### Formation Rules for Strictly Positive Types

For my thesis I've needed to use strictly positive types to avoid the problems which can occur with types of the form: νD. D → D, which were discussed briefly in my post System F is Amazing.

In order to ensure types are positive they should be restricted in some way.  It is therefore convenient to have formation rules for types which ensure that we can't make bad types. My starting point was a wonderful paper by Andreas Abel and Thorsten Altenkirch [1]

Specifically, this paper describes interleaved inductive types, which is close to what I want.   However, I also want to be able to have polymorphism using ∀.  Since I'm interested in becoming more familiar with Agda (a language in which I'm still a novice) I've written the following as a prototype of my type formation rules, as an experiment.

First, we have to set up the appropriate libraries.

```module StrictlyPositive where

open import Data.Nat
open import Data.Bool
open import Data.List
open import Data.Unit using (⊤)
open import Relation.Nullary.Core
open import Data.Sum
```

The first data type we define is a context of type variables. Since we are going to use de Bruijn indices, we can use a trick and say that the type variable context is really just a bound on the number of free variables. Since our types are not themselves typed (as our theory is impredicative) we are justified in doing this as the only information needed formation is that the variable is in a context.

```Ctx : Set
Ctx = ℕ
```

We then define an ∈ relation which is true whenever a variable is below the bound.

```data _∈_ : ℕ → Ctx → Set where
bounded : ∀ {n Δ} → suc n ≤ Δ → n ∈ Δ
```

It turns out to be convenient to define lemmas which perform inversions on data-types in Agda. In Coq, I would generally just use a tactic to perform the inversion. However, there are advantages to Agda's way of doing things, one of which is that it obviates a lot of playing with equational reasoning. So far I've yet to be forced to learn how equational reasoning works in Agda since I haven't had to use it. I'm a little frightened that things work so well!

```inInversion : ∀ {n Δ} → n ∈ Δ → suc n ≤ Δ
inInversion (bounded p) = p
```

Next we prove that ∈ is decidable, which is pretty straight forward since it is defined using ≤ on natural numbers.

```inctx : ∀ n Δ → Dec (n ∈ Δ)
inctx n Δ with (suc n) ≤? Δ
inctx n Δ | no p = no (λ x → p (inInversion x))
inctx n Δ | yes q  = yes (bounded q)
```

Next we define the syntax for types. We have ① for unit, ι which creates a type variable, η which creates a fixed-point type variable, ⇒ which is the function type, × which is the type of a pair, ⊕ which is the type of an injection into the left or right, μ which makes a fixed point, and Π which is the type of a type abstraction.

```data Ty : Set where
① : Ty
ι : ℕ → Ty
η : ℕ → Ty
_⇒_ : Ty → Ty → Ty
_×_ : Ty → Ty → Ty
_⊕_ : Ty → Ty → Ty
μ : Ty → Ty
Π : Ty → Ty
```

Next we demonstrate the formation rules. Here we use two contexts. One is for ι variables, the other for η. The reason for segregating them is that we can allow ι variables to be placed more freely, while η variables need to be tightly controlled to ensure strictly positive types. The restriction manifests itself in the rule for ⇒, which allows formation with a type to the left of the arrow, only if the context for η vars is empty. The reader will notice that every time we go under a Π binder, the first context is increased in size, and every time we go under a μ, we increase the second. When we check that variables are in context, we refer to these segregated contexts with our two different type variables.

```data _·_⊢_ : Ctx → Ctx → Ty → Set where
UnitValid : ∀ {Δ Δ+} →
Δ · Δ+ ⊢ ①
VarValid : ∀ {n Δ Δ+} →
(n ∈ Δ) →
Δ · Δ+ ⊢ (ι n)
FixValid : ∀ {n Δ Δ+} →
(n ∈ Δ+) →
Δ · Δ+ ⊢ (η n)
ImpValid : ∀ {Δ Δ+ α β} →
Δ · 0 ⊢ α →
Δ · Δ+ ⊢ β →
Δ · Δ+ ⊢ (α ⇒ β)
AndValid : ∀ {Δ Δ+ α β} →
Δ · Δ+ ⊢ α →
Δ · Δ+ ⊢ β →
Δ · Δ+ ⊢ (α × β)
OrValid : ∀ {Δ Δ+ α β} →
Δ · Δ+ ⊢ α →
Δ · Δ+ ⊢ β →
Δ · Δ+ ⊢ (α ⊕ β)
MuValid : ∀ {Δ Δ+ α} →
Δ · (suc Δ+) ⊢ α →
Δ · Δ+ ⊢ μ α
AllValid : ∀ {Δ Δ+ α} →
(suc Δ) · Δ+ ⊢ α →
Δ · Δ+ ⊢ Π α
```

