Strongly Normalizing Audited Computation

TL;DR

This paper introduces a new, simpler calculus for auditing in programming languages, ensuring strong normalization and consistency, thus providing a solid logical foundation for secure and accountable computation.

Contribution

The authors present $oldsymbol{ extlambda^{hc}}$, a simpler, consistent, and strongly normalizing calculus for auditing based on Justification Logic, improving upon previous complex systems.

Findings

$oldsymbol{ extlambda^{hc}}$ is simpler than $oldsymbol{ extlambda^h}$.

$oldsymbol{ extlambda^{hc}}$ is proven to be strongly normalizing.

The proof of strong normalization is formalized in Nominal Isabelle.

Abstract

Auditing is an increasingly important operation for computer programming, for example in security (e.g. to enable history-based access control) and to enable reproducibility and accountability (e.g. provenance in scientific programming). Most proposed auditing techniques are ad hoc or treat auditing as a second-class, extralinguistic operation; logical or semantic foundations for auditing are not yet well-established. Justification Logic (JL) offers one such foundation; Bavera and Bonelli introduced a computational interpretation of JL called $\lambda^h$ that supports auditing. However, $\lambda^h$ is technically complex and strong normalization was only established for special cases. In addition, we show that the equational theory of $\lambda^h$ is inconsistent. We introduce a new calculus $\lambda^{hc}$ that is simpler than $\lambda^h$, consistent, and strongly normalizing. Our proof of strong normalization is formalized in Nominal Isabelle.

Equations

$$\left\llbracket{a}\right\rrbracket{(A\supset B)}\supset\left\llbracket{b}\right\rrbracket{A}\supset\left\llbracket{a\cdot b}\right\rrbracket{B}$$

$$\left\llbracket{a}\right\rrbracket{A}\supset\left\llbracket{!a}\right\rrbracket{\left\llbracket{a}\right\rrbracket{A}}$$

$$!\text{leavevmode}M⇝{!}_{q}N$$

$$!\text{leavevmode}\mathsf{if}\text{leavevmode}(1\stackrel{?}{=}2)\text{leavevmode}M\text{leavevmode}N$$

$$!\text{leavevmode}\mathsf{if}\text{leavevmode}(1\stackrel{?}{=}2)\text{leavevmode}M\text{leavevmode}N⇝{!}_{\mathcal{Q}[q]}\mathsf{if}\text{leavevmode}\#F\text{leavevmode}M\text{leavevmode}N⇝{!}_{\mathbf{t}(\mathcal{Q}[q],q^{\prime })}N$$

$$\mathord{!}_{q}2:\left\llbracket{1+1}\right\rrbracket\mathbb{N}\qquad\qquad\mathord{!}_{q^{\prime}}6:\left\llbracket{\mathsf{fact}\leavevmode\nobreak\ 3}\right\rrbracket\mathbb{N}$$

$$\mathord{!}\leavevmode\nobreak\ \operatorname{let}(u^{\mathbb{N}}:=\mathord{!}_{q}2,\operatorname{let}(v^{\mathbb{N}}:=\mathord{!}_{q^{\prime}}6,u+v))\stackrel{{\scriptstyle*}}{{\mathrel{\leadsto}}}\mathord{!}_{q^{\prime\prime}}8:\left\llbracket{\operatorname{let}(u^{\mathbb{N}}:=\mathord{!}\leavevmode\nobreak\ 1+1,\operatorname{let}(v^{\mathbb{N}}:=\mathord{!}\leavevmode\nobreak\ \mathsf{fact}\leavevmode\nobreak\ 3,u+v))}\right\rrbracket\leavevmode\nobreak\ \mathbb{N}$$

$$!\text{leavevmode}((\lambda x,y,p.p\text{leavevmode}x\text{leavevmode}y)\text{leavevmode}2)\text{leavevmode}6$$

$$⇝$$

$$\psi (\_)\theta$$

$$\mathbf{r}(\_)\theta$$

$$\mathbf{t}(q,q^{\prime })\theta$$

$$\mathbf{\beta }(\_,\_)\theta$$

$${\mathbf{\beta }}_{\square }(\_,\_)\theta$$

$$\mathbf{ti}(\_,\_)\theta$$

$${\vartheta }_{+}(\psi )=\{\begin{array}{ll}1& \text{if ψ=β,β□,ti}\\ \lambda x.x& \text{if ψ=lam}\\ \lambda x,y.x+y& \text{if ψ=t,app,let,trpl::}\\ 0& \text{else}\end{array}$$

$$\mathrm{src}(\mathbf{r}(s))$$

$$\mathrm{src}(\mathbf{t}(q_1,q_2))$$

$$\mathrm{src}(\mathbf{\beta }(a^A.s_1,s_2))$$

$$\mathrm{src}({\mathbf{\beta }}_{\square }(s_1,v^A.s_2))$$

$$\mathrm{src}(\mathbf{ti}(q^{\prime },\theta ))$$

$$\small\begin{array}[]{rclcrcl}u\ltimes\left[{(N,q,t)}\middle/{u}\right]&\triangleq&N&&(\mathord{!}_{q^{\prime}}R)\ltimes\left[{(N,q,t)}\middle/{u}\right]&\triangleq&\mathord{!}_{\mathbf{t}(q^{\prime}\left[{t}\middle/{u}\right],R\times\left[{(N,q,t)}\middle/{u}\right])}(R\ltimes\left[{(N,q,t)}\middle/{u}\right])\\ u\times\left[{(N,q,t)}\middle/{u}\right]&\triangleq&q&&(\mathord{!}_{q^{\prime}}R)\times\left[{(N,q,t)}\middle/{u}\right]&\triangleq&\mathbf{r}(\mathord{!}({\mathrm{src}}(q^{\prime})\left[{t}\middle/{u}\right]))\end{array}$$

$$!\text{leavevmode}\mathrm{let}(u^{\mathbb{N}}:={!}_{q}2,\mathrm{let}(v^{\mathbb{N}}:={!}_{q^{\prime }}6,u+v))$$

$$\mathrm{let}(v^{\mathbb{N}}:={!}_{q^{\prime }}6,u+v)⋉\left[2,q,\mathrm{src}(q)/u\right]$$

$$\mathrm{let}(v^{\mathbb{N}}:={!}_{q^{\prime }}6,u+v)\times \left[2,q,\mathrm{src}(q)/u\right]$$

$${\mathcal{T}}^B(\psi )\triangleq \{\begin{array}{ll}B& (\psi =\mathbf{d},\mathbf{r},\mathbf{\beta },{\mathbf{\beta }}_{\square },\mathbf{ti},\mathbf{iti},{\mathbf{trpl}}_{[]})\\ B\supset B& (\psi =\mathbf{lam},{\mathbf{itb}}_{[]})\\ B\supset B\supset B& (\psi =\mathbf{t},\mathbf{app},\mathbf{let},{\mathbf{itb}}_{::},{\mathbf{trpl}}_{::})\end{array}$$

$$\small\begin{array}[]{rcl}\mathcal{E}&::=&\blacksquare\mathbin{|}\lambda a^{A}.\mathcal{E}\mathbin{|}(\mathcal{E}\;M)\mathbin{|}(M\;\mathcal{E})\mathbin{|}\mathord{!}_{q}\mathcal{E}\mathbin{|}\operatorname{let}(u^{A}:=\mathcal{E},M)\mathbin{|}\operatorname{let}(u^{A}:=M,\mathcal{E})\mathbin{|}\iota(\{\overrightarrow{M/\psi},\mathcal{E}/\psi^{\prime},\overrightarrow{N/\psi^{\prime\prime}}\})\vskip 3.0pt plus 1.0pt minus 1.0pt\\ \mathcal{Q}&::=&\blacksquare\mathbin{|}\mathbf{t}(\mathcal{Q},q)\mathbin{|}\mathbf{t}(q,\mathcal{Q})\mathbin{|}\mathbf{app}(\mathcal{Q},q)\mathbin{|}\mathbf{app}(q,\mathcal{Q})\mathbin{|}\mathbf{lam}(a^{A}.\mathcal{Q})\mathbin{|}\mathbf{let}(\mathcal{Q},u^{A}.q)\mathbin{|}\mathbf{let}(q,u^{A}.\mathcal{Q})\\ &|&\mathbf{trpl}(\{\overrightarrow{q_{1}/\psi},\mathcal{Q}/\psi^{\prime},\overrightarrow{q_{2}/\psi^{\prime\prime}}\})\end{array}$$

$$\small{\begin{array}[]{rclcrcl}\mathcal{Q}_{\blacksquare}&\triangleq&\blacksquare&&\mathcal{Q}_{(\mathcal{F}\;M)}&\triangleq&\mathbf{app}(\mathcal{Q}_{\mathcal{F}},\mathbf{r}({\mathrm{cd}}(M)))\\ \mathcal{Q}_{(M\;\mathcal{F})}&\triangleq&\mathbf{app}(\mathbf{r}({\mathrm{cd}}(M)),\mathcal{Q}_{\mathcal{F}})&&\mathcal{Q}_{\lambda a^{A}.\mathcal{F}}&\triangleq&\mathbf{lam}(a^{A}.\mathcal{Q}_{\mathcal{F}})\\ \mathcal{Q}_{\operatorname{let}(\mathcal{F},u^{A}.M)}&\triangleq&\mathbf{let}(\mathcal{Q}_{\mathcal{F}},u.\mathbf{r}({\mathrm{cd}}(M)))&&\mathcal{Q}_{\operatorname{let}(M,u^{A}.\mathcal{F})}&\triangleq&\mathbf{let}(\mathbf{r}({\mathrm{cd}}(M)),u^{A}.\mathcal{Q}_{\mathcal{F}})\vskip 3.0pt plus 1.0pt minus 1.0pt\\ \mathcal{Q}_{\iota(\{\overrightarrow{M/\psi},\mathcal{F}/\psi^{\prime},\overrightarrow{N/\psi^{\prime\prime}}\})}&\triangleq&\lx@intercol\mathbf{trpl}(\{\overrightarrow{\mathbf{r}({\mathrm{cd}}(M))/\psi},Q_{\mathcal{F}}/\psi^{\prime}.\overrightarrow{\mathbf{r}({\mathrm{cd}}(N))/\psi^{\prime\prime}}\})\hfil\lx@intercol\end{array}}$$

