3.1 Axioms in S4

Mint is a system that captures dependently typed variants of four different modal systems: K, T, K4, and S4. These systems are distinguished by the logical axioms that they admit. In Mint, we can implement the following modal axioms generically:

• K: $\square (A \to B) \to \square A \to \square B$

• T: $\square A \to A$

• 4: $\square A \to \square \square A$

In these axioms, A and B refer to any propositions and hence are generic. Recall that in all four subsystems of S4, Axiom K is mandatory. The system that only admits K is System K. If Axiom T is added to System K, then we obtain System T. If we further add Axiom 4 to System T, then we have S4. System K4 only admits Axioms K and 4, but not T. To actually write down these axioms in Mint, intuitively we would like to give T, for example, the following type in Mint:

Here we use Ty to denote universes to avoid clashing with Agda’s terminology. Unfortunately, this type does not type-check, because A is in the current world, but requires the type A to be meaningful in the next world. The correct implementation of T states that A is a type that is universally accessible by giving it the kind . This ensures that A remains accessible. When we want to use A in the definition of , we now need to first it with a proper level.

It might appear counter-intuitive at first glance, why we distinguish between a type of kind Ty and a type of kind Ty. This distinction is necessary, as Mint does not support cross-stage persistence (Taha & Sheard, Reference Taha and Sheard1997), i.e., the axiom R: $A \to \square A$ or more specifically $\texttt{Ty} \to \square \texttt{Ty}$ . In particular, there is no way to implement a function that would lift any type of kind $\texttt{Ty}$ such that it would have kind $\square \texttt{Ty}$ . As a consequence, to ensure that all our types, in particular types such as $\square A,$ are well kinded, we need to ensure that A is globally meaningful. A similar design decision has been taken by Jang et al. (Reference Jang, Gélineau, Monnier and Pientka2022) in their work on developing a polymorphic modal type system that supports the generation of polymorphic code.

We are now in a position to also implement the other two axioms similarly:

3.2 Lifting of natural numbers

As previously discussed, Mint does not support cross-stage persistence and the axiom $A \to \square A$ is not admissible for all A. Nevertheless, there are types where we can explicitly lift an element of type A to $\square A$ . The type for natural numbers is one such example. In Mint, we need to implement such lifting functions when required to ensure cross-stage persistence. Since Mint supports inductive types just as MLTT does, we define natural numbers, Nat, in the usual way, with zero and succ as the constructors. Then, we define its lift function, which shows that natural numbers do admit Axiom $A \to \square A$ :

Note that this function is implemented by recursion on the input number. If the input is just zero, then the solution is easy: it is just . We can refer to zero inside of a , which requires a term in the next world, because Nat is a closed definition, which can be automatically lifted to any other world. In the succ case, we first provide a as required by the output type obligation. Then, we must perform a recursion somehow. Luckily, brings us back to the current world, which allows us access to n, which is precisely needed for a structural recursion.

Just as pure MLTT, Mint can be used to prove properties about a definition. For example, we can show that is an inverse of lift:

In the base case, the left-hand side evaluates to , which is just equivalent to zero. Therefore, reflexivity (refl) suffices to prove this goal. In the step case, we need to prove

The left-hand side is reduced to based on the equivalence rules that we describe in the next section. Note the recursive call . Therefore, we can conclude the goal by the recursive call modulo an extra congruence of succ.

3.3 Generating N-ary sum

According to Davies & Pfenning (Reference Davies and Pfenning2001), the modal logic S4 corresponds to staged computation under Curry–Howard correspondence, where $\square A$ denotes the type of a computation of type A, the result of which is only available in some future stages of computation. Effectively, $\square$ segments different computational stages, so that variables in past stages cannot be directly referred to in the current stage. The $\square$ modality provides a logical foundation for multi-staged programming systems like MetaML (Taha & Sheard, Reference Taha and Sheard1997; Taha, Reference Taha2000). By integrating $\square$ into MLTT, we can use Mint as a program logic to model dependently typed staged computations and use Mint’s equational theory to prove that the programs satisfy certain specifications. In this section, we show how the S4 variant of Mint can model staged programming and in the next, we prove that this program is correctly implemented. Proving the correctness of a staged or meta-program in MetaML or a similar system has not been previously considered, but with Mint, this capability comes very naturally. For more practicality, we postulate that certain extraction mechanisms can be employed here to extract the code to a mature staged programming system such as MetaML (Taha & Sheard, Reference Taha and Sheard1997) with proper type-level magic to erase the dependent types as commonly practiced in Coq and Agda.

Our task here is to model a meta-program that generates code for an n-ary sum function that sums up n numbers. If n is zero, then we return zero; if it is one, then we return the identity function; if it is two, then we return the function that sums up two arguments, i.e., . Writing such an n-ary sum function in a type-safe manner can be achieved by exploiting large elimination in MLTT.

We first define a type-level function nary n, which computes the type of an n-ary function:

We then define the type of nary-sum as taking in a natural number n : Nat and intuitively returning code of type nary n. This, however, does not quite work, as (nary n) is ill-typed. Note that n is defined in the current world, but we need to use it inside (i.e. in the next world). We hence need to first lift the n : Nat to Nat using the previously defined lift function to then be able to splice it in. The need to lift values such as natural numbers to have access to both their values and their code representations is a common theme when writing staged programs. In a dependently typed setting, we need to use such lifting functions also on the type level to support a form of cross-stage persistence of values. We hence arrive at the type for the nary-sum function. Its implementation follows, in fact, directly from our intention.

Note that in the base case of zero, the return type is Nat; in the case of succ zero, we return the boxed identity function; in the case of succ (succ n), nary-sum (succ (succ n)) returns a term of type . The recursive call nary-sum (succ n) has type . Further, we have

To compute the final result of nary-sum (succ (succ n)), we first unbox the code generated by nary-sum (succ n), which has type , and apply it to the sum of the first two arguments. For convenience, we use numeric literals 0, 1, etc. for natural numbers zero, succ zero, etc. interchangeably. To illustrate, let us normalize nary-sum 3:

The last equation shows in Mint that nary-sum 3 and the code of x y z -> (x + y) + z are definitionally equal due to the congruence of :

Mint admits the congruence of and as a result, reductions occur freely even inside of a as in MetaML (Taha, Reference Taha2000). The congruence of is essential to model MetaML and particularly helpful when using Mint as a program logic, for the same reason as having the congruence of . Moreover, the congruence of allows a significantly simpler semantic model leading to a straightforward normalization proof.

3.4 Soundness of N-ary sum

Previously, we have shown a specific proof for the ternary sum. Mint can take one step further: we can prove general properties about nary-sum. In particular, we can prove that given a list xs of natural numbers, which has length n, adding up all numbers in xs returns the same result as using the code generated by nary-sum n to add them up. To make this theorem precise, we first define the function sum, which sums up all the numbers in a list xs of length n, and the function ap-list, which applies a function f : nary n to all the numbers in xs:

where omitted-eq has type when eq has type . We omit it to avoid being distracted by equational reasoning. The slightly unorthodox definition of sum is defined by recursion on n just as ap-list, so that auxiliary lemmas such as the associativity of addition are avoided in our subsequent soundness theorem. Proving it equal to the standard definition is an easy exercise in pure MLTT, which we omit here. We now can state and prove our target theorem:

nary-sum-sound takes two equality proofs to simplify the formulation of this lemma. When using nary-sum-sound, eq’ can be derived from eq and unbox-lift defined above. The first two base cases are easy. In the last case, a recursive call suffices. We reason as follows. The expected return type is

By simplifying the left-hand side, we obtain

On the other hand, the recursive call gives us:

By again simplifying the left-hand side, we conclude

Therefore by definitional equality, nary-sum-sound is a valid proof.

