Program Definition map_tm (fs:{A:Type & stdFunspec A}) : valueTermMeas :=
  fun v n =>
  match v, n with
  | value_cons _ v, S n'  =>
     map_inner_tm (sfs_t (projT2 fs)) v n'
  | _, _ => False
  end.Fixpoint list_val_match (l:list A) (v:value) {struct l} : pred prog :=
    match l, v with
    | nil, value_label 1%positive => TT
    | x::l', value_cons v1 v2 => P x v1 && list_val_match l' v2
    | _, _ => FF
    end.Definition map_pre
  (fs:{A:Type & stdFunspec A})
  l
  (x:value) :=
  match x with
  | value_cons (value_label lab) v =>
      stdfun lab fs &&
      list_val_match (projT1 fs) (sfs_P (projT2 fs)) l v
  | _ => FF
  end.Definition map_post
  (fs:{A:Type & stdFunspec A})
  l
  (x:value) :=
  list_val_match (projT1 fs) (sfs_Q (projT2 fs)) l x.Definition map_spec (fs:{A:Type & stdFunspec A}) : {A:Type & stdFunspec A} :=
  existT (fun X => stdFunspec X) (list (projT1 fs))
    (Build_stdFunspec _ (map_tm fs) (map_pre fs) (map_post fs)).

Lemma map_verify : forall G, verify_prog phi G -> verify_prog phi ((ALL fs:{A:Type & stdFunspec A}, stdfun (L 5) (map_spec fs)) && ((ALL fs:{A:Type & stdFunspec A}, funptr (L 4) _ (map_worker_tm fs) (map_worker_pre fs) (map_worker_post fs)) && G)).