DafnyPro for LLM-Assisted Dafny Verification

Toggle layers to see which parts define behavior, which define the claim, and which exist only to help the verifier close the proof.

Invariants and decreases clauses stay hot because they must survive induction, exit reasoning, and termination checks all at once.

A good invariant must pass four gates, not one. It has to hold before the loop, survive every step, imply the postcondition on exit, and pair with a valid ranking function.

Switch model families and metrics. The chart is meant to show both success rate and the hidden bureaucracy of retries that can ride behind that rate.

The episode’s caution is visualized here: better search policy is real capability, but it also means comparisons should be compute-matched.

Diff checking, pruning, and hint retrieval are broken apart here so the full loop does not get mistaken for a single magical prompt.

The loop alternates between addition and deletion. That is the unusual move: some generated invariants are not assets to repair, but clutter to remove.

Each row is a candidate invariant, assertion, or lemma. The matrix shows that deleting bad clauses can be as important as inventing new ones.

The retrieval layer is drawn as strategy shapes, not answer lookup. It supplies reusable proof structure without permission to rewrite the program.