[STATEMENT]
lemma connect_real: "connect D (obsf_resource real_resource) = connect D (obsf_resource (RES (fused_resource.fuse (lazy_core DH0_sample) lazy_rest) (basic_core_sinit, basic_rest_sinit)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. connect_obsf D (obsf_resource real_resource) = connect_obsf D (obsf_resource (RES (fused_resource.fuse (lazy_core DH0_sample) lazy_rest) (basic_core_sinit, basic_rest_sinit)))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. connect_obsf D (obsf_resource real_resource) = connect_obsf D (obsf_resource (RES (fused_resource.fuse (lazy_core DH0_sample) lazy_rest) (basic_core_sinit, basic_rest_sinit)))
[PROOF STEP]
have [simp]: "\<I>_full \<turnstile>res real_resource \<surd>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<I>_full \<turnstile>res real_resource \<surd>
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<I>_full \<turnstile>res real_resource \<surd>
[PROOF STEP]
have [simp]: "\<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full) \<turnstile>res RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest') \<surd>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full) \<turnstile>res RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest') \<surd>
[PROOF STEP]
apply (rule WT_resource_of_oracle)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. \<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full) \<turnstile>c fused_resource.fuse real_core' real_rest' s \<surd>
[PROOF STEP]
apply (rule WT_calleeI)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s call ret sa. \<lbrakk>call \<in> outs_\<I> (\<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse real_core' real_rest' s call)\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> (\<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full)) call
[PROOF STEP]
subgoal for s q
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>q \<in> outs_\<I> (\<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full)); (ret_, sa_) \<in> set_spmf (fused_resource.fuse real_core' real_rest' s q)\<rbrakk> \<Longrightarrow> ret_ \<in> responses_\<I> (\<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full)) q
[PROOF STEP]
apply (cases s, cases q, rename_tac [!] x, case_tac [!] x)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>a b c d x aa. \<lbrakk>q \<in> outs_\<I> (\<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full)); (ret_, sa_) \<in> set_spmf (fused_resource.fuse real_core' real_rest' s q); s = (a, b, c, d); q = Inl x; x = Inl aa\<rbrakk> \<Longrightarrow> ret_ \<in> responses_\<I> (\<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full)) q
 2. \<And>a b c d x ba. \<lbrakk>q \<in> outs_\<I> (\<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full)); (ret_, sa_) \<in> set_spmf (fused_resource.fuse real_core' real_rest' s q); s = (a, b, c, d); q = Inl x; x = Inr ba\<rbrakk> \<Longrightarrow> ret_ \<in> responses_\<I> (\<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full)) q
 3. \<And>a b c d x aa. \<lbrakk>q \<in> outs_\<I> (\<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full)); (ret_, sa_) \<in> set_spmf (fused_resource.fuse real_core' real_rest' s q); s = (a, b, c, d); q = Inr x; x = Inl aa\<rbrakk> \<Longrightarrow> ret_ \<in> responses_\<I> (\<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full)) q
