A Message-Passing Interpretation of Adjoint Logic

TL;DR

This paper introduces a novel session type system based on adjoint logic that models complex asynchronous communication behaviors like multicast, replication, and cancellation, ensuring safety and deadlock-freedom.

Contribution

It extends standard binary session types with a logical foundation, enabling uniform handling of advanced communication patterns and providing formal guarantees.

Findings

Achieves session fidelity and deadlock-freedom.

Provides a logically justified garbage collection method.

Models multicast, replication, and cancellation behaviors.

Abstract

We present a system of session types based on adjoint logic which generalize standard binary session types. Our system allows us to uniformly capture several new behaviors in the space of asynchronous message-passing communication, including multicast, where a process sends a single message to multiple clients, replicable services, which have multiple clients and replicate themselves on-demand to handle requests from those clients, and cancellation, where a process discards a channel without communicating along it. We provide session fidelity and deadlock-freedom results for this system, from which we then derive a logically justified form of garbage collection.

Tables

Table 1. Table 1 : Informal Meanings of Process Terms

Process term	Meaning
$a\leftarrow c$	Identify channels $a$ and $c$.
$S\leftarrow \left(\nu x\right)P;Q$	Spawn a new process $P$ providing channel $x$ with aliases $S$ to be used by $Q$. Here, $x$ is the internal name in $P$ for the channel offered by $P$, and $S$ is the set of external names of the same channel as used in $Q$.
$c.\ell \left(a\right)$	Send the label $\ell$ and the channel $a$ along $c$.
$\mathrm{𝖼𝖺𝗌𝖾}c{(i\left(x_{\_}i\right)\Rightarrow P_{\_}i\}}_{\_}i\in I)$	Receive a label $i$ and a channel $x_{\_}i$ from $c$, continue as $P_{\_}i$.
$c.⟨a,b⟩$	Send the channels $a$ and $b$ along $c$.
$\mathrm{𝖼𝖺𝗌𝖾}c\left(⟨x,y⟩\Rightarrow P\right)$	Receive channels $x$ and $y$ from $c$ to be used in $P$.
$c.⟨⟩$	End communication over $c$ by sending a terminal message.
$\mathrm{𝖼𝖺𝗌𝖾}c\left(⟨⟩\Rightarrow P\right)$	Wait for $c$ to be closed, continue as $P$.
$c_{\_}m.\mathrm{𝗌𝗁𝗂𝖿𝗍}\left(a_{\_}k\right)$	Send a shift, from mode $m$ to mode $k$
$\mathrm{𝖼𝖺𝗌𝖾}{c}_{\_}m\left(\mathrm{𝗌𝗁𝗂𝖿𝗍}\left(x_{\_}k\right)\Rightarrow P\right)$	Receive a shift from mode $m$ to mode $k$

Equations

$$(x^1:A^1)\cdots (x^n:A^n)⊢P::(x:A)$$

$$\Psi ⊢P::(x_{\_}m:A_{\_}m)\text{mbox}requires\Psi \ge m$$

$$\begin{array}[]{lcl}A_{\_}m,B_{\_}m&\Coloneqq&p_{\_}m\mid A_{\_}m\multimap_{\_}mB_{\_}m\mid A_{\_}m\otimes_{\_}mB_{\_}m\mid\mathbf{1}_{\_}m\mid\mathop{\oplus_{\_}m}\limits_{\_}{i\in I}A_{\_}m^{i}\mid\mathop{\mathbin{\binampersand}_{\_}m}\limits_{\_}{i\in I}A_{\_}m^{i}\mid{\uparrow}_{\_}k^{m}A_{\_}k\mid{\downarrow}_{\_}m^{\ell}A_{\_}\ell\end{array}$$

$$\begin{array}[]{lcl}\mathcal{C}&\Coloneqq&\mathsf{proc}(S,\Delta,a,P)\mid(\cdot)\mid\mathcal{C}\ \mathcal{C}^{\prime}\end{array}$$

$$|S|\sim m$$

$$\Psi {\models }^{\prime }(\cdot )::\Psi$$

$$\cdot \models \mathsf{proc}(\{c_{\_}0\},\cdot ,c,P_{\_}0)::(c_{\_}0:1)\cdot \models \mathsf{proc}(\{c_{\_}0\},\cdot ,c,c.⟨⟩)::(c_{\_}0:1)$$

$$\Psi\vdash A_{\_}k\quad\mbox{where $\Psi\geq k$}$$

$$\begin{array}[]{lcl}A_{\_}m,B_{\_}m&\Coloneqq&p_{\_}m\mid A_{\_}m\multimap_{\_}mB_{\_}m\mid A_{\_}m\otimes_{\_}mB_{\_}m\mid\mathbf{1}_{\_}m\mid\mathop{\oplus_{\_}m}\limits_{\_}{i\in I}A_{\_}m^{i}\mid\mathop{\mathbin{\binampersand}_{\_}m}\limits_{\_}{i\in I}A_{\_}m^{i}\mid{\uparrow}_{\_}k^{m}A_{\_}k\mid{\downarrow}_{\_}m^{\ell}A_{\_}\ell\end{array}$$

$$\Psi \ge m\ge k$$

$$\begin{array}[b]{l}\mathsf{C}\in\sigma(m)\\ \Psi\geq m\geq k\end{array}\;\Psi\vdash A_{\_}m$$

$$\Psi \ge m\ge k$$

$$(x_{\_}1:A_{\_}{\mathsf{L}}^1)\cdots (x_{\_}n:A_{\_}{\mathsf{L}}^n)⊢(x:A_{\_}\mathsf{L})$$

