packages feed

cpsa 4.4.7 → 4.4.8

raw patch · 196 files changed

+281/−35775 lines, 196 filesnew-uploader

Files

ChangeLog view
@@ -1,10 +1,14 @@-2025-09-24  Joshua D. Guttman  <guttman@mitre.org>+2026-02-27 Paul D. Rowe <prowe@mitre.org> -	* Tagged as real4.4.7.  Small updates including improved error-	messages for users with complicated Diffie-Hellman protocols,-	subtle corrections to determining when homomorphism exists, and-	clean ups for the early stages of an analysis.  See NEWS.  +	* src/CPSA/Strand.hs (rewrite): Fixed a bug that failed to check+	nullary rules after the success of a unary rule. +2025-12-01 Paul D. Rowe <prowe@mitre.org>++	* src/CPSA/{Strand.hs,Reduction.hs} (unSatReport): Modified how+    to report unsatisfiability of goals to list all predicates that are+	not satisfiable.+ 2025-05-05  Joshua D. Guttman  <guttman@mitre.org>  	* cpsa.cabal (Version): Tagged as version 4.4.6. Removed an@@ -17,7 +21,7 @@ 2025-05-02  John D. Ramsdell  <ramsdell@mitre.org>  	* src/cpsa/RoleCoq/Main.hs (emit): Updated Roletran to use rocq-	9.0.0. +	9.0.0.  2024-07-17  Joshua D. Guttman  <guttman@mitre.org> @@ -30,7 +34,7 @@  	* cpsa.cabal (Version): Tagged as version 4.4.4.  This version has 	important bug fixes especially for the Diffie-Hellman "absence"-	computation.  +	computation.  2023-10-23  John D. Ramsdell  <ramsdell@mitre.org>
NEWS view
@@ -1,5 +1,18 @@ CPSA NEWS -- history of user-visible changes. +* Changes in version 4.4.8++** Altered how unsatisfied goals are reported when using defgoal queries.+   Previously, only the first predicate found not to be satisfied was+   reported. Now all predicates that are not satisfied are reported.++** Fixed a bug in rule application. Previously, nullary rules (with+   empty right hand side) were not checked for applicability again+   after a unary rule (single disjunct on the right hand side)+   succeeded. This could lead to shapes being reported that had+   unsatisfiable facts. The code now tries to apply nullary rules+   after any other rule succeeds.+ * Changes in version 4.4.7  ** Improved error messages for users specifying
cpsa.cabal view
@@ -1,6 +1,6 @@ Name:                   cpsa-Version:                4.4.7-Maintainer:             guttman@mitre.org+Version:                4.4.8+Maintainer:             prowe@mitre.org Cabal-Version:          >= 1.10 License:                BSD3 License-File:           license.txt@@ -153,123 +153,95 @@   src/ocaml/main.mli src/ocaml/pp.ml src/ocaml/token.ml   src/ocaml/token.mli src/ocaml/scanner.mll src/ocaml/sexpr.ml   src/ocaml/sexpr.mli src/ocaml/sexpr_type.ml tst/README tst/Makefile-  tst/ab.scm tst/abc.scm tst/aik.scm tst/atomic-open-closed.scm-  tst/attest.scm tst/auth-enc.scm tst/auth-hash.scm-  tst/blanchet-strandmax.scm tst/blanchet.scm tst/bug_example.scm-  tst/cert_lang.scm tst/chan-envelope.scm tst/chan-perrig-song.scm-  tst/chan-unilateral.scm tst/chan-yahalom-role-decl.scm-  tst/chan-yahalom.scm tst/commitment.scm tst/comp_test.scm-  tst/completeness-test.scm tst/crushing.scm tst/dass_simple.scm-  tst/denning-sacco.scm tst/deorig_contract.scm tst/deorig_mesg.scm-  tst/deorig_simple.scm tst/dh_encrypt_hack.scm-  tst/dh_group_sig_auth_failure.scm tst/dh_group_sig.scm-  tst/DH_hack.scm tst/dh_mim_hack.scm tst/dh-ca_hack.scm-  tst/dhnsl_hack.scm tst/dhstatic-state.scm tst/disclosure.scm-  tst/doorsep.scm tst/doorsep2invk.scm tst/encsig.scm tst/envelope.scm-  tst/epmo_acctnum-key-hash.scm tst/epmo-hash.scm-  tst/epmo-key-hash.scm tst/epmo.scm tst/expand.scm tst/facts.scm-  tst/factvar.scm tst/ffgg.scm tst/fluffy_draft03_gske.scm-  tst/fragile_pruning.scm tst/goals.scm tst/goalsvar.scm-  tst/hashtest-key-hash.scm tst/hashtest.scm-  tst/incompleteness_example.scm tst/isoreject-corrected.scm-  tst/isoreject.scm tst/kelly1.scm tst/kerberos.scm-  tst/locn_envelope.scm tst/missing_contraction.scm tst/neq_test.scm-  tst/neuman-stubblebine.scm tst/no_contraction.scm-  tst/non_transforming.scm tst/nonaug-prune.scm tst/ns-l.scm-  tst/ns-rebinding.scm tst/ns-unrebinding.scm tst/ns.scm tst/nsl3.scm tst/nslsk.scm-  tst/open-closed-multiloc.scm tst/open-closed-tag.scm-  tst/open-closed.scm tst/or.scm tst/ordered.scm tst/orderedvar.scm-  tst/pca.scm tst/pen-non-orig-test.scm tst/pfs-via-pubkey.scm-  tst/pkinit.scm tst/preprocess.scm tst/print.scm tst/prottrans.scm-  tst/pruning1.scm tst/puzzle_example.scm tst/reflect.scm-  tst/renamings.scm tst/role_uniq.scm tst/rule-node.scm-  tst/rule-order.scm tst/sigenc.scm tst/sorted_epmo_acctnum.scm-  tst/sts_non_role.scm tst/sts_weakened_reflect.scm tst/sts.scm+  tst/ab.scm tst/ab.tst tst/abc.scm tst/abc.tst tst/aik.scm+  tst/aik.tst tst/atomic-open-closed.scm tst/atomic-open-closed.tst+  tst/attest.scm tst/attest.tst tst/auth-enc.scm tst/auth-enc.tst+  tst/auth-hash.scm tst/auth-hash.tst tst/blanchet_doorsep.prot+  tst/blanchet_doorsep.tst tst/blanchet-strandmax.scm+  tst/blanchet-strandmax.tst tst/blanchet.scm tst/blanchet.tst+  tst/bug_example.scm tst/bug_example.tst tst/cert_lang.scm+  tst/cert_lang.tst tst/chan-envelope.scm tst/chan-envelope.tst+  tst/chan-perrig-song.scm tst/chan-perrig-song.tst+  tst/chan-unilateral.scm tst/chan-unilateral.tst+  tst/chan-yahalom-role-decl.scm tst/chan-yahalom-role-decl.tst+  tst/chan-yahalom.scm tst/chan-yahalom.tst tst/commitment.scm+  tst/commitment.tst tst/comp_test.scm tst/comp_test.tst+  tst/completeness-test.scm tst/completeness-test.tst tst/crushing.scm+  tst/crushing.tst tst/dass_simple.scm tst/dass_simple.tst+  tst/denning-sacco.scm tst/denning-sacco.tst tst/deorig_contract.scm+  tst/deorig_contract.tst tst/deorig_mesg.scm tst/deorig_mesg.tst+  tst/deorig_simple.scm tst/deorig_simple.tst tst/dh_encrypt_hack.scm+  tst/dh_encrypt_hack.tst tst/dh_group_sig_auth_failure.scm+  tst/dh_group_sig_auth_failure.tst tst/dh_group_sig.scm+  tst/dh_group_sig.tst tst/DH_hack.scm tst/DH_hack.tst+  tst/dh_mim_hack.scm tst/dh_mim_hack.tst tst/dh-ca_hack.scm+  tst/dh-ca_hack.tst tst/dhnsl_hack.scm tst/dhnsl_hack.tst+  tst/dhstatic-state.scm tst/dhstatic-state.tst tst/disclosure.scm+  tst/disclosure.tst tst/doorsep.scm tst/doorsep.tst+  tst/doorsep2invk.scm tst/doorsep2invk.tst tst/dy.lsp tst/dy.tst+  tst/encsig.scm tst/encsig.tst tst/envelope.scm tst/envelope.tst+  tst/epmo_acctnum-key-hash.scm tst/epmo_acctnum-key-hash.tst+  tst/epmo_acctnum.lsp tst/epmo_acctnum.tst tst/epmo-hash.scm+  tst/epmo-hash.tst tst/epmo-key-hash.scm tst/epmo-key-hash.tst+  tst/epmo.scm tst/epmo.tst tst/expand.scm tst/expand.tst+  tst/facts.scm tst/facts.tst tst/factvar.scm tst/factvar.tst+  tst/ffgg.scm tst/ffgg.tst tst/fluffy_draft03_gske.scm+  tst/fluffy_draft03_gske.tst tst/fragile_pruning.scm+  tst/fragile_pruning.tst tst/goals.scm tst/goals.tst tst/goalsvar.scm+  tst/goalsvar.tst tst/hashtest-key-hash.scm tst/hashtest-key-hash.tst+  tst/hashtest.scm tst/hashtest.tst tst/incompleteness_example.scm+  tst/incompleteness_example.tst tst/isoreject-corrected.scm+  tst/isoreject-corrected.tst tst/isoreject.scm tst/isoreject.tst+  tst/kelly1.scm tst/kelly1.tst tst/kerberos.scm tst/kerberos.tst+  tst/locn_envelope.scm tst/locn_envelope.tst tst/mass.lsp+  tst/mass.tst tst/mass2.lsp tst/mass2.tst tst/missing_contraction.scm+  tst/missing_contraction.tst tst/neq_test.scm tst/neq_test.tst+  tst/neuman-stubblebine-reauth.lsp tst/neuman-stubblebine-reauth.tst+  tst/neuman-stubblebine.scm tst/neuman-stubblebine.tst+  tst/no_contraction.scm tst/no_contraction.tst+  tst/non_transforming.scm tst/non_transforming.tst+  tst/nonaug-prune.scm tst/nonaug-prune.tst tst/ns-l.scm tst/ns-l.tst+  tst/ns-rebinding.scm tst/ns-rebinding.tst tst/ns.scm tst/ns.tst+  tst/nsl3.scm tst/nsl3.tst tst/nslsk.scm tst/nslsk.tst+  tst/open-closed-multiloc.scm tst/open-closed-multiloc.tst+  tst/open-closed-tag.scm tst/open-closed-tag.tst tst/open-closed.scm+  tst/open-closed.tst tst/or.scm tst/or.tst tst/ordered.scm+  tst/ordered.tst tst/orderedvar.scm tst/orderedvar.tst tst/pca.scm+  tst/pca.tst tst/pen-non-orig-test.scm tst/pen-non-orig-test.tst+  tst/pfs-via-pubkey.scm tst/pfs-via-pubkey.tst tst/pkinit.scm+  tst/pkinit.tst tst/preprocess.scm tst/preprocess.tst tst/print.scm+  tst/print.tst tst/prottrans.scm tst/prottrans.tst tst/pruning1.scm+  tst/pruning1.tst tst/puzzle_example.scm tst/puzzle_example.tst+  tst/reflect.scm tst/reflect.tst tst/renamings.scm tst/renamings.tst+  tst/role_uniq.scm tst/role_uniq.tst tst/rule-node.scm+  tst/rule-node.tst tst/rule-order.scm tst/rule-order.tst+  tst/sigenc.scm tst/sigenc.tst tst/sorted_epmo_acctnum.scm+  tst/sorted_epmo_acctnum.tst tst/sts_non_role.scm+  tst/sts_non_role.tst tst/sts_weakened_reflect.scm+  tst/sts_weakened_reflect.tst tst/sts.scm tst/sts.tst   tst/subatomic-open-closed-test-genrule.scm-  tst/subatomic-open-closed.scm tst/sync_locn_envelope.scm-  tst/targetterms1.scm tst/targetterms2.scm tst/targetterms6.scm-  tst/targetterms8.scm tst/thisthat.scm tst/tickle-unique.scm-  tst/timestamping.scm tst/trust-anchor.scm tst/ugen-at.scm-  tst/ugo.scm tst/uncarried_keys.scm tst/unilateral.scm-  tst/uniq-at.scm tst/uniq-gen-test.scm tst/uo.scm tst/wang-hash.scm-  tst/wang-key-hash.scm tst/weird.scm tst/wonthull.scm-  tst/wonthull2.scm tst/wonthull3.scm tst/woolam.scm-  tst/yahalom-6.3.6.scm tst/yahalom-forward.scm tst/yahalom.scm-  tst/yes-or-no.scm-  tst/dass-mod.lisp tst/dass.lisp tst/dh_mim.lisp tst/dhke2.lisp-  tst/ds-short.lisp tst/kelly64.lisp tst/kerb5.lisp-  tst/neuman-stubblebine-alt.lisp tst/neuman-stubblebine-reauth.lisp-  tst/nsl4.lisp tst/nsl4cm1.lisp tst/nsl4init.lisp tst/nsl4resp1.lisp-  tst/nsl4resp2.lisp tst/nsl4resp3.lisp tst/nsl5.lisp tst/nsl5i.lisp-  tst/nsl5resp3.lisp tst/tnsl5.lisp tst/wang.lisp  -  tst/dy.lsp tst/epmo_acctnum.lsp tst/mass.lsp tst/mass2.lsp-  tst/neuman-stubblebine-reauth.lsp tst/wide-mouth-frog-scyther.lsp-  tst/wide-mouth-frog.lsp  -  tst/blanchet_doorsep.prot-  tst/ab.tst tst/abc.tst tst/aik.tst tst/atomic-open-closed.tst-  tst/attest.tst tst/auth-enc.tst tst/auth-hash.tst-  tst/blanchet_doorsep.tst tst/blanchet-strandmax.tst tst/blanchet.tst-  tst/bug_example.tst tst/cert_lang.tst tst/chan-envelope.tst-  tst/chan-perrig-song.tst tst/chan-unilateral.tst-  tst/chan-yahalom-role-decl.tst tst/chan-yahalom.tst-  tst/commitment.tst tst/comp_test.tst tst/completeness-test.tst-  tst/crushing.tst tst/dass_simple.tst-  tst/defact-atomic-open-closed_shapes.tst-  tst/defact-atomic-open-closed.tst-  tst/defact-dhstatic-state_shapes.tst tst/defact-dhstatic-state.tst-  tst/defact-locn_envelope_shapes.tst tst/defact-locn_envelope.tst-  tst/defact-open-closed_shapes.tst-  tst/defact-open-closed-multiloc_shapes.tst-  tst/defact-open-closed-multiloc.tst-  tst/defact-open-closed-tag_shapes.tst tst/defact-open-closed-tag.tst-  tst/defact-open-closed.tst-  tst/defact-subatomic-open-closed_shapes.tst-  tst/defact-subatomic-open-closed-test-genrule_shapes.tst-  tst/defact-subatomic-open-closed-test-genrule.tst-  tst/defact-subatomic-open-closed.tst-  tst/defact-sync_locn_envelope_shapes.tst-  tst/defact-sync_locn_envelope.tst tst/denning-sacco.tst-  tst/deorig_contract.tst tst/deorig_mesg.tst tst/deorig_simple.tst-  tst/dh_encrypt_hack.tst tst/dh_group_sig_auth_failure.tst-  tst/dh_group_sig.tst tst/DH_hack.tst tst/dh_mim_hack.tst-  tst/dh-ca_hack.tst tst/dhnsl_hack.tst tst/dhstatic-state.tst-  tst/disclosure.tst tst/doorsep.tst tst/doorsep2invk.tst tst/dy.tst-  tst/encsig.tst tst/envelope.tst tst/epmo_acctnum-key-hash.tst-  tst/epmo_acctnum.tst tst/epmo-hash.tst tst/epmo-key-hash.tst-  tst/epmo.tst tst/example.tst tst/expand.tst tst/facts.tst-  tst/factvar.tst tst/ffgg.tst tst/fluffy_draft03_gske.tst-  tst/fragile_pruning.tst tst/goals.tst tst/goalsvar.tst-  tst/hashtest-key-hash.tst tst/hashtest.tst-  tst/incompleteness_example.tst tst/isoreject-corrected.tst-  tst/isoreject.tst tst/jdg-wonthull.tst tst/kelly1.tst-  tst/kerberos-variant-guar.tst tst/kerberos.tst tst/locn_envelope.tst-  tst/mass.tst tst/mass2.tst tst/missing_contraction.tst-  tst/neq_test.tst tst/neuman-stubblebine-reauth-tagged.tst-  tst/neuman-stubblebine-reauth.tst tst/neuman-stubblebine.tst-  tst/no_contraction.tst tst/non_transforming.tst tst/nonaug-prune.tst-  tst/ns-l.tst tst/ns-rebinding.tst tst/ns-unrebinding.tst tst/ns.tst tst/nsl3.tst-  tst/nslsk.tst tst/open-closed-multiloc.tst tst/open-closed-tag.tst-  tst/open-closed.tst tst/or.tst tst/ordered.tst tst/orderedvar.tst-  tst/pca.tst tst/pen-non-orig-test.tst tst/pfs-via-pubkey.tst-  tst/pkinit.tst tst/preprocess.tst tst/print.tst tst/prottrans.tst-  tst/pruning1.tst tst/puzzle_example.tst tst/reflect.tst-  tst/renamings.tst tst/role_uniq.tst tst/rule-node.tst-  tst/rule-order.tst tst/sa.tst tst/sigenc.tst-  tst/sorted_epmo_acctnum.tst tst/sts_non_role.tst-  tst/sts_weakened_reflect.tst tst/sts.tst-  tst/subatomic-open-closed-dist.tst   tst/subatomic-open-closed-test-genrule.tst-  tst/subatomic-open-closed.tst tst/sync_locn_envelope.tst-  tst/targetterms1.tst tst/targetterms2.tst tst/targetterms6.tst-  tst/targetterms8.tst tst/thisthat.tst tst/tickle-unique.tst-  tst/timestamping.tst tst/tmp-yahalom.tst tst/trust-anchor.tst-  tst/ugen-at.tst tst/ugo.tst tst/uncarried_keys.tst-  tst/unilateral.tst tst/uniq-at.tst tst/uniq-gen-test.tst tst/uo.tst-  tst/wang-hash.tst tst/wang-key-hash.tst tst/weird.tst-  tst/wide-mouth-frog-scyther.tst tst/wide-mouth-frog.tst-  tst/wonthull.tst tst/wonthull2.tst tst/wonthull3.tst tst/woolam.tst-  tst/yahalom-6.3.6.tst tst/yahalom-forward.tst tst/yahalom.tst-  tst/yes-or-no.tst+  tst/subatomic-open-closed.scm tst/subatomic-open-closed.tst+  tst/sync_locn_envelope.scm tst/sync_locn_envelope.tst+  tst/targetterms1.scm tst/targetterms1.tst tst/targetterms2.scm+  tst/targetterms2.tst tst/targetterms6.scm tst/targetterms6.tst+  tst/targetterms8.scm tst/targetterms8.tst tst/thisthat.scm+  tst/thisthat.tst tst/tickle-unique.scm tst/tickle-unique.tst+  tst/timestamping.scm tst/timestamping.tst tst/trust-anchor.scm+  tst/trust-anchor.tst tst/ugen-at.scm tst/ugen-at.tst tst/ugo.scm+  tst/ugo.tst tst/uncarried_keys.scm tst/uncarried_keys.tst+  tst/unilateral.scm tst/unilateral.tst tst/uniq-at.scm+  tst/uniq-at.tst tst/uniq-gen-test.scm tst/uniq-gen-test.tst+  tst/uo.scm tst/uo.tst tst/wang-hash.scm tst/wang-hash.tst+  tst/wang-key-hash.scm tst/wang-key-hash.tst tst/weird.scm+  tst/weird.tst tst/wide-mouth-frog-scyther.lsp+  tst/wide-mouth-frog-scyther.tst tst/wide-mouth-frog.lsp+  tst/wide-mouth-frog.tst tst/wonthull.scm tst/wonthull.tst+  tst/wonthull2.scm tst/wonthull2.tst tst/wonthull3.scm+  tst/wonthull3.tst tst/woolam.scm tst/woolam.tst+  tst/yahalom-6.3.6.scm tst/yahalom-6.3.6.tst tst/yahalom-forward.scm+  tst/yahalom-forward.tst tst/yahalom.scm tst/yahalom.tst+  tst/yes-or-no.scm tst/yes-or-no.tst   coq/Sem_tactics.v coq/Comp.v coq/Alt_sem.v coq/Match.v coq/Alg.v   coq/Exec.v coq/Intro.v coq/Nonce.v coq/Preamble.v   coq/Unilateral_proof.v coq/Makefile coq/Run.v coq/procdoc.tex
doc/cpsa4manual.pdf view

binary file changed (1053746 → 1367913 bytes)

doc/cpsadesign.pdf view

binary file changed (274428 → 285517 bytes)

doc/cpsafoundation.pdf view

binary file changed (205171 → 220658 bytes)

doc/cpsagoals.pdf view

binary file changed (216433 → 231618 bytes)

doc/cpsaintroslides.pdf view

binary file changed (101593 → 101194 bytes)

doc/cpsaprimer.pdf view

binary file changed (304651 → 300071 bytes)

doc/cpsaspec.pdf view

binary file changed (426908 → 439682 bytes)