$$!\text{leavevmode}\mathrm{let}(u^{\mathbb{N}}:={!}_{q}2,\mathrm{let}(v^{\mathbb{N}}:={!}_{q^{\prime }}6,u+v))⇝{!}_{q_f}\text{leavevmode}\mathrm{let}(v^{\mathbb{N}}:={!}_{q^{\prime }}6,2+v)$$

$$q_f$$

$$=\mathbf{t}(\mathbf{r},\mathbf{t}({\mathbf{\beta }}_{\square }(1+1,u.\mathrm{let}(v:=!\text{leavevmode}\mathsf{fact}\text{leavevmode}3,u+v)),\mathbf{let}(\mathbf{r},\mathbf{app}(\mathbf{app}(\mathbf{r},q),\mathbf{r}))))$$

$$\begin{array}[]{l}!\leavevmode\nobreak\ (t_{0}\leftarrow\iota(\vartheta_{+});\\ \quad\_\leftarrow((\lambda x,y,p.p\leavevmode\nobreak\ x\leavevmode\nobreak\ y)\leavevmode\nobreak\ 2)\leavevmode\nobreak\ 6;\\ \quad t_{1}\leftarrow\iota(\vartheta_{+});\\ \quad t_{1}-t_{0})\end{array}$$

$$\small\begin{array}[]{rcl}\tau,\sigma&::=&P\mid\tau\supset\sigma\mid\Box\tau\\ s,t,\ldots&::=&a\mathbin{|}u\mathbin{|}\lambda a^{\tau}.s\mathbin{|}(s\;t)\mathbin{|}\mathord{!}s\mathbin{|}\operatorname{let}(u^{\tau}:=s,t)\mathbin{|}\iota(\theta)\\ \theta,\theta^{\prime},\ldots&::=&\{\overrightarrow{s/\psi}\}\\ \mathcal{E}&::=&\blacksquare\mathbin{|}\lambda a^{\tau}.\mathcal{E}\mathbin{|}(\mathcal{E}\;s)\mathbin{|}(s\;\mathcal{E})\mathbin{|}\mathord{!}\mathcal{E}\mathbin{|}\operatorname{let}(u^{\tau}:=\mathcal{E},s)\mathbin{|}\operatorname{let}(u^{\tau}:=s,\mathcal{E})\mathbin{|}\iota(\{\overrightarrow{s/\psi},\mathcal{E}/\psi^{\prime},\overrightarrow{t/\psi^{\prime\prime}}\})\end{array}$$

$$\small\begin{array}[]{c}|P|=P\qquad|A\supset B|=|A|\supset|B|\qquad|\left\llbracket{s}\right\rrbracket A|=\Box|A|\\ |a|\triangleq a\qquad|u|\triangleq u\qquad|\lambda a^{A}.M|\triangleq\lambda a^{|A|}.|M|\qquad|M\;N|\triangleq|M|\;|N|\\ |\mathord{!}_{q}M|\triangleq\mathord{!}|M|\qquad|\operatorname{let}(u^{A}:=M,N)|\triangleq\operatorname{let}(u^{A}:=|M|,|N|)\qquad|\iota(\vartheta)|\triangleq\iota(|\vartheta|)\end{array}$$

$$\forall x.f(\pi \cdot x)=\pi \cdot f(x)\forall x.x\in \mathcal{S}⟺\pi \cdot x\in \mathcal{S}$$

$${!}_q\mathcal{F}[M]⇝{!}_q\mathcal{F}[q^{\prime }▹M^{\prime }]\stackrel{\ast }{⇝}{!}_{q^{\prime \prime }}\mathcal{F}[M^{\prime }]$$

Full text

1. Introduction

Auditing is of increasing importance in many areas, including in security (e.g. history-based access control [1], evidence-based audit [25, 15]) and to provide reproducibility or accountability for scientific computations (e.g. provenance tracking [3]). To date, most approaches to auditing propose to instrument programs in some ad hoc way, to provide a record of the computation, sometimes called provenance, audit log, trace, or trail, which is typically meant to be inspected after the computation finishes. Foundations of provenance or auditing have not been fully developed, and auditing typically remains a second-class citizen (or even an alien concept), in that trails are not accessible to the program itself during execution, but only to an external monitoring layer. We seek logical and semantic foundations for self-auditing programs that provide first-class recording and auditing primitives.

In this paper, we explore how ideas from justification logic [5] (a generalization of the Logic of Proofs [6]) can provide such a foundation. Justification Logic is the general name for a family of logics that refine the epistemic reading of modal necessity $\Box A$ (“$A$ is known”) by indexing such formulas with justifications, or (descriptions of) evidence that $A$ holds. So, the formula \left\llbracket{a}\right\rrbracket{A} can be read as “justification $a$ is evidence (proof) establishing $A$”. In elementary forms of justification logic, the justifications consist of uninterpreted constants that can be combined with algebraic operations (e.g. formal sum and product). A representative axiom of justification logic is the evidence-aware version of Modus Ponens:

[TABLE]

which can be read as “if $a$ proves $A\supset B$ and $b$ proves $A$ then $a$ together with $b$ proves $B$”. Another representative axiom is the reflection principle:

[TABLE]

which can be read as “if $a$ proves $A$ then $!a$ proves that $a$ proves $A$”, where $!$ is a reflection operator on justifications. Notice that in both cases, if we ignore the evidence annotations $a,b$, we get standard axioms “K” and “4” of modal logic respectively [16].

This paper explores using (constructive) justification logic as a foundation for programming with auditing, building on of previous work on calculi for modal logic [22] and justification logic [7, 9]. Artemov and Bonelli [7] introduced the intensional lambda calculus $\lambda^{\mathbf{I}}$, which builds upon Pfenning and Davies’ type theory for modal logic [22] by recording proof codes in judgements and modalities; proof codes are a special case of proof terms. In $\lambda^{\mathbf{I}}$, “trails” that witness the equivalence of proof codes were introduced, but these trails could not be inspected by other constructs. More recently, Bavera and Bonelli [9] introduced $\lambda^{h}$, an extension of $\lambda^{\mathbf{I}}$ that allowed trail inspection, which can audit a computation’s trail of evaluation from the currently-enclosing box constructor up to the point of inspection.

Trail inspection is a first-class construct of $\lambda^{h}$, and can be performed at arbitrary program points (including inside another trail inspection). Bavera and Bonelli outlined how this construct can be used to implement history-based access control [1] policies in which access control decisions are made based on the complete previous call history. Trail inspection could also be used for profiling, for example by counting the number of calls of each function in a subcomputation, or for more general auditing [4], for example by comparing the trails of multiple computations to look for differences or anomalies in their execution history. Furthermore, all of these applications can be supported in a single language, rather than requiring ad hoc changes to accommodate different monitoring semantics. (It is worth noting that these applications typically use data structures such as sets or maps that are not provided in $\lambda^{h}$; however, they are straightforward to add.)

Bavera and Bonelli proved basic metatheoretic properties of $\lambda^{h}$ including subject reduction, and gave a partial proof of strong normalization. The latter proof considered only terms in which there was no nesting of box constructors. Although they conjectured that strong normalization holds for the full system, the general case was left as an open question. However, $\lambda^{h}$ is a somewhat complex system, due to subtle aspects of the metatheory of trail inspection. Trails are viewed as proof terms witnessing equivalence of proof codes. Proof codes include trail inspections, whose results depend on the history of the term being executed. $\lambda^{h}$’s trails are viewed as equality proofs and are thus subject to symmetry: operationally, the language provides a trail constructor $\mathbf{s}(q)$ that converts a trail $q$ of type $s=t$ to one of type $t=s$. Since the reduct of an outer trail inspection depends on a non-local, volatile context (the trail declared in the nearest outer box constructor) symmetry makes it possible to equate any two codes of the same type: in other words, the theory of trails becomes inconsistent.

To avoid this problem, Bavera and Bonelli annotated trail inspections with affine trail variables $\alpha,\alpha^{\prime}$ representing the volatile context, and trail inspection is then denoted by $\alpha\theta$, where $\theta$ is a collection of functions specifying a structural recursion over the trail. Nevertheless, in $\lambda^{h}$ we can prove any two codes $s$ and $t$ equivalent. A detailed example, along with the rules of $\lambda^{h}$, are presented in Appendix A; here, we sketch the derivation:

$s=q_{1}\theta$         $q_{1}\theta=\alpha\theta$

$s=\alpha\theta$

     

$t=q_{2}\theta$         $q_{2}\theta=\alpha\theta$

$t=\alpha\theta$

$\alpha\theta=t$

(*)

$s=t$

where $q_{1}$, $q_{2}$ and $\theta$ are chosen so that $s=q_{1}\theta$ and $t=q_{2}\theta$, which is possible whenever $s$ and $t$ have the same type. The problem seems to originate from the transitivity rule marked with (*), which constitutes an exception to the affineness of trail variables, since the same proof code must necessarily appear as the right-hand side of the first premise and as the left-hand side of the second one. This allows trail inspection on $\alpha$ to be triggered twice. It should be noted that this property does not contradict any proved results by Bavera and Bonelli; instead, it can be viewed as an (undesirable) form of proof-irrelevance: that is, \left\llbracket{s}\right\rrbracket A\to\left\llbracket{t}\right\rrbracket A is inhabited for any well-formed proof codes $s,t$. Of course, if this is the case then the stated justification $s$ for \left\llbracket{s}\right\rrbracket A need have nothing with to do its actual proof, defeating the purpose of introducing the proof codes in the first place.

