[STATEMENT]
lemma attach_real: "real_resource = RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. real_resource = RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest')
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. real_resource = RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest')
[PROOF STEP]
have fact1: "real_core' = attach_core 1\<^sub>I (attach_wiring_right parallel_wiring\<^sub>w (enc_callee \<ddagger>\<^sub>I dec_callee))
    (parallel_core key.core auth.core) " (is "?L = ?R")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. real_core' = attach_core 1\<^sub>I (attach_wiring_right parallel_wiring\<^sub>w (enc_callee \<ddagger>\<^sub>I dec_callee)) (parallel_core key.core auth.core)
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. real_core' = attach_core 1\<^sub>I (attach_wiring_right parallel_wiring\<^sub>w (enc_callee \<ddagger>\<^sub>I dec_callee)) (parallel_core key.core auth.core)
[PROOF STEP]
have "cpoke ?L = cpoke ?R"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. cpoke real_core' = cpoke (attach_core 1\<^sub>I (attach_wiring_right parallel_wiring\<^sub>w (enc_callee \<ddagger>\<^sub>I dec_callee)) (parallel_core key.core auth.core))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
cpoke real_core' = cpoke (attach_core 1\<^sub>I (attach_wiring_right parallel_wiring\<^sub>w (enc_callee \<ddagger>\<^sub>I dec_callee)) (parallel_core key.core auth.core))

goal (1 subgoal):
 1. real_core' = attach_core 1\<^sub>I (attach_wiring_right parallel_wiring\<^sub>w (enc_callee \<ddagger>\<^sub>I dec_callee)) (parallel_core key.core auth.core)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
cpoke real_core' = cpoke (attach_core 1\<^sub>I (attach_wiring_right parallel_wiring\<^sub>w (enc_callee \<ddagger>\<^sub>I dec_callee)) (parallel_core key.core auth.core))

goal (1 subgoal):
 1. real_core' = attach_core 1\<^sub>I (attach_wiring_right parallel_wiring\<^sub>w (enc_callee \<ddagger>\<^sub>I dec_callee)) (parallel_core key.core auth.core)
[PROOF STEP]
have "cfunc_adv ?L = cfunc_adv ?R"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. cfunc_adv real_core' = cfunc_adv (attach_core 1\<^sub>I (attach_wiring_right parallel_wiring\<^sub>w (enc_callee \<ddagger>\<^sub>I dec_callee)) (parallel_core key.core auth.core))
[PROOF STEP]
unfolding attach_core_id_oracle_adv
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. cfunc_adv real_core' = (\<lambda>(s_cnv, s_core) q. map_spmf (\<lambda>(out, s_core'). (out, s_cnv, s_core')) (cfunc_adv (parallel_core key.core auth.core) s_core q))
[PROOF STEP]
by (simp add: extend_state_oracle_def)
[PROOF STATE]
proof (state)
this:
cfunc_adv real_core' = cfunc_adv (attach_core 1\<^sub>I (attach_wiring_right parallel_wiring\<^sub>w (enc_callee \<ddagger>\<^sub>I dec_callee)) (parallel_core key.core auth.core))

goal (1 subgoal):
 1. real_core' = attach_core 1\<^sub>I (attach_wiring_right parallel_wiring\<^sub>w (enc_callee \<ddagger>\<^sub>I dec_callee)) (parallel_core key.core auth.core)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
cfunc_adv real_core' = cfunc_adv (attach_core 1\<^sub>I (attach_wiring_right parallel_wiring\<^sub>w (enc_callee \<ddagger>\<^sub>I dec_callee)) (parallel_core key.core auth.core))

goal (1 subgoal):
 1. real_core' = attach_core 1\<^sub>I (attach_wiring_right parallel_wiring\<^sub>w (enc_callee \<ddagger>\<^sub>I dec_callee)) (parallel_core key.core auth.core)
[PROOF STEP]
have "cfunc_usr ?L = cfunc_usr ?R"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. cfunc_usr real_core' = cfunc_usr (attach_core 1\<^sub>I (attach_wiring_right parallel_wiring\<^sub>w (enc_callee \<ddagger>\<^sub>I dec_callee)) (parallel_core key.core auth.core))
[PROOF STEP]
unfolding parallel_wiring\<^sub>w_def swap_lassocr\<^sub>w_def swap\<^sub>w_def lassocr\<^sub>w_def rassocl\<^sub>w_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. cfunc_usr real_core' = cfunc_usr (attach_core 1\<^sub>I (attach_wiring_right ((rsuml, lsumr) \<circ>\<^sub>w ((id, id) |\<^sub>w ((lsumr, rsuml) \<circ>\<^sub>w ((swap_sum, swap_sum) |\<^sub>w (id, id) \<circ>\<^sub>w (rsuml, lsumr))) \<circ>\<^sub>w (lsumr, rsuml))) (enc_callee \<ddagger>\<^sub>I dec_callee)) (parallel_core key.core auth.core))
[PROOF STEP]
by (simp add: attach_wiring_right_simps parallel2_wiring_simps comp_wiring_simps)
[PROOF STATE]
proof (state)
this:
cfunc_usr real_core' = cfunc_usr (attach_core 1\<^sub>I (attach_wiring_right parallel_wiring\<^sub>w (enc_callee \<ddagger>\<^sub>I dec_callee)) (parallel_core key.core auth.core))

goal (1 subgoal):
 1. real_core' = attach_core 1\<^sub>I (attach_wiring_right parallel_wiring\<^sub>w (enc_callee \<ddagger>\<^sub>I dec_callee)) (parallel_core key.core auth.core)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
cpoke real_core' = cpoke (attach_core 1\<^sub>I (attach_wiring_right parallel_wiring\<^sub>w (enc_callee \<ddagger>\<^sub>I dec_callee)) (parallel_core key.core auth.core))
cfunc_adv real_core' = cfunc_adv (attach_core 1\<^sub>I (attach_wiring_right parallel_wiring\<^sub>w (enc_callee \<ddagger>\<^sub>I dec_callee)) (parallel_core key.core auth.core))
cfunc_usr real_core' = cfunc_usr (attach_core 1\<^sub>I (attach_wiring_right parallel_wiring\<^sub>w (enc_callee \<ddagger>\<^sub>I dec_callee)) (parallel_core key.core auth.core))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
cpoke real_core' = cpoke (attach_core 1\<^sub>I (attach_wiring_right parallel_wiring\<^sub>w (enc_callee \<ddagger>\<^sub>I dec_callee)) (parallel_core key.core auth.core))
cfunc_adv real_core' = cfunc_adv (attach_core 1\<^sub>I (attach_wiring_right parallel_wiring\<^sub>w (enc_callee \<ddagger>\<^sub>I dec_callee)) (parallel_core key.core auth.core))
cfunc_usr real_core' = cfunc_usr (attach_core 1\<^sub>I (attach_wiring_right parallel_wiring\<^sub>w (enc_callee \<ddagger>\<^sub>I dec_callee)) (parallel_core key.core auth.core))

goal (1 subgoal):
 1. real_core' = attach_core 1\<^sub>I (attach_wiring_right parallel_wiring\<^sub>w (enc_callee \<ddagger>\<^sub>I dec_callee)) (parallel_core key.core auth.core)
[PROOF STEP]
by (coinduction) blast
[PROOF STATE]
proof (state)
this:
real_core' = attach_core 1\<^sub>I (attach_wiring_right parallel_wiring\<^sub>w (enc_callee \<ddagger>\<^sub>I dec_callee)) (parallel_core key.core auth.core)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
real_core' = attach_core 1\<^sub>I (attach_wiring_right parallel_wiring\<^sub>w (enc_callee \<ddagger>\<^sub>I dec_callee)) (parallel_core key.core auth.core)

goal (1 subgoal):
 1. real_resource = RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest')
[PROOF STEP]
have fact2: "real_rest' = attach_rest 1\<^sub>I 1\<^sub>I (Pair ((), ())) (parallel_rest key_rest auth_rest) "  (is "?L = ?R")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. real_rest' = attach_rest 1\<^sub>I 1\<^sub>I (Pair ((), ())) (parallel_rest key_rest auth_rest)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. real_rest' = attach_rest 1\<^sub>I 1\<^sub>I (Pair ((), ())) (parallel_rest key_rest auth_rest)
[PROOF STEP]
have "rinit ?L = rinit ?R"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. rinit real_rest' = rinit (attach_rest 1\<^sub>I 1\<^sub>I (Pair ((), ())) (parallel_rest key_rest auth_rest))
[PROOF STEP]
unfolding real_rest'_def ideal_rest'_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. rinit (corec_rest_scheme (\<lambda>x. (((), ()), rinit key_rest, rinit auth_rest)) (\<lambda>x. \<dagger>(parallel_eoracle (rfunc_adv key_rest) (rfunc_adv auth_rest))) (\<lambda>x. \<dagger>(parallel_eoracle (rfunc_usr key_rest) (rfunc_usr auth_rest))) ()) = rinit (attach_rest 1\<^sub>I 1\<^sub>I (Pair ((), ())) (parallel_rest key_rest auth_rest))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
rinit real_rest' = rinit (attach_rest 1\<^sub>I 1\<^sub>I (Pair ((), ())) (parallel_rest key_rest auth_rest))

goal (1 subgoal):
 1. real_rest' = attach_rest 1\<^sub>I 1\<^sub>I (Pair ((), ())) (parallel_rest key_rest auth_rest)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
rinit real_rest' = rinit (attach_rest 1\<^sub>I 1\<^sub>I (Pair ((), ())) (parallel_rest key_rest auth_rest))

goal (1 subgoal):
 1. real_rest' = attach_rest 1\<^sub>I 1\<^sub>I (Pair ((), ())) (parallel_rest key_rest auth_rest)
[PROOF STEP]
have "rfunc_adv ?L = rfunc_adv ?R"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. rfunc_adv real_rest' = rfunc_adv (attach_rest 1\<^sub>I 1\<^sub>I (Pair ((), ())) (parallel_rest key_rest auth_rest))
[PROOF STEP]
unfolding real_rest'_def ideal_rest'_def attach_rest_id_oracle_adv
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. rfunc_adv (corec_rest_scheme (\<lambda>x. (((), ()), rinit key_rest, rinit auth_rest)) (\<lambda>x. \<dagger>(parallel_eoracle (rfunc_adv key_rest) (rfunc_adv auth_rest))) (\<lambda>x. \<dagger>(parallel_eoracle (rfunc_usr key_rest) (rfunc_usr auth_rest))) ()) = (\<lambda>(s_cnv, s_core) q. map_spmf (\<lambda>(out, s_core'). (out, s_cnv, s_core')) (rfunc_adv (parallel_rest key_rest auth_rest) s_core q))
[PROOF STEP]
by (simp add: extend_state_oracle_def)
[PROOF STATE]
proof (state)
this:
rfunc_adv real_rest' = rfunc_adv (attach_rest 1\<^sub>I 1\<^sub>I (Pair ((), ())) (parallel_rest key_rest auth_rest))