doc/src/cpsa4manual/basic.tex view
@@ -95,10 +95,10 @@ protocol are encryption, pairing, and the ``key of'' function.  $\enc{m}{k}$ denotes the encryption of message $m$ under encryption-key $k$.  In {cpsa}, encryption operators are always regarded as+key $k$.  In {\cpsa}, encryption operators are always regarded as offering authenticated encryption, meaning that a participant without access to an encryption key is overwhelmingly unlikely to generate a-message that can be successfully descrypted.  This property is+message that can be successfully decrypted.  This property is primarily relevant in symmetric (secret-key) kinds of encryption.  Terms in a pair are represented in comma-separated lists.  And $K_a$@@ -112,7 +112,7 @@ \index{skeleton} \index{instance} In addition to a description of the protocol, {\cpsa} expects the-description of a what we call a \emph{skeleton}---a partial protocol+description of what we call a \emph{skeleton}---a partial protocol execution.  A skeleton is made up of \emph{instances} of the roles, that is, viewpoints of honest parties, along with what values are associated with the variables in those viewpoints.  These viewpoints may be partial, but they@@ -319,7 +319,7 @@ displayed in black, but may also be displayed in other colors.  Blue numbers represent \emph{realized} skeletons, that is, skeletons that may represent an actual execution.\footnote{Note that while realized-  skeletons already represent complete executions, \cpsa does further+  skeletons already represent complete executions, {\cpsa} does further   analysis once a realized skeleton is reached in order to   \emph{generalize} that skeleton as much as possible.  A skeleton   that is both realized and cannot be further generalized is a
doc/src/cpsa4manual/cpsa4manual.tex view
@@ -10,6 +10,7 @@ \usepackage[all]{xy} \usepackage{fancyhdr} \usepackage{pdfpages}+\usepackage[T1]{fontenc} \input{macros}  \newif\ifpubrel@@ -32,7 +33,7 @@ \makeindex  \title{The Cryptographic Protocol Shapes Analyzer:\\ A Manual for CPSA-  4\thanks{\ {\copyright} 2016--2022 The+  4\thanks{\ {\copyright} 2016--2026 The     MITRE Corporation.  Permission to copy without fee all or part of     this material is granted provided that the copies are not made or     distributed for direct commercial advantage, this copyright notice
doc/src/cpsa4manual/goals.tex view
@@ -112,7 +112,7 @@      (and (p "init" z0 3)       (p "init" "n1" z0 n1) (p "init" "b" z0 b)       (non (privk b)) (uniq n1))-     (exists ((z1 node))+     (exists ((z1 strd))       (and (p "resp" z1 2) (p "resp" "b" z1 b))))))  (defskeleton ns            ; Point of view skeleton@@ -567,7 +567,7 @@     (implies      (and (strand init z0 3 (n1 n1) (b b))       (non (privk b)) (uniq n1))-     (exists ((z1 node))+     (exists ((z1 strd))       (strand resp z1 2 (b b)))))). \end{verbatim} \end{quote}
doc/src/cpsa4manual/macros.tex view
@@ -3,9 +3,9 @@ {\setcounter{running}{\value{enumi}}\end{enumerate}}  \newcommand{\cpsa}{\textsc{cpsa}}-\newcommand{\version}{4.4.7}+\newcommand{\version}{4.4.8} \newcommand{\cpsacopying}{\begingroup-  \renewcommand{\thefootnote}{}\footnotetext{{\copyright} 2016--2022 The+  \renewcommand{\thefootnote}{}\footnotetext{{\copyright} 2016--2026 The     MITRE Corporation.  Permission to copy without fee all or part of     this material is granted provided that the copies are not made or     distributed for direct commercial advantage, this copyright notice
doc/src/cpsa4manual/setup.tex view
@@ -100,7 +100,7 @@ \begin{verbatim} $ mkdir project $ cd project-$ cpsainit+$ cpsa4init Created Makefile Created cpsa.mk Created Make.hs@@ -178,7 +178,7 @@   output, try running \texttt{clean}. Getting into the habit of   running \texttt{clean} before \texttt{build} is a good idea. \end{itemize}-\item \texttt{cpsa4} \texttt{"\textit{protocolname}"} Run {\cpsa} on just the+\item \texttt{cpsa4} \texttt{"\textit{protocolname}"}: Run {\cpsa} on just the   protocol provided. Note that the file extension (.scm) should   \textit{not} be included in the name; if your protocol is in   \texttt{foo.scm}, you would run \texttt{cpsa4 "foo"}. Most useful if you
doc/src/macros.tex view
@@ -1,5 +1,5 @@ \newcommand{\cpsa}{\textsc{cpsa}}-\newcommand{\version}{4.4.7}+\newcommand{\version}{4.4.8} \newcommand{\cpsacopying}{\begingroup   \renewcommand{\thefootnote}{}\footnotetext{{\copyright} 2010 The     MITRE Corporation.  Permission to copy without fee all or part of
src/CPSA/Reduction.hs view
@@ -632,11 +632,17 @@       goalGEs -> map f goalGEs     where       f (_, []) = error "reportSatisfies:  How did goalCounterExamples give nil?"+      {- f (g, ge : _) = +          L () (S () "no" :+                map (displayForm+                 (ctx $ (uvars g) ++ (evars g) ++ (kvars k)))+                 (unSatReport k g ge) +++                (displayEnv (ctx $ uvars g) (ctx $ kvars k) (snd ge))) -}       f (g, ge : _) =            L () (S () "no" :-                (displayForm-                 (ctx $ (uvars g) ++ (evars g) ++ (kvars k))-                 (unSatReport k g ge)) :+                map (displayForm+                 (ctx $ (uvars g) ++ (evars g) ++ (kvars k)))+                 (unSatReport k g ge) ++                 (displayEnv (ctx $ uvars g) (ctx $ kvars k) (snd ge)))       ctx ts = addToContext emptyContext ts       evars g = concatMap fst $ consq g
src/CPSA/Strand.hs view
@@ -3266,26 +3266,29 @@       ge' <- satisfy a ebvs k ge  -- checkSem                    conjoinEbvs as ebvs k ge' --- Suppose a gen-env pair ge that satisfies the antecedent of a goal,--- but does not extend to satisfy any of the disjuncts on the--- conclusion.  We would like to know, for at least one disjunct of--- the conclusion, say the first, an atomic formula in that disjunct--- that cannot be satisfied.  unSatReport reports that.+-- Suppose a gen-env pair ge satisfies the antecedent of a goal,+-- but does not extend to satisfy any of the disjuncts in the+-- conclusion.  We would like to know, which atomic facts in the +-- conclusion cannot be satisfied.  unSatReport reports them. -unSatReport :: Preskel -> Goal -> (Gen, Env) -> AForm+unSatReport :: Preskel -> Goal -> (Gen, Env) -> [AForm] unSatReport k g ge =     case varAtomLists of-      [] -> AFact "false" []-      (ebvs,as) : _ -> iter ebvs as ge+      [] -> [AFact "false" []]+      eas -> loop eas       where       varAtomLists = consq g +      -- Do iter on each of the (ebvs,as) pairs+      loop ((ebvs,as) : eas) = iter ebvs as ge ++ loop eas +      loop [] = []+       -- doesn't happen if e is a counterexample-      iter _ [] _ = AFact "true" []+      iter _ [] _ = []--AFact "true" []       iter ebvs (a : as) ge =           case satisfy a ebvs k ge of-            [] -> a+            [] -> a : iter ebvs as ge             ge' : _ -> iter ebvs as ge'  -- Extends an environment (a variable assignment) according to the@@ -4413,7 +4416,9 @@               case rewriteUnary k of                   Unsat    -> Just []                   Unch     -> Nothing-                  Found k' -> Just [k']+                  Found k' -> if checkNullary k' -- was Just [k']+                              then Just [k']+                              else Just []           else               Just []
tst/DH_hack.tst view
@@ -1,6 +1,6 @@ (herald "DH Hack" (bound 15)) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/DH_hack.scm") (comment "Strand count bounded at 15")
tst/ab.tst view
@@ -1,4 +1,4 @@-(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/ab.scm")  (defprotocol ab basic
tst/abc.tst view
@@ -1,4 +1,4 @@-(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/abc.scm")  (defprotocol abc basic
tst/aik.tst view
@@ -1,6 +1,6 @@ (herald "Anonymous identity protocol from TCG") -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/aik.scm")  (defprotocol aikprot basic
tst/atomic-open-closed.tst view
@@ -1,6 +1,6 @@ (herald atomic-open-closed (bound 44)) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/atomic-open-closed.scm") (comment "Strand count bounded at 44")
tst/attest.tst view
@@ -1,6 +1,6 @@ (herald attest-door) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/attest.scm")  (defprotocol attest-door basic
tst/auth-enc.tst view
@@ -1,6 +1,6 @@ (herald auth-enc) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/auth-enc.scm")  (defprotocol auth-enc basic
tst/auth-hash.tst view
@@ -1,6 +1,6 @@ (herald auth-hash) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/auth-hash.scm")  (defprotocol auth-hash basic
tst/blanchet-strandmax.tst view
@@ -1,7 +1,7 @@ (herald "Blanchet's Simple Example Protocol (strand max)"   (comment "There is a flaw in this protocol by design")) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/blanchet-strandmax.scm")  (defprotocol blanchet-max basic
tst/blanchet.tst view
@@ -1,7 +1,7 @@ (herald "Blanchet's Simple Example Protocol"   (comment "There is a flaw in this protocol by design")) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/blanchet.scm")  (defprotocol blanchet basic
tst/blanchet_doorsep.tst view
@@ -1,4 +1,4 @@-(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read")  (defprotocol blanchet basic
tst/bug_example.tst view
@@ -1,6 +1,6 @@ (herald bug_example (bound 20)) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/bug_example.scm") (comment "Strand count bounded at 20")
tst/cert_lang.tst view
@@ -1,6 +1,6 @@ (herald cert-lang) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/cert_lang.scm")  (defprotocol cert-uni basic
tst/chan-envelope.tst view
@@ -1,6 +1,6 @@ (herald "Envelope Protocol With Channels" (bound 15)) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/chan-envelope.scm") (comment "Strand count bounded at 15")
tst/chan-perrig-song.tst view
@@ -1,6 +1,6 @@ (herald perrig-song) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/chan-perrig-song.scm")  (defprotocol perrig-song basic
tst/chan-unilateral.tst view
@@ -1,6 +1,6 @@ (herald chan-unilateral) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/chan-unilateral.scm")  (defprotocol unilateral basic
tst/chan-yahalom-role-decl.tst view
@@ -1,6 +1,6 @@ (herald "Yahalom Protocol Without Forwarding" (bound 15)) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/chan-yahalom-role-decl.scm") (comment "Strand count bounded at 15")
tst/chan-yahalom.tst view
@@ -1,6 +1,6 @@ (herald "Yahalom Protocol Without Forwarding" (bound 15)) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/chan-yahalom.scm") (comment "Strand count bounded at 15")
tst/commitment.tst view
@@ -1,6 +1,6 @@ (herald commitment) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/commitment.scm")  (defprotocol commit basic
tst/comp_test.tst view
@@ -1,6 +1,6 @@ (herald "Main Example") -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/comp_test.scm")  (defprotocol main-ex-src basic
tst/completeness-test.tst view
@@ -1,4 +1,4 @@-(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/completeness-test.scm")  (defprotocol completeness-test basic
tst/crushing.tst view
@@ -1,4 +1,4 @@-(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/crushing.scm")  (defprotocol crushing basic
− tst/dass-mod.lisp 
@@ -1,31 +0,0 @@-(defprotocol dass basic-  (defrole init-    (vars (a name) (b name) (ks name) (k skey) (l text) (ta text) (tb text))-    (trace (send b)-	   (recv (enc (cat b (pubk b)) (privk ks)))-	   (send (enc (cat (enc ta k) l a (enc k (pubk b))) (privk a)))-	   (recv (enc tb k))))-  (defrole resp-    (vars (a name) (b name) (ks name) (k skey) (l text) (ta text) (tb text))-    (trace (recv (enc (cat (enc ta k) l a (enc k (pubk b))) (privk a)))-	   (send a)-	   (recv (enc (cat a (pubk a)) (privk ks)))-	   (send (enc tb k))))-  (defrole keyserver-    (vars (a name) (b name) (ks name))-    (trace (recv b)-	   (send (enc (cat b (pubk b)) (privk ks)))-	   (recv a)-	   (send (enc (cat a (pubk a)) (privk ks))))))--(defskeleton dass-  (vars (a name) (b name) (ks name) (k skey))-  (defstrand init 4 (a a) (b b) (ks ks) (k k))-  (non-orig (privk a) (privk b) (privk ks))-  (uniq-orig k))--(defskeleton dass-  (vars (a name) (b name) (ks name) (k skey))-  (defstrand resp 4 (a a) (b b) (ks ks) (k k))-  (non-orig (privk a) (privk b) (privk ks))-  (uniq-orig k))
− tst/dass.lisp 
@@ -1,31 +0,0 @@-(defprotocol dass basic-  (defrole init-    (vars (a name) (b name) (ks name) (k skey) (l text) (ta text) (kp akey) (tb text))-    (trace (send b)-	   (recv (enc (cat b (pubk b)) (privk ks)))-	   (send (cat (enc ta k) (enc (cat l a kp) (privk a)) (enc (enc k (pubk b)) kp)))-	   (recv (enc tb k))))-  (defrole resp-    (vars (a name) (b name) (ks name) (k skey) (l text) (ta text) (kp akey) (tb text))-    (trace (recv (cat (enc ta k) (enc (cat l a kp) (privk a)) (enc (enc k (pubk b)) kp)))-	   (send a)-	   (recv (enc (cat a (pubk a)) (privk ks)))-	   (send (enc tb k))))-  (defrole keyserver-    (vars (a name) (b name) (ks name))-    (trace (recv b)-	   (send (enc (cat b (pubk b)) (privk ks)))-	   (recv a)-	   (send (enc (cat a (pubk a)) (privk ks))))))--(defskeleton dass-  (vars (a name) (b name) (ks name) (k skey) (kp akey))-  (defstrand init 4 (a a) (b b) (ks ks) (k k) (kp kp))-  (non-orig (privk a) (privk b) (privk ks))-  (uniq-orig k kp))--(defskeleton dass-  (vars (a name) (b name) (ks name) (k skey) (kp akey))-  (defstrand resp 4 (a a) (b b) (ks ks) (k k) (kp kp))-  (non-orig (privk a) (privk b) (privk ks))-  (uniq-orig k kp))
tst/dass_simple.tst view
@@ -1,6 +1,6 @@ (herald "Distributed Authentication Security Service Protocol Variants") -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/dass_simple.scm")  (defprotocol dass-simple basic
− tst/defact-atomic-open-closed.tst 
@@ -1,1666 +0,0 @@-(herald atomic-open-closed (bound 44))--(comment "CPSA 4.4.5")-(comment "All input read from tst/atomic-open-closed.scm")-(comment "Strand count bounded at 44")--(defprotocol atomic-open-closed basic-  (defrole dev-up-    (vars (k skey) (d o name) (old old1 mesg) (start-ch chan)-      (lk ls locn))-    (trace (recv start-ch (cat "power-up" d o k)) (load lk old)-      (stor lk (cat "st-k" d o k)) (load ls old1)-      (stor ls (cat "st" d o)) (send (enc "up" k)))-    (auth start-ch))-  (defrole owner-power-dev-    (vars (k skey) (d o name) (start-ch chan))-    (trace (send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    (conf start-ch))-  (defrole owner-open-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "open" d o n k)) (recv n)))-  (defrole owner-close-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "close" d o n k)) (recv n)))-  (defrole dev-open-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (recv (enc "open" d o n k)) (load lk (cat "st-k" d o k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d o o)) (send n)))-  (defrole dev-close-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (recv (enc "close" d o n k)) (load lk (cat "st-k" d o k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d o)) (send n)))-  (defrole dev-pass-    (vars (k skey) (n text) (d o name) (lk ls locn))-    (trace (recv (enc "may I pass" k)) (load lk (cat "st-k" d o k))-      (load ls (cat "st" d o o)) (send (enc "you may pass" n k)))-    (uniq-orig n))-  (defrole user-pass-    (vars (k skey))-    (trace (send (enc "may I pass" k)) (recv (enc "you may pass" k))))-  (defrule gen-state-close-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-close" z (idx 1)) (p "dev-close" "d" z d)-          (p "dev-close" "o" z o) (p "dev-close" "k" z k)-          (p "dev-close" "any" z (cat o o)))-        (gen-st (cat "st" d o o)))))-  (defrule gen-state-pass-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "d" z d)-          (p "dev-pass" "o" z o) (p "dev-pass" "k" z k))-        (gen-st (cat "st" d o o)))))-  (defrule gen-state-open-    (forall ((z strd) (d o k mesg))-      (implies-        (and (p "dev-open" "d" z d) (p "dev-open" "o" z o)-          (p "dev-open" "k" z k))-        (gen-st (cat "st-k" d o k)))))-  (defrule gen-state-close-    (forall ((z strd) (d o k mesg))-      (implies-        (and (p "dev-close" "d" z d) (p "dev-close" "o" z o)-          (p "dev-close" "k" z k))-        (gen-st (cat "st-k" d o k)))))-  (defrule gen-state-pass-    (forall ((z strd) (d o k mesg))-      (implies-        (and (p "dev-pass" "d" z d) (p "dev-pass" "o" z o)-          (p "dev-pass" "k" z k))-        (gen-st (cat "st-k" d o k)))))-  (defrule power-deliver-once-    (forall ((z1 z2 strd) (k skey))-      (implies-        (and (p "dev-up" z1 (idx 2)) (p "dev-up" z2 (idx 2))-          (p "dev-up" "k" z1 k) (p "dev-up" "k" z2 k))-        (= z1 z2))))-  (defrule intro-same-dev-up-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-up" "lk" z lk) (p "dev-up" "ls" z ls))-        (fact same-dev ls lk))))-  (defrule intro-same-dev-open-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-open" "lk" z lk) (p "dev-open" "ls" z ls))-        (fact same-dev ls lk))))-  (defrule intro-same-dev-close-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-close" "lk" z lk) (p "dev-close" "ls" z ls))-        (fact same-dev ls lk))))-  (defrule intro-same-dev-pass-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-pass" "lk" z lk) (p "dev-pass" "ls" z ls))-        (fact same-dev ls lk))))-  (defrule same-dev-ls-lk-    (forall ((ls lk lk-0 locn))-      (implies-        (and (fact same-dev ls lk) (fact same-dev ls lk-0))-        (= lk lk-0))))-  (defrule same-dev-lk-ls-    (forall ((lk ls ls-0 locn))-      (implies-        (and (fact same-dev ls lk) (fact same-dev ls-0 lk))-        (= ls ls-0))))-  (defrule single-thread-up-up-    (forall ((x y strd) (lk locn))-      (implies-        (and (p "dev-up" x (idx 5)) (p "dev-up" y (idx 5))-          (p "dev-up" "lk" x lk) (p "dev-up" "lk" y lk))-        (or-          (= x y)-          (prec x (idx 4) y (idx 1))-          (prec y (idx 4) x (idx 1))))))-  (defrule single-thread-up-open-    (forall ((x y strd) (ls locn))-      (implies-        (and (p "dev-up" x (idx 5)) (p "dev-open" y (idx 4))-          (p "dev-up" "ls" x ls) (p "dev-open" "ls" y ls))-        (or (prec x (idx 4) y (idx 1)) (prec y (idx 3) x (idx 1))))))-  (defrule single-thread-up-close-    (forall ((x y strd) (ls locn))-      (implies-        (and (p "dev-up" x (idx 5)) (p "dev-close" y (idx 4))-          (p "dev-up" "ls" x ls) (p "dev-close" "ls" y ls))-        (or (prec x (idx 4) y (idx 1)) (prec y (idx 3) x (idx 1))))))-  (defrule single-thread-open-open-    (forall ((x y strd) (ls locn))-      (implies-        (and (p "dev-open" x (idx 4)) (p "dev-open" y (idx 4))-          (p "dev-open" "ls" x ls) (p "dev-open" "ls" y ls))-        (or-          (= x y)-          (prec x (idx 3) y (idx 1))-          (prec y (idx 3) x (idx 1))))))-  (defrule single-thread-ls-open-close-    (forall ((x y strd) (ls locn))-      (implies-        (and (p "dev-open" x (idx 4)) (p "dev-close" y (idx 4))-          (p "dev-open" "ls" x ls) (p "dev-close" "ls" y ls))-        (or (prec x (idx 3) y (idx 1)) (prec y (idx 3) x (idx 1))))))-  (defrule single-thread-close-close-    (forall ((x y strd) (ls locn))-      (implies-        (and (p "dev-close" x (idx 4)) (p "dev-close" y (idx 4))-          (p "dev-close" "ls" x ls) (p "dev-close" "ls" y ls))-        (or-          (= x y)-          (prec x (idx 3) y (idx 1))-          (prec y (idx 3) x (idx 1))))))-  (defrule atomic-up-pass-    (forall ((x y strd) (lk locn))-      (implies-        (and (p "dev-up" x (idx 5)) (p "dev-pass" y (idx 3))-          (p "dev-up" "lk" x lk) (p "dev-pass" "lk" y lk)-          (prec x (idx 2) y (idx 1)))-        (prec x (idx 4) y (idx 1)))))-  (defrule dev-up-completes-    (forall ((x strd))-      (implies (p "dev-up" x (idx 2)) (p "dev-up" x (idx 5)))))-  (defrule dev-open-completes-    (forall ((x strd))-      (implies (p "dev-open" x (idx 2)) (p "dev-open" x (idx 4)))))-  (defrule dev-close-completes-    (forall ((x strd))-      (implies (p "dev-close" x (idx 2)) (p "dev-close" x (idx 4)))))-  (defrule dev-pass-completes-    (forall ((x strd))-      (implies (p "dev-pass" x (idx 2)) (p "dev-pass" x (idx 3)))))-  (defrule dev-up-atomic1-    (forall ((x z strd) (i1 indx))-      (implies-        (and (p "dev-up" z (idx 5)) (prec x i1 z (idx 4)))-        (or (= x z) (prec x i1 z (idx 1))))))-  (defrule dev-up-atomic2-    (forall ((x z strd) (i1 indx))-      (implies-        (and (p "dev-up" z (idx 5)) (prec z (idx 1) x i1))-        (or (= x z) (prec z (idx 4) x i1)))))-  (defrule dev-open-atomic1-    (forall ((x z strd) (i1 indx))-      (implies-        (and (p "dev-open" z (idx 4)) (prec x i1 z (idx 3)))-        (or (= x z) (prec x i1 z (idx 1))))))-  (defrule dev-open-atomic2-    (forall ((x z strd) (i1 indx))-      (implies-        (and (p "dev-open" z (idx 4)) (prec z (idx 1) x i1))-        (or (= x z) (prec z (idx 3) x i1)))))-  (defrule dev-close-atomic1-    (forall ((x z strd) (i1 indx))-      (implies-        (and (p "dev-close" z (idx 4)) (prec x i1 z (idx 3)))-        (or (= x z) (prec x i1 z (idx 1))))))-  (defrule dev-close-atomic2-    (forall ((x z strd) (i1 indx))-      (implies-        (and (p "dev-close" z (idx 4)) (prec z (idx 1) x i1))-        (or (= x z) (prec z (idx 3) x i1)))))-  (defrule dev-pass-atomic1-    (forall ((x z strd) (i1 indx))-      (implies-        (and (p "dev-pass" z (idx 3)) (prec x i1 z (idx 2)))-        (or (= x z) (prec x i1 z (idx 1))))))-  (defrule dev-pass-atomic2-    (forall ((x z strd) (i1 indx))-      (implies-        (and (p "dev-pass" z (idx 3)) (prec z (idx 1) x i1))-        (or (= x z) (prec z (idx 2) x i1)))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule discreteAfter-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule discreteBefore-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule causeRule-    (forall ((z z1 strd) (i j i1 indx))-      (implies (and (fact st-sg-str z i j) (prec z1 i1 z j))-        (or (= z z1) (prec z1 i1 z i)))))-  (defgenrule effectRule-    (forall ((z z1 strd) (i j i1 indx))-      (implies (and (fact st-sg-str z i j) (prec z i z1 i1))-        (or (= z z1) (prec z j z1 i1)))))-  (defgenrule trRl_dev-up-at-4-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 4)))))-  (defgenrule trRl_dev-up-at-3-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 3)))))-  (defgenrule trRl_dev-up-at-2-    (forall ((z strd))-      (implies (p "dev-up" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_dev-up-at-1-    (forall ((z strd))-      (implies (p "dev-up" z (idx 3)) (trans z (idx 1)))))-  (defgenrule trRl_dev-open-at-3-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-open-at-2-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 2)))))-  (defgenrule trRl_dev-close-at-3-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-close-at-2-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 2)))))-  (defgenrule st-sg-dev-up-2-    (forall ((z strd))-      (implies (p "dev-up" z (idx 3))-        (fact st-sg-str z (idx 1) (idx 2)))))-  (defgenrule st-sg-dev-up-4-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5))-        (fact st-sg-str z (idx 3) (idx 4)))))-  (defgenrule st-sg-dev-open-2-    (forall ((z strd))-      (implies (p "dev-open" z (idx 3))-        (fact st-sg-str z (idx 1) (idx 2)))))-  (defgenrule st-sg-dev-open-3-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4))-        (fact st-sg-str z (idx 1) (idx 3)))))-  (defgenrule st-sg-dev-close-2-    (forall ((z strd))-      (implies (p "dev-close" z (idx 3))-        (fact st-sg-str z (idx 1) (idx 2)))))-  (defgenrule st-sg-dev-close-3-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4))-        (fact st-sg-str z (idx 1) (idx 3)))))-  (defgenrule st-sg-dev-pass-2-    (forall ((z strd))-      (implies (p "dev-pass" z (idx 3))-        (fact st-sg-str z (idx 1) (idx 2))))))--(defskeleton atomic-open-closed-  (vars (k skey) (d o name) (start-ch chan))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (deflistener k)-  (uniq-orig k)-  (conf start-ch)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv k) (send k)))-  (label 0)-  (unrealized (0 1) (1 0))-  (preskeleton)-  (origs (k (0 0)))-  (comment "Not a skeleton"))--(defskeleton atomic-open-closed-  (vars (k skey) (d o name) (start-ch chan))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (deflistener k)-  (precedes ((0 0) (1 0)))-  (uniq-orig k)-  (conf start-ch)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv k) (send k)))-  (label 1)-  (parent 0)-  (unrealized (0 1) (1 0))-  (origs (k (0 0)))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton atomic-open-closed-  (vars (old old1 mesg) (k skey) (d o name) (pt pt-0 pt-1 pt-2 pval)-    (start-ch chan) (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (deflistener k)-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (precedes ((0 0) (2 0)) ((2 4) (1 0)))-  (uniq-orig k)-  (conf start-ch)-  (auth start-ch)-  -  -  (operation nonce-test (added-strand dev-up 3) k (1 0)-    (ch-msg start-ch (cat "power-up" d o k)))-  (strand-map 0 1)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv k) (send k))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt old))-      (stor lk (cat pt-0 "st-k" d o k)) (load ls (cat pt-1 old1))-      (stor ls (cat pt-2 "st" d o))))-  (label 2)-  (parent 1)-  (unrealized (0 1) (1 0))-  (dead)-  (comment "empty cohort"))--(comment "Nothing left to do")--(defprotocol atomic-open-closed basic-  (defrole dev-up-    (vars (k skey) (d o name) (old old1 mesg) (start-ch chan)-      (lk ls locn))-    (trace (recv start-ch (cat "power-up" d o k)) (load lk old)-      (stor lk (cat "st-k" d o k)) (load ls old1)-      (stor ls (cat "st" d o)) (send (enc "up" k)))-    (auth start-ch))-  (defrole owner-power-dev-    (vars (k skey) (d o name) (start-ch chan))-    (trace (send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    (conf start-ch))-  (defrole owner-open-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "open" d o n k)) (recv n)))-  (defrole owner-close-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "close" d o n k)) (recv n)))-  (defrole dev-open-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (recv (enc "open" d o n k)) (load lk (cat "st-k" d o k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d o o)) (send n)))-  (defrole dev-close-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (recv (enc "close" d o n k)) (load lk (cat "st-k" d o k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d o)) (send n)))-  (defrole dev-pass-    (vars (k skey) (n text) (d o name) (lk ls locn))-    (trace (recv (enc "may I pass" k)) (load lk (cat "st-k" d o k))-      (load ls (cat "st" d o o)) (send (enc "you may pass" n k)))-    (uniq-orig n))-  (defrole user-pass-    (vars (k skey))-    (trace (send (enc "may I pass" k)) (recv (enc "you may pass" k))))-  (defrule gen-state-close-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-close" z (idx 1)) (p "dev-close" "d" z d)-          (p "dev-close" "o" z o) (p "dev-close" "k" z k)-          (p "dev-close" "any" z (cat o o)))-        (gen-st (cat "st" d o o)))))-  (defrule gen-state-pass-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "d" z d)-          (p "dev-pass" "o" z o) (p "dev-pass" "k" z k))-        (gen-st (cat "st" d o o)))))-  (defrule gen-state-open-    (forall ((z strd) (d o k mesg))-      (implies-        (and (p "dev-open" "d" z d) (p "dev-open" "o" z o)-          (p "dev-open" "k" z k))-        (gen-st (cat "st-k" d o k)))))-  (defrule gen-state-close-    (forall ((z strd) (d o k mesg))-      (implies-        (and (p "dev-close" "d" z d) (p "dev-close" "o" z o)-          (p "dev-close" "k" z k))-        (gen-st (cat "st-k" d o k)))))-  (defrule gen-state-pass-    (forall ((z strd) (d o k mesg))-      (implies-        (and (p "dev-pass" "d" z d) (p "dev-pass" "o" z o)-          (p "dev-pass" "k" z k))-        (gen-st (cat "st-k" d o k)))))-  (defrule power-deliver-once-    (forall ((z1 z2 strd) (k skey))-      (implies-        (and (p "dev-up" z1 (idx 2)) (p "dev-up" z2 (idx 2))-          (p "dev-up" "k" z1 k) (p "dev-up" "k" z2 k))-        (= z1 z2))))-  (defrule intro-same-dev-up-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-up" "lk" z lk) (p "dev-up" "ls" z ls))-        (fact same-dev ls lk))))-  (defrule intro-same-dev-open-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-open" "lk" z lk) (p "dev-open" "ls" z ls))-        (fact same-dev ls lk))))-  (defrule intro-same-dev-close-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-close" "lk" z lk) (p "dev-close" "ls" z ls))-        (fact same-dev ls lk))))-  (defrule intro-same-dev-pass-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-pass" "lk" z lk) (p "dev-pass" "ls" z ls))-        (fact same-dev ls lk))))-  (defrule same-dev-ls-lk-    (forall ((ls lk lk-0 locn))-      (implies-        (and (fact same-dev ls lk) (fact same-dev ls lk-0))-        (= lk lk-0))))-  (defrule same-dev-lk-ls-    (forall ((lk ls ls-0 locn))-      (implies-        (and (fact same-dev ls lk) (fact same-dev ls-0 lk))-        (= ls ls-0))))-  (defrule single-thread-up-up-    (forall ((x y strd) (lk locn))-      (implies-        (and (p "dev-up" x (idx 5)) (p "dev-up" y (idx 5))-          (p "dev-up" "lk" x lk) (p "dev-up" "lk" y lk))-        (or-          (= x y)-          (prec x (idx 4) y (idx 1))-          (prec y (idx 4) x (idx 1))))))-  (defrule single-thread-up-open-    (forall ((x y strd) (ls locn))-      (implies-        (and (p "dev-up" x (idx 5)) (p "dev-open" y (idx 4))-          (p "dev-up" "ls" x ls) (p "dev-open" "ls" y ls))-        (or (prec x (idx 4) y (idx 1)) (prec y (idx 3) x (idx 1))))))-  (defrule single-thread-up-close-    (forall ((x y strd) (ls locn))-      (implies-        (and (p "dev-up" x (idx 5)) (p "dev-close" y (idx 4))-          (p "dev-up" "ls" x ls) (p "dev-close" "ls" y ls))-        (or (prec x (idx 4) y (idx 1)) (prec y (idx 3) x (idx 1))))))-  (defrule single-thread-open-open-    (forall ((x y strd) (ls locn))-      (implies-        (and (p "dev-open" x (idx 4)) (p "dev-open" y (idx 4))-          (p "dev-open" "ls" x ls) (p "dev-open" "ls" y ls))-        (or-          (= x y)-          (prec x (idx 3) y (idx 1))-          (prec y (idx 3) x (idx 1))))))-  (defrule single-thread-ls-open-close-    (forall ((x y strd) (ls locn))-      (implies-        (and (p "dev-open" x (idx 4)) (p "dev-close" y (idx 4))-          (p "dev-open" "ls" x ls) (p "dev-close" "ls" y ls))-        (or (prec x (idx 3) y (idx 1)) (prec y (idx 3) x (idx 1))))))-  (defrule single-thread-close-close-    (forall ((x y strd) (ls locn))-      (implies-        (and (p "dev-close" x (idx 4)) (p "dev-close" y (idx 4))-          (p "dev-close" "ls" x ls) (p "dev-close" "ls" y ls))-        (or-          (= x y)-          (prec x (idx 3) y (idx 1))-          (prec y (idx 3) x (idx 1))))))-  (defrule atomic-up-pass-    (forall ((x y strd) (lk locn))-      (implies-        (and (p "dev-up" x (idx 5)) (p "dev-pass" y (idx 3))-          (p "dev-up" "lk" x lk) (p "dev-pass" "lk" y lk)-          (prec x (idx 2) y (idx 1)))-        (prec x (idx 4) y (idx 1)))))-  (defrule dev-up-completes-    (forall ((x strd))-      (implies (p "dev-up" x (idx 2)) (p "dev-up" x (idx 5)))))-  (defrule dev-open-completes-    (forall ((x strd))-      (implies (p "dev-open" x (idx 2)) (p "dev-open" x (idx 4)))))-  (defrule dev-close-completes-    (forall ((x strd))-      (implies (p "dev-close" x (idx 2)) (p "dev-close" x (idx 4)))))-  (defrule dev-pass-completes-    (forall ((x strd))-      (implies (p "dev-pass" x (idx 2)) (p "dev-pass" x (idx 3)))))-  (defrule dev-up-atomic1-    (forall ((x z strd) (i1 indx))-      (implies-        (and (p "dev-up" z (idx 5)) (prec x i1 z (idx 4)))-        (or (= x z) (prec x i1 z (idx 1))))))-  (defrule dev-up-atomic2-    (forall ((x z strd) (i1 indx))-      (implies-        (and (p "dev-up" z (idx 5)) (prec z (idx 1) x i1))-        (or (= x z) (prec z (idx 4) x i1)))))-  (defrule dev-open-atomic1-    (forall ((x z strd) (i1 indx))-      (implies-        (and (p "dev-open" z (idx 4)) (prec x i1 z (idx 3)))-        (or (= x z) (prec x i1 z (idx 1))))))-  (defrule dev-open-atomic2-    (forall ((x z strd) (i1 indx))-      (implies-        (and (p "dev-open" z (idx 4)) (prec z (idx 1) x i1))-        (or (= x z) (prec z (idx 3) x i1)))))-  (defrule dev-close-atomic1-    (forall ((x z strd) (i1 indx))-      (implies-        (and (p "dev-close" z (idx 4)) (prec x i1 z (idx 3)))-        (or (= x z) (prec x i1 z (idx 1))))))-  (defrule dev-close-atomic2-    (forall ((x z strd) (i1 indx))-      (implies-        (and (p "dev-close" z (idx 4)) (prec z (idx 1) x i1))-        (or (= x z) (prec z (idx 3) x i1)))))-  (defrule dev-pass-atomic1-    (forall ((x z strd) (i1 indx))-      (implies-        (and (p "dev-pass" z (idx 3)) (prec x i1 z (idx 2)))-        (or (= x z) (prec x i1 z (idx 1))))))-  (defrule dev-pass-atomic2-    (forall ((x z strd) (i1 indx))-      (implies-        (and (p "dev-pass" z (idx 3)) (prec z (idx 1) x i1))-        (or (= x z) (prec z (idx 2) x i1)))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule discreteAfter-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule discreteBefore-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule causeRule-    (forall ((z z1 strd) (i j i1 indx))-      (implies (and (fact st-sg-str z i j) (prec z1 i1 z j))-        (or (= z z1) (prec z1 i1 z i)))))-  (defgenrule effectRule-    (forall ((z z1 strd) (i j i1 indx))-      (implies (and (fact st-sg-str z i j) (prec z i z1 i1))-        (or (= z z1) (prec z j z1 i1)))))-  (defgenrule trRl_dev-up-at-4-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 4)))))-  (defgenrule trRl_dev-up-at-3-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 3)))))-  (defgenrule trRl_dev-up-at-2-    (forall ((z strd))-      (implies (p "dev-up" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_dev-up-at-1-    (forall ((z strd))-      (implies (p "dev-up" z (idx 3)) (trans z (idx 1)))))-  (defgenrule trRl_dev-open-at-3-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-open-at-2-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 