We present a new calculus, $\lambda^{hc}$, that overcomes these issues with $\lambda^{h}$, and provides a more satisfactory foundation for audited computation, including the following contributions:

• •

We dispense with $\lambda^{h}$’s trail variables, instead adopting a trail inspection construct $\iota(\theta)$ that can be used anywhere in the program. We also adjust $\lambda^{h}$’s treatment of trails by no longer viewing them as witnesses to proof code equality but rather to (directed) reducibility. At a technical level, this simply consists of dropping the symmetry axiom and trail form. Viewing trails as asymmetric reducibility proofs means that it is no longer inconsistent to relate a trail inspection redex with all of its possible contracta nondeterministically, and it also obviates the need for trail variables (or ordinary variables) to be affine; once we lift these restrictions, however, the rationale for trail variables evaporates. We present the improved system, and summarize its metatheory (including a proof that its equational theory is consistent) in Section 2.

• •

To show that ${\lambda^{hc}}$ is well-behaved, we prove strong normalization (SN). Our proof of SN actually shows a stronger result: SN holds even if we conservatively assume that trail inspection operations can choose any well-formed trail; this is a useful insight because it means that we can extend the result to more realistic languages with more complex trails. We summarize this proof, which we fully formalized in Nominal Isabelle111The full formalization can be found at http://www.wilmer-ricciotti.net/FORMAL/ccau.tgz. A more detailed discussion can be found in the extended version of this paper.

Section 4 discusses related work: in particular, we argue that our approach can be used to prove strong normalization for $\lambda^{h}$ as well, even in the presence of the symmetry rule.

2. A history-aware calculus

2.1. Overview

In this section we describe $\lambda^{hc}$, an extension of the simply-typed lambda calculus allowing for several forms of auditing, thanks to an internalized notion of computation history. It is based in many respects on $\lambda^{h}$, but since our preferred notation differs in important details we give a self-contained presentation.

Operationally, we add to the simply typed $\lambda$-calculus a new term form $\mathord{!}_{q}M$, where $M$ is an expression and $q$ is a trail containing a symbolic description of the past history of $M$. History-aware expressions will be given their own type: if $M$ has type $A$, and $q$ is an appropriate trail showing how $M$ has reduced, then the type of $\mathord{!}_{q}M$ will be indicated by \left\llbracket{s}\right\rrbracket A; the symbol ‘$\mathord{!}$’ is called “bang”. In our language, we will initially evaluate expressions in the form $\mathord{!}\leavevmode\nobreak\ M$, where the absence of a subscript indicates that no computation has happened within $M$ yet. As we reduce $M$, the bang will be annotated with a subscript, for example

[TABLE]

where $q$ must explain how $N$ was obtained from the initial expression $M$.

As a slightly more involved example, we consider the following expression:

[TABLE]

Here, $\mathop{\overset{?}{=}}$ represents an equality test between integers, while $M$ and $N$ represent respectively the ‘then’ and ‘else’ branches of the $\mathsf{if}$ statement. To evaluate the expression, we first reduce the equality test to $\#F$ (boolean false), and the $\mathsf{if}$ to its ‘else’ branch. In $\lambda^{hc}$, this computation will be described as:

[TABLE]

where $q$, $\mathcal{Q}$, and $q^{\prime}$ are defined in such a way that:

• •

$q$ explains how $1\mathop{\overset{?}{=}}2$ reduces to $\#F$

• •

$\mathcal{Q}$ is a context indicating that $q$ was applied to the guard of an $\mathsf{if}$ statement – in other words, it describes a congruence rule of reduction

• •

$q^{\prime}$ describes the reduction of $\mathsf{if}\leavevmode\nobreak\ \#F\cdots$ to its ‘else’ branch

• •

$\mathbf{t}$ combines its two arguments by means of transitivity.

To make use of history-aware expressions, we will also provide constructs to access their contents or to inspect their history.

2.2. Syntax

We now give the formal definition of ${\lambda^{hc}}$. The language includes three syntactic classes, which we have already presented informally in the overview:

• •

codes $s,t$ correspond to (extended) lambda expressions which have not been evaluated yet: in other words, they only contain bangs with no history

• •

trails $q,q^{\prime}$ encode the history of the computation transforming a certain code into another

• •

terms $M,N$ are lambda expressions that have been partially evaluated: they are similar to codes, but their bangs are annotated with trails.

The types of the language (denoted by metavariables $A,B,C,\ldots$) include atomic types $P$, functions $A\supset B$, and audited units \left\llbracket{s}\right\rrbracket A. Notice that types contain codes, which can contain types in turn. Audited types correspond to terms that capture and record all the computation happening inside them, for subsequent retrieval.

The syntax of the language is presented in Figure 1. Codes and terms are defined in a similar way to Pfenning and Davies [22]. We use the symbol ‘$\mathord{!}$’ (“bang”) to denote box introduction in both codes and terms; the corresponding elimination form is given by the $\operatorname{let}$ operator, which unpacks an audited code or term allowing us to access its contents. The variable declared by a $\operatorname{let}$ is bound in its second argument: in essence, $\operatorname{let}(u:=\mathord{!}_{q}M,N)$ will reduce to $N$, where $u$ has been replaced by $M$; $q$ will be used to produce a trail explaining this reduction.

Example 2.1**.**

${\lambda^{hc}}$* allows us to manipulate history-carrying data explicitly. For instance, we could have the following history-carrying natural numbers:*

[TABLE]

The trail $q$ represents the history of $2$, i.e. a witness to the computation that produced $2$ by adding $1+1$; similarly, $q^{\prime}$ describes how computing $\mathsf{fact}\leavevmode\nobreak\ 3$ (for a suitable definition of the factorial function) yielded $6$.

Now supposing we wish to add these two numbers together, at the same time retaining their history, we will use the $\operatorname{let}$ construct to look inside them:

[TABLE]

where the type of the terms is preserved under reduction, and the final trail $q^{\prime\prime}$, produced by composing $q$ and $q^{\prime}$, is expected to log the reductions of $1+1$, of $\mathsf{fact}\leavevmode\nobreak\ 3$, and of the two $\operatorname{let}$s.

Trail inspection codes and terms will perform computation by primitive recursion on a certain trail, which represents an audited unit’s computation history. Trail inspection references the computation history of the current context ($\iota(\theta)$ and $\iota(\vartheta)$). Here, $\theta$ and $\vartheta$ contain the branches that define the recursion.

The only difference between codes and terms is that in terms, bang operators are annotated with a trail $q$: this follows the intuition that terms are codes considered with their computational evolution. Trails represent (multi-step) reductions relating two codes: thus, their structure matches the derivation tree of the reduction itself.

In this definition, when a trail contains an argument composed of a variable and another expression separated by a dot, the variable should be considered bound in that expression. The constructors ${\bm{\beta}},{\bm{\beta_{\Box}}}$ and $\mathbf{ti}$ define atomic reductions: ${\bm{\beta}}$ represents the regular $\beta$-reduction; ${\bm{\beta_{\Box}}}$ is similar, but reduces a let-bang combination; finally, $\mathbf{ti}$ reduces trail inspections. The constructors $\mathbf{lam}$, $\mathbf{app}$, $\mathbf{let}$, and $\mathbf{trpl}$ provide congruence rules for all code constructors (with the notable exception of bangs, since trails are not allowed to escape an audited unit): for example, if $q$ is a trail from $s$ to $t$, $\mathbf{lam}(a^{A}.q)$ constructs a trail from $\lambda a^{A}.s$ to $\lambda a^{A}.t$. Finally, the definition of trails is completed by reflexivity and transitivity (but excluding symmetry). Notice that reflexive trails take as a parameter the code whose identity is stated (for brevity, we will keep this parameter implicit in our examples).

Example 2.2**.**

We can build a pair of natural numbers using Church’s encoding: $\lambda^{hc}$ makes it possible to keep a log of this operation without adding specialized code:

[TABLE]

The trail for the first computation step is obtained by transitivity (trail costructor $\mathbf{t}$) from the original trivial trail ($\mathbf{r}$, i.e. reflexivity) composed with ${\bm{\beta}}(x.\lambda y,p.p\leavevmode\nobreak\ x\leavevmode\nobreak\ y,2)$, which describes the beta-reduction of $(\lambda x,y,p.p\leavevmode\nobreak\ x\leavevmode\nobreak\ y)\leavevmode\nobreak\ 2$: this subtrail is wrapped in a congruence $\mathbf{app}$ because the reduction takes place deep inside the left-hand subterm of an application (the other argument of $\mathbf{app}$ is reflexivity, because no reduction takes place in the right-hand subterm).

The second beta-reduction happens at the top level and is thus not wrapped in a congruence. It is combined with the previous trail by means of transitivity.

Inspection branches $\theta$, $\vartheta$ and $\zeta$ are maps from trail constructors to codes, terms, or trails. More precisely, since some of the trail constructors have a variable arity, in that case we need to distinguish a nil case ($[]$) and a cons case ($::$) to specify the corresponding branch of recursion; in addition, we do not require the map to be exhaustive, but allow a “default”, catch-all branch specified using the label $\mathbf{d}$: this does not make the language more expressive, but will allow us to extend the language with additional constants without needing to modify the base syntax. We now give a formal definition of the result of trail inspection.