4.1 Syntax and judgments of Mint

Mint has the following syntax:

Mint extends MLTT with context stacks and the $\square$ modality. As discussed in Section 1, Mint models and reasons about the Kripke semantics (Kripke, Reference Kripke1963). In particular, we use context stacks to keep track of assumptions in all accessed worlds. Mint has natural numbers ( ${{{{{\texttt{Nat}}}}}}$ , $\texttt{zero}$ , $\texttt{succ }t$ ), $\Pi$ types, cumulative universes, written as $\texttt{Ty}_i$ , and explicit Kripke-style substitutions, which model the mapping between context stacks. Here, the cumulativity of universes means if a type is in the universe of level i, then it is also in the universe of level 1+i, not a stronger notion of cumulativity based on universe subtyping working even for function types and others. We also include a recursor on natural numbers $(\texttt{elim}\ M\ s\ s'\ t)$ . In this expression, t is the scrutinee describing a natural number, and s and s’ are referring to the two possible cases where t is $\texttt{zero}$ and the successor, respectively; M is the motive describing essentially the overall type skeleton of the recursor. As the overall type of the recursor depends on t, we model the motive M as a type with one free variable. Subsequently, we omit most discussions of natural numbers for brevity and refer the interested readers to our technical report and our mechanization. To construct and use a term of $\Pi$ type, we have $\lambda$ abstraction and function application as usual. We have discussed ${{{{{\texttt{box}}}}}}$ and ${{{{{\texttt{unbox}}}}}}$ , the constructor and eliminator of $\square$ types, in Section 3. When ${{{{{\texttt{unbox}}}}}}$ ’ing a term t, we must specify a number n, i.e., $\texttt{unbox}_{n}\ t$ , to describe the Kripke world we travel back to when type-checking t. By restricting n, Mint is specialized to one of the dependently typed generalizations of four different modal systems: K, T, K4, and S4. For example, if the modal offset must be 1, i.e., only $\texttt{unbox}_{1}\ t$ is possible, then we obtain the System K. By allowing the modal offset to be either 0 or 1, we obtain the System T. If the modal offset must be positive, we obtain the System K4. If there is no restriction at all, then we obtain the most general System S4. The Kripke style has the advantage of being specialized to different modal systems by controlling the modal offsets. This observation has been made by Pfenning &Wong (Reference Pfenning and Wong1995), Davies & Pfenning (Reference Davies and Pfenning2001), and Reference Hu and PientkaHu & Pientka (2022a ). At last, since Mint is formulated with explicit Kripke-style substitutions, the substitution closure $t[{\overrightarrow{\sigma}}]$ is defined as a form of syntax. We emphasize that the $t[{\overrightarrow{\sigma}}]$ has a very low binding precedence in our representation. For example, when we write $t~s[{\overrightarrow{\sigma}}]$ , we mean $(t~s)[{\overrightarrow{\sigma}}]$ . If we want ${\overrightarrow{\sigma}}$ to be applied to s only, we add explicit parentheses $t~(s[{\overrightarrow{\sigma}}])$ . Similarly, $\texttt{unbox}_{n}\ t [{\overrightarrow{\sigma}}]$ denotes $(\texttt{unbox}_{n}\ t)[{\overrightarrow{\sigma}}]$ .

Moreover, in this paper, we explicitly work with de Bruijn indices to stay close to our mechanization. The de Bruijn index of a variable is to be understood relative to the topmost context in a context stack, keeping in mind that ${{{{{\texttt{box}}}}}}$ and ${{{{{\texttt{unbox}}}}}}$ modify the context stack and change the topmost context. For example, given a context stack the term ) is well formed, but the first occurrence of refers to the function , while the second occurrence in refers to , as refers to a term in the prior world. Notationally, we consistently use upper cases for types and lower cases otherwise.

We turn the formulation of Kripke-style substitutions (or just K-substitutions) from our previous work at Mathematical Foundations of Programming Semantics (MFPS) (Reference Hu and PientkaHu & Pientka, 2022a ) between context stacks into explicit K-substitutions. K-substitutions are a generalization of the usual simultaneous substitutions. Instead of representing a mapping between two contexts in the typical case, a K-substitution is a mapping between two context stacks. In our explicit K-substitutions, the following syntax directly replicates the usual formulation of simultaneous substitutions: $\overrightarrow{I}$ is the identity K-substitutions between two context stacks; ${\overrightarrow{\sigma}}, t$ extends a K-substitution with a term; $\mathsf{wk}$ is local weakening supporting weakening of the topmost context of a context stack; and ${\overrightarrow{\sigma}} \circ {\overrightarrow{\delta}}$ composes ${\overrightarrow{\sigma}}$ with ${\overrightarrow{\delta}}$ . Furthermore, a K-substitution is no longer simply a list of terms. Modal extension ${\overrightarrow{\sigma}};\Uparrow^{n}$ is added and unique in Kripke-style modal type theories, and models modal weakening of context stacks. The modal offset n originates from the modal transformation operation (MoT) (Davies & Pfenning, Reference Davies and Pfenning2001) and is used to keep track of the number of contexts, which are added to the codomain context stack as in the following rule. A modal extension only introduces one empty context to the domain context stack:

Please refer to our previous work at MFPS (Reference Hu and PientkaHu & Pientka, 2022a ) for a complete motivation for modal extensions. ${\overrightarrow{\sigma}}$ provides a mapping from ${\overrightarrow{\Gamma}}$ to ${\overrightarrow{\Delta}}$ , while ${\overrightarrow{\sigma}};\Uparrow^{n}$ maps from ${\overrightarrow{\Gamma}}; {\overrightarrow{\Gamma}'}$ to ${\overrightarrow{\Delta}}; \cdot$ where the number of contexts in ${\overrightarrow{\Gamma}'}$ is n. This modal weakening is crucial to characterize the $\beta$ rule of $\square$ in a type-safe manner (see ). Hence, we incorporate modal weakening into our definition of K-substitution.

We give some selected typing rules in Figure 1. The full set of rules can be found in Appendix A. The definition of Mint consists of six judgments: denotes that the context stack ${\overrightarrow{\Gamma}}$ is well formed; denotes that ${\overrightarrow{\Gamma}}$ and ${\overrightarrow{\Delta}}$ are equivalent context stacks; denotes that term t has type T in context stack ${\overrightarrow{\Gamma}}$ ; denotes that terms t and s of type T are equivalent in context stack ${\overrightarrow{\Gamma}}$ ; denotes that ${\overrightarrow{\sigma}}$ is a K-substitution susbtituting terms in ${\overrightarrow{\Delta}}$ into ones in ${\overrightarrow{\Gamma}}$ ; and denotes that ${\overrightarrow{\sigma}}$ and ${\overrightarrow{\delta}}$ are equivalent in K-substituting terms in ${\overrightarrow{\Delta}}$ into ones in ${\overrightarrow{\Gamma}}$ . Due to explicit K-substitutions, there needs to be more judgments than usual. The equivalence between context stacks $\vdash {\overrightarrow{\Gamma}} \approx {\overrightarrow{\Delta}}$ is necessary, because we must specify a conversion rule for the equivalence between K-substitutions:

Fig. 1. Selected rules for Mint.

In turn, we need the equivalence between K-substitutions due to the following congruence rule for the K-substitution closure:

Without explicit (K-)substitutions, both $\vdash {\overrightarrow{\Gamma}} \approx {\overrightarrow{\Delta}}$ and are defined after the typing judgments, instead of mutually defined. This style of definitions follows Abel (Reference Abel2013) closely.