2)))))-  (defgenrule trRl_dev-close-at-3-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-close-at-2-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 2)))))-  (defgenrule st-sg-dev-up-2-    (forall ((z strd))-      (implies (p "dev-up" z (idx 3))-        (fact st-sg-str z (idx 1) (idx 2)))))-  (defgenrule st-sg-dev-up-4-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5))-        (fact st-sg-str z (idx 3) (idx 4)))))-  (defgenrule st-sg-dev-open-2-    (forall ((z strd))-      (implies (p "dev-open" z (idx 3))-        (fact st-sg-str z (idx 1) (idx 2)))))-  (defgenrule st-sg-dev-open-3-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4))-        (fact st-sg-str z (idx 1) (idx 3)))))-  (defgenrule st-sg-dev-close-2-    (forall ((z strd))-      (implies (p "dev-close" z (idx 3))-        (fact st-sg-str z (idx 1) (idx 2)))))-  (defgenrule st-sg-dev-close-3-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4))-        (fact st-sg-str z (idx 1) (idx 3)))))-  (defgenrule st-sg-dev-pass-2-    (forall ((z strd))-      (implies (p "dev-pass" z (idx 3))-        (fact st-sg-str z (idx 1) (idx 2))))))--(defskeleton atomic-open-closed-  (vars (k skey) (n text) (d o name) (pt pt-0 pval) (lk ls locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (uniq-orig n)-  (traces-    ((recv (enc "may I pass" k)) (load lk (cat pt "st-k" d o k))-      (load ls (cat pt-0 "st" d o o)) (send (enc "you may pass" n k))))-  (label 3)-  (realized)-  (origs (n (0 3)))-  (comment "Not closed under rules"))--(defskeleton atomic-open-closed-  (vars (k skey) (n text) (d o name) (pt pt-0 pval) (lk ls locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (uniq-orig n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  -  -  (traces-    ((recv (enc "may I pass" k)) (load lk (cat pt "st-k" d o k))-      (load ls (cat pt-0 "st" d o o)) (send (enc "you may pass" n k))))-  (label 4)-  (parent 3)-  (unrealized (0 1) (0 2))-  (origs (n (0 3)))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton atomic-open-closed-  (vars (old old1 mesg) (k skey) (n text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pval) (start-ch chan) (lk ls locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (precedes ((1 4) (0 1)))-  (uniq-orig n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (auth start-ch)-  -  (leads-to ((1 2) (0 1)))-  -  (operation channel-test (added-strand dev-up 3)-    (ch-msg lk (cat pt-1 "st-k" d o k)) (0 1))-  (strand-map 0)-  (traces-    ((recv (enc "may I pass" k)) (load lk (cat pt-1 "st-k" d o k))-      (load ls (cat pt "st" d o o)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (stor lk (cat pt-1 "st-k" d o k)) (load ls (cat pt-2 old1))-      (stor ls (cat pt-3 "st" d o))))-  (label 5)-  (parent 4)-  (unrealized (0 2) (1 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton atomic-open-closed-  (vars (old old1 mesg) (k skey) (n text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pval) (start-ch chan) (lk ls locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand owner-power-dev 1 (k k) (d d) (o o) (start-ch start-ch))-  (precedes ((1 4) (0 1)) ((2 0) (1 0)))-  (uniq-orig n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  -  (leads-to ((1 2) (0 1)))-  -  (operation channel-test (added-strand owner-power-dev 1)-    (ch-msg start-ch (cat "power-up" d o k)) (1 0))-  (strand-map 0 1)-  (traces-    ((recv (enc "may I pass" k)) (load lk (cat pt-1 "st-k" d o k))-      (load ls (cat pt "st" d o o)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (stor lk (cat pt-1 "st-k" d o k)) (load ls (cat pt-2 old1))-      (stor ls (cat pt-3 "st" d o)))-    ((send start-ch (cat "power-up" d o k))))-  (label 6)-  (parent 5)-  (unrealized (0 2))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton atomic-open-closed-  (vars (old old1 any mesg) (k k-0 skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pt-5 pval) (start-ch chan)-    (ls lk locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand owner-power-dev 1 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-open 4 (any any) (k k-0) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (precedes ((1 4) (3 1)) ((2 0) (1 0)) ((3 3) (0 1)))-  (uniq-orig n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k) (cat "st-k" d o k-0))-  (conf start-ch)-  (auth start-ch)-  -  (leads-to ((1 2) (0 1)) ((3 3) (0 2)))-  -  (operation channel-test (added-strand dev-open 4)-    (ch-msg ls (cat pt "st" d o o)) (0 2))-  (strand-map 0 1 2)-  (traces-    ((recv (enc "may I pass" k)) (load lk (cat pt-1 "st-k" d o k))-      (load ls (cat pt "st" d o o)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (stor lk (cat pt-1 "st-k" d o k)) (load ls (cat pt-2 old1))-      (stor ls (cat pt-3 "st" d o)))-    ((send start-ch (cat "power-up" d o k)))-    ((recv (enc "open" d o n-0 k-0)) (load lk (cat pt-4 "st-k" d o k-0))-      (load ls (cat pt-5 "st" d any)) (stor ls (cat pt "st" d o o))))-  (label 7)-  (parent 6)-  (seen 8)-  (seen-ops-    (8-      (operation channel-test (added-strand dev-up 3)-        (ch-msg lk (cat pt-2 "st-k" d o k)) (3 1))-      (strand-map 0 1 2 3)))-  (unrealized (3 1))-  (comment "2 in cohort - 1 not yet seen"))--(defskeleton atomic-open-closed-  (vars (old old1 any mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (start-ch chan) (ls lk locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand owner-power-dev 1 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (precedes ((1 4) (3 1)) ((2 0) (1 0)) ((3 3) (0 1)))-  (uniq-orig n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  -  (leads-to ((1 2) (0 1)) ((1 2) (3 1)) ((3 3) (0 2)))-  -  (operation channel-test (displaced 4 1 dev-up 3)-    (ch-msg lk (cat pt-5 "st-k" d o k-0)) (3 1))-  (strand-map 0 1 2 3)-  (traces-    ((recv (enc "may I pass" k)) (load lk (cat pt-1 "st-k" d o k))-      (load ls (cat pt "st" d o o)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (stor lk (cat pt-1 "st-k" d o k)) (load ls (cat pt-2 old1))-      (stor ls (cat pt-3 "st" d o)))-    ((send start-ch (cat "power-up" d o k)))-    ((recv (enc "open" d o n-0 k)) (load lk (cat pt-1 "st-k" d o k))-      (load ls (cat pt-4 "st" d any)) (stor ls (cat pt "st" d o o))))-  (label 8)-  (parent 7)-  (realized)-  (shape)-  (maps ((0) ((k k) (n n) (d d) (o o) (lk lk) (ls ls))))-  (origs (pt-1 (1 2)) (pt (3 3)) (pt-3 (1 4)) (n (0 3))))--(comment "Nothing left to do")--(defprotocol atomic-open-closed basic-  (defrole dev-up-    (vars (k skey) (d o name) (old old1 mesg) (start-ch chan)-      (lk ls locn))-    (trace (recv start-ch (cat "power-up" d o k)) (load lk old)-      (stor lk (cat "st-k" d o k)) (load ls old1)-      (stor ls (cat "st" d o)) (send (enc "up" k)))-    (auth start-ch))-  (defrole owner-power-dev-    (vars (k skey) (d o name) (start-ch chan))-    (trace (send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    (conf start-ch))-  (defrole owner-open-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "open" d o n k)) (recv n)))-  (defrole owner-close-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "close" d o n k)) (recv n)))-  (defrole dev-open-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (recv (enc "open" d o n k)) (load lk (cat "st-k" d o k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d o o)) (send n)))-  (defrole dev-close-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (recv (enc "close" d o n k)) (load lk (cat "st-k" d o k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d o)) (send n)))-  (defrole dev-pass-    (vars (k skey) (n text) (d o name) (lk ls locn))-    (trace (recv (enc "may I pass" k)) (load lk (cat "st-k" d o k))-      (load ls (cat "st" d o o)) (send (enc "you may pass" n k)))-    (uniq-orig n))-  (defrole user-pass-    (vars (k skey))-    (trace (send (enc "may I pass" k)) (recv (enc "you may pass" k))))-  (defrule gen-state-close-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-close" z (idx 1)) (p "dev-close" "d" z d)-          (p "dev-close" "o" z o) (p "dev-close" "k" z k)-          (p "dev-close" "any" z (cat o o)))-        (gen-st (cat "st" d o o)))))-  (defrule gen-state-pass-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "d" z d)-          (p "dev-pass" "o" z o) (p "dev-pass" "k" z k))-        (gen-st (cat "st" d o o)))))-  (defrule gen-state-open-    (forall ((z strd) (d o k mesg))-      (implies-        (and (p "dev-open" "d" z d) (p "dev-open" "o" z o)-          (p "dev-open" "k" z k))-        (gen-st (cat "st-k" d o k)))))-  (defrule gen-state-close-    (forall ((z strd) (d o k mesg))-      (implies-        (and (p "dev-close" "d" z d) (p "dev-close" "o" z o)-          (p "dev-close" "k" z k))-        (gen-st (cat "st-k" d o k)))))-  (defrule gen-state-pass-    (forall ((z strd) (d o k mesg))-      (implies-        (and (p "dev-pass" "d" z d) (p "dev-pass" "o" z o)-          (p "dev-pass" "k" z k))-        (gen-st (cat "st-k" d o k)))))-  (defrule power-deliver-once-    (forall ((z1 z2 strd) (k skey))-      (implies-        (and (p "dev-up" z1 (idx 2)) (p "dev-up" z2 (idx 2))-          (p "dev-up" "k" z1 k) (p "dev-up" "k" z2 k))-        (= z1 z2))))-  (defrule intro-same-dev-up-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-up" "lk" z lk) (p "dev-up" "ls" z ls))-        (fact same-dev ls lk))))-  (defrule intro-same-dev-open-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-open" "lk" z lk) (p "dev-open" "ls" z ls))-        (fact same-dev ls lk))))-  (defrule intro-same-dev-close-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-close" "lk" z lk) (p "dev-close" "ls" z ls))-        (fact same-dev ls lk))))-  (defrule intro-same-dev-pass-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-pass" "lk" z lk) (p "dev-pass" "ls" z ls))-        (fact same-dev ls lk))))-  (defrule same-dev-ls-lk-    (forall ((ls lk lk-0 locn))-      (implies-        (and (fact same-dev ls lk) (fact same-dev ls lk-0))-        (= lk lk-0))))-  (defrule same-dev-lk-ls-    (forall ((lk ls ls-0 locn))-      (implies-        (and (fact same-dev ls lk) (fact same-dev ls-0 lk))-        (= ls ls-0))))-  (defrule single-thread-up-up-    (forall ((x y strd) (lk locn))-      (implies-        (and (p "dev-up" x (idx 5)) (p "dev-up" y (idx 5))-          (p "dev-up" "lk" x lk) (p "dev-up" "lk" y lk))-        (or-          (= x y)-          (prec x (idx 4) y (idx 1))-          (prec y (idx 4) x (idx 1))))))-  (defrule single-thread-up-open-    (forall ((x y strd) (ls locn))-      (implies-        (and (p "dev-up" x (idx 5)) (p "dev-open" y (idx 4))-          (p "dev-up" "ls" x ls) (p "dev-open" "ls" y ls))-        (or (prec x (idx 4) y (idx 1)) (prec y (idx 3) x (idx 1))))))-  (defrule single-thread-up-close-    (forall ((x y strd) (ls locn))-      (implies-        (and (p "dev-up" x (idx 5)) (p "dev-close" y (idx 4))-          (p "dev-up" "ls" x ls) (p "dev-close" "ls" y ls))-        (or (prec x (idx 4) y (idx 1)) (prec y (idx 3) x (idx 1))))))-  (defrule single-thread-open-open-    (forall ((x y strd) (ls locn))-      (implies-        (and (p "dev-open" x (idx 4)) (p "dev-open" y (idx 4))-          (p "dev-open" "ls" x ls) (p "dev-open" "ls" y ls))-        (or-          (= x y)-          (prec x (idx 3) y (idx 1))-          (prec y (idx 3) x (idx 1))))))-  (defrule single-thread-ls-open-close-    (forall ((x y strd) (ls locn))-      (implies-        (and (p "dev-open" x (idx 4)) (p "dev-close" y (idx 4))-          (p "dev-open" "ls" x ls) (p "dev-close" "ls" y ls))-        (or (prec x (idx 3) y (idx 1)) (prec y (idx 3) x (idx 1))))))-  (defrule single-thread-close-close-    (forall ((x y strd) (ls locn))-      (implies-        (and (p "dev-close" x (idx 4)) (p "dev-close" y (idx 4))-          (p "dev-close" "ls" x ls) (p "dev-close" "ls" y ls))-        (or-          (= x y)-          (prec x (idx 3) y (idx 1))-          (prec y (idx 3) x (idx 1))))))-  (defrule atomic-up-pass-    (forall ((x y strd) (lk locn))-      (implies-        (and (p "dev-up" x (idx 5)) (p "dev-pass" y (idx 3))-          (p "dev-up" "lk" x lk) (p "dev-pass" "lk" y lk)-          (prec x (idx 2) y (idx 1)))-        (prec x (idx 4) y (idx 1)))))-  (defrule dev-up-completes-    (forall ((x strd))-      (implies (p "dev-up" x (idx 2)) (p "dev-up" x (idx 5)))))-  (defrule dev-open-completes-    (forall ((x strd))-      (implies (p "dev-open" x (idx 2)) (p "dev-open" x (idx 4)))))-  (defrule dev-close-completes-    (forall ((x strd))-      (implies (p "dev-close" x (idx 2)) (p "dev-close" x (idx 4)))))-  (defrule dev-pass-completes-    (forall ((x strd))-      (implies (p "dev-pass" x (idx 2)) (p "dev-pass" x (idx 3)))))-  (defrule dev-up-atomic1-    (forall ((x z strd) (i1 indx))-      (implies-        (and (p "dev-up" z (idx 5)) (prec x i1 z (idx 4)))-        (or (= x z) (prec x i1 z (idx 1))))))-  (defrule dev-up-atomic2-    (forall ((x z strd) (i1 indx))-      (implies-        (and (p "dev-up" z (idx 5)) (prec z (idx 1) x i1))-        (or (= x z) (prec z (idx 4) x i1)))))-  (defrule dev-open-atomic1-    (forall ((x z strd) (i1 indx))-      (implies-        (and (p "dev-open" z (idx 4)) (prec x i1 z (idx 3)))-        (or (= x z) (prec x i1 z (idx 1))))))-  (defrule dev-open-atomic2-    (forall ((x z strd) (i1 indx))-      (implies-        (and (p "dev-open" z (idx 4)) (prec z (idx 1) x i1))-        (or (= x z) (prec z (idx 3) x i1)))))-  (defrule dev-close-atomic1-    (forall ((x z strd) (i1 indx))-      (implies-        (and (p "dev-close" z (idx 4)) (prec x i1 z (idx 3)))-        (or (= x z) (prec x i1 z (idx 1))))))-  (defrule dev-close-atomic2-    (forall ((x z strd) (i1 indx))-      (implies-        (and (p "dev-close" z (idx 4)) (prec z (idx 1) x i1))-        (or (= x z) (prec z (idx 3) x i1)))))-  (defrule dev-pass-atomic1-    (forall ((x z strd) (i1 indx))-      (implies-        (and (p "dev-pass" z (idx 3)) (prec x i1 z (idx 2)))-        (or (= x z) (prec x i1 z (idx 1))))))-  (defrule dev-pass-atomic2-    (forall ((x z strd) (i1 indx))-      (implies-        (and (p "dev-pass" z (idx 3)) (prec z (idx 1) x i1))-        (or (= x z) (prec z (idx 2) x i1)))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule discreteAfter-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule discreteBefore-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule causeRule-    (forall ((z z1 strd) (i j i1 indx))-      (implies (and (fact st-sg-str z i j) (prec z1 i1 z j))-        (or (= z z1) (prec z1 i1 z i)))))-  (defgenrule effectRule-    (forall ((z z1 strd) (i j i1 indx))-      (implies (and (fact st-sg-str z i j) (prec z i z1 i1))-        (or (= z z1) (prec z j z1 i1)))))-  (defgenrule trRl_dev-up-at-4-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 4)))))-  (defgenrule trRl_dev-up-at-3-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 3)))))-  (defgenrule trRl_dev-up-at-2-    (forall ((z strd))-      (implies (p "dev-up" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_dev-up-at-1-    (forall ((z strd))-      (implies (p "dev-up" z (idx 3)) (trans z (idx 1)))))-  (defgenrule trRl_dev-open-at-3-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-open-at-2-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 2)))))-  (defgenrule trRl_dev-close-at-3-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-close-at-2-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 2)))))-  (defgenrule st-sg-dev-up-2-    (forall ((z strd))-      (implies (p "dev-up" z (idx 3))-        (fact st-sg-str z (idx 1) (idx 2)))))-  (defgenrule st-sg-dev-up-4-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5))-        (fact st-sg-str z (idx 3) (idx 4)))))-  (defgenrule st-sg-dev-open-2-    (forall ((z strd))-      (implies (p "dev-open" z (idx 3))-        (fact st-sg-str z (idx 1) (idx 2)))))-  (defgenrule st-sg-dev-open-3-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4))-        (fact st-sg-str z (idx 1) (idx 3)))))-  (defgenrule st-sg-dev-close-2-    (forall ((z strd))-      (implies (p "dev-close" z (idx 3))-        (fact st-sg-str z (idx 1) (idx 2)))))-  (defgenrule st-sg-dev-close-3-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4))-        (fact st-sg-str z (idx 1) (idx 3)))))-  (defgenrule st-sg-dev-pass-2-    (forall ((z strd))-      (implies (p "dev-pass" z (idx 3))-        (fact st-sg-str z (idx 1) (idx 2))))))--(defskeleton atomic-open-closed-  (vars (k skey) (n text) (d o d-0 o-0 name) (pt pt-0 pval)-    (start-ch chan) (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d-0) (o o-0) (lk lk) (ls ls))-  (uniq-orig k n)-  (conf start-ch)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv (enc "may I pass" k)) (load lk (cat pt "st-k" d-0 o-0 k))-      (load ls (cat pt-0 "st" d-0 o-0 o-0))-      (send (enc "you may pass" n k))))-  (label 9)-  (unrealized (0 1) (1 0) (1 1))-  (preskeleton)-  (origs (n (1 3)) (k (0 0)))-  (comment "Not a skeleton"))--(defskeleton atomic-open-closed-  (vars (k skey) (n text) (d o d-0 o-0 name) (pt pt-0 pval)-    (start-ch chan) (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d-0) (o o-0) (lk lk) (ls ls))-  (precedes ((0 0) (1 1)))-  (uniq-orig k n)-  (conf start-ch)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv (enc "may I pass" k)) (load lk (cat pt "st-k" d-0 o-0 k))-      (load ls (cat pt-0 "st" d-0 o-0 o-0))-      (send (enc "you may pass" n k))))-  (label 10)-  (parent 9)-  (unrealized (0 1) (1 0) (1 1))-  (origs (n (1 3)) (k (0 0)))-  (comment "Not closed under rules"))--(defskeleton atomic-open-closed-  (vars (k skey) (n text) (d o d-0 o-0 name) (pt pt-0 pval)-    (start-ch chan) (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d-0) (o o-0) (lk lk) (ls ls))-  (precedes ((0 0) (1 1)))-  (uniq-orig k n)-  (gen-st (cat "st" d-0 o-0 o-0) (cat "st-k" d-0 o-0 k))-  (conf start-ch)-  -  -  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv (enc "may I pass" k)) (load lk (cat pt "st-k" d-0 o-0 k))-      (load ls (cat pt-0 "st" d-0 o-0 o-0))-      (send (enc "you may pass" n k))))-  (label 11)-  (parent 10)-  (unrealized (0 1) (1 0) (1 1) (1 2))-  (origs (n (1 3)) (k (0 0)))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton atomic-open-closed-  (vars (k skey) (n text) (d o d-0 o-0 name) (pt pt-0 pval)-    (start-ch chan) (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d-0) (o o-0) (lk lk) (ls ls))-  (defstrand user-pass 1 (k k))-  (precedes ((0 0) (1 1)) ((2 0) (1 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d-0 o-0 o-0) (cat "st-k" d-0 o-0 k))-  (conf start-ch)-  -  -  (operation encryption-test (added-strand user-pass 1)-    (enc "may I pass" k) (1 0))-  (strand-map 0 1)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv (enc "may I pass" k)) (load lk (cat pt "st-k" d-0 o-0 k))-      (load ls (cat pt-0 "st" d-0 o-0 o-0))-      (send (enc "you may pass" n k))) ((send (enc "may I pass" k))))-  (label 12)-  (parent 11)-  (unrealized (0 1) (1 1) (1 2))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton atomic-open-closed-  (vars (k skey) (n text) (d o d-0 o-0 name) (pt pt-0 pval)-    (start-ch chan) (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d-0) (o o-0) (lk lk) (ls ls))-  (deflistener k)-  (precedes ((0 0) (2 0)) ((2 1) (1 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d-0 o-0 o-0) (cat "st-k" d-0 o-0 k))-  (conf start-ch)-  -  -  (operation encryption-test (added-listener k) (enc "may I pass" k)-    (1 0))-  (strand-map 0 1)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv (enc "may I pass" k)) (load lk (cat pt "st-k" d-0 o-0 k))-      (load ls (cat pt-0 "st" d-0 o-0 o-0))-      (send (enc "you may pass" n k))) ((recv k) (send k)))-  (label 13)-  (parent 11)-  (unrealized (0 1) (1 1) (1 2) (2 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton atomic-open-closed-  (vars (old old1 mesg) (k skey) (n text) (d o d-0 o-0 name)-    (pt pt-0 pt-1 pt-2 pt-3 pval) (start-ch start-ch-0 chan)-    (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d-0) (o o-0) (lk lk) (ls ls))-  (defstrand user-pass 1 (k k))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d-0) (o o-0)-    (start-ch start-ch-0) (lk lk) (ls ls))-  (precedes ((0 0) (3 0)) ((2 0) (1 0)) ((3 4) (1 1)))-  (uniq-orig k n)-  (gen-st (cat "st" d-0 o-0 o-0) (cat "st-k" d-0 o-0 k))-  (conf start-ch)-  (auth start-ch-0)-  -  (leads-to ((3 2) (1 1)))-  -  (operation channel-test (added-strand dev-up 3)-    (ch-msg lk (cat pt-1 "st-k" d-0 o-0 k)) (1 1))-  (strand-map 0 1 2)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv (enc "may I pass" k)) (load lk (cat pt-1 "st-k" d-0 o-0 k))-      (load ls (cat pt "st" d-0 o-0 o-0))-      (send (enc "you may pass" n k))) ((send (enc "may I pass" k)))-    ((recv start-ch-0 (cat "power-up" d-0 o-0 k))-      (load lk (cat pt-0 old)) (stor lk (cat pt-1 "st-k" d-0 o-0 k))-      (load ls (cat pt-2 old1)) (stor ls (cat pt-3 "st" d-0 o-0))))-  (label 14)-  (parent 12)-  (unrealized (0 1) (1 2) (3 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton atomic-open-closed-  (vars (old old1 mesg) (k skey) (n text) (d o d-0 o-0 name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (start-ch chan)-    (lk ls lk-0 ls-0 locn))-  (defstrand owner-power-dev 2 (k k) (d d-0) (o o-0)-    (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (deflistener k)-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d-0) (o o-0)-    (start-ch start-ch) (lk lk-0) (ls ls-0))-  (precedes ((0 0) (3 0)) ((2 1) (1 0)) ((3 4) (2 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  -  -  (operation nonce-test (added-strand dev-up 3) k (2 0)-    (ch-msg start-ch (cat "power-up" d-0 o-0 k)))-  (strand-map 0 1 2)-  (traces-    ((send start-ch (cat "power-up" d-0 o-0 k)) (recv (enc "up" k)))-    ((recv (enc "may I pass" k)) (load lk (cat pt "st-k" d o k))-      (load ls (cat pt-0 "st" d o o)) (send (enc "you may pass" n k)))-    ((recv k) (send k))-    ((recv start-ch (cat "power-up" d-0 o-0 k))-      (load lk-0 (cat pt-1 old)) (stor lk-0 (cat pt-2 "st-k" d-0 o-0 k))-      (load ls-0 (cat pt-3 old1)) (stor ls-0 (cat pt-4 "st" d-0 o-0))))-  (label 15)-  (parent 13)-  (unrealized (0 1) (1 1) (1 2) (2 0))-  (dead)-  (comment "empty cohort"))--(defskeleton atomic-open-closed-  (vars (old old1 mesg) (k skey) (n text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pval) (start-ch chan) (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand user-pass 1 (k k))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (precedes ((0 0) (3 0)) ((2 0) (1 0)) ((3 4) (1 1)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  -  (leads-to ((3 2) (1 1)))-  -  (operation channel-test (displaced 4 0 owner-power-dev 1)-    (ch-msg start-ch-0 (cat "power-up" d-0 o-0 k)) (3 0))-  (strand-map 0 1 2 3)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv (enc "may I pass" k)) (load lk (cat pt-1 "st-k" d o k))-      (load ls (cat pt "st" d o o)) (send (enc "you may pass" n k)))-    ((send (enc "may I pass" k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (stor lk (cat pt-1 "st-k" d o k)) (load ls (cat pt-2 old1))-      (stor ls (cat pt-3 "st" d o))))-  (label 16)-  (parent 14)-  (unrealized (0 1) (1 2))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton atomic-open-closed-  (vars (old old1 any mesg) (k k-0 skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pt-5 pval) (start-ch chan)-    (ls lk locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand user-pass 1 (k k))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k-0) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (precedes ((0 0) (3 0)) ((2 0) (1 0)) ((3 4) (4 1)) ((4 3) (1 1)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k) (cat "st-k" d o k-0))-  (conf start-ch)-  (auth start-ch)-  -  (leads-to ((3 2) (1 1)) ((4 3) (1 2)))-  -  (operation channel-test (added-strand dev-open 4)-    (ch-msg ls (cat pt "st" d o o)) (1 2))-  (strand-map 0 1 2 3)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv (enc "may I pass" k)) (load lk (cat pt-1 "st-k" d o k))-      (load ls (cat pt "st" d o o)) (send (enc "you may pass" n k)))-    ((send (enc "may I pass" k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (stor lk (cat pt-1 "st-k" d o k)) (load ls (cat pt-2 old1))-      (stor ls (cat pt-3 "st" d o)))-    ((recv (enc "open" d o n-0 k-0)) (load lk (cat pt-4 "st-k" d o k-0))-      (load ls (cat pt-5 "st" d any)) (stor ls (cat pt "st" d o o))))-  (label 17)-  (parent 16)-  (seen 18)-  (seen-ops-    (18-      (operation channel-test (added-strand dev-up 3)-        (ch-msg lk (cat pt-2 "st-k" d o k)) (4 1))-      (strand-map 0 1 2 3 4)))-  (unrealized (0 1) (4 1))-  (comment "2 in cohort - 1 not yet seen"))--(defskeleton atomic-open-closed-  (vars (old old1 any mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (start-ch chan) (ls lk locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand user-pass 1 (k k))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (precedes ((0 0) (3 0)) ((2 0) (1 0)) ((3 4) (4 1)) ((4 3) (1 1)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  -  (leads-to ((3 2) (1 1)) ((3 2) (4 1)) ((4 3) (1 2)))-  -  (operation channel-test (displaced 5 3 dev-up 3)-    (ch-msg lk (cat pt-5 "st-k" d o k-0)) (4 1))-  (strand-map 0 1 2 3 4)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv (enc "may I pass" k)) (load lk (cat pt-1 "st-k" d o k))-      (load ls (cat pt "st" d o o)) (send (enc "you may pass" n k)))-    ((send (enc "may I pass" k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (stor lk (cat pt-1 "st-k" d o k)) (load ls (cat pt-2 old1))-      (stor ls (cat pt-3 "st" d o)))-    ((recv (enc "open" d o n-0 k)) (load lk (cat pt-1 "st-k" d o k))-      (load ls (cat pt-4 "st" d any)) (stor ls (cat pt "st" d o o))))-  (label 18)-  (parent 17)-  (unrealized (0 1) (4 0))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton atomic-open-closed-  (vars (old old1 any mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (start-ch chan) (ls lk locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand user-pass 1 (k k))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand owner-open 1 (k k) (n n-0) (d d) (o o))-  (precedes ((0 0) (3 0)) ((2 0) (1 0)) ((3 4) (4 1)) ((4 3) (1 1))-    ((5 0) (4 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  -  (leads-to ((3 2) (1 1)) ((3 2) (4 1)) ((4 3) (1 2)))-  -  (operation encryption-test (added-strand owner-open 1)-    (enc "open" d o n-0 k) (4 0))-  (strand-map 0 1 2 3 4)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv (enc "may I pass" k)) (load lk (cat pt-1 "st-k" d o k))-      (load ls (cat pt "st" d o o)) (send (enc "you may pass" n k)))-    ((send (enc "may I pass" k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (stor lk (cat pt-1 "st-k" d o k)) (load ls (cat pt-2 old1))-      (stor ls (cat pt-3 "st" d o)))-    ((recv (enc "open" d o n-0 k)) (load lk (cat pt-1 "st-k" d o k))-      (load ls (cat pt-4 "st" d any)) (stor ls (cat pt "st" d o o)))-    ((send (enc "open" d o n-0 k))))-  (label 19)-  (parent 18)-  (seen 21)-  (seen-ops-    (21-      (operation encryption-test (added-strand dev-up 6) (enc "up" k)-        (0 1)) (strand-map 0 1 2 5 3 4)))-  (unrealized (0 1))-  (comment "3 in cohort - 2 not yet seen"))--(defskeleton atomic-open-closed-  (vars (old old1 any mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (start-ch chan) (ls lk locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand user-pass 1 (k k))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (deflistener k)-  (precedes ((0 0) (3 0)) ((0 0) (5 0)) ((2 0) (1 0)) ((3 4) (4 1))-    ((4 3) (1 1)) ((5 1) (4 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  -  (leads-to ((3 2) (1 1)) ((3 2) (4 1)) ((4 3) (1 2)))-  -  (operation encryption-test (added-listener k) (enc "open" d o n-0 k)-    (4 0))-  (strand-map 0 1 2 3 4)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv (enc "may I pass" k)) (load lk (cat pt-1 "st-k" d o k))-      (load ls (cat pt "st" d o o)) (send (enc "you may pass" n k)))-    ((send (enc "may I pass" k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (stor lk (cat pt-1 "st-k" d o k)) (load ls (cat pt-2 old1))-      (stor ls (cat pt-3 "st" d o)))-    ((recv (enc "open" d o n-0 k)) (load lk (cat pt-1 "st-k" d o k))-      (load ls (cat pt-4 "st" d any)) (stor ls (cat pt "st" d o o)))-    ((recv k) (send k)))-  (label 20)-  (parent 18)-  (seen 23)-  (seen-ops-    (23-      (operation nonce-test (added-strand dev-up 3) k (5 0)-        (ch-msg start-ch (cat "power-up" d o k)))-      (strand-map 0 1 2 3 4 5)))-  (unrealized (0 1) (5 0))-  (comment "2 in cohort - 1 not yet seen"))--(defskeleton atomic-open-closed-  (vars (any old old1 mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (start-ch chan) (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand user-pass 1 (k k))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand owner-open 1 (k k) (n n-0) (d d) (o o))-  (defstrand dev-up 6 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (precedes ((0 0) (5 0)) ((2 0) (1 0)) ((3 3) (1 1)) ((4 0) (3 0))-    ((5 4) (3 1)) ((5 5) (0 1)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  -  (leads-to ((3 3) (1 2)) ((5 2) (1 1)) ((5 2) (3 1)))-  -  (operation encryption-test (displaced 3 6 dev-up 6) (enc "up" k)-    (0 1))-  (strand-map 0 1 2 5 3 4)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv (enc "may I pass" k)) (load lk (cat pt-2 "st-k" d o k))-      (load ls (cat pt "st" d o o)) (send (enc "you may pass" n k)))-    ((send (enc "may I pass" k)))-    ((recv (enc "open" d o n-0 k)) (load lk (cat pt-2 "st-k" d o k))-      (load ls (cat pt-0 "st" d any)) (stor ls (cat pt "st" d o o)))-    ((send (enc "open" d o n-0 k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-1 old))-      (stor lk (cat pt-2 "st-k" d o k)) (load ls (cat pt-3 old1))-      (stor ls (cat pt-4 "st" d o)) (send (enc "up" k))))-  (label 21)-  (parent 19)-  (realized)-  (shape)-  (maps-    ((0 1)-      ((k k) (d d) (o o) (start-ch start-ch) (n n) (d-0 d) (o-0 o)-        (lk lk) (ls ls))))-  (origs (pt-2 (5 2)) (pt-4 (5 4)) (pt (3 3)) (n (1 3)) (k (0 0))))--(defskeleton atomic-open-closed-  (vars (old old1 any mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (start-ch chan) (ls lk locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand user-pass 1 (k k))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand owner-open 1 (k k) (n n-0) (d d) (o o))-  (deflistener k)-  (precedes ((0 0) (3 0)) ((0 0) (6 0)) ((2 0) (1 0)) ((3 4) (4 1))-    ((4 3) (1 1)) ((5 0) (4 0)) ((6 1) (0 1)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  -  (leads-to ((3 2) (1 1)) ((3 2) (4 1)) ((4 3) (1 2)))-  -  (operation encryption-test (added-listener k) (enc "up" k) (0 1))-  (strand-map 0 1 2 3 4 5)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv (enc "may I pass" k)) (load lk (cat pt-1 "st-k" d o k))-      (load ls (cat pt "st" d o o)) (send (enc "you may pass" n k)))-    ((send (enc "may I pass" k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (stor lk (cat pt-1 "st-k" d o k)) (load ls (cat pt-2 old1))-      (stor ls (cat pt-3 "st" d o)))-    ((recv (enc "open" d o n-0 k)) (load lk (cat pt-1 "st-k" d o k))-      (load ls (cat pt-4 "st" d any)) (stor ls (cat pt "st" d o o)))-    ((send (enc "open" d o n-0 k))) ((recv k) (send k)))-  (label 22)-  (parent 19)-  (seen 24)-  (seen-ops-    (24-      (operation nonce-test (added-strand dev-up 3) k (6 0)-        (ch-msg start-ch (cat "power-up" d o k)))-      (strand-map 0 1 2 3 4 5 6)))-  (unrealized (6 0))-  (comment "2 in cohort - 1 not yet seen"))--(defskeleton atomic-open-closed-  (vars (old old1 any mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (start-ch chan) (ls lk locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand user-pass 1 (k k))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (deflistener k)-  (precedes ((0 0) (3 0)) ((2 0) (1 0)) ((3 4) (5 0)) ((4 3) (1 1))-    ((5 1) (4 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  -  (leads-to ((3 2) (1 1)) ((3 2) (4 1)) ((4 3) (1 2)))-  -  (operation nonce-test (displaced 6 3 dev-up 3) k (5 0)-    (ch-msg start-ch (cat "power-up" d o k)))-  (strand-map 0 1 2 3 4 5)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv (enc "may I pass" k)) (load lk (cat pt-1 "st-k" d o k))-      (load ls (cat pt "st" d o o)) (send (enc "you may pass" n k)))-    ((send (enc "may I pass" k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (stor lk (cat pt-1 "st-k" d o k)) (load ls (cat pt-2 old1))-      (stor ls (cat pt-3 "st" d o)))-    ((recv (enc "open" d o n-0 k)) (load lk (cat pt-1 "st-k" d o k))-      (load ls (cat pt-4 "st" d any)) (stor ls (cat pt "st" d o o)))-    ((recv k) (send k)))-  (label 23)-  (parent 20)-  (unrealized (0 1) (5 0))-  (dead)-  (comment "empty cohort"))--(defskeleton atomic-open-closed-  (vars (old old1 any mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (start-ch chan) (ls lk locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand user-pass 1 (k k))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand owner-open 1 (k k) (n n-0) (d d) (o o))-  (deflistener k)-  (precedes ((0 0) (3 0)) ((2 0) (1 0)) ((3 4) (4 1)) ((3 4) (6 0))-    ((4 3) (1 1)) ((5 0) (4 0)) ((6 1) (0 1)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  -  (leads-to ((3 2) (1 1)) ((3 2) (4 1)) ((4 3) (1 2)))-  -  (operation nonce-test (displaced 7 3 dev-up 3) k (6 0)-    (ch-msg start-ch (cat "power-up" d o k)))-  (strand-map 0 1 2 3 4 5 6)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv (enc "may I pass" k)) (load lk (cat pt-1 "st-k" d o k))-      (load ls (cat pt "st" d o o)) (send (enc "you may pass" n k)))-    ((send (enc "may I pass" k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (stor lk (cat pt-1 "st-k" d o k)) (load ls (cat pt-2 old1))-      (stor ls (cat pt-3 "st" d o)))-    ((recv (enc "open" d o n-0 k)) (load lk (cat pt-1 "st-k" d o k))-      (load ls (cat pt-4 "st" d any)) (stor ls (cat pt "st" d o o)))-    ((send (enc "open" d o n-0 k))) ((recv k) (send k)))-  (label 24)-  (parent 22)-  (unrealized (6 0))-  (dead)-  (comment "empty cohort"))--(comment "Nothing left to do")