Again, we find it convenient to define a number of inversion rules, this type on type formation.

```varValidInversion : ∀ {Δ Δ+ n} → Δ · Δ+ ⊢ ι n → n ∈ Δ
varValidInversion {Δ} {Δ+} {n} (VarValid p) = p

fixValidInversion : ∀ {Δ Δ+ n} → Δ · Δ+ ⊢ η n → n ∈ Δ+
fixValidInversion {Δ} {Δ+} {n} (FixValid p) = p

orValidInversionL : ∀ {Δ Δ+ α β} → Δ · Δ+ ⊢ (α ⊕ β) → (Δ · Δ+ ⊢ α)
orValidInversionL {Δ} {Δ+} {α} {β} (OrValid p q) = p

orValidInversionR : ∀ {Δ Δ+ α β} → Δ · Δ+ ⊢ (α ⊕ β) → (Δ · Δ+ ⊢ β)
orValidInversionR {Δ} {Δ+} {α} {β} (OrValid p q) = q

impValidInversionL : ∀ {Δ Δ+ α β} → Δ · Δ+ ⊢ (α ⇒ β) → (Δ · 0 ⊢ α)
impValidInversionL {Δ} {Δ+} {α} {β} (ImpValid p q) = p

impValidInversionR : ∀ {Δ Δ+ α β} → Δ · Δ+ ⊢ (α ⇒ β) → (Δ · Δ+ ⊢ β)
impValidInversionR {Δ} {Δ+} {α} {β} (ImpValid p q) = q

andValidInversionL : ∀ {Δ Δ+ α β} → Δ · Δ+ ⊢ (α × β) → (Δ · Δ+ ⊢ α)
andValidInversionL {Δ} {Δ+} {α} {β} (AndValid p q) = p

andValidInversionR : ∀ {Δ Δ+ α β} → Δ · Δ+ ⊢ (α × β) → (Δ · Δ+ ⊢ β)
andValidInversionR {Δ} {Δ+} {α} {β} (AndValid p q) = q

allValidInversion : ∀ {Δ Δ+ α} → Δ · Δ+ ⊢ Π α → ((suc Δ) · Δ+ ⊢ α)
allValidInversion {Δ} {Δ+} {α} (AllValid p) = p

muValidInversion : ∀ {Δ Δ+ α} → Δ · Δ+ ⊢ μ α → (Δ · (suc Δ+) ⊢ α)
muValidInversion {Δ} {Δ+} {α} (MuValid p) = p
```

Now we would like to show that we can demonstrate whether or not a type is valid or not. This program will construct a proof of the validity of a given type, or reject it with a proof that one can not be constructed. Intermediate computations which attempt to construct subproofs or proofs that no subproof exists are done using with. This allows us to further pattern much, just as we would do with parameters of functions in Haskell. The notation (λ { (VarValid q) p q }) is especially cool. It is a pattern matching lambda, which allows us to destruct the argument with each possible case. In this case, because of the type, there is exactly one case which allows us to prove that this type can not be valid.

```isValid : ∀ Δ Δ+ α → Dec (Δ · Δ+ ⊢ α)
isValid Δ Δ+ ①       = yes UnitValid
isValid Δ Δ+ (ι n)   with (inctx n Δ)
isValid Δ Δ+ (ι n)   | yes p = yes (VarValid p)
isValid Δ Δ+ (ι n)   | no p  = no (λ { (VarValid q) → p q })
isValid Δ Δ+ (η n)   with (inctx n Δ+)
isValid Δ Δ+ (η n)   | yes p = yes (FixValid p)
isValid Δ Δ+ (η n)   | no p  = no (λ { (FixValid q) → p q })
isValid Δ Δ+ (α ⇒ β) with isValid Δ 0 α
isValid Δ Δ+ (α ⇒ β) | yes p with isValid Δ Δ+ β
isValid Δ Δ+ (α ⇒ β) | yes p | yes q = yes (ImpValid p q)
isValid Δ Δ+ (α ⇒ β) | yes p | no q  = no (λ x → q (impValidInversionR x))
isValid Δ Δ+ (α ⇒ β) | no p  = no (λ x → p (impValidInversionL x))
isValid Δ Δ+ (α × β) with isValid Δ Δ+ α
isValid Δ Δ+ (α × β) | yes p with isValid Δ Δ+ β
isValid Δ Δ+ (α × β) | yes p | yes q = yes (AndValid p q)
isValid Δ Δ+ (α × β) | yes p | no q  = no (λ x → q (andValidInversionR x))
isValid Δ Δ+ (α × β) | no p  = no (λ x → p (andValidInversionL x))
isValid Δ Δ+ (α ⊕ β) with isValid Δ Δ+ α
isValid Δ Δ+ (α ⊕ β) | yes p with isValid Δ Δ+ β
isValid Δ Δ+ (α ⊕ β) | yes p | yes q = yes (OrValid p q)
isValid Δ Δ+ (α ⊕ β) | yes p | no q  = no (λ x → q (orValidInversionR x))
isValid Δ Δ+ (α ⊕ β) | no p  = no (λ x → p (orValidInversionL x))
isValid Δ Δ+ (Π α)   with isValid (suc Δ) Δ+ α
isValid Δ Δ+ (Π α)   | yes p = yes (AllValid p)
isValid Δ Δ+ (Π α)   | no p  = no (λ x → p (allValidInversion x))
isValid Δ Δ+ (μ α)   with isValid Δ (suc Δ+) α
isValid Δ Δ+ (μ α)   | yes p = yes (MuValid p)
isValid Δ Δ+ (μ α)   | no p  = no (λ x → p (muValidInversion x))
```

