Skip to content

Migrate Aeneas to the Lean module system - #1230

Open
oliver-butterley wants to merge 43 commits into
AeneasVerif:mainfrom
oliver-butterley:new-module-system
Open

Migrate Aeneas to the Lean module system#1230
oliver-butterley wants to merge 43 commits into
AeneasVerif:mainfrom
oliver-butterley:new-module-system

Conversation

@oliver-butterley

@oliver-butterley oliver-butterley commented Jul 24, 2026

Copy link
Copy Markdown
Collaborator

The PR is twofold:

  • Migrates the Aeneas backend lean project to the module system
  • Updates the translation engine to produce Lean files which use the module system

This PR does the migration in the way that there is minimal change to the code and minimal effect to downstream users. As such, in general the full benefits of the module system aren't being used, instead many definitions are @[expose]d in order to maintain the downstream proofs which took advantage of the visibility into all defs. This was done methodically in a way that something was only ever marked meta if it was forced and something was only every marked expose if that was required to keep downstream behaviour unchanged.

That Aeneas uses the module system permits projects which depend on Aeneas to also benefit from the module system. Moreover, bit-by-bit parts of the Aeneas lean library can be updated to fully benefit from the module system.

@oliver-butterley
oliver-butterley marked this pull request as ready for review July 25, 2026 14:01
@oliver-butterley
oliver-butterley requested a review from jeprinz July 26, 2026 06:41
@oliver-butterley

Copy link
Copy Markdown
Collaborator Author

Note: The code produced by gen-lib-entry has been updated to support the module system but trying to implement a test for this revealed there was already a bug in the placement of files making the test not practical. Locally tested to do the correct thing, modulo the known bug.

See Zulip discussion: #general > ✔ -gen-lib-entry creates all files at the root.

def U32.ofNatCore := @UScalar.ofNatCore .U32
def U64.ofNatCore := @UScalar.ofNatCore .U64
def U128.ofNatCore := @UScalar.ofNatCore .U128
@[expose] def Usize.ofNatCore := @UScalar.ofNatCore .Usize

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@[expose] section could be nice here


def Post α := (α -> Prop)
def Pre := Prop
abbrev Post α := (α -> Prop)

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
abbrev Post α := (α -> Prop)
@[expose] def Post α := (α -> Prop)

def Post α := (α -> Prop)
def Pre := Prop
abbrev Post α := (α -> Prop)
abbrev Pre := Prop

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
abbrev Pre := Prop
@[expose] def Pre := Prop

abbrev Pre := Prop

def Wp α := Post α → Pre
abbrev Wp α := Post α → Pre

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
abbrev Wp α := Post α → Pre
@[expose] def Wp α := Post α → Pre

elab mods:declModifiers "impl_def " id:declId sig:optDeclSig val:declVal : command => do
let modifiers ← elabModifiers mods
let modifiers :=
if modifiers.visibility matches .regular then { modifiers with visibility := .public }

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should ideally use the visibility from the surrounding scope rather than assuming it is .public

@jeprinz jeprinz left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I had some small nitpicks.

About the #assert issue, what is currently requiring assertions to compile the code is that computation of the tests depends on System.Platform.numBits, which is used in various places in aeneas and only computes when the code is compiled.

If there are any rust files that have both definitions and tests in them then maybe when use-lean-modules true it should just skip the tests?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants