💻 computer science

Compositional Program Verification with Polynomial Functors in Dependent Type Theory

This paper presents a framework for compositional program verification in dependent type theory that utilizes polynomial functors to model interfaces, implementations, and specifications, demonstrating how these components compose via wiring diagrams and Mealy machines while being fully formalized in Agda.

Original authors: C. B. Aberlé

Published 2026-04-03

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: C. B. Aberlé

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are trying to understand a massive, complex machine, like a modern car or a smartphone. If you try to look at the entire thing at once, it's overwhelming. You can't see how the engine talks to the brakes, or how the screen connects to the battery.

This paper proposes a new way to build and check software that treats programs like LEGO sets or electronic circuits. Instead of trying to understand the whole giant machine at once, we break it down into small, self-contained boxes, check each box individually, and then snap them together.

Here is the breakdown of the paper's ideas using simple analogies:

1. The "Interface" Box (Polynomial Functors)

Think of every piece of software as a black box with specific ports.

The Input Port: What kind of data does this box need to work? (e.g., "I need a list of numbers").
The Output Port: What kind of data does this box give back? (e.g., "I will give you a single number").
The Directions: If the box has many different input ports, it tells you exactly which path to take for each one.

In the paper, these boxes are called Polynomial Functors. They are just a fancy mathematical way of saying, "Here is the shape of this box's connection points."

2. The "Wiring Diagram" (Composition)

Now, imagine you have a box that sorts mail, and another box that stamps envelopes.

To make a "Mail Processing System," you don't rewrite the code for sorting or stamping.
You simply wire the output of the "Sorter" box to the input of the "Stamper" box.

The paper introduces Wiring Diagrams as a visual map of how these boxes connect. The magic is that if you know how the Sorter works and how the Stamper works, you automatically know how the whole "Mail System" works just by looking at the wires. You don't need to peek inside the boxes again.

3. The "Rulebook" (Specifications & Dependent Polynomials)

Just because you can wire boxes together doesn't mean they will do the right thing. Maybe the Sorter box is broken and throws away the letters.

To fix this, the authors attach a Rulebook (a Specification) to every box.

The Promise: "If you give me a letter (Input), I promise to give you a stamped letter (Output)."
The Catch: The rulebook is smart. It says, "If the letter is addressed to 'Bob', I promise to stamp it red. If it's for 'Alice', I promise to stamp it blue."

In the paper, these are called Dependent Polynomials. They are like a dynamic contract that changes based on what goes into the box.

4. The "Inspector" (Verification)

Here is the superpower of this framework: Compositional Verification.

Usually, to prove a whole system is safe, you have to check every single line of code in the entire system. That's like checking every brick in a skyscraper to prove the building won't fall.

This paper says: No, you don't need to do that.

Check the "Sorter" box against its Rulebook. (Pass!)
Check the "Stamper" box against its Rulebook. (Pass!)
Check the Wiring Diagram to make sure the outputs of one match the inputs of the other. (Pass!)

Conclusion: Because the pieces are checked and the connections are correct, the entire system is guaranteed to be correct. The proof "composes" just like the boxes do.

5. The "Robot" (Mealy Machines)

How do we actually run these boxes? The paper uses Mealy Machines.
Think of a Mealy Machine as a robot with a memory.

When you push a button (Input), the robot looks at its memory, does a task, gives you a result (Output), and updates its memory for the next time.
The paper shows that you can take these "Rulebook-checked" boxes and plug them into these robots. If the boxes are verified, the robot's behavior is also verified.

6. The "Traffic Cop" (Concurrency)

The paper also looks at what happens when boxes run at the same time (like two people trying to use the same printer).

They introduce a "Parallel Sum" which acts like a Traffic Cop.
It ensures that two boxes don't try to grab the same resource at the exact same time, preventing "traffic jams" (race conditions) in the software.

The Big Picture

The author, C.B. Aberlé, has built a mathematical "Lego kit" for software engineers.

Old way: Build a giant wall, then try to find the cracks.
New way: Build perfect, verified bricks. Snap them together with a diagram. If the bricks are good and the diagram is right, the wall is perfect.

This framework has been tested and written out in a computer language called Agda (a tool for writing mathematically perfect code), proving that this "Lego approach" actually works in the real world.

In short: This paper gives us a way to build complex software by snapping together small, verified pieces, ensuring that the whole system is safe and correct without having to re-check everything from scratch every time we add a new piece.

1. Problem Statement

Large-scale software systems are often opaque, making it difficult to verify their behavior holistically. Traditional verification approaches struggle with modularity: verifying a complex system often requires re-verifying the entire system when a component changes, rather than composing the proofs of individual components.

The paper addresses the need for a compositional framework for program verification that:

Decomposes complex programs into simpler, independently verifiable modules.
Allows these modules to be composed (wired together) while preserving their correctness guarantees.
Unifies the representation of interfaces, implementations, specifications (pre/post-conditions), and operational semantics within a single mathematical structure.
Operates within Dependent Type Theory, allowing specifications to depend on runtime values and data structures.

