theory EgTop2

lemma "\<forall>p. \<exists>e s. gs\<^sub>0 p = Some (e, s) \<and>
  (e = client_untrusted \<or>
  \<not>(\<exists>c. sends e {x. q_channel x = c \<and> q_data x = Return [String ''baz'']} \<and>
  receives_on c client_untrusted))" unfolding gs\<^sub>0_def trusted_def apply clarsimp apply (case_tac p, clarsimp) unfolding store_untrusted_def Store_untrusted_def apply clarsimp unfolding UserStep_def ArbitraryRequest_def ArbitraryResponse_def apply clarsimp unfolding client_untrusted_def Client_untrusted_def apply clarsimp unfolding UserStep_def ArbitraryRequest_def ArbitraryResponse_def apply clarsimp apply clarsimp apply clarsimp unfolding filter_trusted_def UserStep_def ArbitraryRequest_def
            ArbitraryResponse_def apply clarsimp unfolding filter_responses_def apply clarsimp done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<forall>p. \<exists>e s. gs\<^sub>0 p = Some (e, s) \<and> (e = client_untrusted \<or> (\<nexists>c. sends e {x. q_channel x = c \<and> q_data x = Return [String ''baz'']} \<and> receives_on c client_untrusted)) proof (prove)
goal (1 subgoal):
 1. \<forall>p. \<exists>e s. (case [inst.filter \<mapsto> (filter_trusted, Component init_component_state)] p of None \<Rightarrow> case p of store \<Rightarrow> Some (store_untrusted, Component init_component_state) | client \<Rightarrow> Some (client_untrusted, Component init_component_state) | inst.filter \<Rightarrow> Some (filter_untrusted, Component init_component_state) | Some s \<Rightarrow> Some s) = Some (e, s) \<and> (e = client_untrusted \<or> (\<nexists>c. sends e {x. q_channel x = c \<and> q_data x = Return [String ''baz'']} \<and> receives_on c client_untrusted)) proof (prove)
goal (1 subgoal):
 1. \<And>p. (p = inst.filter \<longrightarrow> filter_trusted = client_untrusted \<or> (\<forall>c. sends filter_trusted {x. q_channel x = c \<and> q_data x = Return [String ''baz'']} \<longrightarrow> \<not> receives_on c client_untrusted)) \<and> (p \<noteq> inst.filter \<longrightarrow> (\<exists>e. (\<exists>s. (case p of store \<Rightarrow> Some (store_untrusted, Component init_component_state) | client \<Rightarrow> Some (client_untrusted, Component init_component_state) | inst.filter \<Rightarrow> Some (filter_untrusted, Component init_component_state)) = Some (e, s)) \<and> (e = client_untrusted \<or> (\<forall>c. sends e {x. q_channel x = c \<and> q_data x = Return [String ''baz'']} \<longrightarrow> \<not> receives_on c client_untrusted)))) proof (prove)
goal (3 subgoals):
 1. \<And>c. \<lbrakk>store_untrusted \<noteq> client_untrusted; sends store_untrusted {x. q_channel x = c \<and> q_data x = Return [String ''baz'']}; receives_on c client_untrusted\<rbrakk> \<Longrightarrow> False
 2. \<And>p. p = client \<Longrightarrow> (p = inst.filter \<longrightarrow> filter_trusted = client_untrusted \<or> (\<forall>c. sends filter_trusted {x. q_channel x = c \<and> q_data x = Return [String ''baz'']} \<longrightarrow> \<not> receives_on c client_untrusted)) \<and> (p \<noteq> inst.filter \<longrightarrow> (\<exists>e. (\<exists>s. (case p of store \<Rightarrow> Some (store_untrusted, Component init_component_state) | client \<Rightarrow> Some (client_untrusted, Component init_component_state) | inst.filter \<Rightarrow> Some (filter_untrusted, Component init_component_state)) = Some (e, s)) \<and> (e = client_untrusted \<or> (\<forall>c. sends e {x. q_channel x = c \<and> q_data x = Return [String ''baz'']} \<longrightarrow> \<not> receives_on c client_untrusted))))
 3. \<And>p. p = inst.filter \<Longrightarrow> (p = inst.filter \<longrightarrow> filter_trusted = client_untrusted \<or> (\<forall>c. sends filter_trusted {x. q_channel x = c \<and> q_data x = Return [String ''baz'']} \<longrightarrow> \<not> receives_on c client_untrusted)) \<and> (p \<noteq> inst.filter \<longrightarrow> (\<exists>e. (\<exists>s. (case p of store \<Rightarrow> Some (store_untrusted, Component init_component_state) | client \<Rightarrow> Some (client_untrusted, Component init_component_state) | inst.filter \<Rightarrow> Some (filter_untrusted, Component init_component_state)) = Some (e, s)) \<and> (e = client_untrusted \<or> (\<forall>c. sends e {x. q_channel x = c \<and> q_data x = Return [String ''baz'']} \<longrightarrow> \<not> receives_on c client_untrusted)))) proof (prove)
goal (3 subgoals):
 1. \<And>c. \<lbrakk>LOOP UserStep \<squnion> ArbitraryRequest (case Store_l of Store_l \<Rightarrow> two) \<squnion> ArbitraryResponse (case Store_l of Store_l \<Rightarrow> two) \<noteq> client_untrusted; sends LOOP UserStep \<squnion> ArbitraryRequest (case Store_l of Store_l \<Rightarrow> two) \<squnion> ArbitraryResponse (case Store_l of Store_l \<Rightarrow> two) {x. q_channel x = c \<and> q_data x = Return [String ''baz'']}; receives_on c client_untrusted\<rbrakk> \<Longrightarrow> False
