Research proof index

The _no_dne analogue of typecheck_policy_at_level_with_environments_is_sound: a policy that level-checks against every environment of the schema (and so, in particular, the one the request inhabits), evaluated against a store closed at that level, never produces entityDoesNotExist.

Meaty case. Dispatches on whether the receiver has entity or record type (type_of_getAttr_inversion); the entity branch is where entityDoesNotExist can fire and where EntitiesClosedAtLevel is consumed. -/ theorem level_based_no_dne_get_attr {e : Expr} {a : Attr} {n : Nat} {c₀ c₁ : Capabilities} {env : TypeEnv} {request : Request} {entities : Entitie...

The result of typeOf has a well-formed type.

The type checker produces typed expressions that are well-typed after type lifting. TODO: move this around after the proof is fixed

typeOf preserves Entities.ValidRefsFor. The converse is not true, due to policies with invalid UID literals, such as // entity User enum ["alice"]; permit(principal, action, resource) when { if true then User::"alice" else User::"bob" };

Adding a forbid policy won't change a Deny decision.