goal (1 subgoal):
 1. real_rest' = attach_rest 1\<^sub>I 1\<^sub>I (Pair ((), ())) (parallel_rest key_rest auth_rest)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
rfunc_adv real_rest' = rfunc_adv (attach_rest 1\<^sub>I 1\<^sub>I (Pair ((), ())) (parallel_rest key_rest auth_rest))

goal (1 subgoal):
 1. real_rest' = attach_rest 1\<^sub>I 1\<^sub>I (Pair ((), ())) (parallel_rest key_rest auth_rest)
[PROOF STEP]
have "rfunc_usr ?L = rfunc_usr ?R"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. rfunc_usr real_rest' = rfunc_usr (attach_rest 1\<^sub>I 1\<^sub>I (Pair ((), ())) (parallel_rest key_rest auth_rest))
[PROOF STEP]
unfolding real_rest'_def ideal_rest'_def attach_rest_id_oracle_usr
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. rfunc_usr (corec_rest_scheme (\<lambda>x. (((), ()), rinit key_rest, rinit auth_rest)) (\<lambda>x. \<dagger>(parallel_eoracle (rfunc_adv key_rest) (rfunc_adv auth_rest))) (\<lambda>x. \<dagger>(parallel_eoracle (rfunc_usr key_rest) (rfunc_usr auth_rest))) ()) = (\<lambda>(s_cnv, s_core) q. map_spmf (\<lambda>(out, s_core'). (out, s_cnv, s_core')) (rfunc_usr (parallel_rest key_rest auth_rest) s_core q))
[PROOF STEP]
by (simp add: extend_state_oracle_def)
[PROOF STATE]
proof (state)
this:
rfunc_usr real_rest' = rfunc_usr (attach_rest 1\<^sub>I 1\<^sub>I (Pair ((), ())) (parallel_rest key_rest auth_rest))

goal (1 subgoal):
 1. real_rest' = attach_rest 1\<^sub>I 1\<^sub>I (Pair ((), ())) (parallel_rest key_rest auth_rest)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
rinit real_rest' = rinit (attach_rest 1\<^sub>I 1\<^sub>I (Pair ((), ())) (parallel_rest key_rest auth_rest))
rfunc_adv real_rest' = rfunc_adv (attach_rest 1\<^sub>I 1\<^sub>I (Pair ((), ())) (parallel_rest key_rest auth_rest))
rfunc_usr real_rest' = rfunc_usr (attach_rest 1\<^sub>I 1\<^sub>I (Pair ((), ())) (parallel_rest key_rest auth_rest))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
rinit real_rest' = rinit (attach_rest 1\<^sub>I 1\<^sub>I (Pair ((), ())) (parallel_rest key_rest auth_rest))
rfunc_adv real_rest' = rfunc_adv (attach_rest 1\<^sub>I 1\<^sub>I (Pair ((), ())) (parallel_rest key_rest auth_rest))
rfunc_usr real_rest' = rfunc_usr (attach_rest 1\<^sub>I 1\<^sub>I (Pair ((), ())) (parallel_rest key_rest auth_rest))

goal (1 subgoal):
 1. real_rest' = attach_rest 1\<^sub>I 1\<^sub>I (Pair ((), ())) (parallel_rest key_rest auth_rest)
[PROOF STEP]
by (coinduction) blast
[PROOF STATE]
proof (state)
this:
real_rest' = attach_rest 1\<^sub>I 1\<^sub>I (Pair ((), ())) (parallel_rest key_rest auth_rest)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
real_rest' = attach_rest 1\<^sub>I 1\<^sub>I (Pair ((), ())) (parallel_rest key_rest auth_rest)