 4. \<And>a b c d x ba. \<lbrakk>q \<in> outs_\<I> (\<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full)); (ret_, sa_) \<in> set_spmf (fused_resource.fuse real_core' real_rest' s q); s = (a, b, c, d); q = Inr x; x = Inr ba\<rbrakk> \<Longrightarrow> ret_ \<in> responses_\<I> (\<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full)) q
[PROOF STEP]
prefer 3
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>a b c d x aa. \<lbrakk>q \<in> outs_\<I> (\<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full)); (ret_, sa_) \<in> set_spmf (fused_resource.fuse real_core' real_rest' s q); s = (a, b, c, d); q = Inr x; x = Inl aa\<rbrakk> \<Longrightarrow> ret_ \<in> responses_\<I> (\<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full)) q
 2. \<And>a b c d x aa. \<lbrakk>q \<in> outs_\<I> (\<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full)); (ret_, sa_) \<in> set_spmf (fused_resource.fuse real_core' real_rest' s q); s = (a, b, c, d); q = Inl x; x = Inl aa\<rbrakk> \<Longrightarrow> ret_ \<in> responses_\<I> (\<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full)) q
 3. \<And>a b c d x ba. \<lbrakk>q \<in> outs_\<I> (\<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full)); (ret_, sa_) \<in> set_spmf (fused_resource.fuse real_core' real_rest' s q); s = (a, b, c, d); q = Inl x; x = Inr ba\<rbrakk> \<Longrightarrow> ret_ \<in> responses_\<I> (\<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full)) q
 4. \<And>a b c d x ba. \<lbrakk>q \<in> outs_\<I> (\<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full)); (ret_, sa_) \<in> set_spmf (fused_resource.fuse real_core' real_rest' s q); s = (a, b, c, d); q = Inr x; x = Inr ba\<rbrakk> \<Longrightarrow> ret_ \<in> responses_\<I> (\<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full)) q
[PROOF STEP]
subgoal for s_cnv_core _ _ _ _ y
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>q \<in> outs_\<I> (\<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full)); (ret_, sa_) \<in> set_spmf (fused_resource.fuse real_core' real_rest' s q); s = (s_cnv_core, b_, c_, d_); q = Inr x_; x_ = Inl y\<rbrakk> \<Longrightarrow> ret_ \<in> responses_\<I> (\<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full)) q
[PROOF STEP]
apply (cases s_cnv_core, rename_tac s_cnvs s_auth1 s_kern2 s_shell2)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s_cnvs s_auth1 s_kern2 s_shell2. \<lbrakk>q \<in> outs_\<I> (\<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full)); (ret_, sa_) \<in> set_spmf (fused_resource.fuse real_core' real_rest' s q); s = (s_cnv_core, b_, c_, d_); q = Inr x_; x_ = Inl y; s_cnv_core = (s_cnvs, s_auth1, s_kern2, s_shell2)\<rbrakk> \<Longrightarrow> ret_ \<in> responses_\<I> (\<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full)) q
[PROOF STEP]
apply (case_tac s_auth1, rename_tac s_kern1 s_shell1)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s_cnvs s_auth1 s_kern2 s_shell2 s_kern1 s_shell1. \<lbrakk>q \<in> outs_\<I> (\<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full)); (ret_, sa_) \<in> set_spmf (fused_resource.fuse real_core' real_rest' s q); s = (s_cnv_core, b_, c_, d_); q = Inr x_; x_ = Inl y; s_cnv_core = (s_cnvs, s_auth1, s_kern2, s_shell2); s_auth1 = (s_kern1, s_shell1)\<rbrakk> \<Longrightarrow> ret_ \<in> responses_\<I> (\<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full)) q
[PROOF STEP]
