[STATEMENT]
lemma game_difference:
  defines "\<I> \<equiv> \<I>_uniform (Set.Collect (valid_mac_query \<eta>)) (insert None (Some ` (nlists UNIV \<eta> \<times> nlists UNIV \<eta>))) \<oplus>\<^sub>\<I>
     (\<I>_uniform (vld \<eta>) UNIV \<oplus>\<^sub>\<I> \<I>_uniform UNIV (insert None (Some ` vld \<eta>)))"
  assumes bound: "interaction_bounded_by' (\<lambda>_. True) \<A> q"
    and lossless: "plossless_gpv \<I> \<A>"
    and WT: "\<I> \<turnstile>g \<A> \<surd>"
  shows
    "\<bar>spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) (Void, None, Map.empty))) True -
    spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) (Void, None, Map.empty))) True\<bar>
    \<le> q / real (2 ^ \<eta>)" (is "?LHS \<le> _")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<bar>spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) (Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) (Void, None, Map.empty))) True\<bar> \<le> real q / real (2 ^ \<eta>)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<bar>spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) (Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) (Void, None, Map.empty))) True\<bar> \<le> real q / real (2 ^ \<eta>)
[PROOF STEP]
define lazy_channel_insec' where
    "lazy_channel_insec' = (\<dagger>lazy_channel_insec :: (bool \<times> bool list cstate \<times> (bool list \<times> bool list) option \<times> (bool list \<Rightarrow> bool list option),
   (bool list \<times> bool list) insec_query, (bool list \<times> bool list) option) oracle')"
[PROOF STATE]
proof (state)
this:
lazy_channel_insec' = \<dagger>lazy_channel_insec

goal (1 subgoal):
 1. \<bar>spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) (Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) (Void, None, Map.empty))) True\<bar> \<le> real q / real (2 ^ \<eta>)
[PROOF STEP]
define lazy_channel_send' where
    "lazy_channel_send' = (\<dagger>lazy_channel_send :: (bool \<times> bool list cstate \<times> (bool list \<times> bool list) option \<times> (bool list \<Rightarrow> bool list option),
    bool list, unit) oracle')"
[PROOF STATE]
proof (state)
this:
lazy_channel_send' = \<dagger>lazy_channel_send

goal (1 subgoal):
 1. \<bar>spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) (Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) (Void, None, Map.empty))) True\<bar> \<le> real q / real (2 ^ \<eta>)
[PROOF STEP]
define lazy_channel_recv' where
    "lazy_channel_recv' = (\<lambda> (s :: bool \<times> bool list cstate \<times> (bool list \<times> bool list) option \<times> (bool list \<Rightarrow> bool list option)) (q :: unit).
    (case s of
      (flg, Collect m, None, as) \<Rightarrow> return_spmf (Some m, (flg, Fail, None, as))
    | (flg, ms, Some (a', m'), as) \<Rightarrow> (case as m' of
        None \<Rightarrow> do {
          a \<leftarrow> spmf_of_set (rnd \<eta>);
          return_spmf (if a = a' then Some m' else None, flg \<or> a = a', Fail, None, as (m' := Some a))}
      | Some a \<Rightarrow> return_spmf (if a = a' then Some m' else None, flg, Fail, None, as))
    | _ \<Rightarrow> return_spmf (None, s)))"
[PROOF STATE]
proof (state)
this:
lazy_channel_recv' = (\<lambda>s q. case s of (flg, cstate.Collect m, None, as) \<Rightarrow> return_spmf (Some m, flg, cstate.Fail, None, as) | (flg, cstate.Collect m, Some (a', m'), as) \<Rightarrow> case as m' of None \<Rightarrow> spmf_of_set (rnd \<eta>) \<bind> (\<lambda>a. return_spmf (if a = a' then Some m' else None, flg \<or> a = a', cstate.Fail, None, as(m' \<mapsto> a))) | Some a \<Rightarrow> return_spmf (if a = a' then Some m' else None, flg, cstate.Fail, None, as) | (flg, _, None, as) \<Rightarrow> return_spmf (None, s) | (flg, _, Some (a', m'), as) \<Rightarrow> case as m' of None \<Rightarrow> spmf_of_set (rnd \<eta>) \<bind> (\<lambda>a. return_spmf (if a = a' then Some m' else None, flg \<or> a = a', cstate.Fail, None, as(m' \<mapsto> a))) | Some a \<Rightarrow> return_spmf (if a = a' then Some m' else None, flg, cstate.Fail, None, as))

goal (1 subgoal):
 1. \<bar>spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) (Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) (Void, None, Map.empty))) True\<bar> \<le> real q / real (2 ^ \<eta>)
[PROOF STEP]
define lazy_channel_recv_f' where
    "lazy_channel_recv_f' = (\<lambda> (s :: bool \<times> bool list cstate \<times> (bool list \<times> bool list) option \<times> (bool list \<Rightarrow> bool list option)) (q :: unit).
    (case s of
      (flg, Collect m, None, as) \<Rightarrow> return_spmf (Some m, (flg, Fail, None, as))
    | (flg, ms, Some (a', m'), as) \<Rightarrow> (case as m' of
        None \<Rightarrow> do {
          a \<leftarrow> spmf_of_set (rnd \<eta>);
          return_spmf (None, flg \<or> a = a', Fail, None, as (m' := Some a))}
      | Some a \<Rightarrow> return_spmf (if a = a' then Some m' else None, flg, Fail, None, as))
    | _ \<Rightarrow> return_spmf (None, s)))"
[PROOF STATE]
proof (state)
this:
lazy_channel_recv_f' = (\<lambda>s q. case s of (flg, cstate.Collect m, None, as) \<Rightarrow> return_spmf (Some m, flg, cstate.Fail, None, as) | (flg, cstate.Collect m, Some (a', m'), as) \<Rightarrow> case as m' of None \<Rightarrow> spmf_of_set (rnd \<eta>) \<bind> (\<lambda>a. return_spmf (None, flg \<or> a = a', cstate.Fail, None, as(m' \<mapsto> a))) | Some a \<Rightarrow> return_spmf (if a = a' then Some m' else None, flg, cstate.Fail, None, as) | (flg, _, None, as) \<Rightarrow> return_spmf (None, s) | (flg, _, Some (a', m'), as) \<Rightarrow> case as m' of None \<Rightarrow> spmf_of_set (rnd \<eta>) \<bind> (\<lambda>a. return_spmf (None, flg \<or> a = a', cstate.Fail, None, as(m' \<mapsto> a))) | Some a \<Rightarrow> return_spmf (if a = a' then Some m' else None, flg, cstate.Fail, None, as))

goal (1 subgoal):
 1. \<bar>spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) (Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) (Void, None, Map.empty))) True\<bar> \<le> real q / real (2 ^ \<eta>)
[PROOF STEP]
define game where
    "game = (\<lambda>(\<A> :: ((bool list \<times> bool list) insec_query + bool list + unit, (bool list \<times> bool list) option + unit + bool list option) distinguisher) recv_oracle. do {
    (b :: bool, (flg, ams, es, as))\<leftarrow> (exec_gpv (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O recv_oracle) \<A> (False, Void, None, Map.empty));
    return_spmf (b, flg) })"
[PROOF STATE]
proof (state)
this:
game = (\<lambda>\<A> recv_oracle. exec_gpv (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O recv_oracle) \<A> (False, Void, None, Map.empty) \<bind> (\<lambda>(b, flg, ams, es, as). return_spmf (b, flg)))

goal (1 subgoal):
 1. \<bar>spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) (Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) (Void, None, Map.empty))) True\<bar> \<le> real q / real (2 ^ \<eta>)
[PROOF STEP]
have fact1: "spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) (Void, None, Map.empty))) True
    = spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) (Void, None, Map.empty))) True = spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) (Void, None, Map.empty))) True = spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True
[PROOF STEP]
let ?orc_lft = "lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) (Void, None, Map.empty))) True = spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True
[PROOF STEP]
let ?orc_rgt = "lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f'"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) (Void, None, Map.empty))) True = spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True
[PROOF STEP]
have[simp]: "rel_spmf (rel_prod (=) (\<lambda>x y. x = snd y))
      (lazy_channel_insec s q) (lazy_channel_insec' (flg, s) q) " for s flg q
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. rel_spmf (rel_prod (=) (\<lambda>x y. x = snd y)) (lazy_channel_insec s q) (lazy_channel_insec' (flg, s) q)
[PROOF STEP]
by (cases s) (simp add: lazy_channel_insec'_def spmf_rel_map rel_prod_sel split_def option.rel_refl pmf.rel_refl split:option.split)
[PROOF STATE]
proof (state)
this:
rel_spmf (rel_prod (=) (\<lambda>x y. x = snd y)) (lazy_channel_insec ?s ?q) (lazy_channel_insec' (?flg, ?s) ?q)

goal (1 subgoal):
 1. spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) (Void, None, Map.empty))) True = spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True
[PROOF STEP]
have[simp]: "rel_spmf (rel_prod (=) (\<lambda>x y. x = snd y))
      (lazy_channel_send s q) (lazy_channel_send' (flg, s) q)" for s flg q
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. rel_spmf (rel_prod (=) (\<lambda>x y. x = snd y)) (lazy_channel_send s q) (lazy_channel_send' (flg, s) q)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. rel_spmf (rel_prod (=) (\<lambda>x y. x = snd y)) (lazy_channel_send s q) (lazy_channel_send' (flg, s) q)
[PROOF STEP]
obtain ams es as where "s = (ams, es, as)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>ams es as. s = (ams, es, as) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (cases s)
[PROOF STATE]
proof (state)
this:
s = (ams, es, as)

goal (1 subgoal):
 1. rel_spmf (rel_prod (=) (\<lambda>x y. x = snd y)) (lazy_channel_send s q) (lazy_channel_send' (flg, s) q)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
s = (ams, es, as)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
s = (ams, es, as)

goal (1 subgoal):
 1. rel_spmf (rel_prod (=) (\<lambda>x y. x = snd y)) (lazy_channel_send s q) (lazy_channel_send' (flg, s) q)
[PROOF STEP]
by (cases ams) (auto simp add: spmf_rel_map map_spmf_conv_bind_spmf split_def lazy_channel_send'_def)
[PROOF STATE]
proof (state)
this:
rel_spmf (rel_prod (=) (\<lambda>x y. x = snd y)) (lazy_channel_send s q) (lazy_channel_send' (flg, s) q)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
rel_spmf (rel_prod (=) (\<lambda>x y. x = snd y)) (lazy_channel_send ?s ?q) (lazy_channel_send' (?flg, ?s) ?q)

goal (1 subgoal):
 1. spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) (Void, None, Map.empty))) True = spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True
[PROOF STEP]
have[simp]: "rel_spmf (rel_prod (=) (\<lambda>x y. x = snd y))
      (lazy_channel_recv_f s q) (lazy_channel_recv_f' (flg, s) q)" for s flg q
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. rel_spmf (rel_prod (=) (\<lambda>x y. x = snd y)) (lazy_channel_recv_f s q) (lazy_channel_recv_f' (flg, s) q)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. rel_spmf (rel_prod (=) (\<lambda>x y. x = snd y)) (lazy_channel_recv_f s q) (lazy_channel_recv_f' (flg, s) q)
[PROOF STEP]
obtain ams es as where *: "s = (ams, es, as)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>ams es as. s = (ams, es, as) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (cases s)
[PROOF STATE]
proof (state)
this:
s = (ams, es, as)

goal (1 subgoal):
 1. rel_spmf (rel_prod (=) (\<lambda>x y. x = snd y)) (lazy_channel_recv_f s q) (lazy_channel_recv_f' (flg, s) q)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. rel_spmf (rel_prod (=) (\<lambda>x y. x = snd y)) (lazy_channel_recv_f s q) (lazy_channel_recv_f' (flg, s) q)
[PROOF STEP]
proof (cases es)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. es = None \<Longrightarrow> rel_spmf (rel_prod (=) (\<lambda>x y. x = snd y)) (lazy_channel_recv_f s q) (lazy_channel_recv_f' (flg, s) q)
 2. \<And>a. es = Some a \<Longrightarrow> rel_spmf (rel_prod (=) (\<lambda>x y. x = snd y)) (lazy_channel_recv_f s q) (lazy_channel_recv_f' (flg, s) q)
[PROOF STEP]
case None
[PROOF STATE]
proof (state)
this:
es = None

goal (2 subgoals):
 1. es = None \<Longrightarrow> rel_spmf (rel_prod (=) (\<lambda>x y. x = snd y)) (lazy_channel_recv_f s q) (lazy_channel_recv_f' (flg, s) q)
 2. \<And>a. es = Some a \<Longrightarrow> rel_spmf (rel_prod (=) (\<lambda>x y. x = snd y)) (lazy_channel_recv_f s q) (lazy_channel_recv_f' (flg, s) q)
[PROOF STEP]
with *
[PROOF STATE]
proof (chain)
picking this:
s = (ams, es, as)
es = None
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
s = (ams, es, as)
es = None

goal (1 subgoal):
 1. rel_spmf (rel_prod (=) (\<lambda>x y. x = snd y)) (lazy_channel_recv_f s q) (lazy_channel_recv_f' (flg, s) q)
[PROOF STEP]
by (cases ams) (simp_all add:lazy_channel_recv_f'_def)
[PROOF STATE]
proof (state)
this:
rel_spmf (rel_prod (=) (\<lambda>x y. x = snd y)) (lazy_channel_recv_f s q) (lazy_channel_recv_f' (flg, s) q)

goal (1 subgoal):
 1. \<And>a. es = Some a \<Longrightarrow> rel_spmf (rel_prod (=) (\<lambda>x y. x = snd y)) (lazy_channel_recv_f s q) (lazy_channel_recv_f' (flg, s) q)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a. es = Some a \<Longrightarrow> rel_spmf (rel_prod (=) (\<lambda>x y. x = snd y)) (lazy_channel_recv_f s q) (lazy_channel_recv_f' (flg, s) q)
[PROOF STEP]
case (Some am)
[PROOF STATE]
proof (state)
this:
es = Some am

goal (1 subgoal):
 1. \<And>a. es = Some a \<Longrightarrow> rel_spmf (rel_prod (=) (\<lambda>x y. x = snd y)) (lazy_channel_recv_f s q) (lazy_channel_recv_f' (flg, s) q)
[PROOF STEP]
obtain a m where "am = (a, m)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>a m. am = (a, m) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (cases am)
[PROOF STATE]
proof (state)
this:
am = (a, m)

goal (1 subgoal):
 1. \<And>a. es = Some a \<Longrightarrow> rel_spmf (rel_prod (=) (\<lambda>x y. x = snd y)) (lazy_channel_recv_f s q) (lazy_channel_recv_f' (flg, s) q)
[PROOF STEP]
with *
[PROOF STATE]
proof (chain)
picking this:
s = (ams, es, as)
am = (a, m)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
s = (ams, es, as)
am = (a, m)

goal (1 subgoal):
 1. rel_spmf (rel_prod (=) (\<lambda>x y. x = snd y)) (lazy_channel_recv_f s q) (lazy_channel_recv_f' (flg, s) q)
[PROOF STEP]
by (cases ams) (simp_all add: lazy_channel_recv_f'_def rel_spmf_bind_reflI split:option.split)
[PROOF STATE]
proof (state)
this:
rel_spmf (rel_prod (=) (\<lambda>x y. x = snd y)) (lazy_channel_recv_f s q) (lazy_channel_recv_f' (flg, s) q)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
rel_spmf (rel_prod (=) (\<lambda>x y. x = snd y)) (lazy_channel_recv_f s q) (lazy_channel_recv_f' (flg, s) q)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
rel_spmf (rel_prod (=) (\<lambda>x y. x = snd y)) (lazy_channel_recv_f ?s ?q) (lazy_channel_recv_f' (?flg, ?s) ?q)

goal (1 subgoal):
 1. spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) (Void, None, Map.empty))) True = spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True
[PROOF STEP]
have[simp]: "rel_spmf (rel_prod (=) (\<lambda>x y. x = snd y))
     ((lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) (ams, es, as) query)
     ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (flg, ams, es, as) query)" for flg ams es as query
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. rel_spmf (rel_prod (=) (\<lambda>x y. x = snd y)) ((lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) (ams, es, as) query) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (flg, ams, es, as) query)
[PROOF STEP]
proof (cases query)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>a. query = Inl a \<Longrightarrow> rel_spmf (rel_prod (=) (\<lambda>x y. x = snd y)) ((lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) (ams, es, as) query) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (flg, ams, es, as) query)
 2. \<And>b. query = Inr b \<Longrightarrow> rel_spmf (rel_prod (=) (\<lambda>x y. x = snd y)) ((lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) (ams, es, as) query) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (flg, ams, es, as) query)
[PROOF STEP]
case (Inl adv_query)
[PROOF STATE]
proof (state)
this:
query = Inl adv_query

