Positively Dependent Types
Daniel R. Licata∗ Robert Harper ∗ Carnegie Mellon University {drl,rwh}@cs.cmu.edu
Abstract typed programming is to allow indexed families of types whose This paper is part of a line of work on using the logical techniques indices vary with the type’s inhabitants. For example, a simple list of polarity and focusing to design a dependent programming lan- module in ML might have the following signature: guage, with particular emphasis on programming with deductive nil : list systems such as programming languages and proof theories. Polar- cons : elt -> list -> list ity emphasizes the distinction between positive types, which clas- append : list -> list -> list sify data, and negative types, which classify computation. In pre- nth : nat -> list -> elt option vious work, we showed how to use Zeilberger’s higher-order for- mulation of focusing to integrate a positive function space for rep- Using dependency, we can refine the the type list to a type family resenting variable binding, an essential tool for specifying logical list[n:nat] whose index n represents the length of the list: systems, with a standard negative computational function space. nil : list[0] However, our previous work considers only a simply-typed lan- cons : Πn:nat.elt -> list[n] -> list[n+1] guage. The central technical contribution of the present paper is append : Πn,m:nat.list[n] -> list[m] -> list[n+m] to extend higher-order focusing with a form of dependency that we nth : Πn,m:nat.n
∆ c :: A+ + ∆ c :: C Γ ` σ : ∆ Γ ` c [σ] :: C + + + - - x : X x :: X x : A x :: ↓A + Left Inversion: Γ ` k : γ0 > γ + + ∆1 c1 :: A ∆2 c2 :: B · () :: 1 ∆ , ∆ (c , c ) :: A+ ⊗ B + + + 1 2 1 2 (∆ c :: C −→ Γ, ∆ ` φ (c): γ) - - + + + + + Γ ` : X > X Γ ` cont (φ ): C > γ ∆ c :: A ∆ c :: B + + + + (no rule for 0) ∆ inl c :: A ⊕ B ∆ inr c :: A ⊕ B Left Focus: Γ ` k- :: C- > γ ∆ d :: A- > γ - + ∆ d :: C > γ0 Γ ` σ : ∆ Γ ` k : γ0 > γ Γ ` d[σ]; k + :: C- > γ - - + + · :: X > X · :: ↑A > A + - Right Inversion: Γ ` v- : α ∆1 c :: A ∆2 d :: B > γ + - ∆1, ∆2 c ; d :: A → B > γ - - x : X + ∈ Γ (∆ d :: C > γ −→ Γ, ∆ ` φ (d): γ) (no rule for >) Γ ` x : X + Γ ` val-(φ-): C -
∆ d :: A- > γ ∆ d :: B- > γ Neutral: Γ ` e : γ - - - - ∆ fst; d :: A B > γ ∆ snd; d :: A B > γ N N - - - Γ ` v + :: C + x : C ∈ ΓΓ ` k :: C > γ Figure 1. Pattern rules Γ ` v + : C + Γ ` x • k- : γ
Assumptions: Γ ` σ : ∆ X- of each polarity. Below, we will extend this language with dependency on purely positive types, which are those positive types (x : α ∈ ∆ −→ Γ ` σ(x): α) that do not mention atoms X + or shifts ↓. Γ ` σ : ∆ 2.1.2 Patterns Figure 2. Focusing rules Next, we define the constructor and destructor patterns in Figure 1. These judgements use the following auxiliary notions: A hypothesis is a positive atom or a negative type; dually, a conclu- case-analysis, specified by a meta-function φ+ mapping patterns to sion is a negative atom or a positive type. Hypotheses occur at the expressions. We notate a meta-function by a potentially infinite set leaves of constructor patterns, which are defined by the judgement + of pairs of the form {c1 7→ e1 | ...}. The premise of the rule asserts ∆ c :: A . Destructor patterns have hypotheses at the leaves and that for all constructor patterns c for C +, applying φ+ to c yields an additionally produce a conclusion; they are defined by the judge- - expression of type γ using the variables bound by the pattern. We ment ∆ d :: A > γ. 0 + use the notation (J −→ J ) for a higher-order premise of an iter- The constructor patterns ∆ c :: A should be read as follows: ated inductive definition [31]; by convention, variables like ∆ and the pattern for ⊗ is a pair of patterns; there are two patterns for ⊕, c that occur first in the premise of an iterated inductive definition inl and inr. The patterns for atoms and shifts are variables, because are tacitly universally quantified. no further pattern-matching is possible. Variables are treated lin- The next two judgements define focusing and inversion for the early, because a pattern can bind a variable only once. negative types. The judgement Γ ` k- :: C- > γ defines negative The destructor patterns describe the shapes of observations on a - continuations (left focus): a negative continuation is a destructor negative type A : is observed by observing either the first com- pattern under a substitution for its free variables followed by a N + ponent or the second component; suspensions ↑A can be forced; positive continuation consuming the result of the destructor. The functions are observed by applying them to an argument (repre- destructor pattern, filled in by the substitution, decomposes C - sented by a constructor pattern) and observing the result. to some conclusion γ0. The positive continuation reflects the fact that it may take further case-analysis of γ0 to reach the desired 2.1.3 Focusing Judgements conclusion γ. The judgement Γ ` v- : C - defines negative values Next, we define the focusing judgements, presented in Figure 2. In (right inversion): a negative value is specified by a meta-function these rules, Γ stands for a sequence of pattern contexts ∆, but Γ φ- that gives an expression responding to every possible destructor. itself is treated in an unrestricted manner (i.e., variables are bound The judgement Γ ` e : γ types expressions, which are neutral once in a pattern, but may be used any number of times within the states: from an expression, one can right-focus and introduce a pattern’s scope). value, or left-focus on an assumption in Γ and apply a negative The first two judgements define focusing and inversion for pos- continuation to it. Finally, a substitution Γ ` σ : ∆ provides a itive types. The judgement Γ ` v + :: C + defines positive values negative value for each hypothesis. (right focus): a positive value is a constructor pattern under a substi- At this point, the reader may wish to work through some in- + tution for its free variables. The judgement Γ ` k : γ0 > γ defines stances of these rules (using the above pattern rules) to see that positive continuations (left inversion): The only positive continua- they give the expected typings for familiar types. First, the type - + + + tion for atoms X is the identity. A positive continuation for C is a (↑A1 ) (↑A2 ) is inhabited by a lazy pair of expressions: N Constructor patterns are represented by an indexed inductive + + + Γ ` e1 : A1 Γ ` e2 : A2 definition, indexed by the context ∆ and the type A . We write [] - + + for the empty list, ++ for append, and [ x ] for the singleton list. Γ ` val (fst; 7→ e1 | snd; 7→ e2 ):(↑A1 ) (↑A2 ) N + data _ _ : Ctx -> Type -> Set where - - + + + + Second, a function (↓A1 ) ⊕ (↓A2 ) → ↑B is defined by two Cx : forall {X} -> [ X atom ] (X X) - - - - - cases: Cx : forall {A } -> [ A true ] (↓ A ) C<> : [] 1+ + + Γ, x : A- ` e : B + Γ, x : A- ` e : B + Cpair : forall {∆1 ∆2 A B } 1 1 1 2 2 2 + + -> ∆1 A -> ∆2 B Γ ` val-((inl x ; ) 7→ e | (inr x ; ) 7→ e ):(↓A- ) ⊕ (↓A- ) → ↑B + + + 1 1 2 2 1 2 -> (∆2 ++ ∆1) (A *B ) Cinl : forall {∆ A+ B+} -> ∆ A+ + + 2.2 Agda Implementation -> ∆ (A + B ) Cinr : forall {∆ A+ B+} Next, we describe an Agda implementation of the above type the- -> ∆ B+ + + ory. We use an intrinsic encoding: rather than first defining raw -> ∆ (A + B ) syntax (c,d,v +,k +,. . . ) and then defining typing judgements on raw syntax, we represent only the typing judgements, which correspond data _ _>_ : Ctx -> Type- -> Conc -> Set where - - - to the well-typed programs. De : forall {X} -> [] (X X) > (X atom ) De+ : forall {A+} -> [] (↑ A+) > (A+ true+) The correspondence between the above judgements and their + - Agda counterparts is as follows: Dapp : forall {∆1 ∆2 A B γ} -> ∆1 A+ -> ∆2 B- > γ + - Informal Agda -> (∆2 ++ ∆1) (A → B ) > γ + + Dfst : forall {∆ A- B- γ} ∆ c :: A ∆ A - - - -> ∆ A > γ ∆ d :: A > γ ∆ A > γ - - + + + -> ∆ (A &B ) > γ Γ ` v :: C Γ ` RFoc C - - + Dsnd : forall {∆ A B γ} Γ ` k : γ0 > γ Γ ` LInv γ0 γ - - - - -> ∆ B > γ Γ ` k :: C > γ Γ ` LFoc C γ - - -> ∆ (A &B ) > γ Γ ` e : γ Γ ` Neu γ Γ ` σ : ∆ Γ ` Asms ∆ The Agda syntax for dependent functions may be unfamiliar to some readers: A dependent function is written (x : A) -> B, 2.2.1 Types but the -> between successive arguments can be elided, writing, The syntax of types is a straightforward inductive definition: for example, (x : A) (y : B) -> C. Replacing the parentheses with curly-braces, as in {x : A} -> B, notates an implicit argu- Atom : Set ment, whose application will be inferred by unification. The syntax Atom = String forall {x1 ... xn} -> A allows the types of the variables to be elided; it is equivalent to writing {x1 : _} ... {xn : _} -> mutual data Type+ : Set where A. For example, a typical application of Dapp would have the form X+ : Atom -> Type+ (Dapp c d) where c is a constructor pattern and d is a destructor ↓ : Type- -> Type+ pattern; the contexts and types are inferred. A function can be ex- 1+ : Type+ plicitly applied to implicit arguments by enclosing the arguments _*_ : Type+ -> Type+ -> Type+ in curly-braces; e.g., (Dapp {∆}{∆’} c d). 0+ : Type+ _+_ : Type+ -> Type+ -> Type+ 2.2.3 Focusing Judgements
data Type- : Set where Next, we define the focusing judgements in Figure 3. It is conve- X- : Atom -> Type- nient to define a sum type FocJudg and then define one datatype ↑ : Type+ -> Type- Γ ` J, rather than giving six separate datatypes. Additionally, we _→_ : Type+ -> Type- -> Type- use the auxiliary types α ∈ ∆ for list membership, α ∈∈ Γ for > : Type- membership in some list in Γ, and we write :: for consing onto a - - - _&_ : Type -> Type -> Type list. The list membership types serve as de Bruijn indices: a proof α ∈∈ Γ Γ Using an underscore in a name is Agda syntax for mixfix oper- that is an index into . ators; e.g., & can be used infix. The focusing judgements are defined by an iterated inductive definition; note the higher-order premises of Cont+ and Val- and 2.2.2 Patterns Sub. On paper, we tacitly included negative types and atoms into the sum 2.2.4 Examples type α; in Agda, we must give injections: The first of the derived rules suggested above is implemented as –– α follows: data Hyp : Set where _true- : Type- -> Hyp ex1 : forall {Γ A1+ A2+} _atom+ : Atom -> Hyp -> ([] :: Γ) ` Neu (A1+ true+) –– ∆ -> ([] :: Γ) ` Neu (A2+ true+) Ctx = List Hyp -> Γ ` RInv ( ((↑ A1+)&(↑ A2+)) true-) –– γ ex1 {Γ} {A1+} {A2+} e1 e2 = Val- ex1* where data Conc : Set where ex1* : {∆ : Ctx}{γ : Conc} + + + + _true : Type -> Conc -> ∆ ((↑ A1 )&(↑ A2 )) > γ _atom- : Atom -> Conc -> (∆ :: Γ) ` Neu γ –– Γ A function of type (((↓ A1-) + (↓ A2-)) → (↑ B+)) is im- CtxCtx : Set plemented by pattern-matching against its destructor patterns, of CtxCtx = List Ctx which there is one, Dapp, and then further pattern-matching against data FocJudg : Set where the constructor patterns for the argument; there are two in this ex- RFoc : Type+ -> FocJudg ample. LInv : Conc -> Conc -> FocJudg LFoc : Type- -> Conc -> FocJudg 3. Positively Dependent Types RInv : Hyp -> FocJudg Neu : Conc -> FocJudg The two key ideas of positively dependent types are: Asms : Ctx -> FocJudg 1. We allow dependency only on the values of purely positive data _`_ : CtxCtx -> FocJudg -> Set where types—i.e., the shift- and atom-free positive types. Because –– positive values (v+) shifts and atoms are the only types whose patterns bind vari- Val+ : forall {Γ ∆ C+} ables, the values of purely positive types are closed patterns. + -> ∆ C -> Γ ` Asms ∆ 2. The syntax of Π and Σ types is specified using an iterated Γ ` + -> RFoc C inductive definition, mapping patterns to types. Type-level –– positive continuations (k+) Ke- : forall {Γ X} pattern-matching permits types to be defined by recursion on -> Γ ` LInv (X atom-) (X atom-) data. Cont+ : forall {Γ γ C+} -> ({∆ : Ctx} -> ∆ C+ -> ∆ :: Γ ` Neu γ) 3.1 A First Attempt + + -> Γ ` LInv (C true ) γ We add rules for three new types: Σ+ types; a type nat representing –– negative continuations (k-) + - - natural numbers; and a type vec A n, representing vectors of Cont : forall {∆ A γ0 γ Γ} + - length n with elements of type A . Here n is a closed nat pattern; -> ∆ A > γ0 -> Γ ` Asms ∆ -> Γ ` LInv γ0 γ -> Γ ` LFoc A- γ i.e., it has type [] nat. –– negative values (v-) Because types are dependent on patterns, and patterns are clas- Vx+ : forall {Γ X} sified by types, we at least need to define the syntax of types and -> (X atom+) ∈∈ Γ -> Γ ` RInv (X atom+) the pattern judgement as a mutual inductive definition. Val- : forall {Γ C-} The new types are specified as follows: -> ({∆ : Ctx}{γ : Conc} - -> ∆ C > γ -> ∆ :: Γ ` Neu γ) mutual -> Γ ` RInv (C- true-) data Type+ : Set where –– expressions (e) ––- above constructors plus ... + + + + + + + R : forall {Γ C } Σ : (A : Type ) -> ([] A -> Type ) -> Type -> Γ ` RFoc C+ nat : Type+ + + + + -> Γ ` Neu (C true ) vec : Type -> [] nat -> Type Γ - γ L : forall { C } + -> ((C- true-) ∈∈ Γ) -> Γ ` LFoc C- γ Note the higher-order premise of Σ . -> Γ ` Neu γ Next, we add pattern constructors for these types: σ –– substitutions ( ) + Sub : forall {Γ ∆} data _ _ : List Hyp -> Type -> Set where α α ∈ ∆ Γ ` α ––- above constructors plus ... -> ({ : Hyp} -> -> RInv ) + + + + Γ ` ∆ Cdpair : forall {∆ A }{τ : ([] A -> Type )} -> Asms + + (c : [] A ) -> ∆ (τ c) -> ∆ (Σ+ A+ τ +) Figure 3. Focusing judgements for simple types Czero : [] nat Csucc : {∆ : Ctx} -> ∆ nat ex1* (Dfst De+) = e1 -> ∆ nat ex1* (Dsnd De+) = e2 Cnil : forall {A+} + -> [] vec A Czero A lazy pair is implemented by pattern-matching against the projec- + Ccons : forall {A ∆1 ∆2} + + tions and satisfying the two possible observations. This is imple- -> (n : [] nat) -> ∆1 A -> ∆2 vec A n + mented by the Agda function ex1*, which pattern-matches on the -> ∆2 ++ ∆1 vec A (Csucc n) destructor pattern datatype. A few details deserve comment: First, + + + + we require the given expressions e1 and e2 to be in context [] :: A pattern for (Σ A τ ) consists of a closed pattern c for A , as + Γ to avoid the need to call a weakening lemma. Second, the curly- well as a pattern for (τ c)—i.e., the type determined for c by + braces surrounding the three arguments to ex1 are Agda syntax for the meta-function τ . Meta-function application plays the role that matching on implicit arguments. substitution takes in the standard intro rule for Σ-types. + The second derived rule is implemented as follows: To illustrate type-level computation, we can define a type Σ n:nat.iszero n that is inhabited only when the first component ex2 : forall {Γ A1- A2- B+} of the pair is 0. -> ([ A1- true- ] :: Γ) ` Neu (B+ true+) -> ([ A2- true- ] :: Γ) ` Neu (B+ true+) zpair : Type+ -> Γ ` RInv (( ((↓ A1-) + (↓ A2-)) → (↑ B+)) true-) zpair = Σ+ nat iszero* - - + - + ex2 {Γ} {A1 } {A2 } {B } e1 e2 = Val ex2* where where iszero* : [] nat -> Type ex2* : {∆ : Ctx}{γ : Conc} iszero* Czero = 1+ - - + + -> ∆ (((↓ A1 ) + (↓ A2 )) → (↑ B )) > γ iszero* (Csucc n) = 0 -> (∆ :: Γ) ` Neu γ + ex2* (Dapp (Cinl Cx-) De+) = e1 The body of the Σ -type is defined by pattern-matching on nat, ex2* (Dapp (Cinr Cx-) De+) = e2 mapping 0 to the unit type, and successor of anything to the void type. Thus, it will only be possible to give a value for the second data CPatΣ+(_`A+ : Ctx -> Set) component when the first component is Czero. (_`τ +_ : Ctx -> [] `A+ -> Set) : Ctx -> Set where While this definition captures the kind of dependency we want, Cdpair : forall {∆} it is not accepted by Agda because it is not strictly positive: -> (c : [] `A+) -> ∆ `τ + c + + + + + -> CPatΣ _`A _`τ _ ∆ 1. The types Type and ∆ A are defined mutually inductively. data CPat1+ : Ctx -> Set where 2. The premise of the constructor Σ+ quantifies over patterns, C<> : CPat1+ [] which a negative occurrence. data CPat0+ : Ctx -> Set where data CPat+ (_`A+ : Ctx -> Set) (_`B+ : Ctx -> Set) Thus, it is not clear whether this definition is sensible. : Ctx -> Set where Cinl : forall {∆} -> ∆ `A+ -> CPat+ _`A+ _`B+ ∆ 3.2 Induction-Recursion Cinr : forall {∆} -> ∆ `B+ -> CPat+ _`A+ _`B+ ∆ It is possible to make sense of the above definition. They key data CPatnat : Ctx -> Set where observation is that, in the syntax Σ+A+τ +, the meta-function τ + only Czero : CPatnat [] + Csucc : forall {∆} -> CPatnat ∆ -> CPatnat ∆ quantifies over the patterns for a smaller type A . So the definition data CPatvec (_`A+ : Ctx -> Set) is staged as follows: : Ctx -> CPatnat [] -> Set where + 1. First, the type A+. Cnil : CPatvec _`A [] Czero Ccons : forall {∆1 ∆2} {n : CPatnat []} + + + 2. Then, the patterns for A . -> ∆1 `A -> CPatvec _`A ∆2 n + + + + -> CPatvec _`A (∆2 ++ ∆1) (Csucc n) 3. Then, the type Σ A τ , which quantifies over the patterns for - - + data CPatdom (A : Type ) : Ctx -> Set where A . Cdom : CPatdom A- [A- true- ] 4. Then, the patterns for Σ+A+τ +. open CPats using (_true- ; _atom+) 5.... This “weave” between types and their inhabitants is common in 3.2.2 Types and Patterns the semantics of dependent type theories (see, e.g., Constable et al. Next, we define the syntax of types and the positive patterns, using [12]); here, we use it to construct the syntax. induction-recursion. There are a few differences from above. First, This can be formalized in Agda using a simultaneous inductive- Type+ is indexed by kinds. Second, we add two new types: Π-, recursive definition: we define the syntax of Type+ inductively, whose formation rule is parallel to that for Σ+, and dom, which will while simultaneously defining a function mapping a Type+ to the represent the recursive type µ D. D → D. Its pattern rule is: Agda Set classifying its patterns. 3.2.1 Positive Pattern Data dom → ↑ dom dom mutual It will be useful to use a simple kinding discipline to distinguish + the purely positive types, which can never have negative subcom- data Type : PKind -> Set where X+ : Atom -> Type+ Pos ponents embedded in them, from the positive types, which can. We ↓ : Type- -> Type+ Pos write PPos for purely positive and Pos for positive, and we allow 1+ : {K : PKind} -> Type+ K dependency only on the patterns of purely positive types. _*_ : {K : PKind} -> Type+ K -> Type+ K -> Type+ K Σ+ : {K : PKind} data PKind : Set where (A+ : Type+ PPos) -> ([] A+ -> Type+ K) -> Type+ K PPos : PKind 0+ : {K : PKind} -> Type+ K Pos : PKind _+_ : {K : PKind} -> Type+ K -> Type+ K -> Type+ K + Now, we define the Agda Sets used to form patterns, with nat : {K : PKind} -> Type K vec : {K : PKind} (A+ : Type+ K) -> CPatnat [] -> Type+ K one datatype for each type. The constructors are essentially those + + dom : Type Pos for the datatype ∆ A defined before, but abstracted over the types of the subpatterns. Because we have not yet defined the data Type- : Set where syntax of types, we use a module parametrized by the Agda Set’s X- : Atom -> Type- representing them. ↑ : Type+ Pos -> Type- + - - + - _→_ : Type Pos -> Type -> Type module CPats (Type : PKind -> Set) (Type : Set) where - + - - Π : (A+ : Type PPos) -> ([] A+ -> Type ) -> Type > : Type- data Hyp : Set where _&_ : Type- -> Type- -> Type- _true- : Type- -> Hyp _atom+ : Atom -> Hyp The Sets of patterns are defined by instantiating the above datatypes with the Sets determined by the recursive calls: Ctx = List Hyp _ _ : {K : PKind} -> List Hyp -> Type+ K -> Set + + + data CPatX : Atom -> Ctx -> Set where ∆ (X X) = CPatX X ∆ Cx+ : forall {X} -> CPatX+ X [ X atom+ ] ∆ (↓ A-) = CPat↓ A- ∆ - + + data CPat↓ : Type -> Ctx -> Set where ∆ 1 = CPat1 ∆ Cx- : forall {A-} -> CPat↓ A- [A- true- ] ∆ (A+ *B+) = + + + + data CPat* (_`A : Ctx -> Set) (_`B : Ctx -> Set) CPat* (\∆1 -> ∆1 A ) (\∆2 -> ∆2 B ) ∆ : Ctx -> Set where ∆ (Σ+ A+ τ+) = + + Cpair : forall {∆1 ∆2} CPatΣ (\∆ -> ∆ A ) (\∆ c -> ∆ (τ+ c)) ∆ + + + + -> ∆1 `A -> ∆2 `B ∆ 0 = CPat0 ∆ + + + + -> CPat* _`A _`B (∆2 ++ ∆1) ∆ (A + B ) = + + CPat+ (\∆ -> ∆ A ) (\∆ -> ∆ B ) ∆ ∆ nat = CPatnat ∆ CtxCtx : Set + + CtxCtx = List Ctx ∆ (vec A n) = CPatvec (\∆ -> ∆ A ) ∆ n ∆ dom = CPatdom (dom → ↑ dom) ∆ data FocJudg : Set where + The type dom is the recursive type µdom.