Following Harper & Pfenning (Reference Harper and Pfenning2005), we introduce in the rules in order to establish syntactic properties like context stack conversion and presupposition. Context stack conversion states that all syntactic judgments respect context stack equivalence $\vdash {\overrightarrow{\Gamma}} \approx {\overrightarrow{\Delta}}$ . Presupposition (or syntactic validity) includes for example facts such as if then $\vdash {\overrightarrow{\Gamma}}$ and for some i.

After proving these two properties, we remove the and call the resulting judgments the true and golden definition of Mint. These two definitions are equivalent:

4.2. Truncoid: Algebra of truncation and truncation offset

Mint fundamentally relies on two operations, and to handle its Kripke structure. Given and some $n < |{\overrightarrow{\Delta}}|$ , truncation of a K-substitution, written as ${\overrightarrow{\sigma}} \mid {n}$ , returns a prefix of ${\overrightarrow{\sigma}}$ with domain context stack ${\overrightarrow{\Delta}} \mid {n}$ where n modal extensions and accordingly n contexts from ${\overrightarrow{\Delta}}$ are dropped. The main question then is, what is the codomain context stack of this K-substitution? – Since we drop modal extensions including their modal offsets from ${\overrightarrow{\sigma}}$ , the codomain context stack ${\overrightarrow{\Gamma}}$ must also be adjusted. Recall that each modal offset in a modal extension accounts for a number of contexts in ${\overrightarrow{\Gamma}}$ . Hence, intuitively, we should drop k contexts from ${\overrightarrow{\Gamma}}$ where k is the sum of all dropped modal offsets.

For example, let ${\overrightarrow{\sigma}}$ be $({\overrightarrow{\delta}};\Uparrow^{1} , t;\Uparrow^{2} , s)$ where . Truncation ${\overrightarrow{\sigma}} \mid {2}$ then returns the prefix ${\overrightarrow{\delta}}$ after dropping everything up to two modal extensions $\Uparrow^1$ and $\Uparrow^2$ . This resulting K-substitution intuitively must have domain context stack ${\overrightarrow{\Delta}}$ and codomain context stack ${\overrightarrow{\Gamma}}$ , i.e., . How do we obtain ${\overrightarrow{\Gamma}}$ from ${\overrightarrow{\Gamma}}; \Gamma_0;\Gamma_1; \Gamma_2$ ? – The answer is by simply dropping the top 3 contexts where 3 is exactly the sum of the modal offsets in the dropped part of ${\overrightarrow{\sigma}}$ .

To compute the sum of modal offsets, we define the truncation offset $\mathcal{O}({{\overrightarrow{\sigma}}}, {n})$ below. In general, we have .

Our syntax of explicit K-substitutions is carefully designed such that truncation and truncation offset can be defined by recursion on the structure of the inputs:

These two operations satisfy the following two coherence conditions:

These two operations describe how K-substitutions interact with the Kripke structure of Mint so that the whole system remains coherent, e.g., in the following rule:

When applying a K-substitution ${\overrightarrow{\sigma}}$ to ${{{{{\texttt{unbox}}}}}}$ , the K-substitution is pushed recursively inside with a truncated K-substitution and the ${{{{{\texttt{unbox}}}}}}$ level adjusted by truncation offset.

Truncation and truncation offset turn out to be very general concepts and are central to modeling the Kripke structure in both syntax and semantics. In particular, truncation and truncation offset form an algebra, which we call a truncoid. The following gives a concrete and the most basic algebraic characterization of a truncoid:

Definition 4.1. A truncoid is a triple $(S, \_ \mid {\_}, \mathcal{O}({\_}, {\_}))$ , where

• • S is a set;

• • the truncation operation $\_ \mid {\_}$ takes an S and a natural number and returns an S;

• • the truncation offset operation $\mathcal{O}({\_}, {\_})$ takes an S and a natural number and returns a natural number.

where the coherence of addition holds:

\begin{equation*} s \mid { }{(n + m)} = (s \mid {n}) \mid {m} \, \mathrm{and} \, \mathcal{O}({s}, {n + m}) = \mathcal{O}({s}, {n}) + \mathcal{O}({s \mid {n}}, m) \end{equation*}

Following the common mathematical practice, we directly call S a truncoid if it has coherent truncation and truncation offset. We have already shown that K-substitutions are a truncoid. In Section 5 and later sections, we will describe other instances of truncoids on the semantic side. Essentially, the normalization proof is just a study of interactions among different truncoids. In fact, most truncoids we encounter in the normalization proof are more specific, so it is worth organizing a few important and special truncoids ahead of time. The first kind is applicative truncoids, which allows a truncoid to be applied to another:

Definition 4.2. An applicative truncoid consists of a triple of truncoids $(S_0, S_1, S_2)$ and an additional apply operation $\_[\_]$ which takes $S_0$ and $S_1$ and returns $S_2$ . Moreover, the apply operation satisfies an extra coherence condition:

\begin{align*} s[s'] \mid {n} = (s \mid {n})[s' \mid {\mathcal{O}({s}, {n})}] \mathrm{and} \mathcal{O}({s[s']}, {n}) = \mathcal{O}({s'}, {\mathcal{O}({s}, {n})}) \end{align*}

Most semantic models that we depend on in the normalization proof are also applicative. For example, evaluation environments in Section 5 are applicative. K-substitutions are also applicative, as we can just let the apply operation be composition. Following this intuition, we define a specialized applicative truncoid as a substitutional truncoid by asking the apply operation to behave like composition:

Definition 4.3. A substitutional truncoid S is an applicative truncoid (S, S, S) with an identity ${\mathsf{id}} \in S$ . Note that the apply operation is essentially composition, which we just write as $\_\circ\_$ . The extra coherence conditions are for identity:

\begin{align*} {\mathsf{id}} \mid {n} = {\mathsf{id}}, \mathcal{O}({{\mathsf{id}}}, {n}) = n, {\mathsf{id}} \circ s = s \mathrm{and} s \circ {\mathsf{id}} = s \end{align*}

and associativity:

\begin{align*} (s_0 \circ s_1) \circ s_2 = s_0 \circ (s_1 \circ s_2) \end{align*}

As expected, K-substitutions are a substitutional truncoid. We will see very soon that the UMoTs, which model the Kripke structure in the semantics, are also substitutional. There is another way to specialize applicative truncoid. Starting from an applicative truncoid, if we allow $S_1$ to be substitutional, then we obtain a closed truncoid:

We say that $S_0$ is closed under $S_1$ . The apply operation of a closed truncoid must return $S_0$ as required by the definition. In the semantics, the evaluation environments are closed under UMoTs. Note that K-substitutions are also closed under themselves. The laws of applicative and closed truncoids cover all the properties we need to reason about the normalization process. There are also non-closed applicative truncoids. The evaluation operation of K-substitutions to be shown in Section 5 is one such example.

5.1 Definition of untyped domain

The untyped domain has the following syntax. :

In the untyped domain, variables are represented by de Bruijn levels. Consider a topmost context $\Gamma.T.\Delta$ in some stack. If a variable $v_x$ is bound to type T, in the syntax, we use a de Bruijn index and $x = |\Delta|$ . Its corresponding de Bruijn level z, on the other hand, equals to $|\Gamma|$ . De Bruijn levels assign a unique absolute name to each variable in each context, so that we can avoid handling local weakening of variables in the semantics. Evidently, these two representations satisfy $z + x + 1 = |\Gamma.T.\Delta|$ . This equation will be used in the readback functions to correspond syntactic and semantic variables.

