[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6KNAVDT22TEG36TY8ZTFDNF":3,"skill-same:01M6KNAVDT22TEG36TY8ZTFDNF":56},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":28,"linkOnly":29,"markdownContent":30,"markdownBody":31,"frontMatter":32,"refName":34,"commitSha":35,"skillDirectory":36,"forksCount":37,"repositoryHtmlUrl":38,"repositoryHomepageUrl":6,"ownerHtmlUrl":39,"ownerBlogUrl":40,"ownerDescription":6,"updatedAt":41,"install":42,"resources":55},"01M6KNAVDT22TEG36TY8ZTFDNF","tools-creusot-annotate-interfaces",null,"Formally verify a component's properties with Creusot and annotate its interface definitions","AI-native-Systems-Research\u002Fai-native-storage-certus","AI-native-Systems-Research","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F270755458?v=4","01M6KKQWSJX0D4X33E0KKSR4WM","AI-native Systems Research","01M6KKQWXTKR6MYVQMPKVJ5WD5",3,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FAI-native-Systems-Research\u002Fai-native-storage-certus\u002Fblob\u002Funstable\u002Fcomponents\u002Feviction-policy-optimized\u002F.claude\u002Fskills\u002Ftools-creusot-annotate-interfaces\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27],"Tools","annotate","tools creusot annotate interfaces","component","verify","properties","name","with","interface","2026-11-10 10:12:30",false,"---\nname: tools-creusot-annotate-interfaces\ndescription: Formally verify a component's properties with Creusot and annotate its interface definitions\nargument-hint: \"[component-name]\"\n---\n\nGiven a target component, this skill:\n1. Creates a verification branch and `verif\u002F` subdirectory\n2. Writes a Creusot verification model for the component's key properties\n3. Runs the prover to discharge all verification conditions\n4. Returns to the original branch and annotates the interface definition files with verified and unchecked property comments\n\n## Interactive Configuration\n\nIf no component name is provided as an argument, list the available components and ask the user to select one:\n\n```bash\nls components\u002F*\u002FCargo.toml | sed 's|components\u002F||;s|\u002FCargo.toml||' | sort\n```\n\nPresent the list and ask the user to choose.\n\n## Workflow\n\n### 1. Pre-flight\n\n- Record the current branch: `ORIGINAL_BRANCH=$(git branch --show-current)`\n- Check for uncommitted changes; if any, stash them: `git stash push -m \"pre-creusot-annotate\"`\n- Verify Creusot is installed: `cargo creusot version` (if not, tell the user to run `\u002Ftools-creusot-install`)\n- Identify the component's interface file(s) by reading its `define_component!` block to find which interfaces it `provides` (e.g., `IDispatcher`, `IDispatchMap`)\n- Locate the corresponding interface definition file(s) in `components\u002Finterfaces\u002Fsrc\u002F`\n\n### 2. Create Verification Branch\n\n```bash\ngit checkout -b creusot\u002F\u003Ccomponent-name>\n```\n\n### 3. Create the `verif\u002F` Subdirectory\n\nCreate `components\u002F\u003Ccomponent-name>\u002Fverif\u002F` with:\n\n**`Cargo.toml`:**\n```toml\n[package]\nname = \"\u003Ccomponent-name>-verif\"\nversion = \"0.1.0\"\nedition = \"2021\"\npublish = false\n\n[workspace]\n\n[dependencies]\ncreusot-std = { path = \"..\u002F..\u002F..\u002Ftools\u002Fcreusot\u002Fcreusot\u002Fcreusot-std\" }\n\n[lints.rust]\nunexpected_cfgs = { level = \"warn\", check-cfg = ['cfg(creusot)'] }\n```\n\n**`why3find.json`:**\n```json\n{\n  \"fast\": 0.2,\n  \"time\": 2.0,\n  \"depth\": 6,\n  \"packages\": [\"creusot\"],\n  \"provers\": [\"alt-ergo\", \"z3\", \"cvc5\"],\n  \"tactics\": [\"compute_specified\", \"split_vc\"],\n  \"drivers\": [],\n  \"warnoff\": [\"unused_variable\", \"axiom_abstract\"]\n}\n```\n\n**`src\u002Flib.rs`:** The verification model (see step 4).