− tst/defact-atomic-open-closed_shapes.tst 
@@ -1,968 +0,0 @@-(comment "CPSA 4.4.5")-(comment "Extracted shapes")--(herald atomic-open-closed (bound 44))--(comment "CPSA 4.4.5")--(comment "All input read from tst/atomic-open-closed.scm")--(comment "Strand count bounded at 44")--(defprotocol atomic-open-closed basic-  (defrole dev-up-    (vars (k skey) (d o name) (old old1 mesg) (start-ch chan)-      (lk ls locn))-    (trace (recv start-ch (cat "power-up" d o k)) (load lk old)-      (stor lk (cat "st-k" d o k)) (load ls old1)-      (stor ls (cat "st" d o)) (send (enc "up" k)))-    (auth start-ch))-  (defrole owner-power-dev-    (vars (k skey) (d o name) (start-ch chan))-    (trace (send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    (conf start-ch))-  (defrole owner-open-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "open" d o n k)) (recv n)))-  (defrole owner-close-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "close" d o n k)) (recv n)))-  (defrole dev-open-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (recv (enc "open" d o n k)) (load lk (cat "st-k" d o k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d o o)) (send n)))-  (defrole dev-close-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (recv (enc "close" d o n k)) (load lk (cat "st-k" d o k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d o)) (send n)))-  (defrole dev-pass-    (vars (k skey) (n text) (d o name) (lk ls locn))-    (trace (recv (enc "may I pass" k)) (load lk (cat "st-k" d o k))-      (load ls (cat "st" d o o)) (send (enc "you may pass" n k)))-    (uniq-orig n))-  (defrole user-pass-    (vars (k skey))-    (trace (send (enc "may I pass" k)) (recv (enc "you may pass" k))))-  (defrule gen-state-close-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-close" z (idx 1)) (p "dev-close" "d" z d)-          (p "dev-close" "o" z o) (p "dev-close" "k" z k)-          (p "dev-close" "any" z (cat o o)))-        (gen-st (cat "st" d o o)))))-  (defrule gen-state-pass-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "d" z d)-          (p "dev-pass" "o" z o) (p "dev-pass" "k" z k))-        (gen-st (cat "st" d o o)))))-  (defrule gen-state-open-    (forall ((z strd) (d o k mesg))-      (implies-        (and (p "dev-open" "d" z d) (p "dev-open" "o" z o)-          (p "dev-open" "k" z k))-        (gen-st (cat "st-k" d o k)))))-  (defrule gen-state-close-    (forall ((z strd) (d o k mesg))-      (implies-        (and (p "dev-close" "d" z d) (p "dev-close" "o" z o)-          (p "dev-close" "k" z k))-        (gen-st (cat "st-k" d o k)))))-  (defrule gen-state-pass-    (forall ((z strd) (d o k mesg))-      (implies-        (and (p "dev-pass" "d" z d) (p "dev-pass" "o" z o)-          (p "dev-pass" "k" z k))-        (gen-st (cat "st-k" d o k)))))-  (defrule power-deliver-once-    (forall ((z1 z2 strd) (k skey))-      (implies-        (and (p "dev-up" z1 (idx 2)) (p "dev-up" z2 (idx 2))-          (p "dev-up" "k" z1 k) (p "dev-up" "k" z2 k))-        (= z1 z2))))-  (defrule intro-same-dev-up-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-up" "lk" z lk) (p "dev-up" "ls" z ls))-        (fact same-dev ls lk))))-  (defrule intro-same-dev-open-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-open" "lk" z lk) (p "dev-open" "ls" z ls))-        (fact same-dev ls lk))))-  (defrule intro-same-dev-close-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-close" "lk" z lk) (p "dev-close" "ls" z ls))-        (fact same-dev ls lk))))-  (defrule intro-same-dev-pass-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-pass" "lk" z lk) (p "dev-pass" "ls" z ls))-        (fact same-dev ls lk))))-  (defrule same-dev-ls-lk-    (forall ((ls lk lk-0 locn))-      (implies-        (and (fact same-dev ls lk) (fact same-dev ls lk-0))-        (= lk lk-0))))-  (defrule same-dev-lk-ls-    (forall ((lk ls ls-0 locn))-      (implies-        (and (fact same-dev ls lk) (fact same-dev ls-0 lk))-        (= ls ls-0))))-  (defrule single-thread-up-up-    (forall ((x y strd) (lk locn))-      (implies-        (and (p "dev-up" x (idx 5)) (p "dev-up" y (idx 5))-          (p "dev-up" "lk" x lk) (p "dev-up" "lk" y lk))-        (or-          (= x y)-          (prec x (idx 4) y (idx 1))-          (prec y (idx 4) x (idx 1))))))-  (defrule single-thread-up-open-    (forall ((x y strd) (ls locn))-      (implies-        (and (p "dev-up" x (idx 5)) (p "dev-open" y (idx 4))-          (p "dev-up" "ls" x ls) (p "dev-open" "ls" y ls))-        (or (prec x (idx 4) y (idx 1)) (prec y (idx 3) x (idx 1))))))-  (defrule single-thread-up-close-    (forall ((x y strd) (ls locn))-      (implies-        (and (p "dev-up" x (idx 5)) (p "dev-close" y (idx 4))-          (p "dev-up" "ls" x ls) (p "dev-close" "ls" y ls))-        (or (prec x (idx 4) y (idx 1)) (prec y (idx 3) x (idx 1))))))-  (defrule single-thread-open-open-    (forall ((x y strd) (ls locn))-      (implies-        (and (p "dev-open" x (idx 4)) (p "dev-open" y (idx 4))-          (p "dev-open" "ls" x ls) (p "dev-open" "ls" y ls))-        (or-          (= x y)-          (prec x (idx 3) y (idx 1))-          (prec y (idx 3) x (idx 1))))))-  (defrule single-thread-ls-open-close-    (forall ((x y strd) (ls locn))-      (implies-        (and (p "dev-open" x (idx 4)) (p "dev-close" y (idx 4))-          (p "dev-open" "ls" x ls) (p "dev-close" "ls" y ls))-        (or (prec x (idx 3) y (idx 1)) (prec y (idx 3) x (idx 1))))))-  (defrule single-thread-close-close-    (forall ((x y strd) (ls locn))-      (implies-        (and (p "dev-close" x (idx 4)) (p "dev-close" y (idx 4))-          (p "dev-close" "ls" x ls) (p "dev-close" "ls" y ls))-        (or-          (= x y)-          (prec x (idx 3) y (idx 1))-          (prec y (idx 3) x (idx 1))))))-  (defrule atomic-up-pass-    (forall ((x y strd) (lk locn))-      (implies-        (and (p "dev-up" x (idx 5)) (p "dev-pass" y (idx 3))-          (p "dev-up" "lk" x lk) (p "dev-pass" "lk" y lk)-          (prec x (idx 2) y (idx 1)))-        (prec x (idx 4) y (idx 1)))))-  (defrule dev-up-completes-    (forall ((x strd))-      (implies (p "dev-up" x (idx 2)) (p "dev-up" x (idx 5)))))-  (defrule dev-open-completes-    (forall ((x strd))-      (implies (p "dev-open" x (idx 2)) (p "dev-open" x (idx 4)))))-  (defrule dev-close-completes-    (forall ((x strd))-      (implies (p "dev-close" x (idx 2)) (p "dev-close" x (idx 4)))))-  (defrule dev-pass-completes-    (forall ((x strd))-      (implies (p "dev-pass" x (idx 2)) (p "dev-pass" x (idx 3)))))-  (defrule dev-up-atomic1-    (forall ((x z strd) (i1 indx))-      (implies-        (and (p "dev-up" z (idx 5)) (prec x i1 z (idx 4)))-        (or (= x z) (prec x i1 z (idx 1))))))-  (defrule dev-up-atomic2-    (forall ((x z strd) (i1 indx))-      (implies-        (and (p "dev-up" z (idx 5)) (prec z (idx 1) x i1))-        (or (= x z) (prec z (idx 4) x i1)))))-  (defrule dev-open-atomic1-    (forall ((x z strd) (i1 indx))-      (implies-        (and (p "dev-open" z (idx 4)) (prec x i1 z (idx 3)))-        (or (= x z) (prec x i1 z (idx 1))))))-  (defrule dev-open-atomic2-    (forall ((x z strd) (i1 indx))-      (implies-        (and (p "dev-open" z (idx 4)) (prec z (idx 1) x i1))-        (or (= x z) (prec z (idx 3) x i1)))))-  (defrule dev-close-atomic1-    (forall ((x z strd) (i1 indx))-      (implies-        (and (p "dev-close" z (idx 4)) (prec x i1 z (idx 3)))-        (or (= x z) (prec x i1 z (idx 1))))))-  (defrule dev-close-atomic2-    (forall ((x z strd) (i1 indx))-      (implies-        (and (p "dev-close" z (idx 4)) (prec z (idx 1) x i1))-        (or (= x z) (prec z (idx 3) x i1)))))-  (defrule dev-pass-atomic1-    (forall ((x z strd) (i1 indx))-      (implies-        (and (p "dev-pass" z (idx 3)) (prec x i1 z (idx 2)))-        (or (= x z) (prec x i1 z (idx 1))))))-  (defrule dev-pass-atomic2-    (forall ((x z strd) (i1 indx))-      (implies-        (and (p "dev-pass" z (idx 3)) (prec z (idx 1) x i1))-        (or (= x z) (prec z (idx 2) x i1)))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule discreteAfter-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule discreteBefore-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule trRl_dev-up-at-4-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 4)))))-  (defgenrule trRl_dev-up-at-3-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 3)))))-  (defgenrule trRl_dev-up-at-2-    (forall ((z strd))-      (implies (p "dev-up" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_dev-up-at-1-    (forall ((z strd))-      (implies (p "dev-up" z (idx 3)) (trans z (idx 1)))))-  (defgenrule trRl_dev-open-at-3-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-open-at-2-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 2)))))-  (defgenrule trRl_dev-close-at-3-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-close-at-2-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 2)))))-  (defgenrule cau-dev-open-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-open" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1))))))-  (defgenrule cau-dev-close-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-close" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1))))))-  (defgenrule cau-dev-pass-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-pass" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1)))))))--(defskeleton atomic-open-closed-  (vars (k skey) (d o name) (start-ch chan))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (deflistener k)-  (uniq-orig k)-  (conf start-ch)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv k) (send k)))-  (label 0)-  (unrealized (0 1) (1 0))-  (preskeleton)-  (origs (k (0 0)))-  (comment "Not a skeleton"))--(comment "Nothing left to do")--(defprotocol atomic-open-closed basic-  (defrole dev-up-    (vars (k skey) (d o name) (old old1 mesg) (start-ch chan)-      (lk ls locn))-    (trace (recv start-ch (cat "power-up" d o k)) (load lk old)-      (stor lk (cat "st-k" d o k)) (load ls old1)-      (stor ls (cat "st" d o)) (send (enc "up" k)))-    (auth start-ch))-  (defrole owner-power-dev-    (vars (k skey) (d o name) (start-ch chan))-    (trace (send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    (conf start-ch))-  (defrole owner-open-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "open" d o n k)) (recv n)))-  (defrole owner-close-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "close" d o n k)) (recv n)))-  (defrole dev-open-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (recv (enc "open" d o n k)) (load lk (cat "st-k" d o k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d o o)) (send n)))-  (defrole dev-close-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (recv (enc "close" d o n k)) (load lk (cat "st-k" d o k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d o)) (send n)))-  (defrole dev-pass-    (vars (k skey) (n text) (d o name) (lk ls locn))-    (trace (recv (enc "may I pass" k)) (load lk (cat "st-k" d o k))-      (load ls (cat "st" d o o)) (send (enc "you may pass" n k)))-    (uniq-orig n))-  (defrole user-pass-    (vars (k skey))-    (trace (send (enc "may I pass" k)) (recv (enc "you may pass" k))))-  (defrule gen-state-close-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-close" z (idx 1)) (p "dev-close" "d" z d)-          (p "dev-close" "o" z o) (p "dev-close" "k" z k)-          (p "dev-close" "any" z (cat o o)))-        (gen-st (cat "st" d o o)))))-  (defrule gen-state-pass-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "d" z d)-          (p "dev-pass" "o" z o) (p "dev-pass" "k" z k))-        (gen-st (cat "st" d o o)))))-  (defrule gen-state-open-    (forall ((z strd) (d o k mesg))-      (implies-        (and (p "dev-open" "d" z d) (p "dev-open" "o" z o)-          (p "dev-open" "k" z k))-        (gen-st (cat "st-k" d o k)))))-  (defrule gen-state-close-    (forall ((z strd) (d o k mesg))-      (implies-        (and (p "dev-close" "d" z d) (p "dev-close" "o" z o)-          (p "dev-close" "k" z k))-        (gen-st (cat "st-k" d o k)))))-  (defrule gen-state-pass-    (forall ((z strd) (d o k mesg))-      (implies-        (and (p "dev-pass" "d" z d) (p "dev-pass" "o" z o)-          (p "dev-pass" "k" z k))-        (gen-st (cat "st-k" d o k)))))-  (defrule power-deliver-once-    (forall ((z1 z2 strd) (k skey))-      (implies-        (and (p "dev-up" z1 (idx 2)) (p "dev-up" z2 (idx 2))-          (p "dev-up" "k" z1 k) (p "dev-up" "k" z2 k))-        (= z1 z2))))-  (defrule intro-same-dev-up-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-up" "lk" z lk) (p "dev-up" "ls" z ls))-        (fact same-dev ls lk))))-  (defrule intro-same-dev-open-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-open" "lk" z lk) (p "dev-open" "ls" z ls))-        (fact same-dev ls lk))))-  (defrule intro-same-dev-close-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-close" "lk" z lk) (p "dev-close" "ls" z ls))-        (fact same-dev ls lk))))-  (defrule intro-same-dev-pass-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-pass" "lk" z lk) (p "dev-pass" "ls" z ls))-        (fact same-dev ls lk))))-  (defrule same-dev-ls-lk-    (forall ((ls lk lk-0 locn))-      (implies-        (and (fact same-dev ls lk) (fact same-dev ls lk-0))-        (= lk lk-0))))-  (defrule same-dev-lk-ls-    (forall ((lk ls ls-0 locn))-      (implies-        (and (fact same-dev ls lk) (fact same-dev ls-0 lk))-        (= ls ls-0))))-  (defrule single-thread-up-up-    (forall ((x y strd) (lk locn))-      (implies-        (and (p "dev-up" x (idx 5)) (p "dev-up" y (idx 5))-          (p "dev-up" "lk" x lk) (p "dev-up" "lk" y lk))-        (or-          (= x y)-          (prec x (idx 4) y (idx 1))-          (prec y (idx 4) x (idx 1))))))-  (defrule single-thread-up-open-    (forall ((x y strd) (ls locn))-      (implies-        (and (p "dev-up" x (idx 5)) (p "dev-open" y (idx 4))-          (p "dev-up" "ls" x ls) (p "dev-open" "ls" y ls))-        (or (prec x (idx 4) y (idx 1)) (prec y (idx 3) x (idx 1))))))-  (defrule single-thread-up-close-    (forall ((x y strd) (ls locn))-      (implies-        (and (p "dev-up" x (idx 5)) (p "dev-close" y (idx 4))-          (p "dev-up" "ls" x ls) (p "dev-close" "ls" y ls))-        (or (prec x (idx 4) y (idx 1)) (prec y (idx 3) x (idx 1))))))-  (defrule single-thread-open-open-    (forall ((x y strd) (ls locn))-      (implies-        (and (p "dev-open" x (idx 4)) (p "dev-open" y (idx 4))-          (p "dev-open" "ls" x ls) (p "dev-open" "ls" y ls))-        (or-          (= x y)-          (prec x (idx 3) y (idx 1))-          (prec y (idx 3) x (idx 1))))))-  (defrule single-thread-ls-open-close-    (forall ((x y strd) (ls locn))-      (implies-        (and (p "dev-open" x (idx 4)) (p "dev-close" y (idx 4))-          (p "dev-open" "ls" x ls) (p "dev-close" "ls" y ls))-        (or (prec x (idx 3) y (idx 1)) (prec y (idx 3) x (idx 1))))))-  (defrule single-thread-close-close-    (forall ((x y strd) (ls locn))-      (implies-        (and (p "dev-close" x (idx 4)) (p "dev-close" y (idx 4))-          (p "dev-close" "ls" x ls) (p "dev-close" "ls" y ls))-        (or-          (= x y)-          (prec x (idx 3) y (idx 1))-          (prec y (idx 3) x (idx 1))))))-  (defrule atomic-up-pass-    (forall ((x y strd) (lk locn))-      (implies-        (and (p "dev-up" x (idx 5)) (p "dev-pass" y (idx 3))-          (p "dev-up" "lk" x lk) (p "dev-pass" "lk" y lk)-          (prec x (idx 2) y (idx 1)))-        (prec x (idx 4) y (idx 1)))))-  (defrule dev-up-completes-    (forall ((x strd))-      (implies (p "dev-up" x (idx 2)) (p "dev-up" x (idx 5)))))-  (defrule dev-open-completes-    (forall ((x strd))-      (implies (p "dev-open" x (idx 2)) (p "dev-open" x (idx 4)))))-  (defrule dev-close-completes-    (forall ((x strd))-      (implies (p "dev-close" x (idx 2)) (p "dev-close" x (idx 4)))))-  (defrule dev-pass-completes-    (forall ((x strd))-      (implies (p "dev-pass" x (idx 2)) (p "dev-pass" x (idx 3)))))-  (defrule dev-up-atomic1-    (forall ((x z strd) (i1 indx))-      (implies-        (and (p "dev-up" z (idx 5)) (prec x i1 z (idx 4)))-        (or (= x z) (prec x i1 z (idx 1))))))-  (defrule dev-up-atomic2-    (forall ((x z strd) (i1 indx))-      (implies-        (and (p "dev-up" z (idx 5)) (prec z (idx 1) x i1))-        (or (= x z) (prec z (idx 4) x i1)))))-  (defrule dev-open-atomic1-    (forall ((x z strd) (i1 indx))-      (implies-        (and (p "dev-open" z (idx 4)) (prec x i1 z (idx 3)))-        (or (= x z) (prec x i1 z (idx 1))))))-  (defrule dev-open-atomic2-    (forall ((x z strd) (i1 indx))-      (implies-        (and (p "dev-open" z (idx 4)) (prec z (idx 1) x i1))-        (or (= x z) (prec z (idx 3) x i1)))))-  (defrule dev-close-atomic1-    (forall ((x z strd) (i1 indx))-      (implies-        (and (p "dev-close" z (idx 4)) (prec x i1 z (idx 3)))-        (or (= x z) (prec x i1 z (idx 1))))))-  (defrule dev-close-atomic2-    (forall ((x z strd) (i1 indx))-      (implies-        (and (p "dev-close" z (idx 4)) (prec z (idx 1) x i1))-        (or (= x z) (prec z (idx 3) x i1)))))-  (defrule dev-pass-atomic1-    (forall ((x z strd) (i1 indx))-      (implies-        (and (p "dev-pass" z (idx 3)) (prec x i1 z (idx 2)))-        (or (= x z) (prec x i1 z (idx 1))))))-  (defrule dev-pass-atomic2-    (forall ((x z strd) (i1 indx))-      (implies-        (and (p "dev-pass" z (idx 3)) (prec z (idx 1) x i1))-        (or (= x z) (prec z (idx 2) x i1)))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule discreteAfter-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule discreteBefore-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule trRl_dev-up-at-4-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 4)))))-  (defgenrule trRl_dev-up-at-3-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 3)))))-  (defgenrule trRl_dev-up-at-2-    (forall ((z strd))-      (implies (p "dev-up" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_dev-up-at-1-    (forall ((z strd))-      (implies (p "dev-up" z (idx 3)) (trans z (idx 1)))))-  (defgenrule trRl_dev-open-at-3-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-open-at-2-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 2)))))-  (defgenrule trRl_dev-close-at-3-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-close-at-2-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 2)))))-  (defgenrule cau-dev-open-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-open" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1))))))-  (defgenrule cau-dev-close-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-close" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1))))))-  (defgenrule cau-dev-pass-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-pass" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1)))))))--(defskeleton atomic-open-closed-  (vars (k skey) (n text) (d o name) (pt pt-0 pval) (lk ls locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (uniq-orig n)-  (traces-    ((recv (enc "may I pass" k)) (load lk (cat pt "st-k" d o k))-      (load ls (cat pt-0 "st" d o o)) (send (enc "you may pass" n k))))-  (label 3)-  (realized)-  (origs (n (0 3)))-  (comment "Not closed under rules"))--(defskeleton atomic-open-closed-  (vars (old old1 any mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (start-ch chan) (ls lk locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand owner-power-dev 1 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (precedes ((1 4) (3 1)) ((2 0) (1 0)) ((3 3) (0 1)))-  (uniq-orig n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  (leads-to ((1 2) (0 1)) ((1 2) (3 1)) ((3 3) (0 2)))-  (operation channel-test (displaced 4 1 dev-up 3)-    (ch-msg lk (cat pt-5 "st-k" d o k-0)) (3 1))-  (strand-map 0 1 2 3)-  (traces-    ((recv (enc "may I pass" k)) (load lk (cat pt-1 "st-k" d o k))-      (load ls (cat pt "st" d o o)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (stor lk (cat pt-1 "st-k" d o k)) (load ls (cat pt-2 old1))-      (stor ls (cat pt-3 "st" d o)))-    ((send start-ch (cat "power-up" d o k)))-    ((recv (enc "open" d o n-0 k)) (load lk (cat pt-1 "st-k" d o k))-      (load ls (cat pt-4 "st" d any)) (stor ls (cat pt "st" d o o))))-  (label 8)-  (parent 3)-  (realized)-  (shape)-  (maps ((0) ((k k) (n n) (d d) (o o) (lk lk) (ls ls))))-  (origs (pt-1 (1 2)) (pt (3 3)) (pt-3 (1 4)) (n (0 3))))--(comment "Nothing left to do")--(defprotocol atomic-open-closed basic-  (defrole dev-up-    (vars (k skey) (d o name) (old old1 mesg) (start-ch chan)-      (lk ls locn))-    (trace (recv start-ch (cat "power-up" d o k)) (load lk old)-      (stor lk (cat "st-k" d o k)) (load ls old1)-      (stor ls (cat "st" d o)) (send (enc "up" k)))-    (auth start-ch))-  (defrole owner-power-dev-    (vars (k skey) (d o name) (start-ch chan))-    (trace (send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    (conf start-ch))-  (defrole owner-open-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "open" d o n k)) (recv n)))-  (defrole owner-close-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "close" d o n k)) (recv n)))-  (defrole dev-open-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (recv (enc "open" d o n k)) (load lk (cat "st-k" d o k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d o o)) (send n)))-  (defrole dev-close-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (recv (enc "close" d o n k)) (load lk (cat "st-k" d o k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d o)) (send n)))-  (defrole dev-pass-    (vars (k skey) (n text) (d o name) (lk ls locn))-    (trace (recv (enc "may I pass" k)) (load lk (cat "st-k" d o k))-      (load ls (cat "st" d o o)) (send (enc "you may pass" n k)))-    (uniq-orig n))-  (defrole user-pass-    (vars (k skey))-    (trace (send (enc "may I pass" k)) (recv (enc "you may pass" k))))-  (defrule gen-state-close-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-close" z (idx 1)) (p "dev-close" "d" z d)-          (p "dev-close" "o" z o) (p "dev-close" "k" z k)-          (p "dev-close" "any" z (cat o o)))-        (gen-st (cat "st" d o o)))))-  (defrule gen-state-pass-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "d" z d)-          (p "dev-pass" "o" z o) (p "dev-pass" "k" z k))-        (gen-st (cat "st" d o o)))))-  (defrule gen-state-open-    (forall ((z strd) (d o k mesg))-      (implies-        (and (p "dev-open" "d" z d) (p "dev-open" "o" z o)-          (p "dev-open" "k" z k))-        (gen-st (cat "st-k" d o k)))))-  (defrule gen-state-close-    (forall ((z strd) (d o k mesg))-      (implies-        (and (p "dev-close" "d" z d) (p "dev-close" "o" z o)-          (p "dev-close" "k" z k))-        (gen-st (cat "st-k" d o k)))))-  (defrule gen-state-pass-    (forall ((z strd) (d o k mesg))-      (implies-        (and (p "dev-pass" "d" z d) (p "dev-pass" "o" z o)-          (p "dev-pass" "k" z k))-        (gen-st (cat "st-k" d o k)))))-  (defrule power-deliver-once-    (forall ((z1 z2 strd) (k skey))-      (implies-        (and (p "dev-up" z1 (idx 2)) (p "dev-up" z2 (idx 2))-          (p "dev-up" "k" z1 k) (p "dev-up" "k" z2 k))-        (= z1 z2))))-  (defrule intro-same-dev-up-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-up" "lk" z lk) (p "dev-up" "ls" z ls))-        (fact same-dev ls lk))))-  (defrule intro-same-dev-open-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-open" "lk" z lk) (p "dev-open" "ls" z ls))-        (fact same-dev ls lk))))-  (defrule intro-same-dev-close-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-close" "lk" z lk) (p "dev-close" "ls" z ls))-        (fact same-dev ls lk))))-  (defrule intro-same-dev-pass-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-pass" "lk" z lk) (p "dev-pass" "ls" z ls))-        (fact same-dev ls lk))))-  (defrule same-dev-ls-lk-    (forall ((ls lk lk-0 locn))-      (implies-        (and (fact same-dev ls lk) (fact same-dev ls lk-0))-        (= lk lk-0))))-  (defrule same-dev-lk-ls-    (forall ((lk ls ls-0 locn))-      (implies-        (and (fact same-dev ls lk) (fact same-dev ls-0 lk))-        (= ls ls-0))))-  (defrule single-thread-up-up-    (forall ((x y strd) (lk locn))-      (implies-        (and (p "dev-up" x (idx 5)) (p "dev-up" y (idx 5))-          (p "dev-up" "lk" x lk) (p "dev-up" "lk" y lk))-        (or-          (= x y)-          (prec x (idx 4) y (idx 1))-          (prec y (idx 4) x (idx 1))))))-  (defrule single-thread-up-open-    (forall ((x y strd) (ls locn))-      (implies-        (and (p "dev-up" x (idx 5)) (p "dev-open" y (idx 4))-          (p "dev-up" "ls" x ls) (p "dev-open" "ls" y ls))-        (or (prec x (idx 4) y (idx 1)) (prec y (idx 3) x (idx 1))))))-  (defrule single-thread-up-close-    (forall ((x y strd) (ls locn))-      (implies-        (and (p "dev-up" x (idx 5)) (p "dev-close" y (idx 4))-          (p "dev-up" "ls" x ls) (p "dev-close" "ls" y ls))-        (or (prec x (idx 4) y (idx 1)) (prec y (idx 3) x (idx 1))))))-  (defrule single-thread-open-open-    (forall ((x y strd) (ls locn))-      (implies-        (and (p "dev-open" x (idx 4)) (p "dev-open" y (idx 4))-          (p "dev-open" "ls" x ls) (p "dev-open" "ls" y ls))-        (or-          (= x y)-          (prec x (idx 3) y (idx 1))-          (prec y (idx 3) x (idx 1))))))-  (defrule single-thread-ls-open-close-    (forall ((x y strd) (ls locn))-      (implies-        (and (p "dev-open" x (idx 4)) (p "dev-close" y (idx 4))-          (p "dev-open" "ls" x ls) (p "dev-close" "ls" y ls))-        (or (prec x (idx 3) y (idx 1)) (prec y (idx 3) x (idx 1))))))-  (defrule single-thread-close-close-    (forall ((x y strd) (ls locn))-      (implies-        (and (p "dev-close" x (idx 4)) (p "dev-close" y (idx 4))-          (p "dev-close" "ls" x ls) (p "dev-close" "ls" y ls))-        (or-          (= x y)-          (prec x (idx 3) y (idx 1))-          (prec y (idx 3) x (idx 1))))))-  (defrule atomic-up-pass-    (forall ((x y strd) (lk locn))-      (implies-        (and (p "dev-up" x (idx 5)) (p "dev-pass" y (idx 3))-          (p "dev-up" "lk" x lk) (p "dev-pass" "lk" y lk)-          (prec x (idx 2) y (idx 1)))-        (prec x (idx 4) y (idx 1)))))-  (defrule dev-up-completes-    (forall ((x strd))-      (implies (p "dev-up" x (idx 2)) (p "dev-up" x (idx 5)))))-  (defrule dev-open-completes-    (forall ((x strd))-      (implies (p "dev-open" x (idx 2)) (p "dev-open" x (idx 4)))))-  (defrule dev-close-completes-    (forall ((x strd))-      (implies (p "dev-close" x (idx 2)) (p "dev-close" x (idx 4)))))-  (defrule dev-pass-completes-    (forall ((x strd))-      (implies (p "dev-pass" x (idx 2)) (p "dev-pass" x (idx 3)))))-  (defrule dev-up-atomic1-    (forall ((x z strd) (i1 indx))-      (implies-        (and (p "dev-up" z (idx 5)) (prec x i1 z (idx 4)))-        (or (= x z) (prec x i1 z (idx 1))))))-  (defrule dev-up-atomic2-    (forall ((x z strd) (i1 indx))-      (implies-        (and (p "dev-up" z (idx 5)) (prec z (idx 1) x i1))-        (or (= x z) (prec z (idx 4) x i1)))))-  (defrule dev-open-atomic1-    (forall ((x z strd) (i1 indx))-      (implies-        (and (p "dev-open" z (idx 4)) (prec x i1 z (idx 3)))-        (or (= x z) (prec x i1 z (idx 1))))))-  (defrule dev-open-atomic2-    (forall ((x z strd) (i1 indx))-      (implies-        (and (p "dev-open" z (idx 4)) (prec z (idx 1) x i1))-        (or (= x z) (prec z (idx 3) x i1)))))-  (defrule dev-close-atomic1-    (forall ((x z strd) (i1 indx))-      (implies-        (and (p "dev-close" z (idx 4)) (prec x i1 z (idx 3)))-        (or (= x z) (prec x i1 z (idx 1))))))-  (defrule dev-close-atomic2-    (forall ((x z strd) (i1 indx))-      (implies-        (and (p "dev-close" z (idx 4)) (prec z (idx 1) x i1))-        (or (= x z) (prec z (idx 3) x i1)))))-  (defrule dev-pass-atomic1-    (forall ((x z strd) (i1 indx))-      (implies-        (and (p "dev-pass" z (idx 3)) (prec x i1 z (idx 2)))-        (or (= x z) (prec x i1 z (idx 1))))))-  (defrule dev-pass-atomic2-    (forall ((x z strd) (i1 indx))-      (implies-        (and (p "dev-pass" z (idx 3)) (prec z (idx 1) x i1))-        (or (= x z) (prec z (idx 2) x i1)))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule discreteAfter-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule discreteBefore-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule trRl_dev-up-at-4-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 4)))))-  (defgenrule trRl_dev-up-at-3-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 3)))))-  (defgenrule trRl_dev-up-at-2-    (forall ((z strd))-      (implies (p "dev-up" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_dev-up-at-1-    (forall ((z strd))-      (implies (p "dev-up" z (idx 3)) (trans z (idx 1)))))-  (defgenrule trRl_dev-open-at-3-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-open-at-2-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 2)))))-  (defgenrule trRl_dev-close-at-3-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-close-at-2-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 2)))))-  (defgenrule cau-dev-open-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-open" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1))))))-  (defgenrule cau-dev-close-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-close" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1))))))-  (defgenrule cau-dev-pass-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-pass" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1)))))))--(defskeleton atomic-open-closed-  (vars (k skey) (n text) (d o d-0 o-0 name) (pt pt-0 pval)-    (start-ch chan) (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d-0) (o o-0) (lk lk) (ls ls))-  (uniq-orig k n)-  (conf start-ch)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv (enc "may I pass" k)) (load lk (cat pt "st-k" d-0 o-0 k))-      (load ls (cat pt-0 "st" d-0 o-0 o-0))-      (send (enc "you may pass" n k))))-  (label 9)-  (unrealized (0 1) (1 0) (1 1))-  (preskeleton)-  (origs (n (1 3)) (k (0 0)))-  (comment "Not a skeleton"))--(defskeleton atomic-open-closed-  (vars (any old old1 mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (start-ch chan) (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand user-pass 1 (k k))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand owner-open 1 (k k) (n n-0) (d d) (o o))-  (defstrand dev-up 6 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (precedes ((0 0) (5 0)) ((2 0) (1 0)) ((3 3) (1 1)) ((4 0) (3 0))-    ((5 4) (3 1)) ((5 5) (0 1)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  (leads-to ((3 3) (1 2)) ((5 2) (1 1)) ((5 2) (3 1)))-  (operation encryption-test (displaced 3 6 dev-up 6) (enc "up" k)-    (0 1))-  (strand-map 0 1 2 5 3 4)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv (enc "may I pass" k)) (load lk (cat pt-2 "st-k" d o k))-      (load ls (cat pt "st" d o o)) (send (enc "you may pass" n k)))-    ((send (enc "may I pass" k)))-    ((recv (enc "open" d o n-0 k)) (load lk (cat pt-2 "st-k" d o k))-      (load ls (cat pt-0 "st" d any)) (stor ls (cat pt "st" d o o)))-    ((send (enc "open" d o n-0 k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-1 old))-      (stor lk (cat pt-2 "st-k" d o k)) (load ls (cat pt-3 old1))-      (stor ls (cat pt-4 "st" d o)) (send (enc "up" k))))-  (label 21)-  (parent 9)-  (realized)-  (shape)-  (maps-    ((0 1)-      ((k k) (d d) (o o) (start-ch start-ch) (n n) (d-0 d) (o-0 o)-        (lk lk) (ls ls))))-  (origs (pt-2 (5 2)) (pt-4 (5 4)) (pt (3 3)) (n (1 3)) (k (0 0))))--(comment "Nothing left to do")
− tst/defact-dhstatic-state.tst 