In this untyped domain, values are effectively partially $\beta$ -reduced values and classified into three categories: values (D), neutral values ( $D^\mathsf{Ne}$ ), and normal values ( $D^\mathsf{Nf}$ ). Same as before, we consistently use upper cases for semantic types and lower cases otherwise. In D, $\blacksquare$ models $\square$ semantically and $\mathsf{U}_i$ models a universe at level i. $\texttt{ze}$ models $\texttt{zero}$ and $\texttt{su}(a)$ models successors. A neutral value c is embedded into D when annotated with a type A. Following Abel (Reference Abel2013), we use defunctionalization (Reynolds, Reference Reynolds1998; Ager et al., Reference Ager, Biernacki, Danvy and Midtgaard2003) to capture open syntactic terms in the domain together with their surrounding evaluation environments, which enables formalization in Agda.

For example, a domain type $Pi(A, T, \overrightarrow{\rho})$ models a $\Pi$ type and consists of a domain type A as the input type and a syntactic type T as the output type together with its ambient environment $\overrightarrow{\rho,}$ which provides instantiations for all the free variables in T except the topmost one bound by $\Pi$ in the syntax. Similarly, a domain value $\Lambda(t, \overrightarrow{\rho})$ models a $\lambda$ term and describes a syntactic body t together with an environment $\overrightarrow{\rho,}$ which provides values for all the free variables in t except the topmost one bound by $\lambda$ in the syntax. For a neutral domain value for the recursor of natural numbers $\mathsf{rec}(M, a, t, c, \overrightarrow{\rho})$ , the neutral domain value c describes the scrutinee, which is intended to be a natural number, while a describes the domain value for the base case. Next, t is an open syntactic term because it describes the term for the step-case. Last, M describes the motive in the syntax with one free variable expressing the dependency on the natural number c. Due to defunctionalization, we thus capture $\overrightarrow{\rho}$ , the surrounding environment of M and t.

The NbE algorithm relies on local and global environments in the evaluation process. Local evaluation environments ( $\mathsf{Env}$ ) are functions mapping de Bruijn indices to domain values. Global evaluation environments ( $\mathsf{Envs}$ ), or just environments, are functions mapping modal offsets to tuples $\mathbb{N} \times \mathsf{Env}$ where the first projection is a modal offset, thereby allowing us to model different modal logics. An environment can be viewed as a stream of local environments paired with modal offsets. In the NbE algorithm, when evaluating a well-typed term, only a finite prefix of an environment is used, which is ensured by soundness.

We use for the empty local environment and for the global environment.

$\texttt{emp}$ and $\texttt{empty}$ are the empty local and global evaluation environments. Their definitions do not matter here because they only provide default values, which are guaranteed to be never used by soundness. Instead, we focus on how to extend local and global environments. First, we can modally extend an environment with a modal offset n:

We write ${{{{{\texttt{ext}}}}}}(\overrightarrow{\rho})$ for ${{{{{\texttt{ext}}}}}}(\overrightarrow{\rho}, 1)$ . ${{{{{\texttt{ext}}}}}}$ models modal extension of a K-substitution ( ${\overrightarrow{\sigma}};\Uparrow^{n}$ ), so n is not associated with any local environment, hence $\texttt{emp}$ .

We can locally extend an environment with a value by inserting it into the topmost local environment. ${{{{{\texttt{lext'}}}}}}$ conses a value to a local environment, and ${{{{{\texttt{lext}}}}}}$ just extends a value to its topmost local environment by calling ${{{{{\texttt{lext'}}}}}}$ :

The ${{{{{\texttt{drop}}}}}}$ operation drops the zeroth mapping from the topmost $\mathsf{Env}$ . It is needed for the interpretation of $\mathsf{wk}$ :

Last, environments form a truncoid, ^{Footnote 4} and we define truncation and truncation offset on $\overrightarrow{\rho}$ :

5.2 Untyped Modal Transformations

To model $\square$ , we must consider how to model the Kripke structure of Mint. In our untyped domain model, we employ the internal approach, where the Kripke structure is internalized by , ranged over by $\kappa$ . Formally, a UMoT is just an (Agda) function of type $\mathbb{N} \to \mathbb{N}$ , modeling a stream of modal offsets. Given a domain value $a \in D$ and a UMoT $\kappa$ , the UMoT application operation $a[\kappa]$ applies $\kappa$ to a and denotes sending a to another world according to $\kappa$ . The internalization further requires subsequent models to satisfy monotonicity w.r.t. UMoTs (see Sections 6.2.3 and 7.3.1), which is the root of other properties involving UMoTs. The internalization seems to provide certain modularity, and we conjecture that our proof can be adapted to other modalities in Kripke style by only adjusting the definition of UMoTs and the proof of monotonicity. In fact, UMoTs have sufficiently captured the Kripke structures of all Systems K, T, K4, and S4, so as a bonus, their normalization is established simultaneously.

Our approach is in contrast to the external approach by Gratzer et al. (Reference Gratzer, Sterling and Birkedal2019), where the model is parameterized by an extra layer of poset. Subsequent proofs thus must explicitly quantify over this poset, making their proof more difficult to adapt to other modalities (Gratzer et al., Reference Gratzer, Kavvos, Nuyts and Birkedal2020).

Before defining applications of UMoTs, we first define the following operations:

Cons of UMoTs is defined in a way similar to environments. UMoTs have composition, and we use $\overrightarrow{1}$ to represent the identity UMoT in our setting. As previously mentioned, UMoTs form a substitutional truncoid. A quick intuition is that UMoTs behave like substitutions in the semantics, except that it only brings values from one world to another without touching the variables. In the following, we give the for applying a UMoT to domain values and environments:

Following our previous convention, we let $a[\kappa]$ take a very low parsing precedence. Most cases just recursively push $\kappa$ inwards, except the $\blacksquare$ , ${{{{{\texttt{box}}}}}}$ and ${{{{{\texttt{unbox}}}}}}$ cases. The cases for $\blacksquare$ and ${{{{{\texttt{box}}}}}}$ are similar. $\kappa;\Uparrow^{1}$ instructs their recursions to enter a new world, indicated by cons’ing 1 to $\kappa$ . The ${{{{{\texttt{unbox}}}}}}$ case is similar to the rule in Section 4.2. The recursion is $c[\kappa \mid {n}]$ because c is in the n-th previous world. The ${{{{{\texttt{unbox}}}}}}$ level is adjusted to $\mathcal{O}({\kappa}, {n})$ for coherence with the Kripke structure. The apply operation for a local environment $\rho$ is just defined by applying $\kappa$ to all values within pointwise. The apply operation for $\overrightarrow{\rho}$ can be motivated by making the triple $(\mathsf{Envs}, \text{UMoT}, \mathsf{Envs})$ an applicative truncoid. Indeed, this is the unique definition (up to isomorphism) to prove $\overrightarrow{\rho}[\kappa] \mid {n} = (\overrightarrow{\rho} \mid {n})[\kappa \mid {\mathcal{O}({\overrightarrow{\rho}}, {n})}]$ . From here, we can see the formulation of truncoids does guide us very quickly to the right definition of operations. Moreover, since UMoTs are substitutional, we would hope that $\mathsf{Envs}$ is closed under UMoTs. Indeed, this fact can be examined by checking the necessary laws imposed by a closed truncoid.

5.3 Evaluation

Next we consider the , which, given $\overrightarrow{\rho}$ , evaluates a syntactic term to a domain value or evaluates a K-substitution to another environment. In the following sections, we will define a number of partial functions (denoted by $\rightharpoonup$ ), which cannot be directly formalized in Agda. Instead, we define them as relations between inputs and outputs, and we prove that given the same inputs, the outputs are equal. When we refer to a result of a partial function, we implicitly existentially quantify this result for brevity.