goal (2 subgoals):
 1. \<And>a. query = Inl a \<Longrightarrow> rel_spmf (rel_prod (=) (\<lambda>x y. x = snd y)) ((lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) (ams, es, as) query) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (flg, ams, es, as) query)
 2. \<And>b. query = Inr b \<Longrightarrow> rel_spmf (rel_prod (=) (\<lambda>x y. x = snd y)) ((lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) (ams, es, as) query) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (flg, ams, es, as) query)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
query = Inl adv_query
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
query = Inl adv_query

goal (1 subgoal):
 1. rel_spmf (rel_prod (=) (\<lambda>x y. x = snd y)) ((lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) (ams, es, as) query) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (flg, ams, es, as) query)
[PROOF STEP]
by(clarsimp simp add: spmf_rel_map map_spmf_conv_bind_spmf[symmetric] apfst_def map_prod_def split_beta)
          ((rule rel_spmf_mono[where A="rel_prod (=) (\<lambda>x y. x = snd y)"]), auto)
[PROOF STATE]
proof (state)
this:
rel_spmf (rel_prod (=) (\<lambda>x y. x = snd y)) ((lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) (ams, es, as) query) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (flg, ams, es, as) query)

goal (1 subgoal):
 1. \<And>b. query = Inr b \<Longrightarrow> rel_spmf (rel_prod (=) (\<lambda>x y. x = snd y)) ((lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) (ams, es, as) query) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (flg, ams, es, as) query)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>b. query = Inr b \<Longrightarrow> rel_spmf (rel_prod (=) (\<lambda>x y. x = snd y)) ((lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) (ams, es, as) query) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (flg, ams, es, as) query)
[PROOF STEP]
case (Inr query')
[PROOF STATE]
proof (state)
this:
query = Inr query'

goal (1 subgoal):
 1. \<And>b. query = Inr b \<Longrightarrow> rel_spmf (rel_prod (=) (\<lambda>x y. x = snd y)) ((lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) (ams, es, as) query) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (flg, ams, es, as) query)
[PROOF STEP]
note Snd_Rcv = this
[PROOF STATE]
proof (state)
this:
query = Inr query'

goal (1 subgoal):
 1. \<And>b. query = Inr b \<Longrightarrow> rel_spmf (rel_prod (=) (\<lambda>x y. x = snd y)) ((lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) (ams, es, as) query) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (flg, ams, es, as) query)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
query = Inr query'
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
query = Inr query'

goal (1 subgoal):
 1. rel_spmf (rel_prod (=) (\<lambda>x y. x = snd y)) ((lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) (ams, es, as) query) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (flg, ams, es, as) query)
[PROOF STEP]
by (cases query', auto simp add: spmf_rel_map map_spmf_conv_bind_spmf[symmetric] split_beta)
          ((rule rel_spmf_mono[where A="rel_prod (=) (\<lambda>x y. x = snd y)"]); auto)+
[PROOF STATE]
proof (state)
this:
rel_spmf (rel_prod (=) (\<lambda>x y. x = snd y)) ((lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) (ams, es, as) query) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (flg, ams, es, as) query)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
rel_spmf (rel_prod (=) (\<lambda>x y. x = snd y)) ((lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) (?ams, ?es, ?as) ?query) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (?flg, ?ams, ?es, ?as) ?query)

goal (1 subgoal):
 1. spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) (Void, None, Map.empty))) True = spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True
[PROOF STEP]
have[simp]: "rel_spmf (\<lambda>x y. fst x = fst y)
     (exec_gpv ?orc_lft \<A> (Void, None, Map.empty)) (exec_gpv ?orc_rgt \<A> (False, Void, None, Map.empty))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. rel_spmf (\<lambda>x y. fst x = fst y) (exec_gpv (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) \<A> (Void, None, Map.empty)) (exec_gpv (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') \<A> (False, Void, None, Map.empty))
[PROOF STEP]
by(rule rel_spmf_mono[where A="rel_prod (=) (\<lambda>x y. x = snd y)"])
        (auto simp add: gpv.rel_eq split_def intro!: rel_funI
          exec_gpv_parametric[where CALL="(=)", THEN rel_funD, THEN rel_funD, THEN rel_funD])
[PROOF STATE]
proof (state)
this:
rel_spmf (\<lambda>x y. fst x = fst y) (exec_gpv (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) \<A> (Void, None, Map.empty)) (exec_gpv (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') \<A> (False, Void, None, Map.empty))

goal (1 subgoal):
 1. spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) (Void, None, Map.empty))) True = spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) (Void, None, Map.empty))) True = spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True
[PROOF STEP]
unfolding map_spmf_conv_bind_spmf exec_gpv_resource_of_oracle connect_def spmf_conv_measure_spmf
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Sigma_Algebra.measure (measure_spmf (exec_gpv (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) \<A> (Void, None, Map.empty) \<bind> (\<lambda>x. return_spmf (map_prod id (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f)) x)) \<bind> (\<lambda>x. return_spmf (fst x)))) {True} = Sigma_Algebra.measure (measure_spmf (exec_gpv (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') \<A> (False, Void, None, Map.empty) \<bind> (\<lambda>x. return_spmf (map_prod id (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f')) x)) \<bind> (\<lambda>x. return_spmf (fst x)))) {True}
[PROOF STEP]
by(rule measure_spmf_parametric[where A="(=)", THEN rel_funD, THEN rel_funD])
        (auto simp add: rel_pred_def spmf_rel_map map_spmf_conv_bind_spmf[symmetric] gpv.rel_eq split_def intro!: rel_funI)
[PROOF STATE]
proof (state)
this:
spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) (Void, None, Map.empty))) True = spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) (Void, None, Map.empty))) True = spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True

goal (1 subgoal):
 1. \<bar>spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) (Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) (Void, None, Map.empty))) True\<bar> \<le> real q / real (2 ^ \<eta>)
[PROOF STEP]
have fact2: "\<bar>spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True -
    spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True\<bar>
    \<le> Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x}" (is "\<bar>spmf ?L _ - spmf ?R _ \<bar> \<le> _ ")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<bar>spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True\<bar> \<le> Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x}
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<bar>spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True\<bar> \<le> Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x}
[PROOF STEP]
let ?orc_lft = "lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f'"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<bar>spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True\<bar> \<le> Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x}
[PROOF STEP]
let ?orc_rgt = "lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv'"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<bar>spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True\<bar> \<le> Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x}
[PROOF STEP]
have[simp]: "callee_invariant_on lazy_channel_insec' fst (\<I>_uniform (Set.Collect (valid_mac_query \<eta>)) UNIV)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. callee_invariant_on lazy_channel_insec' fst (\<I>_uniform (Set.Collect (valid_mac_query \<eta>)) UNIV)
[PROOF STEP]
proof (unfold_locales, goal_cases)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>s x y s'. \<lbrakk>(y, s') \<in> set_spmf (lazy_channel_insec' s x); fst s; x \<in> outs_\<I> (\<I>_uniform (Set.Collect (valid_mac_query \<eta>)) UNIV)\<rbrakk> \<Longrightarrow> fst s'
 2. \<And>s. fst s \<Longrightarrow> \<I>_uniform (Set.Collect (valid_mac_query \<eta>)) UNIV \<turnstile>c lazy_channel_insec' s \<surd>
[PROOF STEP]
case (1 state query answer state')
[PROOF STATE]
proof (state)
this:
(answer, state') \<in> set_spmf (lazy_channel_insec' state query)
fst state
query \<in> outs_\<I> (\<I>_uniform (Set.Collect (valid_mac_query \<eta>)) UNIV)

goal (2 subgoals):
 1. \<And>s x y s'. \<lbrakk>(y, s') \<in> set_spmf (lazy_channel_insec' s x); fst s; x \<in> outs_\<I> (\<I>_uniform (Set.Collect (valid_mac_query \<eta>)) UNIV)\<rbrakk> \<Longrightarrow> fst s'
 2. \<And>s. fst s \<Longrightarrow> \<I>_uniform (Set.Collect (valid_mac_query \<eta>)) UNIV \<turnstile>c lazy_channel_insec' s \<surd>
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(answer, state') \<in> set_spmf (lazy_channel_insec' state query)
fst state
query \<in> outs_\<I> (\<I>_uniform (Set.Collect (valid_mac_query \<eta>)) UNIV)
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
(answer, state') \<in> set_spmf (lazy_channel_insec' state query)
fst state
query \<in> outs_\<I> (\<I>_uniform (Set.Collect (valid_mac_query \<eta>)) UNIV)

goal (1 subgoal):
 1. fst state'
[PROOF STEP]
by(cases state; cases "fst (snd state)")(auto simp add: spmf_rel_map map_spmf_conv_bind_spmf split_def lazy_channel_insec'_def)
[PROOF STATE]
proof (state)
this:
fst state'

goal (1 subgoal):
 1. \<And>s. fst s \<Longrightarrow> \<I>_uniform (Set.Collect (valid_mac_query \<eta>)) UNIV \<turnstile>c lazy_channel_insec' s \<surd>
[PROOF STEP]
qed (auto intro: WT_calleeI)
[PROOF STATE]
proof (state)
this:
callee_invariant_on lazy_channel_insec' fst (\<I>_uniform (Set.Collect (valid_mac_query \<eta>)) UNIV)

goal (1 subgoal):
 1. \<bar>spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True\<bar> \<le> Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x}
[PROOF STEP]
have[simp]: "callee_invariant_on lazy_channel_send' fst (\<I>_uniform (vld \<eta>) UNIV)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. callee_invariant_on lazy_channel_send' fst (\<I>_uniform (vld \<eta>) UNIV)
[PROOF STEP]
proof (unfold_locales, goal_cases)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>s x y s'. \<lbrakk>(y, s') \<in> set_spmf (lazy_channel_send' s x); fst s; x \<in> outs_\<I> (\<I>_uniform (vld \<eta>) UNIV)\<rbrakk> \<Longrightarrow> fst s'
 2. \<And>s. fst s \<Longrightarrow> \<I>_uniform (vld \<eta>) UNIV \<turnstile>c lazy_channel_send' s \<surd>
[PROOF STEP]
case (1 state query answer state')
[PROOF STATE]
proof (state)
this:
(answer, state') \<in> set_spmf (lazy_channel_send' state query)
fst state
query \<in> outs_\<I> (\<I>_uniform (vld \<eta>) UNIV)

goal (2 subgoals):
 1. \<And>s x y s'. \<lbrakk>(y, s') \<in> set_spmf (lazy_channel_send' s x); fst s; x \<in> outs_\<I> (\<I>_uniform (vld \<eta>) UNIV)\<rbrakk> \<Longrightarrow> fst s'
 2. \<And>s. fst s \<Longrightarrow> \<I>_uniform (vld \<eta>) UNIV \<turnstile>c lazy_channel_send' s \<surd>
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(answer, state') \<in> set_spmf (lazy_channel_send' state query)
fst state
query \<in> outs_\<I> (\<I>_uniform (vld \<eta>) UNIV)
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
(answer, state') \<in> set_spmf (lazy_channel_send' state query)
fst state
query \<in> outs_\<I> (\<I>_uniform (vld \<eta>) UNIV)

goal (1 subgoal):
 1. fst state'
[PROOF STEP]
by(cases state; cases "fst (snd state)")(auto simp add: spmf_rel_map map_spmf_conv_bind_spmf split_def lazy_channel_send'_def)
[PROOF STATE]
proof (state)
this:
fst state'

goal (1 subgoal):
 1. \<And>s. fst s \<Longrightarrow> \<I>_uniform (vld \<eta>) UNIV \<turnstile>c lazy_channel_send' s \<surd>
[PROOF STEP]
qed (auto intro: WT_calleeI)
[PROOF STATE]
proof (state)
this:
callee_invariant_on lazy_channel_send' fst (\<I>_uniform (vld \<eta>) UNIV)

goal (1 subgoal):
 1. \<bar>spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True\<bar> \<le> Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x}
[PROOF STEP]
have[simp]: "callee_invariant lazy_channel_recv' fst"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. callee_invariant lazy_channel_recv' fst
[PROOF STEP]
proof (unfold_locales, goal_cases)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>s x y s'. \<lbrakk>(y, s') \<in> set_spmf (lazy_channel_recv' s x); fst s; x \<in> outs_\<I> \<I>_full\<rbrakk> \<Longrightarrow> fst s'
 2. \<And>s. fst s \<Longrightarrow> \<I>_full \<turnstile>c lazy_channel_recv' s \<surd>
[PROOF STEP]
case (1 state query answer state')
[PROOF STATE]
proof (state)
this:
(answer, state') \<in> set_spmf (lazy_channel_recv' state query)
fst state
query \<in> outs_\<I> \<I>_full

goal (2 subgoals):
 1. \<And>s x y s'. \<lbrakk>(y, s') \<in> set_spmf (lazy_channel_recv' s x); fst s; x \<in> outs_\<I> \<I>_full\<rbrakk> \<Longrightarrow> fst s'
 2. \<And>s. fst s \<Longrightarrow> \<I>_full \<turnstile>c lazy_channel_recv' s \<surd>
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(answer, state') \<in> set_spmf (lazy_channel_recv' state query)
fst state
query \<in> outs_\<I> \<I>_full
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
(answer, state') \<in> set_spmf (lazy_channel_recv' state query)
fst state
query \<in> outs_\<I> \<I>_full

goal (1 subgoal):
 1. fst state'
[PROOF STEP]
by(cases state; cases "fst (snd state)")(auto simp add: lazy_channel_recv'_def split:option.splits)
[PROOF STATE]
proof (state)
this:
fst state'

goal (1 subgoal):
 1. \<And>s. fst s \<Longrightarrow> \<I>_full \<turnstile>c lazy_channel_recv' s \<surd>
[PROOF STEP]
qed (auto split:option.splits)
[PROOF STATE]
proof (state)
this:
callee_invariant lazy_channel_recv' fst

goal (1 subgoal):
 1. \<bar>spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True\<bar> \<le> Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x}
[PROOF STEP]
have[simp]: "callee_invariant lazy_channel_recv_f' fst"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. callee_invariant lazy_channel_recv_f' fst
[PROOF STEP]
proof (unfold_locales, goal_cases)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>s x y s'. \<lbrakk>(y, s') \<in> set_spmf (lazy_channel_recv_f' s x); fst s; x \<in> outs_\<I> \<I>_full\<rbrakk> \<Longrightarrow> fst s'
 2. \<And>s. fst s \<Longrightarrow> \<I>_full \<turnstile>c lazy_channel_recv_f' s \<surd>
[PROOF STEP]
case (1 state query answer state')
[PROOF STATE]
proof (state)
this:
(answer, state') \<in> set_spmf (lazy_channel_recv_f' state query)
fst state
query \<in> outs_\<I> \<I>_full

goal (2 subgoals):
 1. \<And>s x y s'. \<lbrakk>(y, s') \<in> set_spmf (lazy_channel_recv_f' s x); fst s; x \<in> outs_\<I> \<I>_full\<rbrakk> \<Longrightarrow> fst s'
 2. \<And>s. fst s \<Longrightarrow> \<I>_full \<turnstile>c lazy_channel_recv_f' s \<surd>
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(answer, state') \<in> set_spmf (lazy_channel_recv_f' state query)
fst state
query \<in> outs_\<I> \<I>_full
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
(answer, state') \<in> set_spmf (lazy_channel_recv_f' state query)
fst state
query \<in> outs_\<I> \<I>_full

goal (1 subgoal):
 1. fst state'
[PROOF STEP]
by(cases state; cases "fst (snd state)")(auto simp add: lazy_channel_recv_f'_def split:option.splits)
[PROOF STATE]
proof (state)
this:
fst state'

goal (1 subgoal):
 1. \<And>s. fst s \<Longrightarrow> \<I>_full \<turnstile>c lazy_channel_recv_f' s \<surd>
[PROOF STEP]
qed (auto split:option.splits)
[PROOF STATE]
proof (state)
this:
callee_invariant lazy_channel_recv_f' fst

goal (1 subgoal):
 1. \<bar>spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True\<bar> \<le> Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x}
[PROOF STEP]
have[simp]: "lossless_spmf (lazy_channel_insec s q)" for s q
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. lossless_spmf (lazy_channel_insec s q)
[PROOF STEP]
by(cases "(s, q)" rule: lazy_channel_insec.cases)(auto simp add: rnd_def split!: option.split)
[PROOF STATE]
proof (state)
this:
lossless_spmf (lazy_channel_insec ?s ?q)