2. Methodology

The author utilizes Polynomial Functors within the context of Dependent Type Theory (specifically formalized in Agda) to model software systems. The methodology relies on three core abstractions:

A. Polynomial Functors as Interfaces

A polynomial functor $P(y) = \sum_{a:A} y^{B(a)}$ represents a program interface:

$A$ : The type of positions (inputs).
$B(a)$ : The type of directions (outputs/responses) for a given input.
A morphism (lens) between polynomials represents a program that implements one interface by calling another.

B. Free Monads as Implementations

To model sequential composition where an interface is called zero, one, or many times, the framework uses the Free Monad on a polynomial functor ( $Free\ P$ ).

An implementation of interface $p$ depending on interface $q$ is a morphism $p \Rightarrow Free\ q$ .
This structure naturally models "assume-guarantee" reasoning: assuming an implementation of $q$ , we guarantee an implementation of $p$ .

C. Dependent Polynomials as Specifications

To move from implementation to verification, the paper introduces Dependent Polynomials.

A dependent polynomial over $P=(A, B)$ $P = (A, B)$ consists of:
- Preconditions: A family $C: A \to Set$ on inputs.
- Postconditions: A family $D: (a:A) \to C(a) \to B(a) \to Set$ on outputs.
This encodes a contract similar to a Hoare triple: if input $a$ satisfies $C(a)$ , the output must satisfy $D(a, \dots)$ .
Dependent Free Monads ($FreeDep$) are used to lift these specifications to the level of computations, allowing proofs that a computation respects its specification assuming its dependencies do.

D. Operational Semantics via Mealy Machines

The paper defines an operational semantics using Mealy Machines (stateful automata).

A Mealy machine for interface $P$ takes an input, produces an output, and transitions to a new state.
Crucially, Mealy machines act as runners for effects. If a program uses an interface $q$ (e.g., a state effect), a Mealy machine for $q$ provides the concrete implementation of that effect.
The framework proves that composing a program module with a Mealy machine yields a new Mealy machine for the module's interface.

3. Key Contributions

1. Compositional Verification via Wiring Diagrams

The paper demonstrates that implementations and their verifications compose along wiring diagrams.

Theorem: Given a wiring diagram of modules and verified implementations for each box, the composite system has a verified implementation for the outer interface.
This is achieved via Kleisli composition for the free monad monad and its dependent analogue. The proof relies on the fact that dependent polynomials are closed under sums (coproducts), allowing specifications of sub-modules to be combined into a specification for the whole.

2. Unified Categorical Structure

The author identifies the abstract categorical structure underlying this framework:

Interfaces ($Int$): A monoidal category (Kleisli category of the free monad on Poly).
Specifications ($Spec$): A monoidal category of pairs (Polynomial, Dependent Polynomial).
Presheaves: The assignment of Mealy machines to interfaces forms a lax monoidal presheaf.
Natural Transformation: There exists a monoidal natural transformation from the presheaf of verified systems ($DepMealy$) to the presheaf of systems ($Mealy$) via the forgetful functor.
This abstraction allows the framework to be generalized to other categories and monoidal products (e.g., concurrency).

3. Operational Semantics for Verification

The paper bridges the gap between static verification and dynamic execution. It shows that Dependent Mealy Machines (Mealy machines equipped with verification evidence) are closed under composition. This means a verified program running on a verified state machine yields a verified state machine for the composite system.

4. Extension to Concurrency and Relational Verification

In the appendix, the framework is extended to concurrent modules using a parallel sum ( $\|$ ) instead of the standard coproduct ( $\oplus$ ).

The parallel sum allows calling multiple interfaces simultaneously.
This structure supports relational verification (e.g., non-interference, monotonicity) by decomposing specifications into unary parts and relational parts relating the inputs/outputs of concurrent components.
The parallel sum is shown to be affine (preventing race conditions by design, as a wire cannot be used in two places simultaneously).

4. Results

Formalization: The entire framework, including definitions, theorems, and examples, has been fully formalized in Agda.
Case Studies:
- List Operations: The framework successfully models and verifies fold, append, and concat operations. It demonstrates how to verify append by composing verified base and step cases.
- Fibonacci with State: A Fibonacci generator is implemented using a state effect. The paper verifies that the machine correctly computes Fibonacci numbers and maintains a state invariant (that the state represents consecutive Fibonacci numbers).
Compositionality: The proofs confirm that verification effort scales linearly with the number of components, not the complexity of the whole system, provided the components are verified independently.

5. Significance

Bridging Theory and Practice: The paper connects the abstract theory of polynomial functors (interaction theory) with practical program verification in dependent type theory.
Scalability: By enabling true compositional verification, the framework addresses the scalability problem in formal methods, allowing large systems to be built from verified "black boxes."
Unified View: It provides a single mathematical language for interfaces, code, specs, and execution, reducing the fragmentation often found in verification tools.
Future Directions: The abstract categorical formulation opens the door to applying these techniques to:
- Concurrency: Verifying parallel systems without race conditions.
- Security: Verifying information flow policies in systems with opaque components (APIs, ML models).
- Automation: The compositional nature suggests that verification could be automated via tactics in proof assistants, reducing the user burden to local module proofs.

In summary, Aberlé presents a robust, mathematically rigorous framework that treats program verification as a compositional process, leveraging the algebraic structure of polynomial functors to unify specification, implementation, and execution semantics.