Note that here $(\mathsf{Substs}, \mathsf{Envs}, \mathsf{Envs})$ forms an applicative truncoid when the evaluation terminates. In the evaluation of $\mathsf{Trm}$ , we make use of partial functions, which evaluate ${{{{{\texttt{box}}}}}}$ and $\Lambda$ . These partial functions are defined below:

Effectively, these partial functions remove all $\beta$ redexes.

5.4 Readback functions

After evaluating a $\mathsf{Trm}$ to D, we have already got the corresponding $\beta$ normal form in D. We need one last step, readback functions, to read from D back to normal form and do the $\eta$ expansion at the same time to obtain a $\beta\eta$ normal form:

A readback function takes as an argument $\overrightarrow{z} :: \overrightarrow{\mathbb{N}}$ , which is a nonempty list of natural numbers. Each number in this list records the length of the context in that position of the context stack. This list supplies new de Bruijn levels (i.e. new absolute and fresh names) as the readback process continues. In the $\blacksquare$ case, since we enter a new world, 0 is pushed to the list because the new world has no assumption. In the Pi case, the topmost context is extended by one due to the argument of $\lambda$ , so we also increment the topmost de Bruijn level by one. In the ${{{{{\texttt{unbox}}}}}}$ case, we must truncate $\overrightarrow{z}$ in order to correctly keep track of the lengths of contexts in the stack because the context stack is also truncated. In the variable case in $\mathsf{R}^{\mathsf{Ne}}$ , we use the aforementioned formula $z' - z - 1$ to compute the corresponding de Bruijn index in the syntax. If we begin with a well-typed term, then this formula is always non-negative, so we do not have to consider the case where we are cut off at 0.

The readback process consists of three functions: $\mathsf{R}^{\mathsf{Nf}}$ reads back a normal form; $\mathsf{R}^{\mathsf{Ne}}$ reads back a neutral form; and $\mathsf{R}^{\mathsf{Ty}}$ reads back a normal type. Note that $\mathsf{R}^{\mathsf{Nf}}$ is type-directed, so $\eta$ expansion is performed. With evaluation and readback, we are ready to give the definition of the NbE algorithm by first evaluating a term and its type to the domain and then read back as a normal form:

Definition 5.1. For , the NbE algorithm is

where the initial environment $\uparrow^{{\overrightarrow{\Gamma}}}$ is defined by the structure of ${\overrightarrow{\Gamma}}$ :

We have an elaborated example for running the NbE algorithm in Appendix B.

6.1 PER model

We follow Abel (Reference Abel2013) and first introduce the following relations.

where $Nf \subseteq D^{\mathsf{Nf}} \times D^{\mathsf{Nf}}$ , $Ty \subseteq D \times D$ and $Ne \subseteq D^{\mathsf{Ne}} \times D^{\mathsf{Ne}}$ . Nf relates two normal domain values iff their readbacks are equal given any context stack and UMoT. Ty and Ne are defined similarly. We will show by realizability (Section 6.2.5) that all forthcoming PERs are subsumed by Nf, so any two related values have equal readbacks as normal forms, through which completeness is established. These relations are part of dependently typed candidate space introduced by Abel (Reference Abel2013). Since these relations are defined by equality, they are indeed PERs.

The premises of these PERs are all universally quantified over UMoTs. This universal quantification is and continues to be crucial in our PERs. Due to the substitutional truncoid structure of UMoTs, particularly composition, universally quantifying UMoTs allows us to internalize the Kripke structure and delegate the handling of the said structure to UMoTs, so that the proof structure is completely oblivious to the exact structure $\square$ possesses, making our constructions very adaptive as explained in Section 5.2.

Now we move on to define the actual PERs that relate domain values. The PER model consists of two PERs: $\mathcal{U}_i$ which denotes a universe and relates two domain types at level i, and $\textbf{El}_i({{{{{\mathcal{D}}}}}})$ which given ${{{{{\mathcal{D}}}}}} :: A \approx B \in \mathcal{U}_i$ relates two domain values of domain types A and B. The PER model resembles Tarski-style universes (Palmgren, Reference Palmgren1998), in which universes contain “codes” and $\textbf{El}$ converts these codes into actual types which contain values. Following Abel (Reference Abel2013) and Abel et al. (Reference Abel, Vezzosi and Winterhalter2017), $\mathcal{U}_i$ and $\textbf{El}_i$ are defined inductive-recursively (Dybjer, Reference Dybjer2000). Moreover, due to cumulative universes, they must in addition be defined with the well-foundedness of the universe levels. We refer interested readers to our Agda code for our actual formalization of these two relations.

Definition 6.1. The equivalence for domain types and the equivalence for domain values are defined as follows:

• • Neutral types and neutral values:

Then $a \approx b \in \textbf{El}_i({{{{{\mathcal{D}}}}}})$ iff $a \approx b \in Neu$ , where Neu relates two values only when they are actually neutral:

Note that the annotating domain types $A_1$ and $A_2$ do not matter as long as c and c’ are related by Ne.

• • Universes:

Then $a \approx b \in \textbf{El}_i({{{{{\mathcal{D}}}}}})$ iff $a \approx b \in \mathcal{U}_j$ . Note that here $\textbf{El}_i({{{{{\mathcal{D}}}}}})$ is defined in terms of $\mathcal{U}_j$ . This is fine because of $j < i$ and the well-foundedness of universe levels.

• • Semantic $\blacksquare$ types:

Then $a \approx b \in \textbf{El}_i({{{{{\mathcal{D}}}}}})$ iff for any UMoT $\kappa$ and ${{{{{\texttt{unbox}}}}}}$ level n, the ${{{{{\texttt{unbox}}}}}}$ ing’s of $a[\kappa]$ and $b[\kappa]$ remain related: ${{{{{\texttt{unbox}}}}}} \cdot (n, a[\kappa]) \approx {{{{{\texttt{unbox}}}}}} \cdot (n, b[\kappa]) \in \textbf{El}_i({{{{{\mathcal{J}}}}}}(\kappa;\Uparrow^{n}))$ . In other words, if a and b are still related no matter how they travel in Kripke worlds and then are ${{{{{\texttt{unbox}}}}}}$ ’ed, then they are related by $\textbf{El}_i({{{{{\mathcal{D}}}}}})$ .

• • Semantic Pi types:

Then $a \approx b \in \textbf{El}_i({{{{{\mathcal{D}}}}}})$ iff for any UMoT $\kappa$ and related a’ and b’, i.e., ${{{{{\mathcal{E}}}}}} :: a' \approx b' \in \textbf{El}_i({{{{{\mathcal{J}}}}}}_1(\kappa))$ , the results of applying $a[\kappa]$ and $b[\kappa]$ remain related: $a[\kappa] \cdot a' \approx b[\kappa] \cdot b' \in \textbf{El}_i({{{{{\mathcal{J}}}}}}_2(\kappa, {{{{{\mathcal{E}}}}}}))$ . That is, a and b are related if all results of applying them in other worlds to related values are still related.

6.2 Properties for PERs

During mechanization, we are forced to make everything precise and type theory friendly and observe certain gaps between a set-theoretic proof and a type-theoretic one. In this section, we discuss how properties of our PERs are formulated and proved in a type-theoretic flavor. Our mechanization also exposes some oversimplifications about universes that are common in on-paper, set theoretic NbE proofs (Abel, Reference Abel2013; Abel et al., Reference Abel, Vezzosi and Winterhalter2017; Gratzer et al., Reference Gratzer, Sterling and Birkedal2019) in Section 6.2.4.