goal (1 subgoal):
 1. \<bar>spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True\<bar> \<le> Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x}
[PROOF STEP]
have[simp]: "lossless_spmf (lazy_channel_send' s q)" for s q
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. lossless_spmf (lazy_channel_send' s q)
[PROOF STEP]
by(cases s; cases "fst (snd s)")(simp_all add: lazy_channel_send'_def)
[PROOF STATE]
proof (state)
this:
lossless_spmf (lazy_channel_send' ?s ?q)

goal (1 subgoal):
 1. \<bar>spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True\<bar> \<le> Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x}
[PROOF STEP]
have[simp]: "lossless_spmf (lazy_channel_recv' s ())" for s
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. lossless_spmf (lazy_channel_recv' s ())
[PROOF STEP]
by(auto simp add: lazy_channel_recv'_def rnd_def split: prod.split cstate.split option.split)
[PROOF STATE]
proof (state)
this:
lossless_spmf (lazy_channel_recv' ?s ())

goal (1 subgoal):
 1. \<bar>spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True\<bar> \<le> Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x}
[PROOF STEP]
have[simp]: "lossless_spmf (lazy_channel_recv_f' s ())" for s
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. lossless_spmf (lazy_channel_recv_f' s ())
[PROOF STEP]
by(auto simp add: lazy_channel_recv_f'_def rnd_def split: prod.split cstate.split option.split)
[PROOF STATE]
proof (state)
this:
lossless_spmf (lazy_channel_recv_f' ?s ())

goal (1 subgoal):
 1. \<bar>spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True\<bar> \<le> Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x}
[PROOF STEP]
have[simp]: "rel_spmf (\<lambda>(a, s1') (b, s2'). (fst s2' \<longrightarrow> fst s1') \<and> (\<not> fst s2' \<longrightarrow> \<not> fst s1' \<and> a = b \<and> s1' = s2'))
     (?orc_lft (flg, ams, es, as) query) (?orc_rgt (flg, ams, es, as) query)" for flg ams es as query
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. rel_spmf (\<lambda>(a, s1') (b, s2'). (fst s2' \<longrightarrow> fst s1') \<and> (\<not> fst s2' \<longrightarrow> \<not> fst s1' \<and> a = b \<and> s1' = s2')) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (flg, ams, es, as) query) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (flg, ams, es, as) query)
[PROOF STEP]
proof (cases query)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>a. query = Inl a \<Longrightarrow> rel_spmf (\<lambda>(a, s1') (b, s2'). (fst s2' \<longrightarrow> fst s1') \<and> (\<not> fst s2' \<longrightarrow> \<not> fst s1' \<and> a = b \<and> s1' = s2')) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (flg, ams, es, as) query) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (flg, ams, es, as) query)
 2. \<And>b. query = Inr b \<Longrightarrow> rel_spmf (\<lambda>(a, s1') (b, s2'). (fst s2' \<longrightarrow> fst s1') \<and> (\<not> fst s2' \<longrightarrow> \<not> fst s1' \<and> a = b \<and> s1' = s2')) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (flg, ams, es, as) query) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (flg, ams, es, as) query)
[PROOF STEP]
case (Inl adv_query)
[PROOF STATE]
proof (state)
this:
query = Inl adv_query

goal (2 subgoals):
 1. \<And>a. query = Inl a \<Longrightarrow> rel_spmf (\<lambda>(a, s1') (b, s2'). (fst s2' \<longrightarrow> fst s1') \<and> (\<not> fst s2' \<longrightarrow> \<not> fst s1' \<and> a = b \<and> s1' = s2')) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (flg, ams, es, as) query) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (flg, ams, es, as) query)
 2. \<And>b. query = Inr b \<Longrightarrow> rel_spmf (\<lambda>(a, s1') (b, s2'). (fst s2' \<longrightarrow> fst s1') \<and> (\<not> fst s2' \<longrightarrow> \<not> fst s1' \<and> a = b \<and> s1' = s2')) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (flg, ams, es, as) query) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (flg, ams, es, as) query)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
query = Inl adv_query
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
query = Inl adv_query

goal (1 subgoal):
 1. rel_spmf (\<lambda>(a, s1') (b, s2'). (fst s2' \<longrightarrow> fst s1') \<and> (\<not> fst s2' \<longrightarrow> \<not> fst s1' \<and> a = b \<and> s1' = s2')) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (flg, ams, es, as) query) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (flg, ams, es, as) query)
[PROOF STEP]
by (auto simp add: spmf_rel_map map_spmf_conv_bind_spmf intro: rel_spmf_bind_reflI)
[PROOF STATE]
proof (state)
this:
rel_spmf (\<lambda>(a, s1') (b, s2'). (fst s2' \<longrightarrow> fst s1') \<and> (\<not> fst s2' \<longrightarrow> \<not> fst s1' \<and> a = b \<and> s1' = s2')) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (flg, ams, es, as) query) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (flg, ams, es, as) query)

goal (1 subgoal):
 1. \<And>b. query = Inr b \<Longrightarrow> rel_spmf (\<lambda>(a, s1') (b, s2'). (fst s2' \<longrightarrow> fst s1') \<and> (\<not> fst s2' \<longrightarrow> \<not> fst s1' \<and> a = b \<and> s1' = s2')) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (flg, ams, es, as) query) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (flg, ams, es, as) query)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>b. query = Inr b \<Longrightarrow> rel_spmf (\<lambda>(a, s1') (b, s2'). (fst s2' \<longrightarrow> fst s1') \<and> (\<not> fst s2' \<longrightarrow> \<not> fst s1' \<and> a = b \<and> s1' = s2')) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (flg, ams, es, as) query) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (flg, ams, es, as) query)
[PROOF STEP]
case (Inr query')
[PROOF STATE]
proof (state)
this:
query = Inr query'

goal (1 subgoal):
 1. \<And>b. query = Inr b \<Longrightarrow> rel_spmf (\<lambda>(a, s1') (b, s2'). (fst s2' \<longrightarrow> fst s1') \<and> (\<not> fst s2' \<longrightarrow> \<not> fst s1' \<and> a = b \<and> s1' = s2')) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (flg, ams, es, as) query) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (flg, ams, es, as) query)
[PROOF STEP]
note Snd_Rcv = this
[PROOF STATE]
proof (state)
this:
query = Inr query'

goal (1 subgoal):
 1. \<And>b. query = Inr b \<Longrightarrow> rel_spmf (\<lambda>(a, s1') (b, s2'). (fst s2' \<longrightarrow> fst s1') \<and> (\<not> fst s2' \<longrightarrow> \<not> fst s1' \<and> a = b \<and> s1' = s2')) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (flg, ams, es, as) query) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (flg, ams, es, as) query)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. rel_spmf (\<lambda>(a, s1') (b, s2'). (fst s2' \<longrightarrow> fst s1') \<and> (\<not> fst s2' \<longrightarrow> \<not> fst s1' \<and> a = b \<and> s1' = s2')) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (flg, ams, es, as) query) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (flg, ams, es, as) query)
[PROOF STEP]
proof (cases query')
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>a. query' = Inl a \<Longrightarrow> rel_spmf (\<lambda>(a, s1') (b, s2'). (fst s2' \<longrightarrow> fst s1') \<and> (\<not> fst s2' \<longrightarrow> \<not> fst s1' \<and> a = b \<and> s1' = s2')) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (flg, ams, es, as) query) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (flg, ams, es, as) query)
 2. \<And>b. query' = Inr b \<Longrightarrow> rel_spmf (\<lambda>(a, s1') (b, s2'). (fst s2' \<longrightarrow> fst s1') \<and> (\<not> fst s2' \<longrightarrow> \<not> fst s1' \<and> a = b \<and> s1' = s2')) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (flg, ams, es, as) query) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (flg, ams, es, as) query)
[PROOF STEP]
case (Inl snd_query)
[PROOF STATE]
proof (state)
this:
query' = Inl snd_query

goal (2 subgoals):
 1. \<And>a. query' = Inl a \<Longrightarrow> rel_spmf (\<lambda>(a, s1') (b, s2'). (fst s2' \<longrightarrow> fst s1') \<and> (\<not> fst s2' \<longrightarrow> \<not> fst s1' \<and> a = b \<and> s1' = s2')) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (flg, ams, es, as) query) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (flg, ams, es, as) query)
 2. \<And>b. query' = Inr b \<Longrightarrow> rel_spmf (\<lambda>(a, s1') (b, s2'). (fst s2' \<longrightarrow> fst s1') \<and> (\<not> fst s2' \<longrightarrow> \<not> fst s1' \<and> a = b \<and> s1' = s2')) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (flg, ams, es, as) query) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (flg, ams, es, as) query)
[PROOF STEP]
with Snd_Rcv
[PROOF STATE]
proof (chain)
picking this:
query = Inr query'
query' = Inl snd_query
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
query = Inr query'
query' = Inl snd_query

goal (1 subgoal):
 1. rel_spmf (\<lambda>(a, s1') (b, s2'). (fst s2' \<longrightarrow> fst s1') \<and> (\<not> fst s2' \<longrightarrow> \<not> fst s1' \<and> a = b \<and> s1' = s2')) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (flg, ams, es, as) query) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (flg, ams, es, as) query)
[PROOF STEP]
by (auto simp add: spmf_rel_map map_spmf_conv_bind_spmf intro: rel_spmf_bind_reflI)
[PROOF STATE]
proof (state)
this:
rel_spmf (\<lambda>(a, s1') (b, s2'). (fst s2' \<longrightarrow> fst s1') \<and> (\<not> fst s2' \<longrightarrow> \<not> fst s1' \<and> a = b \<and> s1' = s2')) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (flg, ams, es, as) query) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (flg, ams, es, as) query)

goal (1 subgoal):
 1. \<And>b. query' = Inr b \<Longrightarrow> rel_spmf (\<lambda>(a, s1') (b, s2'). (fst s2' \<longrightarrow> fst s1') \<and> (\<not> fst s2' \<longrightarrow> \<not> fst s1' \<and> a = b \<and> s1' = s2')) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (flg, ams, es, as) query) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (flg, ams, es, as) query)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>b. query' = Inr b \<Longrightarrow> rel_spmf (\<lambda>(a, s1') (b, s2'). (fst s2' \<longrightarrow> fst s1') \<and> (\<not> fst s2' \<longrightarrow> \<not> fst s1' \<and> a = b \<and> s1' = s2')) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (flg, ams, es, as) query) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (flg, ams, es, as) query)
[PROOF STEP]
case (Inr rcv_query)
[PROOF STATE]
proof (state)
this:
query' = Inr rcv_query

goal (1 subgoal):
 1. \<And>b. query' = Inr b \<Longrightarrow> rel_spmf (\<lambda>(a, s1') (b, s2'). (fst s2' \<longrightarrow> fst s1') \<and> (\<not> fst s2' \<longrightarrow> \<not> fst s1' \<and> a = b \<and> s1' = s2')) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (flg, ams, es, as) query) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (flg, ams, es, as) query)
[PROOF STEP]
with Snd_Rcv
[PROOF STATE]
proof (chain)
picking this:
query = Inr query'
query' = Inr rcv_query
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
query = Inr query'
query' = Inr rcv_query

goal (1 subgoal):
 1. rel_spmf (\<lambda>(a, s1') (b, s2'). (fst s2' \<longrightarrow> fst s1') \<and> (\<not> fst s2' \<longrightarrow> \<not> fst s1' \<and> a = b \<and> s1' = s2')) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (flg, ams, es, as) query) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (flg, ams, es, as) query)
[PROOF STEP]
proof (cases es)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<lbrakk>query = Inr query'; query' = Inr rcv_query; es = None\<rbrakk> \<Longrightarrow> rel_spmf (\<lambda>(a, s1') (b, s2'). (fst s2' \<longrightarrow> fst s1') \<and> (\<not> fst s2' \<longrightarrow> \<not> fst s1' \<and> a = b \<and> s1' = s2')) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (flg, ams, es, as) query) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (flg, ams, es, as) query)
 2. \<And>a. \<lbrakk>query = Inr query'; query' = Inr rcv_query; es = Some a\<rbrakk> \<Longrightarrow> rel_spmf (\<lambda>(a, s1') (b, s2'). (fst s2' \<longrightarrow> fst s1') \<and> (\<not> fst s2' \<longrightarrow> \<not> fst s1' \<and> a = b \<and> s1' = s2')) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (flg, ams, es, as) query) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (flg, ams, es, as) query)
[PROOF STEP]
case (Some am')
[PROOF STATE]
proof (state)
this:
es = Some am'

goal (2 subgoals):
 1. \<lbrakk>query = Inr query'; query' = Inr rcv_query; es = None\<rbrakk> \<Longrightarrow> rel_spmf (\<lambda>(a, s1') (b, s2'). (fst s2' \<longrightarrow> fst s1') \<and> (\<not> fst s2' \<longrightarrow> \<not> fst s1' \<and> a = b \<and> s1' = s2')) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (flg, ams, es, as) query) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (flg, ams, es, as) query)
 2. \<And>a. \<lbrakk>query = Inr query'; query' = Inr rcv_query; es = Some a\<rbrakk> \<Longrightarrow> rel_spmf (\<lambda>(a, s1') (b, s2'). (fst s2' \<longrightarrow> fst s1') \<and> (\<not> fst s2' \<longrightarrow> \<not> fst s1' \<and> a = b \<and> s1' = s2')) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (flg, ams, es, as) query) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (flg, ams, es, as) query)
[PROOF STEP]
obtain a' m' where "am' = (a', m')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>a' m'. am' = (a', m') \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (cases am')
[PROOF STATE]
proof (state)
this:
am' = (a', m')

goal (2 subgoals):
 1. \<lbrakk>query = Inr query'; query' = Inr rcv_query; es = None\<rbrakk> \<Longrightarrow> rel_spmf (\<lambda>(a, s1') (b, s2'). (fst s2' \<longrightarrow> fst s1') \<and> (\<not> fst s2' \<longrightarrow> \<not> fst s1' \<and> a = b \<and> s1' = s2')) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (flg, ams, es, as) query) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (flg, ams, es, as) query)
 2. \<And>a. \<lbrakk>query = Inr query'; query' = Inr rcv_query; es = Some a\<rbrakk> \<Longrightarrow> rel_spmf (\<lambda>(a, s1') (b, s2'). (fst s2' \<longrightarrow> fst s1') \<and> (\<not> fst s2' \<longrightarrow> \<not> fst s1' \<and> a = b \<and> s1' = s2')) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (flg, ams, es, as) query) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (flg, ams, es, as) query)
[PROOF STEP]
with Snd_Rcv Some Inr
[PROOF STATE]
proof (chain)
picking this:
query = Inr query'
es = Some am'
query' = Inr rcv_query
am' = (a', m')
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
query = Inr query'
es = Some am'
query' = Inr rcv_query
am' = (a', m')

goal (1 subgoal):
 1. rel_spmf (\<lambda>(a, s1') (b, s2'). (fst s2' \<longrightarrow> fst s1') \<and> (\<not> fst s2' \<longrightarrow> \<not> fst s1' \<and> a = b \<and> s1' = s2')) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (flg, ams, es, as) query) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (flg, ams, es, as) query)
[PROOF STEP]
by (cases ams) (auto simp add: spmf_rel_map map_spmf_conv_bind_spmf
                lazy_channel_recv'_def lazy_channel_recv_f'_def rel_spmf_bind_reflI split:option.splits)
[PROOF STATE]
proof (state)
this:
rel_spmf (\<lambda>(a, s1') (b, s2'). (fst s2' \<longrightarrow> fst s1') \<and> (\<not> fst s2' \<longrightarrow> \<not> fst s1' \<and> a = b \<and> s1' = s2')) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (flg, ams, es, as) query) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (flg, ams, es, as) query)

goal (1 subgoal):
 1. \<lbrakk>query = Inr query'; query' = Inr rcv_query; es = None\<rbrakk> \<Longrightarrow> rel_spmf (\<lambda>(a, s1') (b, s2'). (fst s2' \<longrightarrow> fst s1') \<and> (\<not> fst s2' \<longrightarrow> \<not> fst s1' \<and> a = b \<and> s1' = s2')) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (flg, ams, es, as) query) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (flg, ams, es, as) query)
[PROOF STEP]
qed (cases ams; auto simp add: lazy_channel_recv'_def lazy_channel_recv_f'_def split:option.splits)
[PROOF STATE]
proof (state)
this:
rel_spmf (\<lambda>(a, s1') (b, s2'). (fst s2' \<longrightarrow> fst s1') \<and> (\<not> fst s2' \<longrightarrow> \<not> fst s1' \<and> a = b \<and> s1' = s2')) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (flg, ams, es, as) query) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (flg, ams, es, as) query)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
rel_spmf (\<lambda>(a, s1') (b, s2'). (fst s2' \<longrightarrow> fst s1') \<and> (\<not> fst s2' \<longrightarrow> \<not> fst s1' \<and> a = b \<and> s1' = s2')) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (flg, ams, es, as) query) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (flg, ams, es, as) query)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
rel_spmf (\<lambda>(a, s1') (b, s2'). (fst s2' \<longrightarrow> fst s1') \<and> (\<not> fst s2' \<longrightarrow> \<not> fst s1' \<and> a = b \<and> s1' = s2')) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (?flg, ?ams, ?es, ?as) ?query) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (?flg, ?ams, ?es, ?as) ?query)

