Problem: string_search_naive

Your task is to implement a Naive String Search algorithm to find all occurrences of a needle (pattern) within a haystack (text) and verify its functional correctness in Dafny. Preconditions: You can assume the input text and pattern are sequences of integers (representing bytes) and their lengths are at most 1,000,000 to ensure index arithmetic does not overflow. Requirements: Implement the method naive_search which returns a seq<int> containing all starting indices. (1) The method must iterate through every possible starting position in the haystack. (2) For each position, it must perform a character-by-character comparison to check for a match. (3) Soundness & Completeness: You must prove that every index returned is a valid match and that no valid match is omitted. Verification Challenges: (1) Nested Loop Invariants: You must correctly specify the invariant for the inner comparison loop to prove it correctly identifies a match or mismatch. (2) Quantifier Instantiation: Proving completeness involves complex quantifiers (forall indices, if a match exists, it is in the result), which may require manual triggers or ghost code to show the iteration covers the entire search space.

// Following is the block for necessary definitions
// <preamble>
predicate matches_at(haystack: seq<int>, needle: seq<int>, start_index: int) {
    && 0 <= start_index
    && start_index + |needle| <= |haystack|
    && forall i :: 0 <= i < |needle| ==> 
        haystack[start_index + i] == needle[i]
}
// </preamble>

// Following is the block for potential helper specifications
// <helpers>

// </helpers>

// Following is the block for proofs of lemmas
// <proofs>

// </proofs>

// Following is the block for the main specification
// <spec>
method naive_search(haystack: seq<int>, needle: seq<int>) returns (indices: seq<int>)
    requires |haystack| < 1000000
    requires |needle| < 1000000
    ensures 
        // Type Constraint: Indices must be non-negative (simulating usize)
        forall k :: 0 <= k < |indices| ==> indices[k] >= 0
    ensures
        // Soundness: Every index returned is a valid match
        forall i :: 0 <= i < |indices| ==> 
            matches_at(haystack, needle, indices[i])
    ensures
        // Completeness: Every valid match in the haystack is found
        forall i :: matches_at(haystack, needle, i) ==> 
            exists k :: 0 <= k < |indices| && indices[k] == i
// </spec>
// <code>
{
    // Implement and verify the naive search algorithm to find a specific pattern in a string
}
// </code>