↓(dom → ↑ dom). RFoc : {K : PKind} -> Type K -> FocJudg The pattern for dom is a base case, with only one pattern; Cdom LInv : Conc -> Conc -> FocJudg LFoc : Type- -> Conc -> FocJudg is essentially (roll x) for a variable x. We do not define the RInv : Hyp -> FocJudg patterns for dom in terms of functions from the patterns for dom Neu : Conc -> FocJudg to the patterns for dom—the polarity shift caused by the ↓ halts the Asms : Ctx -> FocJudg semantic interpretation of patterns. codata _`_ : CtxCtx -> FocJudg -> Set where 3.2.3 Destructor Patterns –– positive values (v+) Val+ : forall {Γ K ∆} {C+ : Type+ K} Next, we define the destructor patterns inductively, as before. The + - + - -> ∆ C -> Γ ` Asms ∆ Ddapp rule is analogous to Cdpair: to use Π A τ , give a con- -> Γ ` RFoc C+ + - structor c for A , and use (τ c). –– positive continuations (k+) Ke- : forall {Γ X} data Conc : Set where -> Γ ` LInv (X atom-) (X atom-) + + _true : {K : PKind} -> Type K -> Conc Cont+ : forall {Γ K γ} {C+ : Type+ K} _atom- : Atom -> Conc + -> ({∆ : Ctx} -> ∆ C -> ∆ :: Γ ` Neu γ) -> Γ ` LInv (C+ true+) γ - data _ _>_ : Ctx -> Type -> Conc -> Set where –– negative continuations (k-) - - - De : forall {X} -> [] (X X) > (X atom ) Cont- : forall {∆ C- γ0 γ Γ} + + + + + + De : {A : Type Pos} -> [] (↑ A ) > (A true ) -> ∆ C- > γ0 -> Γ ` Asms ∆ -> Γ ` LInv γ0 γ - + + Dapp : forall {∆1 ∆2 B γ} {A : Type Pos} -> Γ ` LFoc C- γ + - -> ∆1 A -> ∆2 B > γ –– negative values (v-) + - -> (∆2 ++ ∆1) ((A → B )) > γ Vx+ : forall {Γ X} + + Ddapp : forall {∆ γ} {A : Type PPos} -> (X atom+) ∈∈ Γ -> Γ ` RInv (X atom+) - + - {τ : ([] A -> Type )} Val- : forall {Γ C-} + - -> (c : [] A ) -> ∆ (τ c) > γ -> ({∆ : Ctx}{γ : Conc} - + - -> ∆ (Π A τ ) > γ -> ∆ C- > γ -> ∆ :: Γ ` Neu γ) - - Dfst : forall {∆ A B γ} -> Γ ` RInv (C- true-) - - - -> ∆ A > γ -> ∆ (A &B ) > γ –– expressions (e) - - Dsnd : forall {∆ A B γ} R : forall {Γ K} {C+ : Type+ K} - - - -> ∆ B > γ -> ∆ (A &B ) > γ -> Γ ` RFoc C+ -> Γ ` Neu (C+ true+) 3.2.4 Focusing Rules L : forall {Γ C- γ} - - ∈∈ Γ Γ ` - γ The focusing rules are essentially unchanged from the simply- -> ((C true ) ) -> LFoc C -> Γ ` Neu γ typed case. The differences are confined to the implicit arguments + –– substitutions (σ) to the constructors: every rule that binds a positive type C now also Sub : {Γ : CtxCtx} -> {∆ : Ctx} binds a kind K classifying it. We present the code in Figure 4. -> ({α : Hyp} -> α ∈ ∆ -> Γ ` RInv α) -> Γ ` Asms ∆ 4. Properties Figure 4. Focusing Rules The focusing rules described above allow only canonical programs (long βη-normal forms). For example there is no way to a apply a value v : · ` RInv A- to a continuation k : · ` LFoc A- γ; it is identity is defined to be a value that, when given a destructor pat- only possible to write the canonical result of this computation. tern, observes the designated variable with that destructor, under Similarly, it is not obvious that it is possible to use an assumption the identity substitution, and followed by the identity left-inversion of A- as a negative value—i.e., to prove A- ` RInv A-. These (both recursive calls). considerations motivate the cut and identity procedures, which Here we write s0 and sS as constructors for de Bruijn indices define a canonization method for our language; they correspond into Γ: to β-reduction and η-expansion, respectively. s0 : α ∈ ∆ -> α ∈∈ (∆ :: Γ) α ∈ Γ α ∈ ∆ Γ 4.1 Identity sS : -> ( :: ) There are two main identity principles, which are defined mutu- The identity principles are defined as follows: - ally. The negative identity says that an assumption of C can be ex- mutual panded into a negative value (right inversion). The positive identity Ke+ : forall {K Γ} {C+ : Type+ K} says that there is an identity continuation (left inversion) from C+ to -> Γ ` LInv (C+ true+) (C+ true+) C+. There are also three auxiliary principles: The first defines iden- Ke+ ~ Cont+ (\c -> R (Val+ c (Ids s0))) tity for assumptions α, by delegating either to the negative identity + Vx- : forall {Γ C-} theorem, or to the primitive rule Vx for atoms. The second maps - - - - this across all assumptions in a context, producing a substitution. -> ((C true ) ∈∈ Γ) -> Γ ` RInv (C true ) Vx- x ~ Val- (\d -> L (sS x) (Cont- d (Ids s0) Ke)) The third expands conclusions γ, by delegating either to positive - identity or to the rule Ke for atoms. Vx : forall {Γ α} -> (α ∈∈ Γ) -> Γ ` RInv α The positive identity is defined to be a continuation that, when Vx {α = x+ atom+} x ~ Vx+ x given a constructor pattern, forms the value composed of that pat- Vx {α = C- true-} x ~ Vx- x tern under the identity substitution (a recursive call). The negative Ids : forall {∆ Γ} weaken : { ΓΓ’ : CtxCtx } { J : FocJudg } -> ({α : Hyp} -> (α ∈ ∆) -> (α ∈∈ Γ)) -> Γ ⊆SS Γ’ -> Γ ` J -> Γ’ ` J -> Γ ` Asms ∆ mutual Ids subset ~ Sub (\{α} i -> Vx (subset i)) Cut+ : forall {Γ K γ} {C+ : Type+ K} -> Γ ` RFoc C+ Ke : forall {Γ γ} -> Γ ` LInv γ γ -> Γ ` LInv (C+ true+) γ Ke {γ = x- atom-} ~ Ke- -> Γ ` Neu γ Ke {γ = C+ true+} ~ Ke+ Cut+ (Val+ c σ) (Cont+ ϕ+) ~ [ i0 ← σ ](ϕ+ c)
Do these functions terminate? There are several circumstances Cut- : forall {Γ C- γ} in which we can answer this question: -> Γ ` RInv (C- true-) -> Γ ` LFoc C- γ First, if the pattern judgements have the property that they -> Γ ` Neu γ decompose a type into syntactically smaller types (i.e., whenever Cut- (Val- ϕ-) (Cont- d σ k+) ~ + + + - + ∆ A , every negative type in ∆ is a subexpression of A , EK ([ i0 ← σ ](ϕ d)) k and similarly for destructor patterns), then identity is total. This + is because the proofs of identity make recursive calls only on the EK : forall {Γ γ0 γ} assumptions and conclusions coming from patterns. We proved this -> Γ ` Neu γ0 -> Γ ` LInv γ0 γ theorem in previous work [29]. -> Γ ` Neu γ EK+ (R v) k+ ~ Cut+ v k+ However, not all types have this property. For example, dom EK+ (L x k-) k+ ~ L x (K-K+ k- k+) violates it, because dom is decomposed into dom → ↑ dom. This + + property is also violated by more innocuous types, such as streams K K : forall {γ0 γ1 γ Γ} specified as an inductive type with a suspended tail—i.e. the so- -> Γ ` LInv γ0 γ1 -> Γ ` LInv γ1 γ lution to str =∼ elt * ↓↑(str). The patterns for str produce -> Γ ` LInv γ0 γ + + + + + assumptions of ↑str. And indeed, these types pose a problem for K K (Cont ϕ ) k2 ~ + + + + the identity theorem as described above: for example, the negative Cont (\c -> EK (ϕ c) (weaken sS k2 )) + + - + + identity at (dom → ↑ dom) makes a recursive call to the negative K K Ke k2 ~ k2 identity