apply (case_tac s_cnvs, rename_tac su s_cnv1 s_cnv2)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s_cnvs s_auth1 s_kern2 s_shell2 s_kern1 s_shell1 su s_cnv1 s_cnv2. \<lbrakk>q \<in> outs_\<I> (\<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full)); (ret_, sa_) \<in> set_spmf (fused_resource.fuse real_core' real_rest' s q); s = (s_cnv_core, b_, c_, d_); q = Inr x_; x_ = Inl y; s_cnv_core = (s_cnvs, s_auth1, s_kern2, s_shell2); s_auth1 = (s_kern1, s_shell1); s_cnvs = (su, s_cnv1, s_cnv2)\<rbrakk> \<Longrightarrow> ret_ \<in> responses_\<I> (\<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full)) q
[PROOF STEP]
apply (cases y, rename_tac [!] z, case_tac [!] z, rename_tac [!] query)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>s_cnvs s_auth1 s_kern2 s_shell2 s_kern1 s_shell1 su s_cnv1 s_cnv2 z query. \<lbrakk>q \<in> outs_\<I> (\<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full)); (ret_, sa_) \<in> set_spmf (fused_resource.fuse real_core' real_rest' s q); s = (s_cnv_core, b_, c_, d_); q = Inr x_; x_ = Inl y; s_cnv_core = (s_cnvs, s_auth1, s_kern2, s_shell2); s_auth1 = (s_kern1, s_shell1); s_cnvs = (su, s_cnv1, s_cnv2); y = Inl z; z = Inl query\<rbrakk> \<Longrightarrow> ret_ \<in> responses_\<I> (\<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full)) q
 2. \<And>s_cnvs s_auth1 s_kern2 s_shell2 s_kern1 s_shell1 su s_cnv1 s_cnv2 z query. \<lbrakk>q \<in> outs_\<I> (\<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full)); (ret_, sa_) \<in> set_spmf (fused_resource.fuse real_core' real_rest' s q); s = (s_cnv_core, b_, c_, d_); q = Inr x_; x_ = Inl y; s_cnv_core = (s_cnvs, s_auth1, s_kern2, s_shell2); s_auth1 = (s_kern1, s_shell1); s_cnvs = (su, s_cnv1, s_cnv2); y = Inl z; z = Inr query\<rbrakk> \<Longrightarrow> ret_ \<in> responses_\<I> (\<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full)) q
 3. \<And>s_cnvs s_auth1 s_kern2 s_shell2 s_kern1 s_shell1 su s_cnv1 s_cnv2 z query. \<lbrakk>q \<in> outs_\<I> (\<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full)); (ret_, sa_) \<in> set_spmf (fused_resource.fuse real_core' real_rest' s q); s = (s_cnv_core, b_, c_, d_); q = Inr x_; x_ = Inl y; s_cnv_core = (s_cnvs, s_auth1, s_kern2, s_shell2); s_auth1 = (s_kern1, s_shell1); s_cnvs = (su, s_cnv1, s_cnv2); y = Inr z; z = Inl query\<rbrakk> \<Longrightarrow> ret_ \<in> responses_\<I> (\<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full)) q
 4. \<And>s_cnvs s_auth1 s_kern2 s_shell2 s_kern1 s_shell1 su s_cnv1 s_cnv2 z query. \<lbrakk>q \<in> outs_\<I> (\<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full)); (ret_, sa_) \<in> set_spmf (fused_resource.fuse real_core' real_rest' s q); s = (s_cnv_core, b_, c_, d_); q = Inr x_; x_ = Inl y; s_cnv_core = (s_cnvs, s_auth1, s_kern2, s_shell2); s_auth1 = (s_kern1, s_shell1); s_cnvs = (su, s_cnv1, s_cnv2); y = Inr z; z = Inr query\<rbrakk> \<Longrightarrow> ret_ \<in> responses_\<I> (\<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full)) q
[PROOF STEP]
apply (auto simp add: fused_resource.fuse.simps split_def apfst_def)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>s_kern2 s_shell2 s_kern1 s_shell1 s_cnv1 s_cnv2 query ab ac bb ad bc ae bd. \<lbrakk>s = ((((), s_cnv1, s_cnv2), (s_kern1, s_shell1), s_kern2, s_shell2), b_, c_, d_); q = Inr (Inl (Inl (Inl query))); x_ = Inl (Inl (Inl query)); s_cnv_core = (((), s_cnv1, s_cnv2), (s_kern1, s_shell1), s_kern2, s_shell2); y = Inl (Inl query); ((ab, ac, bb), (ad, bc), ae, bd) \<in> set_spmf (exec_gpv (auth.iface_usr \<ddagger>\<^sub>O auth.iface_usr) (map_gpv' (map_prod (lsumr \<circ> (map_sum id (rsuml \<circ> (map_sum