Conversion-typed processes have no sum or replication to Peer of a passive send head has an equivalent receive head

TheoremConversion-typed processes have no sum or replication#✓fully proved

Typing excludes sum and repl by syntax, not by a caller fragment premise.

theorem HasType.finiteLinear {n : Nat} {Δ : Context} {p : Proc} (h : HasType n Δ p) :
    FiniteLinear p
Uses 15 · Used by 5

TheoremParallel inversion for conversion typing#✓fully proved

Parallel inversion derives its actual disjoint map split.

theorem HasType.par_inv {n : Nat} {Δ : Context} {p q : Proc} (h : HasType n Δ (.par p q)) :
    ∃ Γ Θ, Δ = Γ ∪ Θ ∧ Finmap.Disjoint Γ Θ ∧ HasType n Γ p ∧ HasType n Θ q
Uses 14 · Used by 8

TheoremRestriction inversion for conversion typing#✓fully proved

The private pair comes from the actual restriction derivation.

theorem HasType.nu_inv {n : Nat} {Δ : Context} {p : Proc} (h : HasType n Δ (.nu p)) :
    ∃ c, HasType (n + 1) (Context.bind c Δ) p
Uses 14 · Used by 7

TheoremNil inversion for conversion typing#✓fully proved

Nil exposes actual completed ownership and key scope.

theorem HasType.nil_inv {n : Nat} {Δ : Context} (h : HasType n Δ .nil) :
    Δ.Completed ∧ (∀ e ∈ Δ, e.name.ClosedAt n)
Uses 14 · Used by 5

TheoremTyped nil admits a completed scoped capability#✓fully proved

Only a scoped actually completed capability can be added at nil.

theorem HasType.nil_insert {n : Nat} {Δ : Context} {e : Key} {c : Capability}
    (h : HasType n Δ .nil) (hc : c.protocol.unfold = .done) (he : e.name.ClosedAt n) :
    HasType n (Δ.insert e c) .nil
Uses 13 · Used by 2

TheoremWeakening conversion typing by a completed capability#✓fully proved

An unused completed endpoint may be added through every current typing constructor. Scope and freshness are explicit; active weakening is not admitted.

theorem HasType.weaken_completed {n : Nat} {Δ : Context} {p : Proc}
    (h : HasType n Δ p) {z : Key} {u : Capability} (hz : z ∉ Δ)
    (hu : u.protocol.unfold = .done) (hscope : z.name.ClosedAt n) :
    HasType n (Δ.insert z u) p
Uses 26 · Used by 2

TheoremWeakening conversion typing by a disjoint completed context#✓fully proved

A disjoint completed context can be reattached to any typed process, with the exact finite-map union required by parallel-nil congruence.

theorem HasType.weaken_completed_union {n : Nat} {Δ Θ : Context} {p : Proc}
    (h : HasType n Δ p) (hd : Finmap.Disjoint Δ Θ) (hc : Θ.Completed)
    (hs : ∀ e ∈ Θ, e.name.ClosedAt n) : HasType n (Δ ∪ Θ) p
Uses 13 · Used by 1

TheoremRemoving a parallel nil preserves conversion typing#✓fully proved

Removing a parallel nil reattaches exactly its completed ownership; no active capability is silently dropped.

theorem HasType.par_nil_elim {n : Nat} {Δ : Context} {p : Proc}
    (h : HasType n Δ (.par p .nil)) : HasType n Δ p
Uses 12 · Used by 1

TheoremErasing a role with an absent name preserves typing#✓fully proved

A role can be erased when its physical name is absent from every subject, payload and binder-adjusted continuation position of the typed term.

theorem HasType.erase_nameAbsent {n : Nat} {Δ : Context} {p : Proc}
    (h : HasType n Δ p) {z : Key} (hab : NameAbsent z.name p) :
    HasType n (Δ.erase z) p
Uses 24 · Used by 2

TheoremOwned capabilities with absent names are completed#✓fully proved

An owned capability with no physical-name occurrence must already be completed. This is derived from typing, including endpoint payload positions.

theorem HasType.absent_lookup_completed {n : Nat} {Δ : Context} {p : Proc}
    (h : HasType n Δ p) {z : Key} {t : Capability}
    (hz : Δ.lookup z = some t) (hab : NameAbsent z.name p) :
    t.protocol.unfold = .done
Uses 20 · Used by 2

TheoremRetyping along ownership-map equivalence#✓fully proved

GENERAL arbitrary-depth, arbitrary-context retyping, by all seven typing constructors. Target ownership, ranks and every unfolded branch are derived.

theorem HasType.retype {n : Nat} {Δ Ξ : Context} {p : Proc}
    (h : HasType n Δ p) (he : ContextEquivalent Δ Ξ) : HasType n Ξ p
Uses 30 · Used by 2

TheoremOwnership-map equivalence preserves typing in both directions#✓fully proved

Equivalence transports typing in BOTH directions at the same process/depth.