at (dom → ↑ dom)! - + - K K : forall {C γ0 γ Γ} One solution is to disallow these types. A better solution is - -> Γ ` LFoc C γ0 -> Γ ` LInv γ0 γ to treat the focusing judgement Γ ` J coinductively, following -> Γ ` LFoc C- γ - + - + + - + + + + Girard [19], in which case identity is productive. The η-expansions K K (Cont d σ k ) k2 ~ (Cont d σ (K K k k2 )) for types like dom and streams are infinitely deep, but they always respond to a single observation in a finite amount of time. We [_←_]_ : forall {∆ Γ J} -> (i : ∆ ∈ Γ) have taken this solution in the Agda code: In Figure 4, we used -> (Γ - i) ` Asms ∆ -> Γ ` J an Agda codata declaration for the focusing judgement. Above, -> (Γ - i) ` J - [ x0 ← σ0 ] L y k with List.SW.here? x0 y | σ0 we used ~ instead of = for the equations defining identity, which is - - Agda syntax for a function whose termination should be checked ... | Inl newy | Sub f ~ Cut (f newy) ([ x0 ← σ0 ] k ) ... | Inr newy | _ ~ L newy ([ x ← σ ] k-) by coinduction towards the result, rather than induction over the 0 0 argument. Agda successfully checks these definitions, because all of the recursive calls occur under constructors. Figure 5. Cut admissibility procedure
4.2 Cut We present the code for cut admissibility in Figure 5. We first Because cut is defined on well-typed syntax, it intrinsically require a weakening lemma, whose code we elide; the type Γ ⊆SS ensures subject reduction, and the fact that cut can only fail by Γ’ classifies proofs that Γ is a subset of Γ’. + - non-termination (i.e., that it coverage checks) is tantamount to a The most fundamental cuts, Cut and Cut , put a value up progress lemma. It is simple to adapt the cut admissibility proce- against a continuation. A positive cut is reduced by applying the dure to an operational semantics on closed terms [27]. meta-function given in the continuation to the constructor pattern given in the value, and then applying the value’s substitution to the result. A negative cut is reduced by applying the meta-function 4.3 Type Equality given in the value to the destructor pattern given in the continu- The focusing rules have the property that two flows of type infor- ation, and then (1) substituting into the result and (2) composing mation never meet, except at atomic propositions X+ and X-: in fully the resulting expression substitution with the positive continuation. η-expanded form, all of the type equality tests are pushed down to The next three cut principles, EK+ and K-K+ and K+K+, compose ex- base type. (For related phenomena, see LFR [30], where subtyp- pressions and continuations. Finally, we have a substitution lemma; ing at higher types is characterized by an identity coercion, and note that Γ - i removes the element of Γ given by the index, and OTT [1], where an η-expanded identity coercion is induced by that List.SW.here? tests whether the index into Γ is in the ∆ proofs of type equality). The cut principles described above have being substituted for, and in the first case gives the index into ∆, too little type information: the principal type of the cut must be an- and in the second case gives the index into Γ - i. We elide the notated or guessed. On the other hand, the identity principles may straightforward cases of substitution. Both composition and substi- be used in a situation where two different flows of type information tution refer back to the principal cuts: composing a value with a meet. In such a circumstance, for example, we may desire a more positive continuation causes a positive cut, whereas substituting a general positive identity that LInv γ γ, if the surrounding context negative value in for a variable causes a negative cut. requires LInv γ γ’, for two different types γ and γ’. But when This cut admissibility procedure does not always terminate, does the identity coercion defined above suffice to map one type to corresponding to the fact that our language admits non-terminating a different type? run-time programs. We show an example of a looping program For our language’s types, this happens when there is an inten- using dom below. sional mismatch in the Agda functions used to specify Σ+ and Π-. For example, given an addition function plus* on two patterns of 5. Examples type nat, the types 5.1 Derived Forms Σ+ nat \n -> Σ+ nat \m -> vec nat (plus* m n) First, we define some derived forms that will make writing the and examples easier. Σ+ nat \n -> Σ+ nat \m -> vec nat (plus* n m) We define shorthands for case-analyzing an expression with a positive continuation, and for right-focusing on a value: will be intensionally different, but extensionally equal, in the sense case_of_ : forall {Γ γ} {C+ : Type+ Pos} that they have the same patterns. In this case, the same implemen- -> Γ ` Neu (C+ true+) tation of Ke+ that we gave above will work as a coercion from one -> ({∆ : Ctx} -> ∆ C+ -> ∆ :: Γ ` Neu γ) of these types to the other. -> Γ ` Neu γ We codify this with a subtyping relation that is sufficient to case e of k+ = EK+ e (Cont+ k+) define the identity coercion. Informally, the subtyping relation for + + rfv : forall {Γ K ∆} {C+ : Type+ K} positive types is defined as follows: A1 <: A2 iff for every pat- + tern ∆1 A1+, the same pattern has type ∆2 A2+ where ∆1 -> ∆ C -> Γ ` Asms ∆ Γ ` + + <: ∆2. The definition is then extended to contexts, assumptions, -> Neu (C true ) rfv c σ = R (Val+ c σ) conclusions, and negative types (which have a contravariant flip). What does it mean for the same pattern to have two different types? We define utilities for creating common substitutions (defini- If we annotated the pattern judgement with raw proof terms (e.g., tions elided): ∆ c : A+), then we would require the same proof term c in both σe : (Γ : CtxCtx) -> Γ ` Asms [] cases. In our intrinsic encoding, we can define an auxiliary judge- ment EqCPat c1 c2 which relates two patterns, with two different σid : forall {Γ ∆} -> (∆ :: Γ) ` Asms ∆ types, as long as they have the same structure. We also require a σ1 : forall {Γ α} -> Γ ` RInv α -> Γ ` Asms [ α ] similar judgement for destructor patterns. The two important cases of subtyping are the following: The meta-functions necessary for introducing a negative value have type: + + + - codata _<: _ : {K : PKind} -> Type K -> Type K -> Set {∆:Ctx}{γ:Conc} -> ∆ A > γ -> (∆ :: Γ) ` γ where Sub+ : forall {K} {A1+ A2+ : Type+ K} -> ({ ∆1 : Ctx} (c1 : ∆1 A1+) -> It is convenient to define a short-hand for matching on destructor patterns. For example, for the type (A+ → B+ → ↑ C+), we will Σ \ ∆2 -> Σ \(c2 : ∆2 A2+) -> EqCPat{∆1}{∆2}{K}{K}{A1+}{A2+} c1 c2 write an Agda function that takes two constructor