swap_sum id \<circ> lsumr)) \<circ> rsuml)) id) (map_sum id swap_sum \<circ> (lsumr \<circ> map_sum id (rsuml \<circ> map_sum swap_sum id \<circ> lsumr) \<circ> rsuml)) (lsumr \<circ> (map_sum id (rsuml \<circ> (map_sum swap_sum id \<circ> lsumr)) \<circ> rsuml) \<circ> map_sum id swap_sum) (left_gpv (map_gpv (map_prod Inl (\<lambda>s1'. (s1', s_cnv2))) id (alice_callee s_cnv1 (Inl query))))) ((s_kern1, s_shell1), s_kern2, s_shell2)); sa_ = ((((), ac, bb), (ad, bc), ae, bd), b_, c_, d_); ret_ = Inr (Inl ab)\<rbrakk> \<Longrightarrow> Inr (Inl ab) \<in> Inr ` Inl ` range Inl
 2. \<And>s_kern2 s_shell2 s_kern1 s_shell1 s_cnv1 s_cnv2 query ab ac bb ad bc ae bd. \<lbrakk>s = ((((), s_cnv1, s_cnv2), (s_kern1, s_shell1), s_kern2, s_shell2), b_, c_, d_); q = Inr (Inl (Inl (Inr query))); x_ = Inl (Inl (Inr query)); s_cnv_core = (((), s_cnv1, s_cnv2), (s_kern1, s_shell1), s_kern2, s_shell2); y = Inl (Inr query); ((ab, ac, bb), (ad, bc), ae, bd) \<in> set_spmf (exec_gpv (auth.iface_usr \<ddagger>\<^sub>O auth.iface_usr) (map_gpv' (map_prod (lsumr \<circ> (map_sum id (rsuml \<circ> (map_sum swap_sum id \<circ> lsumr)) \<circ> rsuml)) id) (map_sum id swap_sum \<circ> (lsumr \<circ> map_sum id (rsuml \<circ> map_sum swap_sum id \<circ> lsumr) \<circ> rsuml)) (lsumr \<circ> (map_sum id (rsuml \<circ> (map_sum swap_sum id \<circ> lsumr)) \<circ> rsuml) \<circ> map_sum id swap_sum) (right_gpv (map_gpv (map_prod Inr (Pair s_cnv1)) id (bob_callee s_cnv2 (Inl query))))) ((s_kern1, s_shell1), s_kern2, s_shell2)); sa_ = ((((), ac, bb), (ad, bc), ae, bd), b_, c_, d_); ret_ = Inr (Inl ab)\<rbrakk> \<Longrightarrow> Inr (Inl ab) \<in> Inr ` Inl ` range Inl
 3. \<And>s_kern2 s_shell2 s_kern1 s_shell1 s_cnv1 s_cnv2 query ab ac bb ad bc ae bd. \<lbrakk>s = ((((), s_cnv1, s_cnv2), (s_kern1, s_shell1), s_kern2, s_shell2), b_, c_, d_); q = Inr (Inl (Inr (Inl query))); x_ = Inl (Inr (Inl query)); s_cnv_core = (((), s_cnv1, s_cnv2), (s_kern1, s_shell1), s_kern2, s_shell2); y = Inr (Inl query); ((ab, ac, bb), (ad, bc), ae, bd) \<in> set_spmf (exec_gpv (auth.iface_usr \<ddagger>\<^sub>O auth.iface_usr) (map_gpv' (map_prod (lsumr \<circ> (map_sum id (rsuml \<circ> (map_sum swap_sum id \<circ> lsumr)) \<circ> rsuml)) id) (map_sum id swap_sum \<circ> (lsumr \<circ> map_sum id (rsuml \<circ> map_sum swap_sum id \<circ> lsumr) \<circ> rsuml)) (lsumr \<circ> (map_sum id (rsuml \<circ> (map_sum swap_sum id \<circ> lsumr)) \<circ> rsuml) \<circ> map_sum id swap_sum) (left_gpv (map_gpv (map_prod Inl (\<lambda>s1'. (s1', s_cnv2))) id (alice_callee s_cnv1 (Inr query))))) ((s_kern1, s_shell1), s_kern2, s_shell2)); sa_ = ((((), ac, bb), (ad, bc), ae, bd), b_, c_, d_); ret_ = Inr (Inl ab)\<rbrakk> \<Longrightarrow> Inr (Inl ab) \<in> Inr ` Inl ` range Inr
 4. \<And>s_kern2 s_shell2 s_kern1 s_shell1 s_cnv1 s_cnv2 query ab ac bb ad bc ae bd. \<lbrakk>s = ((((), s_cnv1, s_cnv2), (s_kern1, s_shell1), s_kern2, s_shell2), b_, c_, d_); q = Inr (Inl (Inr (Inr query))); x_ = Inl (Inr (Inr query)); s_cnv_core = (((), s_cnv1, s_cnv2), (s_kern1, s_shell1), s_kern2, s_shell2); y = Inr (Inr query); ((ab, ac, bb), (ad, bc), ae, bd) \<in> set_spmf (exec_gpv (auth.iface_usr \<ddagger>\<^sub>O auth.iface_usr) (map_gpv' (map_prod (lsumr \<circ> (map_sum id (rsuml \<circ> (map_sum swap_sum id \<circ> lsumr)) \<circ> rsuml)) id) (map_sum id swap_sum \<circ> (lsumr \<circ> map_sum id (rsuml \<circ> map_sum swap_sum id \<circ> lsumr) \<circ> rsuml)) (lsumr \<circ> (map_sum id (rsuml \<circ> (map_sum swap_sum id \<circ> lsumr)) \<circ> rsuml) \<circ> map_sum id swap_sum) (right_gpv (map_gpv (map_prod Inr (Pair s_cnv1)) id (bob_callee s_cnv2 (Inr query))))) ((s_kern1, s_shell1), s_kern2, s_shell2)); sa_ = ((((), ac, bb), (ad, bc), ae, bd), b_, c_, d_); ret_ = Inr (Inl ab)\<rbrakk> \<Longrightarrow> Inr (Inl ab) \<in> Inr ` Inl ` range Inr