goal (1 subgoal):
 1. \<bar>spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True\<bar> \<le> Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x}
[PROOF STEP]
let ?\<I> = "\<I>_uniform (Set.Collect (valid_mac_query \<eta>)) UNIV \<oplus>\<^sub>\<I> (\<I>_uniform (vld \<eta>) UNIV \<oplus>\<^sub>\<I> \<I>_full)"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<bar>spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True\<bar> \<le> Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x}
[PROOF STEP]
let ?\<A> = "mk_lossless_gpv (responses_\<I> \<I>) True \<A>"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<bar>spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True\<bar> \<le> Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x}
[PROOF STEP]
have "plossless_gpv ?\<I> ?\<A>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. plossless_gpv (\<I>_uniform (Set.Collect (valid_mac_query \<eta>)) UNIV \<oplus>\<^sub>\<I> (\<I>_uniform (vld \<eta>) UNIV \<oplus>\<^sub>\<I> \<I>_full)) (mk_lossless_gpv (responses_\<I> \<I>) True \<A>)
[PROOF STEP]
using lossless WT
[PROOF STATE]
proof (prove)
using this:
plossless_gpv \<I> \<A>
\<I> \<turnstile>g \<A> \<surd>

goal (1 subgoal):
 1. plossless_gpv (\<I>_uniform (Set.Collect (valid_mac_query \<eta>)) UNIV \<oplus>\<^sub>\<I> (\<I>_uniform (vld \<eta>) UNIV \<oplus>\<^sub>\<I> \<I>_full)) (mk_lossless_gpv (responses_\<I> \<I>) True \<A>)
[PROOF STEP]
by(rule plossless_gpv_mk_lossless_gpv)(simp add: \<I>_def)
[PROOF STATE]
proof (state)
this:
plossless_gpv (\<I>_uniform (Set.Collect (valid_mac_query \<eta>)) UNIV \<oplus>\<^sub>\<I> (\<I>_uniform (vld \<eta>) UNIV \<oplus>\<^sub>\<I> \<I>_full)) (mk_lossless_gpv (responses_\<I> \<I>) True \<A>)

goal (1 subgoal):
 1. \<bar>spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True\<bar> \<le> Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x}
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
plossless_gpv (\<I>_uniform (Set.Collect (valid_mac_query \<eta>)) UNIV \<oplus>\<^sub>\<I> (\<I>_uniform (vld \<eta>) UNIV \<oplus>\<^sub>\<I> \<I>_full)) (mk_lossless_gpv (responses_\<I> \<I>) True \<A>)

goal (1 subgoal):
 1. \<bar>spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True\<bar> \<le> Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x}
[PROOF STEP]
have "?\<I> \<turnstile>g ?\<A> \<surd>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<I>_uniform (Set.Collect (valid_mac_query \<eta>)) UNIV \<oplus>\<^sub>\<I> (\<I>_uniform (vld \<eta>) UNIV \<oplus>\<^sub>\<I> \<I>_full) \<turnstile>g mk_lossless_gpv (responses_\<I> \<I>) True \<A> \<surd>
[PROOF STEP]
using WT
[PROOF STATE]
proof (prove)
using this:
\<I> \<turnstile>g \<A> \<surd>

goal (1 subgoal):
 1. \<I>_uniform (Set.Collect (valid_mac_query \<eta>)) UNIV \<oplus>\<^sub>\<I> (\<I>_uniform (vld \<eta>) UNIV \<oplus>\<^sub>\<I> \<I>_full) \<turnstile>g mk_lossless_gpv (responses_\<I> \<I>) True \<A> \<surd>
[PROOF STEP]
by(rule WT_gpv_mk_lossless_gpv)(simp add: \<I>_def)
[PROOF STATE]
proof (state)
this:
\<I>_uniform (Set.Collect (valid_mac_query \<eta>)) UNIV \<oplus>\<^sub>\<I> (\<I>_uniform (vld \<eta>) UNIV \<oplus>\<^sub>\<I> \<I>_full) \<turnstile>g mk_lossless_gpv (responses_\<I> \<I>) True \<A> \<surd>

goal (1 subgoal):
 1. \<bar>spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True\<bar> \<le> Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x}
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
plossless_gpv (\<I>_uniform (Set.Collect (valid_mac_query \<eta>)) UNIV \<oplus>\<^sub>\<I> (\<I>_uniform (vld \<eta>) UNIV \<oplus>\<^sub>\<I> \<I>_full)) (mk_lossless_gpv (responses_\<I> \<I>) True \<A>)
\<I>_uniform (Set.Collect (valid_mac_query \<eta>)) UNIV \<oplus>\<^sub>\<I> (\<I>_uniform (vld \<eta>) UNIV \<oplus>\<^sub>\<I> \<I>_full) \<turnstile>g mk_lossless_gpv (responses_\<I> \<I>) True \<A> \<surd>
[PROOF STEP]
have "rel_spmf (\<lambda>x y. fst (snd x) = fst (snd y) \<and> (\<not> fst (snd y) \<longrightarrow> (fst x \<longleftrightarrow> fst y)))
      (exec_gpv ?orc_lft ?\<A> (False, Void, None, Map.empty)) (exec_gpv ?orc_rgt ?\<A> (False, Void, None, Map.empty))"
[PROOF STATE]
proof (prove)
using this:
plossless_gpv (\<I>_uniform (Set.Collect (valid_mac_query \<eta>)) UNIV \<oplus>\<^sub>\<I> (\<I>_uniform (vld \<eta>) UNIV \<oplus>\<^sub>\<I> \<I>_full)) (mk_lossless_gpv (responses_\<I> \<I>) True \<A>)
\<I>_uniform (Set.Collect (valid_mac_query \<eta>)) UNIV \<oplus>\<^sub>\<I> (\<I>_uniform (vld \<eta>) UNIV \<oplus>\<^sub>\<I> \<I>_full) \<turnstile>g mk_lossless_gpv (responses_\<I> \<I>) True \<A> \<surd>

goal (1 subgoal):
 1. rel_spmf (\<lambda>x y. fst (snd x) = fst (snd y) \<and> (\<not> fst (snd y) \<longrightarrow> fst x = fst y)) (exec_gpv (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (mk_lossless_gpv (responses_\<I> \<I>) True \<A>) (False, Void, None, Map.empty)) (exec_gpv (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (mk_lossless_gpv (responses_\<I> \<I>) True \<A>) (False, Void, None, Map.empty))
[PROOF STEP]
by(auto simp add: \<I>_def intro!: exec_gpv_oracle_bisim_bad_plossless[where X="(=)" and
            X_bad="\<lambda> _ _. True" and ?bad1.0="fst" and ?bad2.0="fst" and \<I> = "?\<I>", THEN rel_spmf_mono])
        (auto simp add: lazy_channel_insec'_def intro: WT_calleeI)
[PROOF STATE]
proof (state)
this:
rel_spmf (\<lambda>x y. fst (snd x) = fst (snd y) \<and> (\<not> fst (snd y) \<longrightarrow> fst x = fst y)) (exec_gpv (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (mk_lossless_gpv (responses_\<I> \<I>) True \<A>) (False, Void, None, Map.empty)) (exec_gpv (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (mk_lossless_gpv (responses_\<I> \<I>) True \<A>) (False, Void, None, Map.empty))

goal (1 subgoal):
 1. \<bar>spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True\<bar> \<le> Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x}
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
rel_spmf (\<lambda>x y. fst (snd x) = fst (snd y) \<and> (\<not> fst (snd y) \<longrightarrow> fst x = fst y)) (exec_gpv (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (mk_lossless_gpv (responses_\<I> \<I>) True \<A>) (False, Void, None, Map.empty)) (exec_gpv (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (mk_lossless_gpv (responses_\<I> \<I>) True \<A>) (False, Void, None, Map.empty))