 2. \<And>p. p = client \<Longrightarrow> (p = inst.filter \<longrightarrow> filter_trusted = client_untrusted \<or> (\<forall>c. sends filter_trusted {x. q_channel x = c \<and> q_data x = Return [String ''baz'']} \<longrightarrow> \<not> receives_on c client_untrusted)) \<and> (p \<noteq> inst.filter \<longrightarrow> (\<exists>e. (\<exists>s. (case p of store \<Rightarrow> Some (LOOP UserStep \<squnion> ArbitraryRequest (case Store_l of Store_l \<Rightarrow> two) \<squnion> ArbitraryResponse (case Store_l of Store_l \<Rightarrow> two), Component init_component_state) | client \<Rightarrow> Some (client_untrusted, Component init_component_state) | inst.filter \<Rightarrow> Some (filter_untrusted, Component init_component_state)) = Some (e, s)) \<and> (e = client_untrusted \<or> (\<forall>c. sends e {x. q_channel x = c \<and> q_data x = Return [String ''baz'']} \<longrightarrow> \<not> receives_on c client_untrusted))))
 3. \<And>p. p = inst.filter \<Longrightarrow> (p = inst.filter \<longrightarrow> filter_trusted = client_untrusted \<or> (\<forall>c. sends filter_trusted {x. q_channel x = c \<and> q_data x = Return [String ''baz'']} \<longrightarrow> \<not> receives_on c client_untrusted)) \<and> (p \<noteq> inst.filter \<longrightarrow> (\<exists>e. (\<exists>s. (case p of store \<Rightarrow> Some (LOOP UserStep \<squnion> ArbitraryRequest (case Store_l of Store_l \<Rightarrow> two) \<squnion> ArbitraryResponse (case Store_l of Store_l \<Rightarrow> two), Component init_component_state) | client \<Rightarrow> Some (client_untrusted, Component init_component_state) | inst.filter \<Rightarrow> Some (filter_untrusted, Component init_component_state)) = Some (e, s)) \<and> (e = client_untrusted \<or> (\<forall>c. sends e {x. q_channel x = c \<and> q_data x = Return [String ''baz'']} \<longrightarrow> \<not> receives_on c client_untrusted)))) proof (prove)
goal (3 subgoals):
 1. \<And>c. \<lbrakk>LOOP UserStep \<squnion> ArbitraryRequest two \<squnion> ArbitraryResponse two \<noteq> client_untrusted; sends UserStep {x. q_channel x = c \<and> q_data x = Return [String ''baz'']} \<or> sends (ArbitraryRequest two) {x. q_channel x = c \<and> q_data x = Return [String ''baz'']} \<or> sends (ArbitraryResponse two) {x. q_channel x = c \<and> q_data x = Return [String ''baz'']}; receives_on c client_untrusted\<rbrakk> \<Longrightarrow> False
 2. \<And>p. p = client \<Longrightarrow> (p = inst.filter \<longrightarrow> filter_trusted = client_untrusted \<or> (\<forall>c. sends filter_trusted {x. q_channel x = c \<and> q_data x = Return [String ''baz'']} \<longrightarrow> \<not> receives_on c client_untrusted)) \<and> (p \<noteq> inst.filter \<longrightarrow> (\<exists>e. (\<exists>s. (case p of store \<Rightarrow> Some (LOOP UserStep \<squnion> ArbitraryRequest (case Store_l of Store_l \<Rightarrow> two) \<squnion> ArbitraryResponse (case Store_l of Store_l \<Rightarrow> two), Component init_component_state) | client \<Rightarrow> Some (client_untrusted, Component init_component_state) | inst.filter \<Rightarrow> Some (filter_untrusted, Component init_component_state)) = Some (e, s)) \<and> (e = client_untrusted \<or> (\<forall>c. sends e {x. q_channel x = c \<and> q_data x = Return [String ''baz'']} \<longrightarrow> \<not> receives_on c client_untrusted))))
 3. \<And>p. p = inst.filter \<Longrightarrow> (p = inst.filter \<longrightarrow> filter_trusted = client_untrusted \<or> (\<forall>c. sends filter_trusted {x. q_channel x = c \<and> q_data x = Return [String ''baz'']} \<longrightarrow> \<not> receives_on c client_untrusted)) \<and> (p \<noteq> inst.filter \<longrightarrow> (\<exists>e. (\<exists>s. (case p of store \<Rightarrow> Some (LOOP UserStep \<squnion> ArbitraryRequest (case Store_l of Store_l \<Rightarrow> two) \<squnion> ArbitraryResponse (case Store_l of Store_l \<Rightarrow> two), Component init_component_state) | client \<Rightarrow> Some (client_untrusted, Component init_component_state) | inst.filter \<Rightarrow> Some (filter_untrusted, Component init_component_state)) = Some (e, s)) \<and> (e = client_untrusted \<or> (\<forall>c. sends e {x. q_channel x = c \<and> q_data x = Return [String ''baz'']} \<longrightarrow> \<not> receives_on c client_untrusted)))) proof (prove)
goal (3 subgoals):
 1. \<And>c. \<lbrakk>LOOP LocalOp internal \<squnion> Request (\<lambda>_. {x. q_channel x = two}) (\<lambda>_ _. UNIV\<^sub>c) \<squnion> Response (\<lambda>_ _. {(s', \<beta>). s' \<in> UNIV\<^sub>c \<and> a_channel \<beta> = two}) \<noteq> client_untrusted; sends (LocalOp internal) {x. q_channel x = c \<and> q_data x = Return [String ''baz'']} \<or> sends (Request (\<lambda>_. {x. q_channel x = two}) (\<lambda>_ _. UNIV\<^sub>c)) {x. q_channel x = c \<and> q_data x = Return [String ''baz'']} \<or> sends (Response (\<lambda>_ _. {(s', \<beta>). s' \<in> UNIV\<^sub>c \<and> a_channel \<beta> = two})) {x. q_channel x = c \<and> q_data x = Return [String ''baz'']}; receives_on c client_untrusted\<rbrakk> \<Longrightarrow> False