\n\n### 4. Write the Verification Model\n\nRead the component's implementation source (`src\u002Flib.rs`) to understand its internal logic. Extract the key correctness properties into a pure-functional Creusot model.\n\n**Guidelines for writing the model:**\n\n- Use `creusot_std::prelude::*` for annotations\n- Model internal state as simple structs (no Mutex, HashMap, Arc — Creusot cannot handle those)\n- Each operation becomes a pure function with `#[requires]` and `#[ensures]`\n- Use `@` for logical integer projection (e.g., `value@ == 0`)\n- Use `*state` for pre-state and `^state` for post-state on `&mut` params\n- Use `proof_assert!()` for intermediate proof hints\n- Composite lifecycle functions prove end-to-end scenarios\n- Target: all VCs dischargeable by SMT solvers within 2 seconds\n\n**Property categories to look for:**\n\n- **Arithmetic safety**: No overflow\u002Funderflow on counters or indices\n- **State machine validity**: Only valid transitions between states\n- **Conservation laws**: Quantities preserved across operations (e.g., total refs)\n- **Exclusivity\u002Flocking**: At most one writer, write blocks readers\n- **Precondition enforcement**: Functions reject invalid inputs (return Err)\n- **Lifecycle correctness**: Create→use→destroy paths leave no leaked resources\n- **Idempotency**: Operations that should be safe to repeat\n\n### 5. Run Verification\n\n```bash\ncd components\u002F\u003Ccomponent-name>\u002Fverif\nexport PATH=\"$HOME\u002F.local\u002Fshare\u002Fcreusot\u002Fbin:$PATH\"\ncargo creusot\nwhy3find prove\n```\n\n- If verification fails, analyze the unproved VCs, strengthen preconditions or add `proof_assert!` hints, and retry\n- Iterate until all VCs are discharged (target: 0 unproved goals)\n- Record the number of VCs proved per function\n\n### 6. Commit on local Verification Branch (do not push remotely).\n\n```bash\ngit add components\u002F\u003Ccomponent-name>\u002Fverif\u002F\ngit commit -m \"feat: add Creusot verification for \u003Ccomponent-name>\n\nProved N properties with M total verification conditions discharged.\"\n```\n\n### 7. Return to Original Branch\n\n```bash\ngit checkout $ORIGINAL_BRANCH\n```\n\nIf changes were stashed in step 1, pop them: `git stash pop`\n\n### 8. Annotate Interface Definitions\n\nEdit the interface definition file(s) in `components\u002Finterfaces\u002Fsrc\u002F` (e.g., `idispatch_map.rs`, `idispatcher.rs`).\n\n**Scope rule:** Only include properties that are directly about the interface being annotated. For example:\n- Properties about dispatch-map reference counting (take_read, release_write, etc.) belong in `idispatch_map.rs`, NOT in `idispatcher.rs`.\n- Properties about dispatcher logic (drive index, eviction termination, size validation) belong in `idispatcher.rs`.\n- If a dispatcher property depends on a dispatch-map guarantee (e.g., \"populate calls downgrade_reference\"), reference it briefly but do NOT reproduce the full dispatch-map property list in the dispatcher file.\n\n**Add a header comment block** above the `define_interface!` macro listing verified properties for THIS interface only:\n\n```rust\n\u002F\u002F # Verified Properties (see `components\u002F\u003Ccomponent-name>\u002Fverif\u002F`)\n\u002F\u002F\n\u002F\u002F The following invariants are formally proved with Creusot:\n\u002F\u002F\n\u002F\u002F - P1 (\u003Cname>): \u003Cone-line description>\n\u002F\u002F - P2 (\u003Cname>): \u003Cone-line description>\n\u002F\u002F ...