goal (1 subgoal):
 1. real_resource = RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest')
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. real_resource = RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest')
[PROOF STEP]
unfolding real_resource_def attach_c1f22_c1f22_def wiring_c1r22_c1r22_def key.resource_def auth.resource_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((1\<^sub>C |\<^sub>= 1\<^sub>C) |\<^sub>= (CNV enc_callee () |\<^sub>= CNV dec_callee ()) \<odot> parallel_wiring |\<^sub>= 1\<^sub>C) \<odot> fused_wiring \<rhd> RES (key.fuse key_rest) ((key.PState_Store, {}), rinit key_rest) \<parallel> RES (auth.fuse auth_rest) ((sec.State_Void, {}), rinit auth_rest) = RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest')
[PROOF STEP]
apply(subst resource_of_parallel_oracle[symmetric])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((1\<^sub>C |\<^sub>= 1\<^sub>C) |\<^sub>= (CNV enc_callee () |\<^sub>= CNV dec_callee ()) \<odot> parallel_wiring |\<^sub>= 1\<^sub>C) \<odot> fused_wiring \<rhd> RES (key.fuse key_rest \<ddagger>\<^sub>O auth.fuse auth_rest) (((key.PState_Store, {}), rinit key_rest), (sec.State_Void, {}), rinit auth_rest) = RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest')
[PROOF STEP]
apply(subst attach_compose)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (1\<^sub>C |\<^sub>= 1\<^sub>C) |\<^sub>= (CNV enc_callee () |\<^sub>= CNV dec_callee ()) \<odot> parallel_wiring |\<^sub>= 1\<^sub>C \<rhd> fused_wiring \<rhd> RES (key.fuse key_rest \<ddagger>\<^sub>O auth.fuse auth_rest) (((key.PState_Store, {}), rinit key_rest), (sec.State_Void, {}), rinit auth_rest) = RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest')
[PROOF STEP]
apply(subst attach_wiring_resource_of_oracle)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. wiring ?\<I>1.0 ?\<I>2.0 fused_wiring ?fg
 2. ?\<I>2.0 \<turnstile>res RES (key.fuse key_rest \<ddagger>\<^sub>O auth.fuse auth_rest) (((key.PState_Store, {}), rinit key_rest), (sec.State_Void, {}), rinit auth_rest) \<surd>
 3. outs_\<I> ?\<I>1.0 = UNIV
 4. (1\<^sub>C |\<^sub>= 1\<^sub>C) |\<^sub>= (CNV enc_callee () |\<^sub>= CNV dec_callee ()) \<odot> parallel_wiring |\<^sub>= 1\<^sub>C \<rhd> RES (apply_wiring ?fg (key.fuse key_rest \<ddagger>\<^sub>O auth.fuse auth_rest)) (((key.PState_Store, {}), rinit key_rest), (sec.State_Void, {}), rinit auth_rest) = RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest')
[PROOF STEP]
apply(rule wiring_intro)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. ((?\<I>1.1 \<oplus>\<^sub>\<I> ?\<I>2a1) \<oplus>\<^sub>\<I> (?\<I>1a1 \<oplus>\<^sub>\<I> ?\<I>2aa1)) \<oplus>\<^sub>\<I> ((?\<I>2.1 \<oplus>\<^sub>\<I> ?\<I>3.1) \<oplus>\<^sub>\<I> (?\<I>2b1 \<oplus>\<^sub>\<I> ?\<I>3a1)) \<turnstile>res RES (key.fuse key_rest \<ddagger>\<^sub>O auth.fuse auth_rest) (((key.PState_Store, {}), rinit key_rest), (sec.State_Void, {}), rinit auth_rest) \<surd>
 2. outs_\<I> (((?\<I>1.1 \<oplus>\<^sub>\<I> ?\<I>2.1) \<oplus>\<^sub>\<I> (?\<I>2a1 \<oplus>\<^sub>\<I> ?\<I>3.1)) \<oplus>\<^sub>\<I> ((?\<I>1a1 \<oplus>\<^sub>\<I> ?\<I>2b1) \<oplus>\<^sub>\<I> (?\<I>2aa1 \<oplus>\<^sub>\<I> ?\<I>3a1))) = UNIV
 3. (1\<^sub>C |\<^sub>= 1\<^sub>C) |\<^sub>= (CNV enc_callee () |\<^sub>= CNV dec_callee ()) \<odot> parallel_wiring |\<^sub>= 1\<^sub>C \<rhd> RES (apply_wiring fused_wiring\<^sub>w (key.fuse key_rest \<ddagger>\<^sub>O auth.fuse auth_rest)) (((key.PState_Store, {}), rinit key_rest), (sec.State_Void, {}), rinit auth_rest) = RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest')
[PROOF STEP]
apply (rule WT_resource_of_oracle[OF WT_callee_real1])
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. outs_\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full))) = UNIV
 2. (1\<^sub>C |\<^sub>= 1\<^sub>C) |\<^sub>= (CNV enc_callee () |\<^sub>= CNV dec_callee ()) \<odot> parallel_wiring |\<^sub>= 1\<^sub>C \<rhd> RES (apply_wiring fused_wiring\<^sub>w (key.fuse key_rest \<ddagger>\<^sub>O auth.fuse auth_rest)) (((key.PState_Store, {}), rinit key_rest), (sec.State_Void, {}), rinit auth_rest) = RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest')
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (1\<^sub>C |\<^sub>= 1\<^sub>C) |\<^sub>= (CNV enc_callee () |\<^sub>= CNV dec_callee ()) \<odot> parallel_wiring |\<^sub>= 1\<^sub>C \<rhd> RES (apply_wiring fused_wiring\<^sub>w (key.fuse key_rest \<ddagger>\<^sub>O auth.fuse auth_rest)) (((key.PState_Store, {}), rinit key_rest), (sec.State_Void, {}), rinit auth_rest) = RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest')
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (1\<^sub>C |\<^sub>= 1\<^sub>C) |\<^sub>= (CNV enc_callee () |\<^sub>= CNV dec_callee ()) \<odot> parallel_wiring |\<^sub>= 1\<^sub>C \<rhd> RES (apply_wiring fused_wiring\<^sub>w (key.fuse key_rest \<ddagger>\<^sub>O auth.fuse auth_rest)) (((key.PState_Store, {}), rinit key_rest), (sec.State_Void, {}), rinit auth_rest) = RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest')
[PROOF STEP]
apply(subst parallel_oracle_fuse)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (1\<^sub>C |\<^sub>= 1\<^sub>C) |\<^sub>= (CNV enc_callee () |\<^sub>= CNV dec_callee ()) \<odot> parallel_wiring |\<^sub>= 1\<^sub>C \<rhd> RES (apply_state_iso parallel_state_iso (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest))) (((key.PState_Store, {}), rinit key_rest), (sec.State_Void, {}), rinit auth_rest) = RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest')
[PROOF STEP]
apply(subst resource_of_oracle_state_iso)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. state_iso parallel_state_iso
 2. (1\<^sub>C |\<^sub>= 1\<^sub>C) |\<^sub>= (CNV enc_callee () |\<^sub>= CNV dec_callee ()) \<odot> parallel_wiring |\<^sub>= 1\<^sub>C \<rhd> RES (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest)) (snd parallel_state_iso (((key.PState_Store, {}), rinit key_rest), (sec.State_Void, {}), rinit auth_rest)) = RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest')
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (1\<^sub>C |\<^sub>= 1\<^sub>C) |\<^sub>= (CNV enc_callee () |\<^sub>= CNV dec_callee ()) \<odot> parallel_wiring |\<^sub>= 1\<^sub>C \<rhd> RES (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest)) (snd parallel_state_iso (((key.PState_Store, {}), rinit key_rest), (sec.State_Void, {}), rinit auth_rest)) = RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest')
[PROOF STEP]
apply(simp add: parallel_state_iso_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (1\<^sub>C |\<^sub>= 1\<^sub>C) |\<^sub>= (CNV enc_callee () |\<^sub>= CNV dec_callee ()) \<odot> parallel_wiring |\<^sub>= 1\<^sub>C \<rhd> RES (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest)) (((key.PState_Store, {}), sec.State_Void, {}), rinit key_rest, rinit auth_rest) = RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest')
[PROOF STEP]
apply(subst conv_callee_parallel[symmetric])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (1\<^sub>C |\<^sub>= 1\<^sub>C) |\<^sub>= CNV (enc_callee \<ddagger>\<^sub>I dec_callee) ((), ()) \<odot> parallel_wiring |\<^sub>= 1\<^sub>C \<rhd> RES (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest)) (((key.PState_Store, {}), sec.State_Void, {}), rinit key_rest, rinit auth_rest) = RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest')
[PROOF STEP]
apply(subst eq_resource_on_UNIV_iff[symmetric])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. UNIV \<turnstile>\<^sub>R (1\<^sub>C |\<^sub>= 1\<^sub>C) |\<^sub>= CNV (enc_callee \<ddagger>\<^sub>I dec_callee) ((), ()) \<odot> parallel_wiring |\<^sub>= 1\<^sub>C \<rhd> RES (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest)) (((key.PState_Store, {}), sec.State_Void, {}), rinit key_rest, rinit auth_rest) \<sim> RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest')
[PROOF STEP]
apply(rule eq_resource_on_trans)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. UNIV \<turnstile>\<^sub>R (1\<^sub>C |\<^sub>= 1\<^sub>C) |\<^sub>= CNV (enc_callee \<ddagger>\<^sub>I dec_callee) ((), ()) \<odot> parallel_wiring |\<^sub>= 1\<^sub>C \<rhd> RES (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest)) (((key.PState_Store, {}), sec.State_Void, {}), rinit key_rest, rinit auth_rest) \<sim> ?res'
 2. UNIV \<turnstile>\<^sub>R ?res' \<sim> RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest')
[PROOF STEP]
apply(rule eq_\<I>_attach_on')
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. ?\<I>'3 \<turnstile>res RES (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest)) (((key.PState_Store, {}), sec.State_Void, {}), rinit key_rest, rinit auth_rest) \<surd>
 2. ?\<I>3,?\<I>'3 \<turnstile>\<^sub>C (1\<^sub>C |\<^sub>= 1\<^sub>C) |\<^sub>= CNV (enc_callee \<ddagger>\<^sub>I dec_callee) ((), ()) \<odot> parallel_wiring |\<^sub>= 1\<^sub>C \<sim> ?conv'3
 3. UNIV \<subseteq> outs_\<I> ?\<I>3
 4. UNIV \<turnstile>\<^sub>R ?conv'3 \<rhd> RES (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest)) (((key.PState_Store, {}), sec.State_Void, {}), rinit key_rest, rinit auth_rest) \<sim> RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest')
[PROOF STEP]
apply (rule WT_resource_of_oracle[OF WT_callee_real2])
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. ?\<I>3,(\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full) \<turnstile>\<^sub>C (1\<^sub>C |\<^sub>= 1\<^sub>C) |\<^sub>= CNV (enc_callee \<ddagger>\<^sub>I dec_callee) ((), ()) \<odot> parallel_wiring |\<^sub>= 1\<^sub>C \<sim> ?conv'3
 2. UNIV \<subseteq> outs_\<I> ?\<I>3
 3. UNIV \<turnstile>\<^sub>R ?conv'3 \<rhd> RES (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest)) (((key.PState_Store, {}), sec.State_Void, {}), rinit key_rest, rinit auth_rest) \<sim> RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest')
[PROOF STEP]
apply(rule parallel_converter2_eq_\<I>_cong)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. ?\<I>1.9,\<I>_full \<oplus>\<^sub>\<I> \<I>_full \<turnstile>\<^sub>C 1\<^sub>C |\<^sub>= 1\<^sub>C \<sim> ?conv1'9
 2. ?\<I>2.9,((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full \<turnstile>\<^sub>C CNV (enc_callee \<ddagger>\<^sub>I dec_callee) ((), ()) \<odot> parallel_wiring |\<^sub>= 1\<^sub>C \<sim> ?conv2'9
 3. UNIV \<subseteq> outs_\<I> (?\<I>1.9 \<oplus>\<^sub>\<I> ?\<I>2.9)
 4. UNIV \<turnstile>\<^sub>R ?conv1'9 |\<^sub>= ?conv2'9 \<rhd> RES (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest)) (((key.PState_Store, {}), sec.State_Void, {}), rinit key_rest, rinit auth_rest) \<sim> RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest')
[PROOF STEP]
apply(rule eq_\<I>_converter_reflI)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. ?\<I>1.9, \<I>_full \<oplus>\<^sub>\<I> \<I>_full \<turnstile>\<^sub>C 1\<^sub>C |\<^sub>= 1\<^sub>C \<surd>
 2. ?\<I>2.9,((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full \<turnstile>\<^sub>C CNV (enc_callee \<ddagger>\<^sub>I dec_callee) ((), ()) \<odot> parallel_wiring |\<^sub>= 1\<^sub>C \<sim> ?conv2'9
 3. UNIV \<subseteq> outs_\<I> (?\<I>1.9 \<oplus>\<^sub>\<I> ?\<I>2.9)
 4. UNIV \<turnstile>\<^sub>R (1\<^sub>C |\<^sub>= 1\<^sub>C) |\<^sub>= ?conv2'9 \<rhd> RES (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest)) (((key.PState_Store, {}), sec.State_Void, {}), rinit key_rest, rinit auth_rest) \<sim> RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest')
[PROOF STEP]
apply(rule WT_intro)+
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. ?\<I>2.9,((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full \<turnstile>\<^sub>C CNV (enc_callee \<ddagger>\<^sub>I dec_callee) ((), ()) \<odot> parallel_wiring |\<^sub>= 1\<^sub>C \<sim> ?conv2'9
 2. UNIV \<subseteq> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> ?\<I>2.9)
 3. UNIV \<turnstile>\<^sub>R (1\<^sub>C |\<^sub>= 1\<^sub>C) |\<^sub>= ?conv2'9 \<rhd> RES (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest)) (((key.PState_Store, {}), sec.State_Void, {}), rinit key_rest, rinit auth_rest) \<sim> RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest')
[PROOF STEP]
apply(rule parallel_converter2_eq_\<I>_cong)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. ?\<I>1.19,(\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<turnstile>\<^sub>C CNV (enc_callee \<ddagger>\<^sub>I dec_callee) ((), ()) \<odot> parallel_wiring \<sim> ?conv1'19
 2. ?\<I>2.19,\<I>_full \<turnstile>\<^sub>C 1\<^sub>C \<sim> ?conv2'19
 3. UNIV \<subseteq> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (?\<I>1.19 \<oplus>\<^sub>\<I> ?\<I>2.19))
 4. UNIV \<turnstile>\<^sub>R (1\<^sub>C |\<^sub>= 1\<^sub>C) |\<^sub>= ?conv1'19 |\<^sub>= ?conv2'19 \<rhd> RES (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest)) (((key.PState_Store, {}), sec.State_Void, {}), rinit key_rest, rinit auth_rest) \<sim> RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest')
[PROOF STEP]
apply(rule comp_converter_of_callee_wiring)
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. wiring ?\<I>2.22 ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) parallel_wiring ?w22
 2. ?\<I>1.19, ?\<I>2.22 \<turnstile>\<^sub>C CNV (enc_callee \<ddagger>\<^sub>I dec_callee) ((), ()) \<surd>
 3. ?\<I>2.19,\<I>_full \<turnstile>\<^sub>C 1\<^sub>C \<sim> ?conv2'19
 4. UNIV \<subseteq> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (?\<I>1.19 \<oplus>\<^sub>\<I> ?\<I>2.19))
 5. UNIV \<turnstile>\<^sub>R (1\<^sub>C |\<^sub>= 1\<^sub>C) |\<^sub>= CNV (attach_wiring_right ?w22 (enc_callee \<ddagger>\<^sub>I dec_callee)) ((), ()) |\<^sub>= ?conv2'19 \<rhd> RES (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest)) (((key.PState_Store, {}), sec.State_Void, {}), rinit key_rest, rinit auth_rest) \<sim> RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest')
[PROOF STEP]
apply(rule wiring_intro)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. ?\<I>1.19, (\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<turnstile>\<^sub>C CNV (enc_callee \<ddagger>\<^sub>I dec_callee) ((), ()) \<surd>
 2. ?\<I>2.19,\<I>_full \<turnstile>\<^sub>C 1\<^sub>C \<sim> ?conv2'19
 3. UNIV \<subseteq> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (?\<I>1.19 \<oplus>\<^sub>\<I> ?\<I>2.19))
 4. UNIV \<turnstile>\<^sub>R (1\<^sub>C |\<^sub>= 1\<^sub>C) |\<^sub>= CNV (attach_wiring_right parallel_wiring\<^sub>w (enc_callee \<ddagger>\<^sub>I dec_callee)) ((), ()) |\<^sub>= ?conv2'19 \<rhd> RES (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest)) (((key.PState_Store, {}), sec.State_Void, {}), rinit key_rest, rinit auth_rest) \<sim> RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest')
[PROOF STEP]
apply(subst conv_callee_parallel)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. ?\<I>1.19, (\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<turnstile>\<^sub>C CNV enc_callee () |\<^sub>= CNV dec_callee () \<surd>
 2. ?\<I>2.19,\<I>_full \<turnstile>\<^sub>C 1\<^sub>C \<sim> ?conv2'19
 3. UNIV \<subseteq> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (?\<I>1.19 \<oplus>\<^sub>\<I> ?\<I>2.19))
 4. UNIV \<turnstile>\<^sub>R (1\<^sub>C |\<^sub>= 1\<^sub>C) |\<^sub>= CNV (attach_wiring_right parallel_wiring\<^sub>w (enc_callee \<ddagger>\<^sub>I dec_callee)) ((), ()) |\<^sub>= ?conv2'19 \<rhd> RES (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest)) (((key.PState_Store, {}), sec.State_Void, {}), rinit key_rest, rinit auth_rest) \<sim> RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest')
[PROOF STEP]
apply(rule WT_intro)
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. ?\<I>1.29, \<I>_full \<oplus>\<^sub>\<I> \<I>_full \<turnstile>\<^sub>C CNV enc_callee () \<surd>
 2. ?\<I>1'29, \<I>_full \<oplus>\<^sub>\<I> \<I>_full \<turnstile>\<^sub>C CNV dec_callee () \<surd>
 3. ?\<I>2.19,\<I>_full \<turnstile>\<^sub>C 1\<^sub>C \<sim> ?conv2'19
 4. UNIV \<subseteq> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> ((?\<I>1.29 \<oplus>\<^sub>\<I> ?\<I>1'29) \<oplus>\<^sub>\<I> ?\<I>2.19))
 5. UNIV \<turnstile>\<^sub>R (1\<^sub>C |\<^sub>= 1\<^sub>C) |\<^sub>= CNV (attach_wiring_right parallel_wiring\<^sub>w (enc_callee \<ddagger>\<^sub>I dec_callee)) ((), ()) |\<^sub>= ?conv2'19 \<rhd> RES (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest)) (((key.PState_Store, {}), sec.State_Void, {}), rinit key_rest, rinit auth_rest) \<sim> RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest')
[PROOF STEP]
apply (rule WT_converter_of_callee[where \<I>=\<I>_full and \<I>'="\<I>_full \<oplus>\<^sub>\<I> \<I>_full"])
[PROOF STATE]
proof (prove)
goal (6 subgoals):
 1. \<And>s q. q \<in> outs_\<I> \<I>_full \<Longrightarrow> \<I>_full \<oplus>\<^sub>\<I> \<I>_full \<turnstile>g enc_callee s q \<surd>
 2. \<And>s q r s'. \<lbrakk>q \<in> outs_\<I> \<I>_full; (r, s') \<in> results_gpv (\<I>_full \<oplus>\<^sub>\<I> \<I>_full) (enc_callee s q)\<rbrakk> \<Longrightarrow> r \<in> responses_\<I> \<I>_full q
 3. ?\<I>1'29, \<I>_full \<oplus>\<^sub>\<I> \<I>_full \<turnstile>\<^sub>C CNV dec_callee () \<surd>
 4. ?\<I>2.19,\<I>_full \<turnstile>\<^sub>C 1\<^sub>C \<sim> ?conv2'19
 5. UNIV \<subseteq> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> ?\<I>1'29) \<oplus>\<^sub>\<I> ?\<I>2.19))
 6. UNIV \<turnstile>\<^sub>R (1\<^sub>C |\<^sub>= 1\<^sub>C) |\<^sub>= CNV (attach_wiring_right parallel_wiring\<^sub>w (enc_callee \<ddagger>\<^sub>I dec_callee)) ((), ()) |\<^sub>= ?conv2'19 \<rhd> RES (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest)) (((key.PState_Store, {}), sec.State_Void, {}), rinit key_rest, rinit auth_rest) \<sim> RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest')
[PROOF STEP]
apply (rule WT_gpv_\<I>_mono)
[PROOF STATE]
proof (prove)
goal (7 subgoals):
 1. \<And>s q. q \<in> outs_\<I> \<I>_full \<Longrightarrow> ?\<I>40 s q \<turnstile>g enc_callee s q \<surd>
 2. \<And>s q. q \<in> outs_\<I> \<I>_full \<Longrightarrow> ?\<I>40 s q \<le> \<I>_full \<oplus>\<^sub>\<I> \<I>_full
 3. \<And>s q r s'. \<lbrakk>q \<in> outs_\<I> \<I>_full; (r, s') \<in> results_gpv (\<I>_full \<oplus>\<^sub>\<I> \<I>_full) (enc_callee s q)\<rbrakk> \<Longrightarrow> r \<in> responses_\<I> \<I>_full q
 4. ?\<I>1'29, \<I>_full \<oplus>\<^sub>\<I> \<I>_full \<turnstile>\<^sub>C CNV dec_callee () \<surd>
 5. ?\<I>2.19,\<I>_full \<turnstile>\<^sub>C 1\<^sub>C \<sim> ?conv2'19
 6. UNIV \<subseteq> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> ?\<I>1'29) \<oplus>\<^sub>\<I> ?\<I>2.19))
 7. UNIV \<turnstile>\<^sub>R (1\<^sub>C |\<^sub>= 1\<^sub>C) |\<^sub>= CNV (attach_wiring_right parallel_wiring\<^sub>w (enc_callee \<ddagger>\<^sub>I dec_callee)) ((), ()) |\<^sub>= ?conv2'19 \<rhd> RES (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest)) (((key.PState_Store, {}), sec.State_Void, {}), rinit key_rest, rinit auth_rest) \<sim> RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest')
[PROOF STEP]
apply (rule WT_gpv_full)
[PROOF STATE]
proof (prove)
goal (6 subgoals):
 1. \<And>s q. q \<in> outs_\<I> \<I>_full \<Longrightarrow> \<I>_full \<le> \<I>_full \<oplus>\<^sub>\<I> \<I>_full
 2. \<And>s q r s'. \<lbrakk>q \<in> outs_\<I> \<I>_full; (r, s') \<in> results_gpv (\<I>_full \<oplus>\<^sub>\<I> \<I>_full) (enc_callee s q)\<rbrakk> \<Longrightarrow> r \<in> responses_\<I> \<I>_full q
 3. ?\<I>1'29, \<I>_full \<oplus>\<^sub>\<I> \<I>_full \<turnstile>\<^sub>C CNV dec_callee () \<surd>
 4. ?\<I>2.19,\<I>_full \<turnstile>\<^sub>C 1\<^sub>C \<sim> ?conv2'19
 5. UNIV \<subseteq> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> ?\<I>1'29) \<oplus>\<^sub>\<I> ?\<I>2.19))
 6. UNIV \<turnstile>\<^sub>R (1\<^sub>C |\<^sub>= 1\<^sub>C) |\<^sub>= CNV (attach_wiring_right parallel_wiring\<^sub>w (enc_callee \<ddagger>\<^sub>I dec_callee)) ((), ()) |\<^sub>= ?conv2'19 \<rhd> RES (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest)) (((key.PState_Store, {}), sec.State_Void, {}), rinit key_rest, rinit auth_rest) \<sim> RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest')
[PROOF STEP]
apply (rule \<I>_full_le_plus_\<I>)
[PROOF STATE]
proof (prove)
goal (7 subgoals):
 1. \<And>s q. q \<in> outs_\<I> \<I>_full \<Longrightarrow> \<I>_full \<le> \<I>_full
 2. \<And>s q. q \<in> outs_\<I> \<I>_full \<Longrightarrow> \<I>_full \<le> \<I>_full
 3. \<And>s q r s'. \<lbrakk>q \<in> outs_\<I> \<I>_full; (r, s') \<in> results_gpv (\<I>_full \<oplus>\<^sub>\<I> \<I>_full) (enc_callee s q)\<rbrakk> \<Longrightarrow> r \<in> responses_\<I> \<I>_full q
 4. ?\<I>1'29, \<I>_full \<oplus>\<^sub>\<I> \<I>_full \<turnstile>\<^sub>C CNV dec_callee () \<surd>
 5. ?\<I>2.19,\<I>_full \<turnstile>\<^sub>C 1\<^sub>C \<sim> ?conv2'19
 6. UNIV \<subseteq> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> ?\<I>1'29) \<oplus>\<^sub>\<I> ?\<I>2.19))
 7. UNIV \<turnstile>\<^sub>R (1\<^sub>C |\<^sub>= 1\<^sub>C) |\<^sub>= CNV (attach_wiring_right parallel_wiring\<^sub>w (enc_callee \<ddagger>\<^sub>I dec_callee)) ((), ()) |\<^sub>= ?conv2'19 \<rhd> RES (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest)) (((key.PState_Store, {}), sec.State_Void, {}), rinit key_rest, rinit auth_rest) \<sim> RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest')
[PROOF STEP]
apply(rule order_refl)
[PROOF STATE]
proof (prove)
goal (6 subgoals):
 1. \<And>s q. q \<in> outs_\<I> \<I>_full \<Longrightarrow> \<I>_full \<le> \<I>_full
 2. \<And>s q r s'. \<lbrakk>q \<in> outs_\<I> \<I>_full; (r, s') \<in> results_gpv (\<I>_full \<oplus>\<^sub>\<I> \<I>_full) (enc_callee s q)\<rbrakk> \<Longrightarrow> r \<in> responses_\<I> \<I>_full q
 3. ?\<I>1'29, \<I>_full \<oplus>\<^sub>\<I> \<I>_full \<turnstile>\<^sub>C CNV dec_callee () \<surd>
 4. ?\<I>2.19,\<I>_full \<turnstile>\<^sub>C 1\<^sub>C \<sim> ?conv2'19
 5. UNIV \<subseteq> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> ?\<I>1'29) \<oplus>\<^sub>\<I> ?\<I>2.19))
 6. UNIV \<turnstile>\<^sub>R (1\<^sub>C |\<^sub>= 1\<^sub>C) |\<^sub>= CNV (attach_wiring_right parallel_wiring\<^sub>w (enc_callee \<ddagger>\<^sub>I dec_callee)) ((), ()) |\<^sub>= ?conv2'19 \<rhd> RES (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest)) (((key.PState_Store, {}), sec.State_Void, {}), rinit key_rest, rinit auth_rest) \<sim> RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest')
[PROOF STEP]
apply(rule order_refl)
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>s q r s'. \<lbrakk>q \<in> outs_\<I> \<I>_full; (r, s') \<in> results_gpv (\<I>_full \<oplus>\<^sub>\<I> \<I>_full) (enc_callee s q)\<rbrakk> \<Longrightarrow> r \<in> responses_\<I> \<I>_full q
 2. ?\<I>1'29, \<I>_full \<oplus>\<^sub>\<I> \<I>_full \<turnstile>\<^sub>C CNV dec_callee () \<surd>
 3. ?\<I>2.19,\<I>_full \<turnstile>\<^sub>C 1\<^sub>C \<sim> ?conv2'19
 4. UNIV \<subseteq> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> ?\<I>1'29) \<oplus>\<^sub>\<I> ?\<I>2.19))
 5. UNIV \<turnstile>\<^sub>R (1\<^sub>C |\<^sub>= 1\<^sub>C) |\<^sub>= CNV (attach_wiring_right parallel_wiring\<^sub>w (enc_callee \<ddagger>\<^sub>I dec_callee)) ((), ()) |\<^sub>= ?conv2'19 \<rhd> RES (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest)) (((key.PState_Store, {}), sec.State_Void, {}), rinit key_rest, rinit auth_rest) \<sim> RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest')
[PROOF STEP]
apply (clarsimp simp add: enc_callee_def stateless_callee_def split!: sec.iusr_alice.splits key.ousr_alice.splits)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. ?\<I>1'29, \<I>_full \<oplus>\<^sub>\<I> \<I>_full \<turnstile>\<^sub>C CNV dec_callee () \<surd>
 2. ?\<I>2.19,\<I>_full \<turnstile>\<^sub>C 1\<^sub>C \<sim> ?conv2'19
 3. UNIV \<subseteq> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> ?\<I>1'29) \<oplus>\<^sub>\<I> ?\<I>2.19))
 4. UNIV \<turnstile>\<^sub>R (1\<^sub>C |\<^sub>= 1\<^sub>C) |\<^sub>= CNV (attach_wiring_right parallel_wiring\<^sub>w (enc_callee \<ddagger>\<^sub>I dec_callee)) ((), ()) |\<^sub>= ?conv2'19 \<rhd> RES (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest)) (((key.PState_Store, {}), sec.State_Void, {}), rinit key_rest, rinit auth_rest) \<sim> RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest')
[PROOF STEP]
apply (rule WT_converter_of_callee[where \<I>=\<I>_full and \<I>'="\<I>_full \<oplus>\<^sub>\<I> \<I>_full"])
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>s q. q \<in> outs_\<I> \<I>_full \<Longrightarrow> \<I>_full \<oplus>\<^sub>\<I> \<I>_full \<turnstile>g dec_callee s q \<surd>
 2. \<And>s q r s'. \<lbrakk>q \<in> outs_\<I> \<I>_full; (r, s') \<in> results_gpv (\<I>_full \<oplus>\<^sub>\<I> \<I>_full) (dec_callee s q)\<rbrakk> \<Longrightarrow> r \<in> responses_\<I> \<I>_full q
 3. ?\<I>2.19,\<I>_full \<turnstile>\<^sub>C 1\<^sub>C \<sim> ?conv2'19
 4. UNIV \<subseteq> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> ?\<I>2.19))
 5. UNIV \<turnstile>\<^sub>R (1\<^sub>C |\<^sub>= 1\<^sub>C) |\<^sub>= CNV (attach_wiring_right parallel_wiring\<^sub>w (enc_callee \<ddagger>\<^sub>I dec_callee)) ((), ()) |\<^sub>= ?conv2'19 \<rhd> RES (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest)) (((key.PState_Store, {}), sec.State_Void, {}), rinit key_rest, rinit auth_rest) \<sim> RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest')
[PROOF STEP]
apply (rule WT_gpv_\<I>_mono)
[PROOF STATE]
proof (prove)
goal (6 subgoals):
 1. \<And>s q. q \<in> outs_\<I> \<I>_full \<Longrightarrow> ?\<I>57 s q \<turnstile>g dec_callee s q \<surd>
 2. \<And>s q. q \<in> outs_\<I> \<I>_full \<Longrightarrow> ?\<I>57 s q \<le> \<I>_full \<oplus>\<^sub>\<I> \<I>_full
 3. \<And>s q r s'. \<lbrakk>q \<in> outs_\<I> \<I>_full; (r, s') \<in> results_gpv (\<I>_full \<oplus>\<^sub>\<I> \<I>_full) (dec_callee s q)\<rbrakk> \<Longrightarrow> r \<in> responses_\<I> \<I>_full q
 4. ?\<I>2.19,\<I>_full \<turnstile>\<^sub>C 1\<^sub>C \<sim> ?conv2'19
 5. UNIV \<subseteq> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> ?\<I>2.19))
 6. UNIV \<turnstile>\<^sub>R (1\<^sub>C |\<^sub>= 1\<^sub>C) |\<^sub>= CNV (attach_wiring_right parallel_wiring\<^sub>w (enc_callee \<ddagger>\<^sub>I dec_callee)) ((), ()) |\<^sub>= ?conv2'19 \<rhd> RES (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest)) (((key.PState_Store, {}), sec.State_Void, {}), rinit key_rest, rinit auth_rest) \<sim> RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest')
[PROOF STEP]
apply (rule WT_gpv_full)
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>s q. q \<in> outs_\<I> \<I>_full \<Longrightarrow> \<I>_full \<le> \<I>_full \<oplus>\<^sub>\<I> \<I>_full
 2. \<And>s q r s'. \<lbrakk>q \<in> outs_\<I> \<I>_full; (r, s') \<in> results_gpv (\<I>_full \<oplus>\<^sub>\<I> \<I>_full) (dec_callee s q)\<rbrakk> \<Longrightarrow> r \<in> responses_\<I> \<I>_full q
 3. ?\<I>2.19,\<I>_full \<turnstile>\<^sub>C 1\<^sub>C \<sim> ?conv2'19
 4. UNIV \<subseteq> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> ?\<I>2.19))
 5. UNIV \<turnstile>\<^sub>R (1\<^sub>C |\<^sub>= 1\<^sub>C) |\<^sub>= CNV (attach_wiring_right parallel_wiring\<^sub>w (enc_callee \<ddagger>\<^sub>I dec_callee)) ((), ()) |\<^sub>= ?conv2'19 \<rhd> RES (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest)) (((key.PState_Store, {}), sec.State_Void, {}), rinit key_rest, rinit auth_rest) \<sim> RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest')
[PROOF STEP]
apply (rule \<I>_full_le_plus_\<I>)
[PROOF STATE]
proof (prove)
goal (6 subgoals):
 1. \<And>s q. q \<in> outs_\<I> \<I>_full \<Longrightarrow> \<I>_full \<le> \<I>_full
 2. \<And>s q. q \<in> outs_\<I> \<I>_full \<Longrightarrow> \<I>_full \<le> \<I>_full
 3. \<And>s q r s'. \<lbrakk>q \<in> outs_\<I> \<I>_full; (r, s') \<in> results_gpv (\<I>_full \<oplus>\<^sub>\<I> \<I>_full) (dec_callee s q)\<rbrakk> \<Longrightarrow> r \<in> responses_\<I> \<I>_full q
 4. ?\<I>2.19,\<I>_full \<turnstile>\<^sub>C 1\<^sub>C \<sim> ?conv2'19
 5. UNIV \<subseteq> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> ?\<I>2.19))
 6. UNIV \<turnstile>\<^sub>R (1\<^sub>C |\<^sub>= 1\<^sub>C) |\<^sub>= CNV (attach_wiring_right parallel_wiring\<^sub>w (enc_callee \<ddagger>\<^sub>I dec_callee)) ((), ()) |\<^sub>= ?conv2'19 \<rhd> RES (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest)) (((key.PState_Store, {}), sec.State_Void, {}), rinit key_rest, rinit auth_rest) \<sim> RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest')
[PROOF STEP]
apply(rule order_refl)
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>s q. q \<in> outs_\<I> \<I>_full \<Longrightarrow> \<I>_full \<le> \<I>_full
 2. \<And>s q r s'. \<lbrakk>q \<in> outs_\<I> \<I>_full; (r, s') \<in> results_gpv (\<I>_full \<oplus>\<^sub>\<I> \<I>_full) (dec_callee s q)\<rbrakk> \<Longrightarrow> r \<in> responses_\<I> \<I>_full q
 3. ?\<I>2.19,\<I>_full \<turnstile>\<^sub>C 1\<^sub>C \<sim> ?conv2'19
 4. UNIV \<subseteq> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> ?\<I>2.19))
 5. UNIV \<turnstile>\<^sub>R (1\<^sub>C |\<^sub>= 1\<^sub>C) |\<^sub>= CNV (attach_wiring_right parallel_wiring\<^sub>w (enc_callee \<ddagger>\<^sub>I dec_callee)) ((), ()) |\<^sub>= ?conv2'19 \<rhd> RES (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest)) (((key.PState_Store, {}), sec.State_Void, {}), rinit key_rest, rinit auth_rest) \<sim> RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest')
[PROOF STEP]
apply(rule order_refl)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>s q r s'. \<lbrakk>q \<in> outs_\<I> \<I>_full; (r, s') \<in> results_gpv (\<I>_full \<oplus>\<^sub>\<I> \<I>_full) (dec_callee s q)\<rbrakk> \<Longrightarrow> r \<in> responses_\<I> \<I>_full q
 2. ?\<I>2.19,\<I>_full \<turnstile>\<^sub>C 1\<^sub>C \<sim> ?conv2'19
 3. UNIV \<subseteq> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> ?\<I>2.19))
 4. UNIV \<turnstile>\<^sub>R (1\<^sub>C |\<^sub>= 1\<^sub>C) |\<^sub>= CNV (attach_wiring_right parallel_wiring\<^sub>w (enc_callee \<ddagger>\<^sub>I dec_callee)) ((), ()) |\<^sub>= ?conv2'19 \<rhd> RES (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest)) (((key.PState_Store, {}), sec.State_Void, {}), rinit key_rest, rinit auth_rest) \<sim> RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest')
[PROOF STEP]
apply (clarsimp simp add: enc_callee_def stateless_callee_def split!: sec.iusr_alice.splits key.ousr_alice.splits)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. ?\<I>2.19,\<I>_full \<turnstile>\<^sub>C 1\<^sub>C \<sim> ?conv2'19
 2. UNIV \<subseteq> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> ?\<I>2.19))
 3. UNIV \<turnstile>\<^sub>R (1\<^sub>C |\<^sub>= 1\<^sub>C) |\<^sub>= CNV (attach_wiring_right parallel_wiring\<^sub>w (enc_callee \<ddagger>\<^sub>I dec_callee)) ((), ()) |\<^sub>= ?conv2'19 \<rhd> RES (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest)) (((key.PState_Store, {}), sec.State_Void, {}), rinit key_rest, rinit auth_rest) \<sim> RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest')
[PROOF STEP]
apply(subst id_converter_eq_self)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. ?\<I>2.19 \<le> \<I>_full
 2. True
 3. UNIV \<subseteq> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> ?\<I>2.19))
 4. UNIV \<turnstile>\<^sub>R (1\<^sub>C |\<^sub>= 1\<^sub>C) |\<^sub>= CNV (attach_wiring_right parallel_wiring\<^sub>w (enc_callee \<ddagger>\<^sub>I dec_callee)) ((), ()) |\<^sub>= 1\<^sub>C \<rhd> RES (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest)) (((key.PState_Store, {}), sec.State_Void, {}), rinit key_rest, rinit auth_rest) \<sim> RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest')
[PROOF STEP]
apply(rule order_refl)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. True
 2. UNIV \<subseteq> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full))
 3. UNIV \<turnstile>\<^sub>R (1\<^sub>C |\<^sub>= 1\<^sub>C) |\<^sub>= CNV (attach_wiring_right parallel_wiring\<^sub>w (enc_callee \<ddagger>\<^sub>I dec_callee)) ((), ()) |\<^sub>= 1\<^sub>C \<rhd> RES (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest)) (((key.PState_Store, {}), sec.State_Void, {}), rinit key_rest, rinit auth_rest) \<sim> RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest')
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. UNIV \<subseteq> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> \<I>_full))
 2. UNIV \<turnstile>\<^sub>R (1\<^sub>C |\<^sub>= 1\<^sub>C) |\<^sub>= CNV (attach_wiring_right parallel_wiring\<^sub>w (enc_callee \<ddagger>\<^sub>I dec_callee)) ((), ()) |\<^sub>= 1\<^sub>C \<rhd> RES (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest)) (((key.PState_Store, {}), sec.State_Void, {}), rinit key_rest, rinit auth_rest) \<sim> RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest')
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. UNIV \<turnstile>\<^sub>R (1\<^sub>C |\<^sub>= 1\<^sub>C) |\<^sub>= CNV (attach_wiring_right parallel_wiring\<^sub>w (enc_callee \<ddagger>\<^sub>I dec_callee)) ((), ()) |\<^sub>= 1\<^sub>C \<rhd> RES (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest)) (((key.PState_Store, {}), sec.State_Void, {}), rinit key_rest, rinit auth_rest) \<sim> RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest')
[PROOF STEP]
apply(subst eq_resource_on_UNIV_iff)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (1\<^sub>C |\<^sub>= 1\<^sub>C) |\<^sub>= CNV (attach_wiring_right parallel_wiring\<^sub>w (enc_callee \<ddagger>\<^sub>I dec_callee)) ((), ()) |\<^sub>= 1\<^sub>C \<rhd> RES (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest)) (((key.PState_Store, {}), sec.State_Void, {}), rinit key_rest, rinit auth_rest) = RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest')
[PROOF STEP]
apply(subst (1 2 3) converter_of_callee_id_oracle[symmetric, of "()"])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (CNV 1\<^sub>I () |\<^sub>= CNV 1\<^sub>I ()) |\<^sub>= CNV (attach_wiring_right parallel_wiring\<^sub>w (enc_callee \<ddagger>\<^sub>I dec_callee)) ((), ()) |\<^sub>= CNV 1\<^sub>I () \<rhd> RES (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest)) (((key.PState_Store, {}), sec.State_Void, {}), rinit key_rest, rinit auth_rest) = RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest')
[PROOF STEP]
apply(subst attach_parallel_fuse')
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. RES (fused_resource.fuse (attach_core 1\<^sub>I (attach_wiring_right parallel_wiring\<^sub>w (enc_callee \<ddagger>\<^sub>I dec_callee)) (parallel_core key.core auth.core)) (attach_rest 1\<^sub>I 1\<^sub>I ?f_init70 (parallel_rest key_rest auth_rest))) ((((), (), ()), (key.PState_Store, {}), sec.State_Void, {}), ((), ()), rinit key_rest, rinit auth_rest) = RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest')
[PROOF STEP]
apply(simp add: fact1 fact2 real_s_core'_def real_s_rest'_def ideal_s_rest'_def)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
real_resource = RES (fused_resource.fuse real_core' real_rest') (real_s_core', real_s_rest')