$$A⊢A\oplus B$$

$$\Delta ⊢A$$

$$A⊢A$$

$$\hbox{\vbox{ \moveright 0.0pt\vbox{\halign{\relax\global\@RightOffset=0pt \@ReturnLeftOffsettrue$#$&& \inferTabSkip\global\@RightOffset=0pt \@ReturnLeftOffsetfalse$#$\cr\hbox{\vbox{ \moveright 23.48775pt\vbox{\halign{\relax\global\@RightOffset=0pt \@ReturnLeftOffsettrue$#$&& \inferTabSkip\global\@RightOffset=0pt \@ReturnLeftOffsetfalse$#$\cr\mathstrut\cr}}\nointerlineskip\kern 2.0pt\moveright 0.0pt\vbox{\hrule width=46.97551pt}\nointerlineskip\kern 2.0pt\moveright 0.0pt\hbox{$A\vdash A\oplus B$}}\kern 0.0pt\kern 5.0pt\raise 6.16556pt\hbox{${\oplus}R^{0}_{\_}1$}\kern 0.0pt}&\quad$\hbox{\vbox{ \moveright 0.0pt\vbox{\halign{\relax\global\@RightOffset=0pt \@ReturnLeftOffsettrue$#$&& \inferTabSkip\global\@RightOffset=0pt \@ReturnLeftOffsetfalse$#$\cr\vbox{ \moveright 12.12062pt\vbox{\halign{\relax\global\@RightOffset=0pt \@ReturnLeftOffsettrue$#$&& \inferTabSkip\global\@RightOffset=0pt \@ReturnLeftOffsetfalse$#$\cr\vbox{ \moveright 8.55278pt\vbox{\halign{\relax\global\@RightOffset=0pt \@ReturnLeftOffsettrue$#$&& \inferTabSkip\global\@RightOffset=0pt \@ReturnLeftOffsetfalse$#$\cr\cr}}\nointerlineskip\kern 2.0pt\moveright 0.0pt\hbox{\hbox{$Q_{\_}1$}}}\cr}}\nointerlineskip\kern 2.0pt\moveright 0.0pt\hbox{\hbox{$\Delta^{\prime},A\vdash C$}}}&\quad$\vbox{ \moveright 12.41402pt\vbox{\halign{\relax\global\@RightOffset=0pt \@ReturnLeftOffsettrue$#$&& \inferTabSkip\global\@RightOffset=0pt \@ReturnLeftOffsetfalse$#$\cr\vbox{ \moveright 8.55278pt\vbox{\halign{\relax\global\@RightOffset=0pt \@ReturnLeftOffsettrue$#$&& \inferTabSkip\global\@RightOffset=0pt \@ReturnLeftOffsetfalse$#$\cr\cr}}\nointerlineskip\kern 2.0pt\moveright 0.0pt\hbox{\hbox{$Q_{\_}2$}}}\cr}}\nointerlineskip\kern 2.0pt\moveright 0.0pt\hbox{\hbox{$\Delta^{\prime},B\vdash C$}}}\cr}}\nointerlineskip\kern 2.0pt\moveright 0.0pt\vbox{\hrule width=93.28041pt}\nointerlineskip\kern 2.0pt\moveright 15.81233pt\hbox{$\Delta^{\prime},A\oplus B\vdash C$}}\kern 0.0pt\kern 5.0pt\raise 7.38889pt\hbox{${\oplus}L$}\kern 0.0pt}\cr}}\nointerlineskip\kern 2.0pt\moveright 0.0pt\vbox{\hrule width=157.69157pt}\nointerlineskip\kern 2.0pt\moveright 58.17238pt\hbox{$\Delta^{\prime},A\vdash C$}}\kern-30.3957pt\kern 5.0pt\raise 8.5122pt\hbox{$\mathsf{cut}_{\_}{A\oplus B}$}\kern 0.0pt}\quad\Longrightarrow\quad\vbox{ \moveright 12.12062pt\vbox{\halign{\relax\global\@RightOffset=0pt \@ReturnLeftOffsettrue$#$&& \inferTabSkip\global\@RightOffset=0pt \@ReturnLeftOffsetfalse$#$\cr\vbox{ \moveright 8.55278pt\vbox{\halign{\relax\global\@RightOffset=0pt \@ReturnLeftOffsettrue$#$&& \inferTabSkip\global\@RightOffset=0pt \@ReturnLeftOffsetfalse$#$\cr\cr}}\nointerlineskip\kern 2.0pt\moveright 0.0pt\hbox{\hbox{$Q_{\_}1$}}}\cr}}\nointerlineskip\kern 2.0pt\moveright 0.0pt\hbox{\hbox{$\Delta^{\prime},A\vdash C$}}}$$

$$(x:A_{\_}m)⊢A_{\_}m$$

$$\begin{array}[]{rc}\mathsf{proc}(\{a\},\{a^{\prime}\},a,a.A(a^{\prime})),\mathsf{proc}(\{b\},\{b^{\prime}\},b,b.B(b^{\prime})),{\color[rgb]{1,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{1,0,0}\mathsf{proc}(S,\{a,b\},c,c\leftarrow\mbox{\it nor}\leftarrow a,b)}&\overset{\mathsf{call}}{\Longrightarrow}\\[5.0pt] {\color[rgb]{1,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{1,0,0}\mathsf{proc}(\{a\},\{a^{\prime}\},a,a.A(a^{\prime}))},\mathsf{proc}(\{b\},\{b^{\prime}\},b,b.B(b^{\prime})),{\color[rgb]{1,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{1,0,0}\mathsf{proc}(S,\{a,b\},c,\mathsf{case}\;a\ldots)}&\overset{{\oplus}\;C}{\Longrightarrow}\\[5.0pt] {\color[rgb]{1,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{1,0,0}\mathsf{proc}(\{b\},\{b^{\prime}\},b,b.B(b^{\prime}))},{\color[rgb]{1,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{1,0,0}\mathsf{proc}(S,\{a^{\prime},b\},c,\mathsf{case}\;b\ldots)}&\overset{{\oplus}\;C}{\Longrightarrow}\\[5.0pt] {\color[rgb]{1,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{1,0,0}\mathsf{proc}(S,\{a^{\prime},b^{\prime}\},c,z^{\prime}\leftarrow\ldots)}&\overset{\mathsf{cut}(\{z^{\prime}\})}{\Longrightarrow}\\[5.0pt] \mathsf{proc}(\{c^{\prime}\},\{a^{\prime},b^{\prime}\},z^{\prime},z^{\prime}\leftarrow\mbox{\it nor}\leftarrow a^{\prime},b^{\prime}),\mathsf{proc}(S,\{c^{\prime}\},c,c.C(c^{\prime}))\end{array}$$

Full text

1 Introduction

Binary session types [15] were designed to specify the communication behavior between two message-passing processes. But there are patterns of communication that do not fall into this category. One example is one provider of a replicable service with multiple clients. Another is a multicast, that is, a process sending one message to multiple recipients. A third one is a client that no longer wishes to use a service, a form of cancellation. In this paper we provide a uniform language and operational semantics rooted in logic that captures such patterns of asynchronous communication. It generalizes the usual binary session types by supporting multiple modes of communication. In each of these modes every channel has a unique provider (which may send or receive), and possibly multiple clients. We identify the following modes: linear (a unique client that must communicate, as with the usual binary session types), affine (a unique client that may communicate or cancel), strict (multiple clients, each of which must communicate), and unrestricted (multiple clients, each of which may or may not communicate, which captures both replicable services and multicast).

A type system that uniformly integrates all of these patterns is not obvious if we want to preserve the desirable properties of session fidelity and deadlock freedom that we obtain from binary session types. Underlying our approach is adjoint logic [25, 16, 24], which generalizes intuitionistic linear logic [13, 12] and LNL [3] by decomposing the usual exponential modality $!A$ into two adjoint modal operators and also affords individual control over the structural rules of weakening and contraction. We provide a formulation of adjoint logic in which cut reduction corresponds to asynchronous communication, and from which session fidelity and deadlock freedom derive. Moreover, our formulation uses a form of explicit structural rules embedded in a multicut, where weakening corresponds to cancellation and contraction corresponds to duplication of a message or service.

Some of these patterns have been previously addressed with varying degrees of proximity to an underlying logic. A replicable service with multiple clients can be achieved with access points [10] or persistent services of type $!A$ [5]. Cancellation can be addressed with affine types [18, 26, 20] further developed for asynchronous communication and general handling of failure [9]. Cancellation can also be handled with modalities used to label cancellable types [4]. This approach differs from ours in a few respects — first, Caires and Pérez work in a purely synchronous setting, without multicast, and second, they focus heavily on introducing nondeterminism, which we believe to be orthogonal to (our form of) cancellation. Closest to the present proposal is a polarized formulation of asynchronous communication in adjoint logic [22] which had several shortcomings that are addressed here. Specifically, the mode hierarchy was fixed to have only three modes (linear, affine, and unrestricted), and the unrestricted mode only allowed a single kind of proposition ${{\uparrow}}^{\mathchoice{\mathsf{U}}{\mathsf{U}}{\scriptscriptstyle\mathsf{U}}{\scriptscriptstyle\mathsf{U}}}_{\_}mA_{\_}m$. This meant that, for example, multicast was not representable. Also, the rules left weakening and contraction implicit, which means that there is no explicit cancellation or distributed garbage collection, which is only briefly hinted at as a possibility [14].