 2. \<And>p. p = client \<Longrightarrow> (p = inst.filter \<longrightarrow> filter_trusted = client_untrusted \<or> (\<forall>c. sends filter_trusted {x. q_channel x = c \<and> q_data x = Return [String ''baz'']} \<longrightarrow> \<not> receives_on c client_untrusted)) \<and> (p \<noteq> inst.filter \<longrightarrow> (\<exists>e. (\<exists>s. (case p of store \<Rightarrow> Some (LOOP LocalOp internal \<squnion> Request (\<lambda>_. {x. q_channel x = (case Store_l of Store_l \<Rightarrow> two)}) (\<lambda>_ _. UNIV\<^sub>c) \<squnion> Response (\<lambda>_ _. {(s', \<beta>). s' \<in> UNIV\<^sub>c \<and> a_channel \<beta> = (case Store_l of Store_l \<Rightarrow> two)}), Component init_component_state) | client \<Rightarrow> Some (client_untrusted, Component init_component_state) | inst.filter \<Rightarrow> Some (filter_untrusted, Component init_component_state)) = Some (e, s)) \<and> (e = client_untrusted \<or> (\<forall>c. sends e {x. q_channel x = c \<and> q_data x = Return [String ''baz'']} \<longrightarrow> \<not> receives_on c client_untrusted))))
 3. \<And>p. p = inst.filter \<Longrightarrow> (p = inst.filter \<longrightarrow> filter_trusted = client_untrusted \<or> (\<forall>c. sends filter_trusted {x. q_channel x = c \<and> q_data x = Return [String ''baz'']} \<longrightarrow> \<not> receives_on c client_untrusted)) \<and> (p \<noteq> inst.filter \<longrightarrow> (\<exists>e. (\<exists>s. (case p of store \<Rightarrow> Some (LOOP LocalOp internal \<squnion> Request (\<lambda>_. {x. q_channel x = (case Store_l of Store_l \<Rightarrow> two)}) (\<lambda>_ _. UNIV\<^sub>c) \<squnion> Response (\<lambda>_ _. {(s', \<beta>). s' \<in> UNIV\<^sub>c \<and> a_channel \<beta> = (case Store_l of Store_l \<Rightarrow> two)}), Component init_component_state) | client \<Rightarrow> Some (client_untrusted, Component init_component_state) | inst.filter \<Rightarrow> Some (filter_untrusted, Component init_component_state)) = Some (e, s)) \<and> (e = client_untrusted \<or> (\<forall>c. sends e {x. q_channel x = c \<and> q_data x = Return [String ''baz'']} \<longrightarrow> \<not> receives_on c client_untrusted)))) proof (prove)
goal (3 subgoals):
 1. \<And>q. \<lbrakk>LOOP LocalOp internal \<squnion> Request (\<lambda>_. {x. q_channel x = two}) (\<lambda>_ _. UNIV\<^sub>c) \<squnion> Response (\<lambda>_ _. UNIV\<^sub>c \<times> {\<beta>. a_channel \<beta> = two}) \<noteq> client_untrusted; receives_on two client_untrusted; q_channel q = two; q_data q = Return [String ''baz'']\<rbrakk> \<Longrightarrow> False
 2. \<And>p. p = client \<Longrightarrow> (p = inst.filter \<longrightarrow> filter_trusted = client_untrusted \<or> (\<forall>c. sends filter_trusted {x. q_channel x = c \<and> q_data x = Return [String ''baz'']} \<longrightarrow> \<not> receives_on c client_untrusted)) \<and> (p \<noteq> inst.filter \<longrightarrow> (\<exists>e. (\<exists>s. (case p of store \<Rightarrow> Some (LOOP LocalOp internal \<squnion> Request (\<lambda>_. {x. q_channel x = (case Store_l of Store_l \<Rightarrow> two)}) (\<lambda>_ _. UNIV\<^sub>c) \<squnion> Response (\<lambda>_ _. {(s', \<beta>). s' \<in> UNIV\<^sub>c \<and> a_channel \<beta> = (case Store_l of Store_l \<Rightarrow> two)}), Component init_component_state) | client \<Rightarrow> Some (client_untrusted, Component init_component_state) | inst.filter \<Rightarrow> Some (filter_untrusted, Component init_component_state)) = Some (e, s)) \<and> (e = client_untrusted \<or> (\<forall>c. sends e {x. q_channel x = c \<and> q_data x = Return [String ''baz'']} \<longrightarrow> \<not> receives_on c client_untrusted))))
 3. \<And>p. p = inst.filter \<Longrightarrow> (p = inst.filter \<longrightarrow> filter_trusted = client_untrusted \<or> (\<forall>c. sends filter_trusted {x. q_channel x = c \<and> q_data x = Return [String ''baz'']} \<longrightarrow> \<not> receives_on c client_untrusted)) \<and> (p \<noteq> inst.filter \<longrightarrow> (\<exists>e. (\<exists>s. (case p of store \<Rightarrow> Some (LOOP LocalOp internal \<squnion> Request (\<lambda>_. {x. q_channel x = (case Store_l of Store_l \<Rightarrow> two)}) (\<lambda>_ _. UNIV\<^sub>c) \<squnion> Response (\<lambda>_ _. {(s', \<beta>). s' \<in> UNIV\<^sub>c \<and> a_channel \<beta> = (case Store_l of Store_l \<Rightarrow> two)}), Component init_component_state) | client \<Rightarrow> Some (client_untrusted, Component init_component_state) | inst.filter \<Rightarrow> Some (filter_untrusted, Component init_component_state)) = Some (e, s)) \<and> (e = client_untrusted \<or> (\<forall>c. sends e {x. q_channel x = c \<and> q_data x = Return [String ''baz'']} \<longrightarrow> \<not> receives_on c client_untrusted)))) proof (prove)
