💻 computer science

A formalization of System I with type Top in Agda

This paper presents a complete formalization in Agda of a variant of System I extended with the type Top, including formal proofs of progress and strong normalization.

Original authors: Agustín Séttimo, Cristian Sottile, Cecilia Manzino

Published 2026-03-26

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Agustín Séttimo, Cristian Sottile, Cecilia Manzino

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are a chef in a very strict kitchen. In this kitchen, there is a rulebook (a "type system") that dictates exactly how you can combine ingredients. Usually, if a recipe calls for "Flour and Sugar," you must put the flour in first, then the sugar. If you put the sugar in first, the strict rulebook says, "Error! Wrong order!"

System I is a new kind of rulebook that says: "Wait a minute! Flour and Sugar is the same as Sugar and Flour. They are isomorphic (structurally identical in meaning)."

This paper is about taking that flexible rulebook, adding a special "Universal Ingredient" called Top (which can be anything, like a wildcard card in a game), and then proving mathematically that if you follow these rules, you will never get stuck in an infinite loop of cooking.

Here is the breakdown of what the authors did, using everyday analogies:

1. The Problem: The "Order Doesn't Matter" Kitchen

In standard programming (like a standard kitchen), the order of ingredients matters. But in System I, the authors realized that sometimes the order shouldn't matter.

The Analogy: Imagine a sandwich. A "Ham and Cheese" sandwich is essentially the same as a "Cheese and Ham" sandwich. If a computer program tries to eat a "Ham and Cheese" sandwich but only knows how to look for "Cheese and Ham," it should still work.
The Challenge: If you tell a computer "Order doesn't matter," it gets confused. It might try to swap ingredients forever (Ham $\to$ Cheese $\to$ Ham $\to$ Cheese...), creating an infinite loop. Or, it might try to grab the wrong ingredient because it doesn't know which one is which.

2. The Solution: Adding "Top" and "Receipts"

The authors added a new ingredient called Top (think of it as a "Universal Card" that can represent any ingredient).

The Twist: To make this work in a computer proof system (Agda), they couldn't just say "they are equal." They had to make the computer carry a receipt (a "witness") every time it swapped ingredients.
The Analogy: Instead of just magically turning a "Ham" into "Cheese," the computer must carry a little note saying, "I am turning this Ham into Cheese because of Rule #4." This prevents the computer from swapping things back and forth endlessly. The receipt proves why the swap happened, ensuring the process eventually stops.

3. The Goal: Proving You Won't Get Stuck

The main goal of the paper was to prove two things about this new kitchen:

Progress: If you have a valid recipe, you can always take the next step. You never get stuck with a plate of ingredients that you don't know how to combine.
Strong Normalization: You will never cook forever. No matter how complex the recipe, if you keep following the rules, you will eventually reach a finished dish (a "value").

Why is this hard?
Imagine a recipe that says: "Take this sandwich, swap the ingredients, then swap them back, then swap them again..." If the rules aren't perfect, the sandwich could be swapped forever. The authors proved that with their specific "receipt" system, the sandwich must eventually be eaten.

4. The Tool: Agda (The Super-Strict Sous-Chef)

The authors didn't just write this on paper; they built it inside Agda.

The Analogy: Agda is like a robot sous-chef that is so strict it won't let you cook a single step unless you can prove, mathematically, that the step is safe.
The Achievement: They wrote the entire rulebook for this "Isomorphic Kitchen" in Agda. Because Agda is so strict, if the code compiles (runs), it means the proofs are 100% correct. They didn't just say the kitchen is safe; they forced a robot to verify every single move.

5. The "Omega" Example: The Infinite Loop Trap

The paper discusses a tricky recipe called Omega (a classic computer science trap that usually causes infinite loops).

In a normal kitchen: If you try to eat Omega, the chef spins in circles forever.
In this new kitchen: Because of the "receipts" (witnesses) and the special rules for the "Top" ingredient, the robot chef can look at the recipe, see the receipts, and realize, "Ah, I need to apply this specific rule to simplify this part," and eventually, the recipe resolves into a simple, finished dish (the value ⋆).

Summary

The authors took a flexible programming language where "order doesn't matter," added a special "wildcard" ingredient, and built a rigorous mathematical proof (using a super-strict robot) to show that:

You can always keep cooking.
You will never cook forever.
The system is safe and reliable.

They did this by forcing the computer to carry "receipts" for every change it makes, ensuring that the flexibility of the system doesn't turn into chaos. This is a big deal for computer science because it helps us build languages that are both flexible for humans and safe for machines.

1. Problem Statement

The paper addresses the challenges of formalizing System I, a simply-typed lambda calculus extended with pairs where isomorphic types are considered equal. While System I allows for flexible programming (e.g., reordering arguments due to type isomorphism) and proof-irrelevance, its operational semantics are complex due to the interaction between type isomorphisms and term reduction.