\n```\n\n**Add per-method `# Verified:` comments** on each method that participates in a proven property:\n\n```rust\n\u002F\u002F\u002F \u003Cexisting doc comment>\n\u002F\u002F\u002F\n\u002F\u002F\u002F # Verified: P1 (\u003Cname>), P3 (\u003Cname>)\n\u002F\u002F\u002F \u003Cbrief explanation of what is proved for this method>\nfn method_name(...) -> ...;\n```\n\n**Add `# Unchecked:` comments** for properties that are NOT yet verified but represent important correctness claims:\n\n```rust\n\u002F\u002F\u002F \u003Cexisting doc comment>\n\u002F\u002F\u002F\n\u002F\u002F\u002F # Unchecked: \u003Cproperty description>\n\u002F\u002F\u002F \u003Cwhy this matters and what could go wrong if violated>\nfn method_name(...) -> ...;\n```\n\n**Updating existing annotations:**\n\nIf the interface file already has `# Verified:`, `# Unchecked:`, or `# Verified Properties` comment blocks from a prior run:\n- **Replace** the header property summary block with the updated list (add new properties, remove properties that no longer apply, update descriptions).\n- **Update** per-method `# Verified:` sections — add newly proved properties, remove any that were invalidated by code changes.\n- **Promote** `# Unchecked:` to `# Verified:` if the property is now proved.\n- **Preserve** `# Unchecked:` entries that are still not covered.\n- Do NOT duplicate property annotations — each method should have at most one `# Verified:` section and one `# Unchecked:` section.\n\n**Identifying unchecked properties:**\n\nAfter annotating verified properties, scan each method for claims that are:\n- Stated in doc comments but not formally proved (e.g., \"blocks until...\", \"never returns stale data\")\n- Concurrency guarantees that the sequential Creusot model cannot capture (e.g., \"atomic with respect to...\")\n- Ordering guarantees (e.g., \"entries are returned oldest-first\")\n- Timeout behavior (e.g., \"blocks for at most 100ms\")\n- Memory safety claims beyond what Rust's type system guarantees (e.g., pointer validity across `unsafe`)\n\nMark these as `# Unchecked` with a brief note on what verification technique could address them (Spin model, runtime assertion, fuzzing, etc.).\n\n### 9. Commit Annotations on Original Branch\n\n```bash\ngit add components\u002Finterfaces\u002Fsrc\u002F\u003Cinterface-file>.rs\ngit commit -m \"docs: annotate \u003Cinterface> with verified and unchecked properties\n\nReferences Creusot proofs on branch creusot\u002F\u003Ccomponent-name>.\nN properties verified, M properties identified as unchecked.\"\n```\n\n### 10. Cross-check with Spec Kit Specifications\n\nRead the component's spec kit specifications from `components\u002F\u003Ccomponent-name>\u002F.specify\u002F` (look for `specs\u002F*\u002Fspec.md`, `spec.md`, or any `.md` files under `.specify\u002F`). Extract requirements, invariants, or behavioral contracts stated in the specifications.\n\nCompare them against the verified (P1–PN) and unchecked (U1–UM) properties:\n\n- **Spec requirements covered by formal proofs** — the requirement is verified.\n- **Spec requirements matching an unchecked annotation** — identified but not yet proved.\n- **Spec requirements with no corresponding property** — gaps in verification coverage.\n- **Verified properties with no corresponding spec requirement** — proofs beyond what was specified.\n\nPresent the results as a table to the user:\n\n```\nSpec Kit Cross-Check: \u003Ccomponent-name>\n══════════════════════════════════════\n\n| Spec Requirement                        | Status     | Property  | Notes                          |\n|-----------------------------------------|------------|-----------|--------------------------------|\n| \"release_read fails on zero refs\"       | ✔ Verified | P1        |                                |\n| \"write_ref is binary exclusive\"         | ✔ Verified | P4        |                                |\n| \"shutdown drains background writes\"     | ⚠ Unchecked| U2        | Needs Spin model               |\n| \"entries evicted LRU-first\"             | ⚠ Unchecked| —         | Not modeled in Creusot         |\n| \"max 100ms timeout on blocking ops\"     | ✗ No match | —         | Runtime property only           |\n| (no spec requirement)                   | + Extra    | P10       | Alignment proof beyond spec    |\n```\n\nIf the `.specify\u002F` directory does not exist for the component, note this in the report and skip the cross-check.