Fixpoint gamma_sub (G G':etype) {struct G} : Prop :=
match G, G' with
| nil, nil => True
| x::xs, y::ys => TT |-- y >=> x /\ gamma_sub xs ys
| _, _ => False
end.

(* Specifications: *)
Lemma etype_valid_sub : forall G G' env a,
gamma_sub G G' ->
etype_valid env G' a ->
etype_valid env G  a.
Lemma T_weaken_sub : forall G G' e tau,
gamma_sub G G' ->
Typ G  e tau ->
Typ G' e tau.
Lemma T_sub : forall G tau tau' e,
TT |-- tau >=> tau' ->
Typ G e tau ->
Typ G e tau'.
Lemma T_Nat : forall G n,
Typ G (Nat n) ty_nat.
Lemma T_Var: forall G x tau,
nth_error G x = Some tau -> (* g(x) = tau *)
Typ G (Var x) tau.
Lemma T_Abs: forall G sigma e tau,
Typ (sigma :: G) e tau ->
Typ G (Lam e) (ty_lam sigma tau).