Section StateMachineSafetyProof.
Context {orig_base_params : BaseParams}.
Context {one_node_params : OneNodeParams orig_base_params}.
Context {raft_params : RaftParams orig_base_params}.
Context {rri : raft_refinement_interface}.
Context {si : sorted_interface}.
Context {lmi : log_matching_interface}.
Context {smspi : state_machine_safety'interface}.
Context {rlmli : refined_log_matching_lemmas_interface}.
Context {pllsi : prevLog_leader_sublog_interface}.
Context {ctgt0 : current_term_gt_zero_interface}.
Context {lalcii : lastApplied_le_commitIndex_interface}.
Context {miaei : match_index_all_entries_interface}.
Context {lhlli : leaders_have_leaderLogs_interface}.
Context {lci : leader_completeness_interface}.
Context {lsi : leader_sublog_interface}.
Context {taifoli : terms_and_indices_from_one_log_interface}.
Context {glci : ghost_log_correct_interface}.
Context {lphogli : log_properties_hold_on_ghost_logs_interface}.
Context {glemi : ghost_log_entries_match_interface}.
Context {tci : transitive_commit_interface}.
Context {tsi : term_sanity_interface}.
Context {lhllsi : leaders_have_leaderLogs_strong_interface}.
Context {ollpti : one_leaderLog_per_term_interface}.
Context {rmri : raft_msg_refinement_interface}.
Proof using.
intros.
unfold deghost in *. simpl in *. do_in_map.
subst. eexists; eauto.
Qed.
Proof using.
intros. unfold state_machine_safety in *. intuition.
- unfold state_machine_safety_host. intros.
do 2 eapply_prop_hyp commit_recorded_committed commit_recorded.
unfold state_machine_safety' in *. intuition. eauto.
- unfold state_machine_safety_nw. intros.
eapply_prop_hyp commit_recorded_committed commit_recorded.
unfold state_machine_safety', state_machine_safety_nw' in *. intuition.
find_apply_lem_hyp exists_deghost_packet. break_exists.
intuition. subst. simpl in *. repeat break_match. simpl in *.
subst. eapply_prop_hyp In In; repeat find_rewrite; simpl; eauto.
Qed.
Definition ghost_log_network : Type := @network _ raft_msg_refined_multi_params.
Definition ghost_log_packet : Type := @packet _ raft_msg_refined_multi_params.
Definition lifted_maxIndex_sanity (net : ghost_log_network) : Prop :=
(forall h,
lastApplied (snd (nwState net h)) <= maxIndex (log (snd (nwState net h)))) /\
(forall h, commitIndex (snd (nwState net h)) <= maxIndex (log (snd (nwState net h)))).
Proof using.
unfold msg_refined_raft_net_invariant_init, lifted_maxIndex_sanity, maxIndex_lastApplied, maxIndex_commitIndex.
intuition.
Qed.
Proof using.
unfold handleClientRequest.
intros.
repeat break_match; find_inversion; auto.
Qed.
Proof using.
intros.
destruct (log st') using (handleClientRequest_log_ind ltac:(eauto)).
- auto.
- simpl in *. break_and.
destruct (log st); simpl in *.
+ lia.
+ find_insterU. conclude_using eauto. intuition.
Qed.
Proof using si rri.
intros.
pose proof (lift_prop _ logs_sorted_invariant).
find_insterU. conclude_using eauto.
unfold logs_sorted, logs_sorted_host in *. break_and.
unfold deghost in *. simpl in *. break_match. eauto.
Qed.
Proof using rmri si rri.
intros net0 ??.
rewrite <- msg_deghost_spec with (net := net0).
eapply msg_lift_prop.
- auto using lifted_sorted_host.
- auto.
Qed.
Proof using rlmli.
intros. eapply entries_sorted_nw_invariant; eauto.
Qed.
Definition lifted_no_entries_past_current_term_host net :=
forall (h : name) e,
In e (log (snd (nwState net h))) ->
eTerm e <= currentTerm (snd (nwState net h)).
Proof using rmri tsi.
intros.
enough (no_entries_past_current_term_host (deghost (mgv_deghost net))) by
(unfold no_entries_past_current_term_host, lifted_no_entries_past_current_term_host, deghost, mgv_deghost in *;
simpl in *;
repeat break_match; simpl in *; auto).
apply msg_lift_prop_all_the_way; eauto.
intros.
eapply no_entries_past_current_term_invariant; eauto.
Qed.
Proof using rmri rri.
intros net0 ?.
rewrite deghost_spec.
rewrite msg_deghost_spec with (net := net0).
auto.
Qed.
Proof using rmri rri.
auto using simulation_1, msg_simulation_1.
Qed.
Proof using rmri si rri.
unfold msg_refined_raft_net_invariant_client_request, lifted_maxIndex_sanity, maxIndex_lastApplied, maxIndex_commitIndex.
simpl. intros.
find_copy_apply_lem_hyp handleClientRequest_maxIndex.
- intuition; simpl in *; repeat find_higher_order_rewrite; update_destruct_simplify; auto.
+ erewrite handleClientRequest_lastApplied by eauto. eauto using le_trans.
+ erewrite handleClientRequest_commitIndex by eauto. eauto using le_trans.
- match goal with H : _ |- _ => rewrite all_the_way_deghost_spec with (net := net) in H end.
eapply handleClientRequest_logs_sorted; eauto.
* auto using all_the_way_simulation_1.
* apply logs_sorted_invariant. auto using all_the_way_simulation_1.
Qed.
Proof using.
unfold msg_refined_raft_net_invariant_timeout, lifted_maxIndex_sanity, maxIndex_lastApplied, maxIndex_commitIndex.
intuition; simpl in *; repeat find_higher_order_rewrite; update_destruct_simplify; auto;
erewrite handleTimeout_log_same by eauto.
- erewrite handleTimeout_lastApplied; eauto.
- erewrite handleTimeout_commitIndex; eauto.
Qed.
Proof using.
unfold handleAppendEntries, advanceCurrentTerm;
intros; repeat break_match; repeat find_inversion; simpl; auto.
Qed.
Proof using.
induction l1; intros; simpl in *; intuition.
destruct l2; intuition. simpl in *.
specialize (H0 e). conclude H0 intuition. intuition.
Qed.
Proof using.
intros.
destruct (max a (min b c)) using (Max.max_case _ _); intuition.
Qed.
Proof using.
unfold deghost.
simpl. intuition.
apply in_map_iff.
eexists; eauto.
Qed.
Proof using.
unfold mgv_deghost.
simpl. intuition.
apply in_map_iff.
eexists; eauto.
Qed.
Proof using.
unfold deghost_packet.
simpl. auto.
Qed.
Proof using.
unfold deghost_packet.
simpl. auto.
Qed.
Proof using.
unfold mgv_deghost_packet.
simpl. auto.
Qed.
Proof using.
unfold mgv_deghost_packet.
simpl. auto.
Qed.
Proof using rmri si rri.
intros.
eapply (handleAppendEntries_logs_sorted _ (deghost_packet (mgv_deghost_packet p))).
- eauto using all_the_way_simulation_1.
- apply lift_prop.
+ apply logs_sorted_invariant.
+ auto using msg_simulation_1.
- rewrite <- all_the_way_deghost_spec.
rewrite pDst_deghost_packet.
rewrite pDst_mgv_deghost_packet.
eauto.
- rewrite pBody_deghost_packet.
rewrite pBody_mgv_deghost_packet.
auto.
- apply in_ghost_packet. apply in_mgv_ghost_packet. auto.
Qed.
Proof using.
unfold contiguous_range_exact_lo.
intuition.
Qed.
Proof using.
unfold contiguous_range_exact_lo.
intuition.
Qed.
Proof using rri.
unfold state_machine_safety, state_machine_safety_nw.
intuition.
match goal with
| [ H : _ |- _ ] => eapply H with (p := deghost_packet p)
end.
- auto using in_ghost_packet.
- rewrite pBody_deghost_packet. eauto.
- rewrite deghost_spec. eauto.
- auto.
Qed.
Proof using rmri rri.
intros net0;intros.
eapply lifted_sms_nw.
- eauto.
- eauto using in_mgv_ghost_packet.
- rewrite pBody_mgv_deghost_packet. eauto.
- rewrite msg_deghost_spec with (net := net0). eauto.
- auto.
Qed.
Proof using rri.
unfold commit_recorded.
intros.
rewrite deghost_spec.
auto.
Qed.
Proof using rmri rri.
unfold commit_recorded.
intros net0;intros.
rewrite deghost_spec.
rewrite msg_deghost_spec with (net := net0).
auto.
Qed.
Definition lifted_entries_contiguous (net : ghost_log_network) : Prop :=
forall h, contiguous_range_exact_lo (log (snd (nwState net h))) 0.
Proof using rmri rlmli.
unfold lifted_entries_contiguous.
intros.
pose proof (msg_lift_prop _ entries_contiguous_invariant _ ltac:(eauto) h).
find_rewrite_lem msg_deghost_spec.
auto.
Qed.
Definition lifted_entries_contiguous_nw (net : ghost_log_network) : Prop :=
forall p t n pli plt es ci,
In p (nwPackets net) ->
snd (pBody p) = AppendEntries t n pli plt es ci ->
contiguous_range_exact_lo es pli.
Proof using rmri rlmli.
unfold lifted_entries_contiguous_nw.
intros.
pose proof msg_lift_prop _ entries_contiguous_nw_invariant _ ltac:(eauto) (mgv_deghost_packet p).
match goal with
| [ H : context [In] |- _ ] => eapply H
end.