goal (1 subgoal):
 1. \<bar>spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True\<bar> \<le> Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x}
[PROOF STEP]
let ?I = "(\<lambda>(_, s1, s2, s3). pred_cstate (\<lambda>x. length x = \<eta>) s1 \<and> pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) s2 \<and> ran s3 \<subseteq> nlists UNIV \<eta>)"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<bar>spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True\<bar> \<le> Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x}
[PROOF STEP]
have "callee_invariant_on (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') ?I \<I>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. callee_invariant_on (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (\<lambda>(uu_, s1, s2, s3). pred_cstate (\<lambda>x. length x = \<eta>) s1 \<and> pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) s2 \<and> ran s3 \<subseteq> nlists UNIV \<eta>) \<I>
[PROOF STEP]
apply(unfold_locales)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>s x y s'. \<lbrakk>(y, s') \<in> set_spmf ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') s x); case s of (uu_, s1, s2, s3) \<Rightarrow> pred_cstate (\<lambda>x. length x = \<eta>) s1 \<and> pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) s2 \<and> ran s3 \<subseteq> nlists UNIV \<eta>; x \<in> outs_\<I> \<I>\<rbrakk> \<Longrightarrow> case s' of (uu_, s1, s2, s3) \<Rightarrow> pred_cstate (\<lambda>x. length x = \<eta>) s1 \<and> pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) s2 \<and> ran s3 \<subseteq> nlists UNIV \<eta>
 2. \<And>s. case s of (uu_, s1, s2, s3) \<Rightarrow> pred_cstate (\<lambda>x. length x = \<eta>) s1 \<and> pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) s2 \<and> ran s3 \<subseteq> nlists UNIV \<eta> \<Longrightarrow> \<I> \<turnstile>c (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') s \<surd>
[PROOF STEP]
subgoal for s x y s'
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(y, s') \<in> set_spmf ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') s x); case s of (uu_, s1, s2, s3) \<Rightarrow> pred_cstate (\<lambda>x. length x = \<eta>) s1 \<and> pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) s2 \<and> ran s3 \<subseteq> nlists UNIV \<eta>; x \<in> outs_\<I> \<I>\<rbrakk> \<Longrightarrow> case s' of (uu_, s1, s2, s3) \<Rightarrow> pred_cstate (\<lambda>x. length x = \<eta>) s1 \<and> pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) s2 \<and> ran s3 \<subseteq> nlists UNIV \<eta>
[PROOF STEP]
supply [[simproc del: defined_all]]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(y, s') \<in> set_spmf ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') s x); case s of (uu_, s1, s2, s3) \<Rightarrow> pred_cstate (\<lambda>x. length x = \<eta>) s1 \<and> pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) s2 \<and> ran s3 \<subseteq> nlists UNIV \<eta>; x \<in> outs_\<I> \<I>\<rbrakk> \<Longrightarrow> case s' of (uu_, s1, s2, s3) \<Rightarrow> pred_cstate (\<lambda>x. length x = \<eta>) s1 \<and> pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) s2 \<and> ran s3 \<subseteq> nlists UNIV \<eta>
[PROOF STEP]
apply(clarsimp simp add: \<I>_def; elim PlusE; clarsimp simp add: lazy_channel_insec'_def lazy_channel_send'_def lazy_channel_recv_f'_def)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>xa ab ac ba xaa ah ai aj bc. \<lbrakk>s' = (xa, ai, aj, bc); s = (xa, ab, ac, ba); pred_cstate (\<lambda>x. length x = \<eta>) ab; pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) ac; ran ba \<subseteq> nlists UNIV \<eta>; valid_mac_query \<eta> xaa; x = Inl xaa; (ah, ai, aj, bc) \<in> set_spmf (lazy_channel_insec (ab, ac, ba) xaa); y = Inl ah\<rbrakk> \<Longrightarrow> pred_cstate (\<lambda>x. length x = \<eta>) ai \<and> pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) aj \<and> ran bc \<subseteq> nlists UNIV \<eta>
 2. \<And>xa ab ac ba xaa ak al bd. \<lbrakk>s' = (xa, ak, al, bd); s = (xa, ab, ac, ba); pred_cstate (\<lambda>x. length x = \<eta>) ab; pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) ac; ran ba \<subseteq> nlists UNIV \<eta>; x = Inr (Inl xaa); xaa \<in> vld \<eta>; ((), ak, al, bd) \<in> set_spmf (lazy_channel_send (ab, ac, ba) xaa); y = Inr (Inl ())\<rbrakk> \<Longrightarrow> pred_cstate (\<lambda>x. length x = \<eta>) ak \<and> pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) al \<and> ran bd \<subseteq> nlists UNIV \<eta>
 3. \<And>xa ab ac ba ah ai aj ak bc. \<lbrakk>s' = (ai, aj, ak, bc); s = (xa, ab, ac, ba); pred_cstate (\<lambda>x. length x = \<eta>) ab; pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) ac; ran ba \<subseteq> nlists UNIV \<eta>; x = Inr (Inr ()); (ah, ai, aj, ak, bc) \<in> set_spmf (case ab of cstate.Collect m \<Rightarrow> case ac of None \<Rightarrow> return_spmf (Some m, xa, cstate.Fail, None, ba) | Some (a', m') \<Rightarrow> case ba m' of None \<Rightarrow> spmf_of_set (rnd \<eta>) \<bind> (\<lambda>a. return_spmf (None, xa \<or> a = a', cstate.Fail, None, ba(m' \<mapsto> a))) | Some a \<Rightarrow> return_spmf (if a = a' then Some m' else None, xa, cstate.Fail, None, ba) | _ \<Rightarrow> case ac of None \<Rightarrow> return_spmf (None, xa, ab, ac, ba) | Some (a', m') \<Rightarrow> case ba m' of None \<Rightarrow> spmf_of_set (rnd \<eta>) \<bind> (\<lambda>a. return_spmf (None, xa \<or> a = a', cstate.Fail, None, ba(m' \<mapsto> a))) | Some a \<Rightarrow> return_spmf (if a = a' then Some m' else None, xa, cstate.Fail, None, ba)); y = Inr (Inr ah)\<rbrakk> \<Longrightarrow> pred_cstate (\<lambda>x. length x = \<eta>) aj \<and> pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) ak \<and> ran bc \<subseteq> nlists UNIV \<eta>
[PROOF STEP]
subgoal for _ _ _ _ x'
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>s' = (xa_, ai_, aj_, bc_); s = (xa_, ab_, ac_, ba_); pred_cstate (\<lambda>x. length x = \<eta>) ab_; pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) ac_; ran ba_ \<subseteq> nlists UNIV \<eta>; valid_mac_query \<eta> x'; x = Inl x'; (ah_, ai_, aj_, bc_) \<in> set_spmf (lazy_channel_insec (ab_, ac_, ba_) x'); y = Inl ah_\<rbrakk> \<Longrightarrow> pred_cstate (\<lambda>x. length x = \<eta>) ai_ \<and> pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) aj_ \<and> ran bc_ \<subseteq> nlists UNIV \<eta>
[PROOF STEP]
by(cases "(snd s, x')" rule: lazy_channel_insec.cases)
            (auto simp add: vld_def in_nlists_UNIV rnd_def split: option.split_asm)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>xa ab ac ba xaa ak al bd. \<lbrakk>s' = (xa, ak, al, bd); s = (xa, ab, ac, ba); pred_cstate (\<lambda>x. length x = \<eta>) ab; pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) ac; ran ba \<subseteq> nlists UNIV \<eta>; x = Inr (Inl xaa); xaa \<in> vld \<eta>; ((), ak, al, bd) \<in> set_spmf (lazy_channel_send (ab, ac, ba) xaa); y = Inr (Inl ())\<rbrakk> \<Longrightarrow> pred_cstate (\<lambda>x. length x = \<eta>) ak \<and> pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) al \<and> ran bd \<subseteq> nlists UNIV \<eta>
 2. \<And>xa ab ac ba ah ai aj ak bc. \<lbrakk>s' = (ai, aj, ak, bc); s = (xa, ab, ac, ba); pred_cstate (\<lambda>x. length x = \<eta>) ab; pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) ac; ran ba \<subseteq> nlists UNIV \<eta>; x = Inr (Inr ()); (ah, ai, aj, ak, bc) \<in> set_spmf (case ab of cstate.Collect m \<Rightarrow> case ac of None \<Rightarrow> return_spmf (Some m, xa, cstate.Fail, None, ba) | Some (a', m') \<Rightarrow> case ba m' of None \<Rightarrow> spmf_of_set (rnd \<eta>) \<bind> (\<lambda>a. return_spmf (None, xa \<or> a = a', cstate.Fail, None, ba(m' \<mapsto> a))) | Some a \<Rightarrow> return_spmf (if a = a' then Some m' else None, xa, cstate.Fail, None, ba) | _ \<Rightarrow> case ac of None \<Rightarrow> return_spmf (None, xa, ab, ac, ba) | Some (a', m') \<Rightarrow> case ba m' of None \<Rightarrow> spmf_of_set (rnd \<eta>) \<bind> (\<lambda>a. return_spmf (None, xa \<or> a = a', cstate.Fail, None, ba(m' \<mapsto> a))) | Some a \<Rightarrow> return_spmf (if a = a' then Some m' else None, xa, cstate.Fail, None, ba)); y = Inr (Inr ah)\<rbrakk> \<Longrightarrow> pred_cstate (\<lambda>x. length x = \<eta>) aj \<and> pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) ak \<and> ran bc \<subseteq> nlists UNIV \<eta>
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>s' = (xa_, ak_, al_, bd_); s = (xa_, ab_, ac_, ba_); pred_cstate (\<lambda>x. length x = \<eta>) ab_; pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) ac_; ran ba_ \<subseteq> nlists UNIV \<eta>; x = Inr (Inl xaa_); xaa_ \<in> vld \<eta>; ((), ak_, al_, bd_) \<in> set_spmf (lazy_channel_send (ab_, ac_, ba_) xaa_); y = Inr (Inl ())\<rbrakk> \<Longrightarrow> pred_cstate (\<lambda>x. length x = \<eta>) ak_ \<and> pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) al_ \<and> ran bd_ \<subseteq> nlists UNIV \<eta>
[PROOF STEP]
by(cases "(snd s, projl (projr x))" rule: lazy_channel_send.cases)(auto simp add: vld_def in_nlists_UNIV)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>xa ab ac ba ah ai aj ak bc. \<lbrakk>s' = (ai, aj, ak, bc); s = (xa, ab, ac, ba); pred_cstate (\<lambda>x. length x = \<eta>) ab; pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) ac; ran ba \<subseteq> nlists UNIV \<eta>; x = Inr (Inr ()); (ah, ai, aj, ak, bc) \<in> set_spmf (case ab of cstate.Collect m \<Rightarrow> case ac of None \<Rightarrow> return_spmf (Some m, xa, cstate.Fail, None, ba) | Some (a', m') \<Rightarrow> case ba m' of None \<Rightarrow> spmf_of_set (rnd \<eta>) \<bind> (\<lambda>a. return_spmf (None, xa \<or> a = a', cstate.Fail, None, ba(m' \<mapsto> a))) | Some a \<Rightarrow> return_spmf (if a = a' then Some m' else None, xa, cstate.Fail, None, ba) | _ \<Rightarrow> case ac of None \<Rightarrow> return_spmf (None, xa, ab, ac, ba) | Some (a', m') \<Rightarrow> case ba m' of None \<Rightarrow> spmf_of_set (rnd \<eta>) \<bind> (\<lambda>a. return_spmf (None, xa \<or> a = a', cstate.Fail, None, ba(m' \<mapsto> a))) | Some a \<Rightarrow> return_spmf (if a = a' then Some m' else None, xa, cstate.Fail, None, ba)); y = Inr (Inr ah)\<rbrakk> \<Longrightarrow> pred_cstate (\<lambda>x. length x = \<eta>) aj \<and> pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) ak \<and> ran bc \<subseteq> nlists UNIV \<eta>
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>s' = (ai_, aj_, ak_, bc_); s = (xa_, ab_, ac_, ba_); pred_cstate (\<lambda>x. length x = \<eta>) ab_; pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) ac_; ran ba_ \<subseteq> nlists UNIV \<eta>; x = Inr (Inr ()); (ah_, ai_, aj_, ak_, bc_) \<in> set_spmf (case ab_ of cstate.Collect m \<Rightarrow> case ac_ of None \<Rightarrow> return_spmf (Some m, xa_, cstate.Fail, None, ba_) | Some (a', m') \<Rightarrow> case ba_ m' of None \<Rightarrow> spmf_of_set (rnd \<eta>) \<bind> (\<lambda>a. return_spmf (None, xa_ \<or> a = a', cstate.Fail, None, ba_(m' \<mapsto> a))) | Some a \<Rightarrow> return_spmf (if a = a' then Some m' else None, xa_, cstate.Fail, None, ba_) | _ \<Rightarrow> case ac_ of None \<Rightarrow> return_spmf (None, xa_, ab_, ac_, ba_) | Some (a', m') \<Rightarrow> case ba_ m' of None \<Rightarrow> spmf_of_set (rnd \<eta>) \<bind> (\<lambda>a. return_spmf (None, xa_ \<or> a = a', cstate.Fail, None, ba_(m' \<mapsto> a))) | Some a \<Rightarrow> return_spmf (if a = a' then Some m' else None, xa_, cstate.Fail, None, ba_)); y = Inr (Inr ah_)\<rbrakk> \<Longrightarrow> pred_cstate (\<lambda>x. length x = \<eta>) aj_ \<and> pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) ak_ \<and> ran bc_ \<subseteq> nlists UNIV \<eta>
[PROOF STEP]
by(cases "(snd s, ())" rule: lazy_channel_recv_f.cases)(auto 4 3 split: option.split_asm if_split_asm cstate.split_asm simp add: in_nlists_UNIV vld_def ran_def rnd_def option.pred_set )
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. case s of (uu_, s1, s2, s3) \<Rightarrow> pred_cstate (\<lambda>x. length x = \<eta>) s1 \<and> pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) s2 \<and> ran s3 \<subseteq> nlists UNIV \<eta> \<Longrightarrow> \<I> \<turnstile>c (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') s \<surd>
[PROOF STEP]
subgoal for s
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. case s of (uu_, s1, s2, s3) \<Rightarrow> pred_cstate (\<lambda>x. length x = \<eta>) s1 \<and> pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) s2 \<and> ran s3 \<subseteq> nlists UNIV \<eta> \<Longrightarrow> \<I> \<turnstile>c (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') s \<surd>
[PROOF STEP]
apply(clarsimp simp add: \<I>_def; intro conjI WT_calleeI; clarsimp simp add: lazy_channel_insec'_def lazy_channel_send'_def lazy_channel_recv_f'_def)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>x a aa b call ae af ag bb. \<lbrakk>s = (x, a, aa, b); pred_cstate (\<lambda>x. length x = \<eta>) a; pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) aa; ran b \<subseteq> nlists UNIV \<eta>; valid_mac_query \<eta> call; (ae, af, ag, bb) \<in> set_spmf (lazy_channel_insec (a, aa, b) call); ae \<notin> Some ` (nlists UNIV \<eta> \<times> nlists UNIV \<eta>)\<rbrakk> \<Longrightarrow> ae = None
 2. \<And>x a aa b ret ab ac ad ba. \<lbrakk>s = (x, a, aa, b); pred_cstate (\<lambda>x. length x = \<eta>) a; pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) aa; ran b \<subseteq> nlists UNIV \<eta>; (ret, ab, ac, ad, ba) \<in> set_spmf (case a of cstate.Collect m \<Rightarrow> case aa of None \<Rightarrow> return_spmf (Some m, x, cstate.Fail, None, b) | Some (a', m') \<Rightarrow> case b m' of None \<Rightarrow> spmf_of_set (rnd \<eta>) \<bind> (\<lambda>a. return_spmf (None, x \<or> a = a', cstate.Fail, None, b(m' \<mapsto> a))) | Some a \<Rightarrow> return_spmf (if a = a' then Some m' else None, x, cstate.Fail, None, b) | _ \<Rightarrow> case aa of None \<Rightarrow> return_spmf (None, x, a, aa, b) | Some (a', m') \<Rightarrow> case b m' of None \<Rightarrow> spmf_of_set (rnd \<eta>) \<bind> (\<lambda>a. return_spmf (None, x \<or> a = a', cstate.Fail, None, b(m' \<mapsto> a))) | Some a \<Rightarrow> return_spmf (if a = a' then Some m' else None, x, cstate.Fail, None, b)); ret \<notin> Some ` vld \<eta>\<rbrakk> \<Longrightarrow> ret = None
[PROOF STEP]
subgoal for _ _ _ _ x
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>s = (x_, a_, aa_, b_); pred_cstate (\<lambda>x. length x = \<eta>) a_; pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) aa_; ran b_ \<subseteq> nlists UNIV \<eta>; valid_mac_query \<eta> x; (ae_, af_, ag_, bb_) \<in> set_spmf (lazy_channel_insec (a_, aa_, b_) x); ae_ \<notin> Some ` (nlists UNIV \<eta> \<times> nlists UNIV \<eta>)\<rbrakk> \<Longrightarrow> ae_ = None
[PROOF STEP]
by(cases "(snd s, x)" rule: lazy_channel_insec.cases)
            (auto simp add: vld_def in_nlists_UNIV rnd_def ran_def split: option.split_asm)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x a aa b ret ab ac ad ba. \<lbrakk>s = (x, a, aa, b); pred_cstate (\<lambda>x. length x = \<eta>) a; pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) aa; ran b \<subseteq> nlists UNIV \<eta>; (ret, ab, ac, ad, ba) \<in> set_spmf (case a of cstate.Collect m \<Rightarrow> case aa of None \<Rightarrow> return_spmf (Some m, x, cstate.Fail, None, b) | Some (a', m') \<Rightarrow> case b m' of None \<Rightarrow> spmf_of_set (rnd \<eta>) \<bind> (\<lambda>a. return_spmf (None, x \<or> a = a', cstate.Fail, None, b(m' \<mapsto> a))) | Some a \<Rightarrow> return_spmf (if a = a' then Some m' else None, x, cstate.Fail, None, b) | _ \<Rightarrow> case aa of None \<Rightarrow> return_spmf (None, x, a, aa, b) | Some (a', m') \<Rightarrow> case b m' of None \<Rightarrow> spmf_of_set (rnd \<eta>) \<bind> (\<lambda>a. return_spmf (None, x \<or> a = a', cstate.Fail, None, b(m' \<mapsto> a))) | Some a \<Rightarrow> return_spmf (if a = a' then Some m' else None, x, cstate.Fail, None, b)); ret \<notin> Some ` vld \<eta>\<rbrakk> \<Longrightarrow> ret = None
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>s = (x_, a_, aa_, b_); pred_cstate (\<lambda>x. length x = \<eta>) a_; pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) aa_; ran b_ \<subseteq> nlists UNIV \<eta>; (ret_, ab_, ac_, ad_, ba_) \<in> set_spmf (case a_ of cstate.Collect m \<Rightarrow> case aa_ of None \<Rightarrow> return_spmf (Some m, x_, cstate.Fail, None, b_) | Some (a', m') \<Rightarrow> case b_ m' of None \<Rightarrow> spmf_of_set (rnd \<eta>) \<bind> (\<lambda>a. return_spmf (None, x_ \<or> a = a', cstate.Fail, None, b_(m' \<mapsto> a))) | Some a \<Rightarrow> return_spmf (if a = a' then Some m' else None, x_, cstate.Fail, None, b_) | _ \<Rightarrow> case aa_ of None \<Rightarrow> return_spmf (None, x_, a_, aa_, b_) | Some (a', m') \<Rightarrow> case b_ m' of None \<Rightarrow> spmf_of_set (rnd \<eta>) \<bind> (\<lambda>a. return_spmf (None, x_ \<or> a = a', cstate.Fail, None, b_(m' \<mapsto> a))) | Some a \<Rightarrow> return_spmf (if a = a' then Some m' else None, x_, cstate.Fail, None, b_)); ret_ \<notin> Some ` vld \<eta>\<rbrakk> \<Longrightarrow> ret_ = None
[PROOF STEP]
by(cases "(snd s, ())" rule: lazy_channel_recv_f.cases)(auto 4 3 split: option.split_asm if_split_asm cstate.split_asm simp add: in_nlists_UNIV vld_def ran_def rnd_def)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
callee_invariant_on (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (\<lambda>(uu_, s1, s2, s3). pred_cstate (\<lambda>x. length x = \<eta>) s1 \<and> pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) s2 \<and> ran s3 \<subseteq> nlists UNIV \<eta>) \<I>

goal (1 subgoal):
 1. \<bar>spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True\<bar> \<le> Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
callee_invariant_on (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (\<lambda>(uu_, s1, s2, s3). pred_cstate (\<lambda>x. length x = \<eta>) s1 \<and> pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) s2 \<and> ran s3 \<subseteq> nlists UNIV \<eta>) \<I>
[PROOF STEP]
have "exec_gpv ?orc_lft ?\<A> (False, Void, None, Map.empty) = exec_gpv ?orc_lft \<A> (False, Void, None, Map.empty)"
[PROOF STATE]
proof (prove)
using this:
callee_invariant_on (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (\<lambda>(uu_, s1, s2, s3). pred_cstate (\<lambda>x. length x = \<eta>) s1 \<and> pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) s2 \<and> ran s3 \<subseteq> nlists UNIV \<eta>) \<I>

goal (1 subgoal):
 1. exec_gpv (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (mk_lossless_gpv (responses_\<I> \<I>) True \<A>) (False, Void, None, Map.empty) = exec_gpv (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') \<A> (False, Void, None, Map.empty)
[PROOF STEP]
using WT
[PROOF STATE]
proof (prove)
using this:
callee_invariant_on (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (\<lambda>(uu_, s1, s2, s3). pred_cstate (\<lambda>x. length x = \<eta>) s1 \<and> pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) s2 \<and> ran s3 \<subseteq> nlists UNIV \<eta>) \<I>
\<I> \<turnstile>g \<A> \<surd>

goal (1 subgoal):
 1. exec_gpv (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (mk_lossless_gpv (responses_\<I> \<I>) True \<A>) (False, Void, None, Map.empty) = exec_gpv (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') \<A> (False, Void, None, Map.empty)
[PROOF STEP]
by(rule callee_invariant_on.exec_gpv_mk_lossless_gpv) simp
[PROOF STATE]
proof (state)
this:
exec_gpv (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (mk_lossless_gpv (responses_\<I> \<I>) True \<A>) (False, Void, None, Map.empty) = exec_gpv (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') \<A> (False, Void, None, Map.empty)

goal (1 subgoal):
 1. \<bar>spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True\<bar> \<le> Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x}
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
exec_gpv (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (mk_lossless_gpv (responses_\<I> \<I>) True \<A>) (False, Void, None, Map.empty) = exec_gpv (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') \<A> (False, Void, None, Map.empty)

