Repository: anvil-verifier/anvil
Pull request #616: Specify guarantee-condition for VReplicaSet controller
Author: login: codyjrivera
Created: 2025-05-01T14:42:48Z | Merged: 2025-05-03T16:04:14Z

I add a guarantee-condition for `VReplicaSet`, constraining the messages sent to be create or delete requests on pods owned by the vrs controller.

I also do some cosmetic fixes here as well, changing the naming scheme from 'non-interference' to 'rely-guarantee'.



Diff:
diff --git a/src/v2/controllers/vreplicaset_controller/proof/helper_invariants/predicate.rs b/src/v2/controllers/vreplicaset_controller/proof/helper_invariants/predicate.rs
index 524dfa2f6..4832e280d 100644
--- a/src/v2/controllers/vreplicaset_controller/proof/helper_invariants/predicate.rs
+++ b/src/v2/controllers/vreplicaset_controller/proof/helper_invariants/predicate.rs
@@ -10,7 +10,12 @@ use crate::kubernetes_cluster::spec::{
 use crate::temporal_logic::{defs::*, rules::*};
 use crate::vreplicaset_controller::{
     model::{install::*, reconciler::*},
-    trusted::{liveness_theorem::*, spec_types::*, step::*},
+    trusted::{
+        liveness_theorem::*, 
+        rely_guarantee::*, 
+        spec_types::*, 
+        step::*
+    },
     proof::{predicate::*},
 };
 use vstd::prelude::*;
@@ -70,7 +75,7 @@ pub open spec fn no_pending_interfering_update_request() -> StatePred<ClusterSta
             &&& msg.dst.is_APIServer()
             &&& msg.content.is_APIRequest()
         } ==> match msg.content.get_APIRequest_0() {
-            APIRequest::UpdateRequest(req) => vrs_not_interfered_by_update_req(req)(s),
+            APIRequest::UpdateRequest(req) => vrs_rely_update_req(req)(s),
             _ => true,
         }
     }
@@ -83,7 +88,7 @@ pub open spec fn no_pending_interfering_update_status_request() -> StatePred<Clu
             &&& msg.dst.is_APIServer()
             &&& msg.content.is_APIRequest()
         } ==> match msg.content.get_APIRequest_0() {
-            APIRequest::UpdateStatusRequest(req) => vrs_not_interfered_by_update_status_req(req)(s),
+            APIRequest::UpdateStatusRequest(req) => vrs_rely_update_status_req(req)(s),
             _ => true,
         }
     }
diff --git a/src/v2/controllers/vreplicaset_controller/proof/helper_invariants/proof.rs b/src/v2/controllers/vreplicaset_controller/proof/helper_invariants/proof.rs
index 01b5f4bc6..c70ec9ad6 100644
--- a/src/v2/controllers/vreplicaset_controller/proof/helper_invariants/proof.rs
+++ b/src/v2/controllers/vreplicaset_controller/proof/helper_invariants/proof.rs
@@ -11,7 +11,12 @@ use crate::kubernetes_cluster::spec::{
 use crate::temporal_logic::{defs::*, rules::*};
 use crate::vreplicaset_controller::{
     model::{install::*, reconciler::*},
-    trusted::{liveness_theorem::*, spec_types::*, step::*},
+    trusted::{
+        liveness_theorem::*,
+        rely_guarantee::*,
+        spec_types::*,
+        step::*
+    },
     proof::{predicate::*, helper_lemmas, helper_invariants::{predicate::*}, liveness::api_actions::*},
 };
 use crate::vstd_ext::{map_lib::*, seq_lib::*, set_lib::*};
@@ -40,7 +45,7 @@ pub proof fn lemma_eventually_always_every_create_request_is_well_formed(
         spec.entails(always(lift_state(Cluster::cr_objects_in_reconcile_satisfy_state_validation::<VReplicaSetView>(controller_id)))),
         spec.entails(always(lift_state(cluster.every_in_flight_req_msg_from_controller_has_valid_controller_id()))),
         forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-            ==> spec.entails(always(lift_state(#[trigger] vrs_not_interfered_by(other_id)))),
+            ==> spec.entails(always(lift_state(#[trigger] vrs_rely(other_id)))),
     ensures spec.entails(true_pred().leads_to(always(lift_state(every_create_request_is_well_formed(cluster, controller_id))))),
 {
     let requirements = |msg: Message, s: ClusterState| {
@@ -102,9 +107,9 @@ pub proof fn lemma_eventually_always_every_create_request_is_well_formed(
         &&& cluster.every_in_flight_req_msg_from_controller_has_valid_controller_id()(s)
         &&& Cluster::cr_objects_in_reconcile_satisfy_state_validation::<VReplicaSetView>(controller_id)(s)
         &&& forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-                ==> #[trigger] vrs_not_interfered_by(other_id)(s)
+                ==> #[trigger] vrs_rely(other_id)(s)
         &&& forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-                ==> #[trigger] vrs_not_interfered_by(other_id)(s_prime)
+                ==> #[trigger] vrs_rely(other_id)(s_prime)
     };
     
     assert forall |s: ClusterState, s_prime: ClusterState| #[trigger]  #[trigger] stronger_next(s, s_prime) implies Cluster::every_new_req_msg_if_in_flight_then_satisfies(requirements)(s, s_prime) by {
@@ -121,7 +126,7 @@ pub proof fn lemma_eventually_always_every_create_request_is_well_formed(
                             PodView::marshal_preserves_integrity();
                             VReplicaSetReconcileState::marshal_preserves_integrity();
                             if id != controller_id {
-                                assert(vrs_not_interfered_by(id)(s_prime));
+                                assert(vrs_rely(id)(s_prime));
                             }
                         },
                         _ => {
@@ -133,7 +138,7 @@ pub proof fn lemma_eventually_always_every_create_request_is_well_formed(
         }
     }
 
-    helper_lemmas::vrs_non_interference_property_equivalent_to_lifted_vrs_non_interference_property_action(
+    helper_lemmas::vrs_rely_condition_equivalent_to_lifted_vrs_rely_condition_action(
         spec, cluster, controller_id
     );
     invariant_n!(
@@ -151,7 +156,7 @@ pub proof fn lemma_eventually_always_every_create_request_is_well_formed(
         lift_state(cluster.each_custom_object_in_etcd_is_well_formed::<VReplicaSetView>()),
         lift_state(cluster.every_in_flight_req_msg_from_controller_has_valid_controller_id()),
         lift_state(Cluster::cr_objects_in_reconcile_satisfy_state_validation::<VReplicaSetView>(controller_id)),
-        lifted_vrs_non_interference_property_action(cluster, controller_id)
+        lifted_vrs_rely_condition_action(cluster, controller_id)
     );
 
     cluster.lemma_true_leads_to_always_every_in_flight_req_msg_satisfies(spec, requirements);
@@ -181,13 +186,13 @@ pub proof fn lemma_eventually_always_no_pending_interfering_update_request(
         spec.entails(always(lift_state(cluster.each_custom_object_in_etcd_is_well_formed::<VReplicaSetView>()))),
         spec.entails(always(lift_state(cluster.every_in_flight_req_msg_from_controller_has_valid_controller_id()))),
         forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-            ==> spec.entails(always(lift_state(#[trigger] vrs_not_interfered_by(other_id)))),
+            ==> spec.entails(always(lift_state(#[trigger] vrs_rely(other_id)))),
     ensures spec.entails(true_pred().leads_to(always(lift_state(no_pending_interfering_update_request())))),
 {
     let requirements = |msg: Message, s: ClusterState| {
         msg.content.is_APIRequest() ==> 
             match msg.content.get_APIRequest_0() {
-                APIRequest::UpdateRequest(req) => vrs_not_interfered_by_update_req(req)(s),
+                APIRequest::UpdateRequest(req) => vrs_rely_update_req(req)(s),
                 _ => true,
             }
     };
@@ -200,7 +205,7 @@ pub proof fn lemma_eventually_always_no_pending_interfering_update_request(
                 APIRequest::UpdateRequest(req) =>
                     msg.src.is_Controller()
                     && msg.src != HostId::Controller(controller_id)
-                    && vrs_not_interfered_by_update_req(req)(s),
+                    && vrs_rely_update_req(req)(s),
                 _ => true,
             }
     };
@@ -218,9 +223,9 @@ pub proof fn lemma_eventually_always_no_pending_interfering_update_request(
         &&& cluster.each_custom_object_in_etcd_is_well_formed::<VReplicaSetView>()(s)
         &&& cluster.every_in_flight_req_msg_from_controller_has_valid_controller_id()(s)
         &&& forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-                ==> #[trigger] vrs_not_interfered_by(other_id)(s)
+                ==> #[trigger] vrs_rely(other_id)(s)
         &&& forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-                ==> #[trigger] vrs_not_interfered_by(other_id)(s_prime)
+                ==> #[trigger] vrs_rely(other_id)(s_prime)
     };
     
     assert forall |s: ClusterState, s_prime: ClusterState| #[trigger]  #[trigger] stronger_next(s, s_prime) implies Cluster::every_new_req_msg_if_in_flight_then_satisfies(stronger_requirements)(s, s_prime) by {
@@ -233,7 +238,7 @@ pub proof fn lemma_eventually_always_no_pending_interfering_update_request(
                     PodView::marshal_preserves_integrity();
                     VReplicaSetReconcileState::marshal_preserves_integrity();
                     if id != controller_id {
-                        assert(vrs_not_interfered_by(id)(s_prime));
+                        assert(vrs_rely(id)(s_prime));
                     } else {
                         assert(!s.in_flight().contains(msg));
                     }
@@ -242,7 +247,7 @@ pub proof fn lemma_eventually_always_no_pending_interfering_update_request(
         }
     }
 
-    helper_lemmas::vrs_non_interference_property_equivalent_to_lifted_vrs_non_interference_property_action(
+    helper_lemmas::vrs_rely_condition_equivalent_to_lifted_vrs_rely_condition_action(
         spec, cluster, controller_id
     );
     invariant_n!(
@@ -259,7 +264,7 @@ pub proof fn lemma_eventually_always_no_pending_interfering_update_request(
         lift_state(cluster.each_builtin_object_in_etcd_is_well_formed()),
         lift_state(cluster.each_custom_object_in_etcd_is_well_formed::<VReplicaSetView>()),
         lift_state(cluster.every_in_flight_req_msg_from_controller_has_valid_controller_id()),
-        lifted_vrs_non_interference_property_action(cluster, controller_id)
+        lifted_vrs_rely_condition_action(cluster, controller_id)
     );
 
     cluster.lemma_true_leads_to_always_every_in_flight_req_msg_satisfies(spec, stronger_requirements);
@@ -301,13 +306,13 @@ pub proof fn lemma_eventually_always_no_pending_interfering_update_status_reques
         spec.entails(always(lift_state(cluster.each_custom_object_in_etcd_is_well_formed::<VReplicaSetView>()))),
         spec.entails(always(lift_state(cluster.every_in_flight_req_msg_from_controller_has_valid_controller_id()))),
         forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-            ==> spec.entails(always(lift_state(#[trigger] vrs_not_interfered_by(other_id)))),
+            ==> spec.entails(always(lift_state(#[trigger] vrs_rely(other_id)))),
     ensures spec.entails(true_pred().leads_to(always(lift_state(no_pending_interfering_update_status_request())))),
 {
     let requirements = |msg: Message, s: ClusterState| {
         msg.content.is_APIRequest() ==> 
             match msg.content.get_APIRequest_0() {
-                APIRequest::UpdateStatusRequest(req) => vrs_not_interfered_by_update_status_req(req)(s),
+                APIRequest::UpdateStatusRequest(req) => vrs_rely_update_status_req(req)(s),
                 _ => true,
             }
     };
@@ -320,7 +325,7 @@ pub proof fn lemma_eventually_always_no_pending_interfering_update_status_reques
                 APIRequest::UpdateStatusRequest(req) =>
                     msg.src.is_Controller()
                     && msg.src != HostId::Controller(controller_id)
-                    && vrs_not_interfered_by_update_status_req(req)(s),
+                    && vrs_rely_update_status_req(req)(s),
                 _ => true,
             }
     };
@@ -338,9 +343,9 @@ pub proof fn lemma_eventually_always_no_pending_interfering_update_status_reques
         &&& cluster.each_custom_object_in_etcd_is_well_formed::<VReplicaSetView>()(s)
         &&& cluster.every_in_flight_req_msg_from_controller_has_valid_controller_id()(s)
         &&& forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-                ==> #[trigger] vrs_not_interfered_by(other_id)(s)
+                ==> #[trigger] vrs_rely(other_id)(s)
         &&& forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-                ==> #[trigger] vrs_not_interfered_by(other_id)(s_prime)
+                ==> #[trigger] vrs_rely(other_id)(s_prime)
     };
     
     assert forall |s: ClusterState, s_prime: ClusterState| #[trigger]  #[trigger] stronger_next(s, s_prime) implies Cluster::every_new_req_msg_if_in_flight_then_satisfies(stronger_requirements)(s, s_prime) by {
@@ -353,7 +358,7 @@ pub proof fn lemma_eventually_always_no_pending_interfering_update_status_reques
                     PodView::marshal_preserves_integrity();
                     VReplicaSetReconcileState::marshal_preserves_integrity();
                     if id != controller_id {
-                        assert(vrs_not_interfered_by(id)(s_prime));
+                        assert(vrs_rely(id)(s_prime));
                     } else {
                         assert(!s.in_flight().contains(msg));
                     }
@@ -362,7 +367,7 @@ pub proof fn lemma_eventually_always_no_pending_interfering_update_status_reques
         }
     }
 
-    helper_lemmas::vrs_non_interference_property_equivalent_to_lifted_vrs_non_interference_property_action(
+    helper_lemmas::vrs_rely_condition_equivalent_to_lifted_vrs_rely_condition_action(
         spec, cluster, controller_id
     );
     invariant_n!(
@@ -379,7 +384,7 @@ pub proof fn lemma_eventually_always_no_pending_interfering_update_status_reques
         lift_state(cluster.each_builtin_object_in_etcd_is_well_formed()),
         lift_state(cluster.each_custom_object_in_etcd_is_well_formed::<VReplicaSetView>()),
         lift_state(cluster.every_in_flight_req_msg_from_controller_has_valid_controller_id()),
-        lifted_vrs_non_interference_property_action(cluster, controller_id)
+        lifted_vrs_rely_condition_action(cluster, controller_id)
     );
 
     cluster.lemma_true_leads_to_always_every_in_flight_req_msg_satisfies(spec, stronger_requirements);
@@ -425,7 +430,7 @@ pub proof fn lemma_eventually_always_garbage_collector_does_not_delete_vrs_pods(
         spec.entails(always(lift_state(no_pending_interfering_update_request()))),
         spec.entails(always(lift_state(no_pending_interfering_update_status_request()))),
         forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-            ==> spec.entails(always(lift_state(#[trigger] vrs_not_interfered_by(other_id)))),
+            ==> spec.entails(always(lift_state(#[trigger] vrs_rely(other_id)))),
     ensures spec.entails(true_pred().leads_to(always(lift_state(garbage_collector_does_not_delete_vrs_pods(vrs))))),
 {
     let requirements = |msg: Message, s: ClusterState| {
@@ -469,9 +474,9 @@ pub proof fn lemma_eventually_always_garbage_collector_does_not_delete_vrs_pods(
         &&& no_pending_interfering_update_request()(s)
         &&& no_pending_interfering_update_status_request()(s)
         &&& forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-                ==> #[trigger] vrs_not_interfered_by(other_id)(s)
+                ==> #[trigger] vrs_rely(other_id)(s)
         &&& forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-                ==> #[trigger] vrs_not_interfered_by(other_id)(s_prime)
+                ==> #[trigger] vrs_rely(other_id)(s_prime)
     };
 
     assert forall |s: ClusterState, s_prime: ClusterState| #[trigger]  #[trigger] stronger_next(s, s_prime) implies Cluster::every_new_req_msg_if_in_flight_then_satisfies(requirements)(s, s_prime) by {
@@ -503,7 +508,7 @@ pub proof fn lemma_eventually_always_garbage_collector_does_not_delete_vrs_pods(
         }
     }
     
-    helper_lemmas::vrs_non_interference_property_equivalent_to_lifted_vrs_non_interference_property_action(
+    helper_lemmas::vrs_rely_condition_equivalent_to_lifted_vrs_rely_condition_action(
         spec, cluster, controller_id
     );
     invariant_n!(
@@ -524,7 +529,7 @@ pub proof fn lemma_eventually_always_garbage_collector_does_not_delete_vrs_pods(
         lift_state(Cluster::pending_req_of_key_is_unique_with_unique_id(controller_id, vrs.object_ref())),
         lift_state(no_pending_interfering_update_request()),
         lift_state(no_pending_interfering_update_status_request()),
-        lifted_vrs_non_interference_property_action(cluster, controller_id)
+        lifted_vrs_rely_condition_action(cluster, controller_id)
     );
 
     cluster.lemma_true_leads_to_always_every_in_flight_req_msg_satisfies(spec, requirements);
@@ -554,7 +559,7 @@ pub proof fn lemma_eventually_always_no_pending_create_or_delete_request_not_fro
         spec.entails(always(lift_state(cluster.each_custom_object_in_etcd_is_well_formed::<VReplicaSetView>()))),
         spec.entails(always(lift_state(cluster.every_in_flight_req_msg_from_controller_has_valid_controller_id()))),
         forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-            ==> spec.entails(always(lift_state(#[trigger] vrs_not_interfered_by(other_id)))),
+            ==> spec.entails(always(lift_state(#[trigger] vrs_rely(other_id)))),
     ensures spec.entails(true_pred().leads_to(always(lift_state(no_pending_create_or_delete_request_not_from_controller_on_pods())))),
 {
     let requirements = |msg: Message, s: ClusterState| {
@@ -583,12 +588,12 @@ pub proof fn lemma_eventually_always_no_pending_create_or_delete_request_not_fro
         &&& cluster.each_custom_object_in_etcd_is_well_formed::<VReplicaSetView>()(s)
         &&& cluster.every_in_flight_req_msg_from_controller_has_valid_controller_id()(s)
         &&& forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-                ==> #[trigger] vrs_not_interfered_by(other_id)(s)
+                ==> #[trigger] vrs_rely(other_id)(s)
         &&& forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-                ==> #[trigger] vrs_not_interfered_by(other_id)(s_prime)
+                ==> #[trigger] vrs_rely(other_id)(s_prime)
     };
     
-    helper_lemmas::vrs_non_interference_property_equivalent_to_lifted_vrs_non_interference_property_action(
+    helper_lemmas::vrs_rely_condition_equivalent_to_lifted_vrs_rely_condition_action(
         spec, cluster, controller_id
     );
     invariant_n!(
@@ -605,7 +610,7 @@ pub proof fn lemma_eventually_always_no_pending_create_or_delete_request_not_fro
         lift_state(cluster.each_builtin_object_in_etcd_is_well_formed()),
         lift_state(cluster.each_custom_object_in_etcd_is_well_formed::<VReplicaSetView>()),
         lift_state(cluster.every_in_flight_req_msg_from_controller_has_valid_controller_id()),
-        lifted_vrs_non_interference_property_action(cluster, controller_id)
+        lifted_vrs_rely_condition_action(cluster, controller_id)
     );
 
     cluster.lemma_true_leads_to_always_every_in_flight_req_msg_satisfies(spec, requirements);
@@ -640,7 +645,7 @@ pub proof fn lemma_eventually_always_every_create_matching_pod_request_implies_a
         spec.entails(always(lift_state(Cluster::each_object_in_reconcile_has_consistent_key_and_valid_metadata(controller_id)))),
         spec.entails(always(lift_state(vrs_in_ongoing_reconciles_does_not_have_deletion_timestamp(vrs, controller_id)))),
         forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-            ==> spec.entails(always(lift_state(#[trigger] vrs_not_interfered_by(other_id)))),
+            ==> spec.entails(always(lift_state(#[trigger] vrs_rely(other_id)))),
     ensures spec.entails(true_pred().leads_to(always(lift_state(every_create_matching_pod_request_implies_at_after_create_pod_step(vrs, cluster.installed_types, controller_id))))),
 {
     let key = vrs.object_ref();
@@ -726,9 +731,9 @@ pub proof fn lemma_eventually_always_every_create_matching_pod_request_implies_a
         &&& Cluster::each_object_in_reconcile_has_consistent_key_and_valid_metadata(controller_id)(s)
         &&& vrs_in_ongoing_reconciles_does_not_have_deletion_timestamp(vrs, controller_id)(s)
         &&& forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-                ==> #[trigger] vrs_not_interfered_by(other_id)(s)
+                ==> #[trigger] vrs_rely(other_id)(s)
         &&& forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-                ==> #[trigger] vrs_not_interfered_by(other_id)(s_prime)
+                ==> #[trigger] vrs_rely(other_id)(s_prime)
     };
     
     assert forall |s: ClusterState, s_prime: ClusterState| #[trigger]  #[trigger] stronger_next(s, s_prime) implies Cluster::every_new_req_msg_if_in_flight_then_satisfies(requirements)(s, s_prime) by {
@@ -795,7 +800,7 @@ pub proof fn lemma_eventually_always_every_create_matching_pod_request_implies_a
         }
     }
 
-    helper_lemmas::vrs_non_interference_property_equivalent_to_lifted_vrs_non_interference_property_action(
+    helper_lemmas::vrs_rely_condition_equivalent_to_lifted_vrs_rely_condition_action(
         spec, cluster, controller_id
     );
     invariant_n!(
@@ -817,7 +822,7 @@ pub proof fn lemma_eventually_always_every_create_matching_pod_request_implies_a
         lift_state(Cluster::the_object_in_reconcile_has_spec_and_uid_as(controller_id, vrs)),
         lift_state(Cluster::each_object_in_reconcile_has_consistent_key_and_valid_metadata(controller_id)),
         lift_state(vrs_in_ongoing_reconciles_does_not_have_deletion_timestamp(vrs, controller_id)),
-        lifted_vrs_non_interference_property_action(cluster, controller_id)
+        lifted_vrs_rely_condition_action(cluster, controller_id)
     );
 
     cluster.lemma_true_leads_to_always_every_in_flight_req_msg_satisfies(spec, requirements);
@@ -851,7 +856,7 @@ pub proof fn lemma_eventually_always_every_delete_matching_pod_request_implies_a
         spec.entails(always(lift_state(Cluster::each_object_in_reconcile_has_consistent_key_and_valid_metadata(controller_id)))),
         spec.entails(always(lift_state(Cluster::the_object_in_reconcile_has_spec_and_uid_as::<VReplicaSetView>(controller_id, vrs)))),
         forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-            ==> spec.entails(always(lift_state(#[trigger] vrs_not_interfered_by(other_id)))),
+            ==> spec.entails(always(lift_state(#[trigger] vrs_rely(other_id)))),
         spec.entails(always(lift_state(no_pending_interfering_update_request()))),
         spec.entails(always(lift_state(no_pending_interfering_update_status_request()))),
         spec.entails(always(lift_state(every_create_request_is_well_formed(cluster, controller_id)))),
@@ -930,9 +935,9 @@ pub proof fn lemma_eventually_always_every_delete_matching_pod_request_implies_a
         &&& Cluster::each_object_in_reconcile_has_consistent_key_and_valid_metadata(controller_id)(s)
         &&& Cluster::the_object_in_reconcile_has_spec_and_uid_as::<VReplicaSetView>(controller_id, vrs)(s)
         &&& forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-                ==> #[trigger] vrs_not_interfered_by(other_id)(s)
+                ==> #[trigger] vrs_rely(other_id)(s)
         &&& forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-                ==> #[trigger] vrs_not_interfered_by(other_id)(s_prime)
+                ==> #[trigger] vrs_rely(other_id)(s_prime)
         &&& no_pending_interfering_update_request()(s)
         &&& no_pending_interfering_update_status_request()(s)
         &&& every_create_request_is_well_formed(cluster, controller_id)(s)
@@ -1047,7 +1052,7 @@ pub proof fn lemma_eventually_always_every_delete_matching_pod_request_implies_a
         }
     }
 