6.3 PER model for context stacks and environments

To define semantic judgments that are used to state fundamental theorems, we extend the PER model to context stacks and environments.

We can extend properties in Section 6.2 to context stacks and environments as well, e.g., .

6.4 Semantic judgments, fundamental theorems, and completeness

Having defined all PER models, we are ready to define the semantic judgments:

Definition 6.3. We define as follows:

where iff

• • ${\overrightarrow{\Gamma}}$ is semantically well formed: ${{{{{\mathcal{D}}}}}} ::\ \vDash {\overrightarrow{\Gamma}}$ , and

• • there exists a universe level i, such that for any related $\overrightarrow{\rho}$ and $\overrightarrow{\rho}'$ , i.e., ,

  • - evaluations of T are related types: and

  • - evaluations of t and t’ are related values: ;

and iff

• • ${\overrightarrow{\Gamma}}$ and ${\overrightarrow{\Delta}}$ are semantically well formed: ${{{{{\mathcal{D}}}}}} ::\ \vDash {\overrightarrow{\Gamma}}$ and ${{{{{\mathcal{E}}}}}} ::\ \vDash {\overrightarrow{\Delta}}$ , and

• • for any related $\overrightarrow{\rho}$ and $\overrightarrow{\rho}'$ , i.e., , ${\overrightarrow{\sigma}}$ and ${\overrightarrow{\sigma}'}$ evaluate to related environments: .

The fundamental theorem states that the semantic judgments are sound w.r.t. the syntactic judgments:

Theorem 6.7 (Fundamental).

The completeness theorem states that syntactic equivalent terms evaluate to equal normal forms:

6.5 Consequences of completeness

From the fundamental theorems of the PER model, we can derive a few consequences, which are useful but very challenging to prove syntactically:

Due to the previous lemma, we can prove the following “exact inversion” lemma:

If we proceed by induction on the premise, the universe levels in the conclusion cannot be made exactly i. However, this is now possible with the fundamental theorems.

7.1 Restricted weakening

Restricted weakenings are a special class of K-substitutions, which characterize the possible changes in context stacks during evaluation. Therefore, if a term and a value are related, their relation must be stable under restricted weakenings, hence introducing a Kripke structure to the gluing model.

Definition 7.1. A K-substitution ${\overrightarrow{\sigma}}$ is a if it inductively satisfies

Effectively, a restricted weakening can only do either local weakenings ( $\mathsf{wk}$ ) or modal extensions ( $\_;\Uparrow^{n}$ ), because only these two cases are possible during evaluation. Since restricted weakenings form a category, we require the gluing model to respect them.

7.2 Gluing model

Restricted weakenings are already K-substitutions, so they naturally apply to syntactic terms. However, to define the gluing model, we must also apply them to domain values. This is achieved by ,^{Footnote 5} which extracts a UMoT from a K-substitution (not just a restricted weakening).

Moreover, for conciseness, given a K-substitution ${\overrightarrow{\sigma}}$ and a domain value a, we write $a[{\overrightarrow{\sigma}}]$ for $a[\texttt{mt}({\overrightarrow{\sigma}})]$ unless the distinction is worth emphasizing. Next, we define the gluing model that relates syntactic and domain terms and types. For a PER P, we write $p \in P$ for $p \approx p \in P$ :

and are defined mutually by first well-founded recursion on i and then recursion on ${{{{{\mathcal{D}}}}}}$ :

• •

  

  iff

  • - T is a type at level i: .

  • - For any restricted weakening ${\overrightarrow{\sigma}}$ , that is , s.t.

    

    iff

    • - $c \in Ne$ .

    • - T is a type at level i: .

    • - t is well typed: .

    • - For any restricted weakening ${\overrightarrow{\sigma}}$ , that is , s.t.

      
      and
      

  • •

    

    iff .

    iff

    • - t is well typed: .

    • - T is equivalent to $\texttt{Ty}_j$ : .

    • - a is in PER $\mathcal{U}_j$ : ${{{{{\mathcal{E}}}}}} :: a \in \mathcal{U}_j$ .

    • - t and a are recursively related as types by well-foundedness: .

    Note that refers to , so the definition requires a well-founded recursion on i.

  • •

    

    iff there exists some T’, such that

    • - T is equivalent to .

    • - For any ${\overrightarrow{\Delta}'}$ such that $\vdash {\overrightarrow{\Delta}}; {\overrightarrow{\Delta}'}$ and any restricted weakening and ${{{{{\mathcal{E}}}}}}({\overrightarrow{\sigma}};\Uparrow^{|{\overrightarrow{\Delta}'}|})$ are recursively related as types:

      

    iff there exists some T’, such that

    • - t is well typed: .

    • - a is in $\textbf{El}_i({{{{{\mathcal{D}}}}}})$ : $a \in \textbf{El}_i({{{{{\mathcal{D}}}}}})$ .

    • - T is equivalent to $\square T'$ : .

    • - For any ${\overrightarrow{\Delta}'}$ such that $\vdash {\overrightarrow{\Delta}}; {\overrightarrow{\Delta}'}$ and any restricted weakening , the results of eliminating $t[{\overrightarrow{\sigma}}]$ and $a[{\overrightarrow{\sigma}}]$ are recursively related as terms:

      

  • •

    

    iff there exist $T_1$ and $T_2$ , such that

    • - T and $\Pi T_1. T_2$ are equivalent:

    • - $T_2$ is well typed: .

    • - For any restricted weakening ,

      • * $T_1[{\overrightarrow{\sigma}}]$ and ${{{{{\mathcal{E}}}}}}_1({\overrightarrow{\sigma}})$ are recursively related: , and

      • * For any related s and b, i.e. , and ${{{{{\mathcal{E}}}}}}_3 :: b \in \textbf{El}_i({{{{{\mathcal{E}}}}}}_1({\overrightarrow{\sigma}}))$ , $T_2[{\overrightarrow{\sigma}}, s]$ and ${{{{{\mathcal{E}}}}}}_2({\overrightarrow{\sigma}},{{{{{\mathcal{E}}}}}}_3)$ are recursively related as types:

        

    Note that here we require ${{{{{\mathcal{E}}}}}}_3 :: b \in \textbf{El}_i({{{{{\mathcal{E}}}}}}_1({\overrightarrow{\sigma}}))$ as an assumption, which technically from . However, this fact requires a proof and thus cannot be used at the time of definition. Adding this assumption simplifies our definition.

    iff there exist $T_1$ and $T_2$ , such that

    • - t is well typed: .

    • - a is in the PER $\textbf{El}_i({{{{{\mathcal{D}}}}}})$ : $ a \in \textbf{El}_i({{{{{\mathcal{D}}}}}})$ .

    • - T and $\Pi T_1. T_2$ are equivalent: .

    • - $T_2$ is well typed: .

    • - For any restricted weakening ,

      • * $T_1[{\overrightarrow{\sigma}}]$ and ${{{{{\mathcal{E}}}}}}_1({\overrightarrow{\sigma}})$ are recursively related: , and

      • * For any related s and b, i.e., , and ${{{{{\mathcal{E}}}}}}_3 :: b \in \textbf{El}_i({{{{{\mathcal{E}}}}}}_1({\overrightarrow{\sigma}}))$ , the results of eliminating $t[{\overrightarrow{\sigma}}]$ and $a[{\overrightarrow{\sigma}}]$ are recursively related as terms:

        

7.3 Properties of gluing model

In this section, we discuss some properties of the gluing model. For conciseness, we focus on monotonicity, realizability, and cumulativity.