- auto using in_mgv_ghost_packet.
- rewrite pBody_mgv_deghost_packet. eauto.
Qed.
Definition lifted_entries_gt_0 (net : ghost_log_network) : Prop :=
forall h e,
In e (log (snd (nwState net h))) -> eIndex e > 0.
Proof using rmri rlmli.
unfold lifted_entries_gt_0.
intros.
pose proof msg_lift_prop _ entries_gt_0_invariant _ ltac:(eauto).
unfold entries_gt_0 in *.
match goal with
| [ H : _ |- _ ] => eapply H; eauto
end.
rewrite msg_deghost_spec.
eauto.
Qed.
Proof using rmri rlmli si rri.
unfold lifted_maxIndex_sanity, maxIndex_lastApplied, maxIndex_commitIndex.
intros.
intuition; simpl in *; repeat find_higher_order_rewrite; update_destruct_simplify; auto.
- erewrite handleAppendEntries_lastApplied by eauto.
assert (sorted (log d)) by (eauto using lifted_handleAppendEntries_logs_sorted).
match goal with
| _ : handleAppendEntries ?h ?s ?t ?n ?pli ?plt ?es ?ci = (?s', ?m) |- _ =>
pose proof handleAppendEntries_log_detailed
h s t n pli plt es ci s' m
end.
intuition; repeat find_rewrite.
+ eauto.
+ subst.
destruct (le_lt_dec (lastApplied (snd (nwState net (pDst p))))
(maxIndex (log d))); auto.
exfalso.
assert (In p (nwPackets net)) by (find_rewrite; intuition).
assert (exists x, eIndex x = maxIndex (log d) /\ In x (log (snd (nwState net (pDst p))))).
{
eapply contiguous_range_exact_lo_elim_exists.
- eapply lifted_entries_contiguous_invariant. auto.
- split.
+ find_apply_lem_hyp maxIndex_non_empty. break_exists.  break_and.
repeat find_rewrite.
eapply contiguous_range_exact_lo_elim_lt.
* eapply lifted_entries_contiguous_nw_invariant; eauto.
* auto.
+ eapply le_trans; [|eauto]. simpl in *. lia.
}
break_exists. break_and.
eapply findAtIndex_None; [|eauto| |]; eauto.
apply msg_lifted_sorted_host; auto.
+ subst.
destruct (le_lt_dec (lastApplied (snd (nwState net (pDst p))))
(maxIndex (log d))); auto.
exfalso.
assert (In p (nwPackets net)) by (find_rewrite; intuition).
break_exists; intuition. find_apply_lem_hyp findAtIndex_elim; intuition.
find_eapply_lem_hyp msg_lifted_sms_nw; eauto;
[|eapply msg_commit_recorded_lift_intro; eauto;
left; repeat find_rewrite; auto using lt_le_weak].
intuition.
* subst.
assert (0 < eIndex x) by (eapply lifted_entries_contiguous_invariant; eauto).
lia.
* destruct (log d); intuition. simpl in *.
intuition; subst; auto.
find_apply_hyp_hyp. lia.
+ destruct (le_lt_dec (lastApplied (snd (nwState net (pDst p)))) pli); intuition;
[eapply le_trans; [| apply sorted_maxIndex_app]; auto;
break_exists; break_and;
erewrite maxIndex_removeAfterIndex by (eauto; apply msg_lifted_sorted_host; auto);
auto|]; [idtac].
destruct (le_lt_dec (lastApplied (snd (nwState net (pDst p)))) (maxIndex es)); intuition;
[match goal with
| |- context [ maxIndex (?ll1 ++ ?ll2) ] =>
pose proof maxIndex_app ll1 ll2
end; simpl in *; intuition|]; [idtac].
assert (exists x, eIndex x = maxIndex es /\ In x (log (snd (nwState net (pDst p))))).
{
eapply contiguous_range_exact_lo_elim_exists.
- eapply lifted_entries_contiguous_invariant. auto.
- split.
+ find_apply_lem_hyp maxIndex_non_empty. break_exists.  break_and.
repeat find_rewrite.
destruct es.
* simpl in *. intuition.
* simpl.  subst.
{ eapply le_lt_trans with (m := eIndex x).
- lia.
- eapply contiguous_range_exact_lo_elim_lt.
+ eapply lifted_entries_contiguous_nw_invariant; eauto.
+ intuition.
}
+ eapply le_trans; [|eauto]. simpl in *. lia.
}
break_exists. intuition.
match goal with
| H : findAtIndex _ _ = None |- _ =>
eapply @findAtIndex_None with (x := x) in H
end; eauto.
* congruence.
* apply msg_lifted_sorted_host. auto.
+   destruct (le_lt_dec (lastApplied (snd (nwState net (pDst p)))) (maxIndex es)); intuition;
[match goal with
| |- context [ maxIndex (?ll1 ++ ?ll2) ] =>
pose proof maxIndex_app ll1 ll2
end; simpl in *; intuition|]; [idtac].
exfalso.
assert (In p (nwPackets net)) by (find_rewrite; intuition).
break_exists; intuition. find_apply_lem_hyp findAtIndex_elim; intuition.
find_copy_apply_lem_hyp maxIndex_non_empty.
break_exists. intuition.
find_eapply_lem_hyp msg_lifted_sms_nw; eauto;
[|eapply msg_commit_recorded_lift_intro; eauto;
left; repeat find_rewrite; auto using lt_le_weak].
match goal with
| _ : In ?x es, _ : maxIndex es = eIndex ?x |- _ =>
assert (pli < eIndex x)
by ( eapply contiguous_range_exact_lo_elim_lt; eauto;
eapply lifted_entries_contiguous_nw_invariant; eauto)
end.
intuition.
match goal with
| H : _ = _ ++ _ |- _ => symmetry in H
end.
destruct es; intuition;
simpl in *;
intuition; subst_max; intuition;
repeat clean;
match goal with
| _ : eIndex ?x' = eIndex ?x, H : context [eIndex ?x'] |- _ =>
specialize (H x); conclude H ltac:(apply in_app_iff; auto)
end; intuition.
- assert (sorted (log d)) by (eauto using lifted_handleAppendEntries_logs_sorted).
match goal with
| _ : handleAppendEntries ?h ?s ?t ?n ?pli ?plt ?es ?ci = (?s', ?m) |- _ =>
pose proof handleAppendEntries_log_detailed
h s t n pli plt es ci s' m
end.
intuition; repeat find_rewrite; try apply max_min_thing;
match goal with
| H : context [ lastApplied _ ] |- _ => clear H
end.
+ eauto.
+ subst.
destruct (le_lt_dec (commitIndex (snd (nwState net (pDst p))))
(maxIndex (log d))); auto.
exfalso.
assert (In p (nwPackets net)) by (find_rewrite; intuition).
assert (exists x, eIndex x = maxIndex (log d) /\ In x (log (snd (nwState net (pDst p))))).
{
eapply contiguous_range_exact_lo_elim_exists.
- eapply lifted_entries_contiguous_invariant. auto.
- split.
+ find_apply_lem_hyp maxIndex_non_empty. break_exists.  break_and.
repeat find_rewrite.
eapply contiguous_range_exact_lo_elim_lt.
* eapply lifted_entries_contiguous_nw_invariant; eauto.
* auto.
+ eapply le_trans; [|eauto]. simpl in *. lia.
}
break_exists. intuition.
find_eapply_lem_hyp findAtIndex_None; eauto.
apply msg_lifted_sorted_host. auto.
+ subst.
destruct (le_lt_dec (commitIndex (snd (nwState net (pDst p))))
(maxIndex (log d))); auto.
exfalso.
assert (In p (nwPackets net)) by (find_rewrite; intuition).
break_exists; intuition. find_apply_lem_hyp findAtIndex_elim; intuition.
find_eapply_lem_hyp msg_lifted_sms_nw; eauto;
[|eapply msg_commit_recorded_lift_intro; eauto;
right; repeat find_rewrite; intuition].
intuition.
* subst.
assert (0 < eIndex x) by (eapply lifted_entries_contiguous_invariant; eauto).
lia.
* destruct (log d); intuition. simpl in *.
intuition; subst; auto.
find_apply_hyp_hyp. lia.
+ destruct (le_lt_dec (commitIndex (snd (nwState net (pDst p)))) pli); intuition;
[eapply le_trans; [| apply sorted_maxIndex_app]; auto;
break_exists; intuition;
erewrite maxIndex_removeAfterIndex; eauto; apply msg_lifted_sorted_host; auto|]; [idtac].
destruct (le_lt_dec (commitIndex (snd (nwState net (pDst p)))) (maxIndex es)); intuition;
[match goal with
| |- context [ maxIndex (?ll1 ++ ?ll2) ] =>
pose proof maxIndex_app ll1 ll2
end; simpl in *; intuition|]; [idtac].
assert (exists x, eIndex x = maxIndex es /\ In x (log (snd (nwState net (pDst p))))).
{
eapply contiguous_range_exact_lo_elim_exists.
- eapply lifted_entries_contiguous_invariant. auto.
- split.
+ find_apply_lem_hyp maxIndex_non_empty. break_exists.  break_and.
repeat find_rewrite.
destruct es.
* simpl in *. intuition.
* simpl.  subst.
{ eapply le_lt_trans with (m := eIndex x).
- lia.
- eapply contiguous_range_exact_lo_elim_lt.
+ eapply lifted_entries_contiguous_nw_invariant; eauto.
+ intuition.
}
+ eapply le_trans; [|eauto]. simpl in *. lia.