-    helper_lemmas::vrs_non_interference_property_equivalent_to_lifted_vrs_non_interference_property_action(
+    helper_lemmas::vrs_rely_condition_equivalent_to_lifted_vrs_rely_condition_action(
         spec, cluster, controller_id
     );
     invariant_n!(
@@ -1068,7 +1073,7 @@ pub proof fn lemma_eventually_always_every_delete_matching_pod_request_implies_a
         lift_state(Cluster::each_object_in_etcd_has_at_most_one_controller_owner()),
         lift_state(Cluster::each_object_in_reconcile_has_consistent_key_and_valid_metadata(controller_id)),
         lift_state(Cluster::the_object_in_reconcile_has_spec_and_uid_as::<VReplicaSetView>(controller_id, vrs)),
-        lifted_vrs_non_interference_property_action(cluster, controller_id),
+        lifted_vrs_rely_condition_action(cluster, controller_id),
         lift_state(no_pending_interfering_update_request()),
         lift_state(no_pending_interfering_update_status_request()),
         lift_state(every_create_request_is_well_formed(cluster, controller_id)),
@@ -1116,7 +1121,7 @@ pub proof fn lemma_eventually_always_each_vrs_in_reconcile_implies_filtered_pods
         spec.entails(always(lift_state(Cluster::etcd_is_finite()))),
         spec.entails(tla_forall(|key: ObjectRef| true_pred().leads_to(lift_state(|s: ClusterState| !(s.ongoing_reconciles(controller_id).contains_key(key)))))),
         forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-            ==> spec.entails(always(lift_state(#[trigger] vrs_not_interfered_by(other_id)))),
+            ==> spec.entails(always(lift_state(#[trigger] vrs_rely(other_id)))),
         spec.entails(always(lift_state(no_pending_interfering_update_request()))),
         spec.entails(always(lift_state(no_pending_interfering_update_status_request()))),
         spec.entails(always(lift_state(every_create_request_is_well_formed(cluster, controller_id)))),
@@ -1206,9 +1211,9 @@ pub proof fn lemma_eventually_always_each_vrs_in_reconcile_implies_filtered_pods
         &&& Cluster::cr_objects_in_reconcile_satisfy_state_validation::<VReplicaSetView>(controller_id)(s)
         &&& Cluster::etcd_is_finite()(s)
         &&& forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-                ==> #[trigger] vrs_not_interfered_by(other_id)(s)
+                ==> #[trigger] vrs_rely(other_id)(s)
         &&& forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-                ==> #[trigger] vrs_not_interfered_by(other_id)(s_prime)
+                ==> #[trigger] vrs_rely(other_id)(s_prime)
         &&& no_pending_interfering_update_request()(s)
         &&& no_pending_interfering_update_status_request()(s)
         &&& every_create_request_is_well_formed(cluster, controller_id)(s)
@@ -1523,7 +1528,7 @@ pub proof fn lemma_eventually_always_each_vrs_in_reconcile_implies_filtered_pods
     }
        
 
-    helper_lemmas::vrs_non_interference_property_equivalent_to_lifted_vrs_non_interference_property_action(
+    helper_lemmas::vrs_rely_condition_equivalent_to_lifted_vrs_rely_condition_action(
         spec, cluster, controller_id
     );
     invariant_n!(
@@ -1549,7 +1554,7 @@ pub proof fn lemma_eventually_always_each_vrs_in_reconcile_implies_filtered_pods
         lift_state(Cluster::the_object_in_reconcile_has_spec_and_uid_as::<VReplicaSetView>(controller_id, vrs)),
         lift_state(Cluster::cr_objects_in_reconcile_satisfy_state_validation::<VReplicaSetView>(controller_id)),
         lift_state(Cluster::etcd_is_finite()),
-        lifted_vrs_non_interference_property_action(cluster, controller_id),
+        lifted_vrs_rely_condition_action(cluster, controller_id),
         lift_state(no_pending_interfering_update_request()),
         lift_state(no_pending_interfering_update_status_request()),
         lift_state(every_create_request_is_well_formed(cluster, controller_id))
@@ -1595,7 +1600,7 @@ pub proof fn lemma_eventually_always_at_after_delete_pod_step_implies_filtered_p
         spec.entails(always(lift_state(Cluster::etcd_is_finite()))),
         spec.entails(tla_forall(|key: ObjectRef| true_pred().leads_to(lift_state(|s: ClusterState| !(s.ongoing_reconciles(controller_id).contains_key(key)))))),
         forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-            ==> spec.entails(always(lift_state(#[trigger] vrs_not_interfered_by(other_id)))),
+            ==> spec.entails(always(lift_state(#[trigger] vrs_rely(other_id)))),
         spec.entails(always(lift_state(no_pending_interfering_update_request()))),
         spec.entails(always(lift_state(no_pending_interfering_update_status_request()))),
         spec.entails(always(lift_state(no_pending_create_or_delete_request_not_from_controller_on_pods()))),
@@ -1687,9 +1692,9 @@ pub proof fn lemma_eventually_always_at_after_delete_pod_step_implies_filtered_p
         &&& Cluster::cr_states_are_unmarshallable::<VReplicaSetReconcileState, VReplicaSetView>(controller_id)(s)
         &&& Cluster::etcd_is_finite()(s)
         &&& forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-                ==> #[trigger] vrs_not_interfered_by(other_id)(s)
+                ==> #[trigger] vrs_rely(other_id)(s)
         &&& forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-                ==> #[trigger] vrs_not_interfered_by(other_id)(s_prime)
+                ==> #[trigger] vrs_rely(other_id)(s_prime)
         &&& no_pending_interfering_update_request()(s)
         &&& no_pending_interfering_update_status_request()(s)
         &&& no_pending_create_or_delete_request_not_from_controller_on_pods()(s)
@@ -2195,7 +2200,7 @@ pub proof fn lemma_eventually_always_at_after_delete_pod_step_implies_filtered_p
                                                     &&& forall |diff: nat| !(#[trigger] at_vrs_step_with_vrs(vrs, controller_id, VReplicaSetRecStepView::AfterDeletePod(diff))(s))
                                                 });
                                                 assert(forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-                                                        ==> #[trigger] vrs_not_interfered_by(other_id)(s));
+                                                        ==> #[trigger] vrs_rely(other_id)(s));
                                                 lemma_api_request_outside_create_or_delete_loop_maintains_matching_pods(
                                                     s, s_prime, vrs, cluster, controller_id, 42, current_req_msg
                                                 );
@@ -2250,7 +2255,7 @@ pub proof fn lemma_eventually_always_at_after_delete_pod_step_implies_filtered_p
                                                 &&& current_req_msg.content.is_delete_request() ==> current_req_msg.content.get_delete_request().key.kind != PodView::kind()
                                             });
                                         } else if current_req_msg.src.is_Controller() && current_req_msg.src.get_Controller_0() != controller_id {
-                                            assert(vrs_not_interfered_by(current_req_msg.src.get_Controller_0())(s));
+                                            assert(vrs_rely(current_req_msg.src.get_Controller_0())(s));
                                         } 
                                     }
 
@@ -2266,7 +2271,7 @@ pub proof fn lemma_eventually_always_at_after_delete_pod_step_implies_filtered_p
                                                     &&& forall |diff: nat| !(#[trigger] at_vrs_step_with_vrs(vrs, controller_id, VReplicaSetRecStepView::AfterDeletePod(diff))(s))
                                                 });
                                                 assert(forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-                                                        ==> #[trigger] vrs_not_interfered_by(other_id)(s));
+                                                        ==> #[trigger] vrs_rely(other_id)(s));
                                                 lemma_api_request_outside_create_or_delete_loop_maintains_matching_pods(
                                                     s, s_prime, vrs, cluster, controller_id, 42, current_req_msg
                                                 );
@@ -2473,7 +2478,7 @@ pub proof fn lemma_eventually_always_at_after_delete_pod_step_implies_filtered_p
     }
        
 
-    helper_lemmas::vrs_non_interference_property_equivalent_to_lifted_vrs_non_interference_property_action(
+    helper_lemmas::vrs_rely_condition_equivalent_to_lifted_vrs_rely_condition_action(
         spec, cluster, controller_id
     );
     invariant_n!(
@@ -2500,7 +2505,7 @@ pub proof fn lemma_eventually_always_at_after_delete_pod_step_implies_filtered_p
         lift_state(Cluster::cr_objects_in_reconcile_satisfy_state_validation::<VReplicaSetView>(controller_id)),
         lift_state(Cluster::cr_states_are_unmarshallable::<VReplicaSetReconcileState, VReplicaSetView>(controller_id)),
         lift_state(Cluster::etcd_is_finite()),
-        lifted_vrs_non_interference_property_action(cluster, controller_id),
+        lifted_vrs_rely_condition_action(cluster, controller_id),
         lift_state(no_pending_interfering_update_request()),
         lift_state(no_pending_interfering_update_status_request()),
         lift_state(no_pending_create_or_delete_request_not_from_controller_on_pods()),
@@ -2545,7 +2550,7 @@ pub proof fn lemma_eventually_always_every_delete_request_from_vrs_has_rv_precon
         spec.entails(always(lift_state(no_pending_interfering_update_request()))),
         spec.entails(always(lift_state(no_pending_interfering_update_status_request()))),
         forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-            ==> spec.entails(always(lift_state(#[trigger] vrs_not_interfered_by(other_id)))),
+            ==> spec.entails(always(lift_state(#[trigger] vrs_rely(other_id)))),
         spec.entails(always(lift_state(each_vrs_in_reconcile_implies_filtered_pods_owned_by_vrs(controller_id)))),
     ensures spec.entails(true_pred().leads_to(always(lift_state(every_delete_request_from_vrs_has_rv_precondition_that_is_less_than_rv_counter(vrs, controller_id))))),
 {
@@ -2591,9 +2596,9 @@ pub proof fn lemma_eventually_always_every_delete_request_from_vrs_has_rv_precon
         &&& no_pending_interfering_update_request()(s)
         &&& no_pending_interfering_update_status_request()(s)
         &&& forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-                ==> #[trigger] vrs_not_interfered_by(other_id)(s)
+                ==> #[trigger] vrs_rely(other_id)(s)
         &&& forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-                ==> #[trigger] vrs_not_interfered_by(other_id)(s_prime)
+                ==> #[trigger] vrs_rely(other_id)(s_prime)
         &&& each_vrs_in_reconcile_implies_filtered_pods_owned_by_vrs(controller_id)(s)
     };
 
@@ -2668,7 +2673,7 @@ pub proof fn lemma_eventually_always_every_delete_request_from_vrs_has_rv_precon
         }
     }
     
-    helper_lemmas::vrs_non_interference_property_equivalent_to_lifted_vrs_non_interference_property_action(
+    helper_lemmas::vrs_rely_condition_equivalent_to_lifted_vrs_rely_condition_action(
         spec, cluster, controller_id
     );
     invariant_n!(
@@ -2690,7 +2695,7 @@ pub proof fn lemma_eventually_always_every_delete_request_from_vrs_has_rv_precon
         lift_state(Cluster::each_object_in_reconcile_has_consistent_key_and_valid_metadata(controller_id)),
         lift_state(no_pending_interfering_update_request()),
         lift_state(no_pending_interfering_update_status_request()),
-        lifted_vrs_non_interference_property_action(cluster, controller_id),
+        lifted_vrs_rely_condition_action(cluster, controller_id),
         lift_state(each_vrs_in_reconcile_implies_filtered_pods_owned_by_vrs(controller_id))
     );
 
diff --git a/src/v2/controllers/vreplicaset_controller/proof/helper_lemmas.rs b/src/v2/controllers/vreplicaset_controller/proof/helper_lemmas.rs
index eefec5107..42de2caa3 100644
--- a/src/v2/controllers/vreplicaset_controller/proof/helper_lemmas.rs
+++ b/src/v2/controllers/vreplicaset_controller/proof/helper_lemmas.rs
@@ -10,7 +10,12 @@ use crate::kubernetes_cluster::spec::{
 use crate::temporal_logic::{defs::*, rules::*};
 use crate::vreplicaset_controller::{
     model::{install::*, reconciler::*},
-    trusted::{liveness_theorem::*, spec_types::*, step::*},
+    trusted::{
+        liveness_theorem::*, 
+        rely_guarantee::*,
+        spec_types::*, 
+        step::*
+    },
     proof::{helper_invariants, predicate::*},
 };
 use crate::vstd_ext::{map_lib::*, seq_lib::*, set_lib::*};
@@ -19,19 +24,19 @@ use vstd::prelude::*;
 
 verus! {
 
-pub proof fn vrs_non_interference_property_equivalent_to_lifted_vrs_non_interference_property(
+pub proof fn vrs_rely_condition_equivalent_to_lifted_vrs_rely_condition(
     spec: TempPred<ClusterState>, cluster: Cluster, controller_id: int,
 )
     ensures
         (forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-            ==> spec.entails(always(lift_state(#[trigger] vrs_not_interfered_by(other_id)))))
+            ==> spec.entails(always(lift_state(#[trigger] vrs_rely(other_id)))))
         <==>
-            spec.entails(always(lifted_vrs_non_interference_property(cluster, controller_id))),
+            spec.entails(always(lifted_vrs_rely_condition(cluster, controller_id))),
 {
     let lhs = 
         (forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-            ==> spec.entails(always(lift_state(#[trigger] vrs_not_interfered_by(other_id)))));
-    let rhs = spec.entails(always(lifted_vrs_non_interference_property(cluster, controller_id)));
+            ==> spec.entails(always(lift_state(#[trigger] vrs_rely(other_id)))));
+    let rhs = spec.entails(always(lifted_vrs_rely_condition(cluster, controller_id)));
 
     assert_by(
         lhs ==> rhs,
@@ -40,13 +45,13 @@ pub proof fn vrs_non_interference_property_equivalent_to_lifted_vrs_non_interfer
                 lhs
                 && spec.satisfied_by(ex)
                 && cluster.controller_models.remove(controller_id).contains_key(other_id)
-                implies vrs_not_interfered_by(other_id)(ex.suffix(n).head()) by {
-                // Gradually unwrap the semantics of `spec.entails(always(lift_state(vrs_not_interfered_by(other_id))))`
+                implies vrs_rely(other_id)(ex.suffix(n).head()) by {
+                // Gradually unwrap the semantics of `spec.entails(always(lift_state(vrs_rely(other_id))))`
                 // until Verus can show the consequent.
-                assert(valid(spec.implies(always(lift_state(vrs_not_interfered_by(other_id))))));
-                assert(spec.implies(always(lift_state(vrs_not_interfered_by(other_id)))).satisfied_by(ex));
-                assert(always(lift_state(vrs_not_interfered_by(other_id))).satisfied_by(ex));
-                assert(lift_state(vrs_not_interfered_by(other_id)).satisfied_by(ex.suffix(n)));
+                assert(valid(spec.implies(always(lift_state(vrs_rely(other_id))))));
+                assert(spec.implies(always(lift_state(vrs_rely(other_id)))).satisfied_by(ex));
+                assert(always(lift_state(vrs_rely(other_id))).satisfied_by(ex));
+                assert(lift_state(vrs_rely(other_id)).satisfied_by(ex.suffix(n)));
             }
         }
     );
@@ -58,31 +63,31 @@ pub proof fn vrs_non_interference_property_equivalent_to_lifted_vrs_non_interfer
                 rhs
                 && spec.satisfied_by(ex)
                 && cluster.controller_models.remove(controller_id).contains_key(other_id)
-                implies vrs_not_interfered_by(other_id)(ex.suffix(n).head()) by {
-                // Gradually unwrap the semantics of `spec.entails(always(lifted_vrs_non_interference_property(cluster, controller_id)))`
+                implies vrs_rely(other_id)(ex.suffix(n).head()) by {
+                // Gradually unwrap the semantics of `spec.entails(always(lifted_vrs_rely_condition(cluster, controller_id)))`
                 // until Verus can show the consequent.
-                assert(valid(spec.implies(always(lifted_vrs_non_interference_property(cluster, controller_id)))));
-                assert(spec.implies(always(lifted_vrs_non_interference_property(cluster, controller_id))).satisfied_by(ex));
-                assert(always(lifted_vrs_non_interference_property(cluster, controller_id)).satisfied_by(ex));
-                assert(lifted_vrs_non_interference_property(cluster, controller_id).satisfied_by(ex.suffix(n)));
+                assert(valid(spec.implies(always(lifted_vrs_rely_condition(cluster, controller_id)))));
+                assert(spec.implies(always(lifted_vrs_rely_condition(cluster, controller_id))).satisfied_by(ex));
+                assert(always(lifted_vrs_rely_condition(cluster, controller_id)).satisfied_by(ex));
+                assert(lifted_vrs_rely_condition(cluster, controller_id).satisfied_by(ex.suffix(n)));
             }
         }
     );
 }
 
-pub proof fn vrs_non_interference_property_equivalent_to_lifted_vrs_non_interference_property_action(
+pub proof fn vrs_rely_condition_equivalent_to_lifted_vrs_rely_condition_action(
     spec: TempPred<ClusterState>, cluster: Cluster, controller_id: int,
 )
     ensures
         (forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-            ==> spec.entails(always(lift_state(#[trigger] vrs_not_interfered_by(other_id)))))
+            ==> spec.entails(always(lift_state(#[trigger] vrs_rely(other_id)))))
         <==>
-            spec.entails(always(lifted_vrs_non_interference_property_action(cluster, controller_id))),
+            spec.entails(always(lifted_vrs_rely_condition_action(cluster, controller_id))),
 {
     let lhs = 
         (forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-            ==> spec.entails(always(lift_state(#[trigger] vrs_not_interfered_by(other_id)))));
-    let rhs = spec.entails(always(lifted_vrs_non_interference_property_action(cluster, controller_id)));
+            ==> spec.entails(always(lift_state(#[trigger] vrs_rely(other_id)))));
+    let rhs = spec.entails(always(lifted_vrs_rely_condition_action(cluster, controller_id)));
 
     assert_by(
         lhs ==> rhs,
@@ -92,15 +97,15 @@ pub proof fn vrs_non_interference_property_equivalent_to_lifted_vrs_non_interfer
                 && spec.satisfied_by(ex)
                 && cluster.controller_models.remove(controller_id).contains_key(other_id)
                 implies 
-                vrs_not_interfered_by(other_id)(ex.suffix(n).head())
-                && vrs_not_interfered_by(other_id)(ex.suffix(n).head_next()) by {
-                // Gradually unwrap the semantics of `spec.entails(always(lift_state(vrs_not_interfered_by(other_id))))`
+                vrs_rely(other_id)(ex.suffix(n).head())
+                && vrs_rely(other_id)(ex.suffix(n).head_next()) by {
+                // Gradually unwrap the semantics of `spec.entails(always(lift_state(vrs_rely(other_id))))`
                 // until Verus can show the consequent.
-                assert(valid(spec.implies(always(lift_state(vrs_not_interfered_by(other_id))))));
-                assert(spec.implies(always(lift_state(vrs_not_interfered_by(other_id)))).satisfied_by(ex));
-                assert(always(lift_state(vrs_not_interfered_by(other_id))).satisfied_by(ex));
-                assert(lift_state(vrs_not_interfered_by(other_id)).satisfied_by(ex.suffix(n)));
-                assert(lift_state(vrs_not_interfered_by(other_id)).satisfied_by(ex.suffix(n + 1)));
+                assert(valid(spec.implies(always(lift_state(vrs_rely(other_id))))));
+                assert(spec.implies(always(lift_state(vrs_rely(other_id)))).satisfied_by(ex));
+                assert(always(lift_state(vrs_rely(other_id))).satisfied_by(ex));
+                assert(lift_state(vrs_rely(other_id)).satisfied_by(ex.suffix(n)));
+                assert(lift_state(vrs_rely(other_id)).satisfied_by(ex.suffix(n + 1)));
             }
         }
     );
@@ -113,15 +118,15 @@ pub proof fn vrs_non_interference_property_equivalent_to_lifted_vrs_non_interfer
                 && spec.satisfied_by(ex)
                 && cluster.controller_models.remove(controller_id).contains_key(other_id)
                 implies 
-                vrs_not_interfered_by(other_id)(ex.suffix(n).head())
-                && vrs_not_interfered_by(other_id)(ex.suffix(n).head_next()) by {
-                // Gradually unwrap the semantics of `spec.entails(always(lifted_vrs_non_interference_property_action(cluster, controller_id)))`
+                vrs_rely(other_id)(ex.suffix(n).head())
+                && vrs_rely(other_id)(ex.suffix(n).head_next()) by {
+                // Gradually unwrap the semantics of `spec.entails(always(lifted_vrs_rely_condition_action(cluster, controller_id)))`
                 // until Verus can show the consequent.
-                assert(valid(spec.implies(always(lifted_vrs_non_interference_property_action(cluster, controller_id)))));
-                assert(spec.implies(always(lifted_vrs_non_interference_property_action(cluster, controller_id))).satisfied_by(ex));
-                assert(always(lifted_vrs_non_interference_property_action(cluster, controller_id)).satisfied_by(ex));
-                assert(lifted_vrs_non_interference_property_action(cluster, controller_id).satisfied_by(ex.suffix(n)));
-                assert(lifted_vrs_non_interference_property_action(cluster, controller_id).satisfied_by(ex.suffix(n + 1)));
+                assert(valid(spec.implies(always(lifted_vrs_rely_condition_action(cluster, controller_id)))));
+                assert(spec.implies(always(lifted_vrs_rely_condition_action(cluster, controller_id))).satisfied_by(ex));
+                assert(always(lifted_vrs_rely_condition_action(cluster, controller_id)).satisfied_by(ex));
+                assert(lifted_vrs_rely_condition_action(cluster, controller_id).satisfied_by(ex.suffix(n)));
+                assert(lifted_vrs_rely_condition_action(cluster, controller_id).satisfied_by(ex.suffix(n + 1)));
             }
         }
     );
diff --git a/src/v2/controllers/vreplicaset_controller/proof/liveness/api_actions.rs b/src/v2/controllers/vreplicaset_controller/proof/liveness/api_actions.rs
index 4ec38169c..d564b69f4 100644
--- a/src/v2/controllers/vreplicaset_controller/proof/liveness/api_actions.rs
+++ b/src/v2/controllers/vreplicaset_controller/proof/liveness/api_actions.rs
@@ -10,7 +10,12 @@ use crate::kubernetes_cluster::spec::{
 use crate::temporal_logic::{defs::*, rules::*};
 use crate::vreplicaset_controller::{
     model::{install::*, reconciler::*},
-    trusted::{liveness_theorem::*, spec_types::*, step::*},
+    trusted::{
+        liveness_theorem::*, 
+        rely_guarantee::*, 
+        spec_types::*, 
+        step::*
+    },
     proof::{helper_invariants, predicate::*},
 };
 use crate::vstd_ext::{map_lib::*, set_lib::*, seq_lib::*};
@@ -40,7 +45,7 @@ pub proof fn lemma_api_request_outside_create_or_delete_loop_maintains_matching_
         forall |diff: nat| !(#[trigger] at_vrs_step_with_vrs(vrs, controller_id, VReplicaSetRecStepView::AfterCreatePod(diff))(s)),
         forall |diff: nat| !(#[trigger] at_vrs_step_with_vrs(vrs, controller_id, VReplicaSetRecStepView::AfterDeletePod(diff))(s)),
         forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-            ==> #[trigger] vrs_not_interfered_by(other_id)(s)
+            ==> #[trigger] vrs_rely(other_id)(s)
     ensures
         matching_pod_entries(vrs, s.resources()) == matching_pod_entries(vrs, s_prime.resources()),
 {
@@ -49,7 +54,7 @@ pub proof fn lemma_api_request_outside_create_or_delete_loop_maintains_matching_
         assert(
             (id != controller_id ==> cluster.controller_models.remove(controller_id).contains_key(id)));
         // Invoke non-interference lemma by trigger.
-        assert(id != controller_id ==> vrs_not_interfered_by(id)(s));
+        assert(id != controller_id ==> vrs_rely(id)(s));
     }
 