goal (1 subgoal):
 1. \<bar>spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True\<bar> \<le> Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x}
[PROOF STEP]
have "callee_invariant_on (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') ?I \<I>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. callee_invariant_on (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (\<lambda>(uu_, s1, s2, s3). pred_cstate (\<lambda>x. length x = \<eta>) s1 \<and> pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) s2 \<and> ran s3 \<subseteq> nlists UNIV \<eta>) \<I>
[PROOF STEP]
apply(unfold_locales)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>s x y s'. \<lbrakk>(y, s') \<in> set_spmf ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') s x); case s of (uu_, s1, s2, s3) \<Rightarrow> pred_cstate (\<lambda>x. length x = \<eta>) s1 \<and> pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) s2 \<and> ran s3 \<subseteq> nlists UNIV \<eta>; x \<in> outs_\<I> \<I>\<rbrakk> \<Longrightarrow> case s' of (uu_, s1, s2, s3) \<Rightarrow> pred_cstate (\<lambda>x. length x = \<eta>) s1 \<and> pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) s2 \<and> ran s3 \<subseteq> nlists UNIV \<eta>
 2. \<And>s. case s of (uu_, s1, s2, s3) \<Rightarrow> pred_cstate (\<lambda>x. length x = \<eta>) s1 \<and> pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) s2 \<and> ran s3 \<subseteq> nlists UNIV \<eta> \<Longrightarrow> \<I> \<turnstile>c (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') s \<surd>
[PROOF STEP]
subgoal for s x y s'
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(y, s') \<in> set_spmf ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') s x); case s of (uu_, s1, s2, s3) \<Rightarrow> pred_cstate (\<lambda>x. length x = \<eta>) s1 \<and> pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) s2 \<and> ran s3 \<subseteq> nlists UNIV \<eta>; x \<in> outs_\<I> \<I>\<rbrakk> \<Longrightarrow> case s' of (uu_, s1, s2, s3) \<Rightarrow> pred_cstate (\<lambda>x. length x = \<eta>) s1 \<and> pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) s2 \<and> ran s3 \<subseteq> nlists UNIV \<eta>
[PROOF STEP]
supply [[simproc del: defined_all]]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(y, s') \<in> set_spmf ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') s x); case s of (uu_, s1, s2, s3) \<Rightarrow> pred_cstate (\<lambda>x. length x = \<eta>) s1 \<and> pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) s2 \<and> ran s3 \<subseteq> nlists UNIV \<eta>; x \<in> outs_\<I> \<I>\<rbrakk> \<Longrightarrow> case s' of (uu_, s1, s2, s3) \<Rightarrow> pred_cstate (\<lambda>x. length x = \<eta>) s1 \<and> pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) s2 \<and> ran s3 \<subseteq> nlists UNIV \<eta>
[PROOF STEP]
apply(clarsimp simp add: \<I>_def; elim PlusE; clarsimp simp add: lazy_channel_insec'_def lazy_channel_send'_def lazy_channel_recv'_def)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>xa ab ac ba xaa ah ai aj bc. \<lbrakk>s' = (xa, ai, aj, bc); s = (xa, ab, ac, ba); pred_cstate (\<lambda>x. length x = \<eta>) ab; pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) ac; ran ba \<subseteq> nlists UNIV \<eta>; valid_mac_query \<eta> xaa; x = Inl xaa; (ah, ai, aj, bc) \<in> set_spmf (lazy_channel_insec (ab, ac, ba) xaa); y = Inl ah\<rbrakk> \<Longrightarrow> pred_cstate (\<lambda>x. length x = \<eta>) ai \<and> pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) aj \<and> ran bc \<subseteq> nlists UNIV \<eta>
 2. \<And>xa ab ac ba xaa ak al bd. \<lbrakk>s' = (xa, ak, al, bd); s = (xa, ab, ac, ba); pred_cstate (\<lambda>x. length x = \<eta>) ab; pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) ac; ran ba \<subseteq> nlists UNIV \<eta>; x = Inr (Inl xaa); xaa \<in> vld \<eta>; ((), ak, al, bd) \<in> set_spmf (lazy_channel_send (ab, ac, ba) xaa); y = Inr (Inl ())\<rbrakk> \<Longrightarrow> pred_cstate (\<lambda>x. length x = \<eta>) ak \<and> pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) al \<and> ran bd \<subseteq> nlists UNIV \<eta>
 3. \<And>xa ab ac ba ah ai aj ak bc. \<lbrakk>s' = (ai, aj, ak, bc); s = (xa, ab, ac, ba); pred_cstate (\<lambda>x. length x = \<eta>) ab; pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) ac; ran ba \<subseteq> nlists UNIV \<eta>; x = Inr (Inr ()); (ah, ai, aj, ak, bc) \<in> set_spmf (case ab of cstate.Collect m \<Rightarrow> case ac of None \<Rightarrow> return_spmf (Some m, xa, cstate.Fail, None, ba) | Some (a', m') \<Rightarrow> case ba m' of None \<Rightarrow> spmf_of_set (rnd \<eta>) \<bind> (\<lambda>a. return_spmf (if a = a' then Some m' else None, xa \<or> a = a', cstate.Fail, None, ba(m' \<mapsto> a))) | Some a \<Rightarrow> return_spmf (if a = a' then Some m' else None, xa, cstate.Fail, None, ba) | _ \<Rightarrow> case ac of None \<Rightarrow> return_spmf (None, xa, ab, ac, ba) | Some (a', m') \<Rightarrow> case ba m' of None \<Rightarrow> spmf_of_set (rnd \<eta>) \<bind> (\<lambda>a. return_spmf (if a = a' then Some m' else None, xa \<or> a = a', cstate.Fail, None, ba(m' \<mapsto> a))) | Some a \<Rightarrow> return_spmf (if a = a' then Some m' else None, xa, cstate.Fail, None, ba)); y = Inr (Inr ah)\<rbrakk> \<Longrightarrow> pred_cstate (\<lambda>x. length x = \<eta>) aj \<and> pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) ak \<and> ran bc \<subseteq> nlists UNIV \<eta>
[PROOF STEP]
subgoal for _ _ _ _ x'
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>s' = (xa_, ai_, aj_, bc_); s = (xa_, ab_, ac_, ba_); pred_cstate (\<lambda>x. length x = \<eta>) ab_; pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) ac_; ran ba_ \<subseteq> nlists UNIV \<eta>; valid_mac_query \<eta> x'; x = Inl x'; (ah_, ai_, aj_, bc_) \<in> set_spmf (lazy_channel_insec (ab_, ac_, ba_) x'); y = Inl ah_\<rbrakk> \<Longrightarrow> pred_cstate (\<lambda>x. length x = \<eta>) ai_ \<and> pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) aj_ \<and> ran bc_ \<subseteq> nlists UNIV \<eta>
[PROOF STEP]
by(cases "(snd s, x')" rule: lazy_channel_insec.cases)
            (auto simp add: vld_def in_nlists_UNIV rnd_def split: option.split_asm)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>xa ab ac ba xaa ak al bd. \<lbrakk>s' = (xa, ak, al, bd); s = (xa, ab, ac, ba); pred_cstate (\<lambda>x. length x = \<eta>) ab; pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) ac; ran ba \<subseteq> nlists UNIV \<eta>; x = Inr (Inl xaa); xaa \<in> vld \<eta>; ((), ak, al, bd) \<in> set_spmf (lazy_channel_send (ab, ac, ba) xaa); y = Inr (Inl ())\<rbrakk> \<Longrightarrow> pred_cstate (\<lambda>x. length x = \<eta>) ak \<and> pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) al \<and> ran bd \<subseteq> nlists UNIV \<eta>
 2. \<And>xa ab ac ba ah ai aj ak bc. \<lbrakk>s' = (ai, aj, ak, bc); s = (xa, ab, ac, ba); pred_cstate (\<lambda>x. length x = \<eta>) ab; pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) ac; ran ba \<subseteq> nlists UNIV \<eta>; x = Inr (Inr ()); (ah, ai, aj, ak, bc) \<in> set_spmf (case ab of cstate.Collect m \<Rightarrow> case ac of None \<Rightarrow> return_spmf (Some m, xa, cstate.Fail, None, ba) | Some (a', m') \<Rightarrow> case ba m' of None \<Rightarrow> spmf_of_set (rnd \<eta>) \<bind> (\<lambda>a. return_spmf (if a = a' then Some m' else None, xa \<or> a = a', cstate.Fail, None, ba(m' \<mapsto> a))) | Some a \<Rightarrow> return_spmf (if a = a' then Some m' else None, xa, cstate.Fail, None, ba) | _ \<Rightarrow> case ac of None \<Rightarrow> return_spmf (None, xa, ab, ac, ba) | Some (a', m') \<Rightarrow> case ba m' of None \<Rightarrow> spmf_of_set (rnd \<eta>) \<bind> (\<lambda>a. return_spmf (if a = a' then Some m' else None, xa \<or> a = a', cstate.Fail, None, ba(m' \<mapsto> a))) | Some a \<Rightarrow> return_spmf (if a = a' then Some m' else None, xa, cstate.Fail, None, ba)); y = Inr (Inr ah)\<rbrakk> \<Longrightarrow> pred_cstate (\<lambda>x. length x = \<eta>) aj \<and> pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) ak \<and> ran bc \<subseteq> nlists UNIV \<eta>
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>s' = (xa_, ak_, al_, bd_); s = (xa_, ab_, ac_, ba_); pred_cstate (\<lambda>x. length x = \<eta>) ab_; pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) ac_; ran ba_ \<subseteq> nlists UNIV \<eta>; x = Inr (Inl xaa_); xaa_ \<in> vld \<eta>; ((), ak_, al_, bd_) \<in> set_spmf (lazy_channel_send (ab_, ac_, ba_) xaa_); y = Inr (Inl ())\<rbrakk> \<Longrightarrow> pred_cstate (\<lambda>x. length x = \<eta>) ak_ \<and> pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) al_ \<and> ran bd_ \<subseteq> nlists UNIV \<eta>
[PROOF STEP]
by(cases "(snd s, projl (projr x))" rule: lazy_channel_send.cases)(auto simp add: vld_def in_nlists_UNIV)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>xa ab ac ba ah ai aj ak bc. \<lbrakk>s' = (ai, aj, ak, bc); s = (xa, ab, ac, ba); pred_cstate (\<lambda>x. length x = \<eta>) ab; pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) ac; ran ba \<subseteq> nlists UNIV \<eta>; x = Inr (Inr ()); (ah, ai, aj, ak, bc) \<in> set_spmf (case ab of cstate.Collect m \<Rightarrow> case ac of None \<Rightarrow> return_spmf (Some m, xa, cstate.Fail, None, ba) | Some (a', m') \<Rightarrow> case ba m' of None \<Rightarrow> spmf_of_set (rnd \<eta>) \<bind> (\<lambda>a. return_spmf (if a = a' then Some m' else None, xa \<or> a = a', cstate.Fail, None, ba(m' \<mapsto> a))) | Some a \<Rightarrow> return_spmf (if a = a' then Some m' else None, xa, cstate.Fail, None, ba) | _ \<Rightarrow> case ac of None \<Rightarrow> return_spmf (None, xa, ab, ac, ba) | Some (a', m') \<Rightarrow> case ba m' of None \<Rightarrow> spmf_of_set (rnd \<eta>) \<bind> (\<lambda>a. return_spmf (if a = a' then Some m' else None, xa \<or> a = a', cstate.Fail, None, ba(m' \<mapsto> a))) | Some a \<Rightarrow> return_spmf (if a = a' then Some m' else None, xa, cstate.Fail, None, ba)); y = Inr (Inr ah)\<rbrakk> \<Longrightarrow> pred_cstate (\<lambda>x. length x = \<eta>) aj \<and> pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) ak \<and> ran bc \<subseteq> nlists UNIV \<eta>
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>s' = (ai_, aj_, ak_, bc_); s = (xa_, ab_, ac_, ba_); pred_cstate (\<lambda>x. length x = \<eta>) ab_; pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) ac_; ran ba_ \<subseteq> nlists UNIV \<eta>; x = Inr (Inr ()); (ah_, ai_, aj_, ak_, bc_) \<in> set_spmf (case ab_ of cstate.Collect m \<Rightarrow> case ac_ of None \<Rightarrow> return_spmf (Some m, xa_, cstate.Fail, None, ba_) | Some (a', m') \<Rightarrow> case ba_ m' of None \<Rightarrow> spmf_of_set (rnd \<eta>) \<bind> (\<lambda>a. return_spmf (if a = a' then Some m' else None, xa_ \<or> a = a', cstate.Fail, None, ba_(m' \<mapsto> a))) | Some a \<Rightarrow> return_spmf (if a = a' then Some m' else None, xa_, cstate.Fail, None, ba_) | _ \<Rightarrow> case ac_ of None \<Rightarrow> return_spmf (None, xa_, ab_, ac_, ba_) | Some (a', m') \<Rightarrow> case ba_ m' of None \<Rightarrow> spmf_of_set (rnd \<eta>) \<bind> (\<lambda>a. return_spmf (if a = a' then Some m' else None, xa_ \<or> a = a', cstate.Fail, None, ba_(m' \<mapsto> a))) | Some a \<Rightarrow> return_spmf (if a = a' then Some m' else None, xa_, cstate.Fail, None, ba_)); y = Inr (Inr ah_)\<rbrakk> \<Longrightarrow> pred_cstate (\<lambda>x. length x = \<eta>) aj_ \<and> pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) ak_ \<and> ran bc_ \<subseteq> nlists UNIV \<eta>
[PROOF STEP]
by(cases "(snd s, ())" rule: lazy_channel_recv.cases)(auto 4 3 split: option.split_asm if_split_asm cstate.split_asm simp add: in_nlists_UNIV vld_def ran_def rnd_def option.pred_set )
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. case s of (uu_, s1, s2, s3) \<Rightarrow> pred_cstate (\<lambda>x. length x = \<eta>) s1 \<and> pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) s2 \<and> ran s3 \<subseteq> nlists UNIV \<eta> \<Longrightarrow> \<I> \<turnstile>c (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') s \<surd>
[PROOF STEP]
subgoal for s
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. case s of (uu_, s1, s2, s3) \<Rightarrow> pred_cstate (\<lambda>x. length x = \<eta>) s1 \<and> pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) s2 \<and> ran s3 \<subseteq> nlists UNIV \<eta> \<Longrightarrow> \<I> \<turnstile>c (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') s \<surd>
[PROOF STEP]
apply(clarsimp simp add: \<I>_def; intro conjI WT_calleeI; clarsimp simp add: lazy_channel_insec'_def lazy_channel_send'_def lazy_channel_recv'_def)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>x a aa b call ae af ag bb. \<lbrakk>s = (x, a, aa, b); pred_cstate (\<lambda>x. length x = \<eta>) a; pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) aa; ran b \<subseteq> nlists UNIV \<eta>; valid_mac_query \<eta> call; (ae, af, ag, bb) \<in> set_spmf (lazy_channel_insec (a, aa, b) call); ae \<notin> Some ` (nlists UNIV \<eta> \<times> nlists UNIV \<eta>)\<rbrakk> \<Longrightarrow> ae = None
 2. \<And>x a aa b ret ab ac ad ba. \<lbrakk>s = (x, a, aa, b); pred_cstate (\<lambda>x. length x = \<eta>) a; pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) aa; ran b \<subseteq> nlists UNIV \<eta>; (ret, ab, ac, ad, ba) \<in> set_spmf (case a of cstate.Collect m \<Rightarrow> case aa of None \<Rightarrow> return_spmf (Some m, x, cstate.Fail, None, b) | Some (a', m') \<Rightarrow> case b m' of None \<Rightarrow> spmf_of_set (rnd \<eta>) \<bind> (\<lambda>a. return_spmf (if a = a' then Some m' else None, x \<or> a = a', cstate.Fail, None, b(m' \<mapsto> a))) | Some a \<Rightarrow> return_spmf (if a = a' then Some m' else None, x, cstate.Fail, None, b) | _ \<Rightarrow> case aa of None \<Rightarrow> return_spmf (None, x, a, aa, b) | Some (a', m') \<Rightarrow> case b m' of None \<Rightarrow> spmf_of_set (rnd \<eta>) \<bind> (\<lambda>a. return_spmf (if a = a' then Some m' else None, x \<or> a = a', cstate.Fail, None, b(m' \<mapsto> a))) | Some a \<Rightarrow> return_spmf (if a = a' then Some m' else None, x, cstate.Fail, None, b)); ret \<notin> Some ` vld \<eta>\<rbrakk> \<Longrightarrow> ret = None
[PROOF STEP]
subgoal for _ _ _ _ x
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>s = (x_, a_, aa_, b_); pred_cstate (\<lambda>x. length x = \<eta>) a_; pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) aa_; ran b_ \<subseteq> nlists UNIV \<eta>; valid_mac_query \<eta> x; (ae_, af_, ag_, bb_) \<in> set_spmf (lazy_channel_insec (a_, aa_, b_) x); ae_ \<notin> Some ` (nlists UNIV \<eta> \<times> nlists UNIV \<eta>)\<rbrakk> \<Longrightarrow> ae_ = None
[PROOF STEP]
by(cases "(snd s, x)" rule: lazy_channel_insec.cases)
            (auto simp add: vld_def in_nlists_UNIV rnd_def ran_def split: option.split_asm)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x a aa b ret ab ac ad ba. \<lbrakk>s = (x, a, aa, b); pred_cstate (\<lambda>x. length x = \<eta>) a; pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) aa; ran b \<subseteq> nlists UNIV \<eta>; (ret, ab, ac, ad, ba) \<in> set_spmf (case a of cstate.Collect m \<Rightarrow> case aa of None \<Rightarrow> return_spmf (Some m, x, cstate.Fail, None, b) | Some (a', m') \<Rightarrow> case b m' of None \<Rightarrow> spmf_of_set (rnd \<eta>) \<bind> (\<lambda>a. return_spmf (if a = a' then Some m' else None, x \<or> a = a', cstate.Fail, None, b(m' \<mapsto> a))) | Some a \<Rightarrow> return_spmf (if a = a' then Some m' else None, x, cstate.Fail, None, b) | _ \<Rightarrow> case aa of None \<Rightarrow> return_spmf (None, x, a, aa, b) | Some (a', m') \<Rightarrow> case b m' of None \<Rightarrow> spmf_of_set (rnd \<eta>) \<bind> (\<lambda>a. return_spmf (if a = a' then Some m' else None, x \<or> a = a', cstate.Fail, None, b(m' \<mapsto> a))) | Some a \<Rightarrow> return_spmf (if a = a' then Some m' else None, x, cstate.Fail, None, b)); ret \<notin> Some ` vld \<eta>\<rbrakk> \<Longrightarrow> ret = None
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>s = (x_, a_, aa_, b_); pred_cstate (\<lambda>x. length x = \<eta>) a_; pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) aa_; ran b_ \<subseteq> nlists UNIV \<eta>; (ret_, ab_, ac_, ad_, ba_) \<in> set_spmf (case a_ of cstate.Collect m \<Rightarrow> case aa_ of None \<Rightarrow> return_spmf (Some m, x_, cstate.Fail, None, b_) | Some (a', m') \<Rightarrow> case b_ m' of None \<Rightarrow> spmf_of_set (rnd \<eta>) \<bind> (\<lambda>a. return_spmf (if a = a' then Some m' else None, x_ \<or> a = a', cstate.Fail, None, b_(m' \<mapsto> a))) | Some a \<Rightarrow> return_spmf (if a = a' then Some m' else None, x_, cstate.Fail, None, b_) | _ \<Rightarrow> case aa_ of None \<Rightarrow> return_spmf (None, x_, a_, aa_, b_) | Some (a', m') \<Rightarrow> case b_ m' of None \<Rightarrow> spmf_of_set (rnd \<eta>) \<bind> (\<lambda>a. return_spmf (if a = a' then Some m' else None, x_ \<or> a = a', cstate.Fail, None, b_(m' \<mapsto> a))) | Some a \<Rightarrow> return_spmf (if a = a' then Some m' else None, x_, cstate.Fail, None, b_)); ret_ \<notin> Some ` vld \<eta>\<rbrakk> \<Longrightarrow> ret_ = None
[PROOF STEP]
by(cases "(snd s, ())" rule: lazy_channel_recv.cases)(auto 4 3 split: option.split_asm if_split_asm cstate.split_asm simp add: in_nlists_UNIV vld_def ran_def rnd_def)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
callee_invariant_on (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (\<lambda>(uu_, s1, s2, s3). pred_cstate (\<lambda>x. length x = \<eta>) s1 \<and> pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) s2 \<and> ran s3 \<subseteq> nlists UNIV \<eta>) \<I>

