nanofil/nix/rocq.nix
The Rocq model of the checked IR (rocq/, docs/formal.md Campaign 1): default: model (every theory compiled, one derivation per file) + a small outcome/base-verdict smoke corpus. The grammar round trip of web/rocq/tests/parse.sh is its own check, passthru.parse (checks.nanofil-rocq-parse), also one derivation per file. full=true opts into the complete outcome and mutation campaign below: compile it with the pinned nixpkgs' Rocq, refuse any Admitted or Axiom (none is allowed outside the Campaign 2 runtime module type in Runtime.v), extract and link the model, then check that it agrees with interp:run/5 on every run line of rocq/tests, the Fil-C IR fixtures, the C tests and Fil-C modules from tests/gen.pl, the last three with and without -O and under every --checks mode (rocq/agree.sh), and Lua's own functions (rocq/lua.sh); and that its validator reaches ir:valid_module/1's verdict on mutants of every checked module in the same matrix, and of the tests/c/prog programs with aliases and weak, thread-local or constructor data (rocq/valid.sh). Both check that the modules the program proofs are about are what nanofil makes today (rocq/programs.sh). The program logic (Language.v, Logic.v) is built on Iris, so the model and the parse check take stdpp and Iris from the same nixpkgs; the extracted driver does not use them.
| pkgs | |
| filcc | |
| full | default false |
Each theory is its own derivation, whose inputs are its one .v file and the objects of the theories it imports, so an edit recompiles that file and its importers and nothing else; every other object comes from the store or a cache. Imports are read here from the sources' From Nanofil Require sentences; deps below checks them against rocq dep.
link N: the objects of everything N imports, under theories/.
The grammar check (web/rocq/tests/parse.sh), one theory at a time: reprint it with every subterm in parentheses and compile the reprint against the original objects of its imports. It needs neither its own object nor the other reprints, so a grammar change reruns every file at once and a theory edit reruns that file.
parse.sh's own Ltac, term and Iris fixtures.
The compiled theories as one tree, for the logic spikes (spikes.nix), which compile against them. Nothing in CI's gate needs it.
The model: every theory compiled, no Admitted or stray Axiom, imports as rocq dep reads them, and the extracted driver, with the sources the checks read (programs.sh compares the Code.v files). Its output is a few MB; the objects stay in their own derivations.
The check reads compiler sources, harnesses and corpora, not the wiki, benchmarks or theories (the latter enter through model above).
The corpus reads the extracted driver (Extract.v's imports, a few of the theories) and the sources, so it runs beside the proof compiles; the check below still requires the whole model.