     // Dispatch through all the requests which may mutate the k-v store.
@@ -108,7 +113,7 @@ pub proof fn lemma_api_request_not_made_by_vrs_maintains_matching_pods(
         helper_invariants::every_create_matching_pod_request_implies_at_after_create_pod_step(vrs, cluster.installed_types, controller_id)(s),
         helper_invariants::every_delete_matching_pod_request_implies_at_after_delete_pod_step(vrs, controller_id)(s),
         forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-            ==> #[trigger] vrs_not_interfered_by(other_id)(s)
+            ==> #[trigger] vrs_rely(other_id)(s)
     ensures
         matching_pod_entries(vrs, s.resources()) == matching_pod_entries(vrs, s_prime.resources()),
 {
@@ -117,7 +122,7 @@ pub proof fn lemma_api_request_not_made_by_vrs_maintains_matching_pods(
         assert(
             (id != controller_id ==> cluster.controller_models.remove(controller_id).contains_key(id)));
         // Invoke non-interference lemma by trigger.
-        assert(id != controller_id ==> vrs_not_interfered_by(id)(s));
+        assert(id != controller_id ==> vrs_rely(id)(s));
     }
 
     // Dispatch through all the requests which may mutate the k-v store.
diff --git a/src/v2/controllers/vreplicaset_controller/proof/liveness/proof.rs b/src/v2/controllers/vreplicaset_controller/proof/liveness/proof.rs
index 9f47e113b..034c9eee0 100644
--- a/src/v2/controllers/vreplicaset_controller/proof/liveness/proof.rs
+++ b/src/v2/controllers/vreplicaset_controller/proof/liveness/proof.rs
@@ -5,7 +5,12 @@ use crate::temporal_logic::{defs::*, rules::*};
 use crate::vreplicaset_controller::{
     model::{install::*, reconciler::*},
     proof::{helper_lemmas::*, liveness::{resource_match::*, spec::*, terminate}, predicate::*},
-    trusted::{liveness_theorem::*, spec_types::*, step::*},
+    trusted::{
+        liveness_theorem::*, 
+        rely_guarantee::*,
+        spec_types::*, 
+        step::*
+    },
 };
 use vstd::prelude::*;
 
@@ -22,7 +27,7 @@ proof fn eventually_stable_reconciliation_holds(spec: TempPred<ClusterState>, cl
         cluster.controller_models.contains_pair(controller_id, vrs_controller_model()),
         // No other controllers interfere with the vrs controller.
         forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-            ==> spec.entails(always(lift_state(#[trigger] vrs_not_interfered_by(other_id)))),
+            ==> spec.entails(always(lift_state(#[trigger] vrs_rely(other_id)))),
     ensures
         spec.entails(vrs_eventually_stable_reconciliation()),
 {
@@ -73,7 +78,7 @@ proof fn eventually_stable_reconciliation_holds_per_cr(spec: TempPred<ClusterSta
         cluster.controller_models.contains_pair(controller_id, vrs_controller_model()),
         // No other controllers interfere with the vrs controller.
         forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-            ==> spec.entails(always(lift_state(#[trigger] vrs_not_interfered_by(other_id)))),
+            ==> spec.entails(always(lift_state(#[trigger] vrs_rely(other_id)))),
     ensures
         spec.entails(vrs_eventually_stable_reconciliation_per_cr(vrs)),
 {
@@ -83,7 +88,7 @@ proof fn eventually_stable_reconciliation_holds_per_cr(spec: TempPred<ClusterSta
     assumption_and_invariants_of_all_phases_is_stable(vrs, cluster, controller_id);
     stable_spec_and_assumption_and_invariants_of_all_phases_is_stable(vrs, cluster, controller_id);
     
-    vrs_non_interference_property_equivalent_to_lifted_vrs_non_interference_property(
+    vrs_rely_condition_equivalent_to_lifted_vrs_rely_condition(
         stable_spec, cluster, controller_id
     );
     lemma_true_leads_to_always_current_state_matches(stable_spec, vrs, cluster, controller_id);
@@ -131,7 +136,7 @@ proof fn spec_before_phase_n_entails_true_leads_to_current_state_matches(i: nat,
         cluster.type_is_installed_in_cluster::<VReplicaSetView>(),
         cluster.controller_models.contains_pair(controller_id, vrs_controller_model()),
         forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-            ==> spec.entails(always(lift_state(#[trigger] vrs_not_interfered_by(other_id)))),
+            ==> spec.entails(always(lift_state(#[trigger] vrs_rely(other_id)))),
     ensures spec.and(spec_before_phase_n(i, vrs, cluster, controller_id)).entails(true_pred().leads_to(always(lift_state(current_state_matches(vrs))))),
 {
     reveal_with_fuel(spec_before_phase_n, 8);
@@ -159,7 +164,7 @@ proof fn lemma_true_leads_to_always_current_state_matches(provided_spec: TempPre
         cluster.controller_models.contains_pair(controller_id, vrs_controller_model()),
         // No other controllers interfere with the vrs controller.
         forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-            ==> provided_spec.entails(always(lift_state(#[trigger] vrs_not_interfered_by(other_id)))),
+            ==> provided_spec.entails(always(lift_state(#[trigger] vrs_rely(other_id)))),
     ensures
         provided_spec.and(assumption_and_invariants_of_all_phases(vrs, cluster, controller_id)).entails(true_pred().leads_to(always(lift_state(current_state_matches(vrs))))),
 {
@@ -167,22 +172,22 @@ proof fn lemma_true_leads_to_always_current_state_matches(provided_spec: TempPre
     // assert non-interference property on combined spec.
     assert forall |other_id| 
         (forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id) 
-            ==> provided_spec.entails(always(lift_state(#[trigger] vrs_not_interfered_by(other_id)))))
+            ==> provided_spec.entails(always(lift_state(#[trigger] vrs_rely(other_id)))))
         implies 
         cluster.controller_models.remove(controller_id).contains_key(other_id) 
-            ==> spec.entails(always(lift_state(#[trigger] vrs_not_interfered_by(other_id)))) by {
+            ==> spec.entails(always(lift_state(#[trigger] vrs_rely(other_id)))) by {
         if cluster.controller_models.remove(controller_id).contains_key(other_id) {
-            assert(provided_spec.entails(always(lift_state(vrs_not_interfered_by(other_id)))));
+            assert(provided_spec.entails(always(lift_state(vrs_rely(other_id)))));
             entails_and_different_temp(
                 provided_spec,
                 assumption_and_invariants_of_all_phases(vrs, cluster, controller_id),
-                always(lift_state(vrs_not_interfered_by(other_id))),
+                always(lift_state(vrs_rely(other_id))),
                 true_pred()
             );
-            assert(spec.entails(always(lift_state(vrs_not_interfered_by(other_id))).and(true_pred())));
+            assert(spec.entails(always(lift_state(vrs_rely(other_id))).and(true_pred())));
             temp_pred_equality(
-                always(lift_state(vrs_not_interfered_by(other_id))).and(true_pred()),
-                always(lift_state(vrs_not_interfered_by(other_id)))
+                always(lift_state(vrs_rely(other_id))).and(true_pred()),
+                always(lift_state(vrs_rely(other_id)))
             );
         }
     }
diff --git a/src/v2/controllers/vreplicaset_controller/proof/liveness/resource_match.rs b/src/v2/controllers/vreplicaset_controller/proof/liveness/resource_match.rs
index 81b2dd856..4565c2f7a 100644
--- a/src/v2/controllers/vreplicaset_controller/proof/liveness/resource_match.rs
+++ b/src/v2/controllers/vreplicaset_controller/proof/liveness/resource_match.rs
@@ -11,7 +11,12 @@ use crate::kubernetes_cluster::spec::{
 use crate::temporal_logic::{defs::*, rules::*};
 use crate::vreplicaset_controller::{
     model::{install::*, reconciler::*},
-    trusted::{liveness_theorem::*, spec_types::*, step::*},
+    trusted::{
+        liveness_theorem::*, 
+        rely_guarantee::*, 
+        spec_types::*, 
+        step::*
+    },
     proof::{helper_invariants, helper_lemmas, liveness::{api_actions::*}, predicate::*},
 };
 use crate::vstd_ext::{map_lib::*, set_lib::*, seq_lib::*};
@@ -43,7 +48,7 @@ pub proof fn lemma_from_diff_and_init_to_current_state_matches(
         spec.entails(always(lift_state(Cluster::each_object_in_reconcile_has_consistent_key_and_valid_metadata(controller_id)))),
         spec.entails(always(lift_state(Cluster::pending_req_of_key_is_unique_with_unique_id(controller_id, vrs.object_ref())))),
         forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-            ==> spec.entails(always(lift_state(#[trigger] vrs_not_interfered_by(other_id)))),
+            ==> spec.entails(always(lift_state(#[trigger] vrs_rely(other_id)))),
 
         spec.entails(always(lift_state(Cluster::etcd_is_finite()))),
         spec.entails(always(lift_state(helper_invariants::every_create_request_is_well_formed(cluster, controller_id)))),
@@ -87,7 +92,7 @@ pub proof fn lemma_from_diff_and_init_to_current_state_matches(
         &&& spec.entails(always(lift_state(Cluster::each_object_in_reconcile_has_consistent_key_and_valid_metadata(controller_id))))
         &&& spec.entails(always(lift_state(Cluster::pending_req_of_key_is_unique_with_unique_id(controller_id, vrs.object_ref()))))
         &&& forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-                ==> spec.entails(always(lift_state(#[trigger] vrs_not_interfered_by(other_id))))
+                ==> spec.entails(always(lift_state(#[trigger] vrs_rely(other_id))))
 
         &&& spec.entails(always(lift_state(Cluster::etcd_is_finite())))
         &&& spec.entails(always(lift_state(helper_invariants::every_create_request_is_well_formed(cluster, controller_id))))
@@ -491,7 +496,7 @@ pub proof fn lemma_from_after_receive_list_pods_resp_to_receive_create_pod_resp(
         spec.entails(always(lift_state(Cluster::each_object_in_reconcile_has_consistent_key_and_valid_metadata(controller_id)))),
         spec.entails(always(lift_state(Cluster::pending_req_of_key_is_unique_with_unique_id(controller_id, vrs.object_ref())))),
         forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-            ==> spec.entails(always(lift_state(#[trigger] vrs_not_interfered_by(other_id)))),
+            ==> spec.entails(always(lift_state(#[trigger] vrs_rely(other_id)))),
 
         spec.entails(always(lift_state(Cluster::etcd_is_finite()))),
         spec.entails(always(lift_state(helper_invariants::every_create_request_is_well_formed(cluster, controller_id)))),
@@ -642,7 +647,7 @@ pub proof fn lemma_from_after_receive_create_pod_resp_to_receive_create_pod_resp
         spec.entails(always(lift_state(Cluster::each_object_in_reconcile_has_consistent_key_and_valid_metadata(controller_id)))),
         spec.entails(always(lift_state(Cluster::pending_req_of_key_is_unique_with_unique_id(controller_id, vrs.object_ref())))),
         forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-            ==> spec.entails(always(lift_state(#[trigger] vrs_not_interfered_by(other_id)))),
+            ==> spec.entails(always(lift_state(#[trigger] vrs_rely(other_id)))),
 
         spec.entails(always(lift_state(Cluster::etcd_is_finite()))),
         spec.entails(always(lift_state(helper_invariants::every_create_request_is_well_formed(cluster, controller_id)))),
@@ -771,7 +776,7 @@ pub proof fn lemma_from_after_receive_list_pods_resp_to_receive_delete_pod_resp(
         spec.entails(always(lift_state(Cluster::each_object_in_reconcile_has_consistent_key_and_valid_metadata(controller_id)))),
         spec.entails(always(lift_state(Cluster::pending_req_of_key_is_unique_with_unique_id(controller_id, vrs.object_ref())))),
         forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-            ==> spec.entails(always(lift_state(#[trigger] vrs_not_interfered_by(other_id)))),
+            ==> spec.entails(always(lift_state(#[trigger] vrs_rely(other_id)))),
 
         spec.entails(always(lift_state(Cluster::etcd_is_finite()))),
         spec.entails(always(lift_state(helper_invariants::every_create_request_is_well_formed(cluster, controller_id)))),
@@ -921,7 +926,7 @@ pub proof fn lemma_from_after_receive_delete_pod_resp_to_receive_delete_pod_resp
         spec.entails(always(lift_state(Cluster::each_object_in_reconcile_has_consistent_key_and_valid_metadata(controller_id)))),
         spec.entails(always(lift_state(Cluster::pending_req_of_key_is_unique_with_unique_id(controller_id, vrs.object_ref())))),
         forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-            ==> spec.entails(always(lift_state(#[trigger] vrs_not_interfered_by(other_id)))),
+            ==> spec.entails(always(lift_state(#[trigger] vrs_rely(other_id)))),
 
         spec.entails(always(lift_state(Cluster::etcd_is_finite()))),
         spec.entails(always(lift_state(helper_invariants::every_create_request_is_well_formed(cluster, controller_id)))),
@@ -1048,7 +1053,7 @@ pub proof fn lemma_from_init_step_to_send_list_pods_req(
         spec.entails(always(lift_state(cluster.each_custom_object_in_etcd_is_well_formed::<VReplicaSetView>()))),
         spec.entails(always(lift_state(cluster.every_in_flight_req_msg_from_controller_has_valid_controller_id()))),
         forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-            ==> spec.entails(always(lift_state(#[trigger] vrs_not_interfered_by(other_id)))),
+            ==> spec.entails(always(lift_state(#[trigger] vrs_rely(other_id)))),
 
         spec.entails(always(lift_state(helper_invariants::every_create_request_is_well_formed(cluster, controller_id)))),
         spec.entails(always(lift_state(helper_invariants::no_pending_interfering_update_request()))),
@@ -1097,7 +1102,7 @@ pub proof fn lemma_from_init_step_to_send_list_pods_req(
         &&& cluster.each_custom_object_in_etcd_is_well_formed::<VReplicaSetView>()(s)
         &&& cluster.every_in_flight_req_msg_from_controller_has_valid_controller_id()(s)
         &&& forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-                ==> #[trigger] vrs_not_interfered_by(other_id)(s)
+                ==> #[trigger] vrs_rely(other_id)(s)
         &&& helper_invariants::every_create_request_is_well_formed(cluster, controller_id)(s)
         &&& helper_invariants::no_pending_interfering_update_request()(s)
         &&& helper_invariants::no_pending_interfering_update_status_request()(s)
@@ -1108,7 +1113,7 @@ pub proof fn lemma_from_init_step_to_send_list_pods_req(
         &&& helper_invariants::every_delete_matching_pod_request_implies_at_after_delete_pod_step(vrs, controller_id)(s)
         &&& helper_invariants::vrs_in_ongoing_reconciles_does_not_have_deletion_timestamp(vrs, controller_id)(s)
     };
-    helper_lemmas::vrs_non_interference_property_equivalent_to_lifted_vrs_non_interference_property(
+    helper_lemmas::vrs_rely_condition_equivalent_to_lifted_vrs_rely_condition(
         spec, cluster, controller_id
     );
 
@@ -1124,7 +1129,7 @@ pub proof fn lemma_from_init_step_to_send_list_pods_req(
         lift_state(cluster.each_builtin_object_in_etcd_is_well_formed()),
         lift_state(cluster.each_custom_object_in_etcd_is_well_formed::<VReplicaSetView>()),
         lift_state(cluster.every_in_flight_req_msg_from_controller_has_valid_controller_id()),
-        lifted_vrs_non_interference_property(cluster, controller_id),
+        lifted_vrs_rely_condition(cluster, controller_id),
         lift_state(helper_invariants::every_create_request_is_well_formed(cluster, controller_id)),
         lift_state(helper_invariants::no_pending_interfering_update_request()),
         lift_state(helper_invariants::no_pending_interfering_update_status_request()),
@@ -1181,7 +1186,7 @@ pub proof fn lemma_from_after_send_list_pods_req_to_receive_list_pods_resp(
         spec.entails(always(lift_state(cluster.each_custom_object_in_etcd_is_well_formed::<VReplicaSetView>()))),
         spec.entails(always(lift_state(cluster.every_in_flight_req_msg_from_controller_has_valid_controller_id()))),
         forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-            ==> spec.entails(always(lift_state(#[trigger] vrs_not_interfered_by(other_id)))),
+            ==> spec.entails(always(lift_state(#[trigger] vrs_rely(other_id)))),
 
         spec.entails(always(lift_state(Cluster::etcd_is_finite()))),
         spec.entails(always(lift_state(helper_invariants::every_create_request_is_well_formed(cluster, controller_id)))),
@@ -1231,7 +1236,7 @@ pub proof fn lemma_from_after_send_list_pods_req_to_receive_list_pods_resp(
         &&& cluster.each_custom_object_in_etcd_is_well_formed::<VReplicaSetView>()(s)
         &&& cluster.every_in_flight_req_msg_from_controller_has_valid_controller_id()(s)
         &&& forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-                ==> #[trigger] vrs_not_interfered_by(other_id)(s)
+                ==> #[trigger] vrs_rely(other_id)(s)
         &&& Cluster::etcd_is_finite()(s)
         &&& helper_invariants::every_create_request_is_well_formed(cluster, controller_id)(s)
         &&& helper_invariants::no_pending_interfering_update_request()(s)
@@ -1242,7 +1247,7 @@ pub proof fn lemma_from_after_send_list_pods_req_to_receive_list_pods_resp(
         &&& helper_invariants::every_create_matching_pod_request_implies_at_after_create_pod_step(vrs, cluster.installed_types, controller_id)(s)
         &&& helper_invariants::every_delete_matching_pod_request_implies_at_after_delete_pod_step(vrs, controller_id)(s)
     };
-    helper_lemmas::vrs_non_interference_property_equivalent_to_lifted_vrs_non_interference_property(
+    helper_lemmas::vrs_rely_condition_equivalent_to_lifted_vrs_rely_condition(
         spec, cluster, controller_id
     );
 
@@ -1259,7 +1264,7 @@ pub proof fn lemma_from_after_send_list_pods_req_to_receive_list_pods_resp(
         lift_state(cluster.each_builtin_object_in_etcd_is_well_formed()),
         lift_state(cluster.each_custom_object_in_etcd_is_well_formed::<VReplicaSetView>()),
         lift_state(cluster.every_in_flight_req_msg_from_controller_has_valid_controller_id()),
-        lifted_vrs_non_interference_property(cluster, controller_id),
+        lifted_vrs_rely_condition(cluster, controller_id),
         lift_state(Cluster::etcd_is_finite()),
         lift_state(helper_invariants::every_create_request_is_well_formed(cluster, controller_id)),
         lift_state(helper_invariants::no_pending_interfering_update_request()),
@@ -1625,7 +1630,7 @@ pub proof fn lemma_from_after_receive_list_pods_resp_to_done(
         spec.entails(always(lift_state(Cluster::each_object_in_reconcile_has_consistent_key_and_valid_metadata(controller_id)))),
         spec.entails(always(lift_state(Cluster::pending_req_of_key_is_unique_with_unique_id(controller_id, vrs.object_ref())))),
         forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-            ==> spec.entails(always(lift_state(#[trigger] vrs_not_interfered_by(other_id)))),
+            ==> spec.entails(always(lift_state(#[trigger] vrs_rely(other_id)))),
 
         spec.entails(always(lift_state(Cluster::etcd_is_finite()))),
         spec.entails(always(lift_state(helper_invariants::every_create_request_is_well_formed(cluster, controller_id)))),
@@ -1676,7 +1681,7 @@ pub proof fn lemma_from_after_receive_list_pods_resp_to_done(
         &&& Cluster::each_object_in_reconcile_has_consistent_key_and_valid_metadata(controller_id)(s)
         &&& Cluster::pending_req_of_key_is_unique_with_unique_id(controller_id, vrs.object_ref())(s)
         &&& forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-                ==> #[trigger] vrs_not_interfered_by(other_id)(s)
+                ==> #[trigger] vrs_rely(other_id)(s)
         &&& Cluster::etcd_is_finite()(s)
         &&& helper_invariants::every_create_request_is_well_formed(cluster, controller_id)(s)
         &&& helper_invariants::no_pending_interfering_update_request()(s)
@@ -1687,7 +1692,7 @@ pub proof fn lemma_from_after_receive_list_pods_resp_to_done(
         &&& helper_invariants::every_create_matching_pod_request_implies_at_after_create_pod_step(vrs, cluster.installed_types, controller_id)(s)
         &&& helper_invariants::every_delete_matching_pod_request_implies_at_after_delete_pod_step(vrs, controller_id)(s)
     };
-    helper_lemmas::vrs_non_interference_property_equivalent_to_lifted_vrs_non_interference_property(
+    helper_lemmas::vrs_rely_condition_equivalent_to_lifted_vrs_rely_condition(
         spec, cluster, controller_id
     );
 