theorem HasType.retype_iff {n : Nat} {Δ Ξ : Context} {p : Proc}
    (he : ContextEquivalent Δ Ξ) : HasType n Δ p ↔ HasType n Ξ p
Uses 6

TheoremCollision-free renaming preserves conversion typing#✓fully proved

GENERAL name transport with collision freedom on actual owned keys and canonical ambient name scope; protocol codes, roles and ranks stay exact.

theorem HasType.rename {n m : Nat} {Δ : Context} {p : Proc} {f : Name → Name}
    (h : HasType n Δ p) (hscope : ∀ a, a.ClosedAt n → (f a).ClosedAt m)
    (hf : Set.InjOn (Key.mapName f) {e | e ∈ Δ}) :
    HasType m (Context.rekey (Key.mapName f) Δ hf) (mapProc f p)
Uses 33 · Used by 4

TheoremLifting past a binder preserves conversion typing#✓fully proved

Lift uses the canonical cutoff-aware name and process operations.

theorem HasType.lift {n : Nat} {Δ : Context} {p : Proc} (h : HasType n Δ p) (k : Nat) :
    HasType (n + 1) (Context.lift k Δ) (liftProc k p)
Uses 18 · Used by 2

TheoremSwapping adjacent binders preserves conversion typing#✓fully proved

Swap retains roles, protocols and ranks while permuting two ambient binders.

theorem HasType.swap {n k : Nat} {Δ : Context} {p : Proc} (h : HasType n Δ p) (hk : k + 1 < n) :
    HasType n (Context.swap k Δ) (swapProc k p)
Uses 18 · Used by 1

TheoremEndpoint substitution preserves conversion typing#✓fully proved

GENERAL endpoint substitution: retain the ACTUAL transmitted capability's code and rank at the sent polarized key, allowing its opposite-role alias. Collision freedom is needed only for that exact key and canonical substitution.

theorem HasType.subst_endpoint {n : Nat} {Δ : Context} {b : Name} {r : Role}
    {c v : Capability} {p : Proc}
    (h : HasType (n + 1) ((Context.lift 0 Δ).insert ⟨.var 0, r⟩ c) p)
    (he : v.Equivalent c) (hb : b.ClosedAt n) (hfresh : (⟨b, r⟩ : Key) ∉ Δ) :
    HasType n (Δ.insert ⟨b, r⟩ v) (PiCalculus.subst p b)
Uses 25 · Used by 1

TheoremEndpoint substitution with freshness from a disjoint split#✓fully proved

GENERAL split-derived freshness: actual payload ownership and the receiver's already-owned carrier derive non-aliasing even after advancement.

theorem HasType.subst_endpoint_from_split {n : Nat} {Γ Θ : Context} {b : Name} {r : Role}
    {c v old next : Capability} {e : Key} {p : Proc}
    (hd : Finmap.Disjoint Γ Θ) (hv : Γ.lookup ⟨b, r⟩ = some v)
    (hc : Θ.lookup e = some old)
    (h : HasType (n + 1) ((Context.lift 0 (Θ.insert e next)).insert ⟨.var 0, r⟩ c) p)
    (he : v.Equivalent c) (hb : b.ClosedAt n) :
    HasType n ((Θ.insert e next).insert ⟨b, r⟩ v) (PiCalculus.subst p b)
Uses 14 · Used by 1

TheoremPassive name substitution preserves conversion typing#✓fully proved

GENERAL passive substitution transports all scoped positions but adds NO capability. The input context contains only lifted outer ownership.

theorem HasType.subst_passive {n : Nat} {Δ : Context} {p : Proc} {b : Name}
    (h : HasType (n + 1) (Context.lift 0 Δ) p) (hb : b.ClosedAt n) :
    HasType n Δ (PiCalculus.subst p b)
Uses 19 · Used by 3

TheoremCommunicating subjects have semantically dual capabilities#✓fully proved

At a semantically compatible combined interface, actual disjoint same-name ownership derives opposite roles, literal cap-rank agreement and semantic duality, not raw capability equality.

theorem communicating_equivalent {Γ Θ : Context} {e f : Key} {c d : Capability}
    (hd : Finmap.Disjoint Γ Θ) (hc : Γ.lookup e = some c) (hp : Θ.lookup f = some d)
    (hn : e.name = f.name) (hco : Compatible (Γ ∪ Θ)) : d.Equivalent c.dual
Uses 10 · Used by 8

TheoremPeer of a passive send head has an equivalent receive head#✓fully proved

Semantic duality forces an actual receive-name head and equivalent tail, while keeping the receiver's literal continuation code.

theorem passive_peer_head {c d : Capability} {s : Protocol}
    (he : d.Equivalent c.dual) (hh : c.protocol.unfold = .sendName s) :
    ∃ u, d.protocol.unfold = .recvName u ∧ u.TreeEquiv s.dual
Uses 13 · Used by 4
20 fully proved

The dependency explorer needs JavaScript and its graph data.

Download the complete graph data.