\n\n### 11. Report\n\n```\nCreusot Verification Complete: \u003Ccomponent-name>\n═══════════════════════════════════════════════\n\nVerification branch: creusot\u002F\u003Ccomponent-name>\nInterface file(s):   components\u002Finterfaces\u002Fsrc\u002F\u003Cfile>.rs\n\nVerified Properties:\n  P1: \u003Cname> — \u003Cdescription> (N VCs)\n  P2: \u003Cname> — \u003Cdescription> (N VCs)\n  ...\n\nUnchecked Properties (identified for future work):\n  U1: \u003Cname> — \u003Cdescription> [suggested technique: Spin\u002Ffuzzing\u002Fetc.]\n  U2: \u003Cname> — \u003Cdescription>\n  ...\n\nSpec Kit Cross-Check:\n  [table as above, or \"No .specify\u002F directory found — skipped.\"]\n\nTotal: N properties verified, M unchecked identified\n       K verification conditions discharged by SMT solvers\n```\n\n### 12. Return to Starting Branch\n\nAs the final action, ensure you are back on the branch recorded in step 1:\n\n```bash\ngit checkout $ORIGINAL_BRANCH\n```\n\nDo not commit annotation changes to interface .rs files.\n\nIf changes were stashed in step 1, pop them: `git stash pop`\n\nThis guarantees the user's working state is restored regardless of which branches were visited during the skill execution.\n\n## Important Notes\n\n- The verification model is a PURE ABSTRACTION of the component logic — it does not import or depend on the actual component crate.\n- Creusot proves sequential correctness (no concurrency). Concurrency properties should be marked as `# Unchecked` with a note pointing to Spin models if they exist.\n- Always return to the original branch at the end, even if verification fails.\n- Use regular `\u002F\u002F` comments (not `\u002F\u002F\u002F` doc comments) for the property summary block above `define_interface!` to avoid the `unused_doc_comments` warning on macro invocations.\n- Do not remove existing doc comments — add the `# Verified:` \u002F `# Unchecked:` sections within them.\n- The `verif\u002F` directory uses `[workspace]` in its Cargo.toml to be independent of the parent workspace.\n","Given a target component, this skill:\n1. Creates a verification branch and `verif\u002F` subdirectory\n2. Writes a Creusot verification model for the component's key properties\n3. Runs the prover to discharge all verification conditions\n4. Returns to the original branch and annotates the interface definition files with verified and unchecked property comments\n\n## Interactive Configuration\n\nIf no component name is provided as an argument, list the available components and ask the user to select one:\n\n```bash\nls components\u002F*\u002FCargo.toml | sed 's|components\u002F||;s|\u002FCargo.toml||' | sort\n```\n\nPresent the list and ask the user to choose.\n\n## Workflow\n\n### 1. Pre-flight\n\n- Record the current branch: `ORIGINAL_BRANCH=$(git branch --show-current)`\n- Check for uncommitted changes; if any, stash them: `git stash push -m \"pre-creusot-annotate\"`\n- Verify Creusot is installed: `cargo creusot version` (if not, tell the user to run `\u002Ftools-creusot-install`)\n- Identify the component's interface file(s) by reading its `define_component!` block to find which interfaces it `provides` (e.g., `IDispatcher`, `IDispatchMap`)\n- Locate the corresponding interface definition file(s) in `components\u002Finterfaces\u002Fsrc\u002F`\n\n### 2. Create Verification Branch\n\n```bash\ngit checkout -b creusot\u002F\u003Ccomponent-name>\n```\n\n### 3. Create the `verif\u002F` Subdirectory\n\nCreate `components\u002F\u003Ccomponent-name>\u002Fverif\u002F` with:\n\n**`Cargo.toml`:**\n```toml\n[package]\nname = \"\u003Ccomponent-name>-verif\"\nversion = \"0.1.0\"\nedition = \"2021\"\npublish = false\n\n[workspace]\n\n[dependencies]\ncreusot-std = { path = \"..