@@ -1705,7 +1710,7 @@ pub proof fn lemma_from_after_receive_list_pods_resp_to_done(
         lift_state(cluster.every_in_flight_req_msg_from_controller_has_valid_controller_id()),
         lift_state(Cluster::each_object_in_reconcile_has_consistent_key_and_valid_metadata(controller_id)),
         lift_state(Cluster::pending_req_of_key_is_unique_with_unique_id(controller_id, vrs.object_ref())),
-        lifted_vrs_non_interference_property(cluster, controller_id),
+        lifted_vrs_rely_condition(cluster, controller_id),
         lift_state(Cluster::etcd_is_finite()),
         lift_state(helper_invariants::every_create_request_is_well_formed(cluster, controller_id)),
         lift_state(helper_invariants::no_pending_interfering_update_request()),
@@ -1785,7 +1790,7 @@ pub proof fn lemma_from_after_receive_list_pods_resp_to_send_create_pod_req(
         spec.entails(always(lift_state(Cluster::each_object_in_reconcile_has_consistent_key_and_valid_metadata(controller_id)))),
         spec.entails(always(lift_state(Cluster::pending_req_of_key_is_unique_with_unique_id(controller_id, vrs.object_ref())))),
         forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-            ==> spec.entails(always(lift_state(#[trigger] vrs_not_interfered_by(other_id)))),
+            ==> spec.entails(always(lift_state(#[trigger] vrs_rely(other_id)))),
 
         spec.entails(always(lift_state(Cluster::etcd_is_finite()))),
         spec.entails(always(lift_state(helper_invariants::every_create_request_is_well_formed(cluster, controller_id)))),
@@ -1837,7 +1842,7 @@ pub proof fn lemma_from_after_receive_list_pods_resp_to_send_create_pod_req(
         &&& Cluster::each_object_in_reconcile_has_consistent_key_and_valid_metadata(controller_id)(s)
         &&& Cluster::pending_req_of_key_is_unique_with_unique_id(controller_id, vrs.object_ref())(s)
         &&& forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-                ==> #[trigger] vrs_not_interfered_by(other_id)(s)
+                ==> #[trigger] vrs_rely(other_id)(s)
         &&& Cluster::etcd_is_finite()(s)
         &&& helper_invariants::every_create_request_is_well_formed(cluster, controller_id)(s)
         &&& helper_invariants::no_pending_interfering_update_request()(s)
@@ -1848,7 +1853,7 @@ pub proof fn lemma_from_after_receive_list_pods_resp_to_send_create_pod_req(
         &&& helper_invariants::every_create_matching_pod_request_implies_at_after_create_pod_step(vrs, cluster.installed_types, controller_id)(s)
         &&& helper_invariants::every_delete_matching_pod_request_implies_at_after_delete_pod_step(vrs, controller_id)(s)
     };
-    helper_lemmas::vrs_non_interference_property_equivalent_to_lifted_vrs_non_interference_property(
+    helper_lemmas::vrs_rely_condition_equivalent_to_lifted_vrs_rely_condition(
         spec, cluster, controller_id
     );
 
@@ -1866,7 +1871,7 @@ pub proof fn lemma_from_after_receive_list_pods_resp_to_send_create_pod_req(
         lift_state(cluster.every_in_flight_req_msg_from_controller_has_valid_controller_id()),
         lift_state(Cluster::each_object_in_reconcile_has_consistent_key_and_valid_metadata(controller_id)),
         lift_state(Cluster::pending_req_of_key_is_unique_with_unique_id(controller_id, vrs.object_ref())),
-        lifted_vrs_non_interference_property(cluster, controller_id),
+        lifted_vrs_rely_condition(cluster, controller_id),
         lift_state(Cluster::etcd_is_finite()),
         lift_state(helper_invariants::every_create_request_is_well_formed(cluster, controller_id)),
         lift_state(helper_invariants::no_pending_interfering_update_request()),
@@ -1931,7 +1936,7 @@ pub proof fn lemma_from_after_send_create_pod_req_to_receive_ok_resp(
         spec.entails(always(lift_state(cluster.each_custom_object_in_etcd_is_well_formed::<VReplicaSetView>()))),
         spec.entails(always(lift_state(cluster.every_in_flight_req_msg_from_controller_has_valid_controller_id()))),
         forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-            ==> spec.entails(always(lift_state(#[trigger] vrs_not_interfered_by(other_id)))),
+            ==> spec.entails(always(lift_state(#[trigger] vrs_rely(other_id)))),
 
         spec.entails(always(lift_state(Cluster::etcd_is_finite()))),
         spec.entails(always(lift_state(helper_invariants::every_create_request_is_well_formed(cluster, controller_id)))),
@@ -1983,7 +1988,7 @@ pub proof fn lemma_from_after_send_create_pod_req_to_receive_ok_resp(
         &&& cluster.each_custom_object_in_etcd_is_well_formed::<VReplicaSetView>()(s)
         &&& cluster.every_in_flight_req_msg_from_controller_has_valid_controller_id()(s)
         &&& forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-                ==> #[trigger] vrs_not_interfered_by(other_id)(s)
+                ==> #[trigger] vrs_rely(other_id)(s)
         &&& Cluster::etcd_is_finite()(s)
         &&& helper_invariants::every_create_request_is_well_formed(cluster, controller_id)(s)
         &&& helper_invariants::no_pending_interfering_update_request()(s)
@@ -1994,7 +1999,7 @@ pub proof fn lemma_from_after_send_create_pod_req_to_receive_ok_resp(
         &&& helper_invariants::every_delete_matching_pod_request_implies_at_after_delete_pod_step(vrs, controller_id)(s)
         &&& helper_invariants::every_delete_request_from_vrs_has_rv_precondition_that_is_less_than_rv_counter(vrs, controller_id)(s)
     };
-    helper_lemmas::vrs_non_interference_property_equivalent_to_lifted_vrs_non_interference_property(
+    helper_lemmas::vrs_rely_condition_equivalent_to_lifted_vrs_rely_condition(
         spec, cluster, controller_id
     );
 
@@ -2011,7 +2016,7 @@ pub proof fn lemma_from_after_send_create_pod_req_to_receive_ok_resp(
         lift_state(cluster.each_builtin_object_in_etcd_is_well_formed()),
         lift_state(cluster.each_custom_object_in_etcd_is_well_formed::<VReplicaSetView>()),
         lift_state(cluster.every_in_flight_req_msg_from_controller_has_valid_controller_id()),
-        lifted_vrs_non_interference_property(cluster, controller_id),
+        lifted_vrs_rely_condition(cluster, controller_id),
         lift_state(Cluster::etcd_is_finite()),
         lift_state(helper_invariants::every_create_request_is_well_formed(cluster, controller_id)),
         lift_state(helper_invariants::no_pending_interfering_update_request()),
@@ -2158,7 +2163,7 @@ pub proof fn lemma_from_after_receive_ok_resp_to_send_create_pod_req(
         spec.entails(always(lift_state(Cluster::each_object_in_reconcile_has_consistent_key_and_valid_metadata(controller_id)))),
         spec.entails(always(lift_state(Cluster::pending_req_of_key_is_unique_with_unique_id(controller_id, vrs.object_ref())))),
         forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-            ==> spec.entails(always(lift_state(#[trigger] vrs_not_interfered_by(other_id)))),
+            ==> spec.entails(always(lift_state(#[trigger] vrs_rely(other_id)))),
 
         spec.entails(always(lift_state(Cluster::etcd_is_finite()))),
         spec.entails(always(lift_state(helper_invariants::every_create_request_is_well_formed(cluster, controller_id)))),
@@ -2212,7 +2217,7 @@ pub proof fn lemma_from_after_receive_ok_resp_to_send_create_pod_req(
         &&& Cluster::each_object_in_reconcile_has_consistent_key_and_valid_metadata(controller_id)(s)
         &&& Cluster::pending_req_of_key_is_unique_with_unique_id(controller_id, vrs.object_ref())(s)
         &&& forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-                ==> #[trigger] vrs_not_interfered_by(other_id)(s)
+                ==> #[trigger] vrs_rely(other_id)(s)
         &&& Cluster::etcd_is_finite()(s)
         &&& helper_invariants::every_create_request_is_well_formed(cluster, controller_id)(s)
         &&& helper_invariants::no_pending_interfering_update_request()(s)
@@ -2223,7 +2228,7 @@ pub proof fn lemma_from_after_receive_ok_resp_to_send_create_pod_req(
         &&& helper_invariants::every_create_matching_pod_request_implies_at_after_create_pod_step(vrs, cluster.installed_types, controller_id)(s)
         &&& helper_invariants::every_delete_matching_pod_request_implies_at_after_delete_pod_step(vrs, controller_id)(s)
     };
-    helper_lemmas::vrs_non_interference_property_equivalent_to_lifted_vrs_non_interference_property(
+    helper_lemmas::vrs_rely_condition_equivalent_to_lifted_vrs_rely_condition(
         spec, cluster, controller_id
     );
 
@@ -2241,7 +2246,7 @@ pub proof fn lemma_from_after_receive_ok_resp_to_send_create_pod_req(
         lift_state(cluster.every_in_flight_req_msg_from_controller_has_valid_controller_id()),
         lift_state(Cluster::each_object_in_reconcile_has_consistent_key_and_valid_metadata(controller_id)),
         lift_state(Cluster::pending_req_of_key_is_unique_with_unique_id(controller_id, vrs.object_ref())),
-        lifted_vrs_non_interference_property(cluster, controller_id),
+        lifted_vrs_rely_condition(cluster, controller_id),
         lift_state(Cluster::etcd_is_finite()),
         lift_state(helper_invariants::every_create_request_is_well_formed(cluster, controller_id)),
         lift_state(helper_invariants::no_pending_interfering_update_request()),
@@ -2303,7 +2308,7 @@ pub proof fn lemma_from_after_receive_ok_resp_at_after_create_pod_step_to_done(
         spec.entails(always(lift_state(Cluster::each_object_in_reconcile_has_consistent_key_and_valid_metadata(controller_id)))),
         spec.entails(always(lift_state(Cluster::pending_req_of_key_is_unique_with_unique_id(controller_id, vrs.object_ref())))),
         forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-            ==> spec.entails(always(lift_state(#[trigger] vrs_not_interfered_by(other_id)))),
+            ==> spec.entails(always(lift_state(#[trigger] vrs_rely(other_id)))),
 
         spec.entails(always(lift_state(Cluster::etcd_is_finite()))),
         spec.entails(always(lift_state(helper_invariants::every_create_request_is_well_formed(cluster, controller_id)))),
@@ -2355,7 +2360,7 @@ pub proof fn lemma_from_after_receive_ok_resp_at_after_create_pod_step_to_done(
         &&& Cluster::each_object_in_reconcile_has_consistent_key_and_valid_metadata(controller_id)(s)
         &&& Cluster::pending_req_of_key_is_unique_with_unique_id(controller_id, vrs.object_ref())(s)
         &&& forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-                ==> #[trigger] vrs_not_interfered_by(other_id)(s)
+                ==> #[trigger] vrs_rely(other_id)(s)
         &&& Cluster::etcd_is_finite()(s)
         &&& helper_invariants::every_create_request_is_well_formed(cluster, controller_id)(s)
         &&& helper_invariants::no_pending_interfering_update_request()(s)
@@ -2366,7 +2371,7 @@ pub proof fn lemma_from_after_receive_ok_resp_at_after_create_pod_step_to_done(
         &&& helper_invariants::every_create_matching_pod_request_implies_at_after_create_pod_step(vrs, cluster.installed_types, controller_id)(s)
         &&& helper_invariants::every_delete_matching_pod_request_implies_at_after_delete_pod_step(vrs, controller_id)(s)
     };
-    helper_lemmas::vrs_non_interference_property_equivalent_to_lifted_vrs_non_interference_property(
+    helper_lemmas::vrs_rely_condition_equivalent_to_lifted_vrs_rely_condition(
         spec, cluster, controller_id
     );
 
@@ -2384,7 +2389,7 @@ pub proof fn lemma_from_after_receive_ok_resp_at_after_create_pod_step_to_done(
         lift_state(cluster.every_in_flight_req_msg_from_controller_has_valid_controller_id()),
         lift_state(Cluster::each_object_in_reconcile_has_consistent_key_and_valid_metadata(controller_id)),
         lift_state(Cluster::pending_req_of_key_is_unique_with_unique_id(controller_id, vrs.object_ref())),
-        lifted_vrs_non_interference_property(cluster, controller_id),
+        lifted_vrs_rely_condition(cluster, controller_id),
         lift_state(Cluster::etcd_is_finite()),
         lift_state(helper_invariants::every_create_request_is_well_formed(cluster, controller_id)),
         lift_state(helper_invariants::no_pending_interfering_update_request()),
@@ -2479,7 +2484,7 @@ pub proof fn lemma_from_after_receive_list_pods_resp_to_send_delete_pod_req(
         spec.entails(always(lift_state(Cluster::each_object_in_reconcile_has_consistent_key_and_valid_metadata(controller_id)))),
         spec.entails(always(lift_state(Cluster::pending_req_of_key_is_unique_with_unique_id(controller_id, vrs.object_ref())))),
         forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-            ==> spec.entails(always(lift_state(#[trigger] vrs_not_interfered_by(other_id)))),
+            ==> spec.entails(always(lift_state(#[trigger] vrs_rely(other_id)))),
 
         spec.entails(always(lift_state(Cluster::etcd_is_finite()))),
         spec.entails(always(lift_state(helper_invariants::every_create_request_is_well_formed(cluster, controller_id)))),
@@ -2532,7 +2537,7 @@ pub proof fn lemma_from_after_receive_list_pods_resp_to_send_delete_pod_req(
         &&& Cluster::each_object_in_reconcile_has_consistent_key_and_valid_metadata(controller_id)(s)
         &&& Cluster::pending_req_of_key_is_unique_with_unique_id(controller_id, vrs.object_ref())(s)
         &&& forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-                ==> #[trigger] vrs_not_interfered_by(other_id)(s)
+                ==> #[trigger] vrs_rely(other_id)(s)
         &&& Cluster::etcd_is_finite()(s)
         &&& helper_invariants::every_create_request_is_well_formed(cluster, controller_id)(s)
         &&& helper_invariants::no_pending_interfering_update_request()(s)
@@ -2543,7 +2548,7 @@ pub proof fn lemma_from_after_receive_list_pods_resp_to_send_delete_pod_req(
         &&& helper_invariants::every_create_matching_pod_request_implies_at_after_create_pod_step(vrs, cluster.installed_types, controller_id)(s)
         &&& helper_invariants::every_delete_matching_pod_request_implies_at_after_delete_pod_step(vrs, controller_id)(s)
     };
-    helper_lemmas::vrs_non_interference_property_equivalent_to_lifted_vrs_non_interference_property(
+    helper_lemmas::vrs_rely_condition_equivalent_to_lifted_vrs_rely_condition(
         spec, cluster, controller_id
     );
 
@@ -2562,7 +2567,7 @@ pub proof fn lemma_from_after_receive_list_pods_resp_to_send_delete_pod_req(
         lift_state(cluster.every_in_flight_req_msg_from_controller_has_valid_controller_id()),
         lift_state(Cluster::each_object_in_reconcile_has_consistent_key_and_valid_metadata(controller_id)),
         lift_state(Cluster::pending_req_of_key_is_unique_with_unique_id(controller_id, vrs.object_ref())),
-        lifted_vrs_non_interference_property(cluster, controller_id),
+        lifted_vrs_rely_condition(cluster, controller_id),
         lift_state(Cluster::etcd_is_finite()),
         lift_state(helper_invariants::every_create_request_is_well_formed(cluster, controller_id)),
         lift_state(helper_invariants::no_pending_interfering_update_request()),
@@ -2631,7 +2636,7 @@ pub proof fn lemma_from_after_send_delete_pod_req_to_receive_ok_resp(
         spec.entails(always(lift_state(cluster.each_custom_object_in_etcd_is_well_formed::<VReplicaSetView>()))),
         spec.entails(always(lift_state(cluster.every_in_flight_req_msg_from_controller_has_valid_controller_id()))),
         forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-            ==> spec.entails(always(lift_state(#[trigger] vrs_not_interfered_by(other_id)))),
+            ==> spec.entails(always(lift_state(#[trigger] vrs_rely(other_id)))),
 
         spec.entails(always(lift_state(Cluster::etcd_is_finite()))),
         spec.entails(always(lift_state(helper_invariants::every_create_request_is_well_formed(cluster, controller_id)))),
@@ -2682,7 +2687,7 @@ pub proof fn lemma_from_after_send_delete_pod_req_to_receive_ok_resp(
         &&& cluster.each_custom_object_in_etcd_is_well_formed::<VReplicaSetView>()(s)
         &&& cluster.every_in_flight_req_msg_from_controller_has_valid_controller_id()(s)
         &&& forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-                ==> #[trigger] vrs_not_interfered_by(other_id)(s)
+                ==> #[trigger] vrs_rely(other_id)(s)
         &&& Cluster::etcd_is_finite()(s)
         &&& helper_invariants::every_create_request_is_well_formed(cluster, controller_id)(s)
         &&& helper_invariants::no_pending_interfering_update_request()(s)
@@ -2693,7 +2698,7 @@ pub proof fn lemma_from_after_send_delete_pod_req_to_receive_ok_resp(
         &&& helper_invariants::every_create_matching_pod_request_implies_at_after_create_pod_step(vrs, cluster.installed_types, controller_id)(s)
         &&& helper_invariants::every_delete_matching_pod_request_implies_at_after_delete_pod_step(vrs, controller_id)(s)
     };
-    helper_lemmas::vrs_non_interference_property_equivalent_to_lifted_vrs_non_interference_property(
+    helper_lemmas::vrs_rely_condition_equivalent_to_lifted_vrs_rely_condition(
         spec, cluster, controller_id
     );
 
@@ -2709,7 +2714,7 @@ pub proof fn lemma_from_after_send_delete_pod_req_to_receive_ok_resp(
         lift_state(cluster.each_builtin_object_in_etcd_is_well_formed()),
         lift_state(cluster.each_custom_object_in_etcd_is_well_formed::<VReplicaSetView>()),
         lift_state(cluster.every_in_flight_req_msg_from_controller_has_valid_controller_id()),
-        lifted_vrs_non_interference_property(cluster, controller_id),
+        lifted_vrs_rely_condition(cluster, controller_id),
         lift_state(Cluster::etcd_is_finite()),
         lift_state(helper_invariants::every_create_request_is_well_formed(cluster, controller_id)),
         lift_state(helper_invariants::no_pending_interfering_update_request()),
@@ -2800,7 +2805,7 @@ pub proof fn lemma_from_after_receive_ok_resp_to_send_delete_pod_req(
         spec.entails(always(lift_state(Cluster::each_object_in_reconcile_has_consistent_key_and_valid_metadata(controller_id)))),
         spec.entails(always(lift_state(Cluster::pending_req_of_key_is_unique_with_unique_id(controller_id, vrs.object_ref())))),
         forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-            ==> spec.entails(always(lift_state(#[trigger] vrs_not_interfered_by(other_id)))),
+            ==> spec.entails(always(lift_state(#[trigger] vrs_rely(other_id)))),
 
         spec.entails(always(lift_state(Cluster::etcd_is_finite()))),
         spec.entails(always(lift_state(helper_invariants::every_create_request_is_well_formed(cluster, controller_id)))),
@@ -2856,7 +2861,7 @@ pub proof fn lemma_from_after_receive_ok_resp_to_send_delete_pod_req(
         &&& Cluster::each_object_in_reconcile_has_consistent_key_and_valid_metadata(controller_id)(s)
         &&& Cluster::pending_req_of_key_is_unique_with_unique_id(controller_id, vrs.object_ref())(s)
         &&& forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-                ==> #[trigger] vrs_not_interfered_by(other_id)(s)
+                ==> #[trigger] vrs_rely(other_id)(s)
         &&& Cluster::etcd_is_finite()(s)
         &&& helper_invariants::every_create_request_is_well_formed(cluster, controller_id)(s)
         &&& helper_invariants::no_pending_interfering_update_request()(s)
@@ -2868,7 +2873,7 @@ pub proof fn lemma_from_after_receive_ok_resp_to_send_delete_pod_req(
         &&& helper_invariants::every_delete_matching_pod_request_implies_at_after_delete_pod_step(vrs, controller_id)(s)
         &&& helper_invariants::at_after_delete_pod_step_implies_filtered_pods_in_matching_pod_entries(vrs, controller_id)(s)
     };
-    helper_lemmas::vrs_non_interference_property_equivalent_to_lifted_vrs_non_interference_property(
+    helper_lemmas::vrs_rely_condition_equivalent_to_lifted_vrs_rely_condition(
         spec, cluster, controller_id
     );
 
@@ -2887,7 +2892,7 @@ pub proof fn lemma_from_after_receive_ok_resp_to_send_delete_pod_req(
         lift_state(cluster.every_in_flight_req_msg_from_controller_has_valid_controller_id()),
         lift_state(Cluster::each_object_in_reconcile_has_consistent_key_and_valid_metadata(controller_id)),
         lift_state(Cluster::pending_req_of_key_is_unique_with_unique_id(controller_id, vrs.object_ref())),
-        lifted_vrs_non_interference_property(cluster, controller_id),
+        lifted_vrs_rely_condition(cluster, controller_id),
         lift_state(Cluster::etcd_is_finite()),
         lift_state(helper_invariants::every_create_request_is_well_formed(cluster, controller_id)),
         lift_state(helper_invariants::no_pending_interfering_update_request()),
@@ -2955,7 +2960,7 @@ pub proof fn lemma_from_after_receive_ok_resp_at_after_delete_pod_step_to_done(
         spec.entails(always(lift_state(Cluster::each_object_in_reconcile_has_consistent_key_and_valid_metadata(controller_id)))),
         spec.entails(always(lift_state(Cluster::pending_req_of_key_is_unique_with_unique_id(controller_id, vrs.object_ref())))),
         forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-            ==> spec.entails(always(lift_state(#[trigger] vrs_not_interfered_by(other_id)))),
+            ==> spec.entails(always(lift_state(#[trigger] vrs_rely(other_id)))),
 
         spec.entails(always(lift_state(Cluster::etcd_is_finite()))),
         spec.entails(always(lift_state(helper_invariants::every_create_request_is_well_formed(cluster, controller_id)))),
@@ -3007,7 +3012,7 @@ pub proof fn lemma_from_after_receive_ok_resp_at_after_delete_pod_step_to_done(
         &&& Cluster::each_object_in_reconcile_has_consistent_key_and_valid_metadata(controller_id)(s)
         &&& Cluster::pending_req_of_key_is_unique_with_unique_id(controller_id, vrs.object_ref())(s)
         &&& forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-                ==> #[trigger] vrs_not_interfered_by(other_id)(s)
+                ==> #[trigger] vrs_rely(other_id)(s)
         &&& Cluster::etcd_is_finite()(s)
         &&& helper_invariants::every_create_request_is_well_formed(cluster, controller_id)(s)
         &&& helper_invariants::no_pending_interfering_update_request()(s)
@@ -3018,7 +3023,7 @@ pub proof fn lemma_from_after_receive_ok_resp_at_after_delete_pod_step_to_done(
         &&& helper_invariants::every_create_matching_pod_request_implies_at_after_create_pod_step(vrs, cluster.installed_types, controller_id)(s)
         &&& helper_invariants::every_delete_matching_pod_request_implies_at_after_delete_pod_step(vrs, controller_id)(s)
     };
-    helper_lemmas::vrs_non_interference_property_equivalent_to_lifted_vrs_non_interference_property(
+    helper_lemmas::vrs_rely_condition_equivalent_to_lifted_vrs_rely_condition(
         spec, cluster, controller_id
     );
 