Finally we give an example of some terms which can be typed, and some which can not. When there is no inhabitant of a pattern in Agda, we can use (). Agda is smart enough to know that there is no sense in a right-hand-side of a pattern which has no inhabitants because the type is indexed in such a way that inversion would yield no cases. It's very clever!

```idTy : Ty
idTy = Π ((ι zero) ⇒ (ι zero))

idValid : 0 · 0 ⊢ idTy
idValid = AllValid
(ImpValid (VarValid (bounded (s≤s z≤n)))
(VarValid (bounded (s≤s z≤n))))

listTy : Ty
listTy = Π (μ (① ⊕ ((ι 0) × (η 0))))

listValid : 0 · 0 ⊢ listTy
listValid = AllValid
(MuValid
(OrValid UnitValid
(AndValid (VarValid (bounded (s≤s z≤n)))
(FixValid (bounded (s≤s z≤n))))))

notPos : Ty
notPos = μ ((ι 0) ⇒ (ι 0))

notPosInvalid : ¬ (0 · 0 ⊢ notPos)
notPosInvalid x with muValidInversion x
notPosInvalid x | p with impValidInversionL p
notPosInvalid x | p | q with varValidInversion q
notPosInvalid x | p | q | bounded ()

dodgy : Ty
dodgy = μ (μ ((ι 1) ⇒ (ι 0)))

dodgyInvalid :  ¬ (0 · 0 ⊢ dodgy)
dodgyInvalid x with muValidInversion x
dodgyInvalid x | p with muValidInversion p
dodgyInvalid x | p | q with impValidInversionL q
dodgyInvalid x | p | q | r with varValidInversion r
dodgyInvalid x | p | q | r | bounded ()

isThisDodgy : Ty
isThisDodgy = Π (μ (μ ((((ι 0) ⇒ (η 1)) ⇒ (η 0)))))

isThisDodgyValid : ¬ (0 · 0 ⊢ isThisDodgy)
isThisDodgyValid x with allValidInversion x
isThisDodgyValid x | p with muValidInversion p
isThisDodgyValid x | p | q with muValidInversion q
isThisDodgyValid x | p | q | r with impValidInversionL r
isThisDodgyValid x | p | q | r | s with impValidInversionR s
isThisDodgyValid x | p | q | r | s | t with fixValidInversion t
isThisDodgyValid x | p | q | r | s | t | bounded ()

```

[1] A Predicative Strong Normalisation Proof for a λ-calculus with Interleaving Inductive Types

### Decidable Equality in Agda

So I've been playing with typing various things in System-F which previously I had left with auxiliary well-formedness conditions. This includes substitutions and contexts, both of which are interesting to have well typed versions of. Since I've been learning Agda, it seemed sensible to carry out this work in that language, as there is nothing like a problem to help you learn a language.

In the course of proving properties, I ran into the age old problem of showing that equivalence is decidable between two objects. In this particular case, I need to be able to show the decidability of equality over types in System F in order to have formation rules for variable contexts. We'd like a context Γ to have (x:A) only if (x:B) does not occur in Γ when (A ≠ B). For us to have statements about whether two types are equal or not, we're going to need to be able to decide if that's true using a terminating procedure.

And so we arrive at our story. In Coq, equality is som…

### Formalisation of Tables in a Dependent Language

I've had an idea kicking about in my head for a while of making query plans explicit in SQL in such a way that one can be assured that the query plan corresponds to the SQL statement desired. The idea is something like a Curry-Howard in a relational setting. One could infer the plan from the SQL, the SQL from the plan, or do a sort of "type-checking" to make sure that the plan corresponds to the SQL.

The devil is always in the details however. When I started looking at the primitives that I would need, it turns out that the low level table joining operations are actually not that far from primitive SQL statement themselves. I decided to go ahead and formalise some of what would be necessary in Agda in order get a better feel for the types of objects I would need and the laws which would be required to demonstrate that a plan corresponded with a statement.

Dependent types are very powerful and give you plenty of rope to hang yourself. It's always something of…

### Plotkin, the LGG and the MGU

Legend has it that a million years ago Plotkin was talking to his professor Popplestone, who said that unification (finding the most general unifier or the MGU) might have an interesting dual, and that Plotkin should find it. It turns out that the dual *is* interesting and it is known as the Least General Generalisation (LGG). Plotkin apparently described both the LGG for terms, and for clauses. I say apparently because I can't find his paper on-line.

The LGG for clauses is more complicated so we'll get back to it after we look at the LGG of terms. We can see how the MGU is related to the LGG by looking at a couple of examples and the above image. We use the prolog convention that function symbols start with lower case, and variables start with uppercase. The image above is organised as a DAG (Directed Acyclic Graph). DAGs are a very important structure in mathematics since DAGs are lattices.

Essentially what we have done is drawn an (incomplete) Hasse diagram f…