\u002F..\u002F..\u002Ftools\u002Fcreusot\u002Fcreusot\u002Fcreusot-std\" }\n\n[lints.rust]\nunexpected_cfgs = { level = \"warn\", check-cfg = ['cfg(creusot)'] }\n```\n\n**`why3find.json`:**\n```json\n{\n  \"fast\": 0.2,\n  \"time\": 2.0,\n  \"depth\": 6,\n  \"packages\": [\"creusot\"],\n  \"provers\": [\"alt-ergo\", \"z3\", \"cvc5\"],\n  \"tactics\": [\"compute_specified\", \"split_vc\"],\n  \"drivers\": [],\n  \"warnoff\": [\"unused_variable\", \"axiom_abstract\"]\n}\n```\n\n**`src\u002Flib.rs`:** The verification model (see step 4).\n\n### 4. Write the Verification Model\n\nRead the component's implementation source (`src\u002Flib.rs`) to understand its internal logic. Extract the key correctness properties into a pure-functional Creusot model.\n\n**Guidelines for writing the model:**\n\n- Use `creusot_std::prelude::*` for annotations\n- Model internal state as simple structs (no Mutex, HashMap, Arc — Creusot cannot handle those)\n- Each operation becomes a pure function with `#[requires]` and `#[ensures]`\n- Use `@` for logical integer projection (e.g., `value@ == 0`)\n- Use `*state` for pre-state and `^state` for post-state on `&mut` params\n- Use `proof_assert!()` for intermediate proof hints\n- Composite lifecycle functions prove end-to-end scenarios\n- Target: all VCs dischargeable by SMT solvers within 2 seconds\n\n**Property categories to look for:**\n\n- **Arithmetic safety**: No overflow\u002Funderflow on counters or indices\n- **State machine validity**: Only valid transitions between states\n- **Conservation laws**: Quantities preserved across operations (e.g., total refs)\n- **Exclusivity\u002Flocking**: At most one writer, write blocks readers\n- **Precondition enforcement**: Functions reject invalid inputs (return Err)\n- **Lifecycle correctness**: Create→use→destroy paths leave no leaked resources\n- **Idempotency**: Operations that should be safe to repeat\n\n### 5. Run Verification\n\n```bash\ncd components\u002F\u003Ccomponent-name>\u002Fverif\nexport PATH=\"$HOME\u002F.local\u002Fshare\u002Fcreusot\u002Fbin:$PATH\"\ncargo creusot\nwhy3find prove\n```\n\n- If verification fails, analyze the unproved VCs, strengthen preconditions or add `proof_assert!` hints, and retry\n- Iterate until all VCs are discharged (target: 0 unproved goals)\n- Record the number of VCs proved per function\n\n### 6. Commit on local Verification Branch (do not push remotely).\n\n```bash\ngit add components\u002F\u003Ccomponent-name>\u002Fverif\u002F\ngit commit -m \"feat: add Creusot verification for \u003Ccomponent-name>\n\nProved N properties with M total verification conditions discharged.\"\n```\n\n### 7. Return to Original Branch\n\n```bash\ngit checkout $ORIGINAL_BRANCH\n```\n\nIf changes were stashed in step 1, pop them: `git stash pop`\n\n### 8. Annotate Interface Definitions\n\nEdit the interface definition file(s) in `components\u002Finterfaces\u002Fsrc\u002F` (e.g., `idispatch_map.rs`, `idispatcher.rs`).\n\n**Scope rule:** Only include properties that are directly about the interface being annotated. For example:\n- Properties about dispatch-map reference counting (take_read, release_write, etc.) belong in `idispatch_map.rs`, NOT in `idispatcher.rs`.\n- Properties about dispatcher logic (drive index, eviction termination, size validation) belong in `idispatcher.rs`.\n- If a dispatcher property depends on a dispatch-map guarantee (e.g., \"populate calls downgrade_reference\"), reference it briefly but do NOT reproduce the full dispatch-map property list in the dispatcher file.\n\n**Add a header comment block** above the `define_interface!