7.3.2 Realizability

In completeness, realizability morally states that $\textbf{El}$ is subsumed by Nf. In soundness, realizability has a similar structure. We first need to give three definitions, which serve a purpose similar to Ty, Ne, and Nf in completeness:

Definition 7.3. Given ${{{{{\mathcal{D}}}}}} :: A \approx B \in \mathcal{U}_i$ ,

The first judgment states that T is equivalent to the readback of A (or equally the readback of B) under all valid restricted weakenings. Similarly, the third judgment states that t is equivalent to the readback of a under all valid restricted weakenings. The realizability theorem states that the gluing models of types and terms are subsumed by these two judgments, respectively, which constitutes our second step to the soundness proof. Then, we state the realizability for the gluing model:

Theorem 7.2 (Realizability). Given ${{{{{\mathcal{D}}}}}} :: A \approx B \in \mathcal{U}_i$ ,

• • if

• • if

• • if

7.4 Gluing model for K-substitutions and environments

In this section, we generalize the gluing model to K-substitutions and evaluation environments. Our gluing model is in fact more complex than existing proofs on paper (Abel, Reference Abel2013; Abel et al., Reference Abel, Vezzosi and Winterhalter2017; Gratzer et al., Reference Gratzer, Sterling and Birkedal2019), in that our gluing model is again defined through induction–recursion, while existing proofs directly proceed by recursion on the structure of the domain contexts (or context stacks in our case). This existing proof technique will not work in mechanization, because this technique heavily relies on cumulativity to bring the gluing model for terms and values to a limit, so the generalization to K-substitutions and environments does not care about universe levels. Evidently, in Agda, we cannot really take limits, so we must always keep track of universe levels. In our definition, we have an inductive definition $\Vdash {\overrightarrow{\Gamma}}$ of semantic well formedness of context stacks, in which universe levels are maintained. We speculate that this extra inductive predicate allows an easy adaptation to non-cumulative settings, an NbE proof of which remains unseen to date.

We can then prove like monotonicity, which we omit here in favor of space. We refer the readers to our Agda development. We then give the definitions for semantic judgments.

Definition 7.5. Semantic judgments for soundness are defined as follows:

7.5 Fundamental theorems and soundness

Finally, we are ready to establish the fundamental theorems and soundness:

7.6 Consequences

The fundamental theorems for the gluing model allow us to establish a few more consequences, which are difficult to prove syntactically. We show that the standard injectivity and canonicity hold in Mint.

The following lemma about universe levels is also interesting. It says that if two types are equivalent and they are well typed at a different level, then they are equivalent also at that level. This lemma is intuitive but very challenging to prove syntactically.

As the final and conclusive theorem, we show that Mint is consistent.

Theorem 7.9 (Consistency). There is no closed term of type $\Pi \texttt{Ty}_i . v_0$ . That is, there is no t such that the following judgment holds:

In Agda’s syntax, the type is written as (A : Set_i) -> A and consistency requires that this type does not have a closed inhabitant. In other words, there is no generic way to construct a term for an arbitrary type. If Mint has a bottom type, then the consistency proof is immediately reduced to the consistency of our meta-language (i.e. Agda) and hence significantly simplifies the proof. For the current definition of Mint, we can still prove this theorem with a bit more technical setup.

Proof Note that consistency is equivalent to proving that there is no t’ such that

Note that, by soundness, t’ must be equivalent to some neutral term u by NbE, because its type ( $v_0$ ) is neutral. So our goal is to show that this u also does not exist:

Now we do induction on u. We show that in $\varepsilon;\texttt{Ty}_i$ , there does not exist a neutral term of any type other than $\texttt{Ty}_j$ (i and j are not necessarily equal due to cumulativity), and thus it is impossible for u to have type $v_0$ . Otherwise, that would require $\texttt{Ty}_i$ and $v_0$ to be equivalent, which can be rejected by completeness as they do not evaluate to the same normal form.

9.1 Applications of modalities in multi-staged programming

As previously mentioned, the modal system S4 corresponds to multi-staged programming under Curry–Howard correspondence (Davies & Pfenning, Reference Davies and Pfenning2001) and Mint provides a dependently typed variant of S4. There are other applications of dependent typed systems to multi-staged programming. Kawata & Igarashi (Reference Kawata and Igarashi2019) study $\lambda^{\text{MD}}$ , a logical framework with stages. $\lambda^{\text{MD}}$ uses stage variables to keep track of stages, while Mint uses context stacks and ${{{{{\texttt{unbox}}}}}}$ levels for the same purpose. Pasalic et al. (Reference Pasalic, Taha and Sheard2002) propose Meta-D to remove administrative redexes introduced in a staged interpreter. Brady & Hammond (Reference Brady and Hammond2006) improve Pasalic et al. (Reference Pasalic, Taha and Sheard2002) by also extending MLTT with stages. Fundamentally, the type theory in Brady & Hammond (Reference Brady and Hammond2006) is the dependently typed system T with cross-stage persistence. Extending the T variant of Mint with cross-stage persistence would constitute Brady&Hammond (Reference Brady and Hammond2006)’ system Though the authors claim that their type theory is strongly normalizing, they do not provide any proof, whereas Mint’s normalization proof naturally adapts to all subsystems of S4, including T.

9.2 Modal type theories

One of the first “propositions-as-types”-interpretations of modal logics was given by Borghuis (Reference Borghuis1994) in his PhD thesis, which studies the modal natural deduction with the modality S4 and modal pure type system. His work, similar to Pfenning & Wong (Reference Pfenning and Wong1995) and Davies & Pfenning (Reference Davies and Pfenning2001), also introduces a context stack structure (called generalized contexts). However, in contrast to Davies & Pfenning (Reference Davies and Pfenning2001) where the elimination rule ( ${{{{{\texttt{unbox}}}}}}_n$ ) integrates both modal and local weakening, Borghuis’ elimination rule has explicit rules for both local weakening and modal weakening. As a consequence, weakening is not a property of the overall system in Borghuis’ work. Further, Borghuis studies strong normalization via a translation of the modal pure type system to a pure type system. In contrast, we give a direct normalization proof that yields an algorithm for normalizing objects in Mint.

Most closely related to our work is the line of research by Clouston (Reference Clouston2018), Gratzer et al. (Reference Gratzer, Sterling and Birkedal2019), Reference Birkedal, Clouston, Mannaa, Møgelberg, Pitts and SpittersBirkedal et al. (2020b ), and Valliappan et al. (Reference Valliappan, Ruch and Tomé Cortiñas2022). This line of work explores various modal dependent type theories where different stages are separated by locks . Kripke- and Lock-style (sometimes also referred to as Fitch-style) systems are fundamentally the same, although we manage the context stack structure slightly differently. Syntactically, the Kripke style simply uses a stack of contexts, while the Lock-style uses locks to segment one context into sections. Therefore, Lock-style systems typically rely on external side conditions such as “delete all of the locks that occur in the context” or “no lock occurs in context $\Gamma$ ”. These checks and operations on contexts with locks correspond in fact to modal structural properties in the Kripke-style formulation. For example, “deleting all of the locks” corresponds to the property of modal fusion. The condition that “no locks occur in context $\Gamma$ ” is naturally captured simply by the stack structure of the context stack in Kripke-style systems. Hence, while the lock-based treatment of contexts and the use of context stacks are related (see also Clouston, Reference Clouston2018), context stacks reflect more directly the underlying Kripke semantics. As a consequence, structural properties of context stacks are more clearly formulated as general logical principles on those context stacks. This also allows us to characterize the context stack structure by a truncoid algebra and internalize it in our semantics. One consequence of that approach is that it allows us to directly adapt existing NbE algorithms such as Abel (Reference Abel2013). The end result is a clean and general NbE proof that captures all four subsystems of S4 without change. The fact that our NbE algorithm can be compactly and elegantly mechanized in Agda further emphasizes the benefit of the Kripke-style structure of context stacks and its corresponding semantic characterizations.