[PROOF STEP]
apply(case_tac "(s_cnv1, Inl query)" rule: alice_callee.cases; auto split!: sum.splits auth.ousr_bob.splits simp add: Let_def o_def)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>s_kern2 s_shell2 s_kern1 s_shell1 s_cnv1 s_cnv2 query ab ac bb ad bc ae bd. \<lbrakk>s = ((((), s_cnv1, s_cnv2), (s_kern1, s_shell1), s_kern2, s_shell2), b_, c_, d_); q = Inr (Inl (Inl (Inr query))); x_ = Inl (Inl (Inr query)); s_cnv_core = (((), s_cnv1, s_cnv2), (s_kern1, s_shell1), s_kern2, s_shell2); y = Inl (Inr query); ((ab, ac, bb), (ad, bc), ae, bd) \<in> set_spmf (exec_gpv (auth.iface_usr \<ddagger>\<^sub>O auth.iface_usr) (map_gpv' (map_prod (lsumr \<circ> (map_sum id (rsuml \<circ> (map_sum swap_sum id \<circ> lsumr)) \<circ> rsuml)) id) (map_sum id swap_sum \<circ> (lsumr \<circ> map_sum id (rsuml \<circ> map_sum swap_sum id \<circ> lsumr) \<circ> rsuml)) (lsumr \<circ> (map_sum id (rsuml \<circ> (map_sum swap_sum id \<circ> lsumr)) \<circ> rsuml) \<circ> map_sum id swap_sum) (right_gpv (map_gpv (map_prod Inr (Pair s_cnv1)) id (bob_callee s_cnv2 (Inl query))))) ((s_kern1, s_shell1), s_kern2, s_shell2)); sa_ = ((((), ac, bb), (ad, bc), ae, bd), b_, c_, d_); ret_ = Inr (Inl ab)\<rbrakk> \<Longrightarrow> Inr (Inl ab) \<in> Inr ` Inl ` range Inl
 2. \<And>s_kern2 s_shell2 s_kern1 s_shell1 s_cnv1 s_cnv2 query ab ac bb ad bc ae bd. \<lbrakk>s = ((((), s_cnv1, s_cnv2), (s_kern1, s_shell1), s_kern2, s_shell2), b_, c_, d_); q = Inr (Inl (Inr (Inl query))); x_ = Inl (Inr (Inl query)); s_cnv_core = (((), s_cnv1, s_cnv2), (s_kern1, s_shell1), s_kern2, s_shell2); y = Inr (Inl query); ((ab, ac, bb), (ad, bc), ae, bd) \<in> set_spmf (exec_gpv (auth.iface_usr \<ddagger>\<^sub>O auth.iface_usr) (map_gpv' (map_prod (lsumr \<circ> (map_sum id (rsuml \<circ> (map_sum swap_sum id \<circ> lsumr)) \<circ> rsuml)) id) (map_sum id swap_sum \<circ> (lsumr \<circ> map_sum id (rsuml \<circ> map_sum swap_sum id \<circ> lsumr) \<circ> rsuml)) (lsumr \<circ> (map_sum id (rsuml \<circ> (map_sum swap_sum id \<circ> lsumr)) \<circ> rsuml) \<circ> map_sum id swap_sum) (left_gpv (map_gpv (map_prod Inl (\<lambda>s1'. (s1', s_cnv2))) id (alice_callee s_cnv1 (Inr query))))) ((s_kern1, s_shell1), s_kern2, s_shell2)); sa_ = ((((), ac, bb), (ad, bc), ae, bd), b_, c_, d_); ret_ = Inr (Inl ab)\<rbrakk> \<Longrightarrow> Inr (Inl ab) \<in> Inr ` Inl ` range Inr
 3. \<And>s_kern2 s_shell2 s_kern1 s_shell1 s_cnv1 s_cnv2 query ab ac bb ad bc ae bd. \<lbrakk>s = ((((), s_cnv1, s_cnv2), (s_kern1, s_shell1), s_kern2, s_shell2), b_, c_, d_); q = Inr (Inl (Inr (Inr query))); x_ = Inl (Inr (Inr query)); s_cnv_core = (((), s_cnv1, s_cnv2), (s_kern1, s_shell1), s_kern2, s_shell2); y = Inr (Inr query); ((ab, ac, bb), (ad, bc), ae, bd) \<in> set_spmf (exec_gpv (auth.iface_usr \<ddagger>\<^sub>O auth.iface_usr) (map_gpv' (map_prod (lsumr \<circ> (map_sum id (rsuml \<circ> (map_sum swap_sum id \<circ> lsumr)) \<circ> rsuml)) id) (map_sum id swap_sum \<circ> (lsumr \<circ> map_sum id (rsuml \<circ> map_sum swap_sum id \<circ> lsumr) \<circ> rsuml)) (lsumr \<circ> (map_sum id (rsuml \<circ> (map_sum swap_sum id \<circ> lsumr)) \<circ> rsuml) \<circ> map_sum id swap_sum) (right_gpv (map_gpv (map_prod Inr (Pair s_cnv1)) id (bob_callee s_cnv2 (Inr query))))) ((s_kern1, s_shell1), s_kern2, s_shell2)); sa_ = ((((), ac, bb), (ad, bc), ae, bd), b_, c_, d_); ret_ = Inr (Inl ab)\<rbrakk> \<Longrightarrow> Inr (Inl ab) \<in> Inr ` Inl ` range Inr
