Multi-tenant relay: spec + mechanized formal proof (S1–S8) (#1285)

Signed-off-by: Tyler Longwell <tlongwell@block.xyz>
Co-authored-by: npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@sprout-oss.stage.blox.sqprod.co>
Co-authored-by: Tyler Longwell <tlongwell@block.xyz>
Co-authored-by: Mari <95cae996907d7cab9f5dbf43c0f53edeac6ab0b032a6feae4abfd784e467b3f5@sprout-oss.stage.blox.sqprod.co>
Co-authored-by: npub1mprnacetjua2xx3p5eddmhxyk6wv929ymm5py8kd2xfxurxahspqqlgyta <d8473ee32b973aa31a21a65adddcc4b69cc2a8a4dee8121ecd51926e0cddbc02@sprout-oss.stage.blox.sqprod.co>
Co-authored-by: npub1jmc9dt2lyvzu3h0kxlwxt5zg4fxp9476awyxw6gwxn72g6cw7exqs64whm <96f056ad5f2305c8ddf637dc65d048aa4c12d7daeb8867690e34fca46b0ef64c@sprout-oss.stage.blox.sqprod.co>
This commit is contained in:
Tyler
2026-06-26 11:15:59 -04:00
committed by GitHub
parent 34b2d3e8b4
commit 2ecdcce7bd
14 changed files with 3219 additions and 38 deletions

View File

@@ -0,0 +1,32 @@
\* TLC model-check config for the draft MultiTenantRelay model.
\* Run:
\* java -cp ~/.buzz/.scratch/tla2tools.jar tlc2.TLC -config MultiTenantRelay.cfg MultiTenantRelay.tla
SPECIFICATION Spec
CONSTANTS
Communities = {commA, commB}
Channels = {chanA1, chanA2, chanB1, chanB2, chanFresh}
Hosts = {hostA, hostB, hostBad}
Actors = {alice}
Workers = {relay1}
MsgIds = {msg1}
AuditVals = {audit0, audit1}
CommA = commA
CommB = commB
ChanA1 = chanA1
ChanA2 = chanA2
ChanB1 = chanB1
ChanB2 = chanB2
ChanFresh = chanFresh
HostA = hostA
HostB = hostB
HostBad = hostBad
NoChannel = noChannel
NoCommunity = noCommunity
OpenCommunities = {commA}
SanitizedErrors = {"auth-required", "restricted", "invalid", "duplicate", "pow", "rate-limited", "blocked", "error", "frame-too-large"}
INVARIANT Safety
CONSTRAINT BoundedObservations
CONSTRAINT BoundedWitnesses
SYMMETRY Symmetry