Specific challenges identified include:

Non-determinism: Standard reduction rules (like projection $\pi_1$ ) become non-deterministic when type isomorphisms (like commutativity of pairs) allow terms to be rearranged.
Termination: Ensuring Strong Normalization (SN) is difficult because adding isomorphisms can lead to infinite reduction loops (e.g., via $\eta$ -expansion or symmetric rewriting).
Formalization Complexity: Existing implementations (e.g., in Haskell) often lack rigorous proofs of termination and progress. Adding new base types (like Top) to a calculus modulo isomorphisms requires carefully extending equivalence relations to preserve normalization.

2. Methodology

The authors employ Dependent Type Theory using the proof assistant Agda to construct a fully verified formalization. Their methodology involves:

Intrinsic Typing: Instead of extrinsic typing (where terms and types are separate), they use intrinsically typed terms. Every term in the Agda code is a proof of its own typing derivation. This ensures that type preservation is automatic and eliminates the need to prove subject reduction separately for many operations.
De Bruijn Indices: Variables are represented by natural numbers (indices) rather than names to avoid issues with $\alpha$ -conversion and capture-avoiding substitution.
Explicit Witnesses: To handle the conversion rule ( $A \equiv B \implies t:A \to t:B$ ), the calculus introduces a syntactic constructor [ρ]≡t. Here, ρ is an explicit witness (a proof term) of the type isomorphism. This makes the application of isomorphisms explicit in the term structure, allowing the reduction relation to target and eliminate these witnesses.
Directed Rewriting: Unlike System I, which uses an equivalence relation ( $\Leftrightarrow$ ), this formalization defines a directed rewriting relation ( $\rightsquigarrow$ ). Isomorphisms are oriented to decompose witnesses, preventing infinite loops where a term is rewritten back and forth between isomorphic forms.

3. Key Contributions

A. Extension of System I with `Top`

The authors extend System I by adding the type Top (representing logical truth). This introduces new isomorphisms:

$A \times \top \equiv A$ (Identity for product)
$\top \to A \equiv A$ (Identity for implication)
$A \to \top \equiv \top$ (Absorbing nature)
They adapt the term isomorphisms to handle these new rules, ensuring that terms involving Top reduce correctly.

B. Formalization in Agda

The paper presents a complete Agda development including:

Syntax: Definitions for Types, Contexts, and Terms (including the witness constructor).
Semantics: Definitions of substitution, $\beta$ -reduction, and the specific term equivalence rules (e.g., COMM, ASSO, DIST, CURRY, and new rules for Top).
Reduction Relation: Defined as the union of standard reduction ( $\to$ ) and term equivalence ( $\Leftrightarrow$ ), specifically designed to eliminate isomorphism witnesses.

C. Proofs of Progress and Strong Normalization

Progress: The authors prove that every closed, well-typed term is either a value or can take a reduction step. They handle the complexity of isomorphism witnesses by analyzing the "normal form" of the subterm and applying the appropriate isomorphism rule to eliminate the witness.
Strong Normalization (SN): They prove that every reduction sequence starting from a typed term is finite.
- Technique: They utilize Schäfer's approach to reducibility (adapted from Coq formalizations of System F), generalized for Agda.
- Interpretation: They define an interpretation function $[[t]]$ mapping terms to sets of strongly normalizing terms.
- Adequacy: The core of the proof is the Adequacy Theorem, which states that if a substitution is "adequate" (maps variables to SN terms), then the term resulting from applying that substitution is also SN. This handles the complex interactions of $\beta$ -reduction, projections, and isomorphism witnesses.

D. Evaluation Function

Because SN is proven constructively, the authors define a total evaluation function (eval) in Agda. This function takes a closed term and its SN evidence, returning the reduction sequence to a value. This demonstrates the practical computability of the formalization.

4. Results

Termination of $\Omega$ : The paper demonstrates that the classic non-terminating term $\Omega = (\lambda x. xx)(\lambda x. xx)$ , when typed with Top and using the specific isomorphism witnesses, does terminate in this system. The explicit witnesses force a specific reduction path that eventually eliminates the self-application loop, reducing $\Omega$ to the unit value ⋆.
Complete Formalization: The entire calculus, including the proofs of Progress and Strong Normalization, is implemented in Agda and is publicly available on GitHub.
Handling Non-Determinism: The formalization successfully resolves the non-determinism issues of standard System I by making isomorphism application syntax-directed and witness-driven.

5. Significance

Foundational Rigor: This is the first known formalization of a normalization proof for a lambda calculus modulo isomorphisms in a constructive setting (Agda). It validates the theoretical soundness of System I with Top.
Proof Irrelevance: The work contributes to the understanding of proof-irrelevance in type theory, showing how different proofs of isomorphic propositions can be treated as identical without breaking termination.
Methodological Advancement: The use of explicit witnesses and intrinsic typing provides a robust template for formalizing other calculi with complex equivalence relations. It demonstrates that "directing" equivalence relations into rewriting rules is a viable strategy for ensuring termination.
Future Applications: The formalization lays the groundwork for extending these systems to polymorphism (System F modulo isomorphisms) and untyped variants, as well as exploring the relationship with extensional systems like System I $\eta$ .

In summary, the paper successfully bridges the gap between theoretical lambda calculus with type isomorphisms and practical, verified implementation, proving that such systems can be both expressive and strongly normalizing through careful syntactic design and constructive proof techniques.