[PROOF STEP]
apply(case_tac "(s_cnv2, Inl query)" rule: bob_callee.cases; auto split!: sum.splits auth.ousr_bob.splits simp add: Let_def o_def)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>s_kern2 s_shell2 s_kern1 s_shell1 s_cnv1 s_cnv2 query ab ac bb ad bc ae bd. \<lbrakk>s = ((((), s_cnv1, s_cnv2), (s_kern1, s_shell1), s_kern2, s_shell2), b_, c_, d_); q = Inr (Inl (Inr (Inl query))); x_ = Inl (Inr (Inl query)); s_cnv_core = (((), s_cnv1, s_cnv2), (s_kern1, s_shell1), s_kern2, s_shell2); y = Inr (Inl query); ((ab, ac, bb), (ad, bc), ae, bd) \<in> set_spmf (exec_gpv (auth.iface_usr \<ddagger>\<^sub>O auth.iface_usr) (map_gpv' (map_prod (lsumr \<circ> (map_sum id (rsuml \<circ> (map_sum swap_sum id \<circ> lsumr)) \<circ> rsuml)) id) (map_sum id swap_sum \<circ> (lsumr \<circ> map_sum id (rsuml \<circ> map_sum swap_sum id \<circ> lsumr) \<circ> rsuml)) (lsumr \<circ> (map_sum id (rsuml \<circ> (map_sum swap_sum id \<circ> lsumr)) \<circ> rsuml) \<circ> map_sum id swap_sum) (left_gpv (map_gpv (map_prod Inl (\<lambda>s1'. (s1', s_cnv2))) id (alice_callee s_cnv1 (Inr query))))) ((s_kern1, s_shell1), s_kern2, s_shell2)); sa_ = ((((), ac, bb), (ad, bc), ae, bd), b_, c_, d_); ret_ = Inr (Inl ab)\<rbrakk> \<Longrightarrow> Inr (Inl ab) \<in> Inr ` Inl ` range Inr
 2. \<And>s_kern2 s_shell2 s_kern1 s_shell1 s_cnv1 s_cnv2 query ab ac bb ad bc ae bd. \<lbrakk>s = ((((), s_cnv1, s_cnv2), (s_kern1, s_shell1), s_kern2, s_shell2), b_, c_, d_); q = Inr (Inl (Inr (Inr query))); x_ = Inl (Inr (Inr query)); s_cnv_core = (((), s_cnv1, s_cnv2), (s_kern1, s_shell1), s_kern2, s_shell2); y = Inr (Inr query); ((ab, ac, bb), (ad, bc), ae, bd) \<in> set_spmf (exec_gpv (auth.iface_usr \<ddagger>\<^sub>O auth.iface_usr) (map_gpv' (map_prod (lsumr \<circ> (map_sum id (rsuml \<circ> (map_sum swap_sum id \<circ> lsumr)) \<circ> rsuml)) id) (map_sum id swap_sum \<circ> (lsumr \<circ> map_sum id (rsuml \<circ> map_sum swap_sum id \<circ> lsumr) \<circ> rsuml)) (lsumr \<circ> (map_sum id (rsuml \<circ> (map_sum swap_sum id \<circ> lsumr)) \<circ> rsuml) \<circ> map_sum id swap_sum) (right_gpv (map_gpv (map_prod Inr (Pair s_cnv1)) id (bob_callee s_cnv2 (Inr query))))) ((s_kern1, s_shell1), s_kern2, s_shell2)); sa_ = ((((), ac, bb), (ad, bc), ae, bd), b_, c_, d_); ret_ = Inr (Inl ab)\<rbrakk> \<Longrightarrow> Inr (Inl ab) \<in> Inr ` Inl ` range Inr
[PROOF STEP]
apply(case_tac "(s_cnv1, Inr query)" rule: alice_callee.cases; auto split!: sum.splits
              simp add: Let_def o_def map_gpv_bind_gpv left_gpv_bind_gpv map_gpv'_bind_gpv exec_gpv_bind)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s_kern2 s_shell2 s_kern1 s_shell1 s_cnv1 s_cnv2 query ab ac bb ad bc ae bd. \<lbrakk>s = ((((), s_cnv1, s_cnv2), (s_kern1, s_shell1), s_kern2, s_shell2), b_, c_, d_); q = Inr (Inl (Inr (Inr query))); x_ = Inl (Inr (Inr query)); s_cnv_core = (((), s_cnv1, s_cnv2), (s_kern1, s_shell1), s_kern2, s_shell2); y = Inr (Inr query); ((ab, ac, bb), (ad, bc), ae, bd) \<in> set_spmf (exec_gpv (auth.iface_usr \<ddagger>\<^sub>O auth.iface_usr) (map_gpv' (map_prod (lsumr \<circ> (map_sum id (rsuml \<circ> (map_sum swap_sum id \<circ> lsumr)) \<circ> rsuml)) id) (map_sum id swap_sum \<circ> (lsumr \<circ> map_sum id (rsuml \<circ> map_sum swap_sum id \<circ> lsumr) \<circ> rsuml)) (lsumr \<circ> (map_sum id (rsuml \<circ> (map_sum swap_sum id \<circ> lsumr)) \<circ> rsuml) \<circ> map_sum id swap_sum) (right_gpv (map_gpv (map_prod Inr (Pair s_cnv1)) id (bob_callee s_cnv2 (Inr query))))) ((s_kern1, s_shell1), s_kern2, s_shell2)); sa_ = ((((), ac, bb), (ad, bc), ae, bd), b_, c_, d_); ret_ = Inr (Inl ab)\<rbrakk> \<Longrightarrow> Inr (Inl ab) \<in> Inr ` Inl ` range Inr
[PROOF STEP]
apply(case_tac "(s_cnv2, Inr query)" rule: bob_callee.cases; auto split!: sum.splits
              simp add: Let_def o_def map_gpv_bind_gpv right_gpv_bind_gpv map_gpv'_bind_gpv exec_gpv_bind)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>a b c d x aa. \<lbrakk>q \<in> outs_\<I> (\<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full)); (ret_, sa_) \<in> set_spmf (fused_resource.fuse real_core' real_rest' s q); s = (a, b, c, d); q = Inl x; x = Inl aa\<rbrakk> \<Longrightarrow> ret_ \<in> responses_\<I> (\<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full)) q
 2. \<And>a b c d x ba. \<lbrakk>q \<in> outs_\<I> (\<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full)); (ret_, sa_) \<in> set_spmf (fused_resource.fuse real_core' real_rest' s q); s = (a, b, c, d); q = Inl x; x = Inr ba\<rbrakk> \<Longrightarrow> ret_ \<in> responses_\<I> (\<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full)) q
 3. \<And>a b c d x ba. \<lbrakk>q \<in> outs_\<I> (\<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full)); (ret_, sa_) \<in> set_spmf (fused_resource.fuse real_core' real_rest' s q); s = (a, b, c, d); q = Inr x; x = Inr ba\<rbrakk> \<Longrightarrow> ret_ \<in> responses_\<I> (\<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full)) q
[PROOF STEP]
by (auto simp add: fused_resource.fuse.simps)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
\<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full) \<turnstile>res RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest') \<surd>

goal (1 subgoal):
 1. \<I>_full \<turnstile>res real_resource \<surd>
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<I>_full \<turnstile>res real_resource \<surd>
[PROOF STEP]
unfolding attach_real
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<I>_full \<turnstile>res 1\<^sub>C |\<^sub>= rassocl\<^sub>C \<rhd> RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest') \<surd>
[PROOF STEP]
apply (rule WT_resource_attach[where \<I>'="\<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full)"])
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<I>_full, \<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full) \<turnstile>\<^sub>C 1\<^sub>C |\<^sub>= rassocl\<^sub>C \<surd>
 2. \<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full) \<turnstile>res RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest') \<surd>
[PROOF STEP]
apply (rule WT_converter_mono[of "\<I>_full \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full))" "\<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full)"])
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<I>_full \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)), \<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full) \<turnstile>\<^sub>C 1\<^sub>C |\<^sub>= rassocl\<^sub>C \<surd>
