Mtac2: typed tactics for backward reasoning in Coq

Abstract

Coq supports a range of built-in tactics, which are engineered primarily to support backward reasoning. Starting from a desired goal, the Coq programmer can use these tactics to manipulate the proof state interactively, applying axioms or lemmas to break the goal into subgoals until all subgoals have been solved. Additionally, it provides support for tactic programming via OCaml and Ltac, so that users can roll their own custom proof automation routines. Unfortunately, though, these tactic languages share a significant weakness. They do not offer the tactic programmer any static guarantees about the soundness of their custom tactics, making large tactic developments difficult to maintain. To address this limitation, Ziliani et al. previously proposed Mtac, a new typed approach to custom proof automation in Coq which provides the static guarantees that OCaml and Ltac are missing. However, despite its name, Mtac is really more of a metaprogramming language than it is a full-blown tactic language: it misses an essential feature of tactic programming, namely the ability to directly manipulate Coq's proof state and perform backward reasoning on it. In this paper, we present Mtac2, a next-generation version of Mtac that combines its support for typed metaprogramming with additional support for the programming of backward-reasoning tactics in the style of Ltac. In so doing, Mtac2 introduces a novel feature in tactic programming languagesÐwhat we call typed backward reasoning. With this feature, Mtac2 is capable of statically ruling out several classes of errors that would otherwise remain undetected at tactic definition time. We demonstrate the utility of Mtac2's typed tactics by porting several tactics from a large Coq development, the Iris Proof Mode, from Ltac to Mtac2.

FreeSpec: specifying, verifying, and executing impure computations in Coq

“…Inspired by Mtac [19,36] and MetaCoq [2], FreeSpec.Exec is a bi-interpreter, i.e., an interpreter that interleaves two interpreters. One of these two interpreters is the reduction engine of Coq: when it is provided a term of type impure ix t, this interpreter makes the head constructor appear using the weak-head reduction strategy.…”

Harpoon: Mechanizing Metatheory Interactively

“…We can also reason about formal systems in general purpose proof assistants such as Coq. The general philosophy in such systems is that users should be in the position of writing complex domain-specific tactics to facilitate proof construction using languages such as LTac [7] or MTac(2) [29,17]. Although this is an extremely flexible approach, we believe that the tactic-centric view often obscures the actual line of reasoning in the proof.…”

Touring the MetaCoq Project (Invited Paper)

“…An interpreter for actions in this monad (e.g. adding a new definition with a given name and proof term) is meta-programmed in OCAML, using continuations to handle the interactive aspect of execution and maintaining coherence of the system state, similarly to the proof engine monad of the MTAC2 [29] tactic language.…”