@@ -3036,7 +3041,7 @@ pub proof fn lemma_from_after_receive_ok_resp_at_after_delete_pod_step_to_done(
         lift_state(cluster.every_in_flight_req_msg_from_controller_has_valid_controller_id()),
         lift_state(Cluster::each_object_in_reconcile_has_consistent_key_and_valid_metadata(controller_id)),
         lift_state(Cluster::pending_req_of_key_is_unique_with_unique_id(controller_id, vrs.object_ref())),
-        lifted_vrs_non_interference_property(cluster, controller_id),
+        lifted_vrs_rely_condition(cluster, controller_id),
         lift_state(Cluster::etcd_is_finite()),
         lift_state(helper_invariants::every_create_request_is_well_formed(cluster, controller_id)),
         lift_state(helper_invariants::no_pending_interfering_update_request()),
@@ -3141,7 +3146,7 @@ pub proof fn lemma_current_state_matches_is_stable(
         spec.entails(always(lift_state(Cluster::each_object_in_reconcile_has_consistent_key_and_valid_metadata(controller_id)))),
         spec.entails(always(lift_state(Cluster::pending_req_of_key_is_unique_with_unique_id(controller_id, vrs.object_ref())))),
         forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-            ==> spec.entails(always(lift_state(#[trigger] vrs_not_interfered_by(other_id)))),
+            ==> spec.entails(always(lift_state(#[trigger] vrs_rely(other_id)))),
 
         spec.entails(always(lift_state(Cluster::etcd_is_finite()))),
         spec.entails(always(lift_state(helper_invariants::every_create_request_is_well_formed(cluster, controller_id)))),
@@ -3227,7 +3232,7 @@ pub proof fn lemma_current_state_matches_is_stable(
         &&& Cluster::each_object_in_reconcile_has_consistent_key_and_valid_metadata(controller_id)(s)
         &&& Cluster::pending_req_of_key_is_unique_with_unique_id(controller_id, vrs.object_ref())(s)
         &&& forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-                ==> #[trigger] vrs_not_interfered_by(other_id)(s)
+                ==> #[trigger] vrs_rely(other_id)(s)
         &&& Cluster::etcd_is_finite()(s)
         &&& helper_invariants::every_create_request_is_well_formed(cluster, controller_id)(s)
         &&& helper_invariants::no_pending_interfering_update_request()(s)
@@ -3239,7 +3244,7 @@ pub proof fn lemma_current_state_matches_is_stable(
         &&& helper_invariants::every_delete_matching_pod_request_implies_at_after_delete_pod_step(vrs, controller_id)(s)
         &&& helper_invariants::at_after_delete_pod_step_implies_filtered_pods_in_matching_pod_entries(vrs, controller_id)(s)
     };
-    helper_lemmas::vrs_non_interference_property_equivalent_to_lifted_vrs_non_interference_property(
+    helper_lemmas::vrs_rely_condition_equivalent_to_lifted_vrs_rely_condition(
         spec, cluster, controller_id
     );
 
@@ -3262,7 +3267,7 @@ pub proof fn lemma_current_state_matches_is_stable(
         lift_state(cluster.every_in_flight_req_msg_from_controller_has_valid_controller_id()),
         lift_state(Cluster::each_object_in_reconcile_has_consistent_key_and_valid_metadata(controller_id)),
         lift_state(Cluster::pending_req_of_key_is_unique_with_unique_id(controller_id, vrs.object_ref())),
-        lifted_vrs_non_interference_property(cluster, controller_id),
+        lifted_vrs_rely_condition(cluster, controller_id),
         lift_state(Cluster::etcd_is_finite()),
         lift_state(helper_invariants::every_create_request_is_well_formed(cluster, controller_id)),
         lift_state(helper_invariants::no_pending_interfering_update_request()),
@@ -3478,7 +3483,7 @@ pub proof fn lemma_current_state_matches_is_stable(
                                             &&& forall |diff: nat| !(#[trigger] at_vrs_step_with_vrs(vrs, controller_id, VReplicaSetRecStepView::AfterDeletePod(diff))(s))
                                         });
                                         assert(forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-                                                ==> #[trigger] vrs_not_interfered_by(other_id)(s));
+                                                ==> #[trigger] vrs_rely(other_id)(s));
                                         lemma_api_request_outside_create_or_delete_loop_maintains_matching_pods(
                                             s, s_prime, vrs, cluster, controller_id, 42, current_req_msg
                                         );
@@ -3533,7 +3538,7 @@ pub proof fn lemma_current_state_matches_is_stable(
                                         &&& current_req_msg.content.is_delete_request() ==> current_req_msg.content.get_delete_request().key.kind != PodView::kind()
                                     });
                                 } else if current_req_msg.src.is_Controller() && current_req_msg.src.get_Controller_0() != controller_id {
-                                    assert(vrs_not_interfered_by(current_req_msg.src.get_Controller_0())(s));
+                                    assert(vrs_rely(current_req_msg.src.get_Controller_0())(s));
                                 } 
                             }
 
@@ -3549,7 +3554,7 @@ pub proof fn lemma_current_state_matches_is_stable(
                                             &&& forall |diff: nat| !(#[trigger] at_vrs_step_with_vrs(vrs, controller_id, VReplicaSetRecStepView::AfterDeletePod(diff))(s))
                                         });
                                         assert(forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-                                                ==> #[trigger] vrs_not_interfered_by(other_id)(s));
+                                                ==> #[trigger] vrs_rely(other_id)(s));
                                         lemma_api_request_outside_create_or_delete_loop_maintains_matching_pods(
                                             s, s_prime, vrs, cluster, controller_id, 42, current_req_msg
                                         );
diff --git a/src/v2/controllers/vreplicaset_controller/proof/liveness/spec.rs b/src/v2/controllers/vreplicaset_controller/proof/liveness/spec.rs
index 410511e28..6e4e60f88 100644
--- a/src/v2/controllers/vreplicaset_controller/proof/liveness/spec.rs
+++ b/src/v2/controllers/vreplicaset_controller/proof/liveness/spec.rs
@@ -14,7 +14,12 @@ use crate::kubernetes_cluster::{
 use crate::temporal_logic::{defs::*, rules::*};
 use crate::vreplicaset_controller::{
     model::{install::*, reconciler::*},
-    trusted::{liveness_theorem::*, spec_types::*, step::*},
+    trusted::{
+        liveness_theorem::*, 
+        rely_guarantee::*,
+        spec_types::*, 
+        step::*
+    },
     proof::{helper_invariants::{predicate::*, proof::*}, helper_lemmas::*, liveness::*, predicate::*},
 };
 use crate::reconciler::spec::io::*;
@@ -247,29 +252,29 @@ pub proof fn spec_of_previous_phases_entails_eventually_new_invariants(provided_
         cluster.controller_models.contains_pair(controller_id, vrs_controller_model()),
         // No other controllers interfere with the vrs controller.
         forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-            ==> provided_spec.entails(always(lift_state(#[trigger] vrs_not_interfered_by(other_id)))),
+            ==> provided_spec.entails(always(lift_state(#[trigger] vrs_rely(other_id)))),
     ensures provided_spec.and(spec_before_phase_n(i, vrs, cluster, controller_id)).entails(true_pred().leads_to(invariants_since_phase_n(i, vrs, cluster, controller_id))),
 {
     let spec = provided_spec.and(spec_before_phase_n(i, vrs, cluster, controller_id));
     // assert non-interference property on combined spec.
     assert forall |other_id| 
         (forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id) 
-            ==> provided_spec.entails(always(lift_state(#[trigger] vrs_not_interfered_by(other_id)))))
+            ==> provided_spec.entails(always(lift_state(#[trigger] vrs_rely(other_id)))))
         implies 
         cluster.controller_models.remove(controller_id).contains_key(other_id) 
-            ==> spec.entails(always(lift_state(#[trigger] vrs_not_interfered_by(other_id)))) by {
+            ==> spec.entails(always(lift_state(#[trigger] vrs_rely(other_id)))) by {
         if cluster.controller_models.remove(controller_id).contains_key(other_id) {
-            assert(provided_spec.entails(always(lift_state(vrs_not_interfered_by(other_id)))));
+            assert(provided_spec.entails(always(lift_state(vrs_rely(other_id)))));
             entails_and_different_temp(
                 provided_spec,
                 spec_before_phase_n(i, vrs, cluster, controller_id),
-                always(lift_state(vrs_not_interfered_by(other_id))),
+                always(lift_state(vrs_rely(other_id))),
                 true_pred()
             );
-            assert(spec.entails(always(lift_state(vrs_not_interfered_by(other_id))).and(true_pred())));
+            assert(spec.entails(always(lift_state(vrs_rely(other_id))).and(true_pred())));
             temp_pred_equality(
-                always(lift_state(vrs_not_interfered_by(other_id))).and(true_pred()),
-                always(lift_state(vrs_not_interfered_by(other_id)))
+                always(lift_state(vrs_rely(other_id))).and(true_pred()),
+                always(lift_state(vrs_rely(other_id)))
             );
         }
     }
@@ -351,17 +356,17 @@ pub proof fn spec_of_previous_phases_entails_eventually_new_invariants(provided_
 
 pub open spec fn stable_spec(cluster: Cluster, controller_id: int) -> TempPred<ClusterState> {
     next_with_wf(cluster, controller_id)
-    .and(always(lifted_vrs_non_interference_property(cluster, controller_id)))
+    .and(always(lifted_vrs_rely_condition(cluster, controller_id)))
 }
 
 pub proof fn stable_spec_is_stable(cluster: Cluster, controller_id: int)
     ensures valid(stable(stable_spec(cluster, controller_id))),
 {
     next_with_wf_is_stable(cluster, controller_id);
-    always_p_is_stable(lifted_vrs_non_interference_property(cluster, controller_id));
+    always_p_is_stable(lifted_vrs_rely_condition(cluster, controller_id));
     stable_and_n!(
         next_with_wf(cluster, controller_id),
-        always(lifted_vrs_non_interference_property(cluster, controller_id))
+        always(lifted_vrs_rely_condition(cluster, controller_id))
     );
 }
 
@@ -370,7 +375,7 @@ pub proof fn spec_and_invariants_entails_stable_spec_and_invariants(spec: TempPr
         spec.entails(lift_state(cluster.init())),
         spec.entails(next_with_wf(cluster, controller_id)),
         forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-            ==> spec.entails(always(lift_state(#[trigger] vrs_not_interfered_by(other_id)))),
+            ==> spec.entails(always(lift_state(#[trigger] vrs_rely(other_id)))),
     ensures 
         spec.and(derived_invariants_since_beginning(vrs, cluster, controller_id))
             .entails(stable_spec(cluster, controller_id).and(invariants(vrs, cluster, controller_id))),
@@ -378,7 +383,7 @@ pub proof fn spec_and_invariants_entails_stable_spec_and_invariants(spec: TempPr
     let pre = spec.and(derived_invariants_since_beginning(vrs, cluster, controller_id));
 
     // Proof of stable_spec
-    vrs_non_interference_property_equivalent_to_lifted_vrs_non_interference_property(
+    vrs_rely_condition_equivalent_to_lifted_vrs_rely_condition(
         spec,
         cluster,
         controller_id
@@ -386,7 +391,7 @@ pub proof fn spec_and_invariants_entails_stable_spec_and_invariants(spec: TempPr
     entails_and_n!(
         spec,
         next_with_wf(cluster, controller_id),
-        always(lifted_vrs_non_interference_property(cluster, controller_id))
+        always(lifted_vrs_rely_condition(cluster, controller_id))
     );
     
     entails_and_different_temp(
diff --git a/src/v2/controllers/vreplicaset_controller/proof/predicate.rs b/src/v2/controllers/vreplicaset_controller/proof/predicate.rs
index f6161599c..02ffd72f7 100644
--- a/src/v2/controllers/vreplicaset_controller/proof/predicate.rs
+++ b/src/v2/controllers/vreplicaset_controller/proof/predicate.rs
@@ -10,26 +10,31 @@ use crate::kubernetes_cluster::spec::{
 use crate::temporal_logic::{defs::*, rules::*};
 use crate::vreplicaset_controller::{
     model::{install::*, reconciler::*},
-    trusted::{liveness_theorem::*, spec_types::*, step::*},
+    trusted::{
+        liveness_theorem::*,
+        rely_guarantee::*,
+        spec_types::*, 
+        step::*
+    },
 };
 use vstd::prelude::*;
 
 verus! {
 
 // General helper predicates
-pub open spec fn lifted_vrs_non_interference_property(cluster: Cluster, controller_id: int) -> TempPred<ClusterState> {
+pub open spec fn lifted_vrs_rely_condition(cluster: Cluster, controller_id: int) -> TempPred<ClusterState> {
     lift_state(|s| {
         forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-            ==> #[trigger] vrs_not_interfered_by(other_id)(s)
+            ==> #[trigger] vrs_rely(other_id)(s)
     })
 }
 
-pub open spec fn lifted_vrs_non_interference_property_action(cluster: Cluster, controller_id: int) -> TempPred<ClusterState> {
+pub open spec fn lifted_vrs_rely_condition_action(cluster: Cluster, controller_id: int) -> TempPred<ClusterState> {
     lift_action(|s, s_prime| {
         (forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-            ==> #[trigger] vrs_not_interfered_by(other_id)(s))
+            ==> #[trigger] vrs_rely(other_id)(s))
         && (forall |other_id| cluster.controller_models.remove(controller_id).contains_key(other_id)
-                ==> #[trigger] vrs_not_interfered_by(other_id)(s_prime))
+                ==> #[trigger] vrs_rely(other_id)(s_prime))
     })
 }
 
diff --git a/src/v2/controllers/vreplicaset_controller/trusted/liveness_theorem.rs b/src/v2/controllers/vreplicaset_controller/trusted/liveness_theorem.rs
index d575597b5..6b86eb755 100644
--- a/src/v2/controllers/vreplicaset_controller/trusted/liveness_theorem.rs
+++ b/src/v2/controllers/vreplicaset_controller/trusted/liveness_theorem.rs
@@ -1,5 +1,5 @@
 use crate::kubernetes_api_objects::spec::prelude::*;
-use crate::kubernetes_cluster::spec::{cluster::*, message::*};
+use crate::kubernetes_cluster::spec::cluster::*;
 use crate::temporal_logic::defs::*;
 use crate::vreplicaset_controller::trusted::spec_types::*;
 use vstd::prelude::*;
@@ -33,101 +33,4 @@ pub open spec fn owned_selector_match_is(vrs: VReplicaSetView, obj: DynamicObjec
     &&& obj.metadata.deletion_timestamp.is_None()
 }
 
-// Other controllers don't create pods owned by a VReplicaSet.
-pub open spec fn vrs_not_interfered_by_create_req(req: CreateRequest) -> StatePred<ClusterState> {
-    |s: ClusterState| {
-        req.obj.kind == Kind::PodKind ==> !{
-            let owner_references = req.obj.metadata.owner_references.get_Some_0();
-            &&& req.obj.metadata.owner_references.is_Some()
-            &&& exists |vrs: VReplicaSetView| 
-                #[trigger] owner_references.contains(vrs.controller_owner_ref())
-        }
-    }
-}
-
-// Update requests to pods must carry a resource version on them (despite 
-// the underlying kind permitting unconditional updates). Also, update requests
-// cannot 1) update pods owned by a VReplicaSet, or 2) update pods to become owned
-// by a VReplicaSet.
-pub open spec fn vrs_not_interfered_by_update_req(req: UpdateRequest) -> StatePred<ClusterState> {
-    |s: ClusterState| {
-        req.obj.kind == Kind::PodKind ==>
-            req.obj.metadata.resource_version.is_Some()
-            // Prevents 1): where other controllers update pods already owned
-            // by a VReplicaSet.
-            && !{
-                let etcd_obj = s.resources()[req.key()];
-                let owner_references = etcd_obj.metadata.owner_references.get_Some_0();
-                &&& s.resources().contains_key(req.key())
-                &&& etcd_obj.metadata.resource_version.is_Some()
-                &&& etcd_obj.metadata.resource_version == req.obj.metadata.resource_version
-                &&& etcd_obj.metadata.owner_references.is_Some()
-                &&& exists |vrs: VReplicaSetView| 
-                    #[trigger] owner_references.contains(vrs.controller_owner_ref())
-            }
-            // Prevents 2): where other controllers update pods so they become
-            // owned by a VReplicaSet.
-            && (req.obj.metadata.owner_references.is_Some() ==>
-                    forall |vrs: VReplicaSetView| 
-                        ! #[trigger] req.obj.metadata.owner_references.get_Some_0().contains(vrs.controller_owner_ref()))
-    }
-}
-
-// Dealt with similarly to update requests, minus the condition on 
-// owner_references.
-// TODO: allow other controllers to send UpdateStatus
-// requests to owned pods after we address the fairness issues.
-pub open spec fn vrs_not_interfered_by_update_status_req(req: UpdateStatusRequest) -> StatePred<ClusterState> {
-    |s: ClusterState| {
-        req.obj.kind == Kind::PodKind ==> 
-            req.obj.metadata.resource_version.is_Some()
-            && !{
-                let etcd_obj = s.resources()[req.key()];
-                let owner_references = etcd_obj.metadata.owner_references.get_Some_0();
-                &&& s.resources().contains_key(req.key())
-                &&& etcd_obj.metadata.resource_version.is_Some()
-                &&& etcd_obj.metadata.resource_version == req.obj.metadata.resource_version
-                &&& etcd_obj.metadata.owner_references.is_Some()
-                &&& exists |vrs: VReplicaSetView| 
-                    #[trigger] owner_references.contains(vrs.controller_owner_ref())
-            }
-    }
-}
-
-// All delete requests to pods carry a precondition on the resource version,
-// and other controllers don't try to delete pods owned by a VReplicaSet.
-pub open spec fn vrs_not_interfered_by_delete_req(req: DeleteRequest) -> StatePred<ClusterState> {
-    |s: ClusterState| {
-        req.key.kind == Kind::PodKind ==>
-            req.preconditions.is_Some()
-            && req.preconditions.get_Some_0().resource_version.is_Some()
-            && !{
-                let etcd_obj = s.resources()[req.key];
-                let owner_references = etcd_obj.metadata.owner_references.get_Some_0();
-                &&& s.resources().contains_key(req.key)
-                &&& etcd_obj.metadata.resource_version.is_Some()
-                &&& etcd_obj.metadata.resource_version
-                    == req.preconditions.get_Some_0().resource_version
-                &&& etcd_obj.metadata.owner_references.is_Some()
-                &&& exists |vrs: VReplicaSetView| 
-                    #[trigger] owner_references.contains(vrs.controller_owner_ref())
-            }
-    }
-}
-
-pub open spec fn vrs_not_interfered_by(other_id: int) -> StatePred<ClusterState> {
-    |s: ClusterState| {
-        forall |msg| {
-            &&& #[trigger] s.in_flight().contains(msg)
-            &&& msg.content.is_APIRequest()
-            &&& msg.src == HostId::Controller(other_id)
-        } ==> match msg.content.get_APIRequest_0() {
-            APIRequest::CreateRequest(req) => vrs_not_interfered_by_create_req(req)(s),
-            APIRequest::UpdateRequest(req) => vrs_not_interfered_by_update_req(req)(s),
-            APIRequest::UpdateStatusRequest(req) => vrs_not_interfered_by_update_status_req(req)(s),
-            APIRequest::DeleteRequest(req) => vrs_not_interfered_by_delete_req(req)(s),
-            _ => true,
-        }
-    }
-}
 }
diff --git a/src/v2/controllers/vreplicaset_controller/trusted/mod.rs b/src/v2/controllers/vreplicaset_controller/trusted/mod.rs
index 4f5a75bc4..14eab63a2 100644
--- a/src/v2/controllers/vreplicaset_controller/trusted/mod.rs
+++ b/src/v2/controllers/vreplicaset_controller/trusted/mod.rs
@@ -2,5 +2,6 @@
 // SPDX-License-Identifier: MIT
 pub mod exec_types;
 pub mod liveness_theorem;
+pub mod rely_guarantee;
 pub mod spec_types;
 pub mod step;
diff --git a/src/v2/controllers/vreplicaset_controller/trusted/rely_guarantee.rs b/src/v2/controllers/vreplicaset_controller/trusted/rely_guarantee.rs
new file mode 100644
index 000000000..92a395d66
--- /dev/null
+++ b/src/v2/controllers/vreplicaset_controller/trusted/rely_guarantee.rs
@@ -0,0 +1,164 @@
+use crate::kubernetes_api_objects::spec::prelude::*;
+use crate::kubernetes_cluster::spec::{cluster::*, message::*};
+use crate::temporal_logic::defs::*;
+use crate::vreplicaset_controller::trusted::spec_types::*;
+use vstd::prelude::*;
+
+verus! {
+
+// VRS Rely Condition
+
+// Other controllers don't create pods owned by a VReplicaSet.
+pub open spec fn vrs_rely_create_req(req: CreateRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        req.obj.kind == Kind::PodKind ==> !{
+            let owner_references = req.obj.metadata.owner_references.get_Some_0();
+            &&& req.obj.metadata.owner_references.is_Some()
+            &&& exists |vrs: VReplicaSetView| 
+                #[trigger] owner_references.contains(vrs.controller_owner_ref())
+        }
+    }
+}
+
+// Update requests to pods must carry a resource version on them (despite 
+// the underlying kind permitting unconditional updates). Also, update requests
+// cannot 1) update pods owned by a VReplicaSet, or 2) update pods to become owned
+// by a VReplicaSet.
+pub open spec fn vrs_rely_update_req(req: UpdateRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        req.obj.kind == Kind::PodKind ==>
+            req.obj.metadata.resource_version.is_Some()
+            // Prevents 1): where other controllers update pods already owned
+            // by a VReplicaSet.
+            && !{
+                let etcd_obj = s.resources()[req.key()];
+                let owner_references = etcd_obj.metadata.owner_references.get_Some_0();
+                &&& s.resources().contains_key(req.key())
+                &&& etcd_obj.metadata.resource_version.is_Some()
+                &&& etcd_obj.metadata.resource_version == req.obj.metadata.resource_version
+                &&& etcd_obj.metadata.owner_references.is_Some()
+                &&& exists |vrs: VReplicaSetView| 
+                    #[trigger] owner_references.contains(vrs.controller_owner_ref())
+            }
+            // Prevents 2): where other controllers update pods so they become
+            // owned by a VReplicaSet.
+            && (req.obj.metadata.owner_references.is_Some() ==>
+                    forall |vrs: VReplicaSetView| 
+                        ! #[trigger] req.obj.metadata.owner_references.get_Some_0().contains(vrs.controller_owner_ref()))
+    }
+}
+
+// Dealt with similarly to update requests, minus the condition on 
+// owner_references.
+// TODO: allow other controllers to send UpdateStatus
+// requests to owned pods after we address the fairness issues.
+pub open spec fn vrs_rely_update_status_req(req: UpdateStatusRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        req.obj.kind == Kind::PodKind ==> 
+            req.obj.metadata.resource_version.is_Some()
+            && !{
+                let etcd_obj = s.resources()[req.key()];
+                let owner_references = etcd_obj.metadata.owner_references.get_Some_0();
+                &&& s.resources().contains_key(req.key())
+                &&& etcd_obj.metadata.resource_version.is_Some()
+                &&& etcd_obj.metadata.resource_version == req.obj.metadata.resource_version
+                &&& etcd_obj.metadata.owner_references.is_Some()
+                &&& exists |vrs: VReplicaSetView| 
+                    #[trigger] owner_references.contains(vrs.controller_owner_ref())
+            }
+    }
+}
+
+// All delete requests to pods carry a precondition on the resource version,
+// and other controllers don't try to delete pods owned by a VReplicaSet.
+pub open spec fn vrs_rely_delete_req(req: DeleteRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        req.key.kind == Kind::PodKind ==>
+            req.preconditions.is_Some()
+            && req.preconditions.get_Some_0().resource_version.is_Some()
+            && !{
+                let etcd_obj = s.resources()[req.key];
+                let owner_references = etcd_obj.metadata.owner_references.get_Some_0();
+                &&& s.resources().contains_key(req.key)
+                &&& etcd_obj.metadata.resource_version.is_Some()
+                &&& etcd_obj.metadata.resource_version
+                    == req.preconditions.get_Some_0().resource_version
+                &&& etcd_obj.metadata.owner_references.is_Some()
+                &&& exists |vrs: VReplicaSetView| 
+                    #[trigger] owner_references.contains(vrs.controller_owner_ref())
+            }
+    }
+}
+
+pub open spec fn vrs_rely(other_id: int) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        forall |msg| {
+            &&& #[trigger] s.in_flight().contains(msg)
+            &&& msg.content.is_APIRequest()
+            &&& msg.src == HostId::Controller(other_id)
+        } ==> match msg.content.get_APIRequest_0() {
+            APIRequest::CreateRequest(req) => vrs_rely_create_req(req)(s),
+            APIRequest::UpdateRequest(req) => vrs_rely_update_req(req)(s),
+            APIRequest::UpdateStatusRequest(req) => vrs_rely_update_status_req(req)(s),
+            APIRequest::DeleteRequest(req) => vrs_rely_delete_req(req)(s),
+            _ => true,
+        }
+    }
+}
+
+// VRS Guarantee Condition
+
+// VRS only creates pods owned by a VReplicaSet.
+pub open spec fn vrs_guarantee_create_req(req: CreateRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        let owner_references = req.obj.metadata.owner_references.get_Some_0();
+        &&& req.obj.kind == Kind::PodKind
+        &&& req.obj.metadata.owner_references.is_Some()
+        &&& exists |vrs: VReplicaSetView| 
+            owner_references == seq![#[trigger] vrs.controller_owner_ref()]
+    }
+}
+
+// VRS only sends delete requests to pods that carry a resource version precondition,
+// and if the resource version carried matches the one in the corresponding etcd
+// object, then that object is owned by a VReplicaSet.
+pub open spec fn vrs_guarantee_delete_req(req: DeleteRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        let etcd_obj = s.resources()[req.key];
+        &&& req.key.kind == Kind::PodKind
+        &&& req.preconditions.is_Some()
+        &&& req.preconditions.get_Some_0().resource_version.is_Some()
+        &&& {
+            &&& s.resources().contains_key(req.key)
+            &&& etcd_obj.metadata.resource_version 
+                == req.preconditions.get_Some_0().resource_version
+        } ==> {
+            let controller_owners = etcd_obj.metadata.owner_references
+                .get_Some_0()
+                .filter(|o: OwnerReferenceView| {
+                    o.controller.is_Some() && o.controller.get_Some_0()
+                });
+            &&& etcd_obj.metadata.owner_references.is_Some()
+            &&& exists |vrs: VReplicaSetView| 
+                controller_owners == seq![#[trigger] vrs.controller_owner_ref()]
+        }
+    }
+}
+
+pub open spec fn vrs_guarantee(controller_id: int) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        forall |msg| {
+            &&& #[trigger] s.in_flight().contains(msg)
+            &&& msg.content.is_APIRequest()
+            &&& msg.src == HostId::Controller(controller_id)
+        } ==> match msg.content.get_APIRequest_0() {
+            APIRequest::ListRequest(_) => true,
+            APIRequest::CreateRequest(req) => vrs_guarantee_create_req(req)(s),
+            APIRequest::DeleteRequest(req) => vrs_guarantee_delete_req(req)(s),
+            _ => false, // vrs doesn't send other requests (yet).
+        }
+    }
+}
+
+
+}