}
break_exists. intuition.
match goal with
| H : findAtIndex _ _ = None |- _ =>
eapply @findAtIndex_None with (x := x) in H
end; eauto.
* congruence.
* apply msg_lifted_sorted_host; auto.
+ destruct (le_lt_dec (commitIndex (snd (nwState net (pDst p)))) (maxIndex es)); intuition;
[match goal with
| |- context [ maxIndex (?ll1 ++ ?ll2) ] =>
pose proof maxIndex_app ll1 ll2
end; simpl in *; intuition|]; [idtac].
exfalso.
assert (In p (nwPackets net)) by (find_rewrite; intuition).
break_exists; intuition. find_apply_lem_hyp findAtIndex_elim; intuition.
find_copy_apply_lem_hyp maxIndex_non_empty.
break_exists. intuition.
find_eapply_lem_hyp msg_lifted_sms_nw; eauto;
[|eapply msg_commit_recorded_lift_intro; eauto;
right; repeat find_rewrite; intuition].
match goal with
| _ : In ?x es, _ : maxIndex es = eIndex ?x |- _ =>
assert (pli < eIndex x)
by (eapply contiguous_range_exact_lo_elim_lt; eauto;
eapply lifted_entries_contiguous_nw_invariant; eauto)
end.
intuition.
* match goal with
| H : _ = _ ++ _ |- _ => symmetry in H
end.
destruct es; intuition;
simpl in *;
intuition; subst_max; intuition;
repeat clean;
match goal with
| _ : eIndex ?x' = eIndex ?x, H : context [eIndex ?x'] |- _ =>
specialize (H x); conclude H ltac:(apply in_app_iff; auto)
end; intuition.
Qed.
Proof using.
unfold msg_refined_raft_net_invariant_append_entries_reply,
lifted_maxIndex_sanity, maxIndex_lastApplied, maxIndex_commitIndex.
intuition; repeat find_higher_order_rewrite; update_destruct_simplify; auto.
- erewrite handleAppendEntriesReply_same_lastApplied by eauto.
erewrite handleAppendEntriesReply_same_log by eauto.
auto.
- erewrite handleAppendEntriesReply_same_commitIndex by eauto.
erewrite handleAppendEntriesReply_same_log by eauto.
auto.
Qed.
Proof using.
unfold msg_refined_raft_net_invariant_request_vote,
lifted_maxIndex_sanity, maxIndex_lastApplied, maxIndex_commitIndex.
intuition; repeat find_higher_order_rewrite; update_destruct_simplify; auto.
- erewrite handleRequestVote_same_log by eauto.
erewrite handleRequestVote_same_lastApplied by eauto.
auto.
- erewrite handleRequestVote_same_log by eauto.
erewrite handleRequestVote_same_commitIndex by eauto.
auto.
Qed.
Proof using.
unfold msg_refined_raft_net_invariant_request_vote_reply,
lifted_maxIndex_sanity, maxIndex_lastApplied, maxIndex_commitIndex.
intuition; repeat find_higher_order_rewrite; update_destruct_simplify; auto.
- rewrite handleRequestVoteReply_same_log.
rewrite handleRequestVoteReply_same_lastApplied.
auto.
- rewrite handleRequestVoteReply_same_log.
rewrite handleRequestVoteReply_same_commitIndex.
auto.
Qed.
Proof using.
unfold doLeader.
intros.
repeat break_match; repeat find_inversion; auto.
Qed.
Proof using.
induction l; intros.
- auto.
- simpl. apply IHl. apply Max.max_case_strong; lia.
Qed.
Proof using.
intros. apply fold_left_maximum_le'.
auto.
Qed.
Proof using.
induction l; intros.
- auto.
- simpl in *. revert H.
repeat (apply Max.max_case_strong; intros).
+ eauto.
+ assert (a = y) by lia. subst_max. eauto.
+ subst x. pose proof (fold_left_maximum_le l a).
assert (fold_left max l a = a) by lia.
eauto.
+ subst x.
pose proof (fold_left_maximum_le l a).
assert (fold_left max l a = a) by lia.
assert (a = y) by lia.
subst. auto.
Qed.
Proof using.
induction l; simpl.
- auto.
- intros.
specialize (IHl (max x a)).
intuition.
+ revert H.
apply Max.max_case_strong; intuition.
intuition eauto using fold_left_maxmimum_increase_init.
+ break_exists. break_and. eauto.
Qed.
Proof using.
intros.
destruct (fold_left_maximum_cases l x).
- find_rewrite. auto.
- break_exists. break_and. find_rewrite. eauto.
Qed.
Proof using.
unfold doLeader.
intros.
repeat break_match; repeat find_inversion; simpl; auto;
apply fold_left_maximum_ind; auto.
- intros. do_in_map. find_apply_lem_hyp filter_In.
subst. break_and.
apply maxIndex_is_max; eauto using findGtIndex_in.
- intros. do_in_map. find_apply_lem_hyp filter_In.
break_and. subst.
apply maxIndex_is_max; eauto using findGtIndex_in.
Qed.
Proof using rmri si rri.
unfold msg_refined_raft_net_invariant_do_leader,
lifted_maxIndex_sanity, maxIndex_lastApplied, maxIndex_commitIndex.
intuition; repeat find_higher_order_rewrite; update_destruct_simplify; auto.
- erewrite doLeader_same_log by eauto.
erewrite doLeader_same_lastApplied by eauto.
repeat match goal with
| [ H : forall _ , _ |- _ ] => specialize (H h0)
end.
unfold mgv_refined_base_params, raft_refined_base_params, refined_base_params in *.
simpl in *.
repeat find_rewrite. auto.
- repeat match goal with
| [ H : forall _ , _ |- _ ] => specialize (H h0)
end.
unfold mgv_refined_base_params, raft_refined_base_params, refined_base_params in *.
simpl in *.
repeat find_rewrite. simpl in *.
erewrite doLeader_same_commitIndex; eauto.
find_eapply_lem_hyp (msg_lifted_sorted_host net h0).
unfold mgv_refined_base_params, raft_refined_base_params, refined_base_params in *.
simpl in *.
find_rewrite. auto.
Qed.
Proof using.
unfold doGenericServer.
intros.
repeat break_match; repeat find_inversion; simpl.
- do_bool.
revert Heqb.
eapply applyEntries_spec_ind; eauto.
- do_bool.
revert Heqb.
eapply applyEntries_spec_ind; eauto.
Qed.
Proof using.
unfold msg_refined_raft_net_invariant_do_generic_server,
lifted_maxIndex_sanity, maxIndex_lastApplied, maxIndex_commitIndex.
intuition; find_higher_order_rewrite; update_destruct_simplify; auto;
erewrite doGenericServer_log by eauto.
- repeat match goal with
| [ H : forall _ , _ |- _ ] => specialize (H h0)
end.
repeat find_rewrite. simpl in *.
find_apply_lem_hyp doGenericServer_lastApplied.
unfold mgv_refined_base_params, raft_refined_base_params, refined_base_params in *.
simpl in *.
intuition; repeat find_rewrite; auto.
- repeat match goal with
| [ H : forall _ , _ |- _ ] => specialize (H h0)
end.
unfold mgv_refined_base_params, raft_refined_base_params, refined_base_params in *.
simpl in *.
repeat find_rewrite. simpl in *.
erewrite doGenericServer_commitIndex by eauto.
auto.
Qed.
Proof using.
unfold msg_refined_raft_net_invariant_state_same_packet_subset,
lifted_maxIndex_sanity, maxIndex_lastApplied, maxIndex_commitIndex.
intuition; find_reverse_higher_order_rewrite; auto.
Qed.
Proof using.
unfold msg_refined_raft_net_invariant_reboot,
lifted_maxIndex_sanity, maxIndex_lastApplied, maxIndex_commitIndex.
unfold reboot.
intuition; find_higher_order_rewrite; update_destruct_simplify; auto with *;
repeat match goal with
| [ H : forall _ , _ |- _ ] => specialize (H h0)
end;
unfold mgv_refined_base_params, raft_refined_base_params, refined_base_params in *;
simpl in *;
repeat find_rewrite; simpl in *;
auto.
Qed.
Definition lifted_directly_committed (net : ghost_log_network) (e : entry) : Prop :=
exists quorum,
NoDup quorum /\
length quorum > div2 (length nodes) /\
(forall h, In h quorum -> In (eTerm e, e) (allEntries (fst (nwState net h)))).
Definition lifted_committed (net : ghost_log_network) (e : entry) (t : term) : Prop :=
exists h e',
eTerm e' <= t /\
lifted_directly_committed net e' /\
eIndex e <= eIndex e' /\
In e (log (snd (nwState net h))) /\ In e' (log (snd (nwState net h))).
Definition commit_invariant_host (net : ghost_log_network) : Prop :=
forall h e,
In e (log (snd (nwState net h))) ->
eIndex e <= commitIndex (snd (nwState net h)) ->
lifted_committed net e (currentTerm (snd (nwState net h))).
Definition commit_invariant_nw (net : ghost_log_network) : Prop :=
forall p t lid pli plt es lci e,
In p (nwPackets net) ->
snd (pBody p) = AppendEntries t lid pli plt es lci ->
In e (fst (pBody p)) ->
eIndex e <= lci ->
lifted_committed net e t.
Definition commit_invariant (net : ghost_log_network) : Prop :=
commit_invariant_host net /\
commit_invariant_nw net.
Proof using.
unfold msg_refined_raft_net_invariant_init, commit_invariant.
split.
- unfold commit_invariant_host, commit_recorded_committed, commit_recorded, committed. simpl.
intuition.