Definition 2.3**.**

*The operation $q\theta$, which produces a code by structural recursion on $q$ applying the inspection branches $\theta$, is defined as follows:

[TABLE]

The twin operation $q\vartheta$, which produces a term by structural recursion on $q$, is defined similarly, by replacing each occurrence of $\theta$ with $\vartheta$.

Example 2.4**.**

For profiling purposes, we might be interested in counting the number of computation steps that have happened thus far in an audited unit. This can be accomplished by means of a trail replacement $\vartheta_{+}$ such that:

[TABLE]

This trail replacement counts $1$ for each reduction step (${\bm{\beta}},{\bm{\beta_{\Box}}},\mathbf{ti}$); the cases for transitivity and congruences add together the recursive results for subtrails; the last clause ignores other constructors, most notably $\mathbf{r}$ and $\mathbf{ti}_{[]}$, which are not reduction steps and do not have subtrails.

2.3. Substitutions

$\lambda^{hc}$ employs two notions of substitution, one for each kind of variable supported by the language:

• •

Simple variable substitution, which is not history-aware, is applied to codes, types, or terms and maps a simple variable to, respectively, a code or a term; we denote it by $\left[{t}\middle/{a}\right]$ or $\left[{N}\middle/{a}\right]$, which can also be written $\gamma$ for short.

• •

Audited variable substitution, which is history-aware, is applied to codes or terms and maps an audited variable to, respectively, a code $t$ or a tuple $(N,q,t)$; we denote it by $\left[{t}\middle/{u}\right]$ or $\left[{(N,q,t)}\middle/{u}\right]$, which can also be written $\delta$ for short.

We will also use the letter $\eta$ to refer to either of the two flavors of substitution when more precision is not needed.

Definition 2.5** (substitution on codes).**

Substitution of simple and audited variables on a code $r$ ($r[s/a]$ and $r[s/u]$) is defined as usual (avoiding variable capture). The full definition is shown in Appendix B.1.

Each of the two substitutions on codes is extended to trails and types in the obvious way, by traversing the trail or type until a subexpression containing a code $s$ is found, then resorting to substitution on $s$. To define substitution on terms, we first need auxiliary definitions of the source and target of a trail:

Definition 2.6**.**

*The source and target of a trail $q$ (${\mathrm{src}}(q)$ and ${\mathrm{tgt}}(q)$) are defined as follows: *

[TABLE]

The omitted cases are routine and shown in Appendix B.2.

A valid trail $q$ represents evidence that ${\mathrm{src}}(q)$ reduces to ${\mathrm{tgt}}(q)$ (we formally state this result in the next section).

We omit the definition of simple variable substitution on terms for brevity (it is similar to the corresponding substitution on codes). The definition of audited variable substitution on terms, however, deserves some more explanation: since this substitution arises from the unpacking of a bang term, which contains a trail we need to take care of, it takes the form $\left[{(N,q,t)}\middle/{u}\right]$, where $q$ is the computation history that led from the code $t$ to the term $N$.

For related reasons, this substitution can be applied to a term to produce both a new term and a corresponding trail: the two operations are written $M\times\delta$ and $M\ltimes\delta$, respectively.

Definition 2.7** (audited variable substitution (terms)).**

The operations $M\times\left[{(N,q,t)}\middle/{u}\right]$ and $M\ltimes\left[{(N,q,t)}\middle/{u}\right]$ are defined as follows:

[TABLE]

The omitted cases are routine and shown in Appendix B.3. The main feature of interest here is that when we $\ltimes$-substitute $(N,q,t)$ for $u$ in an audited unit $\mathord{!}_{q^{\prime}}$, we need to augment the trail with a step showing how the replaced occurrence of $u$ evaluated from $t$ to $N$, as well as substituting for other occurrences of $u$; the corresponding case of $\times$-substitution returns the appropriate reflexivity trail, since no trail escapes a bang as a result of substitution.

Example 2.8**.**

We consider again the term from Example 2.1:

[TABLE]

Audited variable substitution is used to reduce $\operatorname{let}$-$\mathord{!}$ combinations; for example, to reduce the outer $\operatorname{let}$ in the example, we need to compute

[TABLE]

(we assume that the infix notation for $+$ is syntactic sugar for two nested applications).

2.4. Type system

We now introduce typing rules for codes, trails, and terms. These rules use three corresponding judgments with the following shape:

[TABLE]

The environments $\Delta$ and $\Gamma$ are list of type declarations for audited and simple variables respectively, in the form $u::A$ or $a:A$.

Figure 2 shows the typing rules of the language. In the rules for codes, if we forget for a moment about trail inspections, it is easy to recognize Pfenning and Davies’s judgmental presentation of modal logic. The rules for terms are very similar, the biggest difference being found in rule T-Bang: to typecheck $\mathord{!}_{q}M$, we first obtain the type $A$ and code $t$ for $M$; then we typecheck the trail $q$ to ensure that it has type $A$ and target $t$; if both checks are successful, we can return \left\llbracket{s}\right\rrbracket A as the type of the expression, and $\mathord{!}s$ as its code, where $s$ is the source of $q$. This also shows that when we say that $\mathord{!}s$ is the code of $\mathord{!}_{q}M$, we mean that the term is the result of reducing the code, and the trail $q$ records the computation history.

The rules for trail inspection, both as a code and as a term, rely on an auxiliary definition of $\mathcal{T}^{B}$, which is a function from inspection branch labels to the corresponding type; it depends on the superscript $B$, which refers to the output type of the inspection. The rule for inspection codes (TI) checks that the types of all the branches in $\theta$ match their labels. This requires $\theta$ to be defined on the default branch $\mathbf{d}$ to guarantee that the inspection is exhaustively defined. We define $\mathcal{T}^{B}$ as follows:

[TABLE]

Rather than typecheck a term to compute its code, we can define a function performing this operation directly.

Definition 2.9**.**

The code of a term $M$ (notation: ${\mathrm{cd}}(M)$) is the code obtained by replacing all occurrences of $\mathord{!}_{q}N$ with $\mathord{!}{\mathrm{src}}(q)$. The full definition is shown in Appendix B.4.

The rule T-Bang, which typechecks audited terms, needs to compute the type of a trail: this is performed by the typechecking rules for trails. Each of these rules typechecks a different trail constructor: in particular, four rules define the contraction of redexes (Q-${\bm{\beta}}$, Q-${\bm{\beta_{\Box}}}$, Q-TI), Q-Refl and Q-Trans ensure that trails induce a preorder on codes, and the remaining rules model congruence with respect to all code constructors but bangs. Let us remark that the trail $q$ mentioned in trail inspections cannot be synthesized from the redex (since codes are not history-aware), but must be provided as an argument to $\mathbf{ti}$.

We can prove that operations of Definitions 2.6 and 2.9 match the typing judgments:

Lemma 2.10**.**

If ${\Delta;\Gamma}\vdash{q}:{s\mathrel{\overset{\triangleright}{=}}_{A}t}$ then ${\mathrm{src}}(q)=s$ and ${\mathrm{tgt}}(q)=t$.

Lemma 2.11**.**

If ${\Delta;\Gamma}\vdash{M}:{A}\mathbin{|}{s}$ then ${\mathrm{cd}}(M)=s$.

2.5. Semantics

In this section, we define a reduction relation expressing how terms compute to values. Reduction differs from trails since it relates terms (rather than codes), and since unlike trails it does not appear as part of terms (however, it is defined in such a way that reduced terms will contain modified trails expressing a log of reduction).

Our definition of reduction makes use of contexts, i.e. terms with holes, represented by black boxes ($\blacksquare$); similarly, we provide a notion of trail contexts, denoted by $\mathcal{Q}$. The notation $\mathcal{E}[M]$ indicates the term obtained by filling the hole in $\mathcal{E}$ with $M$; $\mathcal{Q}[q]$ is defined similarly.

[TABLE]

Following [9] we use $\mathcal{F}$ to refer to contexts that do not allow holes inside bangs. Box-free contexts $\mathcal{F}$ and trail contexts $\mathcal{Q}$ are related by the following definition:

Definition 2.12** (canonical trail context).**

For every $\mathcal{F}$, there exists a canonical trail context $\mathcal{Q}_{\mathcal{F}}$, defined as follows:

[TABLE]

Informally, $\mathcal{Q}_{\mathcal{F}}$ uses congruences to express a reflexive trail for $\mathcal{F}$, with a hole as the subtrail corresponding to the hole in $\mathcal{F}$. It is $\mathcal{Q}_{\mathcal{F}}$ that is responsible for producing the $\mathbf{app}$ congruence of Example 2.2.

Thanks to trail contexts and our definition of audited variable substitution, we can define reduction directly, without an auxiliary judgment pushing trails towards the closest outer bang. To avoid dealing with the unwanted situation of trail inspections not guarded by a bang, we only consider terms surrounded by an outer bang.

The reduction rules are defined in Figure 3. They operate by contracting a subterm appearing in a context $\mathcal{F}$, at the same time updating the trail of the enclosing bang by asserting that $q$ is followed by a new contraction appearing in the trail context $\mathcal{Q}_{\mathcal{F}}$. Rule B-$\beta_{\Box}$ is an exception, in that after performing the ${\bm{\beta_{\Box}}}$ contraction, we still need to take into account the residuals of $q^{\prime}$, expressed by the substitution $N\times\left[{(M,q^{\prime},{\mathrm{src}}(q^{\prime}))}\middle/{u}\right]$

We write $s\leadsto t$ when there exists a well-typed $q$ such that ${\mathrm{src}}(q)=s$ and ${\mathrm{tgt}}(q)=t$.

