HackerLangs
TopNewTrendsCommentsPastAskShowJobs

bneb-dev

no profile record

Submissions

Show HN: Salt – a systems language with Z3 theorem proving in the compiler

salt-lang.dev
44 points·by bneb-dev·il y a 9 jours·54 comments

[untitled]

1 points·by bneb-dev·il y a 17 jours·0 comments

[untitled]

1 points·by bneb-dev·il y a 3 mois·0 comments

[untitled]

1 points·by bneb-dev·il y a 3 mois·0 comments

Show HN: Trytet – Deterministic WASM substrate for stateful AI agents

trytet.com
3 points·by bneb-dev·il y a 3 mois·0 comments

[untitled]

1 points·by bneb-dev·il y a 3 mois·0 comments

Show HN: Parsing hostile industrial data in 64MB WASM sandboxes

ingelt.com
2 points·by bneb-dev·il y a 4 mois·0 comments

[untitled]

1 points·by bneb-dev·il y a 4 mois·0 comments

Show HN: Autonomous Prover Running > 1hr

perqed.com
4 points·by bneb-dev·il y a 4 mois·0 comments

Show HN: Aacyn v0.7.0 – A bare-metal observability engine (5M events/SEC)

aacyn.com
1 points·by bneb-dev·il y a 4 mois·0 comments

Show HN: Write and Run Salt v0.9.2 in the Browser

salt-lang.dev
3 points·by bneb-dev·il y a 4 mois·0 comments

[untitled]

1 points·by bneb-dev·il y a 5 mois·0 comments

comments

bneb-dev
·il y a 7 jours·discuss
With 92 contributors, I'd bet that The Vera Project is much more mature.

Salt has some different ergonomics and performance goals though, which makes this project unique.
bneb-dev
·il y a 7 jours·discuss
Agree with your overall point. I made some changes to extend the current paradigm a bit: https://github.com/bneb/lattice/blob/main/docs/tutorial/09-c...

---

Invariants aren't always inferred automatically. When they aren't, they can be made explicit for Z3 to check.

At the moment, bubble sort with array-content invariants is fully provable:

  fn bubble_sort(arr: Ptr<i32>, n: i64)
      requires n > 0
      ensures forall i in 0..(n-1) => arr[i] <= arr[i+1]
  {
      for i in 0..n {
          invariant forall k in 0..(i-1) => arr[k] <= arr[k+1];
          // bubble pass
      }
  }
Z3 proves the base case (vacuously true at i=0) and the inductive step for each iteration. Both loops have fixed trip counts regardless of data, so the frame axioms are concrete. At concrete sizes the compiler unrolls the loop: for i in 0..4 produces 8 Z3 checks (4 iterations × 2), all proven at compile time, outputting Z3: 8/8 checks proven (100%), 0 deferred to runtime.

And insertion sort is partially provable:

This starts with the same `forall` invariant structure. After the base case, the outer for-loop inductive step is wired but the inner while-loop's trip count depends on the data which can't be determined statically for which indices were modified, so the frame axioms can't fully constrain the array state. This would require splitting on the case for the while condition, which is future work, and wasn't part of my v1.0.0 plans.
bneb-dev
·il y a 7 jours·discuss
LH seems cool but the syntax would definitely take some getting used to...
bneb-dev
·il y a 7 jours·discuss
It looks like verification is distinct from the compiler.
bneb-dev
·il y a 7 jours·discuss
I'm not sure what the point of bringing up Versus is. Is it https://verus.io/ ? Is it a plug for your own project?

There are several points you made where I think we just fundamentally disagree so I'll decline to engage further at this point.

Hope you have better luck with your candidates and your own projects. I look forward do seeing them on HN down the road!
bneb-dev
·il y a 8 jours·discuss
[flagged]
bneb-dev
·il y a 8 jours·discuss
Looking. I did a huge purge/rewrite of the benchmarks and this might have regressed. Happy to track here or GitHub.
bneb-dev
·il y a 8 jours·discuss
My workflow is to design, then use goal and loop prompts to RALPH a feature. At that point, usually there is a bunch of AI generated code that is generally correct but needs refinement, editing, testing, benchmarking, etc... That human-in-the-loop iterative step is the 'de-slop'. Would you prefer different phrasing, or is the trigger here the use of coding agents?
bneb-dev
·il y a 8 jours·discuss
You could nitpick the subsection title, and from that perspective "What's not done" is a bit of a catch-all for caveats.

With that said, I think it's pretty easy to infer the meaning there.

I'm not really sure how else to be more transparent about things, but I am using an AI-augmented engineering as the core workflow for the project, and that includes drafting docs and this post.

I read and edit the work. For a side-project with no current community support or users, I need to make a judicious decision when to spend time and effort. IMO it is reasonable _not_ to try to trick anyone into thinking that AI is not used. My proof reading and editing will miss things from time-to-time. I'm OK with it at the current scale of the project.
bneb-dev
·il y a 8 jours·discuss
For loops already worked but might not have been documented correctly. I just shipped the functionality for `while` loops now, auto-infer works for common cases of invariants:

  let mut i = 0;
  while i < 5 {
    arr[i] = val;
    i += 1;
  }
So in that case, the compiler detects `i < N` with monotonic increment and synthesizes `i >= 0 && i < N` automatically.

(Works with `<`, `<=`, `i += 1`, and `i = i + 1` via the same mechanism as for-loop induction variables.)

Complex loops (`while i + j < n`, `while p.addr() != 0`) require syntax that I have slopped together an explicit `invariant` keyword that I am not 100% happy with, but will refine later. Z3 checks base case + inductive step via Hoare logic and reports counterexamples on failure.

---

RE: "gnarliest invariant"

`ensures(result != 0)` on the SYN cookie in the kernel contract for the OS project in the monorepo.
bneb-dev
·il y a 9 jours·discuss
Not sure what tone you're going for, but can you expound on what you mean by 'ai-created'?
bneb-dev
·il y a 9 jours·discuss
What gives you that impression?
bneb-dev
·il y a 9 jours·discuss
Salt chose Z3 because it felt right for a compiler. The 100ms timeout means it's not sound, but it's useful. Lean could be the right choice when a proof is a hard requirement?
bneb-dev
·il y a 9 jours·discuss
It was a design decision. I chose Arenas instead.

The designed arena allocation is both faster and more predictable than GC. The trade-off is that you have to think about memory regions, but you never pay a GC pause.
bneb-dev
·il y a 9 jours·discuss
This is being made by one person as a side project (not done during core working hours)
bneb-dev
·il y a 9 jours·discuss
Ah, the issue is that I don't like that syntax: Salt is macro free, and doesn't need assert statements, etc... These are stylistic but I am assuming that under the hood things look quite similar.

I put an effort in to de-slop the project wherever I can. If you've noticed anything specific, I'd kindly request that you open an issue on Github or respond here with your findings so that I might correct them in the future.

Thanks for taking an in-depth look at Salt.
bneb-dev
·il y a 9 jours·discuss
Haven't heard of Venus (the programming language), but it sounds interesting. I'm curious to know what you mean by verified?

Do you happen to know if Venus has a Result type with canonical error codes, pipes, and other ergonomics?

Does it have C parity performance?
bneb-dev
·il y a 9 jours·discuss
Thanks, I restructured that doc and will work on it moving forward.
bneb-dev
·il y a 9 jours·discuss
SPARK seems interesting. Any ideas how it compares to Salt?

- C performance? - Generics? - Syntax ergonomics?

Thanks for sharing!
bneb-dev
·il y a 9 jours·discuss
Thanks for reading and sharing your thoughts!