patterns, one for × ∆1 <:∆ ∆2) A+ and one for B+, rather than a function taking both constructor -> A1+ <:+ A2+ patterns packed as a destructor pattern. The Agda type of these con- codata _<:-_ : Type- -> Type- -> Set where venient meta-functions is defined by induction on negative types: Sub- : forall {A1- A2- } -> ({∆2 : Ctx} {γ2 : Conc} (d2 : ∆2 A2- > γ2) IMetaFn- : CtxCtx -> Type- -> Set - + + + -> Σ \∆1 -> Σ \γ1 -> Σ \(d1 : ∆1 A1- > γ1) -> IMetaFn Γ (↑ A ) = Γ ` Neu (A true ) EqDPat d1 d2 IMetaFn- Γ (A+ → B-) = + - - × ((∆1 , γ1) <:∆γ (∆2 , γ2))) {∆ : Ctx} -> ∆ A -> IMetaFn (∆ :: Γ)B - - - + - + - - -> A1- <: A2- IMetaFn Γ (Π A τ ) = (p : [] A ) -> IMetaFn Γ (τ p) IMetaFn- Γ (X- X) = Γ ` Neu (X atom-) We elide the definitions of the auxiliary judgements <:∆ and IMetaFn- Γ > = Unit ------<:∆γ, which define subtyping for contexts and pairs of contexts IMetaFn Γ (A &B ) = IMetaFn Γ A × IMetaFn Γ B and conclusions, respectively. These convenient meta-functions suffice to define a negative The subtyping relation suffices to define the identity coercion; value: the code is essentially the same as above, aside from the need to - - - push the subtyping proofs through. ival : forall {Γ A} -> IMetaFn Γ A -> Γ ` RInv (A true ) 5.2 Tail Ke+ : forall {K Γ} {C1+ C2+ : Type+ K} -> C1+ <:+ C2+ First, we define a tail function on vectors of length at least one: -> Γ ` LInv (C1+ true+) (C2+ true+) tailtp = Π- nat (\n -> (vec nat (Csucc n)) → ↑(vec nat n)) tail : forall {Γ} -> Γ ` RInv (tailtp true-) Vx- : forall {Γ C1- C2- } tail {Γ} = ival- tail* where -> C1- <:- C2- tail* : IMetaFn- Γ tailtp -> ((C1- true-) ∈∈ Γ) -> Γ ` RInv (C2- true-) tail* n (Ccons x xs) = rfv xs (Ids {! !}) In summary, our focused formalism has squeezed the balloon The negative value is defined by a two-argument meta-function, so that proofs of equality are only needed in one spot: to show which takes a nat pattern n and pattern for vec nat (Csucc n). that an identity coercion exists between apparently different types. In the Ccons case, we return the tail under the identity substitu- So far, we have manually constructed the subtyping proofs when tion. Agda’s exhaustiveness checker verifies that the Cnil case is necessary. However, we have also proved that the subtyping proofs impossible for a vector this length. are unique, in the sense that any two proofs of A <: B determine To make the examples more readable, we leave a hole marked the same identity coercion (where “same” means structural equality by {! !} or ? for simple list subset relationships, which are easy of proof terms—a judgement similar to EqCPat but for the focusing but verbose to fill in; in this case, the obligation is to prove that judgement). This licenses the use of theorem proving to find proofs every assumption in ∆2 is in (∆2 ++ ∆1) :: Γ. We would of subtyping, as the code determined by the proofs will be the same. like to try deploying reflective theorem proving to discharge these We intend to explore ways of exploiting this in future work. obligations automatically. + + 5.3 Append comm : {A : Type Pos} (n m : [] nat{PPos}) -> (vec A+ (plus*{PPos} m n)) Next, we define an append function on vectors. We require an <:+ (vec A+ (plus*{PPos} n m)) addition function on nat patterns: commext : {A+ : Type+ Pos} -> plus* : {K : PKind} (Σ+ nat \n -> Σ+ nat \m -> (vec A+ (plus*{PPos} m n))) -> [] nat{K} -> [] nat{K} -> [] nat{K} <:+ (Σ+ nat \n -> Σ+ nat \m -> (vec A+ (plus*{PPos} n m))) plus* Czero n = n plus* {K} (Csucc m) n = Csucc (plus*{K} m n) Then we coerce app2 by cutting with the identity coercion induced by this subtyping proof, and call the result app2’: appendtype = (Π- nat (\n -> Π- nat \m -> vec nat n → vec nat m → ↑ (vec nat (plus*{PPos} n m)))) map2app : forall {Γ} -> Γ ` RInv (map2apptp true-) append : forall {Γ} -> Γ ` RInv (appendtype true-) map2app {Γ} = ival- map2app* where append {Γ} = ival- append* where map2app* : IMetaFn- Γ map2apptp append* : IMetaFn- Γ appendtype map2app* n m Cx- l1 l2 = append* Czero m Cnil l2 = rfv l2 σid Cut- append append* (Csucc n) m (Ccons x l1) l2 = (Cont- (Ddapp n (Ddapp m (Dapp l1 (Dapp l2 De+)))) case (weaken {! !} (append* n m l1 l2)) of (Ids {! !}) (Cont+ (\app1 -> \l12 -> rfv (Ccons x l12) (Ids {! !}) Cut- append (Cont- (Ddapp m (Ddapp n (Dapp l2 (Dapp l1 De+)))) The meta-function append* is defined recursively: we are using (Ids {! !}) (Cont+ (\app2 -> induction in Agda to do induction in the object language. The case (Cut+ (Val+ app2 (Ids {! !})) focusing syntax makes the evaluation-order explicit in the second (Ident.Ke+ (comm {nat} n m))) of case: do the recursive call, and then compose the result with a \app2’ -> continuation that conses x onto the result. Cut- map2 (Cont- (Ddapp (plus* n m) 5.4 Map (Dapp Cx- (Dapp app1 (Dapp app2’ De+)))) We define a function that maps a two-argument function across two (Ids ?) Ke))))))) lists of the same length: 5.6 Loop map2type = Π- nat (\n -> (↓ (nat → nat → ↑ nat) → vec nat n → vec nat n → ↑ (vec nat n))) To illustrate that our language is compatible with effects such as map2 : forall {Γ} -> Γ ` RInv (map2type true-) non-termination, we write a loop using dom. The essential idea is a map2 {Γ} = ival- map2* where variation of (λx.x x)(λx.x x): map2* : IMetaFn- Γ map2type map2* Czero Cx- Cnil Cnil = rfv Cnil (σe _) loop (Cdom f) = f (Cdom f) map2* (Csucc n) Cx- (Ccons x xs) (Ccons y ys) = explode = loop (Cdom loop) case weaken {! !} (map2* n Cx- xs ys) of \t -> This code is represented as follows: L (sS (sS (sS (s0 i0)))) - (Cont- (Dapp x (Dapp y De+)) (Ids {! !}) loop : forall {Γ} -> Γ ` RInv ((dom → ↑ dom) true ) - (Cont+ (\h -> rfv (Ccons h t) (Ids {! !