Section StateMachineSafetyProof.
Context {orig_base_params : BaseParams}.
Context {one_node_params : OneNodeParams orig_base_params}.
Context {raft_params : RaftParams orig_base_params}.
Context {rri : raft_refinement_interface}.
Context {si : sorted_interface}.
Context {lmi : log_matching_interface}.
Context {smspi : state_machine_safety'interface}.
Context {rlmli : refined_log_matching_lemmas_interface}.
Context {pllsi : prevLog_leader_sublog_interface}.
Context {ctgt0 : current_term_gt_zero_interface}.
Context {lalcii : lastApplied_le_commitIndex_interface}.
Context {miaei : match_index_all_entries_interface}.
Context {lhlli : leaders_have_leaderLogs_interface}.
Context {lci : leader_completeness_interface}.
Context {lsi : leader_sublog_interface}.
Context {taifoli : terms_and_indices_from_one_log_interface}.
Context {glci : ghost_log_correct_interface}.
Context {lphogli : log_properties_hold_on_ghost_logs_interface}.
Context {glemi : ghost_log_entries_match_interface}.
Context {tci : transitive_commit_interface}.
Context {tsi : term_sanity_interface}.
Context {lhllsi : leaders_have_leaderLogs_strong_interface}.
Context {ollpti : one_leaderLog_per_term_interface}.
Context {rmri : raft_msg_refinement_interface}.
Proof using.
intros.
unfold deghost in *. simpl in *. do_in_map.
subst. eexists; eauto.
Qed.
Proof using.
intros. unfold state_machine_safety in *. intuition.
- unfold state_machine_safety_host. intros.
do 2 eapply_prop_hyp commit_recorded_committed commit_recorded.
unfold state_machine_safety' in *. intuition. eauto.
- unfold state_machine_safety_nw. intros.
eapply_prop_hyp commit_recorded_committed commit_recorded.
unfold state_machine_safety', state_machine_safety_nw' in *. intuition.
find_apply_lem_hyp exists_deghost_packet. break_exists.
intuition. subst. simpl in *. repeat break_match. simpl in *.
subst. eapply_prop_hyp In In; repeat find_rewrite; simpl; eauto.
Qed.
Definition ghost_log_network : Type := @network _ raft_msg_refined_multi_params.
Definition ghost_log_packet : Type := @packet _ raft_msg_refined_multi_params.
Definition lifted_maxIndex_sanity (net : ghost_log_network) : Prop :=
(forall h,
lastApplied (snd (nwState net h)) <= maxIndex (log (snd (nwState net h)))) /\
(forall h, commitIndex (snd (nwState net h)) <= maxIndex (log (snd (nwState net h)))).
Proof using.
unfold msg_refined_raft_net_invariant_init, lifted_maxIndex_sanity, maxIndex_lastApplied, maxIndex_commitIndex.
intuition.
Qed.
Proof using.
unfold handleClientRequest.
intros.
repeat break_match; find_inversion; auto.
Qed.
Proof using.
intros.
destruct (log st') using (handleClientRequest_log_ind ltac:(eauto)).
- auto.
- simpl in *. break_and.
destruct (log st); simpl in *.
+ lia.
+ find_insterU. conclude_using eauto. intuition.
Qed.
Proof using si rri.
intros.
pose proof (lift_prop _ logs_sorted_invariant).
find_insterU. conclude_using eauto.
unfold logs_sorted, logs_sorted_host in *. break_and.
unfold deghost in *. simpl in *. break_match. eauto.
Qed.
Proof using rmri si rri.
intros net0 ??.
rewrite <- msg_deghost_spec with (net := net0).
eapply msg_lift_prop.
- auto using lifted_sorted_host.
- auto.
Qed.
Proof using rlmli.
intros. eapply entries_sorted_nw_invariant; eauto.
Qed.
Definition lifted_no_entries_past_current_term_host net :=
forall (h : name) e,
In e (log (snd (nwState net h))) ->
eTerm e <= currentTerm (snd (nwState net h)).
Proof using rmri tsi.
intros.
enough (no_entries_past_current_term_host (deghost (mgv_deghost net))) by
(unfold no_entries_past_current_term_host, lifted_no_entries_past_current_term_host, deghost, mgv_deghost in *;
simpl in *;
repeat break_match; simpl in *; auto).
apply msg_lift_prop_all_the_way; eauto.
intros.
eapply no_entries_past_current_term_invariant; eauto.
Qed.
Proof using rmri rri.
intros net0 ?.
rewrite deghost_spec.
rewrite msg_deghost_spec with (net := net0).
auto.
Qed.
Proof using rmri rri.
auto using simulation_1, msg_simulation_1.
Qed.
Proof using rmri si rri.
unfold msg_refined_raft_net_invariant_client_request, lifted_maxIndex_sanity, maxIndex_lastApplied, maxIndex_commitIndex.
simpl. intros.
find_copy_apply_lem_hyp handleClientRequest_maxIndex.
- intuition; simpl in *; repeat find_higher_order_rewrite; update_destruct_simplify; auto.
+ erewrite handleClientRequest_lastApplied by eauto. eauto using le_trans.
+ erewrite handleClientRequest_commitIndex by eauto. eauto using le_trans.
- match goal with H : _ |- _ => rewrite all_the_way_deghost_spec with (net := net) in H end.
eapply handleClientRequest_logs_sorted; eauto.
* auto using all_the_way_simulation_1.
* apply logs_sorted_invariant. auto using all_the_way_simulation_1.
Qed.
Proof using.
unfold msg_refined_raft_net_invariant_timeout, lifted_maxIndex_sanity, maxIndex_lastApplied, maxIndex_commitIndex.
intuition; simpl in *; repeat find_higher_order_rewrite; update_destruct_simplify; auto;
erewrite handleTimeout_log_same by eauto.