Example 2.13**.**

We take again the term from Example 2.1 and reduce the outer $\operatorname{let}$ as follows:

[TABLE]

where we use the substitutions we computed in Example 2.8. Since the reduction happens immediately inside the bang, we use rule B-${\bm{\beta_{\Box}}}$ with $\mathcal{Q}_{\blacksquare}=\blacksquare$, thus $q_{f}$ is as follows:

[TABLE]

(where ${\mathrm{src}}$ and ${\mathrm{cd}}$ compute according to the hypotheses we made about $q$ and $q^{\prime}$).

Example 2.14**.**

To show how to use the profiling inspection from Example 2.4, we need to assume a certain evaluation strategy: for example, call-by-value. We then write $(x\leftarrow M;N)$ as syntactic sugar for $(\lambda x.N)\leavevmode\nobreak\ M$ and evaluate the following term:

[TABLE]

In this term, $t_{0}$ evaluates to [math] because the bang starts with a reflexive trail; by the time we get to the third line, the outer trail contains a log of the inspection on the first line, the two beta reductions needed to evaluate the second line, and two more beta reductions to account for sequential compositions: thus $t_{1}$ evaluates to $5$; finally, we evaluate $t_{1}-t_{0}=5$.

Definition 2.15** (normal form).**

A term $M$ is in normal form iff for all trails $q$ and all terms $N$, $\mathord{!}_{q}M\not\leadsto N$. Likewise, a code is in normal form iff there exists no $t\neq s$ such that $s\leadsto t$.

It should be noted that $\lambda^{hc}$, despite being strongly normalizing (as we will prove in the next section), is not confluent: the same term may reduce to different values under different reduction strategies. In particular, the trails appearing in bangs are sensitive to the reduction order: a call-by-value strategy and a call-by-name strategy will produce different trails. We could recover confluence by forcing a certain evaluation strategy and quotienting trails by means of a suitable equivalence relation: this is beyond the scope of the present paper.

The main properties of $\lambda^{hc}$, such as subject reduction, can be proved similarly to those for $\lambda^{h}$. As explained in Section 1, we also need to establish the consistency of trails as proofs of reducibility.

Theorem 2.16**.**

For all codes $s,t$ of $\lambda^{hc}$ in normal form such that $s\neq t$, there exist no $\Delta,\Gamma,q,A$ such that ${\Delta;\Gamma}\vdash{q}:{s\mathrel{\overset{\triangleright}{=}}_{A}t}$

Proof 2.17**.**

If such a judgment were provable, by structural induction on it we would be able to show that $q$ must be a combination of reflexivity, transitivity, and congruence rules (since both $s$ and $t$ are in normal form, no contraction is possible in absence of symmetry). Then $s=t$, which falsifies the hypothesis.

3. Strong Normalization

We now summarize our proof of strong normalization for $\lambda^{hc}$. The presence of a recursion operator on trails, whose occurrences can be arbitrarily nested, together with the fact that trails grow monotonically during execution, makes this result non-trivial.

Our proof employs the well-known notion of “candidates of reducibility” [13] (sets of strongly normalizing terms enjoying certain desirable properties). Candidates of reducibility are a powerful and flexible tool, which has been used to prove the strong normalization property of very expressive lambda calculi [12, 18, 26] and also other results such as the Church-Rosser property [11].

In the literature, it is possible to find several definitions of candidate of reducibility: along with Girard’s definition, we can cite Tait’s saturated sets [24] and Parigot’s inductive definition [19]. Our proof employs Girard’s candidates, and can be easily compared to the similar proof for the System F [14]. Some acquaintance with that proof will be assumed in the rest of this section. We will use $\mathcal{S}\mathcal{N}$ to denote the set of all strongly normalizing terms. Reduction on strongly normalizing terms is a well-founded relation, which allows us to reason by well-founded induction on it.

3.1. A simplified calculus

As a technical means to investigate normalization of $\lambda^{hc}$, we define $\lambda^{hs}$, a simplified version of the calculus which forgets about trails associated with box introductions. Its types, terms, and contexts are defined by the following grammar:

[TABLE]

The terms of $\lambda^{hs}$ correspond closely to the codes of $\lambda^{hc}$. Their semantics, however, is different: $\iota(\theta)$ does not perform inspection on the trail of the enclosing bang, but at the time of its evaluation will receive an arbitrary trail. We omit the definition of trails for brevity, but it can be obtained from the corresponding notion in $\lambda^{hc}$, by replacing codes with $\lambda^{hs}$ terms.

We can also define simple and audited variable substitution on $\lambda^{hs}$ terms, in a way that mimics the corresponding notion of $\lambda^{hc}$ (Definition 2.5).

We provide an erasure map from $\lambda^{hc}$ types and terms to $\lambda^{hs}$ (its extension to contexts is immediate).

[TABLE]

The typing rules and reduction rules for $\lambda^{hs}$ are given in Figures 5 and 5. They are similar to their counterparts in $\lambda^{hc}$, but greatly simplified: in particular, trail inspection is allowed to reduce by nondeterministically picking any trail.

Unsurprisingly, erasure preserves well-typedness and reduction:

Lemma 3.1**.**

If $\Delta;\Gamma\vdash_{\lambda^{hc}}M:A|s$, then $\Delta;\Gamma\vdash_{\lambda^{hs}}|M|:|A|$.

Lemma 3.2**.**

$M\mathrel{\leadsto}_{\lambda^{hc}}N\Longrightarrow|M|\mathrel{\leadsto}_{\lambda^{hs}}|N|$**

By the combination of Lemma 3.1 and Lemma 3.2, we know that if $\lambda^{hs}$ is strongly normalizing, then $\lambda^{hc}$ must also, a fortiori, be strongly normalizing. We will thus proceed to prove SN in the simpler system, and extend it to $\lambda^{hc}$ as a corollary.

3.2. Summary of the proof

We now give the definition of candidates of reducibility à la Girard.

Definition 3.3** (neutral term).**

A term is neutral if it is not of the form $\lambda a^{A}.s$ or $!s$.

Definition 3.4** (candidates of reducibility).**

A set $\mathcal{C}$ of terms is a candidate of reducibility iff it satisfies Girard’s CR conditions:

**CR1: **

$\mathcal{C}\subseteq\mathcal{S}\mathcal{N}$**

**CR2: **

$s\in\mathcal{C}\land s\mathrel{\leadsto}t\Longrightarrow t\in\mathcal{C}$**

**CR3: **

$s\in\mathcal{N}\mathcal{T}\land(\forall t.s\mathrel{\leadsto}t\Longrightarrow t\in\mathcal{C})\Longrightarrow s\in\mathcal{C}$.

The set of candidates of reducibility will be denoted $\mathcal{C}\mathcal{R}$.

We identify certain subsets of candidates that are stable wrt. validity substitution:

Definition 3.5** (substitutive sub-candidate).**

For all candidates $\mathcal{C}$, validity variables $u$, and sets of terms $\mathcal{D}$, we define its substitutive subset ${{\mathcal{C}}_{u}^{\mathcal{D}}}$ as ${{\mathcal{C}}_{u}^{\mathcal{D}}}\triangleq\{s\in\mathcal{C}:\forall t\in\mathcal{D},s\left[{t}\middle/{u}\right]\in\mathcal{C}\}$.

Notice that sub-candidates are not in $\mathcal{C}\mathcal{R}$; they do, however, satisfy CR1 and CR2, which is enough for us to use them in the definition of reducible sets.

Definition 3.6** (reducible set).**

For all types $\tau$, the set $\mathsf{Red}_{\tau}$ of reducible terms of type $\tau$ is defined by recursion on $\tau$ as follows:

• •

$\mathsf{Red}_{P}=\mathcal{S}\mathcal{N}$**

• •

$\mathsf{Red}_{\tau\supset\sigma}=\{s:\forall t\in\mathsf{Red}_{\tau},(s\leavevmode\nobreak\ t)\in\mathsf{Red}_{\sigma}\}$**

• •

$\mathsf{Red}_{\Box\tau}=\{s:\forall u,\forall\mathcal{C}\in\mathcal{C}\mathcal{R},\forall t\in{{\mathcal{C}}_{u}^{\mathsf{Red}_{\tau}}},\operatorname{let}(u:=s,t)\in\mathcal{C}\}$**

In particular, $s\in\mathsf{Red}_{\Box\tau}$ if, and only if, for all reducibility candidates $\mathcal{C}$ and audited variables $u$, if we take a term $t\in{{\mathcal{C}}_{u}^{\mathsf{Red}_{\tau}}}$, then $\operatorname{let}(u:=s,t)\in\mathcal{C}$. We are allowed to use $\mathsf{Red}_{\tau}$ in ${{\mathcal{C}}_{u}^{\mathsf{Red}_{\tau}}}$ because $\tau$ is a subexpression of $\Box\tau$. thus we need to quantify over all candidates $\mathcal{C}$.

Lemma 3.7**.**

For each type $\tau$, $\mathsf{Red}_{\tau}\in\mathcal{C}\mathcal{R}$.

Theorem 3.8**.**

Let $\Delta,\Gamma,\overrightarrow{\eta}$ s.t. $\operatorname{dom}(\overrightarrow{\eta})=\operatorname{dom}(\Delta)\cup\operatorname{dom}(\Gamma)$, for all $u\in\operatorname{dom}(\Delta),\overrightarrow{\eta}(u)\in\mathsf{Red}_{\Delta(u)}$, and for all $a\in\operatorname{dom}(\Gamma),\overrightarrow{\eta}(a)\in\mathsf{Red}_{\Gamma(a)}$. Then, $\Delta;\Gamma\vdash s:\tau$ implies $s\overrightarrow{\eta}\in\mathsf{Red}_{\tau}$.