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma ProcNoRec1:
  assumes deriv_body:
   "\<forall>Z. \<Gamma>,\<Theta>\<turnstile>\<^sub>t\<^bsub>/F\<^esub> (P Z) (the (\<Gamma> p)) (Q Z),(A Z)"
  assumes p_defined: "p \<in> dom \<Gamma>"
  shows "\<forall>Z. \<Gamma>,\<Theta>\<turnstile>\<^sub>t\<^bsub>/F\<^esub> (P Z) Call p (Q Z),(A Z)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>Z. \<Gamma>,\<Theta>\<turnstile>\<^sub>t\<^bsub>/F\<^esub> (P Z) Call p (Q Z),(A Z)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<forall>Z. \<Gamma>,\<Theta>\<turnstile>\<^sub>t\<^bsub>/F\<^esub> (P Z) Call p (Q Z),(A Z)
[PROOF STEP]
have "\<forall>\<sigma> Z. \<Gamma>,\<Theta>\<turnstile>\<^sub>t\<^bsub>/F\<^esub> ({\<sigma>} \<inter> P Z) (the (\<Gamma> p)) (Q Z),(A Z)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>\<sigma> Z. \<Gamma>,\<Theta>\<turnstile>\<^sub>t\<^bsub>/F\<^esub> ({\<sigma>} \<inter> P Z) the (\<Gamma> p) (Q Z),(A Z)
[PROOF STEP]
by (blast intro: conseqPre deriv_body [rule_format])
[PROOF STATE]
proof (state)
this:
\<forall>\<sigma> Z. \<Gamma>,\<Theta>\<turnstile>\<^sub>t\<^bsub>/F\<^esub> ({\<sigma>} \<inter> P Z) the (\<Gamma> p) (Q Z),(A Z)