goal (3 subgoals):
 1. \<And>q. \<lbrakk>LOOP LocalOp internal \<squnion> Request (\<lambda>_. {x. q_channel x = two}) (\<lambda>_ _. UNIV\<^sub>c) \<squnion> Response (\<lambda>_ _. UNIV\<^sub>c \<times> {\<beta>. a_channel \<beta> = two}) \<noteq> LOOP UserStep \<squnion> ArbitraryRequest (case Client_l of Client_l \<Rightarrow> one) \<squnion> ArbitraryResponse (case Client_l of Client_l \<Rightarrow> one); receives_on two LOOP UserStep \<squnion> ArbitraryRequest (case Client_l of Client_l \<Rightarrow> one) \<squnion> ArbitraryResponse (case Client_l of Client_l \<Rightarrow> one); q_channel q = two; q_data q = Return [String ''baz'']\<rbrakk> \<Longrightarrow> False
 2. \<And>p. p = client \<Longrightarrow> (p = inst.filter \<longrightarrow> filter_trusted = LOOP UserStep \<squnion> ArbitraryRequest (case Client_l of Client_l \<Rightarrow> one) \<squnion> ArbitraryResponse (case Client_l of Client_l \<Rightarrow> one) \<or> (\<forall>c. sends filter_trusted {x. q_channel x = c \<and> q_data x = Return [String ''baz'']} \<longrightarrow> \<not> receives_on c LOOP UserStep \<squnion> ArbitraryRequest (case Client_l of Client_l \<Rightarrow> one) \<squnion> ArbitraryResponse (case Client_l of Client_l \<Rightarrow> one))) \<and> (p \<noteq> inst.filter \<longrightarrow> (\<exists>e. (\<exists>s. (case p of store \<Rightarrow> Some (LOOP LocalOp internal \<squnion> Request (\<lambda>_. {x. q_channel x = (case Store_l of Store_l \<Rightarrow> two)}) (\<lambda>_ _. UNIV\<^sub>c) \<squnion> Response (\<lambda>_ _. {(s', \<beta>). s' \<in> UNIV\<^sub>c \<and> a_channel \<beta> = (case Store_l of Store_l \<Rightarrow> two)}), Component init_component_state) | client \<Rightarrow> Some (LOOP UserStep \<squnion> ArbitraryRequest (case Client_l of Client_l \<Rightarrow> one) \<squnion> ArbitraryResponse (case Client_l of Client_l \<Rightarrow> one), Component init_component_state) | inst.filter \<Rightarrow> Some (filter_untrusted, Component init_component_state)) = Some (e, s)) \<and> (e = LOOP UserStep \<squnion> ArbitraryRequest (case Client_l of Client_l \<Rightarrow> one) \<squnion> ArbitraryResponse (case Client_l of Client_l \<Rightarrow> one) \<or> (\<forall>c. sends e {x. q_channel x = c \<and> q_data x = Return [String ''baz'']} \<longrightarrow> \<not> receives_on c LOOP UserStep \<squnion> ArbitraryRequest (case Client_l of Client_l \<Rightarrow> one) \<squnion> ArbitraryResponse (case Client_l of Client_l \<Rightarrow> one)))))
 3. \<And>p. p = inst.filter \<Longrightarrow> (p = inst.filter \<longrightarrow> filter_trusted = LOOP UserStep \<squnion> ArbitraryRequest (case Client_l of Client_l \<Rightarrow> one) \<squnion> ArbitraryResponse (case Client_l of Client_l \<Rightarrow> one) \<or> (\<forall>c. sends filter_trusted {x. q_channel x = c \<and> q_data x = Return [String ''baz'']} \<longrightarrow> \<not> receives_on c LOOP UserStep \<squnion> ArbitraryRequest (case Client_l of Client_l \<Rightarrow> one) \<squnion> ArbitraryResponse (case Client_l of Client_l \<Rightarrow> one))) \<and> (p \<noteq> inst.filter \<longrightarrow> (\<exists>e. (\<exists>s. (case p of store \<Rightarrow> Some (LOOP LocalOp internal \<squnion> Request (\<lambda>_. {x. q_channel x = (case Store_l of Store_l \<Rightarrow> two)}) (\<lambda>_ _. UNIV\<^sub>c) \<squnion> Response (\<lambda>_ _. {(s', \<beta>). s' \<in> UNIV\<^sub>c \<and> a_channel \<beta> = (case Store_l of Store_l \<Rightarrow> two)}), Component init_component_state) | client \<Rightarrow> Some (LOOP UserStep \<squnion> ArbitraryRequest (case Client_l of Client_l \<Rightarrow> one) \<squnion> ArbitraryResponse (case Client_l of Client_l \<Rightarrow> one), Component init_component_state) | inst.filter \<Rightarrow> Some (filter_untrusted, Component init_component_state)) = Some (e, s)) \<and> (e = LOOP UserStep \<squnion> ArbitraryRequest (case Client_l of Client_l \<Rightarrow> one) \<squnion> ArbitraryResponse (case Client_l of Client_l \<Rightarrow> one) \<or> (\<forall>c. sends e {x. q_channel x = c \<and> q_data x = Return [String ''baz'']} \<longrightarrow> \<not> receives_on c LOOP UserStep \<squnion> ArbitraryRequest (case Client_l of Client_l \<Rightarrow> one) \<squnion> ArbitraryResponse (case Client_l of Client_l \<Rightarrow> one))))) proof (prove)
goal (3 subgoals):