` macro listing verified properties for THIS interface only:\n\n```rust\n\u002F\u002F # Verified Properties (see `components\u002F\u003Ccomponent-name>\u002Fverif\u002F`)\n\u002F\u002F\n\u002F\u002F The following invariants are formally proved with Creusot:\n\u002F\u002F\n\u002F\u002F - P1 (\u003Cname>): \u003Cone-line description>\n\u002F\u002F - P2 (\u003Cname>): \u003Cone-line description>\n\u002F\u002F ...\n```\n\n**Add per-method `# Verified:` comments** on each method that participates in a proven property:\n\n```rust\n\u002F\u002F\u002F \u003Cexisting doc comment>\n\u002F\u002F\u002F\n\u002F\u002F\u002F # Verified: P1 (\u003Cname>), P3 (\u003Cname>)\n\u002F\u002F\u002F \u003Cbrief explanation of what is proved for this method>\nfn method_name(...) -> ...;\n```\n\n**Add `# Unchecked:` comments** for properties that are NOT yet verified but represent important correctness claims:\n\n```rust\n\u002F\u002F\u002F \u003Cexisting doc comment>\n\u002F\u002F\u002F\n\u002F\u002F\u002F # Unchecked: \u003Cproperty description>\n\u002F\u002F\u002F \u003Cwhy this matters and what could go wrong if violated>\nfn method_name(...) -> ...;\n```\n\n**Updating existing annotations:**\n\nIf the interface file already has `# Verified:`, `# Unchecked:`, or `# Verified Properties` comment blocks from a prior run:\n- **Replace** the header property summary block with the updated list (add new properties, remove properties that no longer apply, update descriptions).\n- **Update** per-method `# Verified:` sections — add newly proved properties, remove any that were invalidated by code changes.\n- **Promote** `# Unchecked:` to `# Verified:` if the property is now proved.\n- **Preserve** `# Unchecked:` entries that are still not covered.\n- Do NOT duplicate property annotations — each method should have at most one `# Verified:` section and one `# Unchecked:` section.\n\n**Identifying unchecked properties:**\n\nAfter annotating verified properties, scan each method for claims that are:\n- Stated in doc comments but not formally proved (e.g., \"blocks until...\", \"never returns stale data\")\n- Concurrency guarantees that the sequential Creusot model cannot capture (e.g., \"atomic with respect to...\")\n- Ordering guarantees (e.g., \"entries are returned oldest-first\")\n- Timeout behavior (e.g., \"blocks for at most 100ms\")\n- Memory safety claims beyond what Rust's type system guarantees (e.g., pointer validity across `unsafe`)\n\nMark these as `# Unchecked` with a brief note on what verification technique could address them (Spin model, runtime assertion, fuzzing, etc.).\n\n### 9. Commit Annotations on Original Branch\n\n```bash\ngit add components\u002Finterfaces\u002Fsrc\u002F\u003Cinterface-file>.rs\ngit commit -m \"docs: annotate \u003Cinterface> with verified and unchecked properties\n\nReferences Creusot proofs on branch creusot\u002F\u003Ccomponent-name>.\nN properties verified, M properties identified as unchecked.\"\n```\n\n### 10. Cross-check with Spec Kit Specifications\n\nRead the component's spec kit specifications from `components\u002F\u003Ccomponent-name>\u002F.specify\u002F` (look for `specs\u002F*\u002Fspec.md`, `spec.md`, or any `.md` files under `.specify\u002F`). Extract requirements, invariants, or behavioral contracts stated in the specifications.\n\nCompare them against the verified (P1–PN) and unchecked (U1–UM) properties:\n\n- **Spec requirements covered by formal proofs** — the requirement is verified.\n- **Spec requirements matching an unchecked annotation** — identified but not yet proved.\n- **Spec requirements with no corresponding property** — gaps in verification coverage.\n- **Verified properties with no corresponding spec requirement** — proofs beyond what was specified.