The Curry-Howard correspondence relates propositions to types, proofs to programs, and proof reduction to computation. Cut reductions in a pure sequent calculcus for linear logic [5, 28] naturally correspond to synchronous communication because both premises of the cut are reduced at the same time. We reformulate adjoint logic with a nonstandard sequent calculus in which noninvertible rules are presented as axioms, that is, rules with no premises. As our operational interpretation shows, an axiom can be seen as a message and cut reduction in this sequent calculus corresponds to asynchronous communication. Another unusual aspect of our sequent calculus is that we generalize cut to a sound rule of multicut [11, 19], which operationally allows one provider to connect with multiple clients. Two further consequences of this reformulation are that (a) no explicit rules are needed for weakening and contraction, and yet (b) channels and resources are tracked with sufficient precision that computation in a network of processes “leaves no garbage” (see section 4). This is the concurrent realization of the early observation by Girard and Lafont [12] that functional computation based on intuitionistic linear logic does not require a garbage collector. Cancellation [18, 9] is a natural consequence, without requiring any special mechanism, but our system goes beyond it in the sense that processes with multiple clients will also terminate once no clients are left.

We begin with a brief discussion of our type system (section 2), deferring discussion of the underlying logic to appendix A, in order to focus on the programming system. We then present an operational semantics (section 3): our first major contribution. It models a variety of asynchronous communication behaviors, uniformly generalizing previous systems. We close by briefly presenting our results on session fidelity and deadlock-freedom, along with a brief discussion of the “garbage-collection” result that follows from them (section 4).

2 Language and Typing

Our typing judgment for processes $P$ is based on intuitionistic sequents of the form

[TABLE]

where each of the $x^{i}$ are channels that $P$ uses and $x$ is a channel that $P$ provides. All of these channels must be distinct and we abbreviate the collection of antecedents as $\Psi$. The session types $A^{i}$ and $A$ specify the communication behavior that the process $P$ must follow along each of the channels.

Such sequents are standard for the intuitionistic approach to understanding binary session types (e.g., [5]) where the channels are linear in that every channel in a network of processes has exactly one provider and exactly one client. In the closely related formulation based on classical linear logic [28] all channels are on the right-hand side of the turnstile, but each linear channel still has exactly two endpoints.

We generalize this significantly by assigning to each channel an intrinsic mode $m$. Each mode $m$ is assigned a set of structural properties $\sigma(m)$ among W (for weakening) and C (for contraction). Separating $m$ from $\sigma(m)$ allows us to have multiple modes with the same set of structural properties.111 This allows us, for example, to model the modal logic S4 or lax logic (the logical origins of comonadic and monadic programming), each with two modes both satisfying weakening and contraction, as well as linear analogues of these constructions. No matter which structural properties are available for a channel, each active channel will still have exactly one provider. Beyond that, a channel $x_{\_}m$ with ${\rm W}\in\sigma(m)$ may not have any clients. Furthermore, a channel $x_{\_}m$ with ${\rm C}\in\sigma(m)$ may have multiple clients. All other properties of our system of session types for processes derive systematically from these simple principles.

The modes are organized into a preorder where $m\geq k$ requires that $\sigma(m)\supseteq\sigma(k)$, that is, $m$ must allow more structural properties than $k$. In order to guarantee session fidelity and deadlock freedom, for any sequent $\Psi\vdash P::(x_{\_}m:A_{\_}m)$ is must be the case that for every $y_{\_}k:B_{\_}k\in\Psi$ we have $k\geq m$. For example, if $m$ permits contraction and therefore $P$ may have multiple clients, then for any $y_{\_}k$ in $\Psi$, mode $k$ must also permit contraction because (intuitively) if $x_{\_}m$ is referenced multiple times then, indirectly, so is $y_{\_}k$. If $k\geq m$ then this is ensured. We express this with the presupposition that

[TABLE]

where $\Psi\geq m$ simply means $k\geq m$ for every $y_{\_}k:A_{\_}k\in\Psi$. We will only consider sequents satisfying this presupposition, so our rules, when they are used to break down a conclusion into the premises, must preserve this fundamental property which we call the declaration of independence.

In our formulation, channels $x_{\_}m$ as well as types $A_{\_}m$ are endowed with modes which must always be consistent between a channel and its type ($x_{\_}m:A_{\_}m$). We therefore often omit redundant mode annotations on channels.

The complete set of rules for the typing judgment are given in Fig. 1. We first examine the judgmental rules that explain the meaning of identity and composition. Identity (rule $\mathsf{id}$) is straightforward: a process $c\leftarrow a$ providing $c$ defers to the provider of $a$, which is possible as long as $a$ and $c$ have the same type and mode. This is usually called forwarding or identification of the channels $a$ and $c$.

The usual logical rule of cut corresponds to the parallel composition of two processes with a single private channel for communication between them. However, ordinary cut is insufficiently general to describe the situation where a single provider of a channel $x_{\_}m$ may have multiple clients ($C\in\sigma(m)$) or no clients ($W\in\sigma(m)$). We therefore generalize it to a form of multicut, 222The term ”multicut” has been used in the literature for different rules. We follow here the proof theory literature [19, Section 5.1], where it refers to a rule that cuts out some number of copies of the same proposition A, as in Gentzen’s original proof of cut elimination [11], where he calls it “Mischung”. where the channel $x_{\_}m$ provided by $P$ is known by multiple aliases in the set of channels $S$ in $Q$ as long as the multiplicity of the aliases is permitted by the mode. This is expressed as $|S|\sim m$ and is sufficient for static typing. Formally, we define this condition by $0\sim m$ if $\mathsf{W}\in\sigma(m)$, $1\sim m$ always, and $k\sim m$ for $k\geq 2$ if $\mathsf{C}\in\sigma(m)$. When processes execute we will have an even more general situation where one provider has multiple separate client processes, which is captured in the typing judgment for process configurations (section 3).

Next we come to the various session types. From the logical perspective, these are the propositions of adjoint logic.

[TABLE]

Here, $p_{\_}m$ stands for atomic propositions at mode $m$. The other connectives, other than ${\uparrow}_{\_}k^{m}$ and ${\downarrow}_{\_}m^{\ell}$, are standard linear logic connectives, except that they are only allowed to combine types (propositions) at the same mode. Since the mode of a connective can be inferred from the modes of the types it connects (other than for shifts), we omit subscripts on connectives. Note also that $\mathbin{\binampersand}$ and $\oplus$ have been generalized to $n$-ary forms from the usual binary forms. This is convenient for programming. We will use a label set $I=\{\pi_{\_}1,\pi_{\_}2\}$ when working with the binary forms $A_{\_}m\mathbin{\binampersand}B_{\_}m$ and $A_{\_}m\oplus B_{\_}m$, where $\pi_{\_}1$ selects the left-hand type and $\pi_{\_}2$ selects the right-hand type. The operational meaning of these connectives (as discussed further in section 3) is largely similar to that in past work (e.g. [5]), with $\multimap_{\_}m$ and $\otimes_{\_}m$ sending channels along other channels, $\mathbf{1}_{\_}m$ sending an end-of-communication message, and $\oplus_{\_}m$ and $\mathbin{\binampersand}_{\_}m$ sending labels. The shifts send a simple $\mathsf{shift}$ message to signal a transition between modes, either up (${\uparrow}_{\_}k^{m}$) from $k$ to some $m\geq k$ or down (${\downarrow}_{\_}m^{\ell}$) from $\ell$ to some $m\leq\ell$.

We provide proof terms for the rules in our sequent calculus, as shown in Figure 1. We can then interpret the proof terms as process expressions, and these rules are used to give the typing judgment for such processes. Table 1 gives the informal meaning of each such process term.

In general, our process syntax represents an intermediate point between a programmer-friendly syntax and a notation in which it is easy to describe the operational semantics and prove progress and preservation. When compared to, for instance, SILL [27], the main revisions are that (1) we make channel continuations explicit in order to facilitate asynchronous communication while preserving message order [8], and (2) we distinguish between an internal name for the channel provided by a process and external names connecting it to multiple clients.