goal (1 subgoal):
 1. \<forall>Z. \<Gamma>,\<Theta>\<turnstile>\<^sub>t\<^bsub>/F\<^esub> (P Z) Call p (Q Z),(A Z)
[PROOF STEP]
with p_defined
[PROOF STATE]
proof (chain)
picking this:
p \<in> dom \<Gamma>
\<forall>\<sigma> Z. \<Gamma>,\<Theta>\<turnstile>\<^sub>t\<^bsub>/F\<^esub> ({\<sigma>} \<inter> P Z) the (\<Gamma> p) (Q Z),(A Z)
[PROOF STEP]
have "\<forall>\<sigma> Z. \<Gamma>,\<Theta>\<union>(\<Union>Z. {(P Z \<inter> {s. ((s,p), \<sigma>,p) \<in> {}},
                         p,Q Z,A Z)})
             \<turnstile>\<^sub>t\<^bsub>/F\<^esub> ({\<sigma>} \<inter> P Z) (the (\<Gamma> p)) (Q Z),(A Z)"
[PROOF STATE]
proof (prove)
using this:
p \<in> dom \<Gamma>
\<forall>\<sigma> Z. \<Gamma>,\<Theta>\<turnstile>\<^sub>t\<^bsub>/F\<^esub> ({\<sigma>} \<inter> P Z) the (\<Gamma> p) (Q Z),(A Z)