- unfold commit_invariant_nw; simpl; intuition.
Qed.
Proof using rmri lalcii rri.
intros.
pose proof (lift_prop _ (lastApplied_le_commitIndex_invariant)).
find_apply_lem_hyp msg_simulation_1.
find_apply_hyp_hyp.
unfold lastApplied_le_commitIndex in *.
match goal with
| [ H : _ |- _ ] => specialize (H h)
end.
find_rewrite_lem deghost_spec.
find_rewrite_lem msg_deghost_spec.
auto.
Qed.
Proof using rmri.
unfold lifted_directly_committed, directly_committed.
intuition.
break_exists_exists.
intuition.
rewrite msg_deghost_spec. auto.
Qed.
Proof using rmri.
unfold lifted_directly_committed, directly_committed.
intuition.
break_exists_exists.
intuition.
find_apply_hyp_hyp.
find_rewrite_lem msg_deghost_spec. auto.
Qed.
Proof using rmri.
unfold lifted_committed, committed.
intros.
break_exists_exists.
rewrite msg_deghost_spec.
intuition auto using lifted_directly_committed_directly_committed.
Qed.
Proof using rmri.
unfold lifted_committed, committed.
intros.
break_exists_exists.
find_rewrite_lem msg_deghost_spec.
intuition auto using directly_committed_lifted_directly_committed.
Qed.
Proof using.
unfold mgv_deghost.
intros.
simpl.
destruct net. auto.
Qed.
Proof using rmri lalcii rri.
unfold commit_invariant, commit_recorded_committed, commit_recorded, commit_invariant_host.
intuition;
repeat find_rewrite_lem deghost_spec;
repeat find_rewrite_lem msg_deghost_spec';
rewrite msg_deghost_spec';
apply lifted_committed_committed; auto.
eauto using le_trans, msg_lifted_lastApplied_le_commitIndex.
Qed.
Proof using.
unfold handleClientRequest.
intros.
repeat break_match; repeat find_inversion; auto.
Qed.
Proof using.
unfold handleClientRequest.
intros.
repeat break_match; repeat find_inversion; auto.
Qed.
Proof using.
unfold directly_committed.
intuition.
break_exists_exists.
intuition.
Qed.
Proof using.
intros.
unfold update_elections_data_client_request.
repeat break_match; repeat find_inversion; auto.
simpl.
find_copy_apply_lem_hyp handleClientRequest_log.
intuition.
- repeat find_rewrite. do_bool. lia.
- right.  break_exists_exists. intuition.
congruence.
Qed.
Proof using.
intros.
find_apply_lem_hyp update_elections_data_client_request_allEntries.
intuition.
- find_rewrite. auto.
- break_exists. intuition.
repeat find_rewrite.  auto.
Qed.
Proof using.
intros.
match goal with
| [ |- context [ allEntries ?x ] ] =>
destruct (allEntries x)
using (update_elections_data_client_request_allEntries_ind ltac:(eauto))
end; intuition.
Qed.
Proof using.
intros.
destruct (log st') using (handleClientRequest_log_ind ltac:(eauto)); intuition.
Qed.
Proof using.
unfold committed.
intros.
break_exists_exists.
intuition.
eapply directly_committed_allEntries_preserved; eauto.
Qed.
Proof using rmri.
intros.
find_apply_lem_hyp lifted_committed_committed.
find_eapply_lem_hyp committed_log_allEntries_preserved; eauto.
apply committed_lifted_committed.
eapply committed_log_allEntries_preserved; eauto;
intros;
repeat find_rewrite_lem msg_deghost_spec;
rewrite msg_deghost_spec; auto.
Qed.
Proof using rmri rri.
intros.
match goal with
| [ H : _, H' : _ |- _ ] => apply H in H'; clear H
end.
unfold maxIndex_sanity, maxIndex_lastApplied, maxIndex_commitIndex in *.
break_and.
repeat match goal with
| [ H : _ |- _ ] => specialize (H h)
end.
repeat find_rewrite_lem deghost_spec.
repeat find_rewrite_lem msg_deghost_spec'.
auto.
Qed.
Proof using.
unfold haveNewEntries.
intros.
find_rewrite. auto.
Qed.
Proof using rmri.
intros.
eapply lifted_committed_log_allEntries_preserved; simpl; eauto.
- intros. find_higher_order_rewrite.
update_destruct_simplify; eauto using handleClientRequest_preservers_log.
- intros. find_higher_order_rewrite.
update_destruct_simplify; eauto using update_elections_data_client_request_preserves_allEntries.
Qed.
Proof using.
unfold not_empty.
intros.
break_match; congruence.
Qed.
Proof using.
unfold haveNewEntries.
intros.
do_bool. split.
- auto using not_empty_intro.
- break_match; auto.
apply Bool.negb_true_iff.
do_bool. intuition eauto.
Qed.
Definition lifted_prevLog_leader_sublog (net : network) : Prop :=
forall leader p t leaderId prevLogIndex prevLogTerm entries leaderCommit,
type (snd (nwState net leader)) = Leader ->
In p (nwPackets net) ->
snd (pBody p) = AppendEntries t leaderId prevLogIndex prevLogTerm entries leaderCommit ->
currentTerm (snd (nwState net leader)) = prevLogTerm ->
0 < prevLogIndex ->
0 < prevLogTerm ->
exists ple, eIndex ple = prevLogIndex /\
eTerm ple = prevLogTerm /\
In ple (log (snd (nwState net leader))).
Proof using rmri pllsi rri.
intros.
pose proof (msg_lift_prop _ (lift_prop _ prevLog_leader_sublog_invariant)).
find_insterU. conclude_using eauto.
unfold prevLog_leader_sublog, lifted_prevLog_leader_sublog in *.
intros.
find_apply_lem_hyp in_mgv_ghost_packet.
find_apply_lem_hyp in_ghost_packet.
unfold deghost in *. simpl in *. break_match. simpl in *. subst.
specialize (H0 leader).
destruct (nwState leader). simpl in *.
eauto.
Qed.
Proof using rmri rri.
unfold msg_refined_raft_net_invariant_client_request, commit_invariant.
intros. split.
- { unfold commit_invariant_host in *. break_and.
unfold commit_recorded_committed, commit_recorded in *.
intros. simpl in *.
repeat find_higher_order_rewrite.
rewrite update_fun_comm with (f := snd).
repeat match goal with H : _ |- _ => rewrite update_fun_comm with (f := snd) in H end.
simpl in *.
repeat match goal with
| [H : _ |- _] => rewrite (update_fun_comm _ raft_data _) in H
end.
rewrite (update_fun_comm  _ raft_data).
rewrite update_nop_ext' by (now erewrite <- handleClientRequest_currentTerm by eauto).
match goal with
| [H : _ |- _] => rewrite update_nop_ext' in H
by (now erewrite <- handleClientRequest_commitIndex by eauto)
end.
update_destruct_simplify.
- find_copy_apply_lem_hyp handleClientRequest_log.
break_and. break_or_hyp.
+ repeat find_rewrite.
eapply lifted_committed_log_allEntries_preserved; eauto.
* simpl. intros. find_higher_order_rewrite.
update_destruct_simplify; repeat find_rewrite; auto.
* simpl. intros. find_higher_order_rewrite.
update_destruct_simplify; eauto using update_elections_data_client_request_preserves_allEntries.
+ break_exists. break_and. repeat find_rewrite.
simpl in *.
match goal with
| [ H : _ \/ In _ _ |- _ ] => invc H
end.
* find_eapply_lem_hyp (lift_max_index_sanity net h0); auto.
break_and. simpl in *. lia.
* { eapply lifted_committed_log_allEntries_preserved; eauto.
- simpl. intros. find_higher_order_rewrite.
update_destruct_simplify; repeat find_rewrite; auto.
find_reverse_rewrite.
eapply handleClientRequest_preservers_log; eauto.
- simpl. intros. find_higher_order_rewrite.
update_destruct_simplify; eauto using update_elections_data_client_request_preserves_allEntries.
}
- eapply lifted_committed_log_allEntries_preserved; eauto.
+ simpl. intros. find_higher_order_rewrite.
update_destruct_simplify; repeat find_rewrite; eauto using handleClientRequest_preservers_log.
+ simpl. intros. find_higher_order_rewrite.
update_destruct_simplify; eauto using update_elections_data_client_request_preserves_allEntries.
}
- unfold commit_invariant_nw in *.
simpl. intros.
find_apply_hyp_hyp.
intuition.
+ eapply hCR_preserves_committed; eauto. simpl. subst. auto.
+ unfold send_packets in *.
do_in_map.
unfold add_ghost_msg in *.
do_in_map.
subst. simpl in *.
exfalso. eapply handleClientRequest_no_append_entries; eauto 10.
Qed.
Proof using rmri.
intros.
eapply lifted_committed_log_allEntries_preserved; eauto.
- intros. repeat find_higher_order_rewrite. update_destruct_simplify.
+ now erewrite handleTimeout_log_same by eauto.
+ auto.
- intros. repeat find_higher_order_rewrite. update_destruct_simplify.
+ now rewrite update_elections_data_timeout_allEntries.
+ auto.
Qed.
Proof using.
unfold lifted_committed.
intros.
break_exists_exists.
intuition.
Qed.
Proof using rmri.
unfold msg_refined_raft_net_invariant_timeout, commit_invariant.
simpl. intuition.
- unfold commit_invariant_host in *.
simpl. intros.
repeat find_higher_order_rewrite.
update_destruct_simplify.