Reviews:
user: login: marshtompsxd
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-05-01T15:20:41Z
user: login: marshtompsxd
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-05-01T15:23:30Z
user: login: marshtompsxd
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-05-01T15:24:03Z
user: login: codyjrivera
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-05-01T16:02:40Z
user: login: marshtompsxd
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-05-01T18:20:44Z
user: login: marshtompsxd
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-05-03T02:55:12Z
user: login: codyjrivera
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-05-03T14:09:44Z
user: login: marshtompsxd
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-05-03T14:38:22Z
user: login: codyjrivera
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-05-03T15:41:55Z
user: login: marshtompsxd
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-05-03T15:47:04Z

Review comments:
diff_hunk: @@ -0,0 +1,167 @@
+use crate::kubernetes_api_objects::spec::prelude::*;
+use crate::kubernetes_cluster::spec::{
+    cluster::*, 
+    message::*,
+    retentive_cluster::*
+};
+use crate::temporal_logic::defs::*;
+use crate::vreplicaset_controller::trusted::spec_types::*;
+use vstd::prelude::*;
+
+verus! {
+
+// VRS Rely Condition
+
+// Other controllers don't create pods owned by a VReplicaSet.
+pub open spec fn vrs_rely_create_req(req: CreateRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        req.obj.kind == Kind::PodKind ==> !{
+            let owner_references = req.obj.metadata.owner_references.get_Some_0();
+            &&& req.obj.metadata.owner_references.is_Some()
+            &&& exists |vrs: VReplicaSetView| 
+                #[trigger] owner_references.contains(vrs.controller_owner_ref())
+        }
+    }
+}
+
+// Update requests to pods must carry a resource version on them (despite 
+// the underlying kind permitting unconditional updates). Also, update requests
+// cannot 1) update pods owned by a VReplicaSet, or 2) update pods to become owned
+// by a VReplicaSet.
+pub open spec fn vrs_rely_update_req(req: UpdateRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        req.obj.kind == Kind::PodKind ==>
+            req.obj.metadata.resource_version.is_Some()
+            // Prevents 1): where other controllers update pods already owned
+            // by a VReplicaSet.
+            && !{
+                let etcd_obj = s.resources()[req.key()];
+                let owner_references = etcd_obj.metadata.owner_references.get_Some_0();
+                &&& s.resources().contains_key(req.key())
+                &&& etcd_obj.metadata.resource_version.is_Some()
+                &&& etcd_obj.metadata.resource_version == req.obj.metadata.resource_version
+                &&& etcd_obj.metadata.owner_references.is_Some()
+                &&& exists |vrs: VReplicaSetView| 
+                    #[trigger] owner_references.contains(vrs.controller_owner_ref())
+            }
+            // Prevents 2): where other controllers update pods so they become
+            // owned by a VReplicaSet.
+            && (req.obj.metadata.owner_references.is_Some() ==>
+                    forall |vrs: VReplicaSetView| 
+                        ! #[trigger] req.obj.metadata.owner_references.get_Some_0().contains(vrs.controller_owner_ref()))
+    }
+}
+
+// Dealt with similarly to update requests, minus the condition on 
+// owner_references.
+// TODO: allow other controllers to send UpdateStatus
+// requests to owned pods after we address the fairness issues.
+pub open spec fn vrs_rely_update_status_req(req: UpdateStatusRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        req.obj.kind == Kind::PodKind ==> 
+            req.obj.metadata.resource_version.is_Some()
+            && !{
+                let etcd_obj = s.resources()[req.key()];
+                let owner_references = etcd_obj.metadata.owner_references.get_Some_0();
+                &&& s.resources().contains_key(req.key())
+                &&& etcd_obj.metadata.resource_version.is_Some()
+                &&& etcd_obj.metadata.resource_version == req.obj.metadata.resource_version
+                &&& etcd_obj.metadata.owner_references.is_Some()
+                &&& exists |vrs: VReplicaSetView| 
+                    #[trigger] owner_references.contains(vrs.controller_owner_ref())
+            }
+    }
+}
+
+// All delete requests to pods carry a precondition on the resource version,
+// and other controllers don't try to delete pods owned by a VReplicaSet.
+pub open spec fn vrs_rely_delete_req(req: DeleteRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        req.key.kind == Kind::PodKind ==>
+            req.preconditions.is_Some()
+            && req.preconditions.get_Some_0().resource_version.is_Some()
+            && !{
+                let etcd_obj = s.resources()[req.key];
+                let owner_references = etcd_obj.metadata.owner_references.get_Some_0();
+                &&& s.resources().contains_key(req.key)
+                &&& etcd_obj.metadata.resource_version.is_Some()
+                &&& etcd_obj.metadata.resource_version
+                    == req.preconditions.get_Some_0().resource_version
+                &&& etcd_obj.metadata.owner_references.is_Some()
+                &&& exists |vrs: VReplicaSetView| 
+                    #[trigger] owner_references.contains(vrs.controller_owner_ref())
+            }
+    }
+}
+
+pub open spec fn vrs_rely(other_id: int) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        forall |msg| {
+            &&& #[trigger] s.in_flight().contains(msg)
+            &&& msg.content.is_APIRequest()
+            &&& msg.src == HostId::Controller(other_id)
+        } ==> match msg.content.get_APIRequest_0() {
+            APIRequest::CreateRequest(req) => vrs_rely_create_req(req)(s),
+            APIRequest::UpdateRequest(req) => vrs_rely_update_req(req)(s),
+            APIRequest::UpdateStatusRequest(req) => vrs_rely_update_status_req(req)(s),
+            APIRequest::DeleteRequest(req) => vrs_rely_delete_req(req)(s),
+            _ => true,
+        }
+    }
+}
+
+// VRS Guarantee Condition
+
+// VRS only creates pods owned by a VReplicaSet.
+pub open spec fn vrs_guarantee_create_req(req: CreateRequest) -> StatePred<ClusterHistory> {
+    |h: ClusterHistory| {
+        let owner_references = req.obj.metadata.owner_references.get_Some_0();
+        &&& req.obj.kind == Kind::PodKind
+        &&& req.obj.metadata.owner_references.is_Some()
+        &&& exists |vrs: VReplicaSetView| 
+            #[trigger] owner_references.contains(vrs.controller_owner_ref())
path: src/v2/controllers/vreplicaset_controller/trusted/rely_guarantee.rs
user: login: marshtompsxd
body: @codyjrivera You might want to enhance it to state that there is only one controller_owner_ref in owner_references which is vrs.
created_at: 2025-05-01T15:20:41Z
author_association: COLLABORATOR
diff_hunk: @@ -0,0 +1,167 @@
+use crate::kubernetes_api_objects::spec::prelude::*;
+use crate::kubernetes_cluster::spec::{
+    cluster::*, 
+    message::*,
+    retentive_cluster::*
+};
+use crate::temporal_logic::defs::*;
+use crate::vreplicaset_controller::trusted::spec_types::*;
+use vstd::prelude::*;
+
+verus! {
+
+// VRS Rely Condition
+
+// Other controllers don't create pods owned by a VReplicaSet.
+pub open spec fn vrs_rely_create_req(req: CreateRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        req.obj.kind == Kind::PodKind ==> !{
+            let owner_references = req.obj.metadata.owner_references.get_Some_0();
+            &&& req.obj.metadata.owner_references.is_Some()
+            &&& exists |vrs: VReplicaSetView| 
+                #[trigger] owner_references.contains(vrs.controller_owner_ref())
+        }
+    }
+}
+
+// Update requests to pods must carry a resource version on them (despite 
+// the underlying kind permitting unconditional updates). Also, update requests
+// cannot 1) update pods owned by a VReplicaSet, or 2) update pods to become owned
+// by a VReplicaSet.
+pub open spec fn vrs_rely_update_req(req: UpdateRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        req.obj.kind == Kind::PodKind ==>
+            req.obj.metadata.resource_version.is_Some()
+            // Prevents 1): where other controllers update pods already owned
+            // by a VReplicaSet.
+            && !{
+                let etcd_obj = s.resources()[req.key()];
+                let owner_references = etcd_obj.metadata.owner_references.get_Some_0();
+                &&& s.resources().contains_key(req.key())
+                &&& etcd_obj.metadata.resource_version.is_Some()
+                &&& etcd_obj.metadata.resource_version == req.obj.metadata.resource_version
+                &&& etcd_obj.metadata.owner_references.is_Some()
+                &&& exists |vrs: VReplicaSetView| 
+                    #[trigger] owner_references.contains(vrs.controller_owner_ref())
+            }
+            // Prevents 2): where other controllers update pods so they become
+            // owned by a VReplicaSet.
+            && (req.obj.metadata.owner_references.is_Some() ==>
+                    forall |vrs: VReplicaSetView| 
+                        ! #[trigger] req.obj.metadata.owner_references.get_Some_0().contains(vrs.controller_owner_ref()))
+    }
+}
+
+// Dealt with similarly to update requests, minus the condition on 
+// owner_references.
+// TODO: allow other controllers to send UpdateStatus
+// requests to owned pods after we address the fairness issues.
+pub open spec fn vrs_rely_update_status_req(req: UpdateStatusRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        req.obj.kind == Kind::PodKind ==> 
+            req.obj.metadata.resource_version.is_Some()
+            && !{
+                let etcd_obj = s.resources()[req.key()];
+                let owner_references = etcd_obj.metadata.owner_references.get_Some_0();
+                &&& s.resources().contains_key(req.key())
+                &&& etcd_obj.metadata.resource_version.is_Some()
+                &&& etcd_obj.metadata.resource_version == req.obj.metadata.resource_version
+                &&& etcd_obj.metadata.owner_references.is_Some()
+                &&& exists |vrs: VReplicaSetView| 
+                    #[trigger] owner_references.contains(vrs.controller_owner_ref())
+            }
+    }
+}
+
+// All delete requests to pods carry a precondition on the resource version,
+// and other controllers don't try to delete pods owned by a VReplicaSet.
+pub open spec fn vrs_rely_delete_req(req: DeleteRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        req.key.kind == Kind::PodKind ==>
+            req.preconditions.is_Some()
+            && req.preconditions.get_Some_0().resource_version.is_Some()
+            && !{
+                let etcd_obj = s.resources()[req.key];
+                let owner_references = etcd_obj.metadata.owner_references.get_Some_0();
+                &&& s.resources().contains_key(req.key)
+                &&& etcd_obj.metadata.resource_version.is_Some()
+                &&& etcd_obj.metadata.resource_version
+                    == req.preconditions.get_Some_0().resource_version
+                &&& etcd_obj.metadata.owner_references.is_Some()
+                &&& exists |vrs: VReplicaSetView| 
+                    #[trigger] owner_references.contains(vrs.controller_owner_ref())
+            }
+    }
+}
+
+pub open spec fn vrs_rely(other_id: int) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        forall |msg| {
+            &&& #[trigger] s.in_flight().contains(msg)
+            &&& msg.content.is_APIRequest()
+            &&& msg.src == HostId::Controller(other_id)
+        } ==> match msg.content.get_APIRequest_0() {
+            APIRequest::CreateRequest(req) => vrs_rely_create_req(req)(s),
+            APIRequest::UpdateRequest(req) => vrs_rely_update_req(req)(s),
+            APIRequest::UpdateStatusRequest(req) => vrs_rely_update_status_req(req)(s),
+            APIRequest::DeleteRequest(req) => vrs_rely_delete_req(req)(s),
+            _ => true,
+        }
+    }
+}
+
+// VRS Guarantee Condition
+
+// VRS only creates pods owned by a VReplicaSet.
+pub open spec fn vrs_guarantee_create_req(req: CreateRequest) -> StatePred<ClusterHistory> {
+    |h: ClusterHistory| {
+        let owner_references = req.obj.metadata.owner_references.get_Some_0();
+        &&& req.obj.kind == Kind::PodKind
+        &&& req.obj.metadata.owner_references.is_Some()
+        &&& exists |vrs: VReplicaSetView| 
+            #[trigger] owner_references.contains(vrs.controller_owner_ref())
+    }
+}
+
+// VRS only sends delete requests to pods known to have been in etcd and 
+// owned by a VReplicaSet at some point in history. The request will
+// carry a precondition that matches the resource version of the historical
+// etcd object.
+pub open spec fn vrs_guarantee_delete_req(req: DeleteRequest) -> StatePred<ClusterHistory> {
path: src/v2/controllers/vreplicaset_controller/trusted/rely_guarantee.rs
user: login: marshtompsxd
body: The delete guarantee should not talk about the history. It should just say for any pod delete request sent by this vrs controller, if that object in etcd matches the RV in precondition, then that object is owned by VRS.
created_at: 2025-05-01T15:23:30Z
author_association: COLLABORATOR
diff_hunk: @@ -0,0 +1,167 @@
+use crate::kubernetes_api_objects::spec::prelude::*;
+use crate::kubernetes_cluster::spec::{
+    cluster::*, 
+    message::*,
+    retentive_cluster::*
+};
+use crate::temporal_logic::defs::*;
+use crate::vreplicaset_controller::trusted::spec_types::*;
+use vstd::prelude::*;
+
+verus! {
+
+// VRS Rely Condition
+
+// Other controllers don't create pods owned by a VReplicaSet.
+pub open spec fn vrs_rely_create_req(req: CreateRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        req.obj.kind == Kind::PodKind ==> !{
+            let owner_references = req.obj.metadata.owner_references.get_Some_0();
+            &&& req.obj.metadata.owner_references.is_Some()
+            &&& exists |vrs: VReplicaSetView| 
+                #[trigger] owner_references.contains(vrs.controller_owner_ref())
+        }
+    }
+}
+
+// Update requests to pods must carry a resource version on them (despite 
+// the underlying kind permitting unconditional updates). Also, update requests
+// cannot 1) update pods owned by a VReplicaSet, or 2) update pods to become owned
+// by a VReplicaSet.
+pub open spec fn vrs_rely_update_req(req: UpdateRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        req.obj.kind == Kind::PodKind ==>
+            req.obj.metadata.resource_version.is_Some()
+            // Prevents 1): where other controllers update pods already owned
+            // by a VReplicaSet.
+            && !{
+                let etcd_obj = s.resources()[req.key()];
+                let owner_references = etcd_obj.metadata.owner_references.get_Some_0();
+                &&& s.resources().contains_key(req.key())
+                &&& etcd_obj.metadata.resource_version.is_Some()
+                &&& etcd_obj.metadata.resource_version == req.obj.metadata.resource_version
+                &&& etcd_obj.metadata.owner_references.is_Some()
+                &&& exists |vrs: VReplicaSetView| 
+                    #[trigger] owner_references.contains(vrs.controller_owner_ref())
+            }
+            // Prevents 2): where other controllers update pods so they become
+            // owned by a VReplicaSet.
+            && (req.obj.metadata.owner_references.is_Some() ==>
+                    forall |vrs: VReplicaSetView| 
+                        ! #[trigger] req.obj.metadata.owner_references.get_Some_0().contains(vrs.controller_owner_ref()))
+    }
+}
+
+// Dealt with similarly to update requests, minus the condition on 
+// owner_references.
+// TODO: allow other controllers to send UpdateStatus
+// requests to owned pods after we address the fairness issues.
+pub open spec fn vrs_rely_update_status_req(req: UpdateStatusRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        req.obj.kind == Kind::PodKind ==> 
+            req.obj.metadata.resource_version.is_Some()
+            && !{
+                let etcd_obj = s.resources()[req.key()];
+                let owner_references = etcd_obj.metadata.owner_references.get_Some_0();
+                &&& s.resources().contains_key(req.key())
+                &&& etcd_obj.metadata.resource_version.is_Some()
+                &&& etcd_obj.metadata.resource_version == req.obj.metadata.resource_version
+                &&& etcd_obj.metadata.owner_references.is_Some()
+                &&& exists |vrs: VReplicaSetView| 
+                    #[trigger] owner_references.contains(vrs.controller_owner_ref())
+            }
+    }
+}
+
+// All delete requests to pods carry a precondition on the resource version,
+// and other controllers don't try to delete pods owned by a VReplicaSet.
+pub open spec fn vrs_rely_delete_req(req: DeleteRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        req.key.kind == Kind::PodKind ==>
+            req.preconditions.is_Some()
+            && req.preconditions.get_Some_0().resource_version.is_Some()
+            && !{
+                let etcd_obj = s.resources()[req.key];
+                let owner_references = etcd_obj.metadata.owner_references.get_Some_0();
+                &&& s.resources().contains_key(req.key)
+                &&& etcd_obj.metadata.resource_version.is_Some()
+                &&& etcd_obj.metadata.resource_version
+                    == req.preconditions.get_Some_0().resource_version
+                &&& etcd_obj.metadata.owner_references.is_Some()
+                &&& exists |vrs: VReplicaSetView| 
+                    #[trigger] owner_references.contains(vrs.controller_owner_ref())
+            }
+    }
+}
+
+pub open spec fn vrs_rely(other_id: int) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        forall |msg| {
+            &&& #[trigger] s.in_flight().contains(msg)
+            &&& msg.content.is_APIRequest()
+            &&& msg.src == HostId::Controller(other_id)
+        } ==> match msg.content.get_APIRequest_0() {
+            APIRequest::CreateRequest(req) => vrs_rely_create_req(req)(s),
+            APIRequest::UpdateRequest(req) => vrs_rely_update_req(req)(s),
+            APIRequest::UpdateStatusRequest(req) => vrs_rely_update_status_req(req)(s),
+            APIRequest::DeleteRequest(req) => vrs_rely_delete_req(req)(s),
+            _ => true,
+        }
+    }
+}
+
+// VRS Guarantee Condition
+
+// VRS only creates pods owned by a VReplicaSet.
+pub open spec fn vrs_guarantee_create_req(req: CreateRequest) -> StatePred<ClusterHistory> {
+    |h: ClusterHistory| {
+        let owner_references = req.obj.metadata.owner_references.get_Some_0();
+        &&& req.obj.kind == Kind::PodKind
+        &&& req.obj.metadata.owner_references.is_Some()
+        &&& exists |vrs: VReplicaSetView| 
+            #[trigger] owner_references.contains(vrs.controller_owner_ref())
+    }
+}
+
+// VRS only sends delete requests to pods known to have been in etcd and 
+// owned by a VReplicaSet at some point in history. The request will
+// carry a precondition that matches the resource version of the historical
+// etcd object.
+pub open spec fn vrs_guarantee_delete_req(req: DeleteRequest) -> StatePred<ClusterHistory> {
path: src/v2/controllers/vreplicaset_controller/trusted/rely_guarantee.rs
user: login: marshtompsxd
body: You will have intermediate lemmas that talk about history, but they are only used for proof. They should not be part of the interface.
created_at: 2025-05-01T15:24:03Z
author_association: COLLABORATOR
diff_hunk: @@ -0,0 +1,167 @@
+use crate::kubernetes_api_objects::spec::prelude::*;
+use crate::kubernetes_cluster::spec::{
+    cluster::*, 
+    message::*,
+    retentive_cluster::*
+};
+use crate::temporal_logic::defs::*;
+use crate::vreplicaset_controller::trusted::spec_types::*;
+use vstd::prelude::*;
+
+verus! {
+
+// VRS Rely Condition
+
+// Other controllers don't create pods owned by a VReplicaSet.
+pub open spec fn vrs_rely_create_req(req: CreateRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        req.obj.kind == Kind::PodKind ==> !{
+            let owner_references = req.obj.metadata.owner_references.get_Some_0();
+            &&& req.obj.metadata.owner_references.is_Some()
+            &&& exists |vrs: VReplicaSetView| 
+                #[trigger] owner_references.contains(vrs.controller_owner_ref())
+        }
+    }
+}
+
+// Update requests to pods must carry a resource version on them (despite 
+// the underlying kind permitting unconditional updates). Also, update requests
+// cannot 1) update pods owned by a VReplicaSet, or 2) update pods to become owned
+// by a VReplicaSet.
+pub open spec fn vrs_rely_update_req(req: UpdateRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        req.obj.kind == Kind::PodKind ==>
+            req.obj.metadata.resource_version.is_Some()
+            // Prevents 1): where other controllers update pods already owned
+            // by a VReplicaSet.
+            && !{
+                let etcd_obj = s.resources()[req.key()];
+                let owner_references = etcd_obj.metadata.owner_references.get_Some_0();
+                &&& s.resources().contains_key(req.key())
+                &&& etcd_obj.metadata.resource_version.is_Some()
+                &&& etcd_obj.metadata.resource_version == req.obj.metadata.resource_version
+                &&& etcd_obj.metadata.owner_references.is_Some()
+                &&& exists |vrs: VReplicaSetView| 
+                    #[trigger] owner_references.contains(vrs.controller_owner_ref())
+            }
+            // Prevents 2): where other controllers update pods so they become
+            // owned by a VReplicaSet.
+            && (req.obj.metadata.owner_references.is_Some() ==>
+                    forall |vrs: VReplicaSetView| 
+                        ! #[trigger] req.obj.metadata.owner_references.get_Some_0().contains(vrs.controller_owner_ref()))
+    }
+}
+
+// Dealt with similarly to update requests, minus the condition on 
+// owner_references.
+// TODO: allow other controllers to send UpdateStatus
+// requests to owned pods after we address the fairness issues.
+pub open spec fn vrs_rely_update_status_req(req: UpdateStatusRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        req.obj.kind == Kind::PodKind ==> 
+            req.obj.metadata.resource_version.is_Some()
+            && !{
+                let etcd_obj = s.resources()[req.key()];
+                let owner_references = etcd_obj.metadata.owner_references.get_Some_0();
+                &&& s.resources().contains_key(req.key())
+                &&& etcd_obj.metadata.resource_version.is_Some()
+                &&& etcd_obj.metadata.resource_version == req.obj.metadata.resource_version
+                &&& etcd_obj.metadata.owner_references.is_Some()
+                &&& exists |vrs: VReplicaSetView| 
+                    #[trigger] owner_references.contains(vrs.controller_owner_ref())
+            }
+    }
+}
+
+// All delete requests to pods carry a precondition on the resource version,
+// and other controllers don't try to delete pods owned by a VReplicaSet.
+pub open spec fn vrs_rely_delete_req(req: DeleteRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        req.key.kind == Kind::PodKind ==>
+            req.preconditions.is_Some()
+            && req.preconditions.get_Some_0().resource_version.is_Some()
+            && !{
+                let etcd_obj = s.resources()[req.key];
+                let owner_references = etcd_obj.metadata.owner_references.get_Some_0();
+                &&& s.resources().contains_key(req.key)
+                &&& etcd_obj.metadata.resource_version.is_Some()
+                &&& etcd_obj.metadata.resource_version
+                    == req.preconditions.get_Some_0().resource_version
+                &&& etcd_obj.metadata.owner_references.is_Some()
+                &&& exists |vrs: VReplicaSetView| 
+                    #[trigger] owner_references.contains(vrs.controller_owner_ref())
+            }
+    }
+}
+
+pub open spec fn vrs_rely(other_id: int) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        forall |msg| {
+            &&& #[trigger] s.in_flight().contains(msg)
+            &&& msg.content.is_APIRequest()
+            &&& msg.src == HostId::Controller(other_id)
+        } ==> match msg.content.get_APIRequest_0() {
+            APIRequest::CreateRequest(req) => vrs_rely_create_req(req)(s),
+            APIRequest::UpdateRequest(req) => vrs_rely_update_req(req)(s),
+            APIRequest::UpdateStatusRequest(req) => vrs_rely_update_status_req(req)(s),
+            APIRequest::DeleteRequest(req) => vrs_rely_delete_req(req)(s),
+            _ => true,
+        }
+    }
+}
+
+// VRS Guarantee Condition
+
+// VRS only creates pods owned by a VReplicaSet.
+pub open spec fn vrs_guarantee_create_req(req: CreateRequest) -> StatePred<ClusterHistory> {
+    |h: ClusterHistory| {
+        let owner_references = req.obj.metadata.owner_references.get_Some_0();
+        &&& req.obj.kind == Kind::PodKind
+        &&& req.obj.metadata.owner_references.is_Some()
+        &&& exists |vrs: VReplicaSetView| 
+            #[trigger] owner_references.contains(vrs.controller_owner_ref())
path: src/v2/controllers/vreplicaset_controller/trusted/rely_guarantee.rs
user: login: codyjrivera
body: what's needed here is guaranteed by an init invariant `each_object_in_etcd_has_at_most_one_controller_owner`. Any message violating this is rejected by the api server.
created_at: 2025-05-01T16:02:40Z
author_association: COLLABORATOR
diff_hunk: @@ -0,0 +1,167 @@
+use crate::kubernetes_api_objects::spec::prelude::*;
+use crate::kubernetes_cluster::spec::{
+    cluster::*, 
+    message::*,
+    retentive_cluster::*
+};
+use crate::temporal_logic::defs::*;
+use crate::vreplicaset_controller::trusted::spec_types::*;
+use vstd::prelude::*;
+
+verus! {
+
+// VRS Rely Condition
+
+// Other controllers don't create pods owned by a VReplicaSet.
+pub open spec fn vrs_rely_create_req(req: CreateRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        req.obj.kind == Kind::PodKind ==> !{
+            let owner_references = req.obj.metadata.owner_references.get_Some_0();
+            &&& req.obj.metadata.owner_references.is_Some()
+            &&& exists |vrs: VReplicaSetView| 
+                #[trigger] owner_references.contains(vrs.controller_owner_ref())
+        }
+    }
+}
+
+// Update requests to pods must carry a resource version on them (despite 
+// the underlying kind permitting unconditional updates). Also, update requests
+// cannot 1) update pods owned by a VReplicaSet, or 2) update pods to become owned
+// by a VReplicaSet.
+pub open spec fn vrs_rely_update_req(req: UpdateRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        req.obj.kind == Kind::PodKind ==>
+            req.obj.metadata.resource_version.is_Some()
+            // Prevents 1): where other controllers update pods already owned
+            // by a VReplicaSet.
+            && !{
+                let etcd_obj = s.resources()[req.key()];
+                let owner_references = etcd_obj.metadata.owner_references.get_Some_0();
+                &&& s.resources().contains_key(req.key())
+                &&& etcd_obj.metadata.resource_version.is_Some()
+                &&& etcd_obj.metadata.resource_version == req.obj.metadata.resource_version
+                &&& etcd_obj.metadata.owner_references.is_Some()
+                &&& exists |vrs: VReplicaSetView| 
+                    #[trigger] owner_references.contains(vrs.controller_owner_ref())
+            }
+            // Prevents 2): where other controllers update pods so they become
+            // owned by a VReplicaSet.
+            && (req.obj.metadata.owner_references.is_Some() ==>
+                    forall |vrs: VReplicaSetView| 
+                        ! #[trigger] req.obj.metadata.owner_references.get_Some_0().contains(vrs.controller_owner_ref()))
+    }
+}
+
+// Dealt with similarly to update requests, minus the condition on 
+// owner_references.
+// TODO: allow other controllers to send UpdateStatus
+// requests to owned pods after we address the fairness issues.
+pub open spec fn vrs_rely_update_status_req(req: UpdateStatusRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        req.obj.kind == Kind::PodKind ==> 
+            req.obj.metadata.resource_version.is_Some()
+            && !{
+                let etcd_obj = s.resources()[req.key()];
+                let owner_references = etcd_obj.metadata.owner_references.get_Some_0();
+                &&& s.resources().contains_key(req.key())
+                &&& etcd_obj.metadata.resource_version.is_Some()
+                &&& etcd_obj.metadata.resource_version == req.obj.metadata.resource_version
+                &&& etcd_obj.metadata.owner_references.is_Some()
+                &&& exists |vrs: VReplicaSetView| 
+                    #[trigger] owner_references.contains(vrs.controller_owner_ref())
+            }
+    }
+}
+
+// All delete requests to pods carry a precondition on the resource version,
+// and other controllers don't try to delete pods owned by a VReplicaSet.
+pub open spec fn vrs_rely_delete_req(req: DeleteRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        req.key.kind == Kind::PodKind ==>
+            req.preconditions.is_Some()
+            && req.preconditions.get_Some_0().resource_version.is_Some()
+            && !{
+                let etcd_obj = s.resources()[req.key];
+                let owner_references = etcd_obj.metadata.owner_references.get_Some_0();
+                &&& s.resources().contains_key(req.key)
+                &&& etcd_obj.metadata.resource_version.is_Some()
+                &&& etcd_obj.metadata.resource_version
+                    == req.preconditions.get_Some_0().resource_version
+                &&& etcd_obj.metadata.owner_references.is_Some()
+                &&& exists |vrs: VReplicaSetView| 
+                    #[trigger] owner_references.contains(vrs.controller_owner_ref())
+            }
+    }
+}
+
+pub open spec fn vrs_rely(other_id: int) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        forall |msg| {
+            &&& #[trigger] s.in_flight().contains(msg)
+            &&& msg.content.is_APIRequest()
+            &&& msg.src == HostId::Controller(other_id)
+        } ==> match msg.content.get_APIRequest_0() {
+            APIRequest::CreateRequest(req) => vrs_rely_create_req(req)(s),
+            APIRequest::UpdateRequest(req) => vrs_rely_update_req(req)(s),
+            APIRequest::UpdateStatusRequest(req) => vrs_rely_update_status_req(req)(s),
+            APIRequest::DeleteRequest(req) => vrs_rely_delete_req(req)(s),
+            _ => true,
+        }
+    }
+}
+
+// VRS Guarantee Condition
+
+// VRS only creates pods owned by a VReplicaSet.
+pub open spec fn vrs_guarantee_create_req(req: CreateRequest) -> StatePred<ClusterHistory> {
+    |h: ClusterHistory| {
+        let owner_references = req.obj.metadata.owner_references.get_Some_0();
+        &&& req.obj.kind == Kind::PodKind
+        &&& req.obj.metadata.owner_references.is_Some()
+        &&& exists |vrs: VReplicaSetView| 
+            #[trigger] owner_references.contains(vrs.controller_owner_ref())
path: src/v2/controllers/vreplicaset_controller/trusted/rely_guarantee.rs
user: login: marshtompsxd
body: Yes, `each_object_in_etcd_has_at_most_one_controller_owner` can do the job, but then you will not be able to prove that VRS's guarantee implies another controller's rely --- you can only prove that with VRS's guarantee condition and this invariant, VRS's creation request will not interfere with another controller.

