From f74812f8eda48194b622bdd318f35d3a6b6328cd Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Mon, 6 Jul 2026 10:15:56 +0300 Subject: Add layered formal-verification harness Adds four complementary layers to verify correctness, all runnable locally, weakest-but-broadest to strongest-but-narrowest: 0. Paper proofs (docs/verification.md): Hoare invariants, termination measures, and permutation arguments for every algorithm. 1. Property tests (sort/property_test.go): testing/quick asserting ordering AND permutation for every sort. Closes a real gap -- the existing tests only checked .Sorted(), so a sort dropping/duplicating elements passed. 2. make verify: go vet + staticcheck + go test -race -short, with -short gating of the large sizes in sort/search tests so the race build is quick. 3. make verify-model: TLA+/TLC model check of sleep sort (termination, deadlock-freedom, sorted permutation) -- formal/tla/. 4. make verify-formal: Gobra deductive proof (Viper+Z3) that a monomorphized insertion sort is memory-safe and sorted for all inputs -- formal/. The static layer already found a latent bug: hash() used key<<10 on a generic integer, which silently yields 0 for narrow key types (int8), degrading the hash. Tests missed it because they only use int keys. Fixed by mixing in int64; documented extensively in docs/case-study-hash-shift-bug.md. Also cleans up dead code and a blank-identifier range flagged by staticcheck. Co-Authored-By: Claude Opus 4.8 --- search/search_test.go | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'search/search_test.go') diff --git a/search/search_test.go b/search/search_test.go index 36ef4bf..b2c167a 100644 --- a/search/search_test.go +++ b/search/search_test.go @@ -45,7 +45,15 @@ func TestGoMap(t *testing.T) { } } +// shortMaxLength caps the largest input size exercised under `go test -short` +// (used by `make verify`, which runs under the race detector). The full range +// still runs in a plain `make test`. +const shortMaxLength int = 1000 + func test[K ds.Integer, V ds.Number](s Set[K,V], l int, t *testing.T) { + if testing.Short() && l > shortMaxLength { + t.Skipf("skipping size %d in -short mode", l) + } keys := ds.NewRandomArrayList[K](l, l) randoms := ds.NewRandomArrayList[V](l, -1) mapping := make(map[K]V, l) -- cgit v1.2.3