Proof 3.9**.**

We use the standard technique for System F [14], with additional subproofs for $s\in\mathsf{Red}_{\tau}\implies\mathord{!}s\in\mathsf{Red}_{\Box\tau}$ and $(\forall\psi\in\operatorname{dom}(\theta),\theta(\psi)\in\mathsf{Red}_{\mathcal{T}^{\sigma}(\psi)})\implies\iota(\theta)\in\mathsf{Red}_{\sigma}$. SN follows as a corollary when $\overrightarrow{\eta}$ is the identity substitution.

3.3. Formalization

We formalized $\lambda^{hc}$, together with our proof of strong normalization, in Nominal Isabelle. Nominal Isabelle mechanizes the management of variable binding, relieving the user from the burden of defining binding infrastructure (e.g. de Bruijn indices, lifting operations, etc.). On the other hand, many of the definitions used in a nominal formalization must be proved to be “well-behaved”, beyond what would usually be made explicit in a pencil-and-paper proof. The main well-behavedness property required in Nominal Isabelle is equivariance, stating that a function $f$ or a set $\mathcal{S}$ is stable under finite permutations of names $\pi$:

[TABLE]

Most of the definitions used in the proof are equivariant, including typing and reduction rules, the set $\mathcal{S}\mathcal{N}$ of strongly normalizing terms, the set $\mathcal{C}\mathcal{R}$ of reducibility candidates, reducibility sets $\mathsf{Red}_{A}$ for all types $A$, and the operator ${{\mathcal{C}}_{u}^{\mathcal{D}}}$.

We do not, however, prove equivariance for individual reducibility candidates $\mathcal{C}\in\mathcal{C}\mathcal{R}$: on the contrary, reducibility candidates do not need to be equivariant. To prove it, one can take a closure operator $[\cdot]$ mapping a set of strongly normalizing terms to the smallest reducibility candidate containing it (for its existence and definition see e.g. [23]): it is easy to see that, for all variables $a,b$, $\mathord{!}a\in[\{\mathord{!}b\}]$ if and only if $a=b$.

Our impredicative definition of $\mathsf{Red}_{\Box\tau}$, which quantifies over arbitrary candidates, is handled gracefully by Nominal Isabelle. Lindley and Stark [17] show a technique ($\top\top$-lifting) that can be adapted to provide a predicative definition of $\mathsf{Red}_{\Box A}$. As it happens, the lower logical complexity of $\top\top$-lifting relies on the additional definition of continuations, which would require some more effort to be formalized. On the other hand, our approach seems likely to extend to handle structural recursion (System T), following Aschieri and Zorzi [8], or impredicative polymorphism (System F), following Girard et al. [14].

4. Related work

The first Justification Logic-style system, known as the Logic of Proofs, was introduced by Artemov [6, 5]. Most work on justification logic systems (as for modal logic) is presented via Hilbert-style axiom systems extending classical propositional logic. Pfenning and Davies’ judgemental reconstruction of modal logic [22] provides a natural deduction-style proof system for (intuitionistic) modal logic with necessity and possibility modalities. Artemov and Bonelli [7] introduced a system $\lambda^{\mathbf{I}}$ for justification logic, extending Pfenning and Davies’ treatment of necessity ($\Box A$). They introduced equality proofs (trails) to recover subject reduction and proved strong normalization for $\lambda^{\mathbf{I}}$. Bavera and Bonelli later introduced (outer) trail inspection as part of an extended calculus called $\lambda^{h}$ [9] from which we took inspiration.

Our system $\lambda^{hc}$ seems (at least to us) an improvement over $\lambda^{h}$: it is simpler, and avoids the inconsistency arising from viewing trails as equivalence proofs. Nevertheless, the technique we used to prove strong normalization in $\lambda^{hc}$ seems to suffice for $\lambda^{h}$ as well. The only complication concerns the definition of reduction: while in $\lambda^{hc}$ reduction acts non-locally by updating the trail in the nearest enclosing bang, in $\lambda^{h}$ reduction produces an intermediate term annotated with a new local trail, and the trail in the enclosing bang is updated after a sequence of permutation reductions:

[TABLE]

It is thus necessary, though not overly complicated, to redefine reduction as a single-step operation including permutation reductions, and prove its equivalence to the original definition. This allows us to remove intermediate terms $q\mathrel{\triangleright}M$ from the calculus altogether. In general, the (efficient) reduction theory of systems such as $\lambda^{h}$ and $\lambda^{hc}$ deserves further study.

Our work is also partly motivated by previous work on provenance and tracing for functional languages. Perera et al. [20] presented a pure, ML-like core language in which program execution yields both a value and a trace, corresponding roughly to the large-step operational derivation leading to the result. They gave trace slicing algorithms and techniques for extracting program slices and differential slices from traces; in subsequent work Acar et al. [3] explored security implications such as the disclosure and obfuscation properties of traces [10]. Indeed, trail inspection can be considered as a generic mechanism for defining provenance views as considered by these papers. Although Bavera and Bonelli [9] motivated $\lambda^{h}$ as a basis for history-based access control (following Abadi and Fournet [1]), we are not aware of comparable work on provenance security based on justification logic. Our ongoing investigation suggests that $\lambda^{h}$-style trails contain enough information to extract many forms of provenance; however, to perform this extraction by means of trail inspection, we would usually need to reverse beta-reductions, and in particular to undo the substitution in beta-reduced terms. Since inspections treat beta and beta-box trails as black boxes, this cannot be achieved in the current version of the calculus. An extension of the language providing transparent beta trails and operations to undo substitutions is the subject of our current study.

Audit has been considered by a number of security researchers recently, for example Amir-Mohamedian et al. [4] consider correctness for audit logging, but auditing is again an extralinguistic operation (implemented using aspect-oriented programming). Vaughan et al. [25] introduced new formalisms for evidence-based audit. In Aura, an implementation of this approach [15], dependently-typed programs execute in the presence of a policy specified in authorization logic [2], and whenever a restricted resource is requested, a proof that access is authorized is constructed at run time and stored in an audit log for later inspection. The relationship between this approach and ours, and more generally between justification logic and authorization logic, remains to be investigated.

5. Conclusions

The motivation for this work is the need to provide better foundations for audited computation, as advocated in recent work on provenance and security and on type-theoretic forms of justification logic such as $\lambda^{h}$. However, as we have shown, $\lambda^{h}$ is at the same time overly restrictive (in requiring affine variable and trail variable usage, i.e. forbidding copying of ordinary data) and overly permissive: despite these restrictions aimed at keeping the equational theory consistent, one can still prove any two compatibly-typed proof codes equivalent, using symmetry and the nondeterministic equational law for trail inspection.

We presented a new calculus $\lambda^{hc}$ based on justification logic that includes audit operations such as trail inspection, but has fewer limitations and is simpler than $\lambda^{h}$. We show that $\lambda^{h}$ avoids this problem and has a consistent reduction theory. We also prove strong normalization for $\lambda^{hc}$ via a simplified system $\lambda^{hs}$, and we have mechanically checked the proof. This approach also seems sufficient to prove SN for $\lambda^{h}$, though we have not formalized this result.

In future work, we intend to consider larger-scale programming languages based on the ideas of $\lambda^{hc}$, investigate connections to provenance tracking and slicing techniques, and clarify the security guarantees offered by justification logic-based audit.

Appendix A The type system of $\lambda^{h}$

In Figures 8, 8, and 8, we provide the typing rules of Bavera and Bonelli’s $\lambda^{h}$ for reference, using syntax similar to that used in this paper.

A.1. Inconsistency of the equational theory of $\lambda^{h}$

In Section 1, we provided an informal derivation tree showing that the equational theory of $\lambda^{h}$ allows to equate any two proof codes of the same type. We give below a more accurate (but isomorphic) derivation tree. Then, if we choose a $\theta$ such that $\theta(\mathbf{r})=s$ and $\theta({\bm{\beta}})=t$, this effectively proves $s=t$, where $s$ and $t$ can be chosen freely:

${\cdot;\cdot;\cdot}\vdash{\mathbf{r}(s^{\prime})}:{s^{\prime}=_{B}s^{\prime}}$

${\cdot;\cdot;\cdot}\vdash{\theta}:{\mathcal{T}^{A}}$

EqTI

${\cdot;\cdot;\alpha:\mathsf{Eq}(A)}\vdash{\mathbf{ti}(\theta,\alpha)}:{\mathbf{r}(s^{\prime})\theta=_{A}\alpha\theta}$

     

${\cdot;\cdot;\cdot}\vdash{{\bm{\beta}}(b^{B^{\prime}}.t^{\prime},t^{\prime\prime})}:{t^{\prime}\left[{t^{\prime\prime}}\middle/{b}\right]=_{B^{\prime\prime}}(\lambda b^{B^{\prime}}.t^{\prime})\leavevmode\nobreak\ t^{\prime\prime}}$

${\cdot;\cdot;\cdot}\vdash{\theta}:{\mathcal{T}^{A}}$

EqTI

${\cdot;\cdot;\alpha:\mathsf{Eq}(A)}\vdash{\mathbf{ti}(\theta,\alpha)}:{{\bm{\beta}}(b^{B^{\prime}}.t^{\prime},t^{\prime\prime})\theta=_{A}\alpha\theta}$

EqSym

${\cdot;\cdot;\alpha:\mathsf{Eq}(A)}\vdash{\mathbf{s}(\mathbf{ti}(\theta,\alpha))}:{\alpha\theta=_{A}{\bm{\beta}}(b^{B^{\prime}}.t^{\prime},t^{\prime\prime})\theta}$

EqTrans

${\cdot;\cdot;\alpha:\mathsf{Eq}(A)}\vdash{\mathbf{t}(\mathbf{ti}(\theta,\alpha),\mathbf{s}(\mathbf{ti}(\theta,\alpha)))}:{\mathbf{r}(s^{\prime})\theta=_{A}{\bm{\beta}}(b^{B^{\prime}}.t^{\prime},t^{\prime\prime})\theta}$

This derivation contains a lot of extraneous details, so we summarize the main features which contribute to the final result. In this derivation, we use transitivity on two subderivations. The right-hand subderivation shows that $s=\mathbf{r}(s^{\prime})\theta$ is equal to $\alpha\theta$ , using the rule EqTI. Here, $s^{\prime}$ is an arbitrary well-formed term of some type $B$. The EqTI rule allows us to conclude that any code of the form $q\theta$ is equal to $\alpha\theta$, and here we have used $q=\mathbf{r}(s^{\prime})$.