Ideally, you could structure the compositional proof in a way that (1) first prove A's guarantee implies B's rely, and (2) then prove B's liveness under B's rely.

The proof of (2) will be much more complex than (1), so you only want to do it once and it should not depend on A. The proof of (1) should be much easier and you will need to do it for each pair of controllers.
created_at: 2025-05-01T18:20:44Z
author_association: COLLABORATOR
diff_hunk: @@ -0,0 +1,164 @@
+use crate::kubernetes_api_objects::spec::prelude::*;
+use crate::kubernetes_cluster::spec::{cluster::*, message::*};
+use crate::temporal_logic::defs::*;
+use crate::vreplicaset_controller::trusted::spec_types::*;
+use vstd::prelude::*;
+
+verus! {
+
+// VRS Rely Condition
+
+// Other controllers don't create pods owned by a VReplicaSet.
+pub open spec fn vrs_rely_create_req(req: CreateRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        req.obj.kind == Kind::PodKind ==> !{
+            let owner_references = req.obj.metadata.owner_references.get_Some_0();
+            &&& req.obj.metadata.owner_references.is_Some()
+            &&& exists |vrs: VReplicaSetView| 
+                #[trigger] owner_references.contains(vrs.controller_owner_ref())
+        }
+    }
+}
+
+// Update requests to pods must carry a resource version on them (despite 
+// the underlying kind permitting unconditional updates). Also, update requests
+// cannot 1) update pods owned by a VReplicaSet, or 2) update pods to become owned
+// by a VReplicaSet.
+pub open spec fn vrs_rely_update_req(req: UpdateRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        req.obj.kind == Kind::PodKind ==>
+            req.obj.metadata.resource_version.is_Some()
+            // Prevents 1): where other controllers update pods already owned
+            // by a VReplicaSet.
+            && !{
+                let etcd_obj = s.resources()[req.key()];
+                let owner_references = etcd_obj.metadata.owner_references.get_Some_0();
+                &&& s.resources().contains_key(req.key())
+                &&& etcd_obj.metadata.resource_version.is_Some()
+                &&& etcd_obj.metadata.resource_version == req.obj.metadata.resource_version
+                &&& etcd_obj.metadata.owner_references.is_Some()
+                &&& exists |vrs: VReplicaSetView| 
+                    #[trigger] owner_references.contains(vrs.controller_owner_ref())
+            }
+            // Prevents 2): where other controllers update pods so they become
+            // owned by a VReplicaSet.
+            && (req.obj.metadata.owner_references.is_Some() ==>
+                    forall |vrs: VReplicaSetView| 
+                        ! #[trigger] req.obj.metadata.owner_references.get_Some_0().contains(vrs.controller_owner_ref()))
+    }
+}
+
+// Dealt with similarly to update requests, minus the condition on 
+// owner_references.
+// TODO: allow other controllers to send UpdateStatus
+// requests to owned pods after we address the fairness issues.
+pub open spec fn vrs_rely_update_status_req(req: UpdateStatusRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        req.obj.kind == Kind::PodKind ==> 
+            req.obj.metadata.resource_version.is_Some()
+            && !{
+                let etcd_obj = s.resources()[req.key()];
+                let owner_references = etcd_obj.metadata.owner_references.get_Some_0();
+                &&& s.resources().contains_key(req.key())
+                &&& etcd_obj.metadata.resource_version.is_Some()
+                &&& etcd_obj.metadata.resource_version == req.obj.metadata.resource_version
+                &&& etcd_obj.metadata.owner_references.is_Some()
+                &&& exists |vrs: VReplicaSetView| 
+                    #[trigger] owner_references.contains(vrs.controller_owner_ref())
+            }
+    }
+}
+
+// All delete requests to pods carry a precondition on the resource version,
+// and other controllers don't try to delete pods owned by a VReplicaSet.
+pub open spec fn vrs_rely_delete_req(req: DeleteRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        req.key.kind == Kind::PodKind ==>
+            req.preconditions.is_Some()
+            && req.preconditions.get_Some_0().resource_version.is_Some()
+            && !{
+                let etcd_obj = s.resources()[req.key];
+                let owner_references = etcd_obj.metadata.owner_references.get_Some_0();
+                &&& s.resources().contains_key(req.key)
+                &&& etcd_obj.metadata.resource_version.is_Some()
+                &&& etcd_obj.metadata.resource_version
+                    == req.preconditions.get_Some_0().resource_version
+                &&& etcd_obj.metadata.owner_references.is_Some()
+                &&& exists |vrs: VReplicaSetView| 
+                    #[trigger] owner_references.contains(vrs.controller_owner_ref())
+            }
+    }
+}
+
+pub open spec fn vrs_rely(other_id: int) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        forall |msg| {
+            &&& #[trigger] s.in_flight().contains(msg)
+            &&& msg.content.is_APIRequest()
+            &&& msg.src == HostId::Controller(other_id)
+        } ==> match msg.content.get_APIRequest_0() {
+            APIRequest::CreateRequest(req) => vrs_rely_create_req(req)(s),
+            APIRequest::UpdateRequest(req) => vrs_rely_update_req(req)(s),
+            APIRequest::UpdateStatusRequest(req) => vrs_rely_update_status_req(req)(s),
+            APIRequest::DeleteRequest(req) => vrs_rely_delete_req(req)(s),
+            _ => true,
+        }
+    }
+}
+
+// VRS Guarantee Condition
+
+// VRS only creates pods owned by a VReplicaSet.
+pub open spec fn vrs_guarantee_create_req(req: CreateRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        let owner_references = req.obj.metadata.owner_references.get_Some_0();
+        &&& req.obj.kind == Kind::PodKind
+        &&& req.obj.metadata.owner_references.is_Some()
+        &&& exists |vrs: VReplicaSetView| 
+            owner_references == seq![#[trigger] vrs.controller_owner_ref()]
+    }
+}
+
+// VRS only sends delete requests to pods that carry a resource version precondition,
+// and if the resource version carried matches the one in the corresponding etcd
+// object, then that object is owned by a VReplicaSet.
+pub open spec fn vrs_guarantee_delete_req(req: DeleteRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        let etcd_obj = s.resources()[req.key];
+        &&& req.key.kind == Kind::PodKind
+        &&& req.preconditions.is_Some()
+        &&& req.preconditions.get_Some_0().resource_version.is_Some()
+        &&& {
+            &&& s.resources().contains_key(req.key)
+            &&& etcd_obj.metadata.resource_version 
+                == req.preconditions.get_Some_0().resource_version
+        } ==> {
+            let controller_owners = etcd_obj.metadata.owner_references
+                .get_Some_0()
+                .filter(|o: OwnerReferenceView| {
+                    o.controller.is_Some() && o.controller.get_Some_0()
+                });
+            &&& etcd_obj.metadata.owner_references.is_Some()
+            &&& exists |vrs: VReplicaSetView| 
+                controller_owners == seq![#[trigger] vrs.controller_owner_ref()]
path: src/v2/controllers/vreplicaset_controller/trusted/rely_guarantee.rs
user: login: marshtompsxd
body: This seems too strong? The pod VRS controller deletes might have more than one owner, tho only one controller owner (which is VRS)
created_at: 2025-05-03T02:55:12Z
author_association: COLLABORATOR
diff_hunk: @@ -0,0 +1,164 @@
+use crate::kubernetes_api_objects::spec::prelude::*;
+use crate::kubernetes_cluster::spec::{cluster::*, message::*};
+use crate::temporal_logic::defs::*;
+use crate::vreplicaset_controller::trusted::spec_types::*;
+use vstd::prelude::*;
+
+verus! {
+
+// VRS Rely Condition
+
+// Other controllers don't create pods owned by a VReplicaSet.
+pub open spec fn vrs_rely_create_req(req: CreateRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        req.obj.kind == Kind::PodKind ==> !{
+            let owner_references = req.obj.metadata.owner_references.get_Some_0();
+            &&& req.obj.metadata.owner_references.is_Some()
+            &&& exists |vrs: VReplicaSetView| 
+                #[trigger] owner_references.contains(vrs.controller_owner_ref())
+        }
+    }
+}
+
+// Update requests to pods must carry a resource version on them (despite 
+// the underlying kind permitting unconditional updates). Also, update requests
+// cannot 1) update pods owned by a VReplicaSet, or 2) update pods to become owned
+// by a VReplicaSet.
+pub open spec fn vrs_rely_update_req(req: UpdateRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        req.obj.kind == Kind::PodKind ==>
+            req.obj.metadata.resource_version.is_Some()
+            // Prevents 1): where other controllers update pods already owned
+            // by a VReplicaSet.
+            && !{
+                let etcd_obj = s.resources()[req.key()];
+                let owner_references = etcd_obj.metadata.owner_references.get_Some_0();
+                &&& s.resources().contains_key(req.key())
+                &&& etcd_obj.metadata.resource_version.is_Some()
+                &&& etcd_obj.metadata.resource_version == req.obj.metadata.resource_version
+                &&& etcd_obj.metadata.owner_references.is_Some()
+                &&& exists |vrs: VReplicaSetView| 
+                    #[trigger] owner_references.contains(vrs.controller_owner_ref())
+            }
+            // Prevents 2): where other controllers update pods so they become
+            // owned by a VReplicaSet.
+            && (req.obj.metadata.owner_references.is_Some() ==>
+                    forall |vrs: VReplicaSetView| 
+                        ! #[trigger] req.obj.metadata.owner_references.get_Some_0().contains(vrs.controller_owner_ref()))
+    }
+}
+
+// Dealt with similarly to update requests, minus the condition on 
+// owner_references.
+// TODO: allow other controllers to send UpdateStatus
+// requests to owned pods after we address the fairness issues.
+pub open spec fn vrs_rely_update_status_req(req: UpdateStatusRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        req.obj.kind == Kind::PodKind ==> 
+            req.obj.metadata.resource_version.is_Some()
+            && !{
+                let etcd_obj = s.resources()[req.key()];
+                let owner_references = etcd_obj.metadata.owner_references.get_Some_0();
+                &&& s.resources().contains_key(req.key())
+                &&& etcd_obj.metadata.resource_version.is_Some()
+                &&& etcd_obj.metadata.resource_version == req.obj.metadata.resource_version
+                &&& etcd_obj.metadata.owner_references.is_Some()
+                &&& exists |vrs: VReplicaSetView| 
+                    #[trigger] owner_references.contains(vrs.controller_owner_ref())
+            }
+    }
+}
+
+// All delete requests to pods carry a precondition on the resource version,
+// and other controllers don't try to delete pods owned by a VReplicaSet.
+pub open spec fn vrs_rely_delete_req(req: DeleteRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        req.key.kind == Kind::PodKind ==>
+            req.preconditions.is_Some()
+            && req.preconditions.get_Some_0().resource_version.is_Some()
+            && !{
+                let etcd_obj = s.resources()[req.key];
+                let owner_references = etcd_obj.metadata.owner_references.get_Some_0();
+                &&& s.resources().contains_key(req.key)
+                &&& etcd_obj.metadata.resource_version.is_Some()
+                &&& etcd_obj.metadata.resource_version
+                    == req.preconditions.get_Some_0().resource_version
+                &&& etcd_obj.metadata.owner_references.is_Some()
+                &&& exists |vrs: VReplicaSetView| 
+                    #[trigger] owner_references.contains(vrs.controller_owner_ref())
+            }
+    }
+}
+
+pub open spec fn vrs_rely(other_id: int) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        forall |msg| {
+            &&& #[trigger] s.in_flight().contains(msg)
+            &&& msg.content.is_APIRequest()
+            &&& msg.src == HostId::Controller(other_id)
+        } ==> match msg.content.get_APIRequest_0() {
+            APIRequest::CreateRequest(req) => vrs_rely_create_req(req)(s),
+            APIRequest::UpdateRequest(req) => vrs_rely_update_req(req)(s),
+            APIRequest::UpdateStatusRequest(req) => vrs_rely_update_status_req(req)(s),
+            APIRequest::DeleteRequest(req) => vrs_rely_delete_req(req)(s),
+            _ => true,
+        }
+    }
+}
+
+// VRS Guarantee Condition
+
+// VRS only creates pods owned by a VReplicaSet.
+pub open spec fn vrs_guarantee_create_req(req: CreateRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        let owner_references = req.obj.metadata.owner_references.get_Some_0();
+        &&& req.obj.kind == Kind::PodKind
+        &&& req.obj.metadata.owner_references.is_Some()
+        &&& exists |vrs: VReplicaSetView| 
+            owner_references == seq![#[trigger] vrs.controller_owner_ref()]
+    }
+}
+
+// VRS only sends delete requests to pods that carry a resource version precondition,
+// and if the resource version carried matches the one in the corresponding etcd
+// object, then that object is owned by a VReplicaSet.
+pub open spec fn vrs_guarantee_delete_req(req: DeleteRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        let etcd_obj = s.resources()[req.key];
+        &&& req.key.kind == Kind::PodKind
+        &&& req.preconditions.is_Some()
+        &&& req.preconditions.get_Some_0().resource_version.is_Some()
+        &&& {
+            &&& s.resources().contains_key(req.key)
+            &&& etcd_obj.metadata.resource_version 
+                == req.preconditions.get_Some_0().resource_version
+        } ==> {
+            let controller_owners = etcd_obj.metadata.owner_references
+                .get_Some_0()
+                .filter(|o: OwnerReferenceView| {
+                    o.controller.is_Some() && o.controller.get_Some_0()
+                });
+            &&& etcd_obj.metadata.owner_references.is_Some()
+            &&& exists |vrs: VReplicaSetView| 
+                controller_owners == seq![#[trigger] vrs.controller_owner_ref()]
path: src/v2/controllers/vreplicaset_controller/trusted/rely_guarantee.rs
user: login: codyjrivera
body: Look again; `controller_owners` is filtered precisely that way.
created_at: 2025-05-03T14:09:44Z
author_association: COLLABORATOR
diff_hunk: @@ -0,0 +1,164 @@
+use crate::kubernetes_api_objects::spec::prelude::*;
+use crate::kubernetes_cluster::spec::{cluster::*, message::*};
+use crate::temporal_logic::defs::*;
+use crate::vreplicaset_controller::trusted::spec_types::*;
+use vstd::prelude::*;
+
+verus! {
+
+// VRS Rely Condition
+
+// Other controllers don't create pods owned by a VReplicaSet.
+pub open spec fn vrs_rely_create_req(req: CreateRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        req.obj.kind == Kind::PodKind ==> !{
+            let owner_references = req.obj.metadata.owner_references.get_Some_0();
+            &&& req.obj.metadata.owner_references.is_Some()
+            &&& exists |vrs: VReplicaSetView| 
+                #[trigger] owner_references.contains(vrs.controller_owner_ref())
+        }
+    }
+}
+
+// Update requests to pods must carry a resource version on them (despite 
+// the underlying kind permitting unconditional updates). Also, update requests
+// cannot 1) update pods owned by a VReplicaSet, or 2) update pods to become owned
+// by a VReplicaSet.
+pub open spec fn vrs_rely_update_req(req: UpdateRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        req.obj.kind == Kind::PodKind ==>
+            req.obj.metadata.resource_version.is_Some()
+            // Prevents 1): where other controllers update pods already owned
+            // by a VReplicaSet.
+            && !{
+                let etcd_obj = s.resources()[req.key()];
+                let owner_references = etcd_obj.metadata.owner_references.get_Some_0();
+                &&& s.resources().contains_key(req.key())
+                &&& etcd_obj.metadata.resource_version.is_Some()
+                &&& etcd_obj.metadata.resource_version == req.obj.metadata.resource_version
+                &&& etcd_obj.metadata.owner_references.is_Some()
+                &&& exists |vrs: VReplicaSetView| 
+                    #[trigger] owner_references.contains(vrs.controller_owner_ref())
+            }
+            // Prevents 2): where other controllers update pods so they become
+            // owned by a VReplicaSet.
+            && (req.obj.metadata.owner_references.is_Some() ==>
+                    forall |vrs: VReplicaSetView| 
+                        ! #[trigger] req.obj.metadata.owner_references.get_Some_0().contains(vrs.controller_owner_ref()))
+    }
+}
+
+// Dealt with similarly to update requests, minus the condition on 
+// owner_references.
+// TODO: allow other controllers to send UpdateStatus
+// requests to owned pods after we address the fairness issues.
+pub open spec fn vrs_rely_update_status_req(req: UpdateStatusRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        req.obj.kind == Kind::PodKind ==> 
+            req.obj.metadata.resource_version.is_Some()
+            && !{
+                let etcd_obj = s.resources()[req.key()];
+                let owner_references = etcd_obj.metadata.owner_references.get_Some_0();
+                &&& s.resources().contains_key(req.key())
+                &&& etcd_obj.metadata.resource_version.is_Some()
+                &&& etcd_obj.metadata.resource_version == req.obj.metadata.resource_version
+                &&& etcd_obj.metadata.owner_references.is_Some()
+                &&& exists |vrs: VReplicaSetView| 
+                    #[trigger] owner_references.contains(vrs.controller_owner_ref())
+            }
+    }
+}
+
+// All delete requests to pods carry a precondition on the resource version,
+// and other controllers don't try to delete pods owned by a VReplicaSet.
+pub open spec fn vrs_rely_delete_req(req: DeleteRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        req.key.kind == Kind::PodKind ==>
+            req.preconditions.is_Some()
+            && req.preconditions.get_Some_0().resource_version.is_Some()