Some simple examples.  We provide here some small examples with their types; additional examples which highlight more interesting behavior can be found in appendix C.

First, we have a process that can be written at any mode $m$, which witnesses that $\otimes_{\_}m$ is commutative.

[TABLE]

If $m$ is a mode that admits contraction, we can write the following process, which witnesses that $A_{\_}m\mathbin{\binampersand}B_{\_}m$ proves $A_{\_}m\otimes B_{\_}m$ in the presence of contraction. ‘$\%$’ starts a comment.

[TABLE]

If $m$ is a mode that admits weakening, we can write the following process, which witnesses that $A_{\_}m\otimes B_{\_}m$ proves $A_{\_}m\mathbin{\binampersand}B_{\_}m$ in the presence of weakening.

[TABLE]

3 Operational Semantics

In order to describe the computational behavior of process expressions, we need to first give some syntax for the computational artifacts, which are running processes $\mathsf{proc}(S,\Delta,a,P)$. Such a process executes $P$ and provides a channel $a$ while using the channels in the channel set $\Delta$. $S$ is a set of aliases for the channel $a$, which can be referred to by one or more clients. Each alias $c\in S$ is used by at most one client, but one client may use multiple such aliases. Note that as the aliases in $S$ are the only way to interact with the channel $a$ from an external process, the objects $\mathsf{proc}(S,\Delta,a,P)$ and $\mathsf{proc}(S,\Delta,b,P[b/a])$ are equivalent — changing the internal name of a process has no effect on its interactions with other processes.

A process configuration is a multiset of processes:

[TABLE]

where we require that all the aliases or names provided by the processes $\mathsf{proc}(S,\Delta,a,P)$ are distinct, i.e., given objects $\mathsf{proc}(S,\Delta_{\_}1,a,P)$ and $\mathsf{proc}(T,\Delta_{\_}2,b,Q)$ in the same process configuration, $S$ and $T$ are disjoint. We will specify the operational semantics in the form of multiset rewriting rules [7]. That means we show how to rewrite some subset of the configuration while leaving the remainder untouched. This form provides some assurance of the locality of the rules.

It simplifies the description of the operational semantics if for any process $\mathsf{proc}(S,\Delta,a,P)$, $\Delta$ consists of exactly the free channels (other than $a$) in $P$. This requires that we restrict the labeled internal and external choices, $\mathop{\oplus}\limits_{\_}{i\in I}A^{i}_{\_}m$ and $\mathop{\mathbin{\binampersand}}\limits_{\_}{i\in I}A^{i}_{\_}m$ to the case where $I\neq\emptyset$. Since a channel of empty choice type can never carry any messages, this is not a significant restriction in practice.

In order to understand the rules of the operational semantics, it will be helpful to understand the typing of configurations. The judgment has the form $\Psi\vDash\mathcal{C}::\Psi^{\prime}$ which expresses that using the channels in $\Psi$, configuration $\mathcal{C}$ provides the channels in $\Psi^{\prime}$. This allows a channel that is not mentioned at all in $\mathcal{C}$ to appear in both $\Psi$ and $\Psi^{\prime}$—we think of such a channel as being “passed through” the configuration.

Note that while the configuration typing rules induce an ordering on a configuration, the configuration itself is not inherently ordered. The key rule is the first: for any object $\mathsf{proc}(S,\Delta,a,P)$ we require that $P$ is well-typed on some subset of the available channels while the others are passed through. Here we write $\overline{\Psi}$ for the set of channels declared in $\Psi$, which must be exactly those used in the typing of $P$. Moreover, externally such a process provides the channels $S=\{a^{1}_{\_}m,\ldots,a^{n}_{\_}m\}$, all of the same type $A_{\_}m$. We use the abbreviation $(S:A_{\_}m)$ for $a^{1}_{\_}m:A_{\_}m,\ldots,a^{n}_{\_}m:A_{\_}m$. Finally, we enforce that the number of clients must be compatible with the mode $m$ of the offered channel, which is exactly that $|S|\sim m$, as defined in section 2.

[TABLE]

The identity and composition rules are straightforward. The empty context $(\cdot)$ provides $\Psi$ if given $\Psi$, since it does not use any channels in $\Psi$ or provide any additional channels. Composition just connects configurations with compatible interfaces: what is provided by $\mathcal{C}$ is used by $\mathcal{C}^{\prime}$.

The computation rules we discuss in this section can be found in Figure 2. Remarkably, the computation rules do not depend on the modes, although some of the rules will naturally only apply at modes satisfying certain structural properties.

Judgmental rules.  The identity rule (written as $\overset{\mathsf{id}}{\Longrightarrow}$) describes how an identity process (for instance, ${\mathsf{proc}(S,\{c\},a,a\leftarrow c)}$) may interact with other processes. We think of such a process as connecting the provider of $c$ to clients in $S$, and therefore sometimes call it a forwarding process. A forwarding process interacts with the provider of $c$, telling it to replace $c$ with $S$ in its set of clients. In adding $S$ to the set of clients, the forwarding process accomplishes its goal of connecting the provider of $c$ to $S$, and so it can terminate.

The cut rule steps by spawning a new process which offers along a fresh set of channels $S^{\prime}$, all of which are used in $Q$, the continuation of the original process. Here we write $\Delta_{\_}P$ and $\Delta_{\_}Q$ for the set of free channels in $P$ and $Q$, respectively.

Structural rules.  A process with no clients can terminate (rule $\overset{\mathsf{drop}}{\Longrightarrow}$), but must notify all of the processes it uses that they should also terminate. It does so by sending each one a forwarding message, effectively embodying a cancellation. In concert with the identity rule this accomplishes cascading cancellation in the distributed setting. Note that the mode $m$ of channel $a$ must admit weakening in order for the process on the left-hand side of the rule to be well-typed.

Similarly, a process with multiple clients can spawn a copy of itself, each with a strictly smaller set of clients (rule $\overset{\mathsf{copy}}{\Longrightarrow}$). If the process $P$ is a replicable service, that is, if it has a negative type $\mathbin{\binampersand}$, $\multimap$, ${{\uparrow}}^{m}_{\_}k$, then this corresponds to actual process replication. If it has a positive type $\oplus$, $\otimes$, $\mathbf{1}$, ${{\downarrow}}^{m}_{\_}k$, this corresponds to duplicating a multicast message into copies for different subsets of recipients. The mode $m$ of the channel $a$ must admit contraction in order for the process on the left-hand side of the rule to be well-typed.

While both the $\mathsf{drop}$ and $\mathsf{copy}$ rules can be applied to any process with [math] or multiple clients, respectively, this does not cause any problems as long as we forbid them from executing on identity processes. If we apply drop or copy to an identity process, we end up with another process of the same form on the right-hand side of the rule, and so we could repeatedly apply drop or copy and not make any progress. As such, we forbid this use of the drop and copy rules.

For any other type of process, regardless of whether we drop/copy first or execute another communication rule first, we can eventually reach the same state, and so we do not need to make additional restrictions (though an actual implementation would likely pick either a maximally eager or a maximally lazy strategy for applying these rules).

Additive and multiplicative connectives.  In the rule for $\oplus$, the process $\mathsf{proc}(\{b\},\{c\},a,a.\ell(c))$ represents the message ‘label $\ell$ with continuation $c$’. After this message has been received, the process terminates since $b$ was its only client. The recipient selects the appropriate branch of the $\mathsf{case}$ construct and also substitutes the continuation channel $c$ for the continuation variable $d_{\_}\ell$.