+ eapply handleTimeout_preserves_committed; eauto.
match goal with
| [ H : context [commitIndex] |- _ ] => erewrite handleTimeout_commitIndex in H by eauto
end.
match goal with
| [ H : context [log] |- _ ] => erewrite handleTimeout_log_same in H by eauto
end.
eapply lifted_committed_monotonic; [eauto|].
find_apply_lem_hyp handleTimeout_type_strong.
intuition; repeat find_rewrite; auto.
+ eapply handleTimeout_preserves_committed; eauto.
- unfold commit_invariant_nw in *.
simpl. intros.
find_apply_hyp_hyp.
intuition.
* eapply handleTimeout_preserves_committed; eauto.
simpl. intros. subst. auto.
* do_in_map.
subst. simpl in *.
unfold add_ghost_msg in *.
do_in_map.
subst. simpl in *.
find_eapply_lem_hyp handleTimeout_packets; eauto.
exfalso. eauto 10.
Qed.
Proof using.
unfold committed, directly_committed.
simpl. intros.
break_exists_exists.
find_higher_order_rewrite.
intuition.
break_exists_exists.  intuition.
find_higher_order_rewrite. auto.
Qed.
Proof using rmri.
intros.
apply committed_lifted_committed.
find_apply_lem_hyp lifted_committed_committed.
unfold mgv_deghost in *.
eauto using committed_ext.
Qed.
Definition lifted_state_machine_safety_nw' net :=
forall p t leaderId prevLogIndex prevLogTerm entries leaderCommit e t',
In p (nwPackets net) ->
snd (pBody p) = AppendEntries t leaderId prevLogIndex prevLogTerm
entries leaderCommit ->
lifted_committed net e t' ->
t >= t' ->
(prevLogIndex > eIndex e \/
(prevLogIndex = eIndex e /\ prevLogTerm = eTerm e) \/
eIndex e > maxIndex entries \/
In e entries).
Proof using rmri smspi.
intros.
unfold lifted_state_machine_safety_nw'.
intros.
find_apply_lem_hyp lifted_committed_committed.
find_apply_lem_hyp in_mgv_ghost_packet.
match goal with
| _ : snd (pBody ?p) = ?x |- _ =>
assert (pBody (@mgv_deghost_packet _ _ ghost_log_params p) = x)
by (rewrite pBody_mgv_deghost_packet; auto)
end.
eapply state_machine_safety'_invariant; eauto.
eapply msg_lift_prop; eauto.
Qed.
Proof using rmri rlmli.
intros.
find_apply_lem_hyp in_mgv_ghost_packet.
match goal with
| _ : snd (pBody ?p) = ?x |- _ =>
assert (pBody (@mgv_deghost_packet _ _ ghost_log_params p) = x)
by (rewrite pBody_mgv_deghost_packet; auto)
end.
find_eapply_lem_hyp entries_sorted_nw_invariant; eauto.
eapply msg_lift_prop; eauto.
Qed.
Proof using.
unfold update_elections_data_appendEntries.
intros. break_let. break_match; auto.
break_if; auto.
simpl. intuition.
Qed.
Proof using rmri tci.
intros net0;intros.
apply committed_lifted_committed.
find_apply_lem_hyp lifted_committed_committed.
repeat match goal with
| H : _ |- _ =>
rewrite <- msg_deghost_spec with (net := net0) in H
end.
eapply transitive_commit_invariant; eauto.
eapply msg_lift_prop; eauto.
Qed.
Proof using rmri tsi rlmli smspi si rri.
intros.
unfold lifted_committed in *.
break_exists_name host. break_exists_name e'.
exists host, e'.
intuition.
- (* directly committed doesn't change *)
unfold lifted_directly_committed in *.
break_exists_exists; intuition.
find_higher_order_rewrite.
update_destruct_simplify; eauto using update_elections_data_appendEntries_preserves_allEntries'.
- (* e is still around *)
find_higher_order_rewrite.
update_destruct_simplify; simpl in *; eauto.
assert (lifted_committed net e (currentTerm (snd (nwState net host)))) by
(unfold lifted_committed;
exists host, e'; intuition;
eapply lifted_no_entries_past_current_term_host_invariant; eauto).
find_eapply_lem_hyp handleAppendEntries_log_detailed. intuition; repeat find_rewrite; eauto.
+ (* pli = 0, no entry at maxIndex es *)
find_copy_eapply_lem_hyp lifted_state_machine_safety_nw'_invariant; eauto.
assert (eIndex e > 0) by (eapply lifted_entries_gt_0_invariant; eauto).
intuition; try lia.
find_copy_eapply_lem_hyp msg_lifted_sorted_host.
exfalso.
enough (exists e, eIndex e = (maxIndex es) /\ In e (log (snd (nwState net host)))) by
(break_exists;
intuition; eapply findAtIndex_None; eauto).
eapply contiguous_range_exact_lo_elim_exists;
[apply lifted_entries_contiguous_invariant; auto|].
intuition.
* find_apply_lem_hyp maxIndex_non_empty.
break_exists; intuition; repeat find_rewrite.
enough (eIndex x > 0) by lia.
eapply lifted_entries_contiguous_nw_invariant; eauto.
* enough (eIndex e <= maxIndex (log (snd (nwState net host)))) by lia.
apply maxIndex_is_max; auto.
+ (* pli = 0, bad entry at maxIndex es *)
find_copy_eapply_lem_hyp lifted_state_machine_safety_nw'_invariant; eauto.
assert (eIndex e > 0) by (eapply lifted_entries_gt_0_invariant; eauto).
intuition; try lia.
break_exists. intuition.
find_apply_lem_hyp maxIndex_non_empty.
break_exists_name maxEntry; intuition.
repeat find_rewrite.
find_false.
f_equal.
find_apply_lem_hyp findAtIndex_elim.
intuition.
eapply uniqueIndices_elim_eq; [| |eauto|];
eauto using sorted_uniqueIndices,lifted_entries_sorted_nw.
match goal with
| |- In ?e _ =>
assert (lifted_committed net e (currentTerm (snd (nwState net host)))) by
(unfold lifted_committed;
exists host, e'; intuition;
eapply lifted_no_entries_past_current_term_host_invariant; eauto)
end.
find_copy_eapply_lem_hyp lifted_state_machine_safety_nw'_invariant; eauto.
assert (eIndex x > 0) by (eapply lifted_entries_gt_0_invariant; eauto).
intuition; lia.
+ find_copy_eapply_lem_hyp lifted_state_machine_safety_nw'_invariant; eauto.
intuition;
try solve
[apply in_app_iff; right; apply removeAfterIndex_le_In; auto; lia];
[idtac].
find_copy_eapply_lem_hyp msg_lifted_sorted_host.
exfalso.
enough (exists e, eIndex e = (maxIndex es) /\ In e (log (snd (nwState net host)))) by
(break_exists;
intuition; eapply findAtIndex_None; eauto).
eapply contiguous_range_exact_lo_elim_exists;
[apply lifted_entries_contiguous_invariant; auto|].
intuition.
* find_apply_lem_hyp maxIndex_non_empty.
break_exists; intuition; repeat find_rewrite.
enough (eIndex x0 > 0) by lia.
enough (eIndex x0 > pli) by lia.
eapply lifted_entries_contiguous_nw_invariant; eauto.
* enough (eIndex e <= maxIndex (log (snd (nwState net host)))) by lia.
apply maxIndex_is_max; auto.
+ find_copy_eapply_lem_hyp lifted_state_machine_safety_nw'_invariant; eauto.
intuition;
try solve
[apply in_app_iff; right; apply removeAfterIndex_le_In; auto; lia];
[idtac].
break_exists. intuition.
find_apply_lem_hyp maxIndex_non_empty.
break_exists_name maxEntry; intuition.
repeat find_rewrite.
find_false.
f_equal.
find_apply_lem_hyp findAtIndex_elim.
intuition.
eapply uniqueIndices_elim_eq; [| |eauto|];
eauto using sorted_uniqueIndices,lifted_entries_sorted_nw.
match goal with
| |- In ?e _ =>
assert (lifted_committed net e (currentTerm (snd (nwState net host)))) by
(unfold lifted_committed;
exists host, e'; intuition;
eapply lifted_no_entries_past_current_term_host_invariant; eauto)
end.
find_copy_eapply_lem_hyp lifted_state_machine_safety_nw'_invariant; eauto.
intuition; try lia;
enough (pli < eIndex maxEntry) by lia;
eapply lifted_entries_contiguous_nw_invariant; eauto.
- find_higher_order_rewrite.
update_destruct_simplify; simpl in *; eauto.
assert (lifted_committed net e' (currentTerm (snd (nwState net host)))) by
(unfold lifted_committed;
exists host, e'; intuition;
eapply lifted_no_entries_past_current_term_host_invariant; eauto).
find_eapply_lem_hyp handleAppendEntries_log_detailed. intuition; repeat find_rewrite; eauto.
+ (* pli = 0, no entry at maxIndex es *)
find_copy_eapply_lem_hyp lifted_state_machine_safety_nw'_invariant; eauto.
assert (eIndex e' > 0) by (eapply lifted_entries_gt_0_invariant; eauto).
intuition; try lia.
find_copy_eapply_lem_hyp msg_lifted_sorted_host.
exfalso.
enough (exists e, eIndex e = (maxIndex es) /\ In e (log (snd (nwState net host)))) by
(break_exists;
intuition; eapply findAtIndex_None; eauto).
eapply contiguous_range_exact_lo_elim_exists;
[apply lifted_entries_contiguous_invariant; auto|].
intuition.
