(** Proofs about validation. **)

(* Specifications: *)
(* When ps = ps', validation is finished.  Then we know that the program actually satisfies the claimed specification. *)
Lemma validate_finished : forall ps pu,
validate ps pu ps ->
forall n, satisfies_spec pu ps n.
(* Validation base case. No claims are proved.*)
Lemma validate_empty : forall pu ps,
validate pu ps (fun _ => None).
(* Validation, interesting case.  We wish to add the proof of a new function to the proved set.  To do so, we must produce the appropriate hoare tuple which demonstrates the correctness of the function body. *)
Lemma validate_add : forall pu ps' ps i fs fd,
pu i = Some fd ->
satisfies_spec pu ps' |--
All a:(fs_A fs), hoare_ pu (func_post fs a) (func_pre fd fs a) (fnd_cmd fd) FF ->
validate ps' pu ps ->
validate ps' pu (fun i' => if eq_nat_dec i i' then Some fs else ps i').
(* Top-level safety theorem.  If we have verified an entire program then we can call any of the functions in the program in a state satisfing the function's precondition. *)
Lemma validate_correct : forall pu ps n i f fs rho m args vals a,
satisfies_spec pu ps n ->
ps f = Some fs ->
evaluate_exprs rho args vals ->
(fs_pre fs a vals * TT)%pred (n,(rho,m)) ->
LocalsMap.map_share i rho = Share.top ->
safen pu (kseq (call i f args) knil) (n,(rho,m)).