- erewrite handleTimeout_lastApplied; eauto.
- erewrite handleTimeout_commitIndex; eauto.
Qed.
Proof using.
unfold handleAppendEntries, advanceCurrentTerm;
intros; repeat break_match; repeat find_inversion; simpl; auto.
Qed.
Proof using.
induction l1; intros; simpl in *; intuition.
destruct l2; intuition. simpl in *.
specialize (H0 e). conclude H0 intuition. intuition.
Qed.
Proof using.
intros.
destruct (max a (min b c)) using (Max.max_case _ _); intuition.
Qed.
Proof using.
unfold deghost.
simpl. intuition.
apply in_map_iff.
eexists; eauto.
Qed.
Proof using.
unfold mgv_deghost.
simpl. intuition.
apply in_map_iff.
eexists; eauto.
Qed.
Proof using.
unfold deghost_packet.
simpl. auto.
Qed.
Proof using.
unfold deghost_packet.
simpl. auto.
Qed.
Proof using.
unfold mgv_deghost_packet.
simpl. auto.
Qed.
Proof using.
unfold mgv_deghost_packet.
simpl. auto.
Qed.
Proof using rmri si rri.
intros.
eapply (handleAppendEntries_logs_sorted _ (deghost_packet (mgv_deghost_packet p))).
- eauto using all_the_way_simulation_1.
- apply lift_prop.
+ apply logs_sorted_invariant.
+ auto using msg_simulation_1.
- rewrite <- all_the_way_deghost_spec.
rewrite pDst_deghost_packet.
rewrite pDst_mgv_deghost_packet.
eauto.
- rewrite pBody_deghost_packet.
rewrite pBody_mgv_deghost_packet.
auto.
- apply in_ghost_packet. apply in_mgv_ghost_packet. auto.
Qed.
Proof using.
unfold contiguous_range_exact_lo.
intuition.
Qed.
Proof using.
unfold contiguous_range_exact_lo.
intuition.
Qed.
Proof using rri.
unfold state_machine_safety, state_machine_safety_nw.
intuition.
match goal with
| [ H : _ |- _ ] => eapply H with (p := deghost_packet p)
end.
- auto using in_ghost_packet.
- rewrite pBody_deghost_packet. eauto.
- rewrite deghost_spec. eauto.
- auto.
Qed.
Proof using rmri rri.
intros net0;intros.
eapply lifted_sms_nw.
- eauto.
- eauto using in_mgv_ghost_packet.
- rewrite pBody_mgv_deghost_packet. eauto.
- rewrite msg_deghost_spec with (net := net0). eauto.
- auto.
Qed.
Proof using rri.
unfold commit_recorded.
intros.
rewrite deghost_spec.
auto.
Qed.
Proof using rmri rri.
unfold commit_recorded.
intros net0;intros.
rewrite deghost_spec.
rewrite msg_deghost_spec with (net := net0).
auto.
Qed.
Definition lifted_entries_contiguous (net : ghost_log_network) : Prop :=
forall h, contiguous_range_exact_lo (log (snd (nwState net h))) 0.
Proof using rmri rlmli.
unfold lifted_entries_contiguous.
intros.
pose proof (msg_lift_prop _ entries_contiguous_invariant _ ltac:(eauto) h).
find_rewrite_lem msg_deghost_spec.
auto.
Qed.
Definition lifted_entries_contiguous_nw (net : ghost_log_network) : Prop :=
forall p t n pli plt es ci,
In p (nwPackets net) ->
snd (pBody p) = AppendEntries t n pli plt es ci ->
contiguous_range_exact_lo es pli.
Proof using rmri rlmli.
unfold lifted_entries_contiguous_nw.
intros.
pose proof msg_lift_prop _ entries_contiguous_nw_invariant _ ltac:(eauto) (mgv_deghost_packet p).
match goal with
| [ H : context [In] |- _ ] => eapply H
end.
- auto using in_mgv_ghost_packet.
- rewrite pBody_mgv_deghost_packet. eauto.
Qed.
Definition lifted_entries_gt_0 (net : ghost_log_network) : Prop :=
forall h e,
In e (log (snd (nwState net h))) -> eIndex e > 0.
Proof using rmri rlmli.
unfold lifted_entries_gt_0.
intros.
pose proof msg_lift_prop _ entries_gt_0_invariant _ ltac:(eauto).
unfold entries_gt_0 in *.
match goal with
| [ H : _ |- _ ] => eapply H; eauto
end.
rewrite msg_deghost_spec.
eauto.
Qed.

Lemma lifted_maxIndex_sanity_append_entries :
forall xs (p : ghost_log_packet) ys (net : ghost_log_network) st' ps' gd d m t n pli plt es ci,
handleAppendEntries (pDst p) (snd (nwState net (pDst p))) t n pli plt es ci = (d, m) ->
gd = update_elections_data_appendEntries (pDst p) (nwState net (pDst p)) t n pli plt es ci ->
snd (pBody p) = AppendEntries t n pli plt es ci ->
lifted_maxIndex_sanity net ->
state_machine_safety (deghost (mgv_deghost net)) ->
msg_refined_raft_intermediate_reachable net ->
nwPackets net = xs ++ p :: ys ->
(forall h, st' h = update name_eq_dec (nwState net) (pDst p) (gd, d) h) ->
(forall (p' : ghost_log_packet), In p' ps' -> In p' (xs ++ ys) \/
mgv_deghost_packet p' = mkPacket (params := raft_refined_multi_params)
(pDst p) (pSrc p) m) ->
lifted_maxIndex_sanity (mkNetwork ps' st').