* find_apply_lem_hyp maxIndex_non_empty.
break_exists; intuition; repeat find_rewrite.
enough (eIndex x > 0) by lia.
eapply lifted_entries_contiguous_nw_invariant; eauto.
* enough (eIndex e' <= maxIndex (log (snd (nwState net host)))) by lia.
apply maxIndex_is_max; auto.
+ (* pli = 0, bad entry at maxIndex es *)
find_copy_eapply_lem_hyp lifted_state_machine_safety_nw'_invariant; eauto.
assert (eIndex e' > 0) by (eapply lifted_entries_gt_0_invariant; eauto).
intuition; try lia.
break_exists. intuition.
find_apply_lem_hyp maxIndex_non_empty.
break_exists_name maxEntry; intuition.
repeat find_rewrite.
find_false.
f_equal.
find_apply_lem_hyp findAtIndex_elim.
intuition.
eapply uniqueIndices_elim_eq; [| |eauto|];
eauto using sorted_uniqueIndices,lifted_entries_sorted_nw.
match goal with
| |- In ?e _ =>
assert (lifted_committed net e (currentTerm (snd (nwState net host)))) by
(unfold lifted_committed;
exists host, e'; intuition;
eapply lifted_no_entries_past_current_term_host_invariant; eauto)
end.
find_copy_eapply_lem_hyp lifted_state_machine_safety_nw'_invariant; eauto.
assert (eIndex x > 0) by (eapply lifted_entries_gt_0_invariant; eauto).
intuition; lia.
+ find_copy_eapply_lem_hyp lifted_state_machine_safety_nw'_invariant; eauto.
intuition;
try solve
[apply in_app_iff; right; apply removeAfterIndex_le_In; auto; lia];
[idtac].
find_copy_eapply_lem_hyp msg_lifted_sorted_host.
exfalso.
enough (exists e, eIndex e = (maxIndex es) /\ In e (log (snd (nwState net host)))) by
(break_exists;
intuition; eapply findAtIndex_None; eauto).
eapply contiguous_range_exact_lo_elim_exists;
[apply lifted_entries_contiguous_invariant; auto|].
intuition.
* find_apply_lem_hyp maxIndex_non_empty.
break_exists; intuition; repeat find_rewrite.
enough (eIndex x0 > 0) by lia.
enough (eIndex x0 > pli) by lia.
eapply lifted_entries_contiguous_nw_invariant; eauto.
* enough (eIndex e' <= maxIndex (log (snd (nwState net host)))) by lia.
apply maxIndex_is_max; auto.
+ find_copy_eapply_lem_hyp lifted_state_machine_safety_nw'_invariant; eauto.
intuition;
try solve
[apply in_app_iff; right; apply removeAfterIndex_le_In; auto; lia];
[idtac].
break_exists. intuition.
find_apply_lem_hyp maxIndex_non_empty.
break_exists_name maxEntry; intuition.
repeat find_rewrite.
find_false.
f_equal.
find_apply_lem_hyp findAtIndex_elim.
intuition.
eapply uniqueIndices_elim_eq; [| |eauto|];
eauto using sorted_uniqueIndices,lifted_entries_sorted_nw.
match goal with
| |- In ?e _ =>
assert (lifted_committed net e (currentTerm (snd (nwState net host)))) by
(unfold lifted_committed;
exists host, e'; intuition;
eapply lifted_no_entries_past_current_term_host_invariant; eauto)
end.
find_copy_eapply_lem_hyp lifted_state_machine_safety_nw'_invariant; eauto.
intuition; try lia;
enough (pli < eIndex maxEntry) by lia;
eapply lifted_entries_contiguous_nw_invariant; eauto.
Qed.
Proof using.
intros.
unfold handleAppendEntries, advanceCurrentTerm in *.
repeat break_match; find_inversion; simpl in *;
do_bool; auto.
Qed.
Proof using.
intros. unfold handleAppendEntries in *.
break_if; [find_inversion; subst; eauto|].
break_if;
[do_bool; break_if; find_inversion; subst;
try find_apply_lem_hyp haveNewEntries_true;
simpl in *; intuition eauto using advanceCurrentTerm_log, advanceCurrentTerm_commitIndex, some_none, advanceCurrentTerm_term|].
simpl in *. intuition eauto using advanceCurrentTerm_log, advanceCurrentTerm_commitIndex.
break_match; [|find_inversion; subst; eauto].
break_if; [find_inversion; subst; eauto|].
break_if; [|find_inversion; subst; eauto using advanceCurrentTerm_log, advanceCurrentTerm_commitIndex].
find_inversion; subst; simpl in *.
right. right.
find_apply_lem_hyp findAtIndex_elim.
intuition; do_bool; find_apply_lem_hyp haveNewEntries_true;
intuition eauto using advanceCurrentTerm_term; congruence.
Qed.
Definition lifted_entries_gt_0_nw (net : ghost_log_network) : Prop :=
forall p t n pli plt es ci e,
In p (nwPackets net) ->
snd (pBody p) = AppendEntries t n pli plt es ci ->
In e es ->
eIndex e > 0.
Proof using rmri rlmli.
unfold lifted_entries_gt_0_nw.
intros.
pose proof msg_lift_prop _ entries_gt_0_nw_invariant _ ltac:(eauto).
unfold entries_gt_0_nw in *.
find_apply_lem_hyp in_mgv_ghost_packet.
match goal with
| [ H : _ |- _ ] => eapply H; eauto
end.
Qed.
Definition lifted_entries_sorted_nw' (net : ghost_log_network) :=
forall p t n pli plt es ci,
In p (nwPackets net) ->
snd (pBody p) = AppendEntries t n pli plt es ci ->
sorted es.
Proof using rmri rlmli.
intros.
pose proof msg_lift_prop _ entries_sorted_nw_invariant.
find_copy_apply_hyp_hyp.
unfold entries_sorted_nw, lifted_entries_sorted_nw' in *.
intros.
find_apply_lem_hyp in_mgv_ghost_packet.
eapply_prop_hyp In In; eauto.
Qed.
Proof using rmri tsi glemi lphogli glci rlmli smspi si rri.
unfold commit_invariant.
intros.
assert (In p (nwPackets net)) by (repeat find_rewrite; auto with *).
split.
- break_and.
match goal with
| [ H : commit_invariant_host _ |- _ ] =>
rename H into Hhost;
unfold commit_invariant_host in *
end.
simpl. intros.
eapply lifted_committed_ext; eauto.
match goal with
| [ H : forall _, _ = _ |- _ ] => rewrite H in *
end.
update_destruct_simplify.
+ (* e is in h's log *)
find_copy_apply_lem_hyp handleAppendEntries_log_detailed.
break_or_hyp.
* break_and. repeat find_rewrite.
eapply lifted_committed_monotonic; [
solve [eapply handleAppendEntries_preserves_commit; eauto] |
solve [eauto using handleAppendEntries_currentTerm_le] ].
* { break_or_hyp; repeat break_and.
- (* beginning of time case *)
repeat match goal with
| [ H : _ <= _, H': _ |- _ ] => rewrite H' in H
end.
find_apply_lem_hyp NPeano.Nat.max_le. break_or_hyp.
+ (* my log is just the entries in the incoming AE.
so e was in the incoming entries.
but eIndex e <= old commit index.
by maxIndex_commitIndex, exists e' in old log such that eIndex e = eIndex e'.
note that e' is committed in the pre state by IH.
now apply SMS'_nw invariant to e' to get four cases.
first three are absurd by index calculation.
it follows that e' is in es.
but our new log is just es, so e' is in the new log.
by thus e = e' by unique indices.
thus e is committed.
*)
assert (eIndex e > 0) by (eapply lifted_entries_gt_0_nw_invariant; eauto).
assert (exists e', eIndex e' = eIndex e /\ In e' (log (snd (nwState net (pDst p))))).
{
eapply contiguous_range_exact_lo_elim_exists.
- eapply lifted_entries_contiguous_invariant. auto.
- split.
+ auto.
+ eapply le_trans; [eauto|].
eapply_prop lifted_maxIndex_sanity.
}
break_exists_name e'.
break_and.
assert (lifted_committed net e' (currentTerm (snd (nwState net (pDst p))))) as He'committed
by (apply Hhost; [auto|congruence]) .
find_copy_eapply_lem_hyp lifted_state_machine_safety_nw'_invariant; eauto.
concludes.
assert (sorted (log d)) by (eauto using lifted_handleAppendEntries_logs_sorted).
intuition.
* lia.
* lia.
* match goal with
| [ H : _ |- _ ] => eapply maxIndex_is_max in H; eauto; [idtac]
end.
lia.
* assert (e = e') by (eapply uniqueIndices_elim_eq; eauto using sorted_uniqueIndices).
subst.
eapply lifted_committed_monotonic; [
solve [eapply handleAppendEntries_preserves_commit; eauto] |
solve [eauto using handleAppendEntries_currentTerm_le] ].
+ (* eIndex e <= incoming ci.
result follows by the network invariant. *)
match goal with
| [ H : commit_invariant_nw _ |- _ ] =>
rename H into Hnet; unfold commit_invariant_nw in *
end.
eapply_prop_hyp In In; [| eauto | | eauto using Min.min_glb_l].
* eapply handleAppendEntries_preserves_commit; eauto.
* find_eapply_lem_hyp ghost_log_correct_invariant; eauto.
conclude_using eauto.
{ intuition.
- match goal with
| [ H : In _ _, H' : _ |- _ ] => rewrite H' in H
end. auto.