 1. \<And>q. \<lbrakk>Request (\<lambda>_. {x. q_channel x = two}) (\<lambda>_ _. UNIV\<^sub>c) = ArbitraryRequest one \<longrightarrow> LocalOp internal = UserStep \<longrightarrow> Response (\<lambda>_ _. UNIV\<^sub>c \<times> {\<beta>. a_channel \<beta> = two}) \<noteq> ArbitraryResponse one; receives_on two UserStep \<or> receives_on two (ArbitraryRequest one) \<or> receives_on two (ArbitraryResponse one); q_channel q = two; q_data q = Return [String ''baz'']\<rbrakk> \<Longrightarrow> False
 2. \<And>p. p = client \<Longrightarrow> (p = inst.filter \<longrightarrow> filter_trusted = LOOP UserStep \<squnion> ArbitraryRequest (case Client_l of Client_l \<Rightarrow> one) \<squnion> ArbitraryResponse (case Client_l of Client_l \<Rightarrow> one) \<or> (\<forall>c. sends filter_trusted {x. q_channel x = c \<and> q_data x = Return [String ''baz'']} \<longrightarrow> \<not> receives_on c LOOP UserStep \<squnion> ArbitraryRequest (case Client_l of Client_l \<Rightarrow> one) \<squnion> ArbitraryResponse (case Client_l of Client_l \<Rightarrow> one))) \<and> (p \<noteq> inst.filter \<longrightarrow> (\<exists>e. (\<exists>s. (case p of store \<Rightarrow> Some (LOOP LocalOp internal \<squnion> Request (\<lambda>_. {x. q_channel x = (case Store_l of Store_l \<Rightarrow> two)}) (\<lambda>_ _. UNIV\<^sub>c) \<squnion> Response (\<lambda>_ _. {(s', \<beta>). s' \<in> UNIV\<^sub>c \<and> a_channel \<beta> = (case Store_l of Store_l \<Rightarrow> two)}), Component init_component_state) | client \<Rightarrow> Some (LOOP UserStep \<squnion> ArbitraryRequest (case Client_l of Client_l \<Rightarrow> one) \<squnion> ArbitraryResponse (case Client_l of Client_l \<Rightarrow> one), Component init_component_state) | inst.filter \<Rightarrow> Some (filter_untrusted, Component init_component_state)) = Some (e, s)) \<and> (e = LOOP UserStep \<squnion> ArbitraryRequest (case Client_l of Client_l \<Rightarrow> one) \<squnion> ArbitraryResponse (case Client_l of Client_l \<Rightarrow> one) \<or> (\<forall>c. sends e {x. q_channel x = c \<and> q_data x = Return [String ''baz'']} \<longrightarrow> \<not> receives_on c LOOP UserStep \<squnion> ArbitraryRequest (case Client_l of Client_l \<Rightarrow> one) \<squnion> ArbitraryResponse (case Client_l of Client_l \<Rightarrow> one)))))
 3. \<And>p. p = inst.filter \<Longrightarrow> (p = inst.filter \<longrightarrow> filter_trusted = LOOP UserStep \<squnion> ArbitraryRequest (case Client_l of Client_l \<Rightarrow> one) \<squnion> ArbitraryResponse (case Client_l of Client_l \<Rightarrow> one) \<or> (\<forall>c. sends filter_trusted {x. q_channel x = c \<and> q_data x = Return [String ''baz'']} \<longrightarrow> \<not> receives_on c LOOP UserStep \<squnion> ArbitraryRequest (case Client_l of Client_l \<Rightarrow> one) \<squnion> ArbitraryResponse (case Client_l of Client_l \<Rightarrow> one))) \<and> (p \<noteq> inst.filter \<longrightarrow> (\<exists>e. (\<exists>s. (case p of store \<Rightarrow> Some (LOOP LocalOp internal \<squnion> Request (\<lambda>_. {x. q_channel x = (case Store_l of Store_l \<Rightarrow> two)}) (\<lambda>_ _. UNIV\<^sub>c) \<squnion> Response (\<lambda>_ _. {(s', \<beta>). s' \<in> UNIV\<^sub>c \<and> a_channel \<beta> = (case Store_l of Store_l \<Rightarrow> two)}), Component init_component_state) | client \<Rightarrow> Some (LOOP UserStep \<squnion> ArbitraryRequest (case Client_l of Client_l \<Rightarrow> one) \<squnion> ArbitraryResponse (case Client_l of Client_l \<Rightarrow> one), Component init_component_state) | inst.filter \<Rightarrow> Some (filter_untrusted, Component init_component_state)) = Some (e, s)) \<and> (e = LOOP UserStep \<squnion> ArbitraryRequest (case Client_l of Client_l \<Rightarrow> one) \<squnion> ArbitraryResponse (case Client_l of Client_l \<Rightarrow> one) \<or> (\<forall>c. sends e {x. q_channel x = c \<and> q_data x = Return [String ''baz'']} \<longrightarrow> \<not> receives_on c LOOP UserStep \<squnion> ArbitraryRequest (case Client_l of Client_l \<Rightarrow> one) \<squnion> ArbitraryResponse (case Client_l of Client_l \<Rightarrow> one))))) proof (prove)
goal (3 subgoals):
 1. \<And>q. \<lbrakk>Request (\<lambda>_. {x. q_channel x = two}) (\<lambda>_ _. UNIV\<^sub>c) = Request (\<lambda>_. {x. q_channel x = one}) (\<lambda>_ _. UNIV\<^sub>c) \<longrightarrow> LocalOp internal = LocalOp internal \<longrightarrow> Response (\<lambda>_ _. UNIV\<^sub>c \<times> {\<beta>. a_channel \<beta> = two}) \<noteq> Response (\<lambda>_ _. {(s', \<beta>). s' \<in> UNIV\<^sub>c \<and> a_channel \<beta> = one}); receives_on two (LocalOp internal) \<or> receives_on two (Request (\<lambda>_. {x. q_channel x = one}) (\<lambda>_ _. UNIV\<^sub>c)) \<or> receives_on two (Response (\<lambda>_ _. {(s', \<beta>). s' \<in> UNIV\<^sub>c \<and> a_channel \<beta> = one})); q_channel q = two; q_data q = Return [String ''baz'']\<rbrakk> \<Longrightarrow> False
