[{"data":1,"prerenderedAt":4},["ShallowReactive",2],{"dTIz4PnOHd":3},"# Velvet: A Multi-Modal Verifier for Imperative Programs in Lean\n\n[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)\n\n## What is Velvet?\n\nVelvet is a Dafny-style verifier for imperative programs embedded in the Lean proof\nassistant. Velvet seamlessly combines SMT-inspired proof automation with Lean's\ninteractive proof mode, enabling multi-modal verification: programs can be compiled,\nexecuted, validated using property-based testing, and formally verified within one\nunified environment.\n\n## Features\n\n- **Shallow embedding in monads.** Programs are shallowly embedded in a monad. `Id`,\n  `Option`, `StateT`, `ExceptT` and stacks thereof are supported.\n- **Ghost state.** Variables that exist only for the sake of the specification, and are\n  erased from the compiled program.\n- **Nondeterminism.** Reason about programs with nondeterministic choice using angelic\n  or demonic semantics.\n- **Partial and total correctness.** Separately verify functional correctness and\n  termination, then combine them for total correctness.\n- **Testing before proving.** `#derive_tester_for` turns a contract into an executable\n  checker that runs on concrete or randomly generated inputs.\n- **Foundational verification.** A proved method yields `\u003Cname>.spec`, a plain Lean\n  theorem that Velvet reuses at call sites and that you can use in handwritten proofs.\n- **Access to mathlib** -- use Lean's rich ecosystem of formalised mathematics in program specifications and proofs.\n\n\n\n## Building\n\n### Requirements\n\nVelvet requires [Lean 4](https://github.com/leanprover/lean4), installed through\n[`elan`](https://github.com/leanprover/elan). The exact toolchain is pinned in\n`lean-toolchain` and `elan` picks it up automatically, so there is nothing else to\ninstall:\n\n```bash\ncurl -fsSL https://raw.githubusercontent.com/leanprover/elan/master/elan-init.sh | sh -s -- -y\n```\n\n### Clone and build\n\n```bash\ngit clone https://github.com/verse-lab/velvet.git\ncd velvet\nlake build\n```\n\nThe root package deliberately does not depend on Mathlib, so this builds from source in\na few minutes. Use `lake build Examples` to check the example suite as well.\n\n### Case studies\n\nThe case studies may use Mathlib and live in their own Lake package:\n\n```bash\ncd CaseStudies\nlake exe cache get\nlake build\n```\n\n`lake exe cache get` downloads a pre-built version of\n[Mathlib](https://github.com/leanprover-community/mathlib4), which otherwise would take a\nvery long time to build. See [CaseStudies/README.md](CaseStudies/README.md) for details.\n\n## Documentation\n\nFor detailed documentation of Velvet's features and usage, see [docs/doc.md](docs/doc.md).\n\n## Navigation guide\n\n| Path | Contents |\n| :--- | :--- |\n| [Velvet/Core/](Velvet/Core) | Weakest-precondition semantics, loop and nondeterminism combinators, the `velvet_vcgen` tactic |\n| [Velvet/Frontend/](Velvet/Frontend) | `method` elaboration, `prove_correct`, options, tester derivation, VC reports |\n| [Velvet/Examples/](Velvet/Examples) | Worked examples — the fastest way to learn the syntax |\n| [CaseStudies/](CaseStudies) | Larger developments, in a separate Lake package so that Mathlib stays out of the root build |\n| [docs/doc.md](docs/doc.md) | The language reference |\n\nNew to Velvet? Read [`Sqrt.lean`](Velvet/Examples/Sqrt.lean) for the basics,\n[`Loops.lean`](Velvet/Examples/Loops.lean) for invariant patterns, and\n[`StateT.lean`](Velvet/Examples/StateT.lean) for stateful contracts.\n",1789762396329]