 2. \<I>_full \<le> \<I>_full \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full))
 3. \<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full) \<le> \<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full)
 4. \<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full) \<turnstile>res RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest') \<surd>
[PROOF STEP]
apply (rule WT_converter_parallel_converter2)
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<I>_full, \<I>_full \<turnstile>\<^sub>C 1\<^sub>C \<surd>
 2. \<I>_full \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full), (\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full \<turnstile>\<^sub>C rassocl\<^sub>C \<surd>
 3. \<I>_full \<le> \<I>_full \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full))
 4. \<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full) \<le> \<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full)
 5. \<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full) \<turnstile>res RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest') \<surd>
[PROOF STEP]
apply (rule WT_intro)+
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<I>_full \<le> \<I>_full \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full))
 2. \<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full) \<le> \<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full)
 3. \<I>_full \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full) \<turnstile>res RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest') \<surd>
[PROOF STEP]
by (simp_all add: \<I>_full_le_plus_\<I>)
[PROOF STATE]
proof (state)
this:
\<I>_full \<turnstile>res real_resource \<surd>

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<I>_full \<turnstile>res real_resource \<surd>

goal (1 subgoal):
 1. connect_obsf D (obsf_resource real_resource) = connect_obsf D (obsf_resource (RES (fused_resource.fuse (lazy_core DH0_sample) lazy_rest) (basic_core_sinit, basic_rest_sinit)))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. connect_obsf D (obsf_resource real_resource) = connect_obsf D (obsf_resource (RES (fused_resource.fuse (lazy_core DH0_sample) lazy_rest) (basic_core_sinit, basic_rest_sinit)))
[PROOF STEP]
using trace_eq_obsf_resourceI[OF trace_eq_fuse_rl, folded attach_real]
[PROOF STATE]
proof (prove)
using this:
UNIV \<turnstile>\<^sub>R obsf_resource real_resource \<approx> obsf_resource (RES (fused_resource.fuse (lazy_core DH0_sample) lazy_rest) (basic_core_sinit, basic_rest_sinit))

goal (1 subgoal):
 1. connect_obsf D (obsf_resource real_resource) = connect_obsf D (obsf_resource (RES (fused_resource.fuse (lazy_core DH0_sample) lazy_rest) (basic_core_sinit, basic_rest_sinit)))
[PROOF STEP]
by (rule connect_cong_trace[where A="UNIV" and \<I>=\<I>_full])
      (auto intro!: WT_obsf_resource[where \<I>=\<I>_full, simplified exception_\<I>_full])
[PROOF STATE]
proof (state)
this:
connect_obsf D (obsf_resource real_resource) = connect_obsf D (obsf_resource (RES (fused_resource.fuse (lazy_core DH0_sample) lazy_rest) (basic_core_sinit, basic_rest_sinit)))

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma "(\<exists>x. f x = g x) \<longrightarrow> f = g"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<exists>x. f x = g x) \<longrightarrow> f = g
[PROOF STEP]
refute [expect = genuine]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<exists>x. f x = g x) \<longrightarrow> f = g
[PROOF STEP]
oops