← All papers
First page of Program Analysis with Prophecy and History Variables in the Nexis Compiler

Program Analysis with Prophecy and History Variables in the Nexis Compiler

Martin Rinard

cs.PL Jul 25, 2026 · v1
Lean 4 formalizes prophecy/history-variable analyses and machine-checks correctness and optimality proofs for PDCE and LCM within a verified compiler to ARM64.
We present prophecy variables for forward formulations of program analysis problems that require information about the future execution of the program. We specify prophecy and history variables via a domain specific language that augments the step rules of the base operational semantics with subset inclusion constraints over the prophecy and history variables. This tight coupling between the prophecy and history variable specification and the operational semantics promotes the construction of correctness and optimality proofs for program transformations, with the proofs structured as forward simulations between the original and transformed versions of the program. In comparison with traditional dataflow approaches, this approach eliminates mechanisms such as explicit control flow graphs, abstraction functions, concretization functions, Galois connections, and separate backward and forward analyses. We present a verified implementation of prophecy and history variables and use the implementation to prove correctness and optimality properties of two classic transformations, partial dead code elimination and lazy code motion, that use both prophecy and history variables. To the best of our knowledge, these proofs are the first machine checked correctness and optimality proofs for these transformations.

Program analyses that need information about future execution are usually specified as backward dataflow analyses over control flow graphs. This forces abstraction functions, Galois connections, and separate forward and backward analyses, which complicate machine-checked proofs about program transformations.

Analyses are specified directly over the operational semantics by augmenting states with prophecy and history ghost variables. A DSL adds subset-inclusion constraints to the step rules. Specifications are processed into generated Lean 4 files, and transformation correctness is proved via forward simulations. All code and proofs were generated by a coding agent (Claude Code) supervised by the author, within a verified Lean compiler from a source language to ARM64.

The authors report the first machine-checked correctness and optimality proofs for partial dead code elimination and lazy code motion. The proofs are carried out in a compiler that is fully verified in Lean except for the parser, assembly printer, and spec-to-Lean translation.