goal (1 subgoal):
 1. \<bar>spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True\<bar> \<le> Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
callee_invariant_on (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (\<lambda>(uu_, s1, s2, s3). pred_cstate (\<lambda>x. length x = \<eta>) s1 \<and> pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) s2 \<and> ran s3 \<subseteq> nlists UNIV \<eta>) \<I>
[PROOF STEP]
have "exec_gpv ?orc_rgt ?\<A> (False, Void, None, Map.empty) = exec_gpv ?orc_rgt \<A> (False, Void, None, Map.empty)"
[PROOF STATE]
proof (prove)
using this:
callee_invariant_on (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (\<lambda>(uu_, s1, s2, s3). pred_cstate (\<lambda>x. length x = \<eta>) s1 \<and> pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) s2 \<and> ran s3 \<subseteq> nlists UNIV \<eta>) \<I>

goal (1 subgoal):
 1. exec_gpv (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (mk_lossless_gpv (responses_\<I> \<I>) True \<A>) (False, Void, None, Map.empty) = exec_gpv (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') \<A> (False, Void, None, Map.empty)
[PROOF STEP]
using WT
[PROOF STATE]
proof (prove)
using this:
callee_invariant_on (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (\<lambda>(uu_, s1, s2, s3). pred_cstate (\<lambda>x. length x = \<eta>) s1 \<and> pred_option (\<lambda>(x, y). length x = \<eta> \<and> length y = \<eta>) s2 \<and> ran s3 \<subseteq> nlists UNIV \<eta>) \<I>
\<I> \<turnstile>g \<A> \<surd>

goal (1 subgoal):
 1. exec_gpv (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (mk_lossless_gpv (responses_\<I> \<I>) True \<A>) (False, Void, None, Map.empty) = exec_gpv (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') \<A> (False, Void, None, Map.empty)
[PROOF STEP]
by(rule callee_invariant_on.exec_gpv_mk_lossless_gpv) simp
[PROOF STATE]
proof (state)
this:
exec_gpv (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (mk_lossless_gpv (responses_\<I> \<I>) True \<A>) (False, Void, None, Map.empty) = exec_gpv (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') \<A> (False, Void, None, Map.empty)

goal (1 subgoal):
 1. \<bar>spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True\<bar> \<le> Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x}
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
rel_spmf (\<lambda>x y. fst (snd x) = fst (snd y) \<and> (\<not> fst (snd y) \<longrightarrow> fst x = fst y)) (exec_gpv (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') \<A> (False, Void, None, Map.empty)) (exec_gpv (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') \<A> (False, Void, None, Map.empty))
[PROOF STEP]
have "\<bar>Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. fst x}
          - Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv')) {x. fst x}\<bar>
        \<le> Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x}"
[PROOF STATE]
proof (prove)
using this:
rel_spmf (\<lambda>x y. fst (snd x) = fst (snd y) \<and> (\<not> fst (snd y) \<longrightarrow> fst x = fst y)) (exec_gpv (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') \<A> (False, Void, None, Map.empty)) (exec_gpv (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') \<A> (False, Void, None, Map.empty))

goal (1 subgoal):
 1. \<bar>Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. fst x} - Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv')) {x. fst x}\<bar> \<le> Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x}
[PROOF STEP]
unfolding game_def
[PROOF STATE]
proof (prove)
using this:
rel_spmf (\<lambda>x y. fst (snd x) = fst (snd y) \<and> (\<not> fst (snd y) \<longrightarrow> fst x = fst y)) (exec_gpv (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') \<A> (False, Void, None, Map.empty)) (exec_gpv (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') \<A> (False, Void, None, Map.empty))

goal (1 subgoal):
 1. \<bar>Sigma_Algebra.measure (measure_spmf (exec_gpv (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') \<A> (False, Void, None, Map.empty) \<bind> (\<lambda>(b, flg, ams, es, as). return_spmf (b, flg)))) {x. fst x} - Sigma_Algebra.measure (measure_spmf (exec_gpv (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') \<A> (False, Void, None, Map.empty) \<bind> (\<lambda>(b, flg, ams, es, as). return_spmf (b, flg)))) {x. fst x}\<bar> \<le> Sigma_Algebra.measure (measure_spmf (exec_gpv (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') \<A> (False, Void, None, Map.empty) \<bind> (\<lambda>(b, flg, ams, es, as). return_spmf (b, flg)))) {x. snd x}
[PROOF STEP]
by - (rule fundamental_lemma[where ?bad2.0="snd"]; auto simp add: spmf_rel_map map_spmf_conv_bind_spmf[symmetric] split_def)
[PROOF STATE]
proof (state)
this:
\<bar>Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. fst x} - Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv')) {x. fst x}\<bar> \<le> Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x}

goal (1 subgoal):
 1. \<bar>spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True\<bar> \<le> Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x}
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<bar>Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. fst x} - Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv')) {x. fst x}\<bar> \<le> Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x}

goal (1 subgoal):
 1. \<bar>spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True\<bar> \<le> Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x}
[PROOF STEP]
have "Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. fst x} = spmf ?L True"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. fst x} = spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True
[PROOF STEP]
unfolding game_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Sigma_Algebra.measure (measure_spmf (exec_gpv (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') \<A> (False, Void, None, Map.empty) \<bind> (\<lambda>(b, flg, ams, es, as). return_spmf (b, flg)))) {x. fst x} = spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True
[PROOF STEP]
by(auto simp add: map_spmf_conv_bind_spmf exec_gpv_resource_of_oracle connect_def spmf_conv_measure_spmf)
        (auto simp add: rel_pred_def intro!: rel_spmf_bind_reflI measure_spmf_parametric[where A="\<lambda>l r. fst l \<longleftrightarrow> r", THEN rel_funD, THEN rel_funD])
[PROOF STATE]
proof (state)
this:
Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. fst x} = spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True

goal (1 subgoal):
 1. \<bar>spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True\<bar> \<le> Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x}
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. fst x} = spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True

goal (1 subgoal):
 1. \<bar>spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True\<bar> \<le> Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x}
[PROOF STEP]
have "spmf ?R True = Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv')) {x. fst x}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True = Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv')) {x. fst x}
[PROOF STEP]
unfolding game_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True = Sigma_Algebra.measure (measure_spmf (exec_gpv (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') \<A> (False, Void, None, Map.empty) \<bind> (\<lambda>(b, flg, ams, es, as). return_spmf (b, flg)))) {x. fst x}
[PROOF STEP]
by(auto simp add: map_spmf_conv_bind_spmf exec_gpv_resource_of_oracle connect_def spmf_conv_measure_spmf)
        (auto simp add: rel_pred_def intro!: rel_spmf_bind_reflI measure_spmf_parametric[where A="\<lambda>l r. l \<longleftrightarrow> fst r", THEN rel_funD, THEN rel_funD])
[PROOF STATE]
proof (state)
this:
spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True = Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv')) {x. fst x}

goal (1 subgoal):
 1. \<bar>spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True\<bar> \<le> Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x}
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<bar>Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. fst x} - Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv')) {x. fst x}\<bar> \<le> Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x}
Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. fst x} = spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True
spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True = Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv')) {x. fst x}
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<bar>Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. fst x} - Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv')) {x. fst x}\<bar> \<le> Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x}
Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. fst x} = spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True
spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True = Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv')) {x. fst x}

goal (1 subgoal):
 1. \<bar>spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True\<bar> \<le> Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x}
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<bar>spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True\<bar> \<le> Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x}

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<bar>spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True\<bar> \<le> Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x}

goal (1 subgoal):
 1. \<bar>spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) (Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) (Void, None, Map.empty))) True\<bar> \<le> real q / real (2 ^ \<eta>)
[PROOF STEP]
have fact3: "spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True
    = spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) (Void, None, Map.empty))) True"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True = spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) (Void, None, Map.empty))) True
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True = spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) (Void, None, Map.empty))) True
[PROOF STEP]
let ?orc_lft = "lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv'"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True = spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) (Void, None, Map.empty))) True
[PROOF STEP]
let ?orc_rgt = "lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True = spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) (Void, None, Map.empty))) True
[PROOF STEP]
have[simp]: "rel_spmf (rel_prod (=) (\<lambda>x y. y = snd x))
      (lazy_channel_insec' (flg, s) q) (lazy_channel_insec s q)" for s flg q
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. rel_spmf (rel_prod (=) (\<lambda>x y. y = snd x)) (lazy_channel_insec' (flg, s) q) (lazy_channel_insec s q)
[PROOF STEP]
by (cases s) (simp add: lazy_channel_insec'_def spmf_rel_map rel_prod_sel split_def option.rel_refl pmf.rel_refl split:option.split)
[PROOF STATE]
proof (state)
this:
rel_spmf (rel_prod (=) (\<lambda>x y. y = snd x)) (lazy_channel_insec' (?flg, ?s) ?q) (lazy_channel_insec ?s ?q)

goal (1 subgoal):
 1. spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True = spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) (Void, None, Map.empty))) True
[PROOF STEP]
have[simp]: "rel_spmf (rel_prod (=) (\<lambda>x y. y = snd x))
      (lazy_channel_send' (flg, s) q) (lazy_channel_send s q)" for s flg q
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. rel_spmf (rel_prod (=) (\<lambda>x y. y = snd x)) (lazy_channel_send' (flg, s) q) (lazy_channel_send s q)
[PROOF STEP]
by(cases "(s, q)" rule: lazy_channel_send.cases)(auto simp add: spmf_rel_map map_spmf_conv_bind_spmf split_def lazy_channel_send'_def)
[PROOF STATE]
proof (state)
this:
rel_spmf (rel_prod (=) (\<lambda>x y. y = snd x)) (lazy_channel_send' (?flg, ?s) ?q) (lazy_channel_send ?s ?q)

goal (1 subgoal):
 1. spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True = spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) (Void, None, Map.empty))) True
[PROOF STEP]
have[simp]: "rel_spmf (rel_prod (=) (\<lambda>x y. y = snd x))
       (lazy_channel_recv' (flg, s) q) (lazy_channel_recv s q)" for s flg q
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. rel_spmf (rel_prod (=) (\<lambda>x y. y = snd x)) (lazy_channel_recv' (flg, s) q) (lazy_channel_recv s q)
[PROOF STEP]
by(cases "(s, q)" rule: lazy_channel_recv.cases)(auto simp add: lazy_channel_recv'_def rel_spmf_bind_reflI split:option.split cstate.split)
[PROOF STATE]
proof (state)
this:
rel_spmf (rel_prod (=) (\<lambda>x y. y = snd x)) (lazy_channel_recv' (?flg, ?s) ?q) (lazy_channel_recv ?s ?q)

goal (1 subgoal):
 1. spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True = spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) (Void, None, Map.empty))) True
[PROOF STEP]
have[simp]: "rel_spmf (rel_prod (=) (\<lambda>x y. y = snd x))
     ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (flg, ams, es, as) query)
     ((lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) (ams, es, as)  query)" for flg ams es as query
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. rel_spmf (rel_prod (=) (\<lambda>x y. y = snd x)) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (flg, ams, es, as) query) ((lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) (ams, es, as) query)
[PROOF STEP]
proof (cases query)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>a. query = Inl a \<Longrightarrow> rel_spmf (rel_prod (=) (\<lambda>x y. y = snd x)) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (flg, ams, es, as) query) ((lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) (ams, es, as) query)
 2. \<And>b. query = Inr b \<Longrightarrow> rel_spmf (rel_prod (=) (\<lambda>x y. y = snd x)) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (flg, ams, es, as) query) ((lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) (ams, es, as) query)
[PROOF STEP]
case (Inl adv_query)
[PROOF STATE]
proof (state)
this:
query = Inl adv_query

goal (2 subgoals):
 1. \<And>a. query = Inl a \<Longrightarrow> rel_spmf (rel_prod (=) (\<lambda>x y. y = snd x)) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (flg, ams, es, as) query) ((lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) (ams, es, as) query)
 2. \<And>b. query = Inr b \<Longrightarrow> rel_spmf (rel_prod (=) (\<lambda>x y. y = snd x)) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (flg, ams, es, as) query) ((lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) (ams, es, as) query)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
query = Inl adv_query
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
query = Inl adv_query

goal (1 subgoal):
 1. rel_spmf (rel_prod (=) (\<lambda>x y. y = snd x)) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (flg, ams, es, as) query) ((lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) (ams, es, as) query)
[PROOF STEP]
by(auto simp add: spmf_rel_map map_spmf_conv_bind_spmf[symmetric] apfst_def map_prod_def split_beta intro: rel_spmf_mono[where A="rel_prod (=) (\<lambda>x y. y = snd x)"])
[PROOF STATE]
proof (state)
this:
rel_spmf (rel_prod (=) (\<lambda>x y. y = snd x)) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (flg, ams, es, as) query) ((lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) (ams, es, as) query)

goal (1 subgoal):
 1. \<And>b. query = Inr b \<Longrightarrow> rel_spmf (rel_prod (=) (\<lambda>x y. y = snd x)) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (flg, ams, es, as) query) ((lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) (ams, es, as) query)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>b. query = Inr b \<Longrightarrow> rel_spmf (rel_prod (=) (\<lambda>x y. y = snd x)) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (flg, ams, es, as) query) ((lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) (ams, es, as) query)
[PROOF STEP]
case (Inr query')
[PROOF STATE]
proof (state)
this:
query = Inr query'

goal (1 subgoal):
 1. \<And>b. query = Inr b \<Longrightarrow> rel_spmf (rel_prod (=) (\<lambda>x y. y = snd x)) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (flg, ams, es, as) query) ((lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) (ams, es, as) query)
[PROOF STEP]
note Snd_Rcv = this
[PROOF STATE]
proof (state)
this:
query = Inr query'

goal (1 subgoal):
 1. \<And>b. query = Inr b \<Longrightarrow> rel_spmf (rel_prod (=) (\<lambda>x y. y = snd x)) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (flg, ams, es, as) query) ((lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) (ams, es, as) query)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
query = Inr query'
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
query = Inr query'