The $\mathbin{\binampersand}$ computation rule is largely similar to that for $\oplus$, except that communication proceeds in the opposite direction—messages are sent to providers from clients, rather than from providers to clients as in the case of $\oplus$.

The multiplicative connectives $\otimes$ and $\multimap$ behave similarly to their additive counterparts, except that rather than sending and receiving labels, they send and receive channels together with a continuation, and so an extra substitution is required when receiving messages, while the $\mathbf{1}$ behaves as a nullary $\otimes$, allowing us to signal that no more communication is forthcoming along a channel, and to wait for such a signal before continuing to compute.

Shifts.  We present the computation rules for shifts with modes marked explicitly on the relevant channels. Channels whose modes are unmarked may be at any mode (provided, of course, that the declaration of independence is respected).

Operationally, $\mathord{\uparrow}$ behaves essentially the same as unary $\mathbin{\binampersand}$, while $\mathord{\downarrow}$ behaves as unary $\oplus$. Their significance lies in the mode shift of the continuation channel that is transmitted, which is required for the configuration to remain well-typed.

The messages $\mathsf{shift}(a_{\_}k)$ or $\mathsf{shift}(c_{\_}m)$ should be thought of as signaling a transition between modes — to mode $k$ for the former, and to mode $m$ for the latter. Whether the transition is up or down depends on which direction the message is being sent in. As with other messages (in particular, the messages for $\oplus$ and $\mathbin{\binampersand}$), the continuation channels are made explicit.

4 Session Fidelity, Deadlock-Freedom, and Garbage Collection

While we can prove cut elimination for the form of adjoint logic presented in appendix A, from a programmer’s perspective we are not interested in eliminating all cuts (which would correspond to reducing under $\lambda$-abstractions in a functional language) but rather we block when waiting to receive a message, analogous to a $\lambda$-abstraction waiting for input before it can reduce. What we prove instead are session fidelity and deadlock-freedom.

Session fidelity.  The session fidelity theorem follows from a case analysis on the computation rule used to get that $\mathcal{C}\Rightarrow\mathcal{C}^{\prime}$. In each case, we break $\mathcal{C}$ down to find the processes on which the computation rule acts, along with some collections of processes which are unaffected by the computation. From these pieces, we build a proof that $\Psi\vDash\mathcal{C}^{\prime}::\Psi^{\prime}$.

Theorem 1** (Session Fidelity).**

If $\Psi\vDash\mathcal{C}::\Psi^{\prime}$ and $\mathcal{C}\Rightarrow\mathcal{C}^{\prime}$, then $\Psi\vDash\mathcal{C}^{\prime}::\Psi^{\prime}$.

Deadlock-freedom.  The progress theorem for a functional language states that an expression is either a value or it can take a step. Here we do not have values, but there is nevertheless a clear analogue between, say, a value $\lambda x.e$ that waits for an argument, and a process $\mathsf{case}\;x\,(\langle y,z\rangle\Rightarrow P)$ that waits for an input. We formalize this in the definition below.

Definition 1**.**

We say that a process $\mathsf{proc}(S,\Delta,a,P)$ is poised on $a$ if:

it is a process $\mathsf{proc}(S,\Delta,a,P)$ that sends on $a$ — that is, $P$ is of the form $(a.\mbox{\tt\char 95\relax})$, or 2. 2.

it is a process $\mathsf{proc}(S,\Delta,a,P)$ that receives on $a$ — that is, $P$ is of the form $(\mathsf{case}\;a\;(\mbox{\tt\char 95\relax}))$.

Intuitively, $\mathsf{proc}(S,\Delta,a,P)$ is poised on $a$ if it is blocked trying to communicate along $a$. This definition allows us to state the following progress theorem:

Theorem 2** (Deadlock-Freedom).**

If $(\cdot)\vDash\mathcal{C}::\Psi$, then exactly one of the following holds:

There is a $\mathcal{C}^{\prime}$ such that $\mathcal{C}\Rightarrow\mathcal{C}^{\prime}$. 2. 2.

Every $\mathsf{proc}(S,\Delta,a,P)$ in $\mathcal{C}$ is poised on $a$.

In order to prove this theorem, we first prove a lemma allowing us to take advantage of the ordering induced by configuration typing. We note that if object $\psi$ is a client of object $\phi$, $\psi$ must occur to the right of $\phi$ in the ordering, and so if we can analyze a configuration from right to left, we consider each process before (or after, depending on your view of induction) all of its dependencies. To formalize this, we present a second set of rules defining another form of configuration typing (which will turn out to prove the same judgments as the original form).

[TABLE]

It is clear that if $\vDash$ and $\vDash^{\prime}$ are the same, then we can perform induction using the $\mathsf{Empty}$ and $\mathsf{Extend}$ rules rather than the $\mathsf{Id}$, $\mathsf{Comp}$, and $\mathsf{Proc}$ rules, allowing us to analyze a configuration from right to left. We formalize this as lemma 1.

Lemma 1**.**

$\Psi\vDash\mathcal{C}::\Psi^{\prime}$* if and only if $\Psi\vDash^{\prime}\mathcal{C}::\Psi^{\prime}$.*

This lemma is nearly immediate — all of the rules for $\vDash^{\prime}$ are derivable from the rules of $\vDash$, and all rules of $\vDash$ but $\mathsf{Comp}$ are derivable from the rules of $\vDash^{\prime}$. We therefore need only show (by an induction over the right-hand premise) that the version of the $\mathsf{Comp}$ rule with $\vDash$ replaced by $\vDash^{\prime}$ is admissible.

The proof of deadlock-freedom then proceeds by an induction on the derivation of $(\cdot)\vDash\mathcal{C}::\Psi$, using lemma 1 to work right to left. Writing $\mathcal{C}=\mathcal{C}^{\prime}\;\mathsf{proc}(S,\overline{\Psi^{\prime}},a.P)$, we see that either $\mathcal{C}^{\prime}$ can step, in which case so can $\mathcal{C}$, or every process in $\mathcal{C}^{\prime}$ is poised. Now we carefully distinguish cases on $S$ (empty, singleton, or greater) and apply inversion to the typing of $P$ to see that in each case the process either is poised, can take a step independently, or can interact with provider of a channel in $\overline{\Psi^{\prime}}$.

Garbage collection.  As we can see from the preservation theorem, the interface to a configuration never changes. While new processes may be spawned, they will have clients and are therefore not visible at the interface. This is in contrast to the semantics of shared channels in prior work (for example, in [5, 22]) where shared channels may show up as newly provided channels. Therefore they may be left over at the end of a computation without any clients.

This cannot happen here. Initially, at the top level, we envision starting with the configuration below on the left. Assuming this computation completes, by the progress property and the definition of poised, computation could only halt with the configuration on the right. In other words: no garbage!

[TABLE]

One can generalize this to allow nontrivial output by allowing any purely positive type (that is, one which only uses the fragment of the logic with connectives $\oplus$, $\otimes$, $\mathbf{1}$, and $\mathord{\downarrow}$), such as $\oplus\{\mathsf{false}:\mathbf{1},\mathsf{true}:\mathbf{1}\}$.

We can formalize this intuition by defining an observable configuration $\mathcal{C}$ which corresponds to our intuitive notion of garbage-free. We only define what it means for a configuration with purely positive type to be observable. It is likely that this definition can be extended to encompass negative types as well, but it is not nearly as natural to do so.

A configuration $\mathcal{C}$ for which there is $\Psi$ composed entirely of purely positive types such that $\cdot\vDash\mathcal{C}::\Psi$ is observable at $\Psi$ if, when we repeatedly receive messages from all channels we know about, starting from a state where we only know about $\Psi$, we eventually receive a message from every object in $\mathcal{C}$. If we do not care about the particular channels in $\Psi$, we may say simply that $\mathcal{C}$ is observable.

