Combining Mechanical and Agentic Specification Inference for Move
This paper presents a specification inference tool for the Move Prover that synergizes sound weakest-precondition analysis with an agentic coding CLI to automatically generate and refine verification specifications, effectively reducing manual boilerplate while handling complex properties like loop invariants and structural invariants.
Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
Imagine you are building a complex house (a piece of software called a "Move smart contract"). You want to make sure the house is safe: the doors only open with the right key, the roof never collapses, and the bank vault inside keeps the money safe.
To prove the house is safe, you need to write a detailed "rulebook" (called a specification) that explains exactly how every part of the house should behave. Writing this rulebook by hand is incredibly tedious, boring, and prone to human error. It's like trying to write a legal contract for every single brick in the house.
This paper describes a new tool that acts like a super-smart construction assistant to help write this rulebook automatically. It combines two very different types of helpers: a Rigid Robot and a Creative Human.
The Two Helpers
The Rigid Robot (Mechanical Analysis):
Think of this as a super-precise calculator. It looks at the blueprints (the code) and mechanically calculates the absolute minimum rules required to keep the house standing. It's great at finding obvious things, like "if you pull this lever, the door opens." However, it gets stuck on complex, looping tasks (like a security guard walking a patrol route). It doesn't know why the guard is walking in circles or what the pattern is; it just sees the movement and gets confused.The Creative Human (The AI Agent):
This is the "Claude Code" AI. It's good at understanding patterns, idioms, and high-level concepts. It can look at that security guard and say, "Ah, I see! The guard is checking every door in order, and the number of doors checked always goes up." It's great at writing the "loop invariants" (the rules for the repeating actions) that the Robot can't figure out. But, the AI can sometimes get creative in the wrong way and invent rules that don't actually match the blueprints.
How They Work Together
The tool puts these two together in a loop, using a "Model Context Protocol" (MCP) which is like a walkie-talkie system connecting them to the construction site.
- The Robot starts: It scans the code and writes down the basic, hard facts (the "Weakest Pre-conditions"). It says, "Okay, we know the door opens if you have a key."
- The Human fills the gaps: The AI looks at the Robot's work and says, "I see a loop here. Let me guess the pattern: the counter goes up by one every time." It adds these high-level rules.
- The Referee checks: The "Move Prover" acts as the strict building inspector. It takes the combined rulebook and tries to prove it's true.
- If the rules work, great!
- If the rules fail (e.g., the AI guessed the wrong pattern), the inspector sends a "counter-example" back to the AI.
- The Fix: The AI reads the inspector's note, realizes its mistake, and rewrites the rule. This happens over and over until the inspector is satisfied.
Real-World Examples from the Paper
The authors tested this on three types of "houses":
- The Search Engine: A function that looks for a specific item in a list. The Robot figured out the basic logic, but the AI had to guess that "the number of items checked so far is always less than the total items."
- The Math Problem: A function that calculates powers (like ). The Robot handled the math, but the loop was tricky. The AI had to invent a "helper function" to explain the pattern of multiplication, and then the team had to add a special "proof hint" (like a cheat sheet for the inspector) to prove the math wouldn't explode.
- The Bank Transfer: A function that splits money between two people. This involved changing the "global state" (the bank's ledger). The AI had to track exactly how the money moved from one account to another, ensuring no money was created or destroyed in the middle.
Why This Matters
Before this, writing these rulebooks was a huge bottleneck. It was like hiring a lawyer to write a contract for every single nail in a house.
- The Robot does the boring, mechanical math that humans hate doing.
- The AI does the pattern recognition that robots are bad at.
- The Inspector ensures neither of them lies.
The result is a system where a developer can ask the AI, "Write the safety rules for this code," and the AI, guided by the Robot and checked by the Inspector, produces a verified, safe rulebook much faster than a human could alone.
The Bottom Line
This isn't a magic wand that solves everything perfectly yet. The AI still needs to be guided by specific "skills" (instructions on how to behave) to avoid taking shortcuts. But it represents a major step forward: a partnership where a machine handles the logic, an AI handles the intuition, and a formal verifier ensures the truth, all working together inside the developer's own coding environment.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.