saved
The internet discovers TLA+. Now what?
Hraness wrote this summary from a saved copy of the source. Quotations are taken word for word from the source.
gist
Reasonable introduces TLA+ after Boris Cherny's viral Claude Agent SDK modeling post and treats formal models as a start toward machine-checked software. TLA+ describes allowed behaviours and temporal properties; TLC checks finite instances, not the implementation. The team routes specs into Verus proofs beside Rust and reports more than 3,000 machine-checked safety and liveness proofs from 16,459 TLA+ specification/property pairs.
ideas
- TLA+ models behaviours and temporal properties, not finished software. States and actions define what can happen; safety and liveness say what must always or eventually hold.
- TLC only explores finite instances. Three computers yield 38 states; nine yield more than a million, so general claims need proofs rather than exhaustive search.
- The model is not the implementation. Specs and code can drift, which is the classic gap between verifying a model and verifying the program.
- Verus keeps specs and proofs next to Rust. That path can prove an implementation refines the model instead of stopping at an abstract checker.
- Agents already automate much of the boring proof work. Reasonable's pipeline turned 16,459 TLA+ pairs into more than 3,000 machine-checked Verus proofs with a prover–reviewer loop and anti-cheat gates.
quotes
“TLA+ itself does not fully verify an implementation.”
“A system that does nothing forever is perfectly safe.”
“Because specifications and proofs can live alongside the real Rust implementation.”
“Starting from 16,459 real-world TLA+ specification/property pairs, the pipeline produced more than 3,000 machine-checked safety and liveness proofs.”