 2. \<And>p. p = client \<Longrightarrow> (p = inst.filter \<longrightarrow> filter_trusted = LOOP LocalOp internal \<squnion> Request (\<lambda>_. {x. q_channel x = (case Client_l of Client_l \<Rightarrow> one)}) (\<lambda>_ _. UNIV\<^sub>c) \<squnion> Response (\<lambda>_ _. {(s', \<beta>). s' \<in> UNIV\<^sub>c \<and> a_channel \<beta> = (case Client_l of Client_l \<Rightarrow> one)}) \<or> (\<forall>c. sends filter_trusted {x. q_channel x = c \<and> q_data x = Return [String ''baz'']} \<longrightarrow> \<not> receives_on c LOOP LocalOp internal \<squnion> Request (\<lambda>_. {x. q_channel x = (case Client_l of Client_l \<Rightarrow> one)}) (\<lambda>_ _. UNIV\<^sub>c) \<squnion> Response (\<lambda>_ _. {(s', \<beta>). s' \<in> UNIV\<^sub>c \<and> a_channel \<beta> = (case Client_l of Client_l \<Rightarrow> one)}))) \<and> (p \<noteq> inst.filter \<longrightarrow> (\<exists>e. (\<exists>s. (case p of store \<Rightarrow> Some (LOOP LocalOp internal \<squnion> Request (\<lambda>_. {x. q_channel x = (case Store_l of Store_l \<Rightarrow> two)}) (\<lambda>_ _. UNIV\<^sub>c) \<squnion> Response (\<lambda>_ _. {(s', \<beta>). s' \<in> UNIV\<^sub>c \<and> a_channel \<beta> = (case Store_l of Store_l \<Rightarrow> two)}), Component init_component_state) | client \<Rightarrow> Some (LOOP LocalOp internal \<squnion> Request (\<lambda>_. {x. q_channel x = (case Client_l of Client_l \<Rightarrow> one)}) (\<lambda>_ _. UNIV\<^sub>c) \<squnion> Response (\<lambda>_ _. {(s', \<beta>). s' \<in> UNIV\<^sub>c \<and> a_channel \<beta> = (case Client_l of Client_l \<Rightarrow> one)}), Component init_component_state) | inst.filter \<Rightarrow> Some (filter_untrusted, Component init_component_state)) = Some (e, s)) \<and> (e = LOOP LocalOp internal \<squnion> Request (\<lambda>_. {x. q_channel x = (case Client_l of Client_l \<Rightarrow> one)}) (\<lambda>_ _. UNIV\<^sub>c) \<squnion> Response (\<lambda>_ _. {(s', \<beta>). s' \<in> UNIV\<^sub>c \<and> a_channel \<beta> = (case Client_l of Client_l \<Rightarrow> one)}) \<or> (\<forall>c. sends e {x. q_channel x = c \<and> q_data x = Return [String ''baz'']} \<longrightarrow> \<not> receives_on c LOOP LocalOp internal \<squnion> Request (\<lambda>_. {x. q_channel x = (case Client_l of Client_l \<Rightarrow> one)}) (\<lambda>_ _. UNIV\<^sub>c) \<squnion> Response (\<lambda>_ _. {(s', \<beta>). s' \<in> UNIV\<^sub>c \<and> a_channel \<beta> = (case Client_l of Client_l \<Rightarrow> one)})))))
 3. \<And>p. p = inst.filter \<Longrightarrow> (p = inst.filter \<longrightarrow> filter_trusted = LOOP LocalOp internal \<squnion> Request (\<lambda>_. {x. q_channel x = (case Client_l of Client_l \<Rightarrow> one)}) (\<lambda>_ _. UNIV\<^sub>c) \<squnion> Response (\<lambda>_ _. {(s', \<beta>). s' \<in> UNIV\<^sub>c \<and> a_channel \<beta> = (case Client_l of Client_l \<Rightarrow> one)}) \<or> (\<forall>c. sends filter_trusted {x. q_channel x = c \<and> q_data x = Return [String ''baz'']} \<longrightarrow> \<not> receives_on c LOOP LocalOp internal \<squnion> Request (\<lambda>_. {x. q_channel x = (case Client_l of Client_l \<Rightarrow> one)}) (\<lambda>_ _. UNIV\<^sub>c) \<squnion> Response (\<lambda>_ _. {(s', \<beta>). s' \<in> UNIV\<^sub>c \<and> a_channel \<beta> = (case Client_l of Client_l \<Rightarrow> one)}))) \<and> (p \<noteq> inst.filter \<longrightarrow> (\<exists>e. (\<exists>s. (case p of store \<Rightarrow> Some (LOOP LocalOp internal \<squnion> Request (\<lambda>_. {x. q_channel x = (case Store_l of Store_l \<Rightarrow> two)}) (\<lambda>_ _. UNIV\<^sub>c) \<squnion> Response (\<lambda>_ _. {(s', \<beta>). s' \<in> UNIV\<^sub>c \<and> a_channel \<beta> = (case Store_l of Store_l \<Rightarrow> two)}), Component init_component_state) | client \<Rightarrow> Some (LOOP LocalOp internal \<squnion> Request (\<lambda>_. {x. q_channel x = (case Client_l of Client_l \<Rightarrow> one)}) (\<lambda>_ _. UNIV\<^sub>c) \<squnion> Response (\<lambda>_ _. {(s', \<beta>). s' \<in> UNIV\<^sub>c \<and> a_channel \<beta> = (case Client_l of Client_l \<Rightarrow> one)}), Component init_component_state) | inst.filter \<Rightarrow> Some (filter_untrusted, Component init_component_state)) = Some (e, s)) \<and> (e = LOOP LocalOp internal \<squnion> Request (\<lambda>_. {x. q_channel x = (case Client_l of Client_l \<Rightarrow> one)}) (\<lambda>_ _. UNIV\<^sub>c) \<squnion> Response (\<lambda>_ _. {(s', \<beta>). s' \<in> UNIV\<^sub>c \<and> a_channel \<beta> = (case Client_l of Client_l \<Rightarrow> one)}) \<or> (\<forall>c. sends e {x. q_channel x = c \<and> q_data x = Return [String ''baz'']} \<longrightarrow> \<not> receives_on c LOOP LocalOp internal \<squnion> Request (\<lambda>_. {x. q_channel x = (case Client_l of Client_l \<Rightarrow> one)}) (\<lambda>_ _. UNIV\<^sub>c) \<squnion> Response (\<lambda>_ _. {(s', \<beta>). s' \<in> UNIV\<^sub>c \<and> a_channel \<beta> = (case Client_l of Client_l \<Rightarrow> one)}))))) proof (prove)