goal (1 subgoal):
 1. \<forall>\<sigma> Z. \<Gamma>,\<Theta> \<union> (\<Union>Z. {(P Z \<inter> {s. ((s, p), \<sigma>, p) \<in> {}}, p, Q Z, A Z)})\<turnstile>\<^sub>t\<^bsub>/F\<^esub> ({\<sigma>} \<inter> P Z) the (\<Gamma> p) (Q Z),(A Z)
[PROOF STEP]
by (blast intro: hoaret_augment_context)
[PROOF STATE]
proof (state)
this:
\<forall>\<sigma> Z. \<Gamma>,\<Theta> \<union> (\<Union>Z. {(P Z \<inter> {s. ((s, p), \<sigma>, p) \<in> {}}, p, Q Z, A Z)})\<turnstile>\<^sub>t\<^bsub>/F\<^esub> ({\<sigma>} \<inter> P Z) the (\<Gamma> p) (Q Z),(A Z)

goal (1 subgoal):
 1. \<forall>Z. \<Gamma>,\<Theta>\<turnstile>\<^sub>t\<^bsub>/F\<^esub> (P Z) Call p (Q Z),(A Z)
[PROOF STEP]
from this
[PROOF STATE]
proof (chain)
picking this:
\<forall>\<sigma> Z. \<Gamma>,\<Theta> \<union> (\<Union>Z. {(P Z \<inter> {s. ((s, p), \<sigma>, p) \<in> {}}, p, Q Z, A Z)})\<turnstile>\<^sub>t\<^bsub>/F\<^esub> ({\<sigma>} \<inter> P Z) the (\<Gamma> p) (Q Z),(A Z)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<forall>\<sigma> Z. \<Gamma>,\<Theta> \<union> (\<Union>Z. {(P Z \<inter> {s. ((s, p), \<sigma>, p) \<in> {}}, p, Q Z, A Z)})\<turnstile>\<^sub>t\<^bsub>/F\<^esub> ({\<sigma>} \<inter> P Z) the (\<Gamma> p) (Q Z),(A Z)

goal (1 subgoal):
 1. \<forall>Z. \<Gamma>,\<Theta>\<turnstile>\<^sub>t\<^bsub>/F\<^esub> (P Z) Call p (Q Z),(A Z)
[PROOF STEP]
by (rule ProcRec1) (auto simp add: p_defined)
[PROOF STATE]
proof (state)
this:
\<forall>Z. \<Gamma>,\<Theta>\<turnstile>\<^sub>t\<^bsub>/F\<^esub> (P Z) Call p (Q Z),(A Z)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma DynProcProcPar:
assumes adapt: "P \<subseteq> {s. p s = q \<and> (\<exists>Z. init s \<in> P' Z  \<and>
                            (\<forall>\<tau>. \<tau> \<in> Q' Z \<longrightarrow> return s \<tau> \<in> R s \<tau>) \<and>
                            (\<forall>\<tau>. \<tau> \<in> A' Z \<longrightarrow> return s \<tau> \<in> A))}"
assumes c: "\<forall>s t. \<Gamma>,\<Theta>\<turnstile>\<^bsub>/F\<^esub> (R s t) (c s t) Q,A"
assumes spec: "\<forall>Z. \<Gamma>,\<Theta>\<turnstile>\<^bsub>/F\<^esub> (P' Z) Call q (Q' Z),(A' Z)"
shows "\<Gamma>,\<Theta>\<turnstile>\<^bsub>/F\<^esub> P (dynCall init p return c) Q,A"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<Gamma>,\<Theta>\<turnstile>\<^bsub>/F \<^esub>P dynCall init p return c Q,A
[PROOF STEP]
apply (rule DynProcStaticSpec [where S="{s. p s = q}",simplified, OF adapt c])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>s. p s = q \<longrightarrow> (\<forall>Z. \<Gamma>,\<Theta>\<turnstile>\<^bsub>/F \<^esub>(P' Z) Call (p s) (Q' Z),(A' Z))
[PROOF STEP]
using spec
[PROOF STATE]
proof (prove)
using this:
\<forall>Z. \<Gamma>,\<Theta>\<turnstile>\<^bsub>/F \<^esub>(P' Z) Call q (Q' Z),(A' Z)