\n\nPresent the results as a table to the user:\n\n```\nSpec Kit Cross-Check: \u003Ccomponent-name>\n══════════════════════════════════════\n\n| Spec Requirement                        | Status     | Property  | Notes                          |\n|-----------------------------------------|------------|-----------|--------------------------------|\n| \"release_read fails on zero refs\"       | ✔ Verified | P1        |                                |\n| \"write_ref is binary exclusive\"         | ✔ Verified | P4        |                                |\n| \"shutdown drains background writes\"     | ⚠ Unchecked| U2        | Needs Spin model               |\n| \"entries evicted LRU-first\"             | ⚠ Unchecked| —         | Not modeled in Creusot         |\n| \"max 100ms timeout on blocking ops\"     | ✗ No match | —         | Runtime property only           |\n| (no spec requirement)                   | + Extra    | P10       | Alignment proof beyond spec    |\n```\n\nIf the `.specify\u002F` directory does not exist for the component, note this in the report and skip the cross-check.\n\n### 11. Report\n\n```\nCreusot Verification Complete: \u003Ccomponent-name>\n═══════════════════════════════════════════════\n\nVerification branch: creusot\u002F\u003Ccomponent-name>\nInterface file(s):   components\u002Finterfaces\u002Fsrc\u002F\u003Cfile>.rs\n\nVerified Properties:\n  P1: \u003Cname> — \u003Cdescription> (N VCs)\n  P2: \u003Cname> — \u003Cdescription> (N VCs)\n  ...\n\nUnchecked Properties (identified for future work):\n  U1: \u003Cname> — \u003Cdescription> [suggested technique: Spin\u002Ffuzzing\u002Fetc.]\n  U2: \u003Cname> — \u003Cdescription>\n  ...\n\nSpec Kit Cross-Check:\n  [table as above, or \"No .specify\u002F directory found — skipped.\"]\n\nTotal: N properties verified, M unchecked identified\n       K verification conditions discharged by SMT solvers\n```\n\n### 12. Return to Starting Branch\n\nAs the final action, ensure you are back on the branch recorded in step 1:\n\n```bash\ngit checkout $ORIGINAL_BRANCH\n```\n\nDo not commit annotation changes to interface .rs files.\n\nIf changes were stashed in step 1, pop them: `git stash pop`\n\nThis guarantees the user's working state is restored regardless of which branches were visited during the skill execution.\n\n## Important Notes\n\n- The verification model is a PURE ABSTRACTION of the component logic — it does not import or depend on the actual component crate.\n- Creusot proves sequential correctness (no concurrency). Concurrency properties should be marked as `# Unchecked` with a note pointing to Spin models if they exist.\n- Always return to the original branch at the end, even if verification fails.\n- Use regular `\u002F\u002F` comments (not `\u002F\u002F\u002F` doc comments) for the property summary block above `define_interface!` to avoid the `unused_doc_comments` warning on macro invocations.\n- Do not remove existing doc comments — add the `# Verified:` \u002F `# Unchecked:` sections within them.\n- The `verif\u002F` directory uses `[workspace]` in its Cargo.toml to be independent of the parent workspace.\n",{"name":5,"description":7,"argument-hint":33},"[component-name]","unstable","dc564aa356769b7754391c9fa4fdaa0f179f476c","components\u002Feviction-policy-optimized\u002F.claude\u002Fskills\u002Ftools-creusot-annotate-interfaces",4,"https:\u002F\u002Fgithub.com\u002FAI-native-Systems-Research\u002Fai-native-storage-certus","https:\u002F\u002Fgithub.com\u002FAI-native-Systems-Research","https:\u002F\u002Fai-native-systems-research.github.io\u002Fai-native-systems-research\u002F","2026-11-12 06:08:32",{"source":8,"skillName":5,"commands":43,"prompt":53,"zipAvailable":54},[44,47,50],{"tool":45,"command":46},"npx","npx skills add AI-native-Systems-Research\u002Fai-native-storage-certus --skill tools-creusot-annotate-interfaces",{"tool":48,"command":49},"bunx","bunx skills add AI-native-Systems-Research\u002Fai-native-storage-certus --skill tools-creusot-annotate-interfaces",{"tool":51,"command":52},"pnpm","pnpm dlx skills add AI-native-Systems-Research\u002Fai-native-storage-certus --skill tools-creusot-annotate-interfaces","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FAI-native-Systems-Research\u002Fai-native-storage-certus\u002Fblob\u002Funstable\u002Fcomponents\u002Feviction-policy-optimized\u002F.claude\u002Fskills\u002Ftools-creusot-annotate-interfaces\u002FSKILL.md",true,[],[57,72,88,99,116,128],{"skillNo":58,"name":59,"nameZh":6,"description":60,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":61,"categories":62,"keywords":63,"publishedAt":28},"01M6KP29TWSNGADF3AJ47BR7TY","tools-spin-sync","Synchronize Spin\u002FPromela models with current source code and re-verify","https:\u002F\u002Fgithub.com\u002FAI-native-Systems-Research\u002Fai-native-storage-certus\u002Fblob\u002Funstable\u002Fcomponents\u002Fzyre\u002F.claude\u002Fskills\u002Ftools-spin-sync\u002FSKILL.md",[],[64,19,65,66,23,67,68,25,26,69,70,71],"tools spin sync","sync","code","model","models","re","source","source code",{"skillNo":73,"name":74,"nameZh":6,"description":75,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":76,"categories":77,"keywords":78,"publishedAt":28},"01M6KP277TDY3ZAJEBP5P6MDT8","tools-spin-model","Create a new Spin\u002FPromela formal verification model for a system property","https:\u002F\u002Fgithub.com\u002FAI-native-Systems-Research\u002Fai-native-storage-certus\u002Fblob\u002Funstable\u002Fcomponents\u002Fzyre\u002F.claude\u002Fskills\u002Ftools-spin-model\u002FSKILL.md",[],[79,67,19,80,81,82,83,84,85,86,87],"tools spin model","system","formal verification","number","for","prove","new","create","verification",{"skillNo":89,"name":90,"nameZh":6,"description":91,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":92,"categories":93,"keywords":94,"publishedAt":28},"01M6KP250W406CEDSF02BRXT9D","tools-creusot-install","Install the Creusot Rust verification tool","https:\u002F\u002Fgithub.com\u002FAI-native-Systems-Research\u002Fai-native-storage-certus\u002Fblob\u002Funstable\u002Fcomponents\u002Fzyre\u002F.claude\u002Fskills\u002Ftools-creusot-install\u002FSKILL.md",[],[95,96,19,97,87,98],"tools creusot install","install","rust","tool",{"skillNo":100,"name":101,"nameZh":6,"description":102,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":103,"categories":104,"keywords":105,"publishedAt":28},"01M6KP22H28FQ1X0V7VJHEFWXD","tools-creusot-init","Prepare an existing Cargo project to use Creusot formal verification","https:\u002F\u002Fgithub.com\u002FAI-native-Systems-Research\u002Fai-native-storage-certus\u002Fblob\u002Funstable\u002Fcomponents\u002Fzyre\u002F.claude\u002Fskills\u002Ftools-creusot-init\u002FSKILL.md",[],[106,19,107,108,109,110,111,87,112,81,113,114,115],"tools creusot init","init","project","directory","components","prepare","use","cargo","manager","Existing",{"skillNo":117,"name":118,"nameZh":6,"description":119,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":120,"categories":121,"keywords":122,"publishedAt":28},"01M6KP1V506J9YM8DKKVDG1NRE","tools-creusot-coq-install","Add Coq 8.20 as an additional prover to an existing Creusot installation, for verification conditions that SMT solvers cannot discharge","https:\u002F\u002Fgithub.com\u002FAI-native-Systems-Research\u002Fai-native-storage-certus\u002Fblob\u002Funstable\u002Fcomponents\u002Fzyre\u002F.claude\u002Fskills\u002Ftools-creusot-coq-install\u002FSKILL.md",[],[123,124,96,19,83,115,125,126,87,127],"tools creusot coq install","Coq","as","installation","add",{"skillNo":129,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":130,"categories":131,"keywords":132,"publishedAt":28},"01M6KP1PQJF3H765TYZAZ7P3EF","https:\u002F\u002Fgithub.com\u002FAI-native-Systems-Research\u002Fai-native-storage-certus\u002Fblob\u002Funstable\u002Fcomponents\u002Fzyre\u002F.claude\u002Fskills\u002Ftools-creusot-annotate-interfaces\u002FSKILL.md",[],[19,21,20,26,25,24,23,22,27]]