- break_exists. break_and.
pose proof log_properties_hold_on_ghost_logs_invariant _ ltac:(eauto) as Hprop.
unfold log_properties_hold_on_ghost_logs in *.
unfold msg_log_property in *.
specialize (Hprop (fun l => forall e, In e l -> eIndex e > 0) p).
conclude_using ltac:(intros; eapply lifted_entries_gt_0_invariant; eauto).
conclude_using eauto. simpl in *.
find_apply_hyp_hyp.
lia.
}
- (* middle of time case *)
break_exists_name ple. break_and.
repeat match goal with
| [ H : _ <= _, H': _ |- _ ] => rewrite H' in H
end.
find_apply_lem_hyp NPeano.Nat.max_le. break_or_hyp.
+ (* eIndex e <= old commit index *)
repeat find_rewrite.
match goal with
| [ H : In e (_ ++ _) |- _ ] => apply in_app_or in H; destruct H
end.
* (* e is new *)
{ assert (eIndex e > 0) by (eapply lifted_entries_gt_0_nw_invariant; eauto).
assert (exists e', eIndex e' = eIndex e /\ In e' (log (snd (nwState net (pDst p))))).
{
eapply contiguous_range_exact_lo_elim_exists.
- eapply lifted_entries_contiguous_invariant. auto.
- split.
+ auto.
+ eapply le_trans; [eauto|].
eapply_prop lifted_maxIndex_sanity.
}
break_exists_name e'.
break_and.
assert (lifted_committed net e' (currentTerm (snd (nwState net (pDst p))))) as He'committed
by (apply Hhost; [auto|congruence]) .
find_copy_eapply_lem_hyp lifted_state_machine_safety_nw'_invariant; eauto.
concludes.
assert (sorted es) by
(eapply lifted_entries_sorted_nw'_invariant; eauto).
assert (contiguous_range_exact_lo es (eIndex ple)) by
(eapply lifted_entries_contiguous_nw_invariant; eauto).
find_eapply_lem_hyp contiguous_range_exact_lo_elim_lt; eauto.
intuition.
* lia.
* lia.
* match goal with
| [ H : _ |- _ ] => eapply maxIndex_is_max in H; eauto with *; [idtac]
end.
lia.
* assert (e = e') by (eapply uniqueIndices_elim_eq; eauto using sorted_uniqueIndices).
subst.
eapply lifted_committed_monotonic; [
solve [eapply handleAppendEntries_preserves_commit; eauto] |
solve [eauto using handleAppendEntries_currentTerm_le] ].
}
* (* e is old *)
{ eapply lifted_committed_monotonic.
- eapply handleAppendEntries_preserves_commit; eauto.
eapply Hhost with (h := pDst p); eauto using removeAfterIndex_in.
- eauto using handleAppendEntries_currentTerm_le.
}
+ (* eIndex e <= new commit index *)
match goal with
| [ H : In e _ |- _ ] =>
repeat match goal with
| [ H' : _ |- _ ] => rewrite H' in H
end;
apply in_app_or in H; destruct H
end.
* (* e is new *)
(* follows from network invariant *)
{ match goal with
| [ H : commit_invariant_nw _ |- _ ] =>
rename H into Hnet; unfold commit_invariant_nw in *
end.
match goal with
| [ H : In _ (nwPackets _), H' : _ |- _ ] => eapply H' in H
end; [| eauto | | eauto using Min.min_glb_l].
* eapply handleAppendEntries_preserves_commit; eauto.
* find_copy_eapply_lem_hyp ghost_log_correct_invariant; eauto.
conclude_using eauto.
{ intuition.
- match goal with
| [ H : In _ _, H' : _ |- _ ] => rewrite H' in H
end. auto.
- break_exists_name gple. break_and.
subst.
eauto using findGtIndex_in.
}
}
* (* e is old *)
(* eIndex e <= pli by ghost log contiguous, exists e' in ghost log such that eIndex e = eIndex e'. e' is committed by the nw invariant. by ghost log matching, e = e'. thus e is committed. *)
assert (eIndex e <= eIndex ple) by
(eapply removeAfterIndex_In_le; eauto using msg_lifted_sorted_host).
pose proof log_properties_hold_on_ghost_logs_invariant _ ltac:(eauto) as Hprop.
unfold log_properties_hold_on_ghost_logs in *.
unfold msg_log_property in *.
specialize (Hprop (fun l => contiguous_range_exact_lo l 0) p).
conclude_using ltac:(intros; eapply lifted_entries_contiguous_invariant; eauto).
concludes.
simpl in *.
find_copy_eapply_lem_hyp ghost_log_correct_invariant; eauto.
conclude_using eauto.
{ intuition.
- subst. find_apply_lem_hyp removeAfterIndex_in.
pose proof lifted_entries_gt_0_invariant _ ltac:(eauto) _ _ ltac:(eauto).
lia.
- break_exists_name gple. break_and.
assert (exists e', eIndex e' = eIndex e /\ In e' (fst (pBody p))).
{
eapply contiguous_range_exact_lo_elim_exists; eauto.
split.
+ eapply lifted_entries_gt_0_invariant; eauto using removeAfterIndex_in.
+ eapply le_trans with (m := eIndex gple); try lia.
apply maxIndex_is_max; auto.
pose proof log_properties_hold_on_ghost_logs_invariant _ ltac:(eauto) as Hsort.
unfold log_properties_hold_on_ghost_logs in *.
unfold msg_log_property in *.
specialize (Hsort sorted p msg_lifted_sorted_host).
auto.
}
break_exists_name e'. break_and.
find_apply_lem_hyp removeAfterIndex_in.
assert (e = e').
{
eapply uniqueIndices_elim_eq;
eauto using msg_lifted_sorted_host, sorted_uniqueIndices.
pose proof ghost_log_entries_match_invariant _ ltac:(eauto) (pDst p) _ ltac:(eauto)
as Hem.
specialize (Hem ple gple e').
repeat concludes.
assert (eIndex e' <= eIndex ple) by lia.
intuition.
}
subst.
match goal with
| [ H : commit_invariant_nw _ |- _ ] =>
rename H into Hnet; unfold commit_invariant_nw in *
end.
eapply handleAppendEntries_preserves_commit; eauto.
eapply Hnet; eauto using Min.min_glb_l.
}
}
+ eapply handleAppendEntries_preserves_commit; eauto.
- (* nw invariant preserved *)
break_and.
unfold commit_invariant_nw in *.
simpl. intros.
find_apply_hyp_hyp.
intuition.
+ eapply handleAppendEntries_preserves_commit; eauto.
simpl. subst. auto.
+ subst. simpl in *.
find_apply_lem_hyp handleAppendEntries_not_append_entries.
subst. exfalso. eauto 10.
Qed.
Proof using rmri.
intros.
eapply lifted_committed_log_allEntries_preserved; eauto.
- intros. repeat find_higher_order_rewrite. update_destruct_simplify.
+ now erewrite handleAppendEntriesReply_same_log by eauto.
+ auto.
- intros. repeat find_higher_order_rewrite. update_destruct_simplify; auto.
Qed.
Proof using rmri.
unfold msg_refined_raft_net_invariant_append_entries_reply, commit_invariant.
simpl. intros.
split.
- unfold commit_invariant_host in *.
simpl. intuition.
repeat find_higher_order_rewrite.
update_destruct_simplify.
+ eapply handleAppendEntriesReply_preserves_commit; eauto.
match goal with
| [ H : context [commitIndex] |- _ ] => erewrite handleAppendEntriesReply_same_commitIndex in H by eauto
end.
match goal with
| [ H : context [log] |- _ ] => erewrite handleAppendEntriesReply_same_log in H by eauto
end.
eapply lifted_committed_monotonic; [eauto|].
find_apply_lem_hyp handleAppendEntriesReply_type_term.
intuition; repeat find_rewrite; auto.
+ eapply handleAppendEntriesReply_preserves_commit; eauto.
- unfold commit_invariant_nw in *.
simpl. intros.
find_apply_hyp_hyp.
intuition.
+ eapply handleAppendEntriesReply_preserves_commit; eauto.
simpl. subst. auto.
+ do_in_map. unfold add_ghost_msg in *. do_in_map.
subst. simpl in *.
find_apply_lem_hyp handleAppendEntriesReply_packets.
subst. simpl in *. intuition.
Qed.
Proof using rmri.
intros.
eapply lifted_committed_log_allEntries_preserved; eauto.
- intros. find_higher_order_rewrite. update_destruct_simplify.
+ now erewrite handleRequestVote_same_log by eauto.
+ auto.
- intros. find_higher_order_rewrite. update_destruct_simplify.
+ now rewrite update_elections_data_requestVote_allEntries.
+ auto.
Qed.
Proof using rmri.
unfold msg_refined_raft_net_invariant_request_vote, commit_invariant.
simpl. intuition.
- unfold commit_invariant_host in *.
simpl. intros.
repeat find_higher_order_rewrite.
update_destruct_simplify.
+ eapply handleRequestVote_preserves_committed; eauto.
match goal with
| [ H : context [commitIndex] |- _ ] => erewrite handleRequestVote_same_commitIndex in H by eauto
end.
match goal with
| [ H : context [log] |- _ ] => erewrite handleRequestVote_same_log in H by eauto
end.
eapply lifted_committed_monotonic; eauto.
find_apply_lem_hyp handleRequestVote_currentTerm_leaderId.
intuition.
unfold mgv_refined_base_params, raft_refined_base_params, refined_base_params in *.
simpl in *.
repeat find_rewrite. auto.
+ eapply handleRequestVote_preserves_committed; eauto.
- unfold commit_invariant_nw in *.
simpl. intros.
find_apply_hyp_hyp. intuition.
