From f74812f8eda48194b622bdd318f35d3a6b6328cd Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Mon, 6 Jul 2026 10:15:56 +0300 Subject: Add layered formal-verification harness Adds four complementary layers to verify correctness, all runnable locally, weakest-but-broadest to strongest-but-narrowest: 0. Paper proofs (docs/verification.md): Hoare invariants, termination measures, and permutation arguments for every algorithm. 1. Property tests (sort/property_test.go): testing/quick asserting ordering AND permutation for every sort. Closes a real gap -- the existing tests only checked .Sorted(), so a sort dropping/duplicating elements passed. 2. make verify: go vet + staticcheck + go test -race -short, with -short gating of the large sizes in sort/search tests so the race build is quick. 3. make verify-model: TLA+/TLC model check of sleep sort (termination, deadlock-freedom, sorted permutation) -- formal/tla/. 4. make verify-formal: Gobra deductive proof (Viper+Z3) that a monomorphized insertion sort is memory-safe and sorted for all inputs -- formal/. The static layer already found a latent bug: hash() used key<<10 on a generic integer, which silently yields 0 for narrow key types (int8), degrading the hash. Tests missed it because they only use int keys. Fixed by mixing in int64; documented extensively in docs/case-study-hash-shift-bug.md. Also cleans up dead code and a blank-identifier range flagged by staticcheck. Co-Authored-By: Claude Opus 4.8 --- sort/property_test.go | 110 ++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 110 insertions(+) create mode 100644 sort/property_test.go (limited to 'sort/property_test.go') diff --git a/sort/property_test.go b/sort/property_test.go new file mode 100644 index 0000000..1f3dd88 --- /dev/null +++ b/sort/property_test.go @@ -0,0 +1,110 @@ +package sort + +import ( + "math/rand" + "testing" + quickcheck "testing/quick" // aliased: this package already has a quick() sort + + "codeberg.org/snonux/algorithms/ds" +) + +// This file provides property-based verification for every sort. Unlike the +// size-driven tests in sort_test.go, which only assert a.Sorted(), these tests +// also assert the *permutation* invariant: the output must contain exactly the +// same elements as the input. A buggy sort that drops or duplicates an element +// while still returning an ordered slice would pass a Sorted()-only check but +// fail here. Together, "ordered" + "permutation of the input" is the full +// functional-correctness postcondition proven on paper in docs/verification.md. + +// sortUnderTest is the shared signature of every sort in this package. An +// ds.ArrayList[int] shares []int's representation, so the property helpers +// convert between them for free. +type sortUnderTest func(ds.ArrayList[int]) ds.ArrayList[int] + +// allSorts lists every sort to verify, keyed by name for readable subtests. +func allSorts() map[string]sortUnderTest { + return map[string]sortUnderTest{ + "Selection": Selection[int], + "Insertion": Insertion[int], + "Shell": Shell[int], + "Merge": Merge[int], + "BottomUpMerge": BottomUpMerge[int], + "ParallelMerge": ParallelMerge[int], + "Quick": Quick[int], + "ParallelQuick": ParallelQuick[int], + "Quick3Way": Quick3Way[int], + } +} + +// sameMultiset reports whether b is a permutation of a: equal length and equal +// element multiplicities. This is the invariant the Sorted()-only tests miss. +func sameMultiset(a, b []int) bool { + if len(a) != len(b) { + return false + } + counts := make(map[int]int, len(a)) + for _, v := range a { + counts[v]++ + } + for _, v := range b { + counts[v]-- + if counts[v] < 0 { + return false // b has an element a doesn't have (enough of) + } + } + // Equal lengths plus no negative count implies the multisets match exactly. + return true +} + +// sortedPermutationOf runs sort on a copy of orig and checks both invariants: +// the result is ordered and is a permutation of orig. orig is not mutated. +func sortedPermutationOf(sort sortUnderTest, orig []int) bool { + work := make([]int, len(orig)) + copy(work, orig) + out := sort(ds.ArrayList[int](work)) + return out.Sorted() && sameMultiset(orig, out) +} + +// TestPropertyOrderedPermutation uses testing/quick to throw many randomly +// shaped small slices (arbitrary values, lengths up to ~50) at each sort, +// asserting the ordered-permutation property on every trial. +func TestPropertyOrderedPermutation(t *testing.T) { + cfg := &quickcheck.Config{MaxCount: 2000} + for name, sort := range allSorts() { + name, sort := name, sort + t.Run(name, func(t *testing.T) { + t.Parallel() + prop := func(in []int) bool { return sortedPermutationOf(sort, in) } + if err := quickcheck.Check(prop, cfg); err != nil { + t.Errorf("%s violated ordered-permutation property: %v", name, err) + } + }) + } +} + +// TestPropertySizes exercises input sizes that cross the algorithms' internal +// thresholds: the len<=10 insertion-sort cutoffs, the len<1000 sequential +// fallbacks in the parallel sorts, and the odd-length merge clamp. The largest +// sizes (which drive the real goroutine fan-out) run only outside -short. +func TestPropertySizes(t *testing.T) { + sizes := []int{0, 1, 2, 10, 11, 100, 999, 1000, 1001} + if !testing.Short() { + sizes = append(sizes, 5000, 20001) + } + for name, sort := range allSorts() { + name, sort := name, sort + t.Run(name, func(t *testing.T) { + t.Parallel() + rng := rand.New(rand.NewSource(1)) + for _, n := range sizes { + in := make([]int, n) + for i := range in { + in[i] = rng.Intn(50) - 25 // small range ⇒ many duplicates + } + if !sortedPermutationOf(sort, in) { + t.Errorf("%s failed ordered-permutation at size %d", name, n) + } + } + }) + } +} -- cgit v1.2.3