In comparison, Valliappan et al. (Reference Valliappan, Ruch and Tomé Cortiñas2022) give four (similar but) different formulations for all four subsystems of simply typed S4 and provide their normalization proofs separately. Our previous work (Reference Hu and PientkaHu & Pientka, 2022a ) considers the Kripke style and gives one NbE proof based on a presheaf model that handles all four subsystems. The NbE proof given by Gratzer et al. (Reference Gratzer, Sterling and Birkedal2019) for dependently typed, idempotent S4 cannot be easily adapted to all four subsystems of S4 and it is also not fully mechanized.

Last, the work by Gratzer (Reference Gratzer2022) gives a NbE proof for a richer MTT. However, its relationship to Kripke-style formulations is less clear, as it uses a very different formulation of the $\square$ elimination rule. As such, it is closer in spirit to the dual-context formulation of modal S4 given by Davies & Pfenning (Reference Davies and Pfenning2001) and further developed by Jang et al. (Reference Jang, Gélineau, Monnier and Pientka2022) (see also discussion below). Disregarding the differences in the underlying formulation of the modal elimination rule, the NbE proof described in Gratzer (Reference Gratzer2022) builds on the idea of synthetic Tait’s computability introduced by Sterling (Reference Sterling2022). This framework is much less understood than, for example, Abel (Reference Abel2013). In particular, it is less clear how one would mechanize the NbE proof given by Gratzer (Reference Gratzer2022) or how one would extract an algorithm that can be implemented in a conventional programming language. Hence, while Mint is less powerful than MTT, our work has direct practical benefits: it simply relies on well-understood techniques and approaches and we can extract an NbE algorithm from our Agda mechanization.

An alternative formulation of modal type systems is the dual-context formulation, which also goes back to Davies & Pfenning (Reference Davies and Pfenning2001) and where the authors gave a translation between the implicit (or Kripke-style) modal $\lambda$ -calculus using context stacks and the explicit using dual contexts to distinguish between global assumptions and local assumptions. This translation shows that both styles have the same logical strength. However, the translation does not give a correspondence between the equivalence relations of both styles. In fact, we speculate that the translation from the Kripke style to the dual-context style does not preserve equivalence. This further implies that the translation cannot be scaled to dependent types, because of the mutual definition of typing and equivalence judgments, and that both styles may not have the same expressive power in the dependently typed setting. In recent years, modal type systems in the dual-context style have found a wide range of seemingly unconnected applications: from reasoning about universes in homotopy type theory (Licata et al., Reference Licata, Orton, Pitts and Spitters2018; Shulman, Reference Shulman2018) to mechanizing meta-theory (Pientka, Reference Pientka2008), to reasoning about effects (Zyuzin & Nanevski, Reference Zyuzin and Nanevski2021), and meta-programming (Jang et al., Reference Jang, Gélineau, Monnier and Pientka2022). It would hence be interesting to further explore the relationship between implicit and explicit formulations of modal type theories in the future.

9.3 Mechanization of normalization for dependent type theory

From the 1990s, the question of how to mechanize the normalization proof for dependent type theory has been fundamental to gain trust in the type-theoretic foundation proof assistants such as Coq or Agda are built on. One of the earliest works is, for example, by Barras & Werner (Reference Barras and Werner1997). Barras and Werner formalized the strong normalization for the calculus of construction in Coq using reducibility candidates. More recently, Abel et al. (Reference Abel, Vezzosi and Winterhalter2017) mechanize a normalization proof for Martin-Löf logical framework in Agda. Instead of NbE, they first reduce terms to weak head normal forms and then use a type-directed algorithmic convertibility checking algorithm to check the equivalence of terms. In their development, they also rely on induction–recursion to give a semantics to dependent types. The algorithmic convertibility checking algorithm is shown to be complete and sound w.r.t. the equivalence rules. The completeness and soundness proofs are parameterized by a relation, reducing the size of the proofs. Pujet & Tabareau (Reference Pujet and Tabareau2022) extend the work by Abel et al. (Reference Abel, Vezzosi and Winterhalter2017) by mechanizing observational equality and two-level cumulative universe hierarchy. In their work, they did not need a lowering lemma for related cumulative properties. Instead, they make the following adjustments:

• • In their logical relations, they added an extra case to represent the embedding from the lower universe to the higher one. This adjustment turns the cumulativity lemmas into a case in the logical relations.

• • Moreover, in addition to the level 0 and level 1 universes, they have an extra level $\infty$ universe, which subsumes both level 0 and 1 universes. Then, the proof can simply lift all types to the $\infty$ level and completely avoid explicit discussions of universe levels entirely. This treatment resembles the typical paper proof.

This work is further superseded by Pujet & Tabareau (Reference Pujet and Tabareau2023), which mechanizes impredicative observational equality. In this work, however, cumulativity is removed from the universe hierarchy.

In contrast, mechanizations of NbE algorithms in dependent type theory are less common and remain challenging. Danielsson (Reference Danielsson2006) presents the first mechanization of NbE for Martin-Löf logical framework using induction–recursion in AgdaLight. As pointed out by Chapman (Reference Chapman2009), Danielsson (Reference Danielsson2006)’s formulation contains non-strictly positive predicates, which compromise the trust in this work.

Chapman (Reference Chapman2009) formalizes Martin-Löf logical framework in the style of categories with families (Dybjer, Reference Dybjer1996) in Agda and presents a sound normalizer. However, the normalizer is not shown complete whereas our paper has shown both completeness and soundness.

Altenkirch & Kaposi (Reference Altenkirch and Kaposi2016b,a) and Kaposi & Altenkirch (Reference Kaposi and Altenkirch2017) mechanize an NbE algorithm for Martin-Löf logical framework in Agda and prove completeness and soundness using a presheaf formulation akin to categories with families. Their development explores an advanced combination of intrinsic syntactic representations and involved features like induction–induction (Nordvall Forsberg & Setzer, Reference Nordvall Forsberg and Setzer2010) and quotient inductive types. In comparison, our development is simpler and only relies on two standard extensions: induction–recursion and functional extensionality. The simplicity leads to a formalization of a full hierarchy of universes. We hope that our mechanization of NbE in Agda, while focused on a modal type theory, also provides more general guidance on how to deal with a full universe hierarchy in the mechanization and implementation of NbE in type theory.

Most work in this area is done in Agda, as it supports induction–recursion, which strengthens the logical power of the meta-language and allows us to define the semantics for universes. Nevertheless, Agda is not the only choice. Wieczorek & Biernacki (Reference Wieczorek and Biernacki2018) mechanize an NbE algorithm for Martin-Löf logical framework in Coq. Since Coq does not support induction–recursion, they universally quantify over the impredicative universe Prop in their models. Their algorithm can also be extracted to and run in Haskell or OCaml. One benefit of using Coq is that Prop is automatically removed during extraction. Hence, their extraction code is cleaner than the one generated from Agda. While the readability of our extracted code could be improved by adding compiler auxiliary pragmas, the root cause for the verbosity of our extracted code lies in Agda’s extraction facilities. In the future, it would be interesting to adapt Wieczorek & Biernacki (Reference Wieczorek and Biernacki2018)’s work to mechanize the NbE algorithm for Mint in Coq, which would allow us to take advantage of Coq’s extraction facilities.