goal (1 subgoal):
 1. \<forall>s. p s = q \<longrightarrow> (\<forall>Z. \<Gamma>,\<Theta>\<turnstile>\<^bsub>/F \<^esub>(P' Z) Call (p s) (Q' Z),(A' Z))
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma SeqSubstFormP_Eq:
  assumes sk: "atom s \<sharp> (k,x,y,x',y',v,i)" "atom k \<sharp> (x,y,x',y',v,i)"
  shows "{SubstTermP v i x x', SubstTermP v i y y'}
           \<turnstile> Ex s (Ex k (SeqSubstFormP v i (Q_Eq x y) (Q_Eq x' y') (Var s) (Var k)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {SubstTermP v i x x', SubstTermP v i y y'} \<turnstile> SyntaxN.Ex s (SyntaxN.Ex k (SeqSubstFormP v i (Q_Eq x y) (Q_Eq x' y') (Var s) (Var k)))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. {SubstTermP v i x x', SubstTermP v i y y'} \<turnstile> SyntaxN.Ex s (SyntaxN.Ex k (SeqSubstFormP v i (Q_Eq x y) (Q_Eq x' y') (Var s) (Var k)))
[PROOF STEP]
let ?vs = "(s,k,x,y,x',y',v,i)"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. {SubstTermP v i x x', SubstTermP v i y y'} \<turnstile> SyntaxN.Ex s (SyntaxN.Ex k (SeqSubstFormP v i (Q_Eq x y) (Q_Eq x' y') (Var s) (Var k)))
[PROOF STEP]
obtain l::name and sl::name and sl'::name and m::name and n::name and sm::name and sm'::name and sn::name and sn'::name
    where "atom l \<sharp> (?vs,sl,sl',m,n,sm,sm',sn,sn')"
      "atom sl \<sharp> (?vs,sl',m,n,sm,sm',sn,sn')" "atom sl' \<sharp> (?vs,m,n,sm,sm',sn,sn')"
      "atom m \<sharp> (?vs,n,sm,sm',sn,sn')" "atom n \<sharp> (?vs,sm,sm',sn,sn')"
      "atom sm \<sharp> (?vs,sm',sn,sn')" "atom sm' \<sharp> (?vs,sn,sn')"
      "atom sn \<sharp> (?vs,sn')" "atom sn' \<sharp> ?vs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>l sl sl' m n sm sm' sn sn'. \<lbrakk>atom l \<sharp> ((s, k, x, y, x', y', v, i), sl, sl', m, n, sm, sm', sn, sn'); atom sl \<sharp> ((s, k, x, y, x', y', v, i), sl', m, n, sm, sm', sn, sn'); atom sl' \<sharp> ((s, k, x, y, x', y', v, i), m, n, sm, sm', sn, sn'); atom m \<sharp> ((s, k, x, y, x', y', v, i), n, sm, sm', sn, sn'); atom n \<sharp> ((s, k, x, y, x', y', v, i), sm, sm', sn, sn'); atom sm \<sharp> ((s, k, x, y, x', y', v, i), sm', sn, sn'); atom sm' \<sharp> ((s, k, x, y, x', y', v, i), sn, sn'); atom sn \<sharp> ((s, k, x, y, x', y', v, i), sn'); atom sn' \<sharp> (s, k, x, y, x', y', v, i)\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (metis obtain_fresh)
[PROOF STATE]
proof (state)
this:
atom l \<sharp> ((s, k, x, y, x', y', v, i), sl, sl', m, n, sm, sm', sn, sn')
atom sl \<sharp> ((s, k, x, y, x', y', v, i), sl', m, n, sm, sm', sn, sn')
atom sl' \<sharp> ((s, k, x, y, x', y', v, i), m, n, sm, sm', sn, sn')
atom m \<sharp> ((s, k, x, y, x', y', v, i), n, sm, sm', sn, sn')
atom n \<sharp> ((s, k, x, y, x', y', v, i), sm, sm', sn, sn')
atom sm \<sharp> ((s, k, x, y, x', y', v, i), sm', sn, sn')
atom sm' \<sharp> ((s, k, x, y, x', y', v, i), sn, sn')
atom sn \<sharp> ((s, k, x, y, x', y', v, i), sn')
atom sn' \<sharp> (s, k, x, y, x', y', v, i)

goal (1 subgoal):
 1. {SubstTermP v i x x', SubstTermP v i y y'} \<turnstile> SyntaxN.Ex s (SyntaxN.Ex k (SeqSubstFormP v i (Q_Eq x y) (Q_Eq x' y') (Var s) (Var k)))
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
atom l \<sharp> ((s, k, x, y, x', y', v, i), sl, sl', m, n, sm, sm', sn, sn')
atom sl \<sharp> ((s, k, x, y, x', y', v, i), sl', m, n, sm, sm', sn, sn')
atom sl' \<sharp> ((s, k, x, y, x', y', v, i), m, n, sm, sm', sn, sn')
atom m \<sharp> ((s, k, x, y, x', y', v, i), n, sm, sm', sn, sn')
atom n \<sharp> ((s, k, x, y, x', y', v, i), sm, sm', sn, sn')
atom sm \<sharp> ((s, k, x, y, x', y', v, i), sm', sn, sn')
atom sm' \<sharp> ((s, k, x, y, x', y', v, i), sn, sn')
atom sn \<sharp> ((s, k, x, y, x', y', v, i), sn')
atom sn' \<sharp> (s, k, x, y, x', y', v, i)

goal (1 subgoal):
 1. {SubstTermP v i x x', SubstTermP v i y y'} \<turnstile> SyntaxN.Ex s (SyntaxN.Ex k (SeqSubstFormP v i (Q_Eq x y) (Q_Eq x' y') (Var s) (Var k)))
[PROOF STEP]
using sk
[PROOF STATE]
proof (prove)
using this:
atom l \<sharp> ((s, k, x, y, x', y', v, i), sl, sl', m, n, sm, sm', sn, sn')
atom sl \<sharp> ((s, k, x, y, x', y', v, i), sl', m, n, sm, sm', sn, sn')
atom sl' \<sharp> ((s, k, x, y, x', y', v, i), m, n, sm, sm', sn, sn')
atom m \<sharp> ((s, k, x, y, x', y', v, i), n, sm, sm', sn, sn')
atom n \<sharp> ((s, k, x, y, x', y', v, i), sm, sm', sn, sn')
atom sm \<sharp> ((s, k, x, y, x', y', v, i), sm', sn, sn')
atom sm' \<sharp> ((s, k, x, y, x', y', v, i), sn, sn')
atom sn \<sharp> ((s, k, x, y, x', y', v, i), sn')
atom sn' \<sharp> (s, k, x, y, x', y', v, i)
atom s \<sharp> (k, x, y, x', y', v, i)
atom k \<sharp> (x, y, x', y', v, i)