goal (1 subgoal):
 1. rel_spmf (rel_prod (=) (\<lambda>x y. y = snd x)) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (flg, ams, es, as) query) ((lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) (ams, es, as) query)
[PROOF STEP]
by (cases query', auto simp add: spmf_rel_map map_spmf_conv_bind_spmf[symmetric] split_beta)
          ((rule rel_spmf_mono[where A="rel_prod (=) (\<lambda>x y. y = snd x)"]); auto)+
[PROOF STATE]
proof (state)
this:
rel_spmf (rel_prod (=) (\<lambda>x y. y = snd x)) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (flg, ams, es, as) query) ((lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) (ams, es, as) query)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
rel_spmf (rel_prod (=) (\<lambda>x y. y = snd x)) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (?flg, ?ams, ?es, ?as) ?query) ((lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) (?ams, ?es, ?as) ?query)

goal (1 subgoal):
 1. spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True = spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) (Void, None, Map.empty))) True
[PROOF STEP]
have[simp]: "rel_spmf (\<lambda>x y. fst x = fst y)
     (exec_gpv ?orc_lft \<A> (False, Void, None, Map.empty)) (exec_gpv ?orc_rgt \<A> (Void, None, Map.empty))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. rel_spmf (\<lambda>x y. fst x = fst y) (exec_gpv (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') \<A> (False, Void, None, Map.empty)) (exec_gpv (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) \<A> (Void, None, Map.empty))
[PROOF STEP]
by(rule rel_spmf_mono[where A="rel_prod (=) (\<lambda>x y. y = snd x)"])
        (auto simp add: gpv.rel_eq split_def intro!: rel_funI
          exec_gpv_parametric[where CALL="(=)", THEN rel_funD, THEN rel_funD, THEN rel_funD])
[PROOF STATE]
proof (state)
this:
rel_spmf (\<lambda>x y. fst x = fst y) (exec_gpv (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') \<A> (False, Void, None, Map.empty)) (exec_gpv (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) \<A> (Void, None, Map.empty))

goal (1 subgoal):
 1. spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True = spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) (Void, None, Map.empty))) True
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True = spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) (Void, None, Map.empty))) True
[PROOF STEP]
unfolding map_spmf_conv_bind_spmf exec_gpv_resource_of_oracle connect_def spmf_conv_measure_spmf
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Sigma_Algebra.measure (measure_spmf (exec_gpv (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') \<A> (False, Void, None, Map.empty) \<bind> (\<lambda>x. return_spmf (map_prod id (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv')) x)) \<bind> (\<lambda>x. return_spmf (fst x)))) {True} = Sigma_Algebra.measure (measure_spmf (exec_gpv (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) \<A> (Void, None, Map.empty) \<bind> (\<lambda>x. return_spmf (map_prod id (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv)) x)) \<bind> (\<lambda>x. return_spmf (fst x)))) {True}
[PROOF STEP]
by(rule measure_spmf_parametric[where A="(=)", THEN rel_funD, THEN rel_funD])
        (auto simp add: rel_pred_def spmf_rel_map map_spmf_conv_bind_spmf[symmetric] gpv.rel_eq split_def intro!: rel_funI)
[PROOF STATE]
proof (state)
this:
spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True = spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) (Void, None, Map.empty))) True

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True = spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) (Void, None, Map.empty))) True

goal (1 subgoal):
 1. \<bar>spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) (Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) (Void, None, Map.empty))) True\<bar> \<le> real q / real (2 ^ \<eta>)
[PROOF STEP]
have fact4: "Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x} \<le> q / real (2 ^ \<eta>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x} \<le> real q / real (2 ^ \<eta>)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x} \<le> real q / real (2 ^ \<eta>)
[PROOF STEP]
let ?orc_sum = "lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f'"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x} \<le> real q / real (2 ^ \<eta>)
[PROOF STEP]
have "Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x}
          = spmf (map_spmf (fst \<circ> snd) (exec_gpv ?orc_sum \<A> (False, Void, None, Map.empty))) True"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x} = spmf (map_spmf (fst \<circ> snd) (exec_gpv (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') \<A> (False, Void, None, Map.empty))) True
[PROOF STEP]
unfolding game_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Sigma_Algebra.measure (measure_spmf (exec_gpv (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') \<A> (False, Void, None, Map.empty) \<bind> (\<lambda>(b, flg, ams, es, as). return_spmf (b, flg)))) {x. snd x} = spmf (map_spmf (fst \<circ> snd) (exec_gpv (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') \<A> (False, Void, None, Map.empty))) True
[PROOF STEP]
by (simp add: split_def map_spmf_conv_bind_spmf[symmetric] measure_map_spmf)
        (simp add: spmf_conv_measure_spmf measure_map_spmf vimage_def)
[PROOF STATE]
proof (state)
this:
Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x} = spmf (map_spmf (fst \<circ> snd) (exec_gpv (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') \<A> (False, Void, None, Map.empty))) True

goal (1 subgoal):
 1. Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x} \<le> real q / real (2 ^ \<eta>)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x} = spmf (map_spmf (fst \<circ> snd) (exec_gpv (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') \<A> (False, Void, None, Map.empty))) True

goal (1 subgoal):
 1. Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x} \<le> real q / real (2 ^ \<eta>)
[PROOF STEP]
have "\<dots> \<le>  (1 / real (card (nlists (UNIV :: bool set) \<eta>))) * real q"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. spmf (map_spmf (fst \<circ> snd) (exec_gpv (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') \<A> (False, Void, None, Map.empty))) True \<le> 1 / real (card (nlists UNIV \<eta>)) * real q
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. spmf (map_spmf (fst \<circ> snd) (exec_gpv (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') \<A> (False, Void, None, Map.empty))) True \<le> 1 / real (card (nlists UNIV \<eta>)) * real q
[PROOF STEP]
have *: "spmf (map_spmf (fst \<circ> snd) (?orc_sum (False, ams, es, as) query)) True
                      \<le> 1 / real (card (nlists (UNIV :: bool set) \<eta>))" for ams es as query
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. spmf (map_spmf (fst \<circ> snd) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, ams, es, as) query)) True \<le> 1 / real (card (nlists UNIV \<eta>))
[PROOF STEP]
proof (cases query)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>a. query = Inl a \<Longrightarrow> spmf (map_spmf (fst \<circ> snd) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, ams, es, as) query)) True \<le> 1 / real (card (nlists UNIV \<eta>))
 2. \<And>b. query = Inr b \<Longrightarrow> spmf (map_spmf (fst \<circ> snd) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, ams, es, as) query)) True \<le> 1 / real (card (nlists UNIV \<eta>))
[PROOF STEP]
case (Inl adv_query)
[PROOF STATE]
proof (state)
this:
query = Inl adv_query

goal (2 subgoals):
 1. \<And>a. query = Inl a \<Longrightarrow> spmf (map_spmf (fst \<circ> snd) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, ams, es, as) query)) True \<le> 1 / real (card (nlists UNIV \<eta>))
 2. \<And>b. query = Inr b \<Longrightarrow> spmf (map_spmf (fst \<circ> snd) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, ams, es, as) query)) True \<le> 1 / real (card (nlists UNIV \<eta>))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
query = Inl adv_query
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
query = Inl adv_query

goal (1 subgoal):
 1. spmf (map_spmf (fst \<circ> snd) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, ams, es, as) query)) True \<le> 1 / real (card (nlists UNIV \<eta>))
[PROOF STEP]
by(cases "((ams, es, as), adv_query)" rule: lazy_channel_insec.cases)
            (auto simp add: lazy_channel_insec'_def rnd_def map_spmf_conv_bind_spmf bind_spmf_const split: option.split)
[PROOF STATE]
proof (state)
this:
spmf (map_spmf (fst \<circ> snd) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, ams, es, as) query)) True \<le> 1 / real (card (nlists UNIV \<eta>))

goal (1 subgoal):
 1. \<And>b. query = Inr b \<Longrightarrow> spmf (map_spmf (fst \<circ> snd) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, ams, es, as) query)) True \<le> 1 / real (card (nlists UNIV \<eta>))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>b. query = Inr b \<Longrightarrow> spmf (map_spmf (fst \<circ> snd) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, ams, es, as) query)) True \<le> 1 / real (card (nlists UNIV \<eta>))
[PROOF STEP]
case (Inr query')
[PROOF STATE]
proof (state)
this:
query = Inr query'

goal (1 subgoal):
 1. \<And>b. query = Inr b \<Longrightarrow> spmf (map_spmf (fst \<circ> snd) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, ams, es, as) query)) True \<le> 1 / real (card (nlists UNIV \<eta>))
[PROOF STEP]
note Snd_Rcv = this
[PROOF STATE]
proof (state)
this:
query = Inr query'

goal (1 subgoal):
 1. \<And>b. query = Inr b \<Longrightarrow> spmf (map_spmf (fst \<circ> snd) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, ams, es, as) query)) True \<le> 1 / real (card (nlists UNIV \<eta>))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
query = Inr query'
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
query = Inr query'

goal (1 subgoal):
 1. spmf (map_spmf (fst \<circ> snd) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, ams, es, as) query)) True \<le> 1 / real (card (nlists UNIV \<eta>))
[PROOF STEP]
proof (cases query')
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>a. \<lbrakk>query = Inr query'; query' = Inl a\<rbrakk> \<Longrightarrow> spmf (map_spmf (fst \<circ> snd) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, ams, es, as) query)) True \<le> 1 / real (card (nlists UNIV \<eta>))
 2. \<And>b. \<lbrakk>query = Inr query'; query' = Inr b\<rbrakk> \<Longrightarrow> spmf (map_spmf (fst \<circ> snd) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, ams, es, as) query)) True \<le> 1 / real (card (nlists UNIV \<eta>))
[PROOF STEP]
case (Inr rcv_query)
[PROOF STATE]
proof (state)
this:
query' = Inr rcv_query

goal (2 subgoals):
 1. \<And>a. \<lbrakk>query = Inr query'; query' = Inl a\<rbrakk> \<Longrightarrow> spmf (map_spmf (fst \<circ> snd) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, ams, es, as) query)) True \<le> 1 / real (card (nlists UNIV \<eta>))
 2. \<And>b. \<lbrakk>query = Inr query'; query' = Inr b\<rbrakk> \<Longrightarrow> spmf (map_spmf (fst \<circ> snd) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, ams, es, as) query)) True \<le> 1 / real (card (nlists UNIV \<eta>))
[PROOF STEP]
with Snd_Rcv
[PROOF STATE]
proof (chain)
picking this:
query = Inr query'
query' = Inr rcv_query
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
query = Inr query'
query' = Inr rcv_query

goal (1 subgoal):
 1. spmf (map_spmf (fst \<circ> snd) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, ams, es, as) query)) True \<le> 1 / real (card (nlists UNIV \<eta>))
[PROOF STEP]
by (cases ams, auto simp add: lazy_channel_recv_f'_def map_spmf_conv_bind_spmf split_def split:option.split)
              (auto simp add: spmf_of_set map_spmf_conv_bind_spmf[symmetric] rnd_def spmf_map vimage_def spmf_conv_measure_spmf[symmetric] split: split_indicator)
[PROOF STATE]
proof (state)
this:
spmf (map_spmf (fst \<circ> snd) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, ams, es, as) query)) True \<le> 1 / real (card (nlists UNIV \<eta>))

goal (1 subgoal):
 1. \<And>a. \<lbrakk>query = Inr query'; query' = Inl a\<rbrakk> \<Longrightarrow> spmf (map_spmf (fst \<circ> snd) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, ams, es, as) query)) True \<le> 1 / real (card (nlists UNIV \<eta>))
[PROOF STEP]
qed (cases ams, simp_all add: lazy_channel_send'_def)
[PROOF STATE]
proof (state)
this:
spmf (map_spmf (fst \<circ> snd) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, ams, es, as) query)) True \<le> 1 / real (card (nlists UNIV \<eta>))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
spmf (map_spmf (fst \<circ> snd) ((lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, ?ams, ?es, ?as) ?query)) True \<le> 1 / real (card (nlists UNIV \<eta>))

goal (1 subgoal):
 1. spmf (map_spmf (fst \<circ> snd) (exec_gpv (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') \<A> (False, Void, None, Map.empty))) True \<le> 1 / real (card (nlists UNIV \<eta>)) * real q
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. spmf (map_spmf (fst \<circ> snd) (exec_gpv (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') \<A> (False, Void, None, Map.empty))) True \<le> 1 / real (card (nlists UNIV \<eta>)) * real q
[PROOF STEP]
by (rule oi_True.interaction_bounded_by_exec_gpv_bad[where bad="fst"]) (auto simp add: * assms)
[PROOF STATE]
proof (state)
this:
spmf (map_spmf (fst \<circ> snd) (exec_gpv (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') \<A> (False, Void, None, Map.empty))) True \<le> 1 / real (card (nlists UNIV \<eta>)) * real q

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
spmf (map_spmf (fst \<circ> snd) (exec_gpv (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') \<A> (False, Void, None, Map.empty))) True \<le> 1 / real (card (nlists UNIV \<eta>)) * real q

goal (1 subgoal):
 1. Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x} \<le> real q / real (2 ^ \<eta>)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
spmf (map_spmf (fst \<circ> snd) (exec_gpv (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') \<A> (False, Void, None, Map.empty))) True \<le> 1 / real (card (nlists UNIV \<eta>)) * real q

goal (1 subgoal):
 1. Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x} \<le> real q / real (2 ^ \<eta>)
[PROOF STEP]
have "...  = 1 / real (2 ^ \<eta>) * real q"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 1 / real (card (nlists UNIV \<eta>)) * real q = 1 / real (2 ^ \<eta>) * real q
[PROOF STEP]
by (simp add: card_nlists)
[PROOF STATE]
proof (state)
this:
1 / real (card (nlists UNIV \<eta>)) * real q = 1 / real (2 ^ \<eta>) * real q

goal (1 subgoal):
 1. Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x} \<le> real q / real (2 ^ \<eta>)
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x} \<le> 1 / real (2 ^ \<eta>) * real q
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x} \<le> 1 / real (2 ^ \<eta>) * real q

goal (1 subgoal):
 1. Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x} \<le> real q / real (2 ^ \<eta>)
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x} \<le> real q / real (2 ^ \<eta>)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x} \<le> real q / real (2 ^ \<eta>)

goal (1 subgoal):
 1. \<bar>spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) (Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) (Void, None, Map.empty))) True\<bar> \<le> real q / real (2 ^ \<eta>)
[PROOF STEP]
have "?LHS \<le> Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<bar>spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) (Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) (Void, None, Map.empty))) True\<bar> \<le> Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x}
[PROOF STEP]
using fact1 fact2 fact3
[PROOF STATE]
proof (prove)
using this:
spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) (Void, None, Map.empty))) True = spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True
\<bar>spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv_f') (False, Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True\<bar> \<le> Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x}
spmf (connect \<A> (RES (lazy_channel_insec' \<oplus>\<^sub>O lazy_channel_send' \<oplus>\<^sub>O lazy_channel_recv') (False, Void, None, Map.empty))) True = spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) (Void, None, Map.empty))) True

goal (1 subgoal):
 1. \<bar>spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) (Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) (Void, None, Map.empty))) True\<bar> \<le> Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x}
[PROOF STEP]
by arith
[PROOF STATE]
proof (state)
this:
\<bar>spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) (Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) (Void, None, Map.empty))) True\<bar> \<le> Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x}

goal (1 subgoal):
 1. \<bar>spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) (Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) (Void, None, Map.empty))) True\<bar> \<le> real q / real (2 ^ \<eta>)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
\<bar>spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) (Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) (Void, None, Map.empty))) True\<bar> \<le> Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x}

goal (1 subgoal):
 1. \<bar>spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) (Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) (Void, None, Map.empty))) True\<bar> \<le> real q / real (2 ^ \<eta>)
[PROOF STEP]
note fact4
[PROOF STATE]
proof (state)
this:
Sigma_Algebra.measure (measure_spmf (game \<A> lazy_channel_recv_f')) {x. snd x} \<le> real q / real (2 ^ \<eta>)

goal (1 subgoal):
 1. \<bar>spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) (Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) (Void, None, Map.empty))) True\<bar> \<le> real q / real (2 ^ \<eta>)
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
\<bar>spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) (Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) (Void, None, Map.empty))) True\<bar> \<le> real q / real (2 ^ \<eta>)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<bar>spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) (Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) (Void, None, Map.empty))) True\<bar> \<le> real q / real (2 ^ \<eta>)

goal (1 subgoal):
 1. \<bar>spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) (Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) (Void, None, Map.empty))) True\<bar> \<le> real q / real (2 ^ \<eta>)
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
\<bar>spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv_f) (Void, None, Map.empty))) True - spmf (connect \<A> (RES (lazy_channel_insec \<oplus>\<^sub>O lazy_channel_send \<oplus>\<^sub>O lazy_channel_recv) (Void, None, Map.empty))) True\<bar> \<le> real q / real (2 ^ \<eta>)

goal:
No subgoals!
[PROOF STEP]
qed