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
df340c3
32522e6
6a32a59
fb57dfe
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -110,7 +110,7 @@ This command prints the set of axioms used by the theorem and the theorems it de | |
| The three axioms above are standard axioms of Lean's logic, and benign. | ||
|
|
||
| * If {name}`sorryAx` is reported, then this theorem or one of its dependencies uses {lean}`sorry` or is otherwise incomplete. | ||
| * If {name}`Lean.trustCompiler` is reported, then native evaluation is used; see below for a discussion. | ||
| * If an axiom generated by native evaluation is reported, then compiled code is trusted as part of the proof; see below for a discussion. | ||
|
Member
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. We should probably describe here what such axioms look like? There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. At the very least, we should have a bit about precisely how the axiom connects to the compiled code.
Member
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. @nomeata Do you want to suggest something here? |
||
| * Any other axiom means that a custom axiom was declared and used, and the theorem is only valid relative to the soundness of these axioms. | ||
|
|
||
| ## Trust | ||
|
|
@@ -227,11 +227,11 @@ This is used by the {tactic}`decide`{keywordOf Lean.Parser.Tactic.decide}` +nati | |
| Specific uses wrapped in {tech}[honest] tactics (e.g. {tactic}`bv_decide`) are generally trustworthy. | ||
| The trusted code base is larger (it includes Lean's compilation toolchain and library annotations in the standard library), but still fixed and vetted. | ||
|
|
||
| General use ({tactic}`decide`{keywordOf Lean.Parser.Tactic.decide}` +native` or direct use of {name}`Lean.ofReduceBool`) can be used to create invalid proofs whenever the native evaluation of a term disagrees with the kernel's evaluation. | ||
| General use ({tactic}`decide`{keywordOf Lean.Parser.Tactic.decide}` +native` or direct use of `Lean.ofReduceBool`) can be used to create invalid proofs whenever the native evaluation of a term disagrees with the kernel's evaluation. | ||
|
Member
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Note, since it's not part of the diff: this is the "up to 4.28" section |
||
| In particular, for every {attr}`implemented_by`/{attr}`extern` attribute in libraries it becomes part of the trusted code base that the replacement is semantically equivalent. | ||
|
|
||
| All these uses show up as an axiom {name}`Lean.trustCompiler` in {keywordOf Lean.Parser.Command.printAxioms}`#print axioms`. | ||
| All these uses show up as an axiom `Lean.trustCompiler` in {keywordOf Lean.Parser.Command.printAxioms}`#print axioms`. | ||
| External checkers (`lean4checker`, `comparator`) cannot check such proofs, as they do not have access to the Lean compiler. | ||
| When that level of checking is needed, proofs have to avoid using native evaluation. | ||
|
|
||
| Since Lean 4.29.0, the {tactic}`decide`{keywordOf Lean.Parser.Tactic.decide}` +native` and {tactic}`bv_decide` tactics no longer use {name}`Lean.trustCompiler`, but instead introduce one dedicated axiom for each computation that is asserted by native computation. The {name}`Lean.trustCompiler` machinery is deprecated and will eventually be removed. | ||
| Since Lean 4.29.0, the {tactic}`decide`{keywordOf Lean.Parser.Tactic.decide}` +native` and {tactic}`bv_decide` tactics no longer use `Lean.trustCompiler`, but instead introduce one dedicated axiom for each computation that is asserted by native computation. The `Lean.trustCompiler` machinery has since been removed. | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Is this still true? Before, the compiler was trusted and we ran a checker using compiled code. But if we "merely" emit an axiom, then we are trusting the checker, right? If not, then I think this sentence needs a bit of expansion to say in what way we are not trusting the external checker for the truth of the axiom.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Cadical remains outside the TCB as the elaborator, formerly the kernel, runs the certificate checker. We should probably say here that this is what the axiom stands for /cc @hargoniX