goal (2 subgoals):
 1. \<And>p. p = client \<Longrightarrow> (p = inst.filter \<longrightarrow> filter_trusted = LOOP LocalOp internal \<squnion> Request (\<lambda>_. {x. q_channel x = (case Client_l of Client_l \<Rightarrow> one)}) (\<lambda>_ _. UNIV\<^sub>c) \<squnion> Response (\<lambda>_ _. {(s', \<beta>). s' \<in> UNIV\<^sub>c \<and> a_channel \<beta> = (case Client_l of Client_l \<Rightarrow> one)}) \<or> (\<forall>c. sends filter_trusted {x. q_channel x = c \<and> q_data x = Return [String ''baz'']} \<longrightarrow> \<not> receives_on c LOOP LocalOp internal \<squnion> Request (\<lambda>_. {x. q_channel x = (case Client_l of Client_l \<Rightarrow> one)}) (\<lambda>_ _. UNIV\<^sub>c) \<squnion> Response (\<lambda>_ _. {(s', \<beta>). s' \<in> UNIV\<^sub>c \<and> a_channel \<beta> = (case Client_l of Client_l \<Rightarrow> one)}))) \<and> (p \<noteq> inst.filter \<longrightarrow> (\<exists>e. (\<exists>s. (case p of store \<Rightarrow> Some (LOOP LocalOp internal \<squnion> Request (\<lambda>_. {x. q_channel x = (case Store_l of Store_l \<Rightarrow> two)}) (\<lambda>_ _. UNIV\<^sub>c) \<squnion> Response (\<lambda>_ _. {(s', \<beta>). s' \<in> UNIV\<^sub>c \<and> a_channel \<beta> = (case Store_l of Store_l \<Rightarrow> two)}), Component init_component_state) | client \<Rightarrow> Some (LOOP LocalOp internal \<squnion> Request (\<lambda>_. {x. q_channel x = (case Client_l of Client_l \<Rightarrow> one)}) (\<lambda>_ _. UNIV\<^sub>c) \<squnion> Response (\<lambda>_ _. {(s', \<beta>). s' \<in> UNIV\<^sub>c \<and> a_channel \<beta> = (case Client_l of Client_l \<Rightarrow> one)}), Component init_component_state) | inst.filter \<Rightarrow> Some (filter_untrusted, Component init_component_state)) = Some (e, s)) \<and> (e = LOOP LocalOp internal \<squnion> Request (\<lambda>_. {x. q_channel x = (case Client_l of Client_l \<Rightarrow> one)}) (\<lambda>_ _. UNIV\<^sub>c) \<squnion> Response (\<lambda>_ _. {(s', \<beta>). s' \<in> UNIV\<^sub>c \<and> a_channel \<beta> = (case Client_l of Client_l \<Rightarrow> one)}) \<or> (\<forall>c. sends e {x. q_channel x = c \<and> q_data x = Return [String ''baz'']} \<longrightarrow> \<not> receives_on c LOOP LocalOp internal \<squnion> Request (\<lambda>_. {x. q_channel x = (case Client_l of Client_l \<Rightarrow> one)}) (\<lambda>_ _. UNIV\<^sub>c) \<squnion> Response (\<lambda>_ _. {(s', \<beta>). s' \<in> UNIV\<^sub>c \<and> a_channel \<beta> = (case Client_l of Client_l \<Rightarrow> one)})))))
 2. \<And>p. p = inst.filter \<Longrightarrow> (p = inst.filter \<longrightarrow> filter_trusted = LOOP LocalOp internal \<squnion> Request (\<lambda>_. {x. q_channel x = (case Client_l of Client_l \<Rightarrow> one)}) (\<lambda>_ _. UNIV\<^sub>c) \<squnion> Response (\<lambda>_ _. {(s', \<beta>). s' \<in> UNIV\<^sub>c \<and> a_channel \<beta> = (case Client_l of Client_l \<Rightarrow> one)}) \<or> (\<forall>c. sends filter_trusted {x. q_channel x = c \<and> q_data x = Return [String ''baz'']} \<longrightarrow> \<not> receives_on c LOOP LocalOp internal \<squnion> Request (\<lambda>_. {x. q_channel x = (case Client_l of Client_l \<Rightarrow> one)}) (\<lambda>_ _. UNIV\<^sub>c) \<squnion> Response (\<lambda>_ _. {(s', \<beta>). s' \<in> UNIV\<^sub>c \<and> a_channel \<beta> = (case Client_l of Client_l \<Rightarrow> one)}))) \<and> (p \<noteq> inst.filter \<longrightarrow> (\<exists>e. (\<exists>s. (case p of store \<Rightarrow> Some (LOOP LocalOp internal \<squnion> Request (\<lambda>_. {x. q_channel x = (case Store_l of Store_l \<Rightarrow> two)}) (\<lambda>_ _. UNIV\<^sub>c) \<squnion> Response (\<lambda>_ _. {(s', \<beta>). s' \<in> UNIV\<^sub>c \<and> a_channel \<beta> = (case Store_l of Store_l \<Rightarrow> two)}), Component init_component_state) | client \<Rightarrow> Some (LOOP LocalOp internal \<squnion> Request (\<lambda>_. {x. q_channel x = (case Client_l of Client_l \<Rightarrow> one)}) (\<lambda>_ _. UNIV\<^sub>c) \<squnion> Response (\<lambda>_ _. {(s', \<beta>). s' \<in> UNIV\<^sub>c \<and> a_channel \<beta> = (case Client_l of Client_l \<Rightarrow> one)}), Component init_component_state) | inst.filter \<Rightarrow> Some (filter_untrusted, Component init_component_state)) = Some (e, s)) \<and> (e = LOOP LocalOp internal \<squnion> Request (\<lambda>_. {x. q_channel x = (case Client_l of Client_l \<Rightarrow> one)}) (\<lambda>_ _. UNIV\<^sub>c) \<squnion> Response (\<lambda>_ _. {(s', \<beta>). s' \<in> UNIV\<^sub>c \<and> a_channel \<beta> = (case Client_l of Client_l \<Rightarrow> one)}) \<or> (\<forall>c. sends e {x. q_channel x = c \<and> q_data x = Return [String ''baz'']} \<longrightarrow> \<not> receives_on c LOOP LocalOp internal \<squnion> Request (\<lambda>_. {x. q_channel x = (case Client_l of Client_l \<Rightarrow> one)}) (\<lambda>_ _. UNIV\<^sub>c) \<squnion> Response (\<lambda>_ _. {(s', \<beta>). s' \<in> UNIV\<^sub>c \<and> a_channel \<beta> = (case Client_l of Client_l \<Rightarrow> one)}))))) proof (prove)