goal (1 subgoal):
 1. {SubstTermP v i x x', SubstTermP v i y y'} \<turnstile> SyntaxN.Ex s (SyntaxN.Ex k (SeqSubstFormP v i (Q_Eq x y) (Q_Eq x' y') (Var s) (Var k)))
[PROOF STEP]
apply (auto simp: SeqSubstFormP.simps [of l "Var s" _ _ _ sl sl' m n sm sm' sn sn'])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>atom l \<sharp> ((s, k, x, y, x', y', v, i), sl, sl', m, n, sm, sm', sn, sn'); atom sl \<sharp> ((s, k, x, y, x', y', v, i), sl', m, n, sm, sm', sn, sn'); atom sl' \<sharp> ((s, k, x, y, x', y', v, i), m, n, sm, sm', sn, sn'); atom m \<sharp> ((s, k, x, y, x', y', v, i), n, sm, sm', sn, sn'); atom n \<sharp> ((s, k, x, y, x', y', v, i), sm, sm', sn, sn'); atom sm \<sharp> ((s, k, x, y, x', y', v, i), sm', sn, sn'); atom sm' \<sharp> ((s, k, x, y, x', y', v, i), sn, sn'); atom sn \<sharp> ((s, k, x, y, x', y', v, i), sn'); atom sn' \<sharp> (s, k, x, y, x', y', v, i); atom s \<sharp> (k, x, y, x', y', v, i); atom k \<sharp> (x, y, x', y', v, i)\<rbrakk> \<Longrightarrow> {SubstTermP v i x x', SubstTermP v i y y'} \<turnstile> SyntaxN.Ex s (SyntaxN.Ex k (LstSeqP (Var s) (Var k) (HPair (Q_Eq x y) (Q_Eq x' y')) AND All2 l (SUCC (Var k)) (SyntaxN.Ex sl (SyntaxN.Ex sl' (HPair (Var l) (HPair (Var sl) (Var sl')) IN Var s AND (SubstAtomicP v i (Var sl) (Var sl') OR SyntaxN.Ex m (SyntaxN.Ex n (SyntaxN.Ex sm (SyntaxN.Ex sm' (SyntaxN.Ex sn (SyntaxN.Ex sn' (Var m IN Var l AND Var n IN Var l AND HPair (Var m) (HPair (Var sm) (Var sm')) IN Var s AND HPair (Var n) (HPair (Var sn) (Var sn')) IN Var s AND (Var sl EQ Q_Disj (Var sm) (Var sn) AND Var sl' EQ Q_Disj (Var sm') (Var sn') OR Var sl EQ Q_Neg (Var sm) AND Var sl' EQ Q_Neg (Var sm') OR Var sl EQ Q_Ex (Var sm) AND Var sl' EQ Q_Ex (Var sm'))))))))))))))
[PROOF STEP]
apply (rule Ex_I [where x = "Eats Zero (HPair Zero (HPair (Q_Eq x y) (Q_Eq x' y')))"], simp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>atom l \<sharp> ((s, k, x, y, x', y', v, i), sl, sl', m, n, sm, sm', sn, sn'); atom sl \<sharp> ((s, k, x, y, x', y', v, i), sl', m, n, sm, sm', sn, sn'); atom sl' \<sharp> ((s, k, x, y, x', y', v, i), m, n, sm, sm', sn, sn'); atom m \<sharp> ((s, k, x, y, x', y', v, i), n, sm, sm', sn, sn'); atom n \<sharp> ((s, k, x, y, x', y', v, i), sm, sm', sn, sn'); atom sm \<sharp> ((s, k, x, y, x', y', v, i), sm', sn, sn'); atom sm' \<sharp> ((s, k, x, y, x', y', v, i), sn, sn'); atom sn \<sharp> ((s, k, x, y, x', y', v, i), sn'); atom sn' \<sharp> (s, k, x, y, x', y', v, i); atom s \<sharp> (k, x, y, x', y', v, i); atom k \<sharp> (x, y, x', y', v, i)\<rbrakk> \<Longrightarrow> {SubstTermP v i x x', SubstTermP v i y y'} \<turnstile> SyntaxN.Ex k (LstSeqP (Eats Zero (HPair Zero (HPair (Q_Eq x y) (Q_Eq x' y')))) (Var k) (HPair (Q_Eq x y) (Q_Eq x' y')) AND All2 l (SUCC (Var k)) (SyntaxN.Ex sl (SyntaxN.Ex sl' (HPair (Var l) (HPair (Var sl) (Var sl')) IN Eats Zero (HPair Zero (HPair (Q_Eq x y) (Q_Eq x' y'))) AND (SubstAtomicP v i (Var sl) (Var sl') OR SyntaxN.Ex m (SyntaxN.Ex n (SyntaxN.Ex sm (SyntaxN.Ex sm' (SyntaxN.Ex sn (SyntaxN.Ex sn' (Var m IN Var l AND Var n IN Var l AND HPair (Var m) (HPair (Var sm) (Var sm')) IN Eats Zero (HPair Zero (HPair (Q_Eq x y) (Q_Eq x' y'))) AND HPair (Var n) (HPair (Var sn) (Var sn')) IN Eats Zero (HPair Zero (HPair (Q_Eq x y) (Q_Eq x' y'))) AND (Var sl EQ Q_Disj (Var sm) (Var sn) AND Var sl' EQ Q_Disj (Var sm') (Var sn') OR Var sl EQ Q_Neg (Var sm) AND Var sl' EQ Q_Neg (Var sm') OR Var sl EQ Q_Ex (Var sm) AND Var sl' EQ Q_Ex (Var sm')))))))))))))
[PROOF STEP]
apply (rule Ex_I [where x = Zero], auto intro!: Mem_SUCC_EH)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>atom l \<sharp> ((s, k, x, y, x', y', v, i), sl, sl', m, n, sm, sm', sn, sn'); atom sl \<sharp> ((s, k, x, y, x', y', v, i), sl', m, n, sm, sm', sn, sn'); atom sl' \<sharp> ((s, k, x, y, x', y', v, i), m, n, sm, sm', sn, sn'); atom m \<sharp> ((s, k, x, y, x', y', v, i), n, sm, sm', sn, sn'); atom n \<sharp> ((s, k, x, y, x', y', v, i), sm, sm', sn, sn'); atom sm \<sharp> ((s, k, x, y, x', y', v, i), sm', sn, sn'); atom sm' \<sharp> ((s, k, x, y, x', y', v, i), sn, sn'); atom sn \<sharp> ((s, k, x, y, x', y', v, i), sn'); atom sn' \<sharp> (s, k, x, y, x', y', v, i); atom s \<sharp> (k, x, y, x', y', v, i); atom k \<sharp> (x, y, x', y', v, i)\<rbrakk> \<Longrightarrow> {Var l EQ Zero, SubstTermP v i x x', SubstTermP v i y y'} \<turnstile> SyntaxN.Ex sl (SyntaxN.Ex sl' (HPair (Var l) (HPair (Var sl) (Var sl')) IN Eats Zero (HPair Zero (HPair (Q_Eq x y) (Q_Eq x' y'))) AND (SubstAtomicP v i (Var sl) (Var sl') OR SyntaxN.Ex m (SyntaxN.Ex n (SyntaxN.Ex sm (SyntaxN.Ex sm' (SyntaxN.Ex sn (SyntaxN.Ex sn' (Var m IN Var l AND Var n IN Var l AND HPair (Var m) (HPair (Var sm) (Var sm')) IN Eats Zero (HPair Zero (HPair (Q_Eq x y) (Q_Eq x' y'))) AND HPair (Var n) (HPair (Var sn) (Var sn')) IN Eats Zero (HPair Zero (HPair (Q_Eq x y) (Q_Eq x' y'))) AND (Var sl EQ Q_Disj (Var sm) (Var sn) AND Var sl' EQ Q_Disj (Var sm') (Var sn') OR Var sl EQ Q_Neg (Var sm) AND Var sl' EQ Q_Neg (Var sm') OR Var sl EQ Q_Ex (Var sm) AND Var sl' EQ Q_Ex (Var sm')))))))))))
[PROOF STEP]
apply (rule Ex_I [where x = "Q_Eq x y"], simp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>atom l \<sharp> ((s, k, x, y, x', y', v, i), sl, sl', m, n, sm, sm', sn, sn'); atom sl \<sharp> ((s, k, x, y, x', y', v, i), sl', m, n, sm, sm', sn, sn'); atom sl' \<sharp> ((s, k, x, y, x', y', v, i), m, n, sm, sm', sn, sn'); atom m \<sharp> ((s, k, x, y, x', y', v, i), n, sm, sm', sn, sn'); atom n \<sharp> ((s, k, x, y, x', y', v, i), sm, sm', sn, sn'); atom sm \<sharp> ((s, k, x, y, x', y', v, i), sm', sn, sn'); atom sm' \<sharp> ((s, k, x, y, x', y', v, i), sn, sn'); atom sn \<sharp> ((s, k, x, y, x', y', v, i), sn'); atom sn' \<sharp> (s, k, x, y, x', y', v, i); atom s \<sharp> (k, x, y, x', y', v, i); atom k \<sharp> (x, y, x', y', v, i)\<rbrakk> \<Longrightarrow> {Var l EQ Zero, SubstTermP v i x x', SubstTermP v i y y'} \<turnstile> SyntaxN.Ex sl' (HPair (Var l) (HPair (Q_Eq x y) (Var sl')) IN Eats Zero (HPair Zero (HPair (Q_Eq x y) (Q_Eq x' y'))) AND (SubstAtomicP v i (Q_Eq x y) (Var sl') OR SyntaxN.Ex m (SyntaxN.Ex n (SyntaxN.Ex sm (SyntaxN.Ex sm' (SyntaxN.Ex sn (SyntaxN.Ex sn' (Var m IN Var l AND Var n IN Var l AND HPair (Var m) (HPair (Var sm) (Var sm')) IN Eats Zero (HPair Zero (HPair (Q_Eq x y) (Q_Eq x' y'))) AND HPair (Var n) (HPair (Var sn) (Var sn')) IN Eats Zero (HPair Zero (HPair (Q_Eq x y) (Q_Eq x' y'))) AND (Q_Eq x y EQ Q_Disj (Var sm) (Var sn) AND Var sl' EQ Q_Disj (Var sm') (Var sn') OR Q_Eq x y EQ Q_Neg (Var sm) AND Var sl' EQ Q_Neg (Var sm') OR Q_Eq x y EQ Q_Ex (Var sm) AND Var sl' EQ Q_Ex (Var sm'))))))))))
[PROOF STEP]
apply (rule Ex_I [where x = "Q_Eq x' y'"], auto)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>atom l \<sharp> ((s, k, x, y, x', y', v, i), sl, sl', m, n, sm, sm', sn, sn'); atom sl \<sharp> ((s, k, x, y, x', y', v, i), sl', m, n, sm, sm', sn, sn'); atom sl' \<sharp> ((s, k, x, y, x', y', v, i), m, n, sm, sm', sn, sn'); atom m \<sharp> ((s, k, x, y, x', y', v, i), n, sm, sm', sn, sn'); atom n \<sharp> ((s, k, x, y, x', y', v, i), sm, sm', sn, sn'); atom sm \<sharp> ((s, k, x, y, x', y', v, i), sm', sn, sn'); atom sm' \<sharp> ((s, k, x, y, x', y', v, i), sn, sn'); atom sn \<sharp> ((s, k, x, y, x', y', v, i), sn'); atom sn' \<sharp> (s, k, x, y, x', y', v, i); atom s \<sharp> (k, x, y, x', y', v, i); atom k \<sharp> (x, y, x', y', v, i)\<rbrakk> \<Longrightarrow> {Var l EQ Zero, SubstTermP v i x x', SubstTermP v i y y'} \<turnstile> HPair (Var l) (HPair (Q_Eq x y) (Q_Eq x' y')) IN Eats Zero (HPair Zero (HPair (Q_Eq x y) (Q_Eq x' y')))
 2. \<lbrakk>atom l \<sharp> ((s, k, x, y, x', y', v, i), sl, sl', m, n, sm, sm', sn, sn'); atom sl \<sharp> ((s, k, x, y, x', y', v, i), sl', m, n, sm, sm', sn, sn'); atom sl' \<sharp> ((s, k, x, y, x', y', v, i), m, n, sm, sm', sn, sn'); atom m \<sharp> ((s, k, x, y, x', y', v, i), n, sm, sm', sn, sn'); atom n \<sharp> ((s, k, x, y, x', y', v, i), sm, sm', sn, sn'); atom sm \<sharp> ((s, k, x, y, x', y', v, i), sm', sn, sn'); atom sm' \<sharp> ((s, k, x, y, x', y', v, i), sn, sn'); atom sn \<sharp> ((s, k, x, y, x', y', v, i), sn'); atom sn' \<sharp> (s, k, x, y, x', y', v, i); atom s \<sharp> (k, x, y, x', y', v, i); atom k \<sharp> (x, y, x', y', v, i)\<rbrakk> \<Longrightarrow> {Var l EQ Zero, SubstTermP v i x x', SubstTermP v i y y'} \<turnstile> SubstAtomicP v i (Q_Eq x y) (Q_Eq x' y') OR SyntaxN.Ex m (SyntaxN.Ex n (SyntaxN.Ex sm (SyntaxN.Ex sm' (SyntaxN.Ex sn (SyntaxN.Ex sn' (Var m IN Var l AND Var n IN Var l AND HPair (Var m) (HPair (Var sm) (Var sm')) IN Eats Zero (HPair Zero (HPair (Q_Eq x y) (Q_Eq x' y'))) AND HPair (Var n) (HPair (Var sn) (Var sn')) IN Eats Zero (HPair Zero (HPair (Q_Eq x y) (Q_Eq x' y'))) AND (Q_Eq x y EQ Q_Disj (Var sm) (Var sn) AND Q_Eq x' y' EQ Q_Disj (Var sm') (Var sn') OR Q_Eq x y EQ Q_Neg (Var sm) AND Q_Eq x' y' EQ Q_Neg (Var sm') OR Q_Eq x y EQ Q_Ex (Var sm) AND Q_Eq x' y' EQ Q_Ex (Var sm'))))))))
[PROOF STEP]
apply (metis Mem_Eats_I2 Assume HPair_cong Refl)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>atom l \<sharp> ((s, k, x, y, x', y', v, i), sl, sl', m, n, sm, sm', sn, sn'); atom sl \<sharp> ((s, k, x, y, x', y', v, i), sl', m, n, sm, sm', sn, sn'); atom sl' \<sharp> ((s, k, x, y, x', y', v, i), m, n, sm, sm', sn, sn'); atom m \<sharp> ((s, k, x, y, x', y', v, i), n, sm, sm', sn, sn'); atom n \<sharp> ((s, k, x, y, x', y', v, i), sm, sm', sn, sn'); atom sm \<sharp> ((s, k, x, y, x', y', v, i), sm', sn, sn'); atom sm' \<sharp> ((s, k, x, y, x', y', v, i), sn, sn'); atom sn \<sharp> ((s, k, x, y, x', y', v, i), sn'); atom sn' \<sharp> (s, k, x, y, x', y', v, i); atom s \<sharp> (k, x, y, x', y', v, i); atom k \<sharp> (x, y, x', y', v, i)\<rbrakk> \<Longrightarrow> {Var l EQ Zero, SubstTermP v i x x', SubstTermP v i y y'} \<turnstile> SubstAtomicP v i (Q_Eq x y) (Q_Eq x' y') OR SyntaxN.Ex m (SyntaxN.Ex n (SyntaxN.Ex sm (SyntaxN.Ex sm' (SyntaxN.Ex sn (SyntaxN.Ex sn' (Var m IN Var l AND Var n IN Var l AND HPair (Var m) (HPair (Var sm) (Var sm')) IN Eats Zero (HPair Zero (HPair (Q_Eq x y) (Q_Eq x' y'))) AND HPair (Var n) (HPair (Var sn) (Var sn')) IN Eats Zero (HPair Zero (HPair (Q_Eq x y) (Q_Eq x' y'))) AND (Q_Eq x y EQ Q_Disj (Var sm) (Var sn) AND Q_Eq x' y' EQ Q_Disj (Var sm') (Var sn') OR Q_Eq x y EQ Q_Neg (Var sm) AND Q_Eq x' y' EQ Q_Neg (Var sm') OR Q_Eq x y EQ Q_Ex (Var sm) AND Q_Eq x' y' EQ Q_Ex (Var sm'))))))))
[PROOF STEP]
apply (blast intro: SubstAtomicP_Eq [THEN cut2] Disj_I1)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
{SubstTermP v i x x', SubstTermP v i y y'} \<turnstile> SyntaxN.Ex s (SyntaxN.Ex k (SeqSubstFormP v i (Q_Eq x y) (Q_Eq x' y') (Var s) (Var k)))

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma "x \<cdot> x\<^sup>\<star> = x\<^sup>\<star>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x \<cdot> x\<^sup>\<star> = x\<^sup>\<star>
[PROOF STEP]
(*nitpick [expect=genuine]*)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x \<cdot> x\<^sup>\<star> = x\<^sup>\<star>
[PROOF STEP]
oops