+            && !{
+                let etcd_obj = s.resources()[req.key];
+                let owner_references = etcd_obj.metadata.owner_references.get_Some_0();
+                &&& s.resources().contains_key(req.key)
+                &&& etcd_obj.metadata.resource_version.is_Some()
+                &&& etcd_obj.metadata.resource_version
+                    == req.preconditions.get_Some_0().resource_version
+                &&& etcd_obj.metadata.owner_references.is_Some()
+                &&& exists |vrs: VReplicaSetView| 
+                    #[trigger] owner_references.contains(vrs.controller_owner_ref())
+            }
+    }
+}
+
+pub open spec fn vrs_rely(other_id: int) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        forall |msg| {
+            &&& #[trigger] s.in_flight().contains(msg)
+            &&& msg.content.is_APIRequest()
+            &&& msg.src == HostId::Controller(other_id)
+        } ==> match msg.content.get_APIRequest_0() {
+            APIRequest::CreateRequest(req) => vrs_rely_create_req(req)(s),
+            APIRequest::UpdateRequest(req) => vrs_rely_update_req(req)(s),
+            APIRequest::UpdateStatusRequest(req) => vrs_rely_update_status_req(req)(s),
+            APIRequest::DeleteRequest(req) => vrs_rely_delete_req(req)(s),
+            _ => true,
+        }
+    }
+}
+
+// VRS Guarantee Condition
+
+// VRS only creates pods owned by a VReplicaSet.
+pub open spec fn vrs_guarantee_create_req(req: CreateRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        let owner_references = req.obj.metadata.owner_references.get_Some_0();
+        &&& req.obj.kind == Kind::PodKind
+        &&& req.obj.metadata.owner_references.is_Some()
+        &&& exists |vrs: VReplicaSetView| 
+            owner_references == seq![#[trigger] vrs.controller_owner_ref()]
+    }
+}
+
+// VRS only sends delete requests to pods that carry a resource version precondition,
+// and if the resource version carried matches the one in the corresponding etcd
+// object, then that object is owned by a VReplicaSet.
+pub open spec fn vrs_guarantee_delete_req(req: DeleteRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        let etcd_obj = s.resources()[req.key];
+        &&& req.key.kind == Kind::PodKind
+        &&& req.preconditions.is_Some()
+        &&& req.preconditions.get_Some_0().resource_version.is_Some()
+        &&& {
+            &&& s.resources().contains_key(req.key)
+            &&& etcd_obj.metadata.resource_version 
+                == req.preconditions.get_Some_0().resource_version
+        } ==> {
+            let controller_owners = etcd_obj.metadata.owner_references
+                .get_Some_0()
+                .filter(|o: OwnerReferenceView| {
+                    o.controller.is_Some() && o.controller.get_Some_0()
+                });
+            &&& etcd_obj.metadata.owner_references.is_Some()
+            &&& exists |vrs: VReplicaSetView| 
+                controller_owners == seq![#[trigger] vrs.controller_owner_ref()]
path: src/v2/controllers/vreplicaset_controller/trusted/rely_guarantee.rs
user: login: marshtompsxd
body: I double checked the implementation of the reference RS controller: it manages pods whose controller owner is RS, even if the pods have other owners. See: https://github.com/kubernetes/kubernetes/blob/master/pkg/controller/controller_ref_manager.go#L70-L75
created_at: 2025-05-03T14:38:22Z
author_association: COLLABORATOR
diff_hunk: @@ -0,0 +1,164 @@
+use crate::kubernetes_api_objects::spec::prelude::*;
+use crate::kubernetes_cluster::spec::{cluster::*, message::*};
+use crate::temporal_logic::defs::*;
+use crate::vreplicaset_controller::trusted::spec_types::*;
+use vstd::prelude::*;
+
+verus! {
+
+// VRS Rely Condition
+
+// Other controllers don't create pods owned by a VReplicaSet.
+pub open spec fn vrs_rely_create_req(req: CreateRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        req.obj.kind == Kind::PodKind ==> !{
+            let owner_references = req.obj.metadata.owner_references.get_Some_0();
+            &&& req.obj.metadata.owner_references.is_Some()
+            &&& exists |vrs: VReplicaSetView| 
+                #[trigger] owner_references.contains(vrs.controller_owner_ref())
+        }
+    }
+}
+
+// Update requests to pods must carry a resource version on them (despite 
+// the underlying kind permitting unconditional updates). Also, update requests
+// cannot 1) update pods owned by a VReplicaSet, or 2) update pods to become owned
+// by a VReplicaSet.
+pub open spec fn vrs_rely_update_req(req: UpdateRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        req.obj.kind == Kind::PodKind ==>
+            req.obj.metadata.resource_version.is_Some()
+            // Prevents 1): where other controllers update pods already owned
+            // by a VReplicaSet.
+            && !{
+                let etcd_obj = s.resources()[req.key()];
+                let owner_references = etcd_obj.metadata.owner_references.get_Some_0();
+                &&& s.resources().contains_key(req.key())
+                &&& etcd_obj.metadata.resource_version.is_Some()
+                &&& etcd_obj.metadata.resource_version == req.obj.metadata.resource_version
+                &&& etcd_obj.metadata.owner_references.is_Some()
+                &&& exists |vrs: VReplicaSetView| 
+                    #[trigger] owner_references.contains(vrs.controller_owner_ref())
+            }
+            // Prevents 2): where other controllers update pods so they become
+            // owned by a VReplicaSet.
+            && (req.obj.metadata.owner_references.is_Some() ==>
+                    forall |vrs: VReplicaSetView| 
+                        ! #[trigger] req.obj.metadata.owner_references.get_Some_0().contains(vrs.controller_owner_ref()))
+    }
+}
+
+// Dealt with similarly to update requests, minus the condition on 
+// owner_references.
+// TODO: allow other controllers to send UpdateStatus
+// requests to owned pods after we address the fairness issues.
+pub open spec fn vrs_rely_update_status_req(req: UpdateStatusRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        req.obj.kind == Kind::PodKind ==> 
+            req.obj.metadata.resource_version.is_Some()
+            && !{
+                let etcd_obj = s.resources()[req.key()];
+                let owner_references = etcd_obj.metadata.owner_references.get_Some_0();
+                &&& s.resources().contains_key(req.key())
+                &&& etcd_obj.metadata.resource_version.is_Some()
+                &&& etcd_obj.metadata.resource_version == req.obj.metadata.resource_version
+                &&& etcd_obj.metadata.owner_references.is_Some()
+                &&& exists |vrs: VReplicaSetView| 
+                    #[trigger] owner_references.contains(vrs.controller_owner_ref())
+            }
+    }
+}
+
+// All delete requests to pods carry a precondition on the resource version,
+// and other controllers don't try to delete pods owned by a VReplicaSet.
+pub open spec fn vrs_rely_delete_req(req: DeleteRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        req.key.kind == Kind::PodKind ==>
+            req.preconditions.is_Some()
+            && req.preconditions.get_Some_0().resource_version.is_Some()
+            && !{
+                let etcd_obj = s.resources()[req.key];
+                let owner_references = etcd_obj.metadata.owner_references.get_Some_0();
+                &&& s.resources().contains_key(req.key)
+                &&& etcd_obj.metadata.resource_version.is_Some()
+                &&& etcd_obj.metadata.resource_version
+                    == req.preconditions.get_Some_0().resource_version
+                &&& etcd_obj.metadata.owner_references.is_Some()
+                &&& exists |vrs: VReplicaSetView| 
+                    #[trigger] owner_references.contains(vrs.controller_owner_ref())
+            }
+    }
+}
+
+pub open spec fn vrs_rely(other_id: int) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        forall |msg| {
+            &&& #[trigger] s.in_flight().contains(msg)
+            &&& msg.content.is_APIRequest()
+            &&& msg.src == HostId::Controller(other_id)
+        } ==> match msg.content.get_APIRequest_0() {
+            APIRequest::CreateRequest(req) => vrs_rely_create_req(req)(s),
+            APIRequest::UpdateRequest(req) => vrs_rely_update_req(req)(s),
+            APIRequest::UpdateStatusRequest(req) => vrs_rely_update_status_req(req)(s),
+            APIRequest::DeleteRequest(req) => vrs_rely_delete_req(req)(s),
+            _ => true,
+        }
+    }
+}
+
+// VRS Guarantee Condition
+
+// VRS only creates pods owned by a VReplicaSet.
+pub open spec fn vrs_guarantee_create_req(req: CreateRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        let owner_references = req.obj.metadata.owner_references.get_Some_0();
+        &&& req.obj.kind == Kind::PodKind
+        &&& req.obj.metadata.owner_references.is_Some()
+        &&& exists |vrs: VReplicaSetView| 
+            owner_references == seq![#[trigger] vrs.controller_owner_ref()]
+    }
+}
+
+// VRS only sends delete requests to pods that carry a resource version precondition,
+// and if the resource version carried matches the one in the corresponding etcd
+// object, then that object is owned by a VReplicaSet.
+pub open spec fn vrs_guarantee_delete_req(req: DeleteRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        let etcd_obj = s.resources()[req.key];
+        &&& req.key.kind == Kind::PodKind
+        &&& req.preconditions.is_Some()
+        &&& req.preconditions.get_Some_0().resource_version.is_Some()
+        &&& {
+            &&& s.resources().contains_key(req.key)
+            &&& etcd_obj.metadata.resource_version 
+                == req.preconditions.get_Some_0().resource_version
+        } ==> {
+            let controller_owners = etcd_obj.metadata.owner_references
+                .get_Some_0()
+                .filter(|o: OwnerReferenceView| {
+                    o.controller.is_Some() && o.controller.get_Some_0()
+                });
+            &&& etcd_obj.metadata.owner_references.is_Some()
+            &&& exists |vrs: VReplicaSetView| 
+                controller_owners == seq![#[trigger] vrs.controller_owner_ref()]
path: src/v2/controllers/vreplicaset_controller/trusted/rely_guarantee.rs
user: login: codyjrivera
body: I should have explained further originally. In my code, I define `controller_owners` precisely as the subset of `owner_references` that are controller owners. The line enforces that the only _controller_ owner is a VReplicaSet. My definition allows other non-controller owners.

Unless you were referring to something else.
created_at: 2025-05-03T15:41:55Z
author_association: COLLABORATOR
diff_hunk: @@ -0,0 +1,164 @@
+use crate::kubernetes_api_objects::spec::prelude::*;
+use crate::kubernetes_cluster::spec::{cluster::*, message::*};
+use crate::temporal_logic::defs::*;
+use crate::vreplicaset_controller::trusted::spec_types::*;
+use vstd::prelude::*;
+
+verus! {
+
+// VRS Rely Condition
+
+// Other controllers don't create pods owned by a VReplicaSet.
+pub open spec fn vrs_rely_create_req(req: CreateRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        req.obj.kind == Kind::PodKind ==> !{
+            let owner_references = req.obj.metadata.owner_references.get_Some_0();
+            &&& req.obj.metadata.owner_references.is_Some()
+            &&& exists |vrs: VReplicaSetView| 
+                #[trigger] owner_references.contains(vrs.controller_owner_ref())
+        }
+    }
+}
+
+// Update requests to pods must carry a resource version on them (despite 
+// the underlying kind permitting unconditional updates). Also, update requests
+// cannot 1) update pods owned by a VReplicaSet, or 2) update pods to become owned
+// by a VReplicaSet.
+pub open spec fn vrs_rely_update_req(req: UpdateRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        req.obj.kind == Kind::PodKind ==>
+            req.obj.metadata.resource_version.is_Some()
+            // Prevents 1): where other controllers update pods already owned
+            // by a VReplicaSet.
+            && !{
+                let etcd_obj = s.resources()[req.key()];
+                let owner_references = etcd_obj.metadata.owner_references.get_Some_0();
+                &&& s.resources().contains_key(req.key())
+                &&& etcd_obj.metadata.resource_version.is_Some()
+                &&& etcd_obj.metadata.resource_version == req.obj.metadata.resource_version
+                &&& etcd_obj.metadata.owner_references.is_Some()
+                &&& exists |vrs: VReplicaSetView| 
+                    #[trigger] owner_references.contains(vrs.controller_owner_ref())
+            }
+            // Prevents 2): where other controllers update pods so they become
+            // owned by a VReplicaSet.
+            && (req.obj.metadata.owner_references.is_Some() ==>
+                    forall |vrs: VReplicaSetView| 
+                        ! #[trigger] req.obj.metadata.owner_references.get_Some_0().contains(vrs.controller_owner_ref()))
+    }
+}
+
+// Dealt with similarly to update requests, minus the condition on 
+// owner_references.
+// TODO: allow other controllers to send UpdateStatus
+// requests to owned pods after we address the fairness issues.
+pub open spec fn vrs_rely_update_status_req(req: UpdateStatusRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        req.obj.kind == Kind::PodKind ==> 
+            req.obj.metadata.resource_version.is_Some()
+            && !{
+                let etcd_obj = s.resources()[req.key()];
+                let owner_references = etcd_obj.metadata.owner_references.get_Some_0();
+                &&& s.resources().contains_key(req.key())
+                &&& etcd_obj.metadata.resource_version.is_Some()
+                &&& etcd_obj.metadata.resource_version == req.obj.metadata.resource_version
+                &&& etcd_obj.metadata.owner_references.is_Some()
+                &&& exists |vrs: VReplicaSetView| 
+                    #[trigger] owner_references.contains(vrs.controller_owner_ref())
+            }
+    }
+}
+
+// All delete requests to pods carry a precondition on the resource version,
+// and other controllers don't try to delete pods owned by a VReplicaSet.
+pub open spec fn vrs_rely_delete_req(req: DeleteRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        req.key.kind == Kind::PodKind ==>
+            req.preconditions.is_Some()
+            && req.preconditions.get_Some_0().resource_version.is_Some()
+            && !{
+                let etcd_obj = s.resources()[req.key];
+                let owner_references = etcd_obj.metadata.owner_references.get_Some_0();
+                &&& s.resources().contains_key(req.key)
+                &&& etcd_obj.metadata.resource_version.is_Some()
+                &&& etcd_obj.metadata.resource_version
+                    == req.preconditions.get_Some_0().resource_version
+                &&& etcd_obj.metadata.owner_references.is_Some()
+                &&& exists |vrs: VReplicaSetView| 
+                    #[trigger] owner_references.contains(vrs.controller_owner_ref())
+            }
+    }
+}
+
+pub open spec fn vrs_rely(other_id: int) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        forall |msg| {
+            &&& #[trigger] s.in_flight().contains(msg)
+            &&& msg.content.is_APIRequest()
+            &&& msg.src == HostId::Controller(other_id)
+        } ==> match msg.content.get_APIRequest_0() {
+            APIRequest::CreateRequest(req) => vrs_rely_create_req(req)(s),
+            APIRequest::UpdateRequest(req) => vrs_rely_update_req(req)(s),
+            APIRequest::UpdateStatusRequest(req) => vrs_rely_update_status_req(req)(s),
+            APIRequest::DeleteRequest(req) => vrs_rely_delete_req(req)(s),
+            _ => true,
+        }
+    }
+}
+
+// VRS Guarantee Condition
+
+// VRS only creates pods owned by a VReplicaSet.
+pub open spec fn vrs_guarantee_create_req(req: CreateRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        let owner_references = req.obj.metadata.owner_references.get_Some_0();
+        &&& req.obj.kind == Kind::PodKind
+        &&& req.obj.metadata.owner_references.is_Some()
+        &&& exists |vrs: VReplicaSetView| 
+            owner_references == seq![#[trigger] vrs.controller_owner_ref()]
+    }
+}
+
+// VRS only sends delete requests to pods that carry a resource version precondition,
+// and if the resource version carried matches the one in the corresponding etcd
+// object, then that object is owned by a VReplicaSet.
+pub open spec fn vrs_guarantee_delete_req(req: DeleteRequest) -> StatePred<ClusterState> {
+    |s: ClusterState| {
+        let etcd_obj = s.resources()[req.key];
+        &&& req.key.kind == Kind::PodKind
+        &&& req.preconditions.is_Some()
+        &&& req.preconditions.get_Some_0().resource_version.is_Some()
+        &&& {
+            &&& s.resources().contains_key(req.key)
+            &&& etcd_obj.metadata.resource_version 
+                == req.preconditions.get_Some_0().resource_version
+        } ==> {
+            let controller_owners = etcd_obj.metadata.owner_references
+                .get_Some_0()
+                .filter(|o: OwnerReferenceView| {
+                    o.controller.is_Some() && o.controller.get_Some_0()
+                });
+            &&& etcd_obj.metadata.owner_references.is_Some()
+            &&& exists |vrs: VReplicaSetView| 
+                controller_owners == seq![#[trigger] vrs.controller_owner_ref()]
path: src/v2/controllers/vreplicaset_controller/trusted/rely_guarantee.rs
user: login: marshtompsxd
body: oh I see what you mean. Sorry that I misread the code.
created_at: 2025-05-03T15:47:04Z
author_association: COLLABORATOR

PR comments:
user: login: marshtompsxd
created_at: 2025-05-02T01:58:15Z
body: Ready for review again?
author_association: COLLABORATOR
user: login: marshtompsxd
created_at: 2025-05-03T02:56:44Z
body: @codyjrivera in addition to my new comment, can you also update the description to be more concise?
author_association: COLLABORATOR
user: login: codyjrivera
created_at: 2025-05-03T14:31:35Z
body: Updated the PR description; if you meant any comments in the code, please point them out to me (I think the existing ones are okay).
author_association: COLLABORATOR