In the second subderivation we use rule EqTI again to conclude that $t={\bm{\beta}}(b^{B^{\prime}}.t^{\prime},t^{\prime\prime})\theta$ is equivalent to $\alpha\theta$. Here, terms $t^{\prime}$ ad $t^{\prime\prime}$ are arbitrary well-formed terms of appropriate types to form a redex $\lambda b.t^{\prime})\leavevmode\nobreak\ t^{\prime\prime}$. We then use symmetry to show that $\alpha\theta$ is equivalent to ${\bm{\beta}}(b^{B^{\prime}}.t^{\prime},t^{\prime\prime})\theta$. The desired conclusion follows. Since we can easily choose $\theta$ so that it returns one proof code $s$ when handling a reflexivity trail and a different proof code $t$ when handling a $\beta$-redex trail, the above derivation can be modified to prove that any two proof codes (of the same type $A$) are equivalent.

Finally, in applying the transitivity rule EqTrans, it is important that this rule does not require affine use of the trail variable $\alpha$, so that it can be used in both subderivations. Changing this might fix the above problem, but would also have unknown consequences on the rest of the system. We have instead focused on an alternative system that does not require trail variables or affineness, by removing the symmetry trail.

Appendix B Full definitions

B.1. Substitution on codes

For $\gamma=\left[{t}\middle/{a}\right]$ and $\delta=\left[{t}\middle/{u}\right]$, we define substitution of simple and audited variables on a code $r$ (notation: $r\gamma$ and $r\delta$) as follows:

[TABLE]

where $\theta\gamma$ and $\theta\delta$ are defined pointwise and the notation $\gamma(b)$ is defined as $t$ if $a=b$, and as $b$ otherwise ($\delta(v)$ is defined similarly).

B.2. Source and target of a trail

The source and target of a trail $q$ (notation: ${\mathrm{src}}(q)$ and ${\mathrm{tgt}}(q)$) are defined as follows:

[TABLE]

where ${\mathrm{src}}(\zeta)$ and ${\mathrm{tgt}}(\zeta)$ are defined pointwise.

B.3. Audited variable substitution

Given $\delta=\left[{(N,q,t)}\middle/{u}\right]$, fix $\delta^{\prime}=\left[{t}\middle/{u}\right]$. Then, the operations $M\times\delta$ and $M\ltimes\delta$ are defined as follows:

[TABLE]

[TABLE]

where $\vartheta\times\delta$ and $\vartheta\ltimes\delta$ are defined pointwise on $\vartheta$.

B.4. Codes

The code of a term $M$ (notation: ${\mathrm{cd}}(M)$) is defined as follows:

[TABLE]

where ${\mathrm{cd}}(\vartheta)$ is defined pointwise.

Appendix C Proofs

C.1. Strong normalization

The proofs of strong normalization and related lemmata were only sketched because of space constraints. This appendix provides more detailed proofs and explanations, which summarize the mechanized formalization in Nominal Isabelle. For convenience, we explicitly state the well-founded induction principle we use in some of the following proofs:

Theorem C.1** (induction principle for well-founded relations).**

Let $R\subseteq X\times X$ a well-founded relation on some set $X$, and $P\subseteq X$ a predicate on the same set. Suppose that if $x\in X$ and for all $y\in X$ such that $y\mathrel{R}x$ we have $P\leavevmode\nobreak\ y$, then $P\leavevmode\nobreak\ x$. Then, $P\leavevmode\nobreak\ z$ holds for all $z\in X$.

The principle can also be applied to tuples of strongly normalizing terms by taking the lexicographic extension of the reduction relation, which is also well-founded.

Some standard results hold in $\lambda^{hs}$. The following substitution lemma can be proved by a routine induction.

Lemma C.2** (substitution lemma).**

**

1. (1)

$a\#r\Longrightarrow s\left[{t}\middle/{a}\right]\left[{r}\middle/{u}\right]=s\left[{r}\middle/{u}\right]\left[{t\left[{r}\middle/{u}\right]}\middle/{a}\right]$** 2. (2)

$u\#v,r\Longrightarrow s\left[{t}\middle/{u}\right]\left[{r}\middle/{v}\right]=s\left[{r}\middle/{v}\right]\left[{t\left[{r}\middle/{v}\right]}\middle/{u}\right]$**

Consequently, we can prove the substitutivity of reduction.

Lemma C.3** (substitutivity of reduction).**

$s\mathrel{\leadsto}t\Longrightarrow s\left[{r}\middle/{u}\right]\mathrel{\leadsto}t\left[{r}\middle/{u}\right]$**

Proof C.4**.**

By induction on the derivation of reduction, using Lemma C.2.

We mentioned that our proof of strong normalization uses candidates of reducibility (Definition 3.4): however, we found it convenient to also use a more general notion that we call pre-candidate of reducibility after Petit [21].

Definition C.5** (pre-candidates of reducibility).**

A set $\mathcal{C}$ of terms is a pre-candidate of reducibility iff it satisfies Girard’s CR1 and CR2 conditions:

**CR1: **

$\mathcal{C}\subseteq\mathcal{S}\mathcal{N}$**

**CR2: **

$s\in\mathcal{C}\land s\mathrel{\leadsto}t\Longrightarrow t\in\mathcal{C}$**

The set of pre-candidates of reducibility will be denoted $\mathcal{P}\mathcal{C}\mathcal{R}$.

Substitutive sub-candidates of a candidate are pre-candidates.

Lemma C.6**.**

${{\mathcal{C}}_{u}^{\mathcal{D}}}\in\mathcal{P}\mathcal{C}\mathcal{R}$**

Proof C.7**.**

Since ${{\mathcal{C}}_{u}^{\mathcal{D}}}\subseteq\mathcal{C}$, CR1 follows immediately. To prove CR2, we assume $s\in{{\mathcal{C}}_{u}^{\mathcal{D}}}$ and $s\mathrel{\leadsto}s^{\prime}$. By Lemma C.3, we prove that for all $t\in\mathcal{D}$, $s\left[{t}\middle/{u}\right]\mathrel{\leadsto}s^{\prime}\left[{t}\middle/{u}\right]$. From CR2 on the candidate $\mathcal{C}$, we know $s^{\prime}\in\mathcal{C}$, thus $s^{\prime}\in{{\mathcal{C}}_{u}^{\mathcal{D}}}$, which implies the thesis.

Remark C.8**.**

We easily see that CR3 cannot hold for ${{\mathcal{C}}_{u}^{\mathcal{D}}}$, meaning it is a pre-candidate but not a candidate, even if $\mathcal{D}$ were assumed to be a candidate. Otherwise, we would know $u\in{{\mathcal{C}}_{u}^{\mathcal{D}}}$, and consequently for all $N\in\mathcal{D}$ we would have $u\left[{N}\middle/{u}\right]=N\in\mathcal{C}$. Hence, all candidates would need to be equal, but we know that there exist at least two different candidates: $\mathcal{S}\mathcal{N}$ and the set of all variables.

Some other immediate results about reducibility candidates, whose proof is standard, follow.

Lemma C.9**.**

**

1. (1)

$\mathcal{S}\mathcal{N}\in\mathcal{C}\mathcal{R}$** 2. (2)

for all $\mathcal{C}\in\mathcal{C}\mathcal{R}$ and $s\in\mathcal{N}\mathcal{T}$ in normal form, $s\in\mathcal{C}$ 3. (3)

in particular, for all reducibility candidates $\mathcal{C}$ and all variables $x$, $x\in\mathcal{C}$.

Proof of Lemma 3.7

[TABLE]

We prove that $\mathsf{Red}_{\tau}$ satisfies the CR conditions by structural induction on $\tau$. We only consider the $\mathsf{Red}_{\Box\tau}$ case and invite the interested reader to see [14] for atomic and function types.

**CR1: **

given $s\in\mathsf{Red}_{\Box\tau}$, we prove that $\operatorname{let}(u:=s,v)\in\mathcal{S}\mathcal{N}$, with $u\neq v$ (this follows from the definition of $\mathsf{Red}_{\Box\tau}$, taking $\mathcal{C}=\mathcal{S}\mathcal{N}$, $t=v$, and noticing that $v\left[{s^{\prime}}\middle/{u}\right]=v$ for all $s^{\prime}\in\mathsf{Red}_{\tau}$). Then $s$ is a subterm of a strongly normalizing term, thus $s\in\mathcal{S}\mathcal{N}$ as well.

**CR2: **

given $s\in\mathsf{Red}_{\Box\tau}$ and $r$ s.t. $s\mathrel{\leadsto}r$, we need to prove that $r\in\mathsf{Red}_{\Box\tau}$. By the definition of reducibility, we need to show that for all $\mathcal{C}$ and for all $t\in{{\mathcal{C}}_{u}^{\mathsf{Red}_{\tau}}}$, $\operatorname{let}(u:=r,t)\in\mathcal{C}$. Since $s\in\mathsf{Red}_{\Box\tau}$, by definition we have $\operatorname{let}(u:=s,t)\in\mathcal{C}$ and, since $\mathcal{C}\in\mathcal{C}\mathcal{R}$, we can perform a one step reduction and obtain $\operatorname{let}(u:=r,t)\in\mathcal{C}$ as needed.