Definition 2**.**

We define what it means for a configuration $\mathcal{C}$ to be observable at $\Psi$ (written $\mathcal{C}\rhd\Psi$) inductively over the structure of $\mathcal{C}$.

$\mathsf{proc}(\{c\},\cdot,x,x.\langle\rangle)\rhd(c:\mathbf{1})$. 2. 2.

If $\mathcal{C}\rhd\Psi\;(d:A_{\_}m^{\ell})$, then $\mathcal{C}\;\mathsf{proc}(\{c\},\{d\},x,x.\ell(d))\rhd\Psi\;(c:\mathop{\oplus}\limits_{\_}{i\in I}A_{\_}m^{i})$. 3. 3.

If $\mathcal{C}\rhd\Psi\;(d:A_{\_}m)$, then $\mathcal{C}\;\mathsf{proc}(\{c\},\{d\},x,x.\mathsf{shift}(d))\rhd\Psi\;(c:{\downarrow}_{\_}k^{m}A_{\_}m)$. 4. 4.

If $\mathcal{C}\rhd\Psi\;(d:A_{\_}m)\;(e:B_{\_}m)$, then $\mathcal{C}\;\mathsf{proc}(\{c\},\{d,e\},x,x.\langle d,e\rangle)\rhd\Psi\;(c:A_{\_}m\otimes B_{\_}m)$.

We can then give the following corollary of our deadlock-freedom theorem:

Corollary 1**.**

If $\cdot\vDash\mathcal{C}::\Psi$ for some $\Psi$ consisting entirely of purely positive types and $\mathcal{C}$ cannot take any steps, then $\mathcal{C}\rhd\Psi$.

This proof proceeds by a simple induction on the derivation of $\cdot\vDash\mathcal{C}::\Psi$, using (Lemma 1) to work from right to left. At each step, we note that the rightmost process is poised. Because $\Psi$ consists only of purely positive types, the rightmost process must therefore be sending a positive message. Moreover, it can only use channels of purely positive type. Well-typedness of the configuration then lets us apply the inductive hypothesis to the remainder of the configuration, at which point we can simply apply the definition of observability.

5 Conclusion

At this point, our formulation of adjoint logic and its operational semantics seem to provide a good explanation for a variety of patterns of asynchronous communication. The key behaviors which we can model (and importantly, model in a uniform fashion) are cancellation, replication, and multicast. We also obtain a foundation for a system of distributed garbage collection. Moreover, if used linearly, our semantics coincides with the purely linear semantics developed in prior work.

In parallel work we have also provided a shared memory semantics for a closely related formulation of adjoint logic with implicit structural rules [23]. In future work, we plan to investigate if the declaration of independence is sufficient to allow a modular combination of different operational interpretations for different modes. Of particular interest here would be the semantics with manifest sharing [2].

Acknowledgments

Supported by NSF Grant No. CCF-1718267: “Enriching Session Types for Practical Concurrent Programming”

Appendix A Adjoint Logic

We present here a brief overview of the formulation of adjoint logic that we take as a basis for the semantics presented in the main body of the paper. Adjoint logic can be thought of as a schema to define particular logics. The schema is parameterized by a set of modes of truth $m$, where each proposition and logical connective is indexed by its mode. Furthermore, each mode intrinsically carries a set of structural properties $\sigma(m)\subseteq\{\mathsf{W},\mathsf{C}\}$ where $\mathsf{W}$ stands for weakening and $\mathsf{C}$ stands for contraction. As a concession to simplicity of the presentation, in this paper we always allow exchange, although nothing stands in the way of an even more general framework [21]. In addition, an instance requires a preorder between modes, where $m\geq k$ expresses that the proof of a proposition of mode $k$ may depend on a hypotheses of mode $m$. This preorder embodies the declaration of independence:

A proof of $A_{\_}k$ may only depend on hypotheses $B_{\_}m$ for $m\geq k$.

The form of a sequent is

[TABLE]

where $\Psi$ is a collection of antecedents of the form $(x_{\_}i:B^{i}_{\_}{m_{\_}i})$ with each $m_{\_}i\geq k$, where all the variables $x_{\_}i$ are distinct. This critical presupposition is abbreviated as $\Psi\geq k$. Furthermore, the order of the antecedents does not matter since we always allow exchange.

In addition, we require the preorder between modes to be compatible with their structural properties: that is, $m\geq k$ implies $\sigma(m)\supseteq\sigma(k)$. This is necessary to guarantee cut elimination.

Finally, we may define fragments by restricting the set of propositions we consider for a given mode.

The propositions at each mode are constructed uniformly, remaining within the same mode, except for the shift operators that move between modes. They are ${\uparrow}_{\_}k^{m}A_{\_}k$ (pronounced up), which is a proposition at mode $m$ and requires $m\geq k$; and ${\downarrow}^{\ell}_{\_}mA_{\_}\ell$ (down), which is also a proposition at mode $m$, and which requires $\ell\geq m$.

At this point we can already write out the syntax of propositions.

[TABLE]

Here $p_{\_}m$ stands for atomic propositions at mode $m$. Due to the needs of our operational interpretation, we generalize internal and external choice to $n$-ary constructors parameterized by an index set $I$. So we write $A_{\_}m^{1}\oplus A_{\_}m^{2}=\mathop{\oplus}\limits_{\_}{i\in\{1,2\}}A_{\_}m^{i}$.

Remarkably, the right and left rules in the sequent calculus defining the logical connectives are the same for each mode and are complemented by the permissible structural rules.

A.1 Judgmental and structural rules

The rules for adjoint logic can be found in fig. 3, in which we give a more standard presentation of the logic than that used by the operational semantics (fig. 1). We begin with the judgmental rules of identity and cut, which express the connection between antecedents and succedents. Identity says that if we assume $A_{\_}m$ we are allowed to conclude $A_{\_}m$. Cut says the opposite: if we can conclude $A_{\_}m$ we are allowed to assume $A_{\_}m$ as long as the declaration of independence is respected.

As is common for the sequent calculus, we read the rules in the direction of bottom-up proof construction. For the cut rule, this means we should assume that the conclusion $\Psi\ \Psi^{\prime}\vdash C_{\_}k$ is well-formed and, in particular, that $\Psi\geq k$ and $\Psi^{\prime}\geq k$. Therefore, if we check that $m\geq k$, then we know that the second premise, $(x:A_{\_}m)\ \Psi^{\prime}\vdash C_{\_}k$, will also be well-formed. For the first premise to be well-formed, we need to check outright that $\Psi\geq m$.

The structural rules of weakening and contraction just need to verify that the mode of the principal formula permits the rule.

A.2 Additive and multiplicative connectives

The logical rules defining the additive and multiplicative connectives are simply the linear rules for all modes, since we have separated out the structural rules. Except in one case, ${\multimap}L$, the well-formedness of the conclusion implies the well-formedness of all premises.

As for ${\multimap}L$, we know from the well-formedness of the conclusion that $\Psi\geq k$, $\Psi^{\prime}\geq k$, and $m\geq k$. These facts by themselves already imply the well-formedness of the second premise, but we need to check that $\Psi^{\prime}\geq m$ in order for the first premise to be well-formed.

A.3 Shifts

The shifts represent the most interesting aspects of the rules. Recall that in ${\uparrow}^{m}_{\_}kA_{\_}k$ and ${\downarrow}^{m}_{\_}kA_{\_}m$ we require that $m\geq k$. We first consider the two rules for ${\uparrow}$. We know from the conclusion of the right rule that $\Psi\geq m$ and from the requirement of the shift that $m\geq k$. Therefore, as $\geq$ is transitive, $\Psi\geq k$ and the premise is always well-formed. This also means (although we do not prove it here) that this rule is invertible.

