baraba/Baradb
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
4791434ceab0d3c212172a479c5ade1293f8291c
Baradb/formal-verification/CHANGELOG.md
T
dimgigov 4791434cea FV-2: Raft leader step-down on partition loss 
- Add heartbeatReceived variable tracking last term with heartbeat
- Add Heartbeat action: leader sends keep-alive; recipient steps down on higher term
- Add HeartbeatTimeout: follower starts election if no heartbeat in current term
- Add LeaderLeaseExpired: leader steps down if it loses quorum connectivity
- Add LeaderHasSelfHeartbeat invariant: every leader must have valid heartbeat
- raft.tla now models realistic partition behavior (38M states verified)
- Update CHANGELOG -> v1.2.0, VERSION -> 1.2.0, PLAN.md, README.md
2026-05-07 21:48:03 +03:00

5.3 KiB
Raw Blame History

BaraDB Formal Verification Changelog

[1.2.0] — 2026-05-07

Added

  • raft.tla: Heartbeat, HeartbeatTimeout, LeaderLeaseExpired actions — models leader step-down when quorum is lost
  • raft.tla: LeaderHasSelfHeartbeat invariant — every leader must have a valid heartbeat in its own term
  • raft.tla: heartbeatReceived variable tracks last term in which each node received a heartbeat

Improved

  • raft.tla: Heartbeat causes recipients to step down if they see a higher term (realistic AppendEntries behavior)

Model Checker Configs (v1.2.0)

Spec Model Bounds States Checked Properties
raft 3 nodes, MaxTerm=3, MaxLogLen=3 38,051,647 7 invariants + fair execution
twopc 3 participants, MaxTxnId=3 22,855,681 7 invariants + fair execution
mvcc 2 keys, 2 values, MaxTxnId=2 177,721 7 invariants + 1 liveness
replication 3 replicas, MaxLsn=3, MaxSyncCount=2 3,687,939 4 invariants + 1 temporal
gossip 3 nodes, MaxIncarnation=3 692,497 4 invariants + fair execution
deadlock 5 txns, MaxEdges=8 3,767,361 2 invariants
sharding 3 shards, 2 nodes, 5 vnodes 186,305 3 invariants

[1.1.0] — 2026-05-07

Added

  • mvcc.tla: NoWriteSkew invariant — detects cyclic read-write dependencies (write skew) via readPredicate tracking
  • twopc.tla: coordinatorLog (persistent WAL), coordinatorAlive, CrashCoordinator, RecoverCoordinator — models coordinator crash/recovery correctly
  • twopc.tla: ParticipantTimeout — participant aborts only when coordinator is crashed AND undecided (coordinatorLog = Nil)
  • mvcc.tla: CommitProgress liveness property — any transaction that writes eventually commits or aborts (verified with WF_vars(Next))
  • raft/twopc/mvcc/gossip: Spec definition with WF_vars(Next) — all models now enforce fair execution

Improved

  • raft.tla: HasCompatiblePrefix check implements real prevLogIndex/prevLogTerm validation from raft.nim:190-197
  • raft.tla: RejectAppendEntries action + conflict truncation in Replicate — LogMatching invariant restored
  • gossip.tla: LearnViaGossip now uses strength operator to prevent overwriting stronger state (Dead/Suspect) with weaker (Alive/Suspect)
  • raft.tla: AppendEntry guard ensures term continuity — prevents gaps in leader log terms

Infrastructure

  • CI: Replaced container: eclipse-temurin with actions/setup-java@v4 + actions/cache@v4 + continue-on-error: true

Model Checker Configs (v1.1.0)

Spec Model Bounds States Checked Properties
raft 3 nodes, MaxTerm=3, MaxLogLen=3 3,031,684 6 invariants + fair execution
twopc 3 participants, MaxTxnId=3 22,855,681 7 invariants + fair execution
mvcc 2 keys, 2 values, MaxTxnId=2 177,721 7 invariants + 1 liveness
replication 3 replicas, MaxLsn=3, MaxSyncCount=2 3,687,939 4 invariants + 1 temporal
gossip 3 nodes, MaxIncarnation=3 692,497 4 invariants + fair execution
deadlock 5 txns, MaxEdges=8 3,767,361 2 invariants
sharding 3 shards, 2 nodes, 5 vnodes 186,305 3 invariants

[1.0.0] — 2026-05-07

Added

  • raft.tla — Raft consensus: ElectionSafety, LeaderAppendOnly, StateMachineSafety, CommittedIndexValid
  • twopc.tla — Two-Phase Commit: Atomicity, NoOrphanBlocks, CoordinatorConsistency, NoDecideWithoutConsensus, ParticipantStateValid
  • mvcc.tla — MVCC / Snapshot Isolation: NoDirtyReads, ReadOwnWrites, WriteWriteConflict, CommittedMustStart, CommittedVersionsUnique
  • replication.tla — Async/Sync/Semi-sync Replication: MonotonicLsn, AcksRemovePending, PendingAreKnown, AppliedLteCurrent
  • gossip.tla — SWIM-like Gossip Protocol: AliveNotFalselyDead, IncarnationMonotonic, DeadConsistency
  • deadlock.tla — Deadlock Detection: GraphIntegrity, NoSelfLoops
  • sharding.tla — Consistent Hashing Sharding: VirtualNodeMapping, NodeAssignmentConsistency, VnodeOrdering

Improved

  • raft.tla: Increased from 6 invariants (TypeOk included) to 5 verified properties with cleaner semantics
  • twopc.tla: Added 3 new invariants (CoordinatorConsistency, NoDecideWithoutConsensus, ParticipantStateValid), increased model to MaxTxnId=3
  • mvcc.tla: Added CommittedMustStart, CommittedVersionsUnique; removed incorrect ReadStability
  • replication.tla: Added AppliedLteCurrent, SemiSyncQuorum; simplified SyncDurability for model checking

Infrastructure

  • Added VERSION file (v1.0.0)
  • Added CHANGELOG.md
  • Added run_all.sh script for batch TLC verification
  • Added CI job (verify) for automated TLA+ model checking in GitHub Actions

Model Checker Configs

Spec Model Bounds States Checked Properties
raft 3 nodes, MaxTerm=3, MaxLogLen=3 475,972 4
twopc 3 participants, MaxTxnId=3 2,125,825 5
mvcc 2 keys, 2 values, MaxTxnId=2 177,849 5
replication 3 replicas, MaxLsn=3, MaxSyncCount=2 3,687,939 4 + 1 temporal
gossip 3 nodes, MaxIncarnation=3 1,257,121 3
deadlock 5 txns, MaxEdges=8 3,767,361 2
sharding 3 shards, 2 nodes, 5 vnodes 186,305 3
Reference in New Issue View Git Blame Copy Permalink