goal (1 subgoal):
 1. \<And>p. p = inst.filter \<Longrightarrow> (p = inst.filter \<longrightarrow> filter_trusted = LOOP LocalOp internal \<squnion> Request (\<lambda>_. {x. q_channel x = (case Client_l of Client_l \<Rightarrow> one)}) (\<lambda>_ _. UNIV\<^sub>c) \<squnion> Response (\<lambda>_ _. {(s', \<beta>). s' \<in> UNIV\<^sub>c \<and> a_channel \<beta> = (case Client_l of Client_l \<Rightarrow> one)}) \<or> (\<forall>c. sends filter_trusted {x. q_channel x = c \<and> q_data x = Return [String ''baz'']} \<longrightarrow> \<not> receives_on c LOOP LocalOp internal \<squnion> Request (\<lambda>_. {x. q_channel x = (case Client_l of Client_l \<Rightarrow> one)}) (\<lambda>_ _. UNIV\<^sub>c) \<squnion> Response (\<lambda>_ _. {(s', \<beta>). s' \<in> UNIV\<^sub>c \<and> a_channel \<beta> = (case Client_l of Client_l \<Rightarrow> one)}))) \<and> (p \<noteq> inst.filter \<longrightarrow> (\<exists>e. (\<exists>s. (case p of store \<Rightarrow> Some (LOOP LocalOp internal \<squnion> Request (\<lambda>_. {x. q_channel x = (case Store_l of Store_l \<Rightarrow> two)}) (\<lambda>_ _. UNIV\<^sub>c) \<squnion> Response (\<lambda>_ _. {(s', \<beta>). s' \<in> UNIV\<^sub>c \<and> a_channel \<beta> = (case Store_l of Store_l \<Rightarrow> two)}), Component init_component_state) | client \<Rightarrow> Some (LOOP LocalOp internal \<squnion> Request (\<lambda>_. {x. q_channel x = (case Client_l of Client_l \<Rightarrow> one)}) (\<lambda>_ _. UNIV\<^sub>c) \<squnion> Response (\<lambda>_ _. {(s', \<beta>). s' \<in> UNIV\<^sub>c \<and> a_channel \<beta> = (case Client_l of Client_l \<Rightarrow> one)}), Component init_component_state) | inst.filter \<Rightarrow> Some (filter_untrusted, Component init_component_state)) = Some (e, s)) \<and> (e = LOOP LocalOp internal \<squnion> Request (\<lambda>_. {x. q_channel x = (case Client_l of Client_l \<Rightarrow> one)}) (\<lambda>_ _. UNIV\<^sub>c) \<squnion> Response (\<lambda>_ _. {(s', \<beta>). s' \<in> UNIV\<^sub>c \<and> a_channel \<beta> = (case Client_l of Client_l \<Rightarrow> one)}) \<or> (\<forall>c. sends e {x. q_channel x = c \<and> q_data x = Return [String ''baz'']} \<longrightarrow> \<not> receives_on c LOOP LocalOp internal \<squnion> Request (\<lambda>_. {x. q_channel x = (case Client_l of Client_l \<Rightarrow> one)}) (\<lambda>_ _. UNIV\<^sub>c) \<squnion> Response (\<lambda>_ _. {(s', \<beta>). s' \<in> UNIV\<^sub>c \<and> a_channel \<beta> = (case Client_l of Client_l \<Rightarrow> one)}))))) proof (prove)
goal (1 subgoal):
 1. \<And>y. \<lbrakk>filter_trusted \<noteq> LOOP LocalOp internal \<squnion> Request (\<lambda>_. {x. q_channel x = one}) (\<lambda>_ _. UNIV\<^sub>c) \<squnion> Response (\<lambda>_ _. UNIV\<^sub>c \<times> {\<beta>. a_channel \<beta> = one}); sends filter_trusted {x. q_channel x = one \<and> q_data x = Return [String ''baz'']}; UNIV\<^sub>c \<noteq> {}; a_channel y = one\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>y. \<lbrakk>LOOP LocalOp internal \<squnion> Request (\<lambda>_. {x. q_channel x = two}) (\<lambda>_ _. UNIV\<^sub>c) \<squnion> Response (\<lambda>_ _. {(s', \<beta>). s' \<in> UNIV\<^sub>c \<and> a_channel \<beta> = two}) \<squnion> Response (\<lambda>_ _. {(s', \<beta>). s' \<in> UNIV\<^sub>c \<and> a_channel \<beta> = one}) \<squnion> Request (\<lambda>_. filter_responses) discard \<noteq> LOOP LocalOp internal \<squnion> Request (\<lambda>_. {x. q_channel x = one}) (\<lambda>_ _. UNIV\<^sub>c) \<squnion> Response (\<lambda>_ _. UNIV\<^sub>c \<times> {\<beta>. a_channel \<beta> = one}); sends LOOP LocalOp internal \<squnion> Request (\<lambda>_. {x. q_channel x = two}) (\<lambda>_ _. UNIV\<^sub>c) \<squnion> Response (\<lambda>_ _. {(s', \<beta>). s' \<in> UNIV\<^sub>c \<and> a_channel \<beta> = two}) \<squnion> Response (\<lambda>_ _. {(s', \<beta>). s' \<in> UNIV\<^sub>c \<and> a_channel \<beta> = one}) \<squnion> Request (\<lambda>_. filter_responses) discard {x. q_channel x = one \<and> q_data x = Return [String ''baz'']}; UNIV\<^sub>c \<noteq> {}; a_channel y = one\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>y q. \<lbrakk>UNIV\<^sub>c \<noteq> {}; a_channel y = one; q \<in> filter_responses; q_channel q = one; q_data q = Return [String ''baz'']\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>y q. \<lbrakk>UNIV\<^sub>c \<noteq> {}; a_channel y = one; q \<in> {x. \<exists>v\<in>{''bar'', []}. q_data x = Return [String v]}; q_channel q = one; q_data q = Return [String ''baz'']\<rbrakk> \<Longrightarrow> False proof (prove)
goal:
No subgoals!