From the conclusion of the left rule, we know $\Psi\geq\ell$, $m\geq\ell$, and $m\geq k$. This does not imply that $k\geq\ell$, which we need for the premise to be well-formed and thus needs to be checked. Therefore, this rule is non-invertible.

The downshift rules are constructed analogously, taking only the declaration of independence and properties of the preorder $\leq$ as guidance. Note that in this case the left rule is always applicable (that is, invertible), while the right rule is non-invertible.

A.4 Multicut

Because we have an explicit rule of contraction, cut elimination does not follow by a simple structural induction. However, we can follow Gentzen [11] and allow multiple copies of the same proposition to be removed by the cut, which then allows a structural induction argument. In anticipation of the operational interpretation, we have labeled our antecedents with unique variables, so the generalized form of cut called multicut (see, for example, [19]) can remove $n\geq 0$ copies. Of course, such cuts are only legal if the propositions that are removed satisfy the necessary structural rules. For $n=0$, we require that the mode $m$ support weakening.

[TABLE]

For $n=1$, we obtain the usual cut rule and no special requirements are needed.

[TABLE]

For $n\geq 2$, the mode of the cut formula must admit contraction.

[TABLE]

Here, we have used the abbreviation $(\{x_{\_}1,\dotsc,x_{\_}n\}:A_{\_}m)$ to stand for $(x_{\_}1:A_{\_}m)\ldots(x_{\_}n:A_{\_}m)$.

Note that each of these rules has a side condition that can be interpreted informally as stating that the number of antecedents cut must be compatible with the mode $m$: if there are no antecedents removed, $m$ must admit weakening, and if we remove two or more, $m$ must admit contraction. This is exactly $|S|\sim m$ as defined in section 2.

This allows us to write down a single rule encompassing all three of the above cases for multicut:

[TABLE]

Note that the standard cut rule is the instance of the multicut rule where $|S|=1$, and so proving multicut elimination for adjoint logic also yields cut elimination for the standard cut rule.

A.5 Identity Expansion and Cut Elimination

We present standard identity expansion and cut elimination results as evidence for the correctness of the sequent calculus as capturing the meaning of the logical connectives via their inference rules. Cut-free proofs will always decompose propositions when read from conclusion to premise and thus yield a conservative extension result. Finally, the fine detail of the proof is significant because the cut reductions, which constitute the essence of the proof, are the basis for the operational semantics.

Theorem 3** (Identity Expansion).**

If $\Psi\vdash A_{\_}m$, then there exists a proof that $\Psi\vdash A_{\_}m$ using identity rules only at atomic propositions, which is cut-free if the original proof is.

Proof.

We begin by proving that for any formula $A_{\_}m$, there is a cut-free proof that $(x:A_{\_}m)\vdash A_{\_}m$ using identity rules only at atomic propositions. This follows easily from an induction on $A_{\_}m$.

Now, we arrive at the theorem by induction over the structure of the given proof that $\Psi\vdash A_{\_}m$. ∎

Theorem 4** (Cut Elimination).**

If $\Psi\vdash A_{\_}m$, then there is a cut-free proof of $\Psi\vdash A_{\_}m$.

Proof.

This proof follows the structure of many cut-elimination results. First we prove admissibility of multicut in the cut-free system. This is established by a straightforward nested induction, first on the proposition $A_{\_}m$ and then simultaneously on the structure of the deductions $\mathcal{D}$ and $\mathcal{E}$. This is followed by a simple structural induction to prove cut elimination, using the admissibility of (multi)cut when it is encountered. If we ignore the modes, this proof is very similar to the original proof of Gentzen [11]. ∎

Corollary 2**.**

Adjoint logic is a conservative extension of each of the logics at a fixed mode. That is, if $\Psi\vdash A_{\_}m$ is a sequent purely at mode $m$ (in that every type in $\Psi$ is at mode $m$ and neither $A_{\_}m$ nor the types in $\Psi$ make use of shifts), then $\Psi\vdash A_{\_}m$ is provable using the rules of adjoint logic iff it is provable using the rules which define the logic at mode $m$.

A.6 Adjunction properties

As yet, we have not discussed the meaning of the name “adjoint logic”. This can be justified by showing that for fixed $k\leq m$, $\mathord{\downarrow}_{\_}k^{m}$ and $\mathord{\uparrow}_{\_}k^{m}$ yield an adjoint pair of functors $\mathord{\downarrow}_{\_}k^{m}\dashv\mathord{\uparrow}_{\_}k^{m}$. Since prior results (see [3] and [17]) already establish this property and we have little new to contribute here, we omit the details here.

Appendix B Asynchronous Adjoint Logic

As has been observed before, intuitionistic and classical linear logics can be put into a Curry–Howard correspondence with session-typed communicating processes [5, 28, 6]. A linear logical proposition corresponds to a session type, and a sequent proof to a process expression. The transition rules of the operational semantics derive from the cut reductions.

Under the intuitionistic interpretation a sequent proof333for now on the linear fragment, and also labeling the succedent with a fresh variable of

[TABLE]

corresponds to a process $P$ that provides channel $x$ and uses channels $x_{\_}i$. The types of the channels prescribe the pattern of communication: in the succedent, positive types (${\oplus},{\otimes},{\mathbf{1}}$) will send and negative types (${\mathbin{\binampersand}},{\multimap}$) will receive. In the antecedent, the roles are reversed. Cut corresponds to parallel composition of two processes, with a private channel between them, while identity simply equates two channels.

B.1 Enforcing Asynchronous Communication

Under this interpretation, a cut of a right rule against a matching left rule allows computation to proceed by mimicking the cut reduction from the proof of Theorem 4. For example, a cut at type $\mathop{\oplus}\limits_{\_}{i\in I}A_{\_}{\mathchoice{\mathsf{L}}{\mathsf{L}}{\scriptscriptstyle\mathsf{L}}{\scriptscriptstyle\mathsf{L}}}^{i}$ is replaced by a cut at type $A_{\_}{\mathchoice{\mathsf{L}}{\mathsf{L}}{\scriptscriptstyle\mathsf{L}}{\scriptscriptstyle\mathsf{L}}}^{\ell}$ for some $\ell\in I$. This corresponds to passing a message (‘$\ell$’) from the process providing $x:\mathop{\oplus}\limits_{\_}{i\in I}A_{\_}{\mathchoice{\mathsf{L}}{\mathsf{L}}{\scriptscriptstyle\mathsf{L}}{\scriptscriptstyle\mathsf{L}}}^{i}$ to the process using $x$. By its very nature, this form of cut reduction is synchronous: both provider and client proceed simultaneously because the channel $x:A_{\_}\ell$ connects the two process continuations.

For realistic languages, and also for the paradigm to smoothly extend to the case of adjoint logic where some modes permit weakening and contraction, we would like to prescribe asynchronous communication instead.

We observe that the asynchronous $\pi$-calculus replaces the usual action prefix for output $x\langle y\rangle.P$ by a process expression $x\langle y\rangle$ without a continuation, thereby ensuring that communication is asynchronous. Such a process represents the message $y$ sent along channel $x$. Under our interpretation, the continuation process corresponds to the proof of the premise of a rule. Therefore, if we can restructure the sequent calculus so that the rules that send (${\oplus}R$, ${\mathbf{1}}R$, ${\otimes}R$, ${{\downarrow}}R$, ${\mathbin{\binampersand}}L$, ${\multimap}L$, ${{\uparrow}}L$) have zero premises, then we may achieve a similar effect.