+ eapply handleRequestVote_preserves_committed; eauto.
simpl. intros. subst. auto.
+ subst. simpl in *. unfold write_ghost_log in *.
find_apply_lem_hyp handleRequestVote_no_append_entries.
subst.
exfalso. eauto 10.
Qed.
Proof using rmri.
intros.
eapply lifted_committed_log_allEntries_preserved; eauto.
- intros. repeat find_higher_order_rewrite. update_destruct_simplify.
+ erewrite handleRequestVoteReply_log; eauto.
+ auto.
- intros. repeat find_higher_order_rewrite. update_destruct_simplify.
+ rewrite update_elections_data_requestVoteReply_allEntries. auto.
+ auto.
Qed.
Proof using rmri.
unfold msg_refined_raft_net_invariant_request_vote_reply, commit_invariant.
simpl. intuition.
- unfold commit_invariant_host in *. simpl. intuition.
match goal with
| [ H : forall h, st' h = _ |- _ ] => repeat rewrite H in *
end. destruct (name_eq_dec (pDst p) h).
+ subst h. subst gd. rewrite_update. simpl in *.
eapply handleRequestVoteReply_preserves_committed; eauto.
find_copy_apply_lem_hyp handleRequestVoteReply_type.
subst.
match goal with
| [ H : context [commitIndex] |- _ ] => rewrite handleRequestVoteReply_same_commitIndex in H
end.
match goal with
| [ H : context [log] |- _ ] => erewrite handleRequestVoteReply_same_log in H
end.
eapply lifted_committed_monotonic; eauto.
intuition; repeat find_rewrite; auto.
+ rewrite_update. eapply handleRequestVoteReply_preserves_committed; eauto.
simpl. subst. auto.
- unfold commit_invariant_nw. simpl.
intros.
find_apply_hyp_hyp.
eapply handleRequestVoteReply_preserves_committed; eauto.
simpl. subst. auto.
Qed.
Proof using.
unfold committed, directly_committed.
simpl. intros.
break_exists_exists.
find_higher_order_rewrite.
intuition.
break_exists_exists.  intuition.
find_higher_order_rewrite. auto.
Qed.
Proof using rmri.
intros.
apply committed_lifted_committed.
find_apply_lem_hyp lifted_committed_committed.
unfold mgv_deghost in *.
eauto using committed_ext'.
Qed.
Proof using.
unfold doLeader.
intros.
destruct st. simpl in *.
repeat break_match; repeat find_inversion; simpl in *; eauto.
right. intuition.
- intros.
do_in_map. subst.
find_apply_lem_hyp filter_In. break_and.
break_if; try discriminate.
eexists. intuition eauto.
- intuition.
Qed.
Proof using miaei.
unfold haveQuorum, directly_committed.
intros. do_bool.
eexists. intuition eauto.
- apply filter_NoDup. pose proof no_dup_nodes. simpl in *. auto.
- find_apply_lem_hyp filter_In. break_and. do_bool.
eapply match_index_all_entries_invariant; eauto.
Qed.
Proof using miaei.
unfold advanceCommitIndex.
intros. simpl in *.
match goal with
| [ H : context [fold_left Nat.max ?l ?x] |- _ ] =>
pose proof fold_left_maximum_cases l x
end. intuition.
break_exists. break_and.
find_apply_lem_hyp in_map_iff.
break_exists_name witness. break_and.
find_apply_lem_hyp filter_In.  break_and.
find_apply_lem_hyp findGtIndex_necessary. do_bool. break_and. do_bool. break_and.
do_bool.
unfold committed.
exists h, witness. intuition.
eapply haveQuorum_directly_committed; eauto.
Qed.
Proof using rmri miaei.
intros.
find_apply_lem_hyp msg_simulation_1.
match goal with
| [ H : refined_raft_intermediate_reachable _ |- _ ] =>
eapply advanceCommitIndex_committed in H
end;
repeat rewrite msg_deghost_spec' in *;
eauto using committed_lifted_committed, lifted_committed_committed.
Qed.
Proof using.
tauto.
Qed.
Definition lifted_leaders_have_leaderLogs_strong (net : ghost_log_network) :=
forall h,
type (snd (nwState net h)) = Leader ->
exists ll es,
In (currentTerm (snd (nwState net h)), ll) (leaderLogs (fst (nwState net h))) /\
log (snd (nwState net h)) = es ++ ll /\
(forall e : entry, In e es -> eTerm e = currentTerm (snd (nwState net h))).
Proof using rmri lhllsi.
unfold lifted_leaders_have_leaderLogs_strong.
intros.
pose proof msg_lift_prop _ leaders_have_leaderLogs_strong_invariant _ ltac:(eauto) h.
rewrite msg_deghost_spec' in *. auto.
Qed.
Definition lifted_one_leaderLog_per_term (net : ghost_log_network) : Prop :=
forall h h' t ll ll',
In (t, ll) (leaderLogs (fst (nwState net h))) ->
In (t, ll') (leaderLogs (fst (nwState net h'))) ->
h = h' /\ ll = ll'.
Proof using rmri ollpti.
unfold lifted_one_leaderLog_per_term.
intros.
pose proof msg_lift_prop _ one_leaderLog_per_term_invariant _ ltac:(eauto) h h' t ll ll'.
repeat rewrite msg_deghost_spec' in *. auto.
Qed.
Proof using rmri ollpti lhllsi.
intros.
find_copy_apply_lem_hyp lifted_leaders_have_leaderLogs_strong_invariant; auto.
break_exists_name ll'.
break_exists_name es.
break_and.
find_eapply_lem_hyp (lifted_one_leaderLog_per_term_invariant _ ltac:(eauto) leader leader _ ll ll' ltac:(eauto)).
intuition. subst.
unfold mgv_refined_base_params, raft_refined_base_params, refined_base_params in *.
simpl in *.
repeat find_rewrite. intuition.
Qed.
Definition lifted_leaders_have_leaderLogs (net : ghost_log_network) : Prop :=
forall h,
type (snd (nwState net h)) = Leader ->
exists ll,
In (currentTerm (snd (nwState net h)), ll) (leaderLogs (fst (nwState net h))).
Proof using rmri lhlli.
intros.
pose proof msg_lift_prop _ leaders_have_leaderLogs_invariant _ ltac:(eauto).
unfold leaders_have_leaderLogs, lifted_leaders_have_leaderLogs in *.
intros.
match goal with
| [ H : _ |- _ ] => specialize (H h)
end.
repeat find_rewrite_lem msg_deghost_spec.
auto.
Qed.
Definition lifted_leader_completeness_directly_committed (net : ghost_log_network) : Prop :=
forall t e log h,
lifted_directly_committed net e ->
t > eTerm e -> In (t, log) (leaderLogs (fst (nwState net h))) -> In e log.
Definition lifted_leader_completeness_committed (net : ghost_log_network) : Prop :=
forall t t' e log h,
lifted_committed net e t ->
t' > t -> In (t', log) (leaderLogs (fst (nwState net h))) -> In e log.
Definition lifted_leader_completeness (net : ghost_log_network) : Prop :=
lifted_leader_completeness_directly_committed net /\
lifted_leader_completeness_committed net.
Proof using rmri lci.
intros.
pose proof msg_lift_prop _ leader_completeness_invariant _ ltac:(eauto).
unfold lifted_leader_completeness, leader_completeness in *.
intuition.
- unfold lifted_leader_completeness_directly_committed, leader_completeness_directly_committed in *.
intros.
find_apply_lem_hyp lifted_directly_committed_directly_committed.
eapply_prop_hyp directly_committed directly_committed; eauto.
rewrite msg_deghost_spec'. eauto.
- unfold lifted_leader_completeness_committed, leader_completeness_committed in *.
intros.
find_apply_lem_hyp lifted_committed_committed.
eapply_prop_hyp committed committed; eauto.
rewrite msg_deghost_spec'. eauto.
Qed.
Definition msg_lifted_leader_sublog_host (net : ghost_log_network) : Prop :=
forall leader e h,
type (snd (nwState net leader)) = Leader ->
In e (log (snd (nwState net h))) ->
eTerm e = currentTerm (snd (nwState net leader)) ->
In e (log (snd (nwState net leader))).
Proof using rmri lsi rri.
intros.
pose proof msg_lift_prop _ (lift_prop _ leader_sublog_invariant_invariant) _ ltac:(eauto).
simpl in *.
unfold leader_sublog_invariant, leader_sublog_host_invariant, msg_lifted_leader_sublog_host in *.
intuition.
match goal with
| [ H : _ |- _ ] =>
specialize (H leader e h)
end.
repeat find_rewrite_lem deghost_spec.
repeat find_rewrite_lem msg_deghost_spec.
auto.
Qed.
Proof using rmri rlmli.
intros.
find_apply_lem_hyp msg_simulation_1.
find_eapply_lem_hyp entries_match_invariant.
repeat rewrite msg_deghost_spec' in *.
eauto.
Qed.
Proof using taifoli rri.
intros net0;intros.
pose proof (lift_prop _ terms_and_indices_from_one_log_invariant).
unfold terms_and_indices_from_one_log in *.
rewrite <- deghost_spec with (net := net0). auto.
Qed.

Lemma doLeader_preserves_committed :
forall (net net' : ghost_log_network) d h os d' ms gd  e t,
doLeader d h = (os, d', ms) ->
nwState net h = (gd, d) ->
(forall h', nwState net' h' = update name_eq_dec (nwState net) h (gd, d') h') ->
lifted_committed net e t ->
lifted_committed net' e t.