})))) loop {Γ} = ival (\{_} -> loop*) where loop* : IMetaFn- Γ (dom → ↑ dom) In the second case, we let t be the result of mapping the given loop* Cdom = L (s0 i0) - + function across the tails of the lists, then we let h be the result (Cont (Dapp Cdom De ) of calling the function on the heads, and finally we cons h onto (σ1 (Vx (s0 i0))) Ke) t. Agda’s exhaustiveness checker verifies that the nil/cons and explode : [] ` Neu (dom true+) cons/nil cases are impossible because the lists have the same length. explode = Force.force (Cut- loop (Cont- (Dapp Cdom De+)(σ1 loop) Ke)) 5.5 Map2app To illustrate the need for proofs of type equality, we implement a The function Force.force pattern-matches on the focusing term, function map2app of type which causes Agda to evaluate it and loop. map2apptp = 6. Related Work Π- nat (\n -> Π- nat (\m -> ↓ (nat → nat → ↑ nat) There has been a great deal of work on integrating various forms → vec nat n → vec nat m of dependent types into practical programming languages and their → ↑ (vec nat (plus*{PPos} n m)))) implementations [3, 8, 9, 10, 11, 15, 17, 18, 32, 35, 36, 37, 42, 43, 44, 45, 47, 48, 50, 53], building on dependently typed proof Informally, this function is defined as follows: assistants such as NuPRL [12] and Coq [5]. Our central technical map2app n m f l1 l2 = contribution relative to these type theories is to show how to sup- case (append n m l1 l2) of port a form of dependency within the formalism of higher-order app1 => case (append m n l2 l1) of focusing. app2 => map2 (plus* n m) f app1 app2 Positively dependent types are slightly more parsimonious than those phase-sensitive languages which duplicate types like the nat- I.e., we map the given function across the results of appending ural numbers at the static and dynamic levels [8, 9, 15, 18, 37, 42, the two lists in both orders. However, the second list app2 has 44, 47, 48, 50, 53]. On the other hand, the reason for this dupli- type vec nat (plus* m n), whereas it is expected to have type cation is that these languages commit to the computational irrel- vec nat (plus* n m). Consequently, it is necessary to prove a evance of static data, which gives programmers a way, albeit rel- subtyping relationship inductively: atively coarse-grained, to indicate what data should be passed at run-time. We plan to address this issue both with compiler opti- Acknowledgements mizations that require no programmer input (see Brady [6]) and by We thank Noam Zeilberger for discussions about this work, and we integrating proof irrelevance [4, 33, 38] into the type structure of thank the anonymous reviewers for their helpful feedback. our language, which will provide more fine-grained control. Other languages, such as Delphin [41] and Beluga [39], allow dependency on LF terms, and allow run-time computation with this data, but do References not provide for compile-time computation with it. Unlike phase-insensitive languages [3, 17, 32, 35, 36, 45], pos- [1] T. Altenkirch, C. McBride, and W. Swierstra. Observational itively dependent types make a syntactic distinction between run- equality, now! In Programming Languages meets Program time and compile-time computations, and thus are compatible with Verification Workshop, 2007. standard treatments of effects, as in ML. Positively dependent types [2] J.-M. Andreoli. Logic programming with focusing proofs in are thus a useful first step that can be taken while research on meth- linear logic. Journal of Logic and Computation, 2(3):297– ods of encapsulating effects progresses. One relatively coarse solu- 347, 1992. tion is to confine all effects, including non-termination, to an IO monad. Many more-refined treatments are possible, based on sep- [3] L. Augustsson. Cayenne - a language with dependent types. In arating different effects into different monads [40], treating some International Conference on Functional Programming, 1998. effects comonadically [34], reasoning about effects using purely [4] S. Awodey and A. Bauer. Propositions as [types]. Journal of functional models [46], and reasoning about effects using specifica- Logic and Computation, 14(4):447–471, 2004. tion logics [35]. None of these approaches yet provide a satisfactory [5] Y. Bertot and P. Castéran. Interactive Theorem Proving account of benign effects, where effects are used under-the-hood to and Program Development: Coq’Art: The Calculus of Induc- implement a pure interface (e.g., splay trees). tive Constructions. Texts in Theoretical Computer Science. Polarized intuitionistic logic has the same basic type structure Springer, 2004. as call-by-push-value [25], but the programs of our calculus are different than those of CBPV, which are not fully focalized. Polar- [6] E. Brady. Practical Implementation of a Dependently Typed ized classical logical has been applied to programming in a variety Functional Programming Language. PhD thesis, Durham of ways; e.g, to analyze evaluation order [51] and to emphasize University, 2005. connections with game-theoretic semantics [24]. However, none of [7] M. Chakravarty, G. Keller, and S. P. Jones. Associated type these polarized type theories consider dependent types. synonyms. In ACM SIGPLAN International Conference on Functional Programming, 2005. [8] C. Chen and H. Xi. Combining programming with theorem proving. In International Conference on Functional Program- ming 7. Conclusion , 2005. [9] J. Cheney and R. Hinze. Phantom types. Technical Report In this paper, we have demonstrated how to support a simple but CUCIS TR20003-1901, Cornell University, 2003. useful form of dependency, positively dependent types, within the formalism of higher-order focusing. There are many directions for [10] B. Chin, S. Markstrum, and T. Millstein. Semantic type quali- future work. One is to integrate the dependency considered here fiers. In Programming Language Design and Implementation, with our previous work [29], which considers a positive function 2005. space used to represent variable binding. This would allow depen- [11] J. Condit, M. Harren, Z. Anderson, D. Gay, and G. C. Necula. dency on data with variable binding, as in LF, which is useful for Dependent types for low-level programming. In European representing logical systems. Another direction is to extend our po- Symposium on Programming, 2007. larized type theory with ways of encapsulating effects. This would provide an account of total programming and proof alongside our [12] R. L. Constable, S. F. Allen, H. M. Bromley, W. R. Cleave- current computational language, which allows unrestricted effects, land, J. F. Cremer, R. W. Harper, D. J. Howe, T. B. Knoblock, and is necessary for considering dependency on negative computa- N. P. Mendler, P. Panangaden, J. T. Sasaki, and S. F. Smith. tions. Implementing Mathematics with the NuPRL Proof Develop- Finally, we may consider an implementation of positively de- ment System. Prentice Hall, 1986. pendent types as an extension of ML or Haskell. GHC already im- [13] K. Crary and S. Weirich. Flexible type analysis. In Interna- plements much of the technology necessary: Associated type syn- tional Conference on Functional Programming, 1999. onyms [7] provide a notion of type-level functions which could be [14] J. Dunfield. A Unified System of Type Refinements. PhD thesis, used to realize type-level meta-functions, and of course Haskell Carnegie Mellon University, August 2007. CMU-CS-07-129. supports run-time functions defined by pattern-matching, which can realize the value-level meta-functions. GHC also implements [15] J. Dunfield and F. Pfenning. Tridirectional typechecking. In indexed datatypes (GADTs), but at present these datatypes can only ACM SIGPLAN-SIGACT Symposium on Principles of Pro- be indexed by constructors of kind type. Our proposal is to allow gramming Languages, 2004. these datatypes to additionally be indexed by the values of purely [16] P. Dybjer and A. Setzer. Indexed induction-recursion. In Proof positive types. The primary difficulty is that positive types are hard Theory in Computer Science, pages 93–113. Springer, 2001. to come by in Haskell: tuples are more -like than ⊗-like, and sums build in shifts (Either A- B- can beN read as ↑(↓A- ⊕ ↓B-)). [17] C. Flanagan. Hybrid type checking. In ACM SIGPLAN- One solution would be to allow dependency only on datatypes with SIGACT Symposium on Principles of Programming Lan- strictness annotations at each recursive call (data Nat = Z | S guages, pages 245–256, 2006. !Nat) and to treat the dependent function type Π- as call-by-value, [18] S. Fogarty, E. Pasalic, J. Siek, and W. Taha. Concoqtion: rather than call-by-name. Adding positively dependent types to ML indexed types now! In ACM SIGPLAN symposium on Partial would be easier, as ML sums and products of purely positive types evaluation and semantics-based program manipulation, pages are purely positive. 112–121, New York, NY, USA, 2007. ACM Press. [19] J.-Y. Girard. Locus solum: From the rules of logic to the logic [37] S. Peyton Jones, D. Vytiniotis, S. Weirich, and G. Washburn. of rules. Mathematical Structures in Computer Science, 11 Simple unification-based type inference for GADTs. In ACM (3):301–506, 2001. SIGPLAN International Conference on Functional Program- [20] J.-Y. Girard. On the unity of logic. Annals of pure and applied ming, 2006. logic, 59(3):201–217, 1993. [38] F. Pfenning. Intensionality, extensionality, and proof irrele- [21] R. Harper and G. Morrisett. Compiling polymorphism using vance in modal type theory. In IEEE Symposium on Logic in intensional type analysis. In Symposium on Principles of Computer Science, 2001. Programming Languages, 1995. [39] B. Pientka. A type-theoretic foundation for programming with [22] R. Harper, J. C. Mitchell, and E. Moggi. Higher-order mod- higher-order abstract syntax and first-class substitutions. In ules and the phase distinction. In Symposium on Principles of ACM SIGPLAN-SIGACT Symposium on Principles of Pro- Programming Languages, 1990. gramming Languages, pages 371–382, 2008. [23] R. Harper, F. Honsell, and G. Plotkin. A framework for [40] G. Plotkin and J. Power. Notions of computation determine defining logics. Journal of the Association for Computing monads. In Proc. FOSSACS 2002, Lecture Notes in Computer Machinery, 40(1), 1993. Science 2303, pages 342–356. Springer, 2002. [24] O. Laurent. Etude de la polarisation en logique. Thèse de [41] A. Poswolsky and C. Schürmann. Practical programming with doctorat, Université Aix-Marseille II, Mar. 2002. higher-order encodings and dependent types. In European Symposium on Programming, 2008. [25] P. B. Levy. Call-by-push-value. PhD thesis, Queen Mary, University of London, 2001. [42] S. Sarkar. A cost-effective foundational certified code system. Thesis Proposal, Carenegie Mellon University, 2005. [26] C. Liang and D. Miller. Focusing and polarization in intu- itionistic logic. In J. Duparc and T. A. Henzinger, editors, [43] Z. Shao, V. Trifonov, B. Saha, and N. Papaspyrou. A type sys- CSL 2007: Computer Science Logic, volume 4646 of LNCS, tem for certified binaries. ACM Transactions on Programming pages 451–465. Springer-Verlag, 2007. Languages and Systems, 27(1):1–45, 2005. [27] D. R. Licata. Dependently typed programming with [44] T. Sheard. Languages of the future. In Conference on Object- domain-specific logics (thesis proposal). Available from Oriented Programming, Systems, Languages, and Applica- http://www.cs.cmu.edu/~drl, 2008. tions, 2004. [28] D. R. Licata and R. Harper. A formulation of Dependent ML [45] M. Sozeau. PROGRAM-ing finger trees in Coq. In ACM SIG- with explicit equality proofs. Technical Report CMU-CS- PLAN International Conference on Functional Programming. 05-178, Department of Computer Science, Carnegie Mellon Association for Computing Machinery, 2007. University, 2005. [46] W. Swierstra and T. Altenkirch. Beauty in the beast: A func- [29] D. R. Licata, N. Zeilberger, and R. Harper. Focusing on tional semantics of the awkward squad. In ACM SIGPLAN binding and computation. In IEEE Symposium on Logic in Workshop on Haskell, pages 25–36, 2007. Computer Science, 2008. [47] E. Westbrook, A. Stump, and I. Wehrman. A language-based [30] W. Lovas and F. Pfenning. A bidirectional refinement type approach to functionally correct imperative programming. In system for LF. Electronic Notes in Theoretical Computer International Conference on Functional Programming, 2005. Science, 196:113–128, 2008. [48] H. Xi and F. Pfenning. Eliminating array bound checking [31] P. Martin-Löf. Hauptsatz for the intuitionistic theory of iter- through dependent types. In Conference on Programming ated inductive definitions. In J. E. Fenstad, editor, Proceedings Language Design and Implementation, 1998. of the Second Scandinavian Logic Symposium, pages 179– [49] H. Xi and F. Pfenning. Dependent types in practical program- 216, Amsterdam, 1971. North Holland. ming. In ACM SIGPLAN-SIGACT Symposium on Principles [32] C. McBride and J. McKinna. The view from the left. Journal of Programming Languages, 1999. of Functional Programming, 15(1), 2004. [50] H. Xi, C. Chen, and G. Chen. Guarded recursive datatype con- [33] A. Miquel. The implicit calculus of constructions: Extending structors. In ACM SIGPLAN-SIGACT Symposium on Princi- pure type systems with an intersection type binder and subtyp- ples of Programming Languages, 2003. ing. In International Conference on Typed Lambda Calculi [51] N. Zeilberger. On the unity of duality. Annals of Pure and and Applications, 2001. Applied Logic, 153(1–3), 2008. Special issue on “Classical [34] A. Nanevski. A modal calculus for exception handling. In Logic and Computation”. Intuitionistic Modal Logic and Applications, 2005. [52] N. Zeilberger. Focusing and higher-order abstract syntax. In [35] A. Nanevski, G. Morrisett, and L. Birkedal. Polymorphism ACM SIGPLAN-SIGACT Symposium on Principles of Pro- and separation in Hoare Type Theory. In ACM SIGPLAN gramming Languages, pages 359–369, 2008. International Conference on Functional Programming, pages [53] C. Zenger. Indizierte Typen. PhD thesis, Universit at Karl- 62–73, Portland, Oregon, 2006. sruhe, 1998. [36] U. Norell. Towards a practical programming language based on dependent type theory. PhD thesis, Chalmers University of Technology, 2007.