As an example, we consider the two right rules for ${\oplus}$. Reformulated as axioms, they become

[TABLE]

In the presence of cut, these two rules together produce the same theorems as the usual two right rules. In one direction, we use cut

[TABLE]

and in the other direction we use identity

[TABLE]

to derive the other rules.

Returning to the $\pi$-calculus, instead of explicitly sending a message $a\langle b\rangle.\,P$ we spawn a new process in parallel $a\langle b\rangle\mid P$. This use of parallel composition corresponds to a cut; receiving a message is achieved by cut reduction:

[TABLE]

We see the cut reduction completely eliminates the cut in one step, which corresponds precisely to receiving a message. In this example the message would be $\pi_{\_}1$ since the axiom ${\oplus}R^{0}_{\_}1$ was used; for ${\oplus}R^{0}_{\_}2$ it would be $\pi_{\_}2$.

In summary, if we restructure the sequent calculus so that the non-invertible rules (those that send) have zero premises, then (1) messages are proofs of axioms, (2) message sends are modeled by cut, and (3) message receives are a new form of cut reduction with a single continuation.

In the process we give something up, namely the traditional cut elimination theorem. For example, the sequent $\cdot\vdash\mathbf{1}\oplus\mathbf{1}$ has no cut-free proof since no rule matches this conclusion. The saving grace is that we can reach a normal form where each cut just simulates the usual rules of the sequent calculus. This can be shown by translation to the ordinary sequent calculus, applying cut elimination, and translating the result back. Proofs in this normal form have the subformula property. Perhaps more importantly, we have session fidelity and deadlock freedom (section 4) for the corresponding process calculus even in the presence of recursive types and processes, which is ultimately what we care about for the resulting concurrent programming language.

B.2 Eliminating Weakening and Contraction

We have introduced multicut entirely with the standard motivation of providing a simple proof of the admissibility of cut using structural induction. Surprisingly, we can streamline the system further by using multicut to eliminate weakening and contraction from the logic altogether, as in the system we use as the basis for our typing rules (fig. 1).

Consider a mode $m$ with $\mathsf{C}\in\sigma(m)$. Then contraction is a simple instance of multicut with an instance of the identity rule.

[TABLE]

Similarly, for a mode $m$ with $\mathsf{W}\in\sigma(m)$, weakening is also an instance of multicut.

[TABLE]

Cut reductions in the presence of contraction entail many residual contractions, as is evident already from Gentzen’s original proof. Under our interpretation of contraction above, these residual contractions simply become multicuts with the identity. The operational interpretation of identities then plays three related roles: with one client, an identity achieves a renaming, redirecting communication; with two or more clients, an identity implements copying; with zero clients, its effect is cancellation or garbage collection. The central role of identities can be seen in full detail in Figure 2, once we have introduced our notation for processes and process configurations.

Appendix C Program Examples

In the examples that follow, we will work with two modes, ${\mathchoice{\mathsf{L}}{\mathsf{L}}{\scriptscriptstyle\mathsf{L}}{\scriptscriptstyle\mathsf{L}}}$ and ${\mathchoice{\mathsf{U}}{\mathsf{U}}{\scriptscriptstyle\mathsf{U}}{\scriptscriptstyle\mathsf{U}}}$, with ${\mathchoice{\mathsf{L}}{\mathsf{L}}{\scriptscriptstyle\mathsf{L}}{\scriptscriptstyle\mathsf{L}}}<{\mathchoice{\mathsf{U}}{\mathsf{U}}{\scriptscriptstyle\mathsf{U}}{\scriptscriptstyle\mathsf{U}}}$, $\sigma({\mathchoice{\mathsf{L}}{\mathsf{L}}{\scriptscriptstyle\mathsf{L}}{\scriptscriptstyle\mathsf{L}}})=\emptyset$, and $\sigma({\mathchoice{\mathsf{U}}{\mathsf{U}}{\scriptscriptstyle\mathsf{U}}{\scriptscriptstyle\mathsf{U}}})~{}=~{}\{W,C\}$. In these examples we also use recursively defined types and processes without formally defining these constructs, since they are well-known from the literature and orthogonal to our concerns (see, for example, [27]).

C.1 Example: Circuits

We call channels $c_{\_}{\mathchoice{\mathsf{U}}{\mathsf{U}}{\scriptscriptstyle\mathsf{U}}{\scriptscriptstyle\mathsf{U}}}$ that are subject to weakening and contraction shared channels. As an example that requires shared channels we use circuits. We start by programming a nor gate that processes infinite streams of zeros and ones.

[TABLE]

This is somewhat verbose, but note that all channels here are shared. For this particular gate they could also be linear because they are neither reused nor canceled. This illustrates that programming can be uniform at different modes, which is a significant advantage of our system over systems of session types based on linear logic with an exponential ${!}A$. Our implementation of nor has the property that for bits $A$, $B$, and $C$ with $C=\lnot(A\lor B)$, the following transitions are possible and characterize nor:

[TABLE]

This multi-step reduction is shown in full (one step at a time) below. We only show the initial portion of each process term, which is enough to disambiguate where in the program we are, as otherwise process terms become unwieldy and reduce clarity. We also assume the existence of a rule $\mathsf{call}$ that lets us invoke a defined process, replacing the call with the process definition, after appropriate substitution. At each step, we have highlighted in red the process(es) that are about to transition.

[TABLE]

When we build an or-gate out of a nor-gate we need to exploit sharing to implement simple negation. In the example below, $u$ and $u^{\prime}$ are both names for the same shared channel. The process invoked as $\mbox{\it nor}\leftarrow x,y$ will multicast a message to the clients of $u$ and $u^{\prime}$.

[TABLE]

An analogous computation to the above is possible, except that at an intermediate stage of the computation, we will also have a shared channel $d$ carrying the (multicast) message $\mathsf{proc}(\{u,u^{\prime}\},\{d^{\prime}\},d,d.D(d^{\prime}))$ with $D=\lnot(A\lor B)$.

C.2 Example: Map

Mapping a process over a list allows us to demonstrate the use of replicable services, as well as cancellation. We define a whole family of types indexed by a type $A$, which is not formally part of the language but is expressed at the metalevel.

[TABLE]

Such a list should not be viewed as a data structure in memory. Instead, it is a behavioral description of a stream of messages. A process that maps a channel of type $A$ to one of type $B$ will itself have type $A\multimap B$. However, this process must be shared since it needs to be applied to every element. We therefore obtain the following type and definition, where all channels not annotated with a mode subscript are at mode ${\mathchoice{\mathsf{L}}{\mathsf{L}}{\scriptscriptstyle\mathsf{L}}{\scriptscriptstyle\mathsf{L}}}$.

[TABLE]

In this example, $f_{\_}{\mathchoice{\mathsf{U}}{\mathsf{U}}{\scriptscriptstyle\mathsf{U}}{\scriptscriptstyle\mathsf{U}}}$ is a replicable and cancelable service. In the case of a nonempty list, we create two names for the channel $f_{\_}{\mathchoice{\mathsf{U}}{\mathsf{U}}{\scriptscriptstyle\mathsf{U}}{\scriptscriptstyle\mathsf{U}}}$ — one to use immediately and one to pass to the recursive call. Note that the service itself remains a single service with two clients until the message $\mathsf{shift}(f^{\prime})$ is sent to it, at which point it replicates itself, creating one copy to handle this request and leaving another to deal with future requests. In the case of an empty list, we have no elements to map over, and so we do not need to use $f_{\_}{\mathchoice{\mathsf{U}}{\mathsf{U}}{\scriptscriptstyle\mathsf{U}}{\scriptscriptstyle\mathsf{U}}}$. As such, we cancel it before continuing.