**CR3: **

given $s$ neutral such that whenever $s\mathrel{\leadsto}s^{\prime}$ we have $s^{\prime}\in\mathsf{Red}_{\Box\tau}$, we need to prove that $s\in\mathsf{Red}_{\Box\tau}$: in other words, we assume $t\in{{\mathcal{C}}_{u}^{\mathsf{Red}_{\tau}}}$ for some candidate $\mathcal{C}$, and we need to prove that $\operatorname{let}(u:=s,t)\in\mathcal{C}$. Since ${{\mathcal{C}}_{u}^{\mathsf{Red}_{\tau}}}$ is a pre-candidate (Lemma C.6), by CR1 $t\in\mathcal{S}\mathcal{N}$ and we can reason by well-founded induction. We consider all possible reducts of $\operatorname{let}(u:=s,t)$:

• **•: **

$\operatorname{let}(u:=s,t)\mathrel{\leadsto}\operatorname{let}(u:=s^{\prime},t)$ with $s\mathrel{\leadsto}s^{\prime}$: we know by hypothesis that $s^{\prime}\in\mathsf{Red}_{\Box\tau}$, thus we have $\operatorname{let}(u:=s^{\prime},t)\in\mathcal{C}$ by definition of reducibility;

• **•: **

$\operatorname{let}(u:=s,t)\mathrel{\leadsto}\operatorname{let}(u:=s,t^{\prime})$ with $t\mathrel{\leadsto}t^{\prime}$: by CR2 on pre-candidates we know that $t^{\prime}\in{{\mathcal{C}}_{u}^{\mathsf{Red}_{\tau}}}$ and we obtain by the inner induction hypothesis on $t^{\prime}$ that $\operatorname{let}(u:=s,t^{\prime})\in\mathcal{C}$;

• **•: **

no other possible reduct, since $s$ is neutral.

Then by CR3 on $\mathcal{C}$, we know $\operatorname{let}(u:=s,t)\in\mathcal{C}$, as needed.

Lemma C.10**.**

$s\in\mathsf{Red}_{\tau}\Longrightarrow\mathord{!}s\in\mathsf{Red}_{\Box\tau}$**

Proof C.11**.**

To prove that $\mathord{!}s\in\mathsf{Red}_{\Box\tau}$, we need to show that for all choices of $\mathcal{C}$ and $t\in{{\mathcal{C}}_{u}^{\mathsf{Red}_{\tau}}}$, we have $\operatorname{let}(u:=\mathord{!}s,t)\in\mathcal{C}$. Since $s\in\mathsf{Red}_{\tau}$ and $t\in\mathcal{C}$, by CR1 both terms are strongly normalizing, and we can reason by well-founded induction: then we consider all reducts of $\operatorname{let}(u:=\mathord{!}s,t)$:

• •

$\operatorname{let}(u:=\mathord{!}s^{\prime},t)$* with $s\mathrel{\leadsto}s^{\prime}$: we know $s^{\prime}\in\mathsf{Red}_{\tau}$ (by CR2), then by induction hypothesis $\operatorname{let}(u:=\mathord{!}s^{\prime},t)\in\mathcal{C}$;*

• •

$\operatorname{let}(u:=\mathord{!}s,t^{\prime})$* with $t\mathrel{\leadsto}t^{\prime}$: by CR2 on pre-candidates we prove $t^{\prime}\in{{\mathcal{C}}_{u}^{\mathsf{Red}_{\tau}}}$, then by induction hypothesis $\operatorname{let}(u:=\mathord{!}s,t^{\prime})\in\mathcal{C}$;*

• •

$t\left[{s}\middle/{u}\right]$: since $s\in\mathsf{Red}_{\tau}$ and $t\in{{\mathcal{C}}_{u}^{\mathsf{Red}_{\tau}}}$, we have $t\left[{s}\middle/{u}\right]\in\mathcal{C}$.

Then we obtain $\operatorname{let}(u:=\mathord{!}s,t)\in\mathcal{C}$ by CR3.

Lemma C.12**.**

$(\forall\psi\in\operatorname{dom}(\theta),\theta(\psi)\in\mathsf{Red}_{\mathcal{T}^{\sigma}(\psi)})\Longrightarrow\iota(\theta)\in\mathsf{Red}_{\sigma}$**

Proof C.13**.**

Similarly to the previous lemma, all the terms in the codomain of $\theta$ (which form a finite tuple) are strongly normalizing, thus we can reason by well-founded induction. We thus consider all reducts of $\iota(\theta)$:

• •

$\iota(\theta^{\prime})$* where $\theta^{\prime}$ is obtained from $\theta$ by means of a one-step reduction of a single term in its codomain, keeping all the other terms the same: we easily prove that for all $\psi$, $\theta^{\prime}(\psi)\in\mathsf{Red}_{\mathcal{T}^{\sigma}(\psi)}$ (using CR2), then by induction hypothesis we have $\iota(\theta^{\prime})\in\mathsf{Red}_{\sigma}$;*

• •

$q\theta$: by an inner induction on the structure of $q$, we prove that $q\theta\in\mathsf{Red}_{\sigma}$.

We thus obtain $\iota(\theta)\in\mathsf{Red}_{\sigma}$ by CR3.

We now prove strong normalization for $\lambda^{hs}$. The theorem can be stated in a more elegant way by means of the following definition.

Definition C.14** (adapted interpretation).**

Given contexts $\Delta$ and $\Gamma$, a sequence of substitutions $\overrightarrow{\eta}=\eta_{1},\ldots,\eta_{n}$ is a $(\Delta;\Gamma)$-adapted interpretation (notation: $\overrightarrow{\eta}\vDash\Delta;\Gamma$) if and only if:

• •

$\operatorname{dom}(\overrightarrow{\eta})=\operatorname{dom}(\Delta)\cup\operatorname{dom}(\Gamma)$**

• •

for all $u\in\operatorname{dom}(\Delta)$ we have $\overrightarrow{\eta}(u)\in\mathsf{Red}_{\Delta(u)}$

• •

for all $a\in\operatorname{dom}(\Gamma)$ we have $\overrightarrow{\eta}(a)\in\mathsf{Red}_{\Gamma(a)}$.

Proof of Theorem 3.8

[TABLE]

By induction on the typing derivation. We consider the interesting cases:

• •

$s=\mathord{!}s^{\prime}$, $\tau=\Box\sigma$ and, by induction hypothesis, for all ($\Delta;\cdot$)-adapted interpretations $\overrightarrow{\eta^{\prime}}$ ($\mathord{!}$ is opaque to truth variables, so the corresponding context is empty) $s^{\prime}\overrightarrow{\eta^{\prime}}\in\mathsf{Red}_{\sigma}$. We choose $\overrightarrow{\eta^{\prime}}$ to be equal to $\overrightarrow{\eta}$ restricted to $\Delta$: then $(\mathord{!}s)\eta=\mathord{!}(s\eta^{\prime})$ and the thesis follows from the induction hypothesis and Lemma C.10.

• •

$s=\operatorname{let}(u:=R,S)$, and (by induction hypotheses), $R\eta^{\prime}\in\mathsf{Red}_{\Box\sigma}$ (for all ($\Delta;\Gamma$)-adapted $\eta^{\prime}$) and $S\eta^{\prime\prime}\in\mathsf{Red}_{\tau}$ (for all ($\Delta,u::\sigma;\Gamma$)-adapted $\eta^{\prime\prime}$), with $u$ chosen to be fresh. Since clearly $R\overrightarrow{\eta}\in\mathsf{Red}_{\Box\sigma}$, by the definition of $\mathsf{Red}_{\Box\sigma}$ it suffices to show that $S\overrightarrow{\eta}\in{{(\mathsf{Red}_{\tau})}_{u}^{\mathsf{Red}_{\sigma}}}$ to prove $\operatorname{let}(u:=R,S)\eta=\operatorname{let}(u:=R\eta,S\eta)\in\mathsf{Red}_{\tau}$. This is equivalent to proving that $S\overrightarrow{\eta}\in\mathsf{Red}_{\tau}$ and $S\overrightarrow{\eta}\left[{t}\middle/{u}\right]\in\mathsf{Red}_{\tau}$ for all $t\in\mathsf{Red}_{\sigma}$: both statements are implied by the induction hypothesis on $S$.

• •

$s=\iota(\theta)$ and (by induction hypothesis) for all $\psi$, for all ($\Delta,\cdot$)-adapted interpretations $\eta^{\prime}$ we have $\theta(\psi)\in\mathsf{Red}_{\mathcal{T}^{\tau}{\psi}}$. We choose $\eta^{\prime}$ to be the suitable restriction of $\eta$ and we obtain $\iota(\theta)\eta=\iota(\theta\eta^{\prime})\in\mathsf{Red}_{\tau}$ by Lemma C.12.

The two corollaries we are interested in follow immediately.

Corollary C.15** (strong normalization for $\lambda^{hs}$).**

If $\Delta;\Gamma\vdash_{\lambda^{hs}}s:\tau$, then $s\in\mathcal{S}\mathcal{N}$.

Proof C.16**.**

Immediately from Theorem 3.8, by replacing $\overrightarrow{\eta}$ with the identity substitution.

Corollary C.17** (strong normalization for $\lambda^{hc}$).**

If $\Delta;\Gamma\vdash_{\lambda^{hc}}M:A|s$, then $M\in\mathcal{S}\mathcal{N}$.

Proof C.18**.**

By combining Corollary C.15 with Lemma 3.1 and Lemma 3.2.