@@ -1,2913 +0,0 @@-(herald dhstatic-state (algebra diffie-hellman) (bound 16))--(comment "CPSA 4.4.5")-(comment "All input read from tst/dhstatic-state.scm")-(comment "Strand count bounded at 16")--(defprotocol dhstatic-state diffie-hellman-  (defrole cert-    (vars (subj ca name) (serial data) (galpha mesg))-    (trace (recv (sig (cert-req subj galpha ca) (privk "sig" subj)))-      (send (sig (cert subj galpha ca serial) (privk "sig" ca))))-    (uniq-orig serial)-    (comment "Certificate Authority"))-  (defrole get-cert-    (vars (self ca name) (serial data) (ra rndx) (static-key locn)-      (ignore mesg))-    (trace-      (send (sig (cert-req self (exp (gen) ra) ca) (privk "sig" self)))-      (recv (sig (cert self (exp (gen) ra) ca serial) (privk "sig" ca)))-      (load static-key ignore)-      (stor static-key (cat "privkey" self ra serial ca)))-    (uniq-gen ra)-    (comment "Get certified"))-  (defrole init-    (vars (a b ca name) (ra rndx) (serial-a serial-b data) (alpha expt)-      (n text) (static-key locn))-    (trace (load static-key (cat "privkey" a ra serial-a ca))-      (recv-        (sig (cert b (exp (gen) alpha) ca serial-b) (privk "sig" ca)))-      (send (enc n a b serial-a serial-b (exp (gen) (mul ra alpha))))-      (recv n))-    (uniq-orig n)-    (gen-st (cat "privkey" a ra serial-a ca))-    -    (comment "Initiator is A"))-  (defrole resp-    (vars (a b ca name) (rb rndx) (serial-b serial-a data) (alpha expt)-      (n text) (static-key locn))-    (trace (load static-key (cat "privkey" b rb serial-b ca))-      (recv-        (sig (cert a (exp (gen) alpha) ca serial-a) (privk "sig" ca)))-      (recv (enc n a b serial-a serial-b (exp (gen) (mul rb alpha))))-      (send n))-    -    (gen-st (cat "privkey" b rb serial-b ca))-    (comment "Responder is B"))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule shearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule invShearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule fact-init-neq0-    (forall ((z strd) (b a name))-      (implies-        (and (p "init" z (idx 2)) (p "init" "a" z a) (p "init" "b" z b))-        (fact neq a b))))-  (defgenrule fact-resp-neq0-    (forall ((z strd) (b a name))-      (implies-        (and (p "resp" z (idx 2)) (p "resp" "a" z a) (p "resp" "b" z b))-        (fact neq a b))))-  (defgenrule trRl_get-cert-at-3-    (forall ((z strd))-      (implies (p "get-cert" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_get-cert-at-2-    (forall ((z strd))-      (implies (p "get-cert" z (idx 4)) (trans z (idx 2)))))-  (defgenrule gen-st-init-0-    (forall ((z strd) (a name) (ra rndx) (serial-a data) (ca name))-      (implies-        (and (p "init" z (idx 1)) (p "init" "ca" z ca)-          (p "init" "serial-a" z serial-a) (p "init" "ra" z ra)-          (p "init" "a" z a))-        (gen-st (cat "privkey" a ra serial-a ca)))))-  (defgenrule gen-st-resp-0-    (forall ((z strd) (b name) (rb rndx) (serial-b data) (ca name))-      (implies-        (and (p "resp" z (idx 1)) (p "resp" "ca" z ca)-          (p "resp" "serial-b" z serial-b) (p "resp" "rb" z rb)-          (p "resp" "b" z b))-        (gen-st (cat "privkey" b rb serial-b ca)))))-  (lang (cert-req (tupl 3)) (cert (tupl 4)) (sig sign)))--(defskeleton dhstatic-state-  (vars (serial-a serial-b data) (n text) (ca b a name) (pt pval)-    (static-key locn) (ra rndx) (alpha expt))-  (defstrand init 4 (serial-a serial-a) (serial-b serial-b) (n n) (a a)-    (b b) (ca ca) (static-key static-key) (ra ra) (alpha alpha))-  (non-orig (privk "sig" ca) (privk "sig" b))-  (uniq-orig n)-  (traces-    ((load static-key (cat pt "privkey" a ra serial-a ca))-      (recv-        (sig (cert b (exp (gen) alpha) ca serial-b) (privk "sig" ca)))-      (send (enc n a b serial-a serial-b (exp (gen) (mul ra alpha))))-      (recv n)))-  (label 0)-  (unrealized (0 1))-  (origs (n (0 2)))-  (comment "Not closed under rules"))--(defskeleton dhstatic-state-  (vars (serial-a serial-b data) (n text) (ca b a name) (pt pval)-    (static-key locn) (ra rndx) (alpha expt))-  (defstrand init 4 (serial-a serial-a) (serial-b serial-b) (n n) (a a)-    (b b) (ca ca) (static-key static-key) (ra ra) (alpha alpha))-  (non-orig (privk "sig" ca) (privk "sig" b))-  (uniq-orig n)-  (gen-st (cat "privkey" a ra serial-a ca))-  -  -  (traces-    ((load static-key (cat pt "privkey" a ra serial-a ca))-      (recv-        (sig (cert b (exp (gen) alpha) ca serial-b) (privk "sig" ca)))-      (send (enc n a b serial-a serial-b (exp (gen) (mul ra alpha))))-      (recv n)))-  (label 1)-  (parent 0)-  (unrealized (0 0) (0 1))-  (origs (n (0 2)))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton dhstatic-state-  (vars (ignore mesg) (serial-a serial-b data) (n text) (ca b a name)-    (pt pt-0 pval) (static-key locn) (alpha expt) (ra rndx))-  (defstrand init 4 (serial-a serial-a) (serial-b serial-b) (n n) (a a)-    (b b) (ca ca) (static-key static-key) (ra ra) (alpha alpha))-  (defstrand get-cert 4 (ignore ignore) (serial serial-a) (self a)-    (ca ca) (static-key static-key) (ra ra))-  (precedes ((1 3) (0 0)))-  (non-orig (privk "sig" ca) (privk "sig" b))-  (uniq-orig n)-  (uniq-gen ra)-  (gen-st (cat "privkey" a ra serial-a ca))-  -  (leads-to ((1 3) (0 0)))-  -  (operation channel-test (added-strand get-cert 4)-    (ch-msg static-key (cat pt "privkey" a ra serial-a ca)) (0 0))-  (strand-map 0)-  (traces-    ((load static-key (cat pt "privkey" a ra serial-a ca))-      (recv-        (sig (cert b (exp (gen) alpha) ca serial-b) (privk "sig" ca)))-      (send (enc n a b serial-a serial-b (exp (gen) (mul alpha ra))))-      (recv n))-    ((send (sig (cert-req a (exp (gen) ra) ca) (privk "sig" a)))-      (recv (sig (cert a (exp (gen) ra) ca serial-a) (privk "sig" ca)))-      (load static-key (cat pt-0 ignore))-      (stor static-key (cat pt "privkey" a ra serial-a ca))))-  (label 2)-  (parent 1)-  (unrealized (0 1) (1 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton dhstatic-state-  (vars (ignore mesg) (serial-a serial-b data) (n text) (ca b a name)-    (pt pt-0 pval) (static-key locn) (alpha expt) (ra rndx))-  (defstrand init 4 (serial-a serial-a) (serial-b serial-b) (n n) (a a)-    (b b) (ca ca) (static-key static-key) (ra ra) (alpha alpha))-  (defstrand get-cert 4 (ignore ignore) (serial serial-a) (self a)-    (ca ca) (static-key static-key) (ra ra))-  (defstrand cert 2 (galpha (exp (gen) ra)) (serial serial-a) (subj a)-    (ca ca))-  (precedes ((1 0) (2 0)) ((1 3) (0 0)) ((2 1) (1 1)))-  (non-orig (privk "sig" ca) (privk "sig" b))-  (uniq-orig serial-a n)-  (uniq-gen ra)-  (gen-st (cat "privkey" a ra serial-a ca))-  -  (leads-to ((1 3) (0 0)))-  -  (operation encryption-test (added-strand cert 2)-    (sig (cert a (exp (gen) ra) ca serial-a) (privk "sig" ca)) (1 1))-  (strand-map 0 1)-  (traces-    ((load static-key (cat pt "privkey" a ra serial-a ca))-      (recv-        (sig (cert b (exp (gen) alpha) ca serial-b) (privk "sig" ca)))-      (send (enc n a b serial-a serial-b (exp (gen) (mul alpha ra))))-      (recv n))-    ((send (sig (cert-req a (exp (gen) ra) ca) (privk "sig" a)))-      (recv (sig (cert a (exp (gen) ra) ca serial-a) (privk "sig" ca)))-      (load static-key (cat pt-0 ignore))-      (stor static-key (cat pt "privkey" a ra serial-a ca)))-    ((recv (sig (cert-req a (exp (gen) ra) ca) (privk "sig" a)))-      (send-        (sig (cert a (exp (gen) ra) ca serial-a) (privk "sig" ca)))))-  (label 3)-  (parent 2)-  (unrealized (0 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton dhstatic-state-  (vars (ignore mesg) (serial-a serial-b data) (n text) (ca b a name)-    (pt pt-0 pval) (static-key locn) (alpha expt) (ra rndx))-  (defstrand init 4 (serial-a serial-a) (serial-b serial-b) (n n) (a a)-    (b b) (ca ca) (static-key static-key) (ra ra) (alpha alpha))-  (defstrand get-cert 4 (ignore ignore) (serial serial-a) (self a)-    (ca ca) (static-key static-key) (ra ra))-  (defstrand cert 2 (galpha (exp (gen) ra)) (serial serial-a) (subj a)-    (ca ca))-  (defstrand cert 2 (galpha (exp (gen) alpha)) (serial serial-b)-    (subj b) (ca ca))-  (precedes ((1 0) (2 0)) ((1 3) (0 0)) ((2 1) (1 1)) ((3 1) (0 1)))-  (non-orig (privk "sig" ca) (privk "sig" b))-  (uniq-orig serial-a serial-b n)-  (uniq-gen ra)-  (gen-st (cat "privkey" a ra serial-a ca))-  -  (leads-to ((1 3) (0 0)))-  -  (operation encryption-test (added-strand cert 2)-    (sig (cert b (exp (gen) alpha) ca serial-b) (privk "sig" ca)) (0 1))-  (strand-map 0 1 2)-  (traces-    ((load static-key (cat pt "privkey" a ra serial-a ca))-      (recv-        (sig (cert b (exp (gen) alpha) ca serial-b) (privk "sig" ca)))-      (send (enc n a b serial-a serial-b (exp (gen) (mul alpha ra))))-      (recv n))-    ((send (sig (cert-req a (exp (gen) ra) ca) (privk "sig" a)))-      (recv (sig (cert a (exp (gen) ra) ca serial-a) (privk "sig" ca)))-      (load static-key (cat pt-0 ignore))-      (stor static-key (cat pt "privkey" a ra serial-a ca)))-    ((recv (sig (cert-req a (exp (gen) ra) ca) (privk "sig" a)))-      (send (sig (cert a (exp (gen) ra) ca serial-a) (privk "sig" ca))))-    ((recv (sig (cert-req b (exp (gen) alpha) ca) (privk "sig" b)))-      (send-        (sig (cert b (exp (gen) alpha) ca serial-b) (privk "sig" ca)))))-  (label 4)-  (parent 3)-  (unrealized (3 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton dhstatic-state-  (vars (ignore mesg) (serial-a serial-b data) (n text) (ca b a name)-    (pt pt-0 pval) (static-key locn) (ra ra-0 rndx))-  (defstrand init 4 (serial-a serial-a) (serial-b serial-b) (n n) (a a)-    (b b) (ca ca) (static-key static-key) (ra ra) (alpha ra-0))-  (defstrand get-cert 4 (ignore ignore) (serial serial-a) (self a)-    (ca ca) (static-key static-key) (ra ra))-  (defstrand cert 2 (galpha (exp (gen) ra)) (serial serial-a) (subj a)-    (ca ca))-  (defstrand cert 2 (galpha (exp (gen) ra-0)) (serial serial-b) (subj b)-    (ca ca))-  (defstrand get-cert 1 (self b) (ca ca) (ra ra-0))-  (precedes ((1 0) (2 0)) ((1 3) (0 0)) ((2 1) (1 1)) ((3 1) (0 1))-    ((4 0) (3 0)))-  (non-orig (privk "sig" ca) (privk "sig" b))-  (uniq-orig serial-a serial-b n)-  (uniq-gen ra ra-0)-  (gen-st (cat "privkey" a ra serial-a ca))-  -  (leads-to ((1 3) (0 0)))-  -  (operation encryption-test (added-strand get-cert 1)-    (sig (cert-req b (exp (gen) ra-0) ca) (privk "sig" b)) (3 0))-  (strand-map 0 1 2 3)-  (traces-    ((load static-key (cat pt "privkey" a ra serial-a ca))-      (recv-        (sig (cert b (exp (gen) ra-0) ca serial-b) (privk "sig" ca)))-      (send (enc n a b serial-a serial-b (exp (gen) (mul ra ra-0))))-      (recv n))-    ((send (sig (cert-req a (exp (gen) ra) ca) (privk "sig" a)))-      (recv (sig (cert a (exp (gen) ra) ca serial-a) (privk "sig" ca)))-      (load static-key (cat pt-0 ignore))-      (stor static-key (cat pt "privkey" a ra serial-a ca)))-    ((recv (sig (cert-req a (exp (gen) ra) ca) (privk "sig" a)))-      (send (sig (cert a (exp (gen) ra) ca serial-a) (privk "sig" ca))))-    ((recv (sig (cert-req b (exp (gen) ra-0) ca) (privk "sig" b)))-      (send-        (sig (cert b (exp (gen) ra-0) ca serial-b) (privk "sig" ca))))-    ((send (sig (cert-req b (exp (gen) ra-0) ca) (privk "sig" b)))))-  (label 5)-  (parent 4)-  (unrealized (0 3))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton dhstatic-state-  (vars (ignore mesg) (serial-a serial-b data) (n text)-    (ca b a ca-0 name) (pt pt-0 pt-1 pval)-    (static-key static-key-0 locn) (ra ra-0 rb rndx))-  (defstrand init 4 (serial-a serial-a) (serial-b serial-b) (n n) (a a)-    (b b) (ca ca) (static-key static-key) (ra ra) (alpha ra-0))-  (defstrand get-cert 4 (ignore ignore) (serial serial-a) (self a)-    (ca ca) (static-key static-key) (ra ra))-  (defstrand cert 2 (galpha (exp (gen) ra)) (serial serial-a) (subj a)-    (ca ca))-  (defstrand cert 2 (galpha (exp (gen) ra-0)) (serial serial-b) (subj b)-    (ca ca))-  (defstrand get-cert 1 (self b) (ca ca) (ra ra-0))-  (defstrand resp 4 (serial-b serial-b) (serial-a serial-a) (n n) (a a)-    (b b) (ca ca-0) (static-key static-key-0) (rb rb)-    (alpha (mul ra ra-0 (rec rb))))-  (precedes ((0 2) (5 2)) ((1 0) (2 0)) ((1 3) (0 0)) ((2 1) (1 1))-    ((2 1) (5 1)) ((3 1) (0 1)) ((3 1) (5 0)) ((4 0) (3 0))-    ((5 3) (0 3)))-  (non-orig (privk "sig" ca) (privk "sig" b))-  (uniq-orig serial-a serial-b n)-  (uniq-gen ra ra-0)-  (gen-st (cat "privkey" b rb serial-b ca-0)-    (cat "privkey" a ra serial-a ca))-  -  (leads-to ((1 3) (0 0)))-  -  (operation nonce-test (added-strand resp 4) n (0 3)-    (enc n a b serial-a serial-b (exp (gen) (mul ra ra-0))))-  (strand-map 0 1 2 3 4)-  (traces-    ((load static-key (cat pt "privkey" a ra serial-a ca))-      (recv-        (sig (cert b (exp (gen) ra-0) ca serial-b) (privk "sig" ca)))-      (send (enc n a b serial-a serial-b (exp (gen) (mul ra ra-0))))-      (recv n))-    ((send (sig (cert-req a (exp (gen) ra) ca) (privk "sig" a)))-      (recv (sig (cert a (exp (gen) ra) ca serial-a) (privk "sig" ca)))-      (load static-key (cat pt-0 ignore))-      (stor static-key (cat pt "privkey" a ra serial-a ca)))-    ((recv (sig (cert-req a (exp (gen) ra) ca) (privk "sig" a)))-      (send (sig (cert a (exp (gen) ra) ca serial-a) (privk "sig" ca))))-    ((recv (sig (cert-req b (exp (gen) ra-0) ca) (privk "sig" b)))-      (send-        (sig (cert b (exp (gen) ra-0) ca serial-b) (privk "sig" ca))))-    ((send (sig (cert-req b (exp (gen) ra-0) ca) (privk "sig" b))))-    ((load static-key-0 (cat pt-1 "privkey" b rb serial-b ca-0))-      (recv-        (sig (cert a (exp (gen) (mul ra ra-0 (rec rb))) ca-0 serial-a)-          (privk "sig" ca-0)))-      (recv (enc n a b serial-a serial-b (exp (gen) (mul ra ra-0))))-      (send n)))-  (label 6)-  (parent 5)-  (unrealized (5 0) (5 1))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton dhstatic-state-  (vars (ignore mesg) (serial-a serial-b data) (n text) (ca b a name)-    (pt pt-0 pval) (static-key locn) (ra ra-0 rndx))-  (defstrand init 4 (serial-a serial-a) (serial-b serial-b) (n n) (a a)-    (b b) (ca ca) (static-key static-key) (ra ra) (alpha ra-0))-  (defstrand get-cert 4 (ignore ignore) (serial serial-a) (self a)-    (ca ca) (static-key static-key) (ra ra))-  (defstrand cert 2 (galpha (exp (gen) ra)) (serial serial-a) (subj a)-    (ca ca))-  (defstrand cert 2 (galpha (exp (gen) ra-0)) (serial serial-b) (subj b)-    (ca ca))-  (defstrand get-cert 1 (self b) (ca ca) (ra ra-0))-  (deflistener (exp (gen) (mul ra ra-0)))-  (precedes ((1 0) (2 0)) ((1 0) (5 0)) ((1 3) (0 0)) ((2 1) (1 1))-    ((3 1) (0 1)) ((4 0) (3 0)) ((4 0) (5 0)) ((5 1) (0 3)))-  (non-orig (privk "sig" ca) (privk "sig" b))-  (uniq-orig serial-a serial-b n)-  (uniq-gen ra ra-0)-  (gen-st (cat "privkey" a ra serial-a ca))-  -  (leads-to ((1 3) (0 0)))-  -  (operation nonce-test (added-listener (exp (gen) (mul ra ra-0))) n-    (0 3) (enc n a b serial-a serial-b (exp (gen) (mul ra ra-0))))-  (strand-map 0 1 2 3 4)-  (traces-    ((load static-key (cat pt "privkey" a ra serial-a ca))-      (recv-        (sig (cert b (exp (gen) ra-0) ca serial-b) (privk "sig" ca)))-      (send (enc n a b serial-a serial-b (exp (gen) (mul ra ra-0))))-      (recv n))-    ((send (sig (cert-req a (exp (gen) ra) ca) (privk "sig" a)))-      (recv (sig (cert a (exp (gen) ra) ca serial-a) (privk "sig" ca)))-      (load static-key (cat pt-0 ignore))-      (stor static-key (cat pt "privkey" a ra serial-a ca)))-    ((recv (sig (cert-req a (exp (gen) ra) ca) (privk "sig" a)))-      (send (sig (cert a (exp (gen) ra) ca serial-a) (privk "sig" ca))))-    ((recv (sig (cert-req b (exp (gen) ra-0) ca) (privk "sig" b)))-      (send-        (sig (cert b (exp (gen) ra-0) ca serial-b) (privk "sig" ca))))-    ((send (sig (cert-req b (exp (gen) ra-0) ca) (privk "sig" b))))-    ((recv (exp (gen) (mul ra ra-0))) (send (exp (gen) (mul ra ra-0)))))-  (label 7)-  (parent 5)-  (unrealized (5 0))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton dhstatic-state-  (vars (ignore ignore-0 mesg) (serial-a serial-b data) (n text)-    (b a ca name) (pt pt-0 pt-1 pt-2 pval)-    (static-key static-key-0 locn) (ra ra-0 rndx))-  (defstrand init 4 (serial-a serial-a) (serial-b serial-b) (n n) (a a)-    (b b) (ca ca) (static-key static-key) (ra ra) (alpha ra-0))-  (defstrand get-cert 4 (ignore ignore) (serial serial-a) (self a)-    (ca ca) (static-key static-key) (ra ra))-  (defstrand cert 2 (galpha (exp (gen) ra)) (serial serial-a) (subj a)-    (ca ca))-  (defstrand cert 2 (galpha (exp (gen) ra-0)) (serial serial-b) (subj b)-    (ca ca))-  (defstrand resp 4 (serial-b serial-b) (serial-a serial-a) (n n) (a a)-    (b b) (ca ca) (static-key static-key-0) (rb ra-0) (alpha ra))-  (defstrand get-cert 4 (ignore ignore-0) (serial serial-b) (self b)-    (ca ca) (static-key static-key-0) (ra ra-0))-  (precedes ((0 2) (4 2)) ((1 0) (2 0)) ((1 3) (0 0)) ((2 1) (1 1))-    ((2 1) (4 1)) ((3 1) (0 1)) ((3 1) (5 1)) ((4 3) (0 3))-    ((5 0) (3 0)) ((5 3) (4 0)))-  (non-orig (privk "sig" b) (privk "sig" ca))-  (uniq-orig serial-a serial-b n)-  (uniq-gen ra ra-0)-  (gen-st (cat "privkey" b ra-0 serial-b ca)-    (cat "privkey" a ra serial-a ca))-  -  (leads-to ((1 3) (0 0)) ((5 3) (4 0)))-  -  (operation channel-test (displaced 4 6 get-cert 4)-    (ch-msg static-key-0 (cat pt-1 "privkey" b ra-1 serial-b ca)) (5 0))-  (strand-map 0 1 2 3 5 4)-  (traces-    ((load static-key (cat pt "privkey" a ra serial-a ca))-      (recv-        (sig (cert b (exp (gen) ra-0) ca serial-b) (privk "sig" ca)))-      (send (enc n a b serial-a serial-b (exp (gen) (mul ra ra-0))))-      (recv n))-    ((send (sig (cert-req a (exp (gen) ra) ca) (privk "sig" a)))-      (recv (sig (cert a (exp (gen) ra) ca serial-a) (privk "sig" ca)))-      (load static-key (cat pt-0 ignore))-      (stor static-key (cat pt "privkey" a ra serial-a ca)))-    ((recv (sig (cert-req a (exp (gen) ra) ca) (privk "sig" a)))-      (send (sig (cert a (exp (gen) ra) ca serial-a) (privk "sig" ca))))-    ((recv (sig (cert-req b (exp (gen) ra-0) ca) (privk "sig" b)))-      (send-        (sig (cert b (exp (gen) ra-0) ca serial-b) (privk "sig" ca))))-    ((load static-key-0 (cat pt-1 "privkey" b ra-0 serial-b ca))-      (recv (sig (cert a (exp (gen) ra) ca serial-a) (privk "sig" ca)))-      (recv (enc n a b serial-a serial-b (exp (gen) (mul ra ra-0))))-      (send n))-    ((send (sig (cert-req b (exp (gen) ra-0) ca) (privk "sig" b)))-      (recv-        (sig (cert b (exp (gen) ra-0) ca serial-b) (privk "sig" ca)))-      (load static-key-0 (cat pt-2 ignore-0))-      (stor static-key-0 (cat pt-1 "privkey" b ra-0 serial-b ca))))-  (label 8)-  (parent 6)-  (realized)-  (shape)-  (maps-    ((0)-      ((ca ca) (b b) (a a) (ra ra) (serial-a serial-a)-        (serial-b serial-b) (alpha ra-0) (n n)-        (static-key static-key))))-  (origs (pt-1 (5 3)) (serial-b (3 1)) (serial-a (2 1)) (pt (1 3))-    (n (0 2)))-  (ugens (ra-0 (5 0)) (ra (1 0))))--(defskeleton dhstatic-state-  (vars (ignore ignore-0 mesg) (serial-a serial-b data) (n text)-    (ca b a ca-0 name) (pt pt-0 pt-1 pt-2 pval)-    (static-key static-key-0 locn) (ra ra-0 ra-1 rndx))-  (defstrand init 4 (serial-a serial-a) (serial-b serial-b) (n n) (a a)-    (b b) (ca ca) (static-key static-key) (ra ra) (alpha ra-0))-  (defstrand get-cert 4 (ignore ignore) (serial serial-a) (self a)-    (ca ca) (static-key static-key) (ra ra))-  (defstrand cert 2 (galpha (exp (gen) ra)) (serial serial-a) (subj a)-    (ca ca))-  (defstrand cert 2 (galpha (exp (gen) ra-0)) (serial serial-b) (subj b)-    (ca ca))-  (defstrand get-cert 1 (self b) (ca ca) (ra ra-0))-  (defstrand resp 4 (serial-b serial-b) (serial-a serial-a) (n n) (a a)-    (b b) (ca ca-0) (static-key static-key-0) (rb ra-1)-    (alpha (mul ra ra-0 (rec ra-1))))-  (defstrand get-cert 4 (ignore ignore-0) (serial serial-b) (self b)-    (ca ca-0) (static-key static-key-0) (ra ra-1))-  (precedes ((0 2) (5 2)) ((1 0) (2 0)) ((1 3) (0 0)) ((2 1) (1 1))-    ((2 1) (5 1)) ((3 1) (0 1)) ((3 1) (6 1)) ((4 0) (3 0))-    ((5 3) (0 3)) ((6 3) (5 0)))-  (non-orig (privk "sig" ca) (privk "sig" b))-  (uniq-orig serial-a serial-b n)-  (uniq-gen ra ra-0 ra-1)-  (gen-st (cat "privkey" b ra-1 serial-b ca-0)-    (cat "privkey" a ra serial-a ca))-  -  (leads-to ((1 3) (0 0)) ((6 3) (5 0)))-  -  (operation channel-test (added-strand get-cert 4)-    (ch-msg static-key-0 (cat pt-1 "privkey" b ra-1 serial-b ca-0))-    (5 0))-  (strand-map 0 1 2 3 4 5)-  (traces-    ((load static-key (cat pt "privkey" a ra serial-a ca))-      (recv-        (sig (cert b (exp (gen) ra-0) ca serial-b) (privk "sig" ca)))-      (send (enc n a b serial-a serial-b (exp (gen) (mul ra ra-0))))-      (recv n))-    ((send (sig (cert-req a (exp (gen) ra) ca) (privk "sig" a)))-      (recv (sig (cert a (exp (gen) ra) ca serial-a) (privk "sig" ca)))-      (load static-key (cat pt-0 ignore))-      (stor static-key (cat pt "privkey" a ra serial-a ca)))-    ((recv (sig (cert-req a (exp (gen) ra) ca) (privk "sig" a)))-      (send (sig (cert a (exp (gen) ra) ca serial-a) (privk "sig" ca))))-    ((recv (sig (cert-req b (exp (gen) ra-0) ca) (privk "sig" b)))-      (send-        (sig (cert b (exp (gen) ra-0) ca serial-b) (privk "sig" ca))))-    ((send (sig (cert-req b (exp (gen) ra-0) ca) (privk "sig" b))))-    ((load static-key-0 (cat pt-1 "privkey" b ra-1 serial-b ca-0))-      (recv-        (sig (cert a (exp (gen) (mul ra ra-0 (rec ra-1))) ca-0 serial-a)-          (privk "sig" ca-0)))-      (recv (enc n a b serial-a serial-b (exp (gen) (mul ra ra-0))))-      (send n))-    ((send (sig (cert-req b (exp (gen) ra-1) ca-0) (privk "sig" b)))-      (recv-        (sig (cert b (exp (gen) ra-1) ca-0 serial-b)-          (privk "sig" ca-0))) (load static-key-0 (cat pt-2 ignore-0))-      (stor static-key-0 (cat pt-1 "privkey" b ra-1 serial-b ca-0))))-  (label 9)-  (parent 6)-  (unrealized (5 1))-  (comment "3 in cohort - 3 not yet seen"))--(defskeleton dhstatic-state-  (vars (ignore mesg) (serial-a serial-b data) (n text) (ca b a name)-    (pt pt-0 pval) (static-key locn) (ra ra-0 rndx))-  (defstrand init 4 (serial-a serial-a) (serial-b serial-b) (n n) (a a)-    (b b) (ca ca) (static-key static-key) (ra ra) (alpha ra-0))-  (defstrand get-cert 4 (ignore ignore) (serial serial-a) (self a)-    (ca ca) (static-key static-key) (ra ra))-  (defstrand cert 2 (galpha (exp (gen) ra)) (serial serial-a) (subj a)-    (ca ca))-  (defstrand cert 2 (galpha (exp (gen) ra-0)) (serial serial-b) (subj b)-    (ca ca))-  (defstrand get-cert 1 (self b) (ca ca) (ra ra-0))-  (deflistener (exp (gen) (mul ra ra-0)))-  (deflistener (cat (exp (gen) ra) ra-0))-  (precedes ((1 0) (2 0)) ((1 0) (6 0)) ((1 3) (0 0)) ((2 1) (1 1))-    ((3 1) (0 1)) ((4 0) (3 0)) ((4 0) (6 0)) ((5 1) (0 3))-    ((6 1) (5 0)))-  (non-orig (privk "sig" ca) (privk "sig" b))-  (uniq-orig serial-a serial-b n)-  (uniq-gen ra ra-0)-  (gen-st (cat "privkey" a ra serial-a ca))-  -  (leads-to ((1 3) (0 0)))-  -  (operation nonce-test (added-listener (cat (exp (gen) ra) ra-0))-    (exp (gen) (mul ra ra-0)) (5 0))-  (strand-map 0 1 2 3 4 5)-  (traces-    ((load static-key (cat pt "privkey" a ra serial-a ca))-      (recv-        (sig (cert b (exp (gen) ra-0) ca serial-b) (privk "sig" ca)))-      (send (enc n a b serial-a serial-b (exp (gen) (mul ra ra-0))))-      (recv n))-    ((send (sig (cert-req a (exp (gen) ra) ca) (privk "sig" a)))-      (recv (sig (cert a (exp (gen) ra) ca serial-a) (privk "sig" ca)))-      (load static-key (cat pt-0 ignore))-      (stor static-key (cat pt "privkey" a ra serial-a ca)))-    ((recv (sig (cert-req a (exp (gen) ra) ca) (privk "sig" a)))-      (send (sig (cert a (exp (gen) ra) ca serial-a) (privk "sig" ca))))-    ((recv (sig (cert-req b (exp (gen) ra-0) ca) (privk "sig" b)))-      (send-        (sig (cert b (exp (gen) ra-0) ca serial-b) (privk "sig" ca))))-    ((send (sig (cert-req b (exp (gen) ra-0) ca) (privk "sig" b))))-    ((recv (exp (gen) (mul ra ra-0))) (send (exp (gen) (mul ra ra-0))))-    ((recv (cat (exp (gen) ra) ra-0)) (send (cat (exp (gen) ra) ra-0))))-  (label 10)-  (parent 7)-  (unrealized (6 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton dhstatic-state-  (vars (ignore mesg) (serial-a serial-b data) (n text) (ca b a name)-    (pt pt-0 pval) (static-key locn) (ra ra-0 rndx))-  (defstrand init 4 (serial-a serial-a) (serial-b serial-b) (n n) (a a)-    (b b) (ca ca) (static-key static-key) (ra ra) (alpha ra-0))-  (defstrand get-cert 4 (ignore ignore) (serial serial-a) (self a)-    (ca ca) (static-key static-key) (ra ra))-  (defstrand cert 2 (galpha (exp (gen) ra)) (serial serial-a) (subj a)-    (ca ca))-  (defstrand cert 2 (galpha (exp (gen) ra-0)) (serial serial-b) (subj b)-    (ca ca))-  (defstrand get-cert 1 (self b) (ca ca) (ra ra-0))-  (deflistener (exp (gen) (mul ra ra-0)))-  (deflistener (cat (exp (gen) ra-0) ra))-  (precedes ((1 0) (2 0)) ((1 0) (6 0)) ((1 3) (0 0)) ((2 1) (1 1))-    ((3 1) (0 1)) ((4 0) (3 0)) ((4 0) (6 0)) ((5 1) (0 3))-    ((6 1) (5 0)))-  (non-orig (privk "sig" ca) (privk "sig" b))-  (uniq-orig serial-a serial-b n)-  (uniq-gen ra ra-0)-  (gen-st (cat "privkey" a ra serial-a ca))-  -  (leads-to ((1 3) (0 0)))-  -  (operation nonce-test (added-listener (cat (exp (gen) ra-0) ra))-    (exp (gen) (mul ra ra-0)) (5 0))-  (strand-map 0 1 2 3 4 5)-  (traces-    ((load static-key (cat pt "privkey" a ra serial-a ca))-      (recv-        (sig (cert b (exp (gen) ra-0) ca serial-b) (privk "sig" ca)))-      (send (enc n a b serial-a serial-b (exp (gen) (mul ra ra-0))))-      (recv n))-    ((send (sig (cert-req a (exp (gen) ra) ca) (privk "sig" a)))-      (recv (sig (cert a (exp (gen) ra) ca serial-a) (privk "sig" ca)))-      (load static-key (cat pt-0 ignore))-      (stor static-key (cat pt "privkey" a ra serial-a ca)))-    ((recv (sig (cert-req a (exp (gen) ra) ca) (privk "sig" a)))-      (send (sig (cert a (exp (gen) ra) ca serial-a) (privk "sig" ca))))-    ((recv (sig (cert-req b (exp (gen) ra-0) ca) (privk "sig" b)))-      (send-        (sig (cert b (exp (gen) ra-0) ca serial-b) (privk "sig" ca))))-    ((send (sig (cert-req b (exp (gen) ra-0) ca) (privk "sig" b))))-    ((recv (exp (gen) (mul ra ra-0))) (send (exp (gen) (mul ra ra-0))))-    ((recv (cat (exp (gen) ra-0) ra)) (send (cat (exp (gen) ra-0) ra))))-  (label 11)-  (parent 7)-  (unrealized (6 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton dhstatic-state-  (vars (ignore ignore-0 mesg) (serial-a serial-b data) (n text)-    (ca b a ca-0 name) (pt pt-0 pt-1 pt-2 pval)-    (static-key static-key-0 locn) (ra ra-0 ra-1 rndx))-  (defstrand init 4 (serial-a serial-a) (serial-b serial-b) (n n) (a a)-    (b b) (ca ca) (static-key static-key) (ra ra) (alpha ra-0))-  (defstrand get-cert 4 (ignore ignore) (serial serial-a) (self a)-    (ca ca) (static-key static-key) (ra ra))-  (defstrand cert 2 (galpha (exp (gen) ra)) (serial serial-a) (subj a)-    (ca ca))-  (defstrand cert 2 (galpha (exp (gen) ra-0)) (serial serial-b) (subj b)-    (ca ca))-  (defstrand get-cert 1 (self b) (ca ca) (ra ra-0))-  (defstrand resp 4 (serial-b serial-b) (serial-a serial-a) (n n) (a a)-    (b b) (ca ca-0) (static-key static-key-0) (rb ra-1)-    (alpha (mul ra ra-0 (rec ra-1))))-  (defstrand get-cert 4 (ignore ignore-0) (serial serial-b) (self b)-    (ca ca-0) (static-key static-key-0) (ra ra-1))-  (deflistener (cat (exp (gen) (mul ra ra-0)) ra-1))-  (precedes ((0 2) (5 2)) ((1 0) (2 0)) ((1 0) (7 0)) ((1 3) (0 0))-    ((2 1) (1 1)) ((2 1) (5 1)) ((3 1) (0 1)) ((3 1) (6 1))-    ((4 0) (3 0)) ((4 0) (7 0)) ((5 3) (0 3)) ((6 0) (7 0))-    ((6 3) (5 0)) ((7 1) (5 1)))-  (non-orig (privk "sig" ca) (privk "sig" b))-  (uniq-orig serial-a serial-b n)-  (uniq-gen ra ra-0 ra-1)-  (gen-st (cat "privkey" b ra-1 serial-b ca-0)-    (cat "privkey" a ra serial-a ca))-  -  (leads-to ((1 3) (0 0)) ((6 3) (5 0)))-  -  (operation nonce-test-    (added-listener (cat (exp (gen) (mul ra ra-0)) ra-1))-    (exp (gen) (mul ra ra-0 (rec ra-1))) (5 1))-  (strand-map 0 1 2 3 4 5 6)-  (traces-    ((load static-key (cat pt "privkey" a ra serial-a ca))-      (recv-        (sig (cert b (exp (gen) ra-0) ca serial-b) (privk "sig" ca)))-      (send (enc n a b serial-a serial-b (exp (gen) (mul ra ra-0))))-      (recv n))-    ((send (sig (cert-req a (exp (gen) ra) ca) (privk "sig" a)))-      (recv (sig (cert a (exp (gen) ra) ca serial-a) (privk "sig" ca)))-      (load static-key (cat pt-0 ignore))-      (stor static-key (cat pt "privkey" a ra serial-a ca)))-    ((recv (sig (cert-req a (exp (gen) ra) ca) (privk "sig" a)))-      (send (sig (cert a (exp (gen) ra) ca serial-a) (privk "sig" ca))))-    ((recv (sig (cert-req b (exp (gen) ra-0) ca) (privk "sig" b)))-      (send-        (sig (cert b (exp (gen) ra-0) ca serial-b) (privk "sig" ca))))-    ((send (sig (cert-req b (exp (gen) ra-0) ca) (privk "sig" b))))-    ((load static-key-0 (cat pt-1 "privkey" b ra-1 serial-b ca-0))-      (recv-        (sig (cert a (exp (gen) (mul ra ra-0 (rec ra-1))) ca-0 serial-a)-          (privk "sig" ca-0)))-      (recv (enc n a b serial-a serial-b (exp (gen) (mul ra ra-0))))-      (send n))-    ((send (sig (cert-req b (exp (gen) ra-1) ca-0) (privk "sig" b)))-      (recv-        (sig (cert b (exp (gen) ra-1) ca-0 serial-b)-          (privk "sig" ca-0))) (load static-key-0 (cat pt-2 ignore-0))-      (stor static-key-0 (cat pt-1 "privkey" b ra-1 serial-b ca-0)))-    ((recv (cat (exp (gen) (mul ra ra-0)) ra-1))-      (send (cat (exp (gen) (mul ra ra-0)) ra-1))))-  (label 12)-  (parent 9)-  (unrealized (7 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton dhstatic-state-  (vars (ignore ignore-0 mesg) (serial-a serial-b data) (n text)-    (ca b a ca-0 name) (pt pt-0 pt-1 pt-2 pval)-    (static-key static-key-0 locn) (ra ra-0 ra-1 rndx))-  (defstrand init 4 (serial-a serial-a) (serial-b serial-b) (n n) (a a)-    (b b) (ca ca) (static-key static-key) (ra ra) (alpha ra-0))-  (defstrand get-cert 4 (ignore ignore) (serial serial-a) (self a)-    (ca ca) (static-key static-key) (ra ra))-  (defstrand cert 2 (galpha (exp (gen) ra)) (serial serial-a) (subj a)-    (ca ca))-  (defstrand cert 2 (galpha (exp (gen) ra-0)) (serial serial-b) (subj b)-    (ca ca))-  (defstrand get-cert 1 (self b) (ca ca) (ra ra-0))-  (defstrand resp 4 (serial-b serial-b) (serial-a serial-a) (n n) (a a)-    (b b) (ca ca-0) (static-key static-key-0) (rb ra-1)-    (alpha (mul ra ra-0 (rec ra-1))))-  (defstrand get-cert 4 (ignore ignore-0) (serial serial-b) (self b)-    (ca ca-0) (static-key static-key-0) (ra ra-1))-  (deflistener (cat (exp (gen) (mul ra (rec ra-1))) ra-0))-  (precedes ((0 2) (5 2)) ((1 0) (2 0)) ((1 0) (7 0)) ((1 3) (0 0))-    ((2 1) (1 1)) ((2 1) (5 1)) ((3 1) (0 1)) ((3 1) (6 1))-    ((4 0) (3 0)) ((4 0) (7 0)) ((5 3) (0 3)) ((6 0) (7 0))-    ((6 3) (5 0)) ((7 1) (5 1)))-  (non-orig (privk "sig" ca) (privk "sig" b))-  (uniq-orig serial-a serial-b n)-  (uniq-gen ra ra-0 ra-1)-  (gen-st (cat "privkey" b ra-1 serial-b ca-0)-    (cat "privkey" a ra serial-a ca))-  -  (leads-to ((1 3) (0 0)) ((6 3) (5 0)))-  -  (operation nonce-test-    (added-listener (cat (exp (gen) (mul ra (rec ra-1))) ra-0))-    (exp (gen) (mul ra ra-0 (rec ra-1))) (5 1))-  (strand-map 0 1 2 3 4 5 6)-  (traces-    ((load static-key (cat pt "privkey" a ra serial-a ca))-      (recv-        (sig (cert b (exp (gen) ra-0) ca serial-b) (privk "sig" ca)))-      (send (enc n a b serial-a serial-b (exp (gen) (mul ra ra-0))))-      (recv n))-    ((send (sig (cert-req a (exp (gen) ra) ca) (privk "sig" a)))-      (recv (sig (cert a (exp (gen) ra) ca serial-a) (privk "sig" ca)))-      (load static-key (cat pt-0 ignore))-      (stor static-key (cat pt "privkey" a ra serial-a ca)))-    ((recv (sig (cert-req a (exp (gen) ra) ca) (privk "sig" a)))-      (send (sig (cert a (exp (gen) ra) ca serial-a) (privk "sig" ca))))-    ((recv (sig (cert-req b (exp (gen) ra-0) ca) (privk "sig" b)))-      (send-        (sig (cert b (exp (gen) ra-0) ca serial-b) (privk "sig" ca))))-    ((send (sig (cert-req b (exp (gen) ra-0) ca) (privk "sig" b))))-    ((load static-key-0 (cat pt-1 "privkey" b ra-1 serial-b ca-0))-      (recv-        (sig (cert a (exp (gen) (mul ra ra-0 (rec ra-1))) ca-0 serial-a)-          (privk "sig" ca-0)))-      (recv (enc n a b serial-a serial-b (exp (gen) (mul ra ra-0))))-      (send n))-    ((send (sig (cert-req b (exp (gen) ra-1) ca-0) (privk "sig" b)))-      (recv-        (sig (cert b (exp (gen) ra-1) ca-0 serial-b)-          (privk "sig" ca-0))) (load static-key-0 (cat pt-2 ignore-0))-      (stor static-key-0 (cat pt-1 "privkey" b ra-1 serial-b ca-0)))-    ((recv (cat (exp (gen) (mul ra (rec ra-1))) ra-0))-      (send (cat (exp (gen) (mul ra (rec ra-1))) ra-0))))-  (label 13)-  (parent 9)-  (unrealized (7 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton dhstatic-state-  (vars (ignore ignore-0 mesg) (serial-a serial-b data) (n text)-    (ca b a ca-0 name) (pt pt-0 pt-1 pt-2 pval)-    (static-key static-key-0 locn) (ra ra-0 ra-1 rndx))-  (defstrand init 4 (serial-a serial-a) (serial-b serial-b) (n n) (a a)-    (b b) (ca ca) (static-key static-key) (ra ra) (alpha ra-0))-  (defstrand get-cert 4 (ignore ignore) (serial serial-a) (self a)-    (ca ca) (static-key static-key) (ra ra))-  (defstrand cert 2 (galpha (exp (gen) ra)) (serial serial-a) (subj a)-    (ca ca))-  (defstrand cert 2 (galpha (exp (gen) ra-0)) (serial serial-b) (subj b)-    (ca ca))-  (defstrand get-cert 1 (self b) (ca ca) (ra ra-0))-  (defstrand resp 4 (serial-b serial-b) (serial-a serial-a) (n n) (a a)-    (b b) (ca ca-0) (static-key static-key-0) (rb ra-1)-    (alpha (mul ra ra-0 (rec ra-1))))-  (defstrand get-cert 4 (ignore ignore-0) (serial serial-b) (self b)-    (ca ca-0) (static-key static-key-0) (ra ra-1))-  (deflistener (cat (exp (gen) (mul ra-0 (rec ra-1))) ra))-  (precedes ((0 2) (5 2)) ((1 0) (2 0)) ((1 0) (7 0)) ((1 3) (0 0))-    ((2 1) (1 1)) ((2 1) (5 1)) ((3 1) (0 1)) ((3 1) (6 1))-    ((4 0) (3 0)) ((4 0) (7 0)) ((5 3) (0 3)) ((6 0) (7 0))-    ((6 3) (5 0)) ((7 1) (5 1)))-  (non-orig (privk "sig" ca) (privk "sig" b))-  (uniq-orig serial-a serial-b n)-  (uniq-gen ra ra-0 ra-1)-  (gen-st (cat "privkey" b ra-1 serial-b ca-0)-    (cat "privkey" a ra serial-a ca))-  -  (leads-to ((1 3) (0 0)) ((6 3) (5 0)))-  -  (operation nonce-test-    (added-listener (cat (exp (gen) (mul ra-0 (rec ra-1))) ra))-    (exp (gen) (mul ra ra-0 (rec ra-1))) (5 1))-  (strand-map 0 1 2 3 4 5 6)-  (traces-    ((load static-key (cat pt "privkey" a ra serial-a ca))-      (recv-        (sig (cert b (exp (gen) ra-0) ca serial-b) (privk "sig" ca)))-      (send (enc n a b serial-a serial-b (exp (gen) (mul ra ra-0))))-      (recv n))-    ((send (sig (cert-req a (exp (gen) ra) ca) (privk "sig" a)))-      (recv (sig (cert a (exp (gen) ra) ca serial-a) (privk "sig" ca)))-      (load static-key (cat pt-0 ignore))-      (stor static-key (cat pt "privkey" a ra serial-a ca)))-    ((recv (sig (cert-req a (exp (gen) ra) ca) (privk "sig" a)))-      (send (sig (cert a (exp (gen) ra) ca serial-a) (privk "sig" ca))))-    ((recv (sig (cert-req b (exp (gen) ra-0) ca) (privk "sig" b)))-      (send-        (sig (cert b (exp (gen) ra-0) ca serial-b) (privk "sig" ca))))-    ((send (sig (cert-req b (exp (gen) ra-0) ca) (privk "sig" b))))-    ((load static-key-0 (cat pt-1 "privkey" b ra-1 serial-b ca-0))-      (recv-        (sig (cert a (exp (gen) (mul ra ra-0 (rec ra-1))) ca-0 serial-a)-          (privk "sig" ca-0)))-      (recv (enc n a b serial-a serial-b (exp (gen) (mul ra ra-0))))-      (send n))-    ((send (sig (cert-req b (exp (gen) ra-1) ca-0) (privk "sig" b)))-      (recv-        (sig (cert b (exp (gen) ra-1) ca-0 serial-b)-          (privk "sig" ca-0))) (load static-key-0 (cat pt-2 ignore-0))-      (stor static-key-0 (cat pt-1 "privkey" b ra-1 serial-b ca-0)))-    ((recv (cat (exp (gen) (mul ra-0 (rec ra-1))) ra))-      (send (cat (exp (gen) (mul ra-0 (rec ra-1))) ra))))-  (label 14)-  (parent 9)-  (unrealized (7 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton dhstatic-state-  (vars (ignore ignore-0 mesg) (serial-a serial-b serial data) (n text)-    (a self ca name) (pt pt-0 pt-1 pt-2 pval)-    (static-key static-key-0 locn) (ra ra-0 rndx))-  (defstrand init 4 (serial-a serial-a) (serial-b serial-b) (n n) (a a)-    (b self) (ca ca) (static-key static-key) (ra ra) (alpha ra-0))-  (defstrand get-cert 4 (ignore ignore) (serial serial-a) (self a)-    (ca ca) (static-key static-key) (ra ra))-  (defstrand cert 2 (galpha (exp (gen) ra)) (serial serial-a) (subj a)-    (ca ca))-  (defstrand cert 2 (galpha (exp (gen) ra-0)) (serial serial-b)-    (subj self) (ca ca))-  (deflistener (exp (gen) (mul ra ra-0)))-  (deflistener (cat (exp (gen) ra) ra-0))-  (defstrand get-cert 4 (ignore ignore-0) (serial serial) (self self)-    (ca ca) (static-key static-key-0) (ra ra-0))-  (precedes ((1 0) (2 0)) ((1 0) (5 0)) ((1 3) (0 0)) ((2 1) (1 1))-    ((3 1) (0 1)) ((4 1) (0 3)) ((5 1) (4 0)) ((6 0) (3 0))-    ((6 3) (5 0)))-  (non-orig (privk "sig" self) (privk "sig" ca))-  (uniq-orig serial-a serial-b n)-  (uniq-gen ra ra-0)-  (gen-st (cat "privkey" a ra serial-a ca))-  -  (leads-to ((1 3) (0 0)))-  -  (operation nonce-test (displaced 4 7 get-cert 4) ra-0 (6 0))-  (strand-map 0 1 2 3 6 4 5)-  (traces-    ((load static-key (cat pt "privkey" a ra serial-a ca))-      (recv-        (sig (cert self (exp (gen) ra-0) ca serial-b) (privk "sig" ca)))-      (send (enc n a self serial-a serial-b (exp (gen) (mul ra ra-0))))-      (recv n))-    ((send (sig (cert-req a (exp (gen) ra) ca) (privk "sig" a)))-      (recv (sig (cert a (exp (gen) ra) ca serial-a) (privk "sig" ca)))-      (load static-key (cat pt-0 ignore))-      (stor static-key (cat pt "privkey" a ra serial-a ca)))-    ((recv (sig (cert-req a (exp (gen) ra) ca) (privk "sig" a)))-      (send (sig (cert a (exp (gen) ra) ca serial-a) (privk "sig" ca))))-    ((recv (sig (cert-req self (exp (gen) ra-0) ca) (privk "sig" self)))-      (send-        (sig (cert self (exp (gen) ra-0) ca serial-b)-          (privk "sig" ca))))-    ((recv (exp (gen) (mul ra ra-0))) (send (exp (gen) (mul ra ra-0))))-    ((recv (cat (exp (gen) ra) ra-0)) (send (cat (exp (gen) ra) ra-0)))-    ((send (sig (cert-req self (exp (gen) ra-0) ca) (privk "sig" self)))-      (recv-        (sig (cert self (exp (gen) ra-0) ca serial) (privk "sig" ca)))-      (load static-key-0 (cat pt-1 ignore-0))-      (stor static-key-0 (cat pt-2 "privkey" self ra-0 serial ca))))-  (label 15)-  (parent 10)-  (unrealized (5 0) (6 1))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton dhstatic-state-  (vars (ignore mesg) (serial-a serial-b data) (n text) (ca b a name)-    (pt pt-0 pval) (static-key locn) (ra ra-0 rndx))-  (defstrand init 4 (serial-a serial-a) (serial-b serial-b) (n n) (a a)-    (b b) (ca ca) (static-key static-key) (ra ra-0) (alpha ra))-  (defstrand get-cert 4 (ignore ignore) (serial serial-a) (self a)-    (ca ca) (static-key static-key) (ra ra-0))-  (defstrand cert 2 (galpha (exp (gen) ra-0)) (serial serial-a) (subj a)-    (ca ca))-  (defstrand cert 2 (galpha (exp (gen) ra)) (serial serial-b) (subj b)-    (ca ca))-  (defstrand get-cert 1 (self b) (ca ca) (ra ra))-  (deflistener (exp (gen) (mul ra ra-0)))-  (deflistener (cat (exp (gen) ra) ra-0))-  (precedes ((1 0) (2 0)) ((1 3) (0 0)) ((1 3) (6 0)) ((2 1) (1 1))-    ((3 1) (0 1)) ((4 0) (3 0)) ((4 0) (6 0)) ((5 1) (0 3))-    ((6 1) (5 0)))-  (non-orig (privk "sig" ca) (privk "sig" b))-  (uniq-orig serial-a serial-b n)-  (uniq-gen ra ra-0)-  (gen-st (cat "privkey" a ra-0 serial-a ca))-  -  (leads-to ((1 3) (0 0)))-  -  (operation nonce-test (displaced 7 1 get-cert 4) ra-0 (6 0))-  (strand-map 0 1 2 3 4 5 6)-  (traces-    ((load static-key (cat pt "privkey" a ra-0 serial-a ca))-      (recv (sig (cert b (exp (gen) ra) ca serial-b) (privk "sig" ca)))-      (send (enc n a b serial-a serial-b (exp (gen) (mul ra ra-0))))-      (recv n))-    ((send (sig (cert-req a (exp (gen) ra-0) ca) (privk "sig" a)))-      (recv-        (sig (cert a (exp (gen) ra-0) ca serial-a) (privk "sig" ca)))-      (load static-key (cat pt-0 ignore))-      (stor static-key (cat pt "privkey" a ra-0 serial-a ca)))-    ((recv (sig (cert-req a (exp (gen) ra-0) ca) (privk "sig" a)))-      (send-        (sig (cert a (exp (gen) ra-0) ca serial-a) (privk "sig" ca))))-    ((recv (sig (cert-req b (exp (gen) ra) ca) (privk "sig" b)))-      (send (sig (cert b (exp (gen) ra) ca serial-b) (privk "sig" ca))))-    ((send (sig (cert-req b (exp (gen) ra) ca) (privk "sig" b))))-    ((recv (exp (gen) (mul ra ra-0))) (send (exp (gen) (mul ra ra-0))))-    ((recv (cat (exp (gen) ra) ra-0)) (send (cat (exp (gen) ra) ra-0))))-  (label 16)-  (parent 11)-  (unrealized (6 0))-  (dead)-  (comment "empty cohort"))--(defskeleton dhstatic-state-  (vars (ignore ignore-0 mesg) (serial-a serial-b data) (n text)-    (ca b a ca-0 name) (pt pt-0 pt-1 pt-2 pval)-    (static-key static-key-0 locn) (ra ra-0 ra-1 rndx))-  (defstrand init 4 (serial-a serial-a) (serial-b serial-b) (n n) (a a)-    (b b) (ca ca) (static-key static-key) (ra ra) (alpha ra-0))-  (defstrand get-cert 4 (ignore ignore) (serial serial-a) (self a)-    (ca ca) (static-key static-key) (ra ra))-  (defstrand cert 2 (galpha (exp (gen) ra)) (serial serial-a) (subj a)-    (ca ca))-  (defstrand cert 2 (galpha (exp (gen) ra-0)) (serial serial-b) (subj b)-    (ca ca))-  (defstrand get-cert 1 (self b) (ca ca) (ra ra-0))-  (defstrand resp 4 (serial-b serial-b) (serial-a serial-a) (n n) (a a)-    (b b) (ca ca-0) (static-key static-key-0) (rb ra-1)-    (alpha (mul ra ra-0 (rec ra-1))))-  (defstrand get-cert 4 (ignore ignore-0) (serial serial-b) (self b)-    (ca ca-0) (static-key static-key-0) (ra ra-1))-  (deflistener (cat (exp (gen) (mul ra ra-0)) ra-1))-  (precedes ((0 2) (5 2)) ((1 0) (2 0)) ((1 0) (7 0)) ((1 3) (0 0))-    ((2 1) (1 1)) ((2 1) (5 1)) ((3 1) (0 1)) ((3 1) (6 1))-    ((4 0) (3 0)) ((5 3) (0 3)) ((6 3) (5 0)) ((6 3) (7 0))-    ((7 1) (5 1)))-  (non-orig (privk "sig" ca) (privk "sig" b))-  (uniq-orig serial-a serial-b n)-  (uniq-gen ra ra-0 ra-1)-  (gen-st (cat "privkey" b ra-1 serial-b ca-0)-    (cat "privkey" a ra serial-a ca))-  -  (leads-to ((1 3) (0 0)) ((6 3) (5 0)))-  -  (operation nonce-test (displaced 8 6 get-cert 4) ra-1 (7 0))-  (strand-map 0 1 2 3 4 5 6 7)-  (traces-    ((load static-key (cat pt "privkey" a ra serial-a ca))-      (recv-        (sig (cert b (exp (gen) ra-0) ca serial-b) (privk "sig" ca)))-      (send (enc n a b serial-a serial-b (exp (gen) (mul ra ra-0))))-      (recv n))-    ((send (sig (cert-req a (exp (gen) ra) ca) (privk "sig" a)))-      (recv (sig (cert a (exp (gen) ra) ca serial-a) (privk "sig" ca)))-      (load static-key (cat pt-0 ignore))-      (stor static-key (cat pt "privkey" a ra serial-a ca)))-    ((recv (sig (cert-req a (exp (gen) ra) ca) (privk "sig" a)))-      (send (sig (cert a (exp (gen) ra) ca serial-a) (privk "sig" ca))))-    ((recv (sig (cert-req b (exp (gen) ra-0) ca) (privk "sig" b)))-      (send-        (sig (cert b (exp (gen) ra-0) ca serial-b) (privk "sig" ca))))-    ((send (sig (cert-req b (exp (gen) ra-0) ca) (privk "sig" b))))-    ((load static-key-0 (cat pt-1 "privkey" b ra-1 serial-b ca-0))-      (recv-        (sig (cert a (exp (gen) (mul ra ra-0 (rec ra-1))) ca-0 serial-a)-          (privk "sig" ca-0)))-      (recv (enc n a b serial-a serial-b (exp (gen) (mul ra ra-0))))-      (send n))-    ((send (sig (cert-req b (exp (gen) ra-1) ca-0) (privk "sig" b)))-      (recv-        (sig (cert b (exp (gen) ra-1) ca-0 serial-b)-          (privk "sig" ca-0))) (load static-key-0 (cat pt-2 ignore-0))-      (stor static-key-0 (cat pt-1 "privkey" b ra-1 serial-b ca-0)))-    ((recv (cat (exp (gen) (mul ra ra-0)) ra-1))-      (send (cat (exp (gen) (mul ra ra-0)) ra-1))))-  (label 17)-  (parent 12)-  (unrealized (7 0))-  (dead)-  (comment "empty cohort"))--(defskeleton dhstatic-state-  (vars (ignore ignore-0 ignore-1 mesg) (serial-a serial-b serial data)-    (n text) (a ca self ca-0 name) (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval)-    (static-key static-key-0 static-key-1 locn) (ra ra-0 ra-1 rndx))-  (defstrand init 4 (serial-a serial-a) (serial-b serial-b) (n n) (a a)-    (b self) (ca ca-0) (static-key static-key) (ra ra) (alpha ra-1))-  (defstrand get-cert 4 (ignore ignore) (serial serial-a) (self a)-    (ca ca-0) (static-key static-key) (ra ra))-  (defstrand cert 2 (galpha (exp (gen) ra)) (serial serial-a) (subj a)-    (ca ca-0))-  (defstrand cert 2 (galpha (exp (gen) ra-1)) (serial serial-b)-    (subj self) (ca ca-0))-  (defstrand resp 4 (serial-b serial-b) (serial-a serial-a) (n n) (a a)-    (b self) (ca ca) (static-key static-key-0) (rb ra-0)-    (alpha (mul ra (rec ra-0) ra-1)))-  (defstrand get-cert 4 (ignore ignore-0) (serial serial-b) (self self)-    (ca ca) (static-key static-key-0) (ra ra-0))-  (deflistener (cat (exp (gen) (mul ra (rec ra-0))) ra-1))-  (defstrand get-cert 4 (ignore ignore-1) (serial serial) (self self)-    (ca ca-0) (static-key static-key-1) (ra ra-1))-  (precedes ((0 2) (4 2)) ((1 0) (2 0)) ((1 0) (6 0)) ((1 3) (0 0))-    ((2 1) (1 1)) ((2 1) (4 1)) ((3 1) (0 1)) ((3 1) (5 1))-    ((4 3) (0 3)) ((5 0) (6 0)) ((5 3) (4 0)) ((6 1) (4 1))-    ((7 0) (3 0)) ((7 3) (6 0)))-  (non-orig (privk "sig" self) (privk "sig" ca-0))-  (uniq-orig serial-a serial-b n)-  (uniq-gen ra ra-0 ra-1)-  (gen-st (cat "privkey" a ra serial-a ca-0)-    (cat "privkey" self ra-0 serial-b ca))-  -  (leads-to ((1 3) (0 0)) ((5 3) (4 0)))-  -  (operation nonce-test (displaced 4 8 get-cert 4) ra-1 (7 0))-  (strand-map 0 1 2 3 7 4 5 6)-  (traces-    ((load static-key (cat pt "privkey" a ra serial-a ca-0))-      (recv-        (sig (cert self (exp (gen) ra-1) ca-0 serial-b)-          (privk "sig" ca-0)))-      (send (enc n a self serial-a serial-b (exp (gen) (mul ra ra-1))))-      (recv n))-    ((send (sig (cert-req a (exp (gen) ra) ca-0) (privk "sig" a)))-      (recv-        (sig (cert a (exp (gen) ra) ca-0 serial-a) (privk "sig" ca-0)))-      (load static-key (cat pt-0 ignore))-      (stor static-key (cat pt "privkey" a ra serial-a ca-0)))-    ((recv (sig (cert-req a (exp (gen) ra) ca-0) (privk "sig" a)))-      (send-        (sig (cert a (exp (gen) ra) ca-0 serial-a) (privk "sig" ca-0))))-    ((recv-       (sig (cert-req self (exp (gen) ra-1) ca-0) (privk "sig" self)))-      (send-        (sig (cert self (exp (gen) ra-1) ca-0 serial-b)-          (privk "sig" ca-0))))-    ((load static-key-0 (cat pt-1 "privkey" self ra-0 serial-b ca))-      (recv-        (sig (cert a (exp (gen) (mul ra (rec ra-0) ra-1)) ca serial-a)-          (privk "sig" ca)))-      (recv (enc n a self serial-a serial-b (exp (gen) (mul ra ra-1))))-      (send n))-    ((send (sig (cert-req self (exp (gen) ra-0) ca) (privk "sig" self)))-      (recv-        (sig (cert self (exp (gen) ra-0) ca serial-b) (privk "sig" ca)))-      (load static-key-0 (cat pt-2 ignore-0))-      (stor static-key-0 (cat pt-1 "privkey" self ra-0 serial-b ca)))-    ((recv (cat (exp (gen) (mul ra (rec ra-0))) ra-1))-      (send (cat (exp (gen) (mul ra (rec ra-0))) ra-1)))-    ((send-       (sig (cert-req self (exp (gen) ra-1) ca-0) (privk "sig" self)))-      (recv-        (sig (cert self (exp (gen) ra-1) ca-0 serial)-          (privk "sig" ca-0))) (load static-key-1 (cat pt-3 ignore-1))-      (stor static-key-1 (cat pt-4 "privkey" self ra-1 serial ca-0))))-  (label 18)-  (parent 13)-  (unrealized (6 0) (7 1))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton dhstatic-state-  (vars (ignore ignore-0 mesg) (serial-a serial-b data) (n text)-    (ca b a ca-0 name) (pt pt-0 pt-1 pt-2 pval)-    (static-key static-key-0 locn) (ra ra-0 ra-1 rndx))-  (defstrand init 4 (serial-a serial-a) (serial-b serial-b) (n n) (a a)-    (b b) (ca ca) (static-key static-key) (ra ra-1) (alpha ra))-  (defstrand get-cert 4 (ignore ignore) (serial serial-a) (self a)-    (ca ca) (static-key static-key) (ra ra-1))-  (defstrand cert 2 (galpha (exp (gen) ra-1)) (serial serial-a) (subj a)-    (ca ca))-  (defstrand cert 2 (galpha (exp (gen) ra)) (serial serial-b) (subj b)-    (ca ca))-  (defstrand get-cert 1 (self b) (ca ca) (ra ra))-  (defstrand resp 4 (serial-b serial-b) (serial-a serial-a) (n n) (a a)-    (b b) (ca ca-0) (static-key static-key-0) (rb ra-0)-    (alpha (mul ra (rec ra-0) ra-1)))-  (defstrand get-cert 4 (ignore ignore-0) (serial serial-b) (self b)-    (ca ca-0) (static-key static-key-0) (ra ra-0))-  (deflistener (cat (exp (gen) (mul ra (rec ra-0))) ra-1))-  (precedes ((0 2) (5 2)) ((1 0) (2 0)) ((1 3) (0 0)) ((1 3) (7 0))-    ((2 1) (1 1)) ((3 1) (0 1)) ((3 1) (6 1)) ((4 0) (3 0))-    ((4 0) (7 0)) ((5 3) (0 3)) ((6 0) (7 0)) ((6 3) (5 0))-    ((7 1) (5 1)))-  (non-orig (privk "sig" ca) (privk "sig" b))-  (uniq-orig serial-a serial-b n)-  (uniq-gen ra ra-0 ra-1)-  (gen-st (cat "privkey" b ra-0 serial-b ca-0)-    (cat "privkey" a ra-1 serial-a ca))-  -  (leads-to ((1 3) (0 0)) ((6 3) (5 0)))-  -  (operation nonce-test (displaced 8 1 get-cert 4) ra-1 (7 0))-  (strand-map 0 1 2 3 4 5 6 7)-  (traces-    ((load static-key (cat pt "privkey" a ra-1 serial-a ca))-      (recv (sig (cert b (exp (gen) ra) ca serial-b) (privk "sig" ca)))-      (send (enc n a b serial-a serial-b (exp (gen) (mul ra ra-1))))-      (recv n))-    ((send (sig (cert-req a (exp (gen) ra-1) ca) (privk "sig" a)))-      (recv-        (sig (cert a (exp (gen) ra-1) ca serial-a) (privk "sig" ca)))-      (load static-key (cat pt-0 ignore))-      (stor static-key (cat pt "privkey" a ra-1 serial-a ca)))-    ((recv (sig (cert-req a (exp (gen) ra-1) ca) (privk "sig" a)))-      (send-        (sig (cert a (exp (gen) ra-1) ca serial-a) (privk "sig" ca))))-    ((recv (sig (cert-req b (exp (gen) ra) ca) (privk "sig" b)))-      (send (sig (cert b (exp (gen) ra) ca serial-b) (privk "sig" ca))))-    ((send (sig (cert-req b (exp (gen) ra) ca) (privk "sig" b))))-    ((load static-key-0 (cat pt-1 "privkey" b ra-0 serial-b ca-0))-      (recv-        (sig (cert a (exp (gen) (mul ra (rec ra-0) ra-1)) ca-0 serial-a)-          (privk "sig" ca-0)))-      (recv (enc n a b serial-a serial-b (exp (gen) (mul ra ra-1))))-      (send n))-    ((send (sig (cert-req b (exp (gen) ra-0) ca-0) (privk "sig" b)))-      (recv-        (sig (cert b (exp (gen) ra-0) ca-0 serial-b)-          (privk "sig" ca-0))) (load static-key-0 (cat pt-2 ignore-0))-      (stor static-key-0 (cat pt-1 "privkey" b ra-0 serial-b ca-0)))-    ((recv (cat (exp (gen) (mul ra (rec ra-0))) ra-1))-      (send (cat (exp (gen) (mul ra (rec ra-0))) ra-1))))-  (label 19)-  (parent 14)-  (unrealized (7 0))-  (dead)-  (comment "empty cohort"))--(defskeleton dhstatic-state-  (vars (ignore ignore-0 mesg) (serial-a serial-b data) (n text)-    (a self ca name) (pt pt-0 pt-1 pt-2 pval)-    (static-key static-key-0 locn) (ra ra-0 rndx))-  (defstrand init 4 (serial-a serial-a) (serial-b serial-b) (n n) (a a)-    (b self) (ca ca) (static-key static-key) (ra ra) (alpha ra-0))-  (defstrand get-cert 4 (ignore ignore) (serial serial-a) (self a)-    (ca ca) (static-key static-key) (ra ra))-  (defstrand cert 2 (galpha (exp (gen) ra)) (serial serial-a) (subj a)-    (ca ca))-  (defstrand cert 2 (galpha (exp (gen) ra-0)) (serial serial-b)-    (subj self) (ca ca))-  (deflistener (exp (gen) (mul ra ra-0)))-  (deflistener (cat (exp (gen) ra) ra-0))-  (defstrand get-cert 4 (ignore ignore-0) (serial serial-b) (self self)-    (ca ca) (static-key static-key-0) (ra ra-0))-  (precedes ((1 0) (2 0)) ((1 0) (5 0)) ((1 3) (0 0)) ((2 1) (1 1))-    ((3 1) (0 1)) ((3 1) (6 1)) ((4 1) (0 3)) ((5 1) (4 0))-    ((6 0) (3 0)) ((6 3) (5 0)))-  (non-orig (privk "sig" self) (privk "sig" ca))-  (uniq-orig serial-a serial-b n)-  (uniq-gen ra ra-0)-  (gen-st (cat "privkey" a ra serial-a ca))-  -  (leads-to ((1 3) (0 0)))-  -  (operation encryption-test (displaced 7 3 cert 2)-    (sig (cert self (exp (gen) ra-0) ca serial) (privk "sig" ca)) (6 1))-  (strand-map 0 1 2 3 4 5 6)-  (traces-    ((load static-key (cat pt "privkey" a ra serial-a ca))-      (recv-        (sig (cert self (exp (gen) ra-0) ca serial-b) (privk "sig" ca)))-      (send (enc n a self serial-a serial-b (exp (gen) (mul ra ra-0))))-      (recv n))-    ((send (sig (cert-req a (exp (gen) ra) ca) (privk "sig" a)))-      (recv (sig (cert a (exp (gen) ra) ca serial-a) (privk "sig" ca)))-      (load static-key (cat pt-0 ignore))-      (stor static-key (cat pt "privkey" a ra serial-a ca)))-    ((recv (sig (cert-req a (exp (gen) ra) ca) (privk "sig" a)))-      (send (sig (cert a (exp (gen) ra) ca serial-a) (privk "sig" ca))))-    ((recv (sig (cert-req self (exp (gen) ra-0) ca) (privk "sig" self)))-      (send-        (sig (cert self (exp (gen) ra-0) ca serial-b)-          (privk "sig" ca))))-    ((recv (exp (gen) (mul ra ra-0))) (send (exp (gen) (mul ra ra-0))))-    ((recv (cat (exp (gen) ra) ra-0)) (send (cat (exp (gen) ra) ra-0)))-    ((send (sig (cert-req self (exp (gen) ra-0) ca) (privk "sig" self)))-      (recv-        (sig (cert self (exp (gen) ra-0) ca serial-b) (privk "sig" ca)))-      (load static-key-0 (cat pt-1 ignore-0))-      (stor static-key-0 (cat pt-2 "privkey" self ra-0 serial-b ca))))-  (label 20)-  (parent 15)-  (unrealized (5 0))-  (dead)-  (comment "empty cohort"))--(defskeleton dhstatic-state-  (vars (ignore ignore-0 mesg) (serial-a serial-b serial data) (n text)-    (a self ca name) (pt pt-0 pt-1 pt-2 pval)-    (static-key static-key-0 locn) (ra ra-0 rndx))-  (defstrand init 4 (serial-a serial-a) (serial-b serial-b) (n n) (a a)-    (b self) (ca ca) (static-key static-key) (ra ra) (alpha ra-0))-  (defstrand get-cert 4 (ignore ignore) (serial serial-a) (self a)-    (ca ca) (static-key static-key) (ra ra))-  (defstrand cert 2 (galpha (exp (gen) ra)) (serial serial-a) (subj a)-    (ca ca))-  (defstrand cert 2 (galpha (exp (gen) ra-0)) (serial serial-b)-    (subj self) (ca ca))-  (deflistener (exp (gen) (mul ra ra-0)))-  (deflistener (cat (exp (gen) ra) ra-0))-  (defstrand get-cert 4 (ignore ignore-0) (serial serial) (self self)-    (ca ca) (static-key static-key-0) (ra ra-0))-  (defstrand cert 2 (galpha (exp (gen) ra-0)) (serial serial)-    (subj self) (ca ca))-  (precedes ((1 0) (2 0)) ((1 0) (5 0)) ((1 3) (0 0)) ((2 1) (1 1))-    ((3 1) (0 1)) ((4 1) (0 3)) ((5 1) (4 0)) ((6 0) (3 0))-    ((6 0) (7 0)) ((6 3) (5 0)) ((7 1) (6 1)))-  (non-orig (privk "sig" self) (privk "sig" ca))-  (uniq-orig serial-a serial-b serial n)-  (uniq-gen ra ra-0)-  (gen-st (cat "privkey" a ra serial-a ca))-  -  (leads-to ((1 3) (0 0)))-  -  (operation encryption-test (added-strand cert 2)-    (sig (cert self (exp (gen) ra-0) ca serial) (privk "sig" ca)) (6 1))-  (strand-map 0 1 2 3 4 5 6)-  (traces-    ((load static-key (cat pt "privkey" a ra serial-a ca))-      (recv-        (sig (cert self (exp (gen) ra-0) ca serial-b) (privk "sig" ca)))-      (send (enc n a self serial-a serial-b (exp (gen) (mul ra ra-0))))-      (recv n))-    ((send (sig (cert-req a (exp (gen) ra) ca) (privk "sig" a)))-      (recv (sig (cert a (exp (gen) ra) ca serial-a) (privk "sig" ca)))-      (load static-key (cat pt-0 ignore))-      (stor static-key (cat pt "privkey" a ra serial-a ca)))-    ((recv (sig (cert-req a (exp (gen) ra) ca) (privk "sig" a)))-      (send (sig (cert a (exp (gen) ra) ca serial-a) (privk "sig" ca))))-    ((recv (sig (cert-req self (exp (gen) ra-0) ca) (privk "sig" self)))-      (send-        (sig (cert self (exp (gen) ra-0) ca serial-b)-          (privk "sig" ca))))-    ((recv (exp (gen) (mul ra ra-0))) (send (exp (gen) (mul ra ra-0))))-    ((recv (cat (exp (gen) ra) ra-0)) (send (cat (exp (gen) ra) ra-0)))-    ((send (sig (cert-req self (exp (gen) ra-0) ca) (privk "sig" self)))-      (recv-        (sig (cert self (exp (gen) ra-0) ca serial) (privk "sig" ca)))-      (load static-key-0 (cat pt-1 ignore-0))-      (stor static-key-0 (cat pt-2 "privkey" self ra-0 serial ca)))-    ((recv (sig (cert-req self (exp (gen) ra-0) ca) (privk "sig" self)))-      (send-        (sig (cert self (exp (gen) ra-0) ca serial) (privk "sig" ca)))))-  (label 21)-  (parent 15)-  (unrealized (5 0))-  (dead)-  (comment "empty cohort"))--(defskeleton dhstatic-state-  (vars (ignore ignore-0 ignore-1 mesg) (serial-a serial-b data)-    (n text) (a ca self ca-0 name) (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval)-    (static-key static-key-0 static-key-1 locn) (ra ra-0 ra-1 rndx))-  (defstrand init 4 (serial-a serial-a) (serial-b serial-b) (n n) (a a)-    (b self) (ca ca-0) (static-key static-key) (ra ra) (alpha ra-1))-  (defstrand get-cert 4 (ignore ignore) (serial serial-a) (self a)-    (ca ca-0) (static-key static-key) (ra ra))-  (defstrand cert 2 (galpha (exp (gen) ra)) (serial serial-a) (subj a)-    (ca ca-0))-  (defstrand cert 2 (galpha (exp (gen) ra-1)) (serial serial-b)-    (subj self) (ca ca-0))-  (defstrand resp 4 (serial-b serial-b) (serial-a serial-a) (n n) (a a)-    (b self) (ca ca) (static-key static-key-0) (rb ra-0)-    (alpha (mul ra (rec ra-0) ra-1)))-  (defstrand get-cert 4 (ignore ignore-0) (serial serial-b) (self self)-    (ca ca) (static-key static-key-0) (ra ra-0))-  (deflistener (cat (exp (gen) (mul ra (rec ra-0))) ra-1))-  (defstrand get-cert 4 (ignore ignore-1) (serial serial-b) (self self)-    (ca ca-0) (static-key static-key-1) (ra ra-1))-  (precedes ((0 2) (4 2)) ((1 0) (2 0)) ((1 0) (6 0)) ((1 3) (0 0))-    ((2 1) (1 1)) ((2 1) (4 1)) ((3 1) (0 1)) ((3 1) (5 1))-    ((3 1) (7 1)) ((4 3) (0 3)) ((5 0) (6 0)) ((5 3) (4 0))-    ((6 1) (4 1)) ((7 0) (3 0)) ((7 3) (6 0)))-  (non-orig (privk "sig" self) (privk "sig" ca-0))-  (uniq-orig serial-a serial-b n)-  (uniq-gen ra ra-0 ra-1)-  (gen-st (cat "privkey" a ra serial-a ca-0)-    (cat "privkey" self ra-0 serial-b ca))-  -  (leads-to ((1 3) (0 0)) ((5 3) (4 0)))-  -  (operation encryption-test (displaced 8 3 cert 2)-    (sig (cert self (exp (gen) ra-1) ca-0 serial) (privk "sig" ca-0))-    (7 1))-  (strand-map 0 1 2 3 4 5 6 7)-  (traces-    ((load static-key (cat pt "privkey" a ra serial-a ca-0))-      (recv-        (sig (cert self (exp (gen) ra-1) ca-0 serial-b)-          (privk "sig" ca-0)))-      (send (enc n a self serial-a serial-b (exp (gen) (mul ra ra-1))))-      (recv n))-    ((send (sig (cert-req a (exp (gen) ra) ca-0) (privk "sig" a)))-      (recv-        (sig (cert a (exp (gen) ra) ca-0 serial-a) (privk "sig" ca-0)))-      (load static-key (cat pt-0 ignore))-      (stor static-key (cat pt "privkey" a ra serial-a ca-0)))-    ((recv (sig (cert-req a (exp (gen) ra) ca-0) (privk "sig" a)))-      (send-        (sig (cert a (exp (gen) ra) ca-0 serial-a) (privk "sig" ca-0))))-    ((recv-       (sig (cert-req self (exp (gen) ra-1) ca-0) (privk "sig" self)))-      (send-        (sig (cert self (exp (gen) ra-1) ca-0 serial-b)-          (privk "sig" ca-0))))-    ((load static-key-0 (cat pt-1 "privkey" self ra-0 serial-b ca))-      (recv-        (sig (cert a (exp (gen) (mul ra (rec ra-0) ra-1)) ca serial-a)-          (privk "sig" ca)))-      (recv (enc n a self serial-a serial-b (exp (gen) (mul ra ra-1))))-      (send n))-    ((send (sig (cert-req self (exp (gen) ra-0) ca) (privk "sig" self)))-      (recv-        (sig (cert self (exp (gen) ra-0) ca serial-b) (privk "sig" ca)))-      (load static-key-0 (cat pt-2 ignore-0))-      (stor static-key-0 (cat pt-1 "privkey" self ra-0 serial-b ca)))-    ((recv (cat (exp (gen) (mul ra (rec ra-0))) ra-1))-      (send (cat (exp (gen) (mul ra (rec ra-0))) ra-1)))-    ((send-       (sig (cert-req self (exp (gen) ra-1) ca-0) (privk "sig" self)))-      (recv-        (sig (cert self (exp (gen) ra-1) ca-0 serial-b)-          (privk "sig" ca-0))) (load static-key-1 (cat pt-3 ignore-1))-      (stor static-key-1 (cat pt-4 "privkey" self ra-1 serial-b ca-0))))-  (label 22)-  (parent 18)-  (unrealized (6 0))-  (dead)-  (comment "empty cohort"))--(defskeleton dhstatic-state-  (vars (ignore ignore-0 ignore-1 mesg) (serial-a serial-b serial data)-    (n text) (a ca self ca-0 name) (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval)-    (static-key static-key-0 static-key-1 locn) (ra ra-0 ra-1 rndx))-  (defstrand init 4 (serial-a serial-a) (serial-b serial-b) (n n) (a a)-    (b self) (ca ca-0) (static-key static-key) (ra ra) (alpha ra-1))-  (defstrand get-cert 4 (ignore ignore) (serial serial-a) (self a)-    (ca ca-0) (static-key static-key) (ra ra))-  (defstrand cert 2 (galpha (exp (gen) ra)) (serial serial-a) (subj a)-    (ca ca-0))-  (defstrand cert 2 (galpha (exp (gen) ra-1)) (serial serial-b)-    (subj self) (ca ca-0))-  (defstrand resp 4 (serial-b serial-b) (serial-a serial-a) (n n) (a a)-    (b self) (ca ca) (static-key static-key-0) (rb ra-0)-    (alpha (mul ra (rec ra-0) ra-1)))-  (defstrand get-cert 4 (ignore ignore-0) (serial serial-b) (self self)-    (ca ca) (static-key static-key-0) (ra ra-0))-  (deflistener (cat (exp (gen) (mul ra (rec ra-0))) ra-1))-  (defstrand get-cert 4 (ignore ignore-1) (serial serial) (self self)-    (ca ca-0) (static-key static-key-1) (ra ra-1))-  (defstrand cert 2 (galpha (exp (gen) ra-1)) (serial serial)-    (subj self) (ca ca-0))-  (precedes ((0 2) (4 2)) ((1 0) (2 0)) ((1 0) (6 0)) ((1 3) (0 0))-    ((2 1) (1 1)) ((2 1) (4 1)) ((3 1) (0 1)) ((3 1) (5 1))-    ((4 3) (0 3)) ((5 0) (6 0)) ((5 3) (4 0)) ((6 1) (4 1))-    ((7 0) (3 0)) ((7 0) (8 0)) ((7 3) (6 0)) ((8 1) (7 1)))-  (non-orig (privk "sig" self) (privk "sig" ca-0))-  (uniq-orig serial-a serial-b serial n)-  (uniq-gen ra ra-0 ra-1)-  (gen-st (cat "privkey" a ra serial-a ca-0)-    (cat "privkey" self ra-0 serial-b ca))-  -  (leads-to ((1 3) (0 0)) ((5 3) (4 0)))-  -  (operation encryption-test (added-strand cert 2)-    (sig (cert self (exp (gen) ra-1) ca-0 serial) (privk "sig" ca-0))-    (7 1))-  (strand-map 0 1 2 3 4 5 6 7)-  (traces-    ((load static-key (cat pt "privkey" a ra serial-a ca-0))-      (recv-        (sig (cert self (exp (gen) ra-1) ca-0 serial-b)-          (privk "sig" ca-0)))-      (send (enc n a self serial-a serial-b (exp (gen) (mul ra ra-1))))-      (recv n))-    ((send (sig (cert-req a (exp (gen) ra) ca-0) (privk "sig" a)))-      (recv-        (sig (cert a (exp (gen) ra) ca-0 serial-a) (privk "sig" ca-0)))-      (load static-key (cat pt-0 ignore))-      (stor static-key (cat pt "privkey" a ra serial-a ca-0)))-    ((recv (sig (cert-req a (exp (gen) ra) ca-0) (privk "sig" a)))-      (send-        (sig (cert a (exp (gen) ra) ca-0 serial-a) (privk "sig" ca-0))))-    ((recv-       (sig (cert-req self (exp (gen) ra-1) ca-0) (privk "sig" self)))-      (send-        (sig (cert self (exp (gen) ra-1) ca-0 serial-b)-          (privk "sig" ca-0))))-    ((load static-key-0 (cat pt-1 "privkey" self ra-0 serial-b ca))-      (recv-        (sig (cert a (exp (gen) (mul ra (rec ra-0) ra-1)) ca serial-a)-          (privk "sig" ca)))-      (recv (enc n a self serial-a serial-b (exp (gen) (mul ra ra-1))))-      (send n))-    ((send (sig (cert-req self (exp (gen) ra-0) ca) (privk "sig" self)))-      (recv-        (sig (cert self (exp (gen) ra-0) ca serial-b) (privk "sig" ca)))-      (load static-key-0 (cat pt-2 ignore-0))-      (stor static-key-0 (cat pt-1 "privkey" self ra-0 serial-b ca)))-    ((recv (cat (exp (gen) (mul ra (rec ra-0))) ra-1))-      (send (cat (exp (gen) (mul ra (rec ra-0))) ra-1)))-    ((send-       (sig (cert-req self (exp (gen) ra-1) ca-0) (privk "sig" self)))-      (recv-        (sig (cert self (exp (gen) ra-1) ca-0 serial)-          (privk "sig" ca-0))) (load static-key-1 (cat pt-3 ignore-1))-      (stor static-key-1 (cat pt-4 "privkey" self ra-1 serial ca-0)))-    ((recv-       (sig (cert-req self (exp (gen) ra-1) ca-0) (privk "sig" self)))-      (send-        (sig (cert self (exp (gen) ra-1) ca-0 serial)-          (privk "sig" ca-0)))))-  (label 23)-  (parent 18)-  (unrealized (6 0))-  (dead)-  (comment "empty cohort"))--(comment "Nothing left to do")--(defprotocol dhstatic-state diffie-hellman-  (defrole cert-    (vars (subj ca name) (serial data) (galpha mesg))-    (trace (recv (sig (cert-req subj galpha ca) (privk "sig" subj)))-      (send (sig (cert subj galpha ca serial) (privk "sig" ca))))-    (uniq-orig serial)-    (comment "Certificate Authority"))-  (defrole get-cert-    (vars (self ca name) (serial data) (ra rndx) (static-key locn)-      (ignore mesg))-    (trace-      (send (sig (cert-req self (exp (gen) ra) ca) (privk "sig" self)))-      (recv (sig (cert self (exp (gen) ra) ca serial) (privk "sig" ca)))-      (load static-key ignore)-      (stor static-key (cat "privkey" self ra serial ca)))-    (uniq-gen ra)-    (comment "Get certified"))-  (defrole init-    (vars (a b ca name) (ra rndx) (serial-a serial-b data) (alpha expt)-      (n text) (static-key locn))-    (trace (load static-key (cat "privkey" a ra serial-a ca))-      (recv-        (sig (cert b (exp (gen) alpha) ca serial-b) (privk "sig" ca)))-      (send (enc n a b serial-a serial-b (exp (gen) (mul ra alpha))))-      (recv n))-    (uniq-orig n)-    (gen-st (cat "privkey" a ra serial-a ca))-    -    (comment "Initiator is A"))-  (defrole resp-    (vars (a b ca name) (rb rndx) (serial-b serial-a data) (alpha expt)-      (n text) (static-key locn))-    (trace (load static-key (cat "privkey" b rb serial-b ca))-      (recv-        (sig (cert a (exp (gen) alpha) ca serial-a) (privk "sig" ca)))-      (recv (enc n a b serial-a serial-b (exp (gen) (mul rb alpha))))-      (send n))-    -    (gen-st (cat "privkey" b rb serial-b ca))-    (comment "Responder is B"))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule shearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule invShearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule fact-init-neq0-    (forall ((z strd) (b a name))-      (implies-        (and (p "init" z (idx 2)) (p "init" "a" z a) (p "init" "b" z b))-        (fact neq a b))))-  (defgenrule fact-resp-neq0-    (forall ((z strd) (b a name))-      (implies-        (and (p "resp" z (idx 2)) (p "resp" "a" z a) (p "resp" "b" z b))-        (fact neq a b))))-  (defgenrule trRl_get-cert-at-3-    (forall ((z strd))-      (implies (p "get-cert" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_get-cert-at-2-    (forall ((z strd))-      (implies (p "get-cert" z (idx 4)) (trans z (idx 2)))))-  (defgenrule gen-st-init-0-    (forall ((z strd) (a name) (ra rndx) (serial-a data) (ca name))-      (implies-        (and (p "init" z (idx 1)) (p "init" "ca" z ca)-          (p "init" "serial-a" z serial-a) (p "init" "ra" z ra)-          (p "init" "a" z a))-        (gen-st (cat "privkey" a ra serial-a ca)))))-  (defgenrule gen-st-resp-0-    (forall ((z strd) (b name) (rb rndx) (serial-b data) (ca name))-      (implies-        (and (p "resp" z (idx 1)) (p "resp" "ca" z ca)-          (p "resp" "serial-b" z serial-b) (p "resp" "rb" z rb)-          (p "resp" "b" z b))-        (gen-st (cat "privkey" b rb serial-b ca)))))-  (lang (cert-req (tupl 3)) (cert (tupl 4)) (sig sign)))--(defskeleton dhstatic-state-  (vars (serial-b serial-a data) (n text) (ca a b name) (pt pval)-    (static-key locn) (rb rndx) (alpha expt))-  (defstrand resp 4 (serial-b serial-b) (serial-a serial-a) (n n) (a a)-    (b b) (ca ca) (static-key static-key) (rb rb) (alpha alpha))-  (non-orig (privk "sig" ca) (privk "sig" a))-  (traces-    ((load static-key (cat pt "privkey" b rb serial-b ca))-      (recv-        (sig (cert a (exp (gen) alpha) ca serial-a) (privk "sig" ca)))-      (recv (enc n a b serial-a serial-b (exp (gen) (mul rb alpha))))-      (send n)))-  (label 24)-  (unrealized (0 1))-  (origs)-  (comment "Not closed under rules"))--(defskeleton dhstatic-state-  (vars (serial-b serial-a data) (n text) (ca a b name) (pt pval)-    (static-key locn) (rb rndx) (alpha expt))-  (defstrand resp 4 (serial-b serial-b) (serial-a serial-a) (n n) (a a)-    (b b) (ca ca) (static-key static-key) (rb rb) (alpha alpha))-  (non-orig (privk "sig" ca) (privk "sig" a))-  (gen-st (cat "privkey" b rb serial-b ca))-  -  -  (traces-    ((load static-key (cat pt "privkey" b rb serial-b ca))-      (recv-        (sig (cert a (exp (gen) alpha) ca serial-a) (privk "sig" ca)))-      (recv (enc n a b serial-a serial-b (exp (gen) (mul rb alpha))))-      (send n)))-  (label 25)-  (parent 24)-  (unrealized (0 0) (0 1))-  (origs)-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton dhstatic-state-  (vars (ignore mesg) (serial-b serial-a data) (n text) (ca a b name)-    (pt pt-0 pval) (static-key locn) (alpha expt) (ra rndx))-  (defstrand resp 4 (serial-b serial-b) (serial-a serial-a) (n n) (a a)-    (b b) (ca ca) (static-key static-key) (rb ra) (alpha alpha))-  (defstrand get-cert 4 (ignore ignore) (serial serial-b) (self b)-    (ca ca) (static-key static-key) (ra ra))-  (precedes ((1 3) (0 0)))-  (non-orig (privk "sig" ca) (privk "sig" a))-  (uniq-gen ra)-  (gen-st (cat "privkey" b ra serial-b ca))-  -  (leads-to ((1 3) (0 0)))-  -  (operation channel-test (added-strand get-cert 4)-    (ch-msg static-key (cat pt "privkey" b ra serial-b ca)) (0 0))-  (strand-map 0)-  (traces-    ((load static-key (cat pt "privkey" b ra serial-b ca))-      (recv-        (sig (cert a (exp (gen) alpha) ca serial-a) (privk "sig" ca)))-      (recv (enc n a b serial-a serial-b (exp (gen) (mul alpha ra))))-      (send n))-    ((send (sig (cert-req b (exp (gen) ra) ca) (privk "sig" b)))-      (recv (sig (cert b (exp (gen) ra) ca serial-b) (privk "sig" ca)))-      (load static-key (cat pt-0 ignore))-      (stor static-key (cat pt "privkey" b ra serial-b ca))))-  (label 26)-  (parent 25)-  (unrealized (0 1) (1 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton dhstatic-state-  (vars (ignore mesg) (serial-b serial-a data) (n text) (ca a b name)-    (pt pt-0 pval) (static-key locn) (alpha expt) (ra rndx))-  (defstrand resp 4 (serial-b serial-b) (serial-a serial-a) (n n) (a a)-    (b b) (ca ca) (static-key static-key) (rb ra) (alpha alpha))-  (defstrand get-cert 4 (ignore ignore) (serial serial-b) (self b)-    (ca ca) (static-key static-key) (ra ra))-  (defstrand cert 2 (galpha (exp (gen) ra)) (serial serial-b) (subj b)-    (ca ca))-  (precedes ((1 0) (2 0)) ((1 3) (0 0)) ((2 1) (1 1)))-  (non-orig (privk "sig" ca) (privk "sig" a))-  (uniq-orig serial-b)-  (uniq-gen ra)-  (gen-st (cat "privkey" b ra serial-b ca))-  -  (leads-to ((1 3) (0 0)))-  -  (operation encryption-test (added-strand cert 2)-    (sig (cert b (exp (gen) ra) ca serial-b) (privk "sig" ca)) (1 1))-  (strand-map 0 1)-  (traces-    ((load static-key (cat pt "privkey" b ra serial-b ca))-      (recv-        (sig (cert a (exp (gen) alpha) ca serial-a) (privk "sig" ca)))-      (recv (enc n a b serial-a serial-b (exp (gen) (mul alpha ra))))-      (send n))-    ((send (sig (cert-req b (exp (gen) ra) ca) (privk "sig" b)))-      (recv (sig (cert b (exp (gen) ra) ca serial-b) (privk "sig" ca)))-      (load static-key (cat pt-0 ignore))-      (stor static-key (cat pt "privkey" b ra serial-b ca)))-    ((recv (sig (cert-req b (exp (gen) ra) ca) (privk "sig" b)))-      (send-        (sig (cert b (exp (gen) ra) ca serial-b) (privk "sig" ca)))))-  (label 27)-  (parent 26)-  (unrealized (0 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton dhstatic-state-  (vars (ignore mesg) (serial-b serial-a data) (n text) (ca a b name)-    (pt pt-0 pval) (static-key locn) (alpha expt) (ra rndx))-  (defstrand resp 4 (serial-b serial-b) (serial-a serial-a) (n n) (a a)-    (b b) (ca ca) (static-key static-key) (rb ra) (alpha alpha))-  (defstrand get-cert 4 (ignore ignore) (serial serial-b) (self b)-    (ca ca) (static-key static-key) (ra ra))-  (defstrand cert 2 (galpha (exp (gen) ra)) (serial serial-b) (subj b)-    (ca ca))-  (defstrand cert 2 (galpha (exp (gen) alpha)) (serial serial-a)-    (subj a) (ca ca))-  (precedes ((1 0) (2 0)) ((1 3) (0 0)) ((2 1) (1 1)) ((3 1) (0 1)))-  (non-orig (privk "sig" ca) (privk "sig" a))-  (uniq-orig serial-b serial-a)-  (uniq-gen ra)-  (gen-st (cat "privkey" b ra serial-b ca))-  -  (leads-to ((1 3) (0 0)))-  -  (operation encryption-test (added-strand cert 2)-    (sig (cert a (exp (gen) alpha) ca serial-a) (privk "sig" ca)) (0 1))-  (strand-map 0 1 2)-  (traces-    ((load static-key (cat pt "privkey" b ra serial-b ca))-      (recv-        (sig (cert a (exp (gen) alpha) ca serial-a) (privk "sig" ca)))-      (recv (enc n a b serial-a serial-b (exp (gen) (mul alpha ra))))-      (send n))-    ((send (sig (cert-req b (exp (gen) ra) ca) (privk "sig" b)))-      (recv (sig (cert b (exp (gen) ra) ca serial-b) (privk "sig" ca)))-      (load static-key (cat pt-0 ignore))-      (stor static-key (cat pt "privkey" b ra serial-b ca)))-    ((recv (sig (cert-req b (exp (gen) ra) ca) (privk "sig" b)))-      (send (sig (cert b (exp (gen) ra) ca serial-b) (privk "sig" ca))))-    ((recv (sig (cert-req a (exp (gen) alpha) ca) (privk "sig" a)))-      (send-        (sig (cert a (exp (gen) alpha) ca serial-a) (privk "sig" ca)))))-  (label 28)-  (parent 27)-  (unrealized (3 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton dhstatic-state-  (vars (ignore mesg) (serial-b serial-a data) (n text) (ca a b name)-    (pt pt-0 pval) (static-key locn) (ra ra-0 rndx))-  (defstrand resp 4 (serial-b serial-b) (serial-a serial-a) (n n) (a a)-    (b b) (ca ca) (static-key static-key) (rb ra) (alpha ra-0))-  (defstrand get-cert 4 (ignore ignore) (serial serial-b) (self b)-    (ca ca) (static-key static-key) (ra ra))-  (defstrand cert 2 (galpha (exp (gen) ra)) (serial serial-b) (subj b)-    (ca ca))-  (defstrand cert 2 (galpha (exp (gen) ra-0)) (serial serial-a) (subj a)-    (ca ca))-  (defstrand get-cert 1 (self a) (ca ca) (ra ra-0))-  (precedes ((1 0) (2 0)) ((1 3) (0 0)) ((2 1) (1 1)) ((3 1) (0 1))-    ((4 0) (3 0)))-  (non-orig (privk "sig" ca) (privk "sig" a))-  (uniq-orig serial-b serial-a)-  (uniq-gen ra ra-0)-  (gen-st (cat "privkey" b ra serial-b ca))-  -  (leads-to ((1 3) (0 0)))-  -  (operation encryption-test (added-strand get-cert 1)-    (sig (cert-req a (exp (gen) ra-0) ca) (privk "sig" a)) (3 0))-  (strand-map 0 1 2 3)-  (traces-    ((load static-key (cat pt "privkey" b ra serial-b ca))-      (recv-        (sig (cert a (exp (gen) ra-0) ca serial-a) (privk "sig" ca)))-      (recv (enc n a b serial-a serial-b (exp (gen) (mul ra ra-0))))-      (send n))-    ((send (sig (cert-req b (exp (gen) ra) ca) (privk "sig" b)))-      (recv (sig (cert b (exp (gen) ra) ca serial-b) (privk "sig" ca)))-      (load static-key (cat pt-0 ignore))-      (stor static-key (cat pt "privkey" b ra serial-b ca)))-    ((recv (sig (cert-req b (exp (gen) ra) ca) (privk "sig" b)))-      (send (sig (cert b (exp (gen) ra) ca serial-b) (privk "sig" ca))))-    ((recv (sig (cert-req a (exp (gen) ra-0) ca) (privk "sig" a)))-      (send-        (sig (cert a (exp (gen) ra-0) ca serial-a) (privk "sig" ca))))-    ((send (sig (cert-req a (exp (gen) ra-0) ca) (privk "sig" a)))))-  (label 29)-  (parent 28)-  (unrealized (0 2))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton dhstatic-state-  (vars (ignore mesg) (serial-b serial-a data) (n text)-    (ca a b ca-0 name) (pt pt-0 pt-1 pval)-    (static-key static-key-0 locn) (ra ra-0 ra-1 rndx))-  (defstrand resp 4 (serial-b serial-b) (serial-a serial-a) (n n) (a a)-    (b b) (ca ca) (static-key static-key) (rb ra) (alpha ra-0))-  (defstrand get-cert 4 (ignore ignore) (serial serial-b) (self b)-    (ca ca) (static-key static-key) (ra ra))-  (defstrand cert 2 (galpha (exp (gen) ra)) (serial serial-b) (subj b)-    (ca ca))-  (defstrand cert 2 (galpha (exp (gen) ra-0)) (serial serial-a) (subj a)-    (ca ca))-  (defstrand get-cert 1 (self a) (ca ca) (ra ra-0))-  (defstrand init 3 (serial-a serial-a) (serial-b serial-b) (n n) (a a)-    (b b) (ca ca-0) (static-key static-key-0) (ra ra-1)-    (alpha (mul ra ra-0 (rec ra-1))))-  (precedes ((1 0) (2 0)) ((1 3) (0 0)) ((2 1) (1 1)) ((2 1) (5 1))-    ((3 1) (0 1)) ((3 1) (5 0)) ((4 0) (3 0)) ((5 2) (0 2)))-  (non-orig (privk "sig" ca) (privk "sig" a))-  (uniq-orig serial-b serial-a n)-  (uniq-gen ra ra-0)-  (gen-st (cat "privkey" a ra-1 serial-a ca-0)-    (cat "privkey" b ra serial-b ca))-  -  (leads-to ((1 3) (0 0)))-  -  (operation encryption-test (added-strand init 3)-    (enc n a b serial-a serial-b (exp (gen) (mul ra ra-0))) (0 2))-  (strand-map 0 1 2 3 4)-  (traces-    ((load static-key (cat pt "privkey" b ra serial-b ca))-      (recv-        (sig (cert a (exp (gen) ra-0) ca serial-a) (privk "sig" ca)))-      (recv (enc n a b serial-a serial-b (exp (gen) (mul ra ra-0))))-      (send n))-    ((send (sig (cert-req b (exp (gen) ra) ca) (privk "sig" b)))-      (recv (sig (cert b (exp (gen) ra) ca serial-b) (privk "sig" ca)))-      (load static-key (cat pt-0 ignore))-      (stor static-key (cat pt "privkey" b ra serial-b ca)))-    ((recv (sig (cert-req b (exp (gen) ra) ca) (privk "sig" b)))-      (send (sig (cert b (exp (gen) ra) ca serial-b) (privk "sig" ca))))-    ((recv (sig (cert-req a (exp (gen) ra-0) ca) (privk "sig" a)))-      (send-        (sig (cert a (exp (gen) ra-0) ca serial-a) (privk "sig" ca))))-    ((send (sig (cert-req a (exp (gen) ra-0) ca) (privk "sig" a))))-    ((load static-key-0 (cat pt-1 "privkey" a ra-1 serial-a ca-0))-      (recv-        (sig (cert b (exp (gen) (mul ra ra-0 (rec ra-1))) ca-0 serial-b)-          (privk "sig" ca-0)))-      (send (enc n a b serial-a serial-b (exp (gen) (mul ra ra-0))))))-  (label 30)-  (parent 29)-  (unrealized (5 0) (5 1))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton dhstatic-state-  (vars (ignore mesg) (serial-b serial-a data) (n text) (ca a b name)-    (pt pt-0 pval) (static-key locn) (ra ra-0 rndx))-  (defstrand resp 4 (serial-b serial-b) (serial-a serial-a) (n n) (a a)-    (b b) (ca ca) (static-key static-key) (rb ra) (alpha ra-0))-  (defstrand get-cert 4 (ignore ignore) (serial serial-b) (self b)-    (ca ca) (static-key static-key) (ra ra))-  (defstrand cert 2 (galpha (exp (gen) ra)) (serial serial-b) (subj b)-    (ca ca))-  (defstrand cert 2 (galpha (exp (gen) ra-0)) (serial serial-a) (subj a)-    (ca ca))-  (defstrand get-cert 1 (self a) (ca ca) (ra ra-0))-  (deflistener (exp (gen) (mul ra ra-0)))-  (precedes ((1 0) (2 0)) ((1 0) (5 0)) ((1 3) (0 0)) ((2 1) (1 1))-    ((3 1) (0 1)) ((4 0) (3 0)) ((4 0) (5 0)) ((5 1) (0 2)))-  (non-orig (privk "sig" ca) (privk "sig" a))-  (uniq-orig serial-b serial-a)-  (uniq-gen ra ra-0)-  (gen-st (cat "privkey" b ra serial-b ca))-  -  (leads-to ((1 3) (0 0)))-  -  (operation encryption-test (added-listener (exp (gen) (mul ra ra-0)))-    (enc n a b serial-a serial-b (exp (gen) (mul ra ra-0))) (0 2))-  (strand-map 0 1 2 3 4)-  (traces-    ((load static-key (cat pt "privkey" b ra serial-b ca))-      (recv-        (sig (cert a (exp (gen) ra-0) ca serial-a) (privk "sig" ca)))-      (recv (enc n a b serial-a serial-b (exp (gen) (mul ra ra-0))))-      (send n))-    ((send (sig (cert-req b (exp (gen) ra) ca) (privk "sig" b)))-      (recv (sig (cert b (exp (gen) ra) ca serial-b) (privk "sig" ca)))-      (load static-key (cat pt-0 ignore))-      (stor static-key (cat pt "privkey" b ra serial-b ca)))-    ((recv (sig (cert-req b (exp (gen) ra) ca) (privk "sig" b)))-      (send (sig (cert b (exp (gen) ra) ca serial-b) (privk "sig" ca))))-    ((recv (sig (cert-req a (exp (gen) ra-0) ca) (privk "sig" a)))-      (send-        (sig (cert a (exp (gen) ra-0) ca serial-a) (privk "sig" ca))))-    ((send (sig (cert-req a (exp (gen) ra-0) ca) (privk "sig" a))))-    ((recv (exp (gen) (mul ra ra-0))) (send (exp (gen) (mul ra ra-0)))))-  (label 31)-  (parent 29)-  (unrealized (5 0))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton dhstatic-state-  (vars (ignore ignore-0 mesg) (serial-b serial-a data) (n text)-    (a b ca name) (pt pt-0 pt-1 pt-2 pval)-    (static-key static-key-0 locn) (ra ra-0 rndx))-  (defstrand resp 4 (serial-b serial-b) (serial-a serial-a) (n n) (a a)-    (b b) (ca ca) (static-key static-key) (rb ra) (alpha ra-0))-  (defstrand get-cert 4 (ignore ignore) (serial serial-b) (self b)-    (ca ca) (static-key static-key) (ra ra))-  (defstrand cert 2 (galpha (exp (gen) ra)) (serial serial-b) (subj b)-    (ca ca))-  (defstrand cert 2 (galpha (exp (gen) ra-0)) (serial serial-a) (subj a)-    (ca ca))-  (defstrand init 3 (serial-a serial-a) (serial-b serial-b) (n n) (a a)-    (b b) (ca ca) (static-key static-key-0) (ra ra-0) (alpha ra))-  (defstrand get-cert 4 (ignore ignore-0) (serial serial-a) (self a)-    (ca ca) (static-key static-key-0) (ra ra-0))-  (precedes ((1 0) (2 0)) ((1 3) (0 0)) ((2 1) (1 1)) ((2 1) (4 1))-    ((3 1) (0 1)) ((3 1) (5 1)) ((4 2) (0 2)) ((5 0) (3 0))-    ((5 3) (4 0)))-  (non-orig (privk "sig" a) (privk "sig" ca))-  (uniq-orig serial-b serial-a n)-  (uniq-gen ra ra-0)-  (gen-st (cat "privkey" a ra-0 serial-a ca)-    (cat "privkey" b ra serial-b ca))-  -  (leads-to ((1 3) (0 0)) ((5 3) (4 0)))-  -  (operation channel-test (displaced 4 6 get-cert 4)-    (ch-msg static-key-0 (cat pt-1 "privkey" a ra-1 serial-a ca)) (5 0))-  (strand-map 0 1 2 3 5 4)-  (traces-    ((load static-key (cat pt "privkey" b ra serial-b ca))-      (recv-        (sig (cert a (exp (gen) ra-0) ca serial-a) (privk "sig" ca)))-      (recv (enc n a b serial-a serial-b (exp (gen) (mul ra ra-0))))-      (send n))-    ((send (sig (cert-req b (exp (gen) ra) ca) (privk "sig" b)))-      (recv (sig (cert b (exp (gen) ra) ca serial-b) (privk "sig" ca)))-      (load static-key (cat pt-0 ignore))-      (stor static-key (cat pt "privkey" b ra serial-b ca)))-    ((recv (sig (cert-req b (exp (gen) ra) ca) (privk "sig" b)))-      (send (sig (cert b (exp (gen) ra) ca serial-b) (privk "sig" ca))))-    ((recv (sig (cert-req a (exp (gen) ra-0) ca) (privk "sig" a)))-      (send-        (sig (cert a (exp (gen) ra-0) ca serial-a) (privk "sig" ca))))-    ((load static-key-0 (cat pt-1 "privkey" a ra-0 serial-a ca))-      (recv (sig (cert b (exp (gen) ra) ca serial-b) (privk "sig" ca)))-      (send (enc n a b serial-a serial-b (exp (gen) (mul ra ra-0)))))-    ((send (sig (cert-req a (exp (gen) ra-0) ca) (privk "sig" a)))-      (recv-        (sig (cert a (exp (gen) ra-0) ca serial-a) (privk "sig" ca)))-      (load static-key-0 (cat pt-2 ignore-0))-      (stor static-key-0 (cat pt-1 "privkey" a ra-0 serial-a ca))))-  (label 32)-  (parent 30)-  (realized)-  (shape)-  (maps-    ((0)-      ((ca ca) (a a) (b b) (rb ra) (serial-b serial-b)-        (serial-a serial-a) (alpha ra-0) (n n)-        (static-key static-key))))-  (origs (pt-1 (5 3)) (n (4 2)) (serial-a (3 1)) (serial-b (2 1))-    (pt (1 3)))-  (ugens (ra-0 (5 0)) (ra (1 0))))--(defskeleton dhstatic-state-  (vars (ignore ignore-0 mesg) (serial-b serial-a data) (n text)-    (ca a b ca-0 name) (pt pt-0 pt-1 pt-2 pval)-    (static-key static-key-0 locn) (ra ra-0 ra-1 rndx))-  (defstrand resp 4 (serial-b serial-b) (serial-a serial-a) (n n) (a a)-    (b b) (ca ca) (static-key static-key) (rb ra) (alpha ra-0))-  (defstrand get-cert 4 (ignore ignore) (serial serial-b) (self b)-    (ca ca) (static-key static-key) (ra ra))-  (defstrand cert 2 (galpha (exp (gen) ra)) (serial serial-b) (subj b)-    (ca ca))-  (defstrand cert 2 (galpha (exp (gen) ra-0)) (serial serial-a) (subj a)-    (ca ca))-  (defstrand get-cert 1 (self a) (ca ca) (ra ra-0))-  (defstrand init 3 (serial-a serial-a) (serial-b serial-b) (n n) (a a)-    (b b) (ca ca-0) (static-key static-key-0) (ra ra-1)-    (alpha (mul ra ra-0 (rec ra-1))))-  (defstrand get-cert 4 (ignore ignore-0) (serial serial-a) (self a)-    (ca ca-0) (static-key static-key-0) (ra ra-1))-  (precedes ((1 0) (2 0)) ((1 3) (0 0)) ((2 1) (1 1)) ((2 1) (5 1))-    ((3 1) (0 1)) ((3 1) (6 1)) ((4 0) (3 0)) ((5 2) (0 2))-    ((6 3) (5 0)))-  (non-orig (privk "sig" ca) (privk "sig" a))-  (uniq-orig serial-b serial-a n)-  (uniq-gen ra ra-0 ra-1)-  (gen-st (cat "privkey" a ra-1 serial-a ca-0)-    (cat "privkey" b ra serial-b ca))-  -  (leads-to ((1 3) (0 0)) ((6 3) (5 0)))-  -  (operation channel-test (added-strand get-cert 4)-    (ch-msg static-key-0 (cat pt-1 "privkey" a ra-1 serial-a ca-0))-    (5 0))-  (strand-map 0 1 2 3 4 5)-  (traces-    ((load static-key (cat pt "privkey" b ra serial-b ca))-      (recv-        (sig (cert a (exp (gen) ra-0) ca serial-a) (privk "sig" ca)))-      (recv (enc n a b serial-a serial-b (exp (gen) (mul ra ra-0))))-      (send n))-    ((send (sig (cert-req b (exp (gen) ra) ca) (privk "sig" b)))-      (recv (sig (cert b (exp (gen) ra) ca serial-b) (privk "sig" ca)))-      (load static-key (cat pt-0 ignore))-      (stor static-key (cat pt "privkey" b ra serial-b ca)))-    ((recv (sig (cert-req b (exp (gen) ra) ca) (privk "sig" b)))-      (send (sig (cert b (exp (gen) ra) ca serial-b) (privk "sig" ca))))-    ((recv (sig (cert-req a (exp (gen) ra-0) ca) (privk "sig" a)))-      (send-        (sig (cert a (exp (gen) ra-0) ca serial-a) (privk "sig" ca))))-    ((send (sig (cert-req a (exp (gen) ra-0) ca) (privk "sig" a))))-    ((load static-key-0 (cat pt-1 "privkey" a ra-1 serial-a ca-0))-      (recv-        (sig (cert b (exp (gen) (mul ra ra-0 (rec ra-1))) ca-0 serial-b)-          (privk "sig" ca-0)))-      (send (enc n a b serial-a serial-b (exp (gen) (mul ra ra-0)))))-    ((send (sig (cert-req a (exp (gen) ra-1) ca-0) (privk "sig" a)))-      (recv-        (sig (cert a (exp (gen) ra-1) ca-0 serial-a)-          (privk "sig" ca-0))) (load static-key-0 (cat pt-2 ignore-0))-      (stor static-key-0 (cat pt-1 "privkey" a ra-1 serial-a ca-0))))-  (label 33)-  (parent 30)-  (unrealized (5 1))-  (comment "3 in cohort - 3 not yet seen"))--(defskeleton dhstatic-state-  (vars (ignore mesg) (serial-b serial-a data) (n text) (ca a b name)-    (pt pt-0 pval) (static-key locn) (ra ra-0 rndx))-  (defstrand resp 4 (serial-b serial-b) (serial-a serial-a) (n n) (a a)-    (b b) (ca ca) (static-key static-key) (rb ra) (alpha ra-0))-  (defstrand get-cert 4 (ignore ignore) (serial serial-b) (self b)-    (ca ca) (static-key static-key) (ra ra))-  (defstrand cert 2 (galpha (exp (gen) ra)) (serial serial-b) (subj b)-    (ca ca))-  (defstrand cert 2 (galpha (exp (gen) ra-0)) (serial serial-a) (subj a)-    (ca ca))-  (defstrand get-cert 1 (self a) (ca ca) (ra ra-0))-  (deflistener (exp (gen) (mul ra ra-0)))-  (deflistener (cat (exp (gen) ra) ra-0))-  (precedes ((1 0) (2 0)) ((1 0) (6 0)) ((1 3) (0 0)) ((2 1) (1 1))-    ((3 1) (0 1)) ((4 0) (3 0)) ((4 0) (6 0)) ((5 1) (0 2))-    ((6 1) (5 0)))-  (non-orig (privk "sig" ca) (privk "sig" a))-  (uniq-orig serial-b serial-a)-  (uniq-gen ra ra-0)-  (gen-st (cat "privkey" b ra serial-b ca))-  -  (leads-to ((1 3) (0 0)))-  -  (operation nonce-test (added-listener (cat (exp (gen) ra) ra-0))-    (exp (gen) (mul ra ra-0)) (5 0))-  (strand-map 0 1 2 3 4 5)-  (traces-    ((load static-key (cat pt "privkey" b ra serial-b ca))-      (recv-        (sig (cert a (exp (gen) ra-0) ca serial-a) (privk "sig" ca)))-      (recv (enc n a b serial-a serial-b (exp (gen) (mul ra ra-0))))-      (send n))-    ((send (sig (cert-req b (exp (gen) ra) ca) (privk "sig" b)))-      (recv (sig (cert b (exp (gen) ra) ca serial-b) (privk "sig" ca)))-      (load static-key (cat pt-0 ignore))-      (stor static-key (cat pt "privkey" b ra serial-b ca)))-    ((recv (sig (cert-req b (exp (gen) ra) ca) (privk "sig" b)))-      (send (sig (cert b (exp (gen) ra) ca serial-b) (privk "sig" ca))))-    ((recv (sig (cert-req a (exp (gen) ra-0) ca) (privk "sig" a)))-      (send-        (sig (cert a (exp (gen) ra-0) ca serial-a) (privk "sig" ca))))-    ((send (sig (cert-req a (exp (gen) ra-0) ca) (privk "sig" a))))-    ((recv (exp (gen) (mul ra ra-0))) (send (exp (gen) (mul ra ra-0))))-    ((recv (cat (exp (gen) ra) ra-0)) (send (cat (exp (gen) ra) ra-0))))-  (label 34)-  (parent 31)-  (unrealized (6 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton dhstatic-state-  (vars (ignore mesg) (serial-b serial-a data) (n text) (ca a b name)-    (pt pt-0 pval) (static-key locn) (ra ra-0 rndx))-  (defstrand resp 4 (serial-b serial-b) (serial-a serial-a) (n n) (a a)-    (b b) (ca ca) (static-key static-key) (rb ra) (alpha ra-0))-  (defstrand get-cert 4 (ignore ignore) (serial serial-b) (self b)-    (ca ca) (static-key static-key) (ra ra))-  (defstrand cert 2 (galpha (exp (gen) ra)) (serial serial-b) (subj b)-    (ca ca))-  (defstrand cert 2 (galpha (exp (gen) ra-0)) (serial serial-a) (subj a)-    (ca ca))-  (defstrand get-cert 1 (self a) (ca ca) (ra ra-0))-  (deflistener (exp (gen) (mul ra ra-0)))-  (deflistener (cat (exp (gen) ra-0) ra))-  (precedes ((1 0) (2 0)) ((1 0) (6 0)) ((1 3) (0 0)) ((2 1) (1 1))-    ((3 1) (0 1)) ((4 0) (3 0)) ((4 0) (6 0)) ((5 1) (0 2))-    ((6 1) (5 0)))-  (non-orig (privk "sig" ca) (privk "sig" a))-  (uniq-orig serial-b serial-a)-  (uniq-gen ra ra-0)-  (gen-st (cat "privkey" b ra serial-b ca))-  -  (leads-to ((1 3) (0 0)))-  -  (operation nonce-test (added-listener (cat (exp (gen) ra-0) ra))-    (exp (gen) (mul ra ra-0)) (5 0))-  (strand-map 0 1 2 3 4 5)-  (traces-    ((load static-key (cat pt "privkey" b ra serial-b ca))-      (recv-        (sig (cert a (exp (gen) ra-0) ca serial-a) (privk "sig" ca)))-      (recv (enc n a b serial-a serial-b (exp (gen) (mul ra ra-0))))-      (send n))-    ((send (sig (cert-req b (exp (gen) ra) ca) (privk "sig" b)))-      (recv (sig (cert b (exp (gen) ra) ca serial-b) (privk "sig" ca)))-      (load static-key (cat pt-0 ignore))-      (stor static-key (cat pt "privkey" b ra serial-b ca)))-    ((recv (sig (cert-req b (exp (gen) ra) ca) (privk "sig" b)))-      (send (sig (cert b (exp (gen) ra) ca serial-b) (privk "sig" ca))))-    ((recv (sig (cert-req a (exp (gen) ra-0) ca) (privk "sig" a)))-      (send-        (sig (cert a (exp (gen) ra-0) ca serial-a) (privk "sig" ca))))-    ((send (sig (cert-req a (exp (gen) ra-0) ca) (privk "sig" a))))-    ((recv (exp (gen) (mul ra ra-0))) (send (exp (gen) (mul ra ra-0))))-    ((recv (cat (exp (gen) ra-0) ra)) (send (cat (exp (gen) ra-0) ra))))-  (label 35)-  (parent 31)-  (unrealized (6 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton dhstatic-state-  (vars (ignore ignore-0 mesg) (serial-b serial-a data) (n text)-    (ca a b ca-0 name) (pt pt-0 pt-1 pt-2 pval)-    (static-key static-key-0 locn) (ra ra-0 ra-1 rndx))-  (defstrand resp 4 (serial-b serial-b) (serial-a serial-a) (n n) (a a)-    (b b) (ca ca) (static-key static-key) (rb ra) (alpha ra-0))-  (defstrand get-cert 4 (ignore ignore) (serial serial-b) (self b)-    (ca ca) (static-key static-key) (ra ra))-  (defstrand cert 2 (galpha (exp (gen) ra)) (serial serial-b) (subj b)-    (ca ca))-  (defstrand cert 2 (galpha (exp (gen) ra-0)) (serial serial-a) (subj a)-    (ca ca))-  (defstrand get-cert 1 (self a) (ca ca) (ra ra-0))-  (defstrand init 3 (serial-a serial-a) (serial-b serial-b) (n n) (a a)-    (b b) (ca ca-0) (static-key static-key-0) (ra ra-1)-    (alpha (mul ra ra-0 (rec ra-1))))-  (defstrand get-cert 4 (ignore ignore-0) (serial serial-a) (self a)-    (ca ca-0) (static-key static-key-0) (ra ra-1))-  (deflistener (cat (exp (gen) (mul ra ra-0)) ra-1))-  (precedes ((1 0) (2 0)) ((1 0) (7 0)) ((1 3) (0 0)) ((2 1) (1 1))-    ((2 1) (5 1)) ((3 1) (0 1)) ((3 1) (6 1)) ((4 0) (3 0))-    ((4 0) (7 0)) ((5 2) (0 2)) ((6 0) (7 0)) ((6 3) (5 0))-    ((7 1) (5 1)))-  (non-orig (privk "sig" ca) (privk "sig" a))-  (uniq-orig serial-b serial-a n)-  (uniq-gen ra ra-0 ra-1)-  (gen-st (cat "privkey" a ra-1 serial-a ca-0)-    (cat "privkey" b ra serial-b ca))-  -  (leads-to ((1 3) (0 0)) ((6 3) (5 0)))-  -  (operation nonce-test-    (added-listener (cat (exp (gen) (mul ra ra-0)) ra-1))-    (exp (gen) (mul ra ra-0 (rec ra-1))) (5 1))-  (strand-map 0 1 2 3 4 5 6)-  (traces-    ((load static-key (cat pt "privkey" b ra serial-b ca))-      (recv-        (sig (cert a (exp (gen) ra-0) ca serial-a) (privk "sig" ca)))-      (recv (enc n a b serial-a serial-b (exp (gen) (mul ra ra-0))))-      (send n))-    ((send (sig (cert-req b (exp (gen) ra) ca) (privk "sig" b)))-      (recv (sig (cert b (exp (gen) ra) ca serial-b) (privk "sig" ca)))-      (load static-key (cat pt-0 ignore))-      (stor static-key (cat pt "privkey" b ra serial-b ca)))-    ((recv (sig (cert-req b (exp (gen) ra) ca) (privk "sig" b)))-      (send (sig (cert b (exp (gen) ra) ca serial-b) (privk "sig" ca))))-    ((recv (sig (cert-req a (exp (gen) ra-0) ca) (privk "sig" a)))-      (send-        (sig (cert a (exp (gen) ra-0) ca serial-a) (privk "sig" ca))))-    ((send (sig (cert-req a (exp (gen) ra-0) ca) (privk "sig" a))))-    ((load static-key-0 (cat pt-1 "privkey" a ra-1 serial-a ca-0))-      (recv-        (sig (cert b (exp (gen) (mul ra ra-0 (rec ra-1))) ca-0 serial-b)-          (privk "sig" ca-0)))-      (send (enc n a b serial-a serial-b (exp (gen) (mul ra ra-0)))))-    ((send (sig (cert-req a (exp (gen) ra-1) ca-0) (privk "sig" a)))-      (recv-        (sig (cert a (exp (gen) ra-1) ca-0 serial-a)-          (privk "sig" ca-0))) (load static-key-0 (cat pt-2 ignore-0))-      (stor static-key-0 (cat pt-1 "privkey" a ra-1 serial-a ca-0)))-    ((recv (cat (exp (gen) (mul ra ra-0)) ra-1))-      (send (cat (exp (gen) (mul ra ra-0)) ra-1))))-  (label 36)-  (parent 33)-  (unrealized (7 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton dhstatic-state-  (vars (ignore ignore-0 mesg) (serial-b serial-a data) (n text)-    (ca a b ca-0 name) (pt pt-0 pt-1 pt-2 pval)-    (static-key static-key-0 locn) (ra ra-0 ra-1 rndx))-  (defstrand resp 4 (serial-b serial-b) (serial-a serial-a) (n n) (a a)-    (b b) (ca ca) (static-key static-key) (rb ra) (alpha ra-0))-  (defstrand get-cert 4 (ignore ignore) (serial serial-b) (self b)-    (ca ca) (static-key static-key) (ra ra))-  (defstrand cert 2 (galpha (exp (gen) ra)) (serial serial-b) (subj b)-    (ca ca))-  (defstrand cert 2 (galpha (exp (gen) ra-0)) (serial serial-a) (subj a)-    (ca ca))-  (defstrand get-cert 1 (self a) (ca ca) (ra ra-0))-  (defstrand init 3 (serial-a serial-a) (serial-b serial-b) (n n) (a a)-    (b b) (ca ca-0) (static-key static-key-0) (ra ra-1)-    (alpha (mul ra ra-0 (rec ra-1))))-  (defstrand get-cert 4 (ignore ignore-0) (serial serial-a) (self a)-    (ca ca-0) (static-key static-key-0) (ra ra-1))-  (deflistener (cat (exp (gen) (mul ra (rec ra-1))) ra-0))-  (precedes ((1 0) (2 0)) ((1 0) (7 0)) ((1 3) (0 0)) ((2 1) (1 1))-    ((2 1) (5 1)) ((3 1) (0 1)) ((3 1) (6 1)) ((4 0) (3 0))-    ((4 0) (7 0)) ((5 2) (0 2)) ((6 0) (7 0)) ((6 3) (5 0))-    ((7 1) (5 1)))-  (non-orig (privk "sig" ca) (privk "sig" a))-  (uniq-orig serial-b serial-a n)-  (uniq-gen ra ra-0 ra-1)-  (gen-st (cat "privkey" a ra-1 serial-a ca-0)-    (cat "privkey" b ra serial-b ca))-  -  (leads-to ((1 3) (0 0)) ((6 3) (5 0)))-  -  (operation nonce-test-    (added-listener (cat (exp (gen) (mul ra (rec ra-1))) ra-0))-    (exp (gen) (mul ra ra-0 (rec ra-1))) (5 1))-  (strand-map 0 1 2 3 4 5 6)-  (traces-    ((load static-key (cat pt "privkey" b ra serial-b ca))-      (recv-        (sig (cert a (exp (gen) ra-0) ca serial-a) (privk "sig" ca)))-      (recv (enc n a b serial-a serial-b (exp (gen) (mul ra ra-0))))-      (send n))-    ((send (sig (cert-req b (exp (gen) ra) ca) (privk "sig" b)))-      (recv (sig (cert b (exp (gen) ra) ca serial-b) (privk "sig" ca)))-      (load static-key (cat pt-0 ignore))-      (stor static-key (cat pt "privkey" b ra serial-b ca)))-    ((recv (sig (cert-req b (exp (gen) ra) ca) (privk "sig" b)))-      (send (sig (cert b (exp (gen) ra) ca serial-b) (privk "sig" ca))))-    ((recv (sig (cert-req a (exp (gen) ra-0) ca) (privk "sig" a)))-      (send-        (sig (cert a (exp (gen) ra-0) ca serial-a) (privk "sig" ca))))-    ((send (sig (cert-req a (exp (gen) ra-0) ca) (privk "sig" a))))-    ((load static-key-0 (cat pt-1 "privkey" a ra-1 serial-a ca-0))-      (recv-        (sig (cert b (exp (gen) (mul ra ra-0 (rec ra-1))) ca-0 serial-b)-          (privk "sig" ca-0)))-      (send (enc n a b serial-a serial-b (exp (gen) (mul ra ra-0)))))-    ((send (sig (cert-req a (exp (gen) ra-1) ca-0) (privk "sig" a)))-      (recv-        (sig (cert a (exp (gen) ra-1) ca-0 serial-a)-          (privk "sig" ca-0))) (load static-key-0 (cat pt-2 ignore-0))-      (stor static-key-0 (cat pt-1 "privkey" a ra-1 serial-a ca-0)))-    ((recv (cat (exp (gen) (mul ra (rec ra-1))) ra-0))-      (send (cat (exp (gen) (mul ra (rec ra-1))) ra-0))))-  (label 37)-  (parent 33)-  (unrealized (7 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton dhstatic-state-  (vars (ignore ignore-0 mesg) (serial-b serial-a data) (n text)-    (ca a b ca-0 name) (pt pt-0 pt-1 pt-2 pval)-    (static-key static-key-0 locn) (ra ra-0 ra-1 rndx))-  (defstrand resp 4 (serial-b serial-b) (serial-a serial-a) (n n) (a a)-    (b b) (ca ca) (static-key static-key) (rb ra) (alpha ra-0))-  (defstrand get-cert 4 (ignore ignore) (serial serial-b) (self b)-    (ca ca) (static-key static-key) (ra ra))-  (defstrand cert 2 (galpha (exp (gen) ra)) (serial serial-b) (subj b)-    (ca ca))-  (defstrand cert 2 (galpha (exp (gen) ra-0)) (serial serial-a) (subj a)-    (ca ca))-  (defstrand get-cert 1 (self a) (ca ca) (ra ra-0))-  (defstrand init 3 (serial-a serial-a) (serial-b serial-b) (n n) (a a)-    (b b) (ca ca-0) (static-key static-key-0) (ra ra-1)-    (alpha (mul ra ra-0 (rec ra-1))))-  (defstrand get-cert 4 (ignore ignore-0) (serial serial-a) (self a)-    (ca ca-0) (static-key static-key-0) (ra ra-1))-  (deflistener (cat (exp (gen) (mul ra-0 (rec ra-1))) ra))-  (precedes ((1 0) (2 0)) ((1 0) (7 0)) ((1 3) (0 0)) ((2 1) (1 1))-    ((2 1) (5 1)) ((3 1) (0 1)) ((3 1) (6 1)) ((4 0) (3 0))-    ((4 0) (7 0)) ((5 2) (0 2)) ((6 0) (7 0)) ((6 3) (5 0))-    ((7 1) (5 1)))-  (non-orig (privk "sig" ca) (privk "sig" a))-  (uniq-orig serial-b serial-a n)-  (uniq-gen ra ra-0 ra-1)-  (gen-st (cat "privkey" a ra-1 serial-a ca-0)-    (cat "privkey" b ra serial-b ca))-  -  (leads-to ((1 3) (0 0)) ((6 3) (5 0)))-  -  (operation nonce-test-    (added-listener (cat (exp (gen) (mul ra-0 (rec ra-1))) ra))-    (exp (gen) (mul ra ra-0 (rec ra-1))) (5 1))-  (strand-map 0 1 2 3 4 5 6)-  (traces-    ((load static-key (cat pt "privkey" b ra serial-b ca))-      (recv-        (sig (cert a (exp (gen) ra-0) ca serial-a) (privk "sig" ca)))-      (recv (enc n a b serial-a serial-b (exp (gen) (mul ra ra-0))))-      (send n))-    ((send (sig (cert-req b (exp (gen) ra) ca) (privk "sig" b)))-      (recv (sig (cert b (exp (gen) ra) ca serial-b) (privk "sig" ca)))-      (load static-key (cat pt-0 ignore))-      (stor static-key (cat pt "privkey" b ra serial-b ca)))-    ((recv (sig (cert-req b (exp (gen) ra) ca) (privk "sig" b)))-      (send (sig (cert b (exp (gen) ra) ca serial-b) (privk "sig" ca))))-    ((recv (sig (cert-req a (exp (gen) ra-0) ca) (privk "sig" a)))-      (send-        (sig (cert a (exp (gen) ra-0) ca serial-a) (privk "sig" ca))))-    ((send (sig (cert-req a (exp (gen) ra-0) ca) (privk "sig" a))))-    ((load static-key-0 (cat pt-1 "privkey" a ra-1 serial-a ca-0))-      (recv-        (sig (cert b (exp (gen) (mul ra ra-0 (rec ra-1))) ca-0 serial-b)-          (privk "sig" ca-0)))-      (send (enc n a b serial-a serial-b (exp (gen) (mul ra ra-0)))))-    ((send (sig (cert-req a (exp (gen) ra-1) ca-0) (privk "sig" a)))-      (recv-        (sig (cert a (exp (gen) ra-1) ca-0 serial-a)-          (privk "sig" ca-0))) (load static-key-0 (cat pt-2 ignore-0))-      (stor static-key-0 (cat pt-1 "privkey" a ra-1 serial-a ca-0)))-    ((recv (cat (exp (gen) (mul ra-0 (rec ra-1))) ra))-      (send (cat (exp (gen) (mul ra-0 (rec ra-1))) ra))))-  (label 38)-  (parent 33)-  (unrealized (7 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton dhstatic-state-  (vars (ignore ignore-0 mesg) (serial-b serial-a serial data) (n text)-    (b self ca name) (pt pt-0 pt-1 pt-2 pval)-    (static-key static-key-0 locn) (ra ra-0 rndx))-  (defstrand resp 4 (serial-b serial-b) (serial-a serial-a) (n n)-    (a self) (b b) (ca ca) (static-key static-key) (rb ra) (alpha ra-0))-  (defstrand get-cert 4 (ignore ignore) (serial serial-b) (self b)-    (ca ca) (static-key static-key) (ra ra))-  (defstrand cert 2 (galpha (exp (gen) ra)) (serial serial-b) (subj b)-    (ca ca))-  (defstrand cert 2 (galpha (exp (gen) ra-0)) (serial serial-a)-    (subj self) (ca ca))-  (deflistener (exp (gen) (mul ra ra-0)))-  (deflistener (cat (exp (gen) ra) ra-0))-  (defstrand get-cert 4 (ignore ignore-0) (serial serial) (self self)-    (ca ca) (static-key static-key-0) (ra ra-0))-  (precedes ((1 0) (2 0)) ((1 0) (5 0)) ((1 3) (0 0)) ((2 1) (1 1))-    ((3 1) (0 1)) ((4 1) (0 2)) ((5 1) (4 0)) ((6 0) (3 0))-    ((6 3) (5 0)))-  (non-orig (privk "sig" self) (privk "sig" ca))-  (uniq-orig serial-b serial-a)-  (uniq-gen ra ra-0)-  (gen-st (cat "privkey" b ra serial-b ca))-  -  (leads-to ((1 3) (0 0)))-  -  (operation nonce-test (displaced 4 7 get-cert 4) ra-0 (6 0))-  (strand-map 0 1 2 3 6 4 5)-  (traces-    ((load static-key (cat pt "privkey" b ra serial-b ca))-      (recv-        (sig (cert self (exp (gen) ra-0) ca serial-a) (privk "sig" ca)))-      (recv (enc n self b serial-a serial-b (exp (gen) (mul ra ra-0))))-      (send n))-    ((send (sig (cert-req b (exp (gen) ra) ca) (privk "sig" b)))-      (recv (sig (cert b (exp (gen) ra) ca serial-b) (privk "sig" ca)))-      (load static-key (cat pt-0 ignore))-      (stor static-key (cat pt "privkey" b ra serial-b ca)))-    ((recv (sig (cert-req b (exp (gen) ra) ca) (privk "sig" b)))-      (send (sig (cert b (exp (gen) ra) ca serial-b) (privk "sig" ca))))-    ((recv (sig (cert-req self (exp (gen) ra-0) ca) (privk "sig" self)))-      (send-        (sig (cert self (exp (gen) ra-0) ca serial-a)-          (privk "sig" ca))))-    ((recv (exp (gen) (mul ra ra-0))) (send (exp (gen) (mul ra ra-0))))-    ((recv (cat (exp (gen) ra) ra-0)) (send (cat (exp (gen) ra) ra-0)))-    ((send (sig (cert-req self (exp (gen) ra-0) ca) (privk "sig" self)))-      (recv-        (sig (cert self (exp (gen) ra-0) ca serial) (privk "sig" ca)))-      (load static-key-0 (cat pt-1 ignore-0))-      (stor static-key-0 (cat pt-2 "privkey" self ra-0 serial ca))))-  (label 39)-  (parent 34)-  (unrealized (5 0) (6 1))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton dhstatic-state-  (vars (ignore mesg) (serial-b serial-a data) (n text) (ca a b name)-    (pt pt-0 pval) (static-key locn) (ra ra-0 rndx))-  (defstrand resp 4 (serial-b serial-b) (serial-a serial-a) (n n) (a a)-    (b b) (ca ca) (static-key static-key) (rb ra-0) (alpha ra))-  (defstrand get-cert 4 (ignore ignore) (serial serial-b) (self b)-    (ca ca) (static-key static-key) (ra ra-0))-  (defstrand cert 2 (galpha (exp (gen) ra-0)) (serial serial-b) (subj b)-    (ca ca))-  (defstrand cert 2 (galpha (exp (gen) ra)) (serial serial-a) (subj a)-    (ca ca))-  (defstrand get-cert 1 (self a) (ca ca) (ra ra))-  (deflistener (exp (gen) (mul ra ra-0)))-  (deflistener (cat (exp (gen) ra) ra-0))-  (precedes ((1 0) (2 0)) ((1 3) (0 0)) ((1 3) (6 0)) ((2 1) (1 1))-    ((3 1) (0 1)) ((4 0) (3 0)) ((4 0) (6 0)) ((5 1) (0 2))-    ((6 1) (5 0)))-  (non-orig (privk "sig" ca) (privk "sig" a))-  (uniq-orig serial-b serial-a)-  (uniq-gen ra ra-0)-  (gen-st (cat "privkey" b ra-0 serial-b ca))-  -  (leads-to ((1 3) (0 0)))-  -  (operation nonce-test (displaced 7 1 get-cert 4) ra-0 (6 0))-  (strand-map 0 1 2 3 4 5 6)-  (traces-    ((load static-key (cat pt "privkey" b ra-0 serial-b ca))-      (recv (sig (cert a (exp (gen) ra) ca serial-a) (privk "sig" ca)))-      (recv (enc n a b serial-a serial-b (exp (gen) (mul ra ra-0))))-      (send n))-    ((send (sig (cert-req b (exp (gen) ra-0) ca) (privk "sig" b)))-      (recv-        (sig (cert b (exp (gen) ra-0) ca serial-b) (privk "sig" ca)))-      (load static-key (cat pt-0 ignore))-      (stor static-key (cat pt "privkey" b ra-0 serial-b ca)))-    ((recv (sig (cert-req b (exp (gen) ra-0) ca) (privk "sig" b)))-      (send-        (sig (cert b (exp (gen) ra-0) ca serial-b) (privk "sig" ca))))-    ((recv (sig (cert-req a (exp (gen) ra) ca) (privk "sig" a)))-      (send (sig (cert a (exp (gen) ra) ca serial-a) (privk "sig" ca))))-    ((send (sig (cert-req a (exp (gen) ra) ca) (privk "sig" a))))-    ((recv (exp (gen) (mul ra ra-0))) (send (exp (gen) (mul ra ra-0))))-    ((recv (cat (exp (gen) ra) ra-0)) (send (cat (exp (gen) ra) ra-0))))-  (label 40)-  (parent 35)-  (unrealized (6 0))-  (dead)-  (comment "empty cohort"))--(defskeleton dhstatic-state-  (vars (ignore ignore-0 mesg) (serial-b serial-a data) (n text)-    (ca a b ca-0 name) (pt pt-0 pt-1 pt-2 pval)-    (static-key static-key-0 locn) (ra ra-0 ra-1 rndx))-  (defstrand resp 4 (serial-b serial-b) (serial-a serial-a) (n n) (a a)-    (b b) (ca ca) (static-key static-key) (rb ra) (alpha ra-0))-  (defstrand get-cert 4 (ignore ignore) (serial serial-b) (self b)-    (ca ca) (static-key static-key) (ra ra))-  (defstrand cert 2 (galpha (exp (gen) ra)) (serial serial-b) (subj b)-    (ca ca))-  (defstrand cert 