Contracts made manifest

Abstract

Since Findler and Felleisen introduced higher-order contracts , many variants have been proposed. Broadly, these fall into two groups: some follow Findler and Felleisen in using latent contracts, purely dynamic checks that are transparent to the type system; others use manifest contracts, where refinement types record the most recent check that has been applied to each value. These two approaches are commonly assumed to be equivalent---different ways of implementing the same idea, one retaining a simple type system, and the other providing more static information. Our goal is to formalize and clarify this folklore understanding. Our work extends that of Gronski and Flanagan, who defined a latent calculus λ C and a manifest calculus λ H , gave a translation φ from λ C to λ H , and proved that, if a λ C term reduces to a constant, then so does its φ-image. We enrich their account with a translation Ψ from λ H to λ C and prove an analogous theorem. We then generalize the whole framework to dependent contracts , whose predicates can mention free variables. This extension is both pragmatically crucial, supporting a much more interesting range of contracts, and theoretically challenging. We define dependent versions of λ H and two dialects ("lax" and "picky") of λ C , establish type soundness---a substantial result in itself, for λ H ---and extend φ and Ψ accordingly. Surprisingly, the intuition that the latent and manifest systems are equivalent now breaks down: the extended translations preserve behavior in one direction but, in the other, sometimes yield terms that blame more.

Contracts made manifest

“…If labels represent "contexts" for values, then this treats the contract as an independent context. This can be seen as completing some of the future work of Greenberg et al (2010). Belo et al (2011) at once simplify and extend the CBV λ H given here.…”

“…More recently, Findler and Felleisen (2002) introduced a λ-calculus with higher-order contracts. The other label on the This is a longer version of a POPL 2010 paper (Greenberg, M., Pierce, B. C. & Weirich, S. (2010) Contracts made manifest. This term evaluates to 1, since pos 1 returns true.…”

Higher-Order Approximate Relational Refinement Types for Mechanism Design and Differential Privacy

“…Other prominent approaches for verifying functional programs include dynamic checking [22] (and its combination with static type-checking [30,31,54]), model-checking [43] and translating functional programs into logic [53].…”

Temporal higher-order contracts

“…This higher-order precondition constrains how the sort module can call the function argument cmp, and so is a guarantee provided by sort rather than an obligation on the client. Higherorder contract systems [19,15,22,24,45] support such preconditions by wrapping the cmp argument to enforce this property dynamically.…”

“…Since then contracts have been used to extend static checking [14,5] and for runtime monitoring of higher-order programs [18]. These investigations have progressed towards more expressive dependent contracts [18,31,24,15]. In contrast, our work moves contract expressiveness in a different-orthogonal-direction where contracts enforce temporal properties.…”