2 (galpha (exp (gen) ra-0)) (serial serial-a) (subj a)-    (ca ca))-  (defstrand get-cert 1 (self a) (ca ca) (ra ra-0))-  (defstrand init 3 (serial-a serial-a) (serial-b serial-b) (n n) (a a)-    (b b) (ca ca-0) (static-key static-key-0) (ra ra-1)-    (alpha (mul ra ra-0 (rec ra-1))))-  (defstrand get-cert 4 (ignore ignore-0) (serial serial-a) (self a)-    (ca ca-0) (static-key static-key-0) (ra ra-1))-  (deflistener (cat (exp (gen) (mul ra ra-0)) ra-1))-  (precedes ((1 0) (2 0)) ((1 0) (7 0)) ((1 3) (0 0)) ((2 1) (1 1))-    ((2 1) (5 1)) ((3 1) (0 1)) ((3 1) (6 1)) ((4 0) (3 0))-    ((5 2) (0 2)) ((6 3) (5 0)) ((6 3) (7 0)) ((7 1) (5 1)))-  (non-orig (privk "sig" ca) (privk "sig" a))-  (uniq-orig serial-b serial-a n)-  (uniq-gen ra ra-0 ra-1)-  (gen-st (cat "privkey" a ra-1 serial-a ca-0)-    (cat "privkey" b ra serial-b ca))-  -  (leads-to ((1 3) (0 0)) ((6 3) (5 0)))-  -  (operation nonce-test (displaced 8 6 get-cert 4) ra-1 (7 0))-  (strand-map 0 1 2 3 4 5 6 7)-  (traces-    ((load static-key (cat pt "privkey" b ra serial-b ca))-      (recv-        (sig (cert a (exp (gen) ra-0) ca serial-a) (privk "sig" ca)))-      (recv (enc n a b serial-a serial-b (exp (gen) (mul ra ra-0))))-      (send n))-    ((send (sig (cert-req b (exp (gen) ra) ca) (privk "sig" b)))-      (recv (sig (cert b (exp (gen) ra) ca serial-b) (privk "sig" ca)))-      (load static-key (cat pt-0 ignore))-      (stor static-key (cat pt "privkey" b ra serial-b ca)))-    ((recv (sig (cert-req b (exp (gen) ra) ca) (privk "sig" b)))-      (send (sig (cert b (exp (gen) ra) ca serial-b) (privk "sig" ca))))-    ((recv (sig (cert-req a (exp (gen) ra-0) ca) (privk "sig" a)))-      (send-        (sig (cert a (exp (gen) ra-0) ca serial-a) (privk "sig" ca))))-    ((send (sig (cert-req a (exp (gen) ra-0) ca) (privk "sig" a))))-    ((load static-key-0 (cat pt-1 "privkey" a ra-1 serial-a ca-0))-      (recv-        (sig (cert b (exp (gen) (mul ra ra-0 (rec ra-1))) ca-0 serial-b)-          (privk "sig" ca-0)))-      (send (enc n a b serial-a serial-b (exp (gen) (mul ra ra-0)))))-    ((send (sig (cert-req a (exp (gen) ra-1) ca-0) (privk "sig" a)))-      (recv-        (sig (cert a (exp (gen) ra-1) ca-0 serial-a)-          (privk "sig" ca-0))) (load static-key-0 (cat pt-2 ignore-0))-      (stor static-key-0 (cat pt-1 "privkey" a ra-1 serial-a ca-0)))-    ((recv (cat (exp (gen) (mul ra ra-0)) ra-1))-      (send (cat (exp (gen) (mul ra ra-0)) ra-1))))-  (label 41)-  (parent 36)-  (unrealized (7 0))-  (dead)-  (comment "empty cohort"))--(defskeleton dhstatic-state-  (vars (ignore ignore-0 ignore-1 mesg) (serial-b serial-a serial data)-    (n text) (b ca self ca-0 name) (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval)-    (static-key static-key-0 static-key-1 locn) (ra ra-0 ra-1 rndx))-  (defstrand resp 4 (serial-b serial-b) (serial-a serial-a) (n n)-    (a self) (b b) (ca ca-0) (static-key static-key) (rb ra)-    (alpha ra-1))-  (defstrand get-cert 4 (ignore ignore) (serial serial-b) (self b)-    (ca ca-0) (static-key static-key) (ra ra))-  (defstrand cert 2 (galpha (exp (gen) ra)) (serial serial-b) (subj b)-    (ca ca-0))-  (defstrand cert 2 (galpha (exp (gen) ra-1)) (serial serial-a)-    (subj self) (ca ca-0))-  (defstrand init 3 (serial-a serial-a) (serial-b serial-b) (n n)-    (a self) (b b) (ca ca) (static-key static-key-0) (ra ra-0)-    (alpha (mul ra (rec ra-0) ra-1)))-  (defstrand get-cert 4 (ignore ignore-0) (serial serial-a) (self self)-    (ca ca) (static-key static-key-0) (ra ra-0))-  (deflistener (cat (exp (gen) (mul ra (rec ra-0))) ra-1))-  (defstrand get-cert 4 (ignore ignore-1) (serial serial) (self self)-    (ca ca-0) (static-key static-key-1) (ra ra-1))-  (precedes ((1 0) (2 0)) ((1 0) (6 0)) ((1 3) (0 0)) ((2 1) (1 1))-    ((2 1) (4 1)) ((3 1) (0 1)) ((3 1) (5 1)) ((4 2) (0 2))-    ((5 0) (6 0)) ((5 3) (4 0)) ((6 1) (4 1)) ((7 0) (3 0))-    ((7 3) (6 0)))-  (non-orig (privk "sig" self) (privk "sig" ca-0))-  (uniq-orig serial-b serial-a n)-  (uniq-gen ra ra-0 ra-1)-  (gen-st (cat "privkey" b ra serial-b ca-0)-    (cat "privkey" self ra-0 serial-a ca))-  -  (leads-to ((1 3) (0 0)) ((5 3) (4 0)))-  -  (operation nonce-test (displaced 4 8 get-cert 4) ra-1 (7 0))-  (strand-map 0 1 2 3 7 4 5 6)-  (traces-    ((load static-key (cat pt "privkey" b ra serial-b ca-0))-      (recv-        (sig (cert self (exp (gen) ra-1) ca-0 serial-a)-          (privk "sig" ca-0)))-      (recv (enc n self b serial-a serial-b (exp (gen) (mul ra ra-1))))-      (send n))-    ((send (sig (cert-req b (exp (gen) ra) ca-0) (privk "sig" b)))-      (recv-        (sig (cert b (exp (gen) ra) ca-0 serial-b) (privk "sig" ca-0)))-      (load static-key (cat pt-0 ignore))-      (stor static-key (cat pt "privkey" b ra serial-b ca-0)))-    ((recv (sig (cert-req b (exp (gen) ra) ca-0) (privk "sig" b)))-      (send-        (sig (cert b (exp (gen) ra) ca-0 serial-b) (privk "sig" ca-0))))-    ((recv-       (sig (cert-req self (exp (gen) ra-1) ca-0) (privk "sig" self)))-      (send-        (sig (cert self (exp (gen) ra-1) ca-0 serial-a)-          (privk "sig" ca-0))))-    ((load static-key-0 (cat pt-1 "privkey" self ra-0 serial-a ca))-      (recv-        (sig (cert b (exp (gen) (mul ra (rec ra-0) ra-1)) ca serial-b)-          (privk "sig" ca)))-      (send (enc n self b serial-a serial-b (exp (gen) (mul ra ra-1)))))-    ((send (sig (cert-req self (exp (gen) ra-0) ca) (privk "sig" self)))-      (recv-        (sig (cert self (exp (gen) ra-0) ca serial-a) (privk "sig" ca)))-      (load static-key-0 (cat pt-2 ignore-0))-      (stor static-key-0 (cat pt-1 "privkey" self ra-0 serial-a ca)))-    ((recv (cat (exp (gen) (mul ra (rec ra-0))) ra-1))-      (send (cat (exp (gen) (mul ra (rec ra-0))) ra-1)))-    ((send-       (sig (cert-req self (exp (gen) ra-1) ca-0) (privk "sig" self)))-      (recv-        (sig (cert self (exp (gen) ra-1) ca-0 serial)-          (privk "sig" ca-0))) (load static-key-1 (cat pt-3 ignore-1))-      (stor static-key-1 (cat pt-4 "privkey" self ra-1 serial ca-0))))-  (label 42)-  (parent 37)-  (unrealized (6 0) (7 1))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton dhstatic-state-  (vars (ignore ignore-0 mesg) (serial-b serial-a data) (n text)-    (ca a b ca-0 name) (pt pt-0 pt-1 pt-2 pval)-    (static-key static-key-0 locn) (ra ra-0 ra-1 rndx))-  (defstrand resp 4 (serial-b serial-b) (serial-a serial-a) (n n) (a a)-    (b b) (ca ca) (static-key static-key) (rb ra-1) (alpha ra))-  (defstrand get-cert 4 (ignore ignore) (serial serial-b) (self b)-    (ca ca) (static-key static-key) (ra ra-1))-  (defstrand cert 2 (galpha (exp (gen) ra-1)) (serial serial-b) (subj b)-    (ca ca))-  (defstrand cert 2 (galpha (exp (gen) ra)) (serial serial-a) (subj a)-    (ca ca))-  (defstrand get-cert 1 (self a) (ca ca) (ra ra))-  (defstrand init 3 (serial-a serial-a) (serial-b serial-b) (n n) (a a)-    (b b) (ca ca-0) (static-key static-key-0) (ra ra-0)-    (alpha (mul ra (rec ra-0) ra-1)))-  (defstrand get-cert 4 (ignore ignore-0) (serial serial-a) (self a)-    (ca ca-0) (static-key static-key-0) (ra ra-0))-  (deflistener (cat (exp (gen) (mul ra (rec ra-0))) ra-1))-  (precedes ((1 0) (2 0)) ((1 3) (0 0)) ((1 3) (7 0)) ((2 1) (1 1))-    ((3 1) (0 1)) ((3 1) (6 1)) ((4 0) (3 0)) ((4 0) (7 0))-    ((5 2) (0 2)) ((6 0) (7 0)) ((6 3) (5 0)) ((7 1) (5 1)))-  (non-orig (privk "sig" ca) (privk "sig" a))-  (uniq-orig serial-b serial-a n)-  (uniq-gen ra ra-0 ra-1)-  (gen-st (cat "privkey" a ra-0 serial-a ca-0)-    (cat "privkey" b ra-1 serial-b ca))-  -  (leads-to ((1 3) (0 0)) ((6 3) (5 0)))-  -  (operation nonce-test (displaced 8 1 get-cert 4) ra-1 (7 0))-  (strand-map 0 1 2 3 4 5 6 7)-  (traces-    ((load static-key (cat pt "privkey" b ra-1 serial-b ca))-      (recv (sig (cert a (exp (gen) ra) ca serial-a) (privk "sig" ca)))-      (recv (enc n a b serial-a serial-b (exp (gen) (mul ra ra-1))))-      (send n))-    ((send (sig (cert-req b (exp (gen) ra-1) ca) (privk "sig" b)))-      (recv-        (sig (cert b (exp (gen) ra-1) ca serial-b) (privk "sig" ca)))-      (load static-key (cat pt-0 ignore))-      (stor static-key (cat pt "privkey" b ra-1 serial-b ca)))-    ((recv (sig (cert-req b (exp (gen) ra-1) ca) (privk "sig" b)))-      (send-        (sig (cert b (exp (gen) ra-1) ca serial-b) (privk "sig" ca))))-    ((recv (sig (cert-req a (exp (gen) ra) ca) (privk "sig" a)))-      (send (sig (cert a (exp (gen) ra) ca serial-a) (privk "sig" ca))))-    ((send (sig (cert-req a (exp (gen) ra) ca) (privk "sig" a))))-    ((load static-key-0 (cat pt-1 "privkey" a ra-0 serial-a ca-0))-      (recv-        (sig (cert b (exp (gen) (mul ra (rec ra-0) ra-1)) ca-0 serial-b)-          (privk "sig" ca-0)))-      (send (enc n a b serial-a serial-b (exp (gen) (mul ra ra-1)))))-    ((send (sig (cert-req a (exp (gen) ra-0) ca-0) (privk "sig" a)))-      (recv-        (sig (cert a (exp (gen) ra-0) ca-0 serial-a)-          (privk "sig" ca-0))) (load static-key-0 (cat pt-2 ignore-0))-      (stor static-key-0 (cat pt-1 "privkey" a ra-0 serial-a ca-0)))-    ((recv (cat (exp (gen) (mul ra (rec ra-0))) ra-1))-      (send (cat (exp (gen) (mul ra (rec ra-0))) ra-1))))-  (label 43)-  (parent 38)-  (unrealized (7 0))-  (dead)-  (comment "empty cohort"))--(defskeleton dhstatic-state-  (vars (ignore ignore-0 mesg) (serial-b serial-a data) (n text)-    (b self ca name) (pt pt-0 pt-1 pt-2 pval)-    (static-key static-key-0 locn) (ra ra-0 rndx))-  (defstrand resp 4 (serial-b serial-b) (serial-a serial-a) (n n)-    (a self) (b b) (ca ca) (static-key static-key) (rb ra) (alpha ra-0))-  (defstrand get-cert 4 (ignore ignore) (serial serial-b) (self b)-    (ca ca) (static-key static-key) (ra ra))-  (defstrand cert 2 (galpha (exp (gen) ra)) (serial serial-b) (subj b)-    (ca ca))-  (defstrand cert 2 (galpha (exp (gen) ra-0)) (serial serial-a)-    (subj self) (ca ca))-  (deflistener (exp (gen) (mul ra ra-0)))-  (deflistener (cat (exp (gen) ra) ra-0))-  (defstrand get-cert 4 (ignore ignore-0) (serial serial-a) (self self)-    (ca ca) (static-key static-key-0) (ra ra-0))-  (precedes ((1 0) (2 0)) ((1 0) (5 0)) ((1 3) (0 0)) ((2 1) (1 1))-    ((3 1) (0 1)) ((3 1) (6 1)) ((4 1) (0 2)) ((5 1) (4 0))-    ((6 0) (3 0)) ((6 3) (5 0)))-  (non-orig (privk "sig" self) (privk "sig" ca))-  (uniq-orig serial-b serial-a)-  (uniq-gen ra ra-0)-  (gen-st (cat "privkey" b ra serial-b ca))-  -  (leads-to ((1 3) (0 0)))-  -  (operation encryption-test (displaced 7 3 cert 2)-    (sig (cert self (exp (gen) ra-0) ca serial) (privk "sig" ca)) (6 1))-  (strand-map 0 1 2 3 4 5 6)-  (traces-    ((load static-key (cat pt "privkey" b ra serial-b ca))-      (recv-        (sig (cert self (exp (gen) ra-0) ca serial-a) (privk "sig" ca)))-      (recv (enc n self b serial-a serial-b (exp (gen) (mul ra ra-0))))-      (send n))-    ((send (sig (cert-req b (exp (gen) ra) ca) (privk "sig" b)))-      (recv (sig (cert b (exp (gen) ra) ca serial-b) (privk "sig" ca)))-      (load static-key (cat pt-0 ignore))-      (stor static-key (cat pt "privkey" b ra serial-b ca)))-    ((recv (sig (cert-req b (exp (gen) ra) ca) (privk "sig" b)))-      (send (sig (cert b (exp (gen) ra) ca serial-b) (privk "sig" ca))))-    ((recv (sig (cert-req self (exp (gen) ra-0) ca) (privk "sig" self)))-      (send-        (sig (cert self (exp (gen) ra-0) ca serial-a)-          (privk "sig" ca))))-    ((recv (exp (gen) (mul ra ra-0))) (send (exp (gen) (mul ra ra-0))))-    ((recv (cat (exp (gen) ra) ra-0)) (send (cat (exp (gen) ra) ra-0)))-    ((send (sig (cert-req self (exp (gen) ra-0) ca) (privk "sig" self)))-      (recv-        (sig (cert self (exp (gen) ra-0) ca serial-a) (privk "sig" ca)))-      (load static-key-0 (cat pt-1 ignore-0))-      (stor static-key-0 (cat pt-2 "privkey" self ra-0 serial-a ca))))-  (label 44)-  (parent 39)-  (unrealized (5 0))-  (dead)-  (comment "empty cohort"))--(defskeleton dhstatic-state-  (vars (ignore ignore-0 mesg) (serial-b serial-a serial data) (n text)-    (b self ca name) (pt pt-0 pt-1 pt-2 pval)-    (static-key static-key-0 locn) (ra ra-0 rndx))-  (defstrand resp 4 (serial-b serial-b) (serial-a serial-a) (n n)-    (a self) (b b) (ca ca) (static-key static-key) (rb ra) (alpha ra-0))-  (defstrand get-cert 4 (ignore ignore) (serial serial-b) (self b)-    (ca ca) (static-key static-key) (ra ra))-  (defstrand cert 2 (galpha (exp (gen) ra)) (serial serial-b) (subj b)-    (ca ca))-  (defstrand cert 2 (galpha (exp (gen) ra-0)) (serial serial-a)-    (subj self) (ca ca))-  (deflistener (exp (gen) (mul ra ra-0)))-  (deflistener (cat (exp (gen) ra) ra-0))-  (defstrand get-cert 4 (ignore ignore-0) (serial serial) (self self)-    (ca ca) (static-key static-key-0) (ra ra-0))-  (defstrand cert 2 (galpha (exp (gen) ra-0)) (serial serial)-    (subj self) (ca ca))-  (precedes ((1 0) (2 0)) ((1 0) (5 0)) ((1 3) (0 0)) ((2 1) (1 1))-    ((3 1) (0 1)) ((4 1) (0 2)) ((5 1) (4 0)) ((6 0) (3 0))-    ((6 0) (7 0)) ((6 3) (5 0)) ((7 1) (6 1)))-  (non-orig (privk "sig" self) (privk "sig" ca))-  (uniq-orig serial-b serial-a serial)-  (uniq-gen ra ra-0)-  (gen-st (cat "privkey" b ra serial-b ca))-  -  (leads-to ((1 3) (0 0)))-  -  (operation encryption-test (added-strand cert 2)-    (sig (cert self (exp (gen) ra-0) ca serial) (privk "sig" ca)) (6 1))-  (strand-map 0 1 2 3 4 5 6)-  (traces-    ((load static-key (cat pt "privkey" b ra serial-b ca))-      (recv-        (sig (cert self (exp (gen) ra-0) ca serial-a) (privk "sig" ca)))-      (recv (enc n self b serial-a serial-b (exp (gen) (mul ra ra-0))))-      (send n))-    ((send (sig (cert-req b (exp (gen) ra) ca) (privk "sig" b)))-      (recv (sig (cert b (exp (gen) ra) ca serial-b) (privk "sig" ca)))-      (load static-key (cat pt-0 ignore))-      (stor static-key (cat pt "privkey" b ra serial-b ca)))-    ((recv (sig (cert-req b (exp (gen) ra) ca) (privk "sig" b)))-      (send (sig (cert b (exp (gen) ra) ca serial-b) (privk "sig" ca))))-    ((recv (sig (cert-req self (exp (gen) ra-0) ca) (privk "sig" self)))-      (send-        (sig (cert self (exp (gen) ra-0) ca serial-a)-          (privk "sig" ca))))-    ((recv (exp (gen) (mul ra ra-0))) (send (exp (gen) (mul ra ra-0))))-    ((recv (cat (exp (gen) ra) ra-0)) (send (cat (exp (gen) ra) ra-0)))-    ((send (sig (cert-req self (exp (gen) ra-0) ca) (privk "sig" self)))-      (recv-        (sig (cert self (exp (gen) ra-0) ca serial) (privk "sig" ca)))-      (load static-key-0 (cat pt-1 ignore-0))-      (stor static-key-0 (cat pt-2 "privkey" self ra-0 serial ca)))-    ((recv (sig (cert-req self (exp (gen) ra-0) ca) (privk "sig" self)))-      (send-        (sig (cert self (exp (gen) ra-0) ca serial) (privk "sig" ca)))))-  (label 45)-  (parent 39)-  (unrealized (5 0))-  (dead)-  (comment "empty cohort"))--(defskeleton dhstatic-state-  (vars (ignore ignore-0 ignore-1 mesg) (serial-b serial-a data)-    (n text) (b ca self ca-0 name) (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval)-    (static-key static-key-0 static-key-1 locn) (ra ra-0 ra-1 rndx))-  (defstrand resp 4 (serial-b serial-b) (serial-a serial-a) (n n)-    (a self) (b b) (ca ca-0) (static-key static-key) (rb ra)-    (alpha ra-1))-  (defstrand get-cert 4 (ignore ignore) (serial serial-b) (self b)-    (ca ca-0) (static-key static-key) (ra ra))-  (defstrand cert 2 (galpha (exp (gen) ra)) (serial serial-b) (subj b)-    (ca ca-0))-  (defstrand cert 2 (galpha (exp (gen) ra-1)) (serial serial-a)-    (subj self) (ca ca-0))-  (defstrand init 3 (serial-a serial-a) (serial-b serial-b) (n n)-    (a self) (b b) (ca ca) (static-key static-key-0) (ra ra-0)-    (alpha (mul ra (rec ra-0) ra-1)))-  (defstrand get-cert 4 (ignore ignore-0) (serial serial-a) (self self)-    (ca ca) (static-key static-key-0) (ra ra-0))-  (deflistener (cat (exp (gen) (mul ra (rec ra-0))) ra-1))-  (defstrand get-cert 4 (ignore ignore-1) (serial serial-a) (self self)-    (ca ca-0) (static-key static-key-1) (ra ra-1))-  (precedes ((1 0) (2 0)) ((1 0) (6 0)) ((1 3) (0 0)) ((2 1) (1 1))-    ((2 1) (4 1)) ((3 1) (0 1)) ((3 1) (5 1)) ((3 1) (7 1))-    ((4 2) (0 2)) ((5 0) (6 0)) ((5 3) (4 0)) ((6 1) (4 1))-    ((7 0) (3 0)) ((7 3) (6 0)))-  (non-orig (privk "sig" self) (privk "sig" ca-0))-  (uniq-orig serial-b serial-a n)-  (uniq-gen ra ra-0 ra-1)-  (gen-st (cat "privkey" b ra serial-b ca-0)-    (cat "privkey" self ra-0 serial-a ca))-  -  (leads-to ((1 3) (0 0)) ((5 3) (4 0)))-  -  (operation encryption-test (displaced 8 3 cert 2)-    (sig (cert self (exp (gen) ra-1) ca-0 serial) (privk "sig" ca-0))-    (7 1))-  (strand-map 0 1 2 3 4 5 6 7)-  (traces-    ((load static-key (cat pt "privkey" b ra serial-b ca-0))-      (recv-        (sig (cert self (exp (gen) ra-1) ca-0 serial-a)-          (privk "sig" ca-0)))-      (recv (enc n self b serial-a serial-b (exp (gen) (mul ra ra-1))))-      (send n))-    ((send (sig (cert-req b (exp (gen) ra) ca-0) (privk "sig" b)))-      (recv-        (sig (cert b (exp (gen) ra) ca-0 serial-b) (privk "sig" ca-0)))-      (load static-key (cat pt-0 ignore))-      (stor static-key (cat pt "privkey" b ra serial-b ca-0)))-    ((recv (sig (cert-req b (exp (gen) ra) ca-0) (privk "sig" b)))-      (send-        (sig (cert b (exp (gen) ra) ca-0 serial-b) (privk "sig" ca-0))))-    ((recv-       (sig (cert-req self (exp (gen) ra-1) ca-0) (privk "sig" self)))-      (send-        (sig (cert self (exp (gen) ra-1) ca-0 serial-a)-          (privk "sig" ca-0))))-    ((load static-key-0 (cat pt-1 "privkey" self ra-0 serial-a ca))-      (recv-        (sig (cert b (exp (gen) (mul ra (rec ra-0) ra-1)) ca serial-b)-          (privk "sig" ca)))-      (send (enc n self b serial-a serial-b (exp (gen) (mul ra ra-1)))))-    ((send (sig (cert-req self (exp (gen) ra-0) ca) (privk "sig" self)))-      (recv-        (sig (cert self (exp (gen) ra-0) ca serial-a) (privk "sig" ca)))-      (load static-key-0 (cat pt-2 ignore-0))-      (stor static-key-0 (cat pt-1 "privkey" self ra-0 serial-a ca)))-    ((recv (cat (exp (gen) (mul ra (rec ra-0))) ra-1))-      (send (cat (exp (gen) (mul ra (rec ra-0))) ra-1)))-    ((send-       (sig (cert-req self (exp (gen) ra-1) ca-0) (privk "sig" self)))-      (recv-        (sig (cert self (exp (gen) ra-1) ca-0 serial-a)-          (privk "sig" ca-0))) (load static-key-1 (cat pt-3 ignore-1))-      (stor static-key-1 (cat pt-4 "privkey" self ra-1 serial-a ca-0))))-  (label 46)-  (parent 42)-  (unrealized (6 0))-  (dead)-  (comment "empty cohort"))--(defskeleton dhstatic-state-  (vars (ignore ignore-0 ignore-1 mesg) (serial-b serial-a serial data)-    (n text) (b ca self ca-0 name) (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval)-    (static-key static-key-0 static-key-1 locn) (ra ra-0 ra-1 rndx))-  (defstrand resp 4 (serial-b serial-b) (serial-a serial-a) (n n)-    (a self) (b b) (ca ca-0) (static-key static-key) (rb ra)-    (alpha ra-1))-  (defstrand get-cert 4 (ignore ignore) (serial serial-b) (self b)-    (ca ca-0) (static-key static-key) (ra ra))-  (defstrand cert 2 (galpha (exp (gen) ra)) (serial serial-b) (subj b)-    (ca ca-0))-  (defstrand cert 2 (galpha (exp (gen) ra-1)) (serial serial-a)-    (subj self) (ca ca-0))-  (defstrand init 3 (serial-a serial-a) (serial-b serial-b) (n n)-    (a self) (b b) (ca ca) (static-key static-key-0) (ra ra-0)-    (alpha (mul ra (rec ra-0) ra-1)))-  (defstrand get-cert 4 (ignore ignore-0) (serial serial-a) (self self)-    (ca ca) (static-key static-key-0) (ra ra-0))-  (deflistener (cat (exp (gen) (mul ra (rec ra-0))) ra-1))-  (defstrand get-cert 4 (ignore ignore-1) (serial serial) (self self)-    (ca ca-0) (static-key static-key-1) (ra ra-1))-  (defstrand cert 2 (galpha (exp (gen) ra-1)) (serial serial)-    (subj self) (ca ca-0))-  (precedes ((1 0) (2 0)) ((1 0) (6 0)) ((1 3) (0 0)) ((2 1) (1 1))-    ((2 1) (4 1)) ((3 1) (0 1)) ((3 1) (5 1)) ((4 2) (0 2))-    ((5 0) (6 0)) ((5 3) (4 0)) ((6 1) (4 1)) ((7 0) (3 0))-    ((7 0) (8 0)) ((7 3) (6 0)) ((8 1) (7 1)))-  (non-orig (privk "sig" self) (privk "sig" ca-0))-  (uniq-orig serial-b serial-a serial n)-  (uniq-gen ra ra-0 ra-1)-  (gen-st (cat "privkey" b ra serial-b ca-0)-    (cat "privkey" self ra-0 serial-a ca))-  -  (leads-to ((1 3) (0 0)) ((5 3) (4 0)))-  -  (operation encryption-test (added-strand cert 2)-    (sig (cert self (exp (gen) ra-1) ca-0 serial) (privk "sig" ca-0))-    (7 1))-  (strand-map 0 1 2 3 4 5 6 7)-  (traces-    ((load static-key (cat pt "privkey" b ra serial-b ca-0))-      (recv-        (sig (cert self (exp (gen) ra-1) ca-0 serial-a)-          (privk "sig" ca-0)))-      (recv (enc n self b serial-a serial-b (exp (gen) (mul ra ra-1))))-      (send n))-    ((send (sig (cert-req b (exp (gen) ra) ca-0) (privk "sig" b)))-      (recv-        (sig (cert b (exp (gen) ra) ca-0 serial-b) (privk "sig" ca-0)))-      (load static-key (cat pt-0 ignore))-      (stor static-key (cat pt "privkey" b ra serial-b ca-0)))-    ((recv (sig (cert-req b (exp (gen) ra) ca-0) (privk "sig" b)))-      (send-        (sig (cert b (exp (gen) ra) ca-0 serial-b) (privk "sig" ca-0))))-    ((recv-       (sig (cert-req self (exp (gen) ra-1) ca-0) (privk "sig" self)))-      (send-        (sig (cert self (exp (gen) ra-1) ca-0 serial-a)-          (privk "sig" ca-0))))-    ((load static-key-0 (cat pt-1 "privkey" self ra-0 serial-a ca))-      (recv-        (sig (cert b (exp (gen) (mul ra (rec ra-0) ra-1)) ca serial-b)-          (privk "sig" ca)))-      (send (enc n self b serial-a serial-b (exp (gen) (mul ra ra-1)))))-    ((send (sig (cert-req self (exp (gen) ra-0) ca) (privk "sig" self)))-      (recv-        (sig (cert self (exp (gen) ra-0) ca serial-a) (privk "sig" ca)))-      (load static-key-0 (cat pt-2 ignore-0))-      (stor static-key-0 (cat pt-1 "privkey" self ra-0 serial-a ca)))-    ((recv (cat (exp (gen) (mul ra (rec ra-0))) ra-1))-      (send (cat (exp (gen) (mul ra (rec ra-0))) ra-1)))-    ((send-       (sig (cert-req self (exp (gen) ra-1) ca-0) (privk "sig" self)))-      (recv-        (sig (cert self (exp (gen) ra-1) ca-0 serial)-          (privk "sig" ca-0))) (load static-key-1 (cat pt-3 ignore-1))-      (stor static-key-1 (cat pt-4 "privkey" self ra-1 serial ca-0)))-    ((recv-       (sig (cert-req self (exp (gen) ra-1) ca-0) (privk "sig" self)))-      (send-        (sig (cert self (exp (gen) ra-1) ca-0 serial)-          (privk "sig" ca-0)))))-  (label 47)-  (parent 42)-  (unrealized (6 0))-  (dead)-  (comment "empty cohort"))--(comment "Nothing left to do")
− tst/defact-dhstatic-state_shapes.tst 
@@ -1,390 +0,0 @@-(comment "CPSA 4.4.5")-(comment "Extracted shapes")--(herald dhstatic-state (algebra diffie-hellman) (bound 16))--(comment "CPSA 4.4.5")--(comment "All input read from tst/dhstatic-state.scm")--(comment "Strand count bounded at 16")--(defprotocol dhstatic-state diffie-hellman-  (defrole cert-    (vars (subj ca name) (serial data) (galpha mesg))-    (trace (recv (sig (cert-req subj galpha ca) (privk "sig" subj)))-      (send (sig (cert subj galpha ca serial) (privk "sig" ca))))-    (uniq-orig serial)-    (comment "Certificate Authority"))-  (defrole get-cert-    (vars (self ca name) (serial data) (ra rndx) (static-key locn)-      (ignore mesg))-    (trace-      (send (sig (cert-req self (exp (gen) ra) ca) (privk "sig" self)))-      (recv (sig (cert self (exp (gen) ra) ca serial) (privk "sig" ca)))-      (load static-key ignore)-      (stor static-key (cat "privkey" self ra serial ca)))-    (uniq-gen ra)-    (comment "Get certified"))-  (defrole init-    (vars (a b ca name) (ra rndx) (serial-a serial-b data) (alpha expt)-      (n text) (static-key locn))-    (trace (load static-key (cat "privkey" a ra serial-a ca))-      (recv-        (sig (cert b (exp (gen) alpha) ca serial-b) (privk "sig" ca)))-      (send (enc n a b serial-a serial-b (exp (gen) (mul ra alpha))))-      (recv n))-    (uniq-orig n)-    (gen-st (cat "privkey" a ra serial-a ca))-    (comment "Initiator is A"))-  (defrole resp-    (vars (a b ca name) (rb rndx) (serial-b serial-a data) (alpha expt)-      (n text) (static-key locn))-    (trace (load static-key (cat "privkey" b rb serial-b ca))-      (recv-        (sig (cert a (exp (gen) alpha) ca serial-a) (privk "sig" ca)))-      (recv (enc n a b serial-a serial-b (exp (gen) (mul rb alpha))))-      (send n))-    (gen-st (cat "privkey" b rb serial-b ca))-    (comment "Responder is B"))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule shearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule invShearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule fact-init-neq0-    (forall ((z strd) (b a name))-      (implies-        (and (p "init" z (idx 2)) (p "init" "a" z a) (p "init" "b" z b))-        (fact neq a b))))-  (defgenrule fact-resp-neq0-    (forall ((z strd) (b a name))-      (implies-        (and (p "resp" z (idx 2)) (p "resp" "a" z a) (p "resp" "b" z b))-        (fact neq a b))))-  (defgenrule trRl_get-cert-at-3-    (forall ((z strd))-      (implies (p "get-cert" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_get-cert-at-2-    (forall ((z strd))-      (implies (p "get-cert" z (idx 4)) (trans z (idx 2)))))-  (defgenrule gen-st-init-0-    (forall ((z strd) (a name) (ra rndx) (serial-a data) (ca name))-      (implies-        (and (p "init" z (idx 1)) (p "init" "ca" z ca)-          (p "init" "serial-a" z serial-a) (p "init" "ra" z ra)-          (p "init" "a" z a))-        (gen-st (cat "privkey" a ra serial-a ca)))))-  (defgenrule gen-st-resp-0-    (forall ((z strd) (b name) (rb rndx) (serial-b data) (ca name))-      (implies-        (and (p "resp" z (idx 1)) (p "resp" "ca" z ca)-          (p "resp" "serial-b" z serial-b) (p "resp" "rb" z rb)-          (p "resp" "b" z b))-        (gen-st (cat "privkey" b rb serial-b ca)))))-  (lang (cert-req (tupl 3)) (cert (tupl 4)) (sig sign)))--(defskeleton dhstatic-state-  (vars (serial-a serial-b data) (n text) (ca b a name) (pt pval)-    (static-key locn) (ra rndx) (alpha expt))-  (defstrand init 4 (serial-a serial-a) (serial-b serial-b) (n n) (a a)-    (b b) (ca ca) (static-key static-key) (ra ra) (alpha alpha))-  (non-orig (privk "sig" ca) (privk "sig" b))-  (uniq-orig n)-  (traces-    ((load static-key (cat pt "privkey" a ra serial-a ca))-      (recv-        (sig (cert b (exp (gen) alpha) ca serial-b) (privk "sig" ca)))-      (send (enc n a b serial-a serial-b (exp (gen) (mul ra alpha))))-      (recv n)))-  (label 0)-  (unrealized (0 1))-  (origs (n (0 2)))-  (comment "Not closed under rules"))--(defskeleton dhstatic-state-  (vars (ignore ignore-0 mesg) (serial-a serial-b data) (n text)-    (b a ca name) (pt pt-0 pt-1 pt-2 pval)-    (static-key static-key-0 locn) (ra ra-0 rndx))-  (defstrand init 4 (serial-a serial-a) (serial-b serial-b) (n n) (a a)-    (b b) (ca ca) (static-key static-key) (ra ra) (alpha ra-0))-  (defstrand get-cert 4 (ignore ignore) (serial serial-a) (self a)-    (ca ca) (static-key static-key) (ra ra))-  (defstrand cert 2 (galpha (exp (gen) ra)) (serial serial-a) (subj a)-    (ca ca))-  (defstrand cert 2 (galpha (exp (gen) ra-0)) (serial serial-b) (subj b)-    (ca ca))-  (defstrand resp 4 (serial-b serial-b) (serial-a serial-a) (n n) (a a)-    (b b) (ca ca) (static-key static-key-0) (rb ra-0) (alpha ra))-  (defstrand get-cert 4 (ignore ignore-0) (serial serial-b) (self b)-    (ca ca) (static-key static-key-0) (ra ra-0))-  (precedes ((0 2) (4 2)) ((1 0) (2 0)) ((1 3) (0 0)) ((2 1) (1 1))-    ((2 1) (4 1)) ((3 1) (0 1)) ((3 1) (5 1)) ((4 3) (0 3))-    ((5 0) (3 0)) ((5 3) (4 0)))-  (non-orig (privk "sig" b) (privk "sig" ca))-  (uniq-orig serial-a serial-b n)-  (uniq-gen ra ra-0)-  (gen-st (cat "privkey" b ra-0 serial-b ca)-    (cat "privkey" a ra serial-a ca))-  (leads-to ((1 3) (0 0)) ((5 3) (4 0)))-  (operation channel-test (displaced 4 6 get-cert 4)-    (ch-msg static-key-0 (cat pt-1 "privkey" b ra-1 serial-b ca)) (5 0))-  (strand-map 0 1 2 3 5 4)-  (traces-    ((load static-key (cat pt "privkey" a ra serial-a ca))-      (recv-        (sig (cert b (exp (gen) ra-0) ca serial-b) (privk "sig" ca)))-      (send (enc n a b serial-a serial-b (exp (gen) (mul ra ra-0))))-      (recv n))-    ((send (sig (cert-req a (exp (gen) ra) ca) (privk "sig" a)))-      (recv (sig (cert a (exp (gen) ra) ca serial-a) (privk "sig" ca)))-      (load static-key (cat pt-0 ignore))-      (stor static-key (cat pt "privkey" a ra serial-a ca)))-    ((recv (sig (cert-req a (exp (gen) ra) ca) (privk "sig" a)))-      (send (sig (cert a (exp (gen) ra) ca serial-a) (privk "sig" ca))))-    ((recv (sig (cert-req b (exp (gen) ra-0) ca) (privk "sig" b)))-      (send-        (sig (cert b (exp (gen) ra-0) ca serial-b) (privk "sig" ca))))-    ((load static-key-0 (cat pt-1 "privkey" b ra-0 serial-b ca))-      (recv (sig (cert a (exp (gen) ra) ca serial-a) (privk "sig" ca)))-      (recv (enc n a b serial-a serial-b (exp (gen) (mul ra ra-0))))-      (send n))-    ((send (sig (cert-req b (exp (gen) ra-0) ca) (privk "sig" b)))-      (recv-        (sig (cert b (exp (gen) ra-0) ca serial-b) (privk "sig" ca)))-      (load static-key-0 (cat pt-2 ignore-0))-      (stor static-key-0 (cat pt-1 "privkey" b ra-0 serial-b ca))))-  (label 8)-  (parent 0)-  (realized)-  (shape)-  (maps-    ((0)-      ((ca ca) (b b) (a a) (ra ra) (serial-a serial-a)-        (serial-b serial-b) (alpha ra-0) (n n)-        (static-key static-key))))-  (origs (pt-1 (5 3)) (serial-b (3 1)) (serial-a (2 1)) (pt (1 3))-    (n (0 2)))-  (ugens (ra-0 (5 0)) (ra (1 0))))--(comment "Nothing left to do")--(defprotocol dhstatic-state diffie-hellman-  (defrole cert-    (vars (subj ca name) (serial data) (galpha mesg))-    (trace (recv (sig (cert-req subj galpha ca) (privk "sig" subj)))-      (send (sig (cert subj galpha ca serial) (privk "sig" ca))))-    (uniq-orig serial)-    (comment "Certificate Authority"))-  (defrole get-cert-    (vars (self ca name) (serial data) (ra rndx) (static-key locn)-      (ignore mesg))-    (trace-      (send (sig (cert-req self (exp (gen) ra) ca) (privk "sig" self)))-      (recv (sig (cert self (exp (gen) ra) ca serial) (privk "sig" ca)))-      (load static-key ignore)-      (stor static-key (cat "privkey" self ra serial ca)))-    (uniq-gen ra)-    (comment "Get certified"))-  (defrole init-    (vars (a b ca name) (ra rndx) (serial-a serial-b data) (alpha expt)-      (n text) (static-key locn))-    (trace (load static-key (cat "privkey" a ra serial-a ca))-      (recv-        (sig (cert b (exp (gen) alpha) ca serial-b) (privk "sig" ca)))-      (send (enc n a b serial-a serial-b (exp (gen) (mul ra alpha))))-      (recv n))-    (uniq-orig n)-    (gen-st (cat "privkey" a ra serial-a ca))-    (comment "Initiator is A"))-  (defrole resp-    (vars (a b ca name) (rb rndx) (serial-b serial-a data) (alpha expt)-      (n text) (static-key locn))-    (trace (load static-key (cat "privkey" b rb serial-b ca))-      (recv-        (sig (cert a (exp (gen) alpha) ca serial-a) (privk "sig" ca)))-      (recv (enc n a b serial-a serial-b (exp (gen) (mul rb alpha))))-      (send n))-    (gen-st (cat "privkey" b rb serial-b ca))-    (comment "Responder is B"))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule shearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule invShearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule fact-init-neq0-    (forall ((z strd) (b a name))-      (implies-        (and (p "init" z (idx 2)) (p "init" "a" z a) (p "init" "b" z b))-        (fact neq a b))))-  (defgenrule fact-resp-neq0-    (forall ((z strd) (b a name))-      (implies-        (and (p "resp" z (idx 2)) (p "resp" "a" z a) (p "resp" "b" z b))-        (fact neq a b))))-  (defgenrule trRl_get-cert-at-3-    (forall ((z strd))-      (implies (p "get-cert" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_get-cert-at-2-    (forall ((z strd))-      (implies (p "get-cert" z (idx 4)) (trans z (idx 2)))))-  (defgenrule gen-st-init-0-    (forall ((z strd) (a name) (ra rndx) (serial-a data) (ca name))-      (implies-        (and (p "init" z (idx 1)) (p "init" "ca" z ca)-          (p "init" "serial-a" z serial-a) (p "init" "ra" z ra)-          (p "init" "a" z a))-        (gen-st (cat "privkey" a ra serial-a ca)))))-  (defgenrule gen-st-resp-0-    (forall ((z strd) (b name) (rb rndx) (serial-b data) (ca name))-      (implies-        (and (p "resp" z (idx 1)) (p "resp" "ca" z ca)-          (p "resp" "serial-b" z serial-b) (p "resp" "rb" z rb)-          (p "resp" "b" z b))-        (gen-st (cat "privkey" b rb serial-b ca)))))-  (lang (cert-req (tupl 3)) (cert (tupl 4)) (sig sign)))--(defskeleton dhstatic-state-  (vars (serial-b serial-a data) (n text) (ca a b name) (pt pval)-    (static-key locn) (rb rndx) (alpha expt))-  (defstrand resp 4 (serial-b serial-b) (serial-a serial-a) (n n) (a a)-    (b b) (ca ca) (static-key static-key) (rb rb) (alpha alpha))-  (non-orig (privk "sig" ca) (privk "sig" a))-  (traces-    ((load static-key (cat pt "privkey" b rb serial-b ca))-      (recv-        (sig (cert a (exp (gen) alpha) ca serial-a) (privk "sig" ca)))-      (recv (enc n a b serial-a serial-b (exp (gen) (mul rb alpha))))-      (send n)))-  (label 24)-  (unrealized (0 1))-  (origs)-  (comment "Not closed under rules"))--(defskeleton dhstatic-state-  (vars (ignore ignore-0 mesg) (serial-b serial-a data) (n text)-    (a b ca name) (pt pt-0 pt-1 pt-2 pval)-    (static-key static-key-0 locn) (ra ra-0 rndx))-  (defstrand resp 4 (serial-b serial-b) (serial-a serial-a) (n n) (a a)-    (b b) (ca ca) (static-key static-key) (rb ra) (alpha ra-0))-  (defstrand get-cert 4 (ignore ignore) (serial serial-b) (self b)-    (ca ca) (static-key static-key) (ra ra))-  (defstrand cert 2 (galpha (exp (gen) ra)) (serial serial-b) (subj b)-    (ca ca))-  (defstrand cert 2 (galpha (exp (gen) ra-0)) (serial serial-a) (subj a)-    (ca ca))-  (defstrand init 3 (serial-a serial-a) (serial-b serial-b) (n n) (a a)-    (b b) (ca ca) (static-key static-key-0) (ra ra-0) (alpha ra))-  (defstrand get-cert 4 (ignore ignore-0) (serial serial-a) (self a)-    (ca ca) (static-key static-key-0) (ra ra-0))-  (precedes ((1 0) (2 0)) ((1 3) (0 0)) ((2 1) (1 1)) ((2 1) (4 1))-    ((3 1) (0 1)) ((3 1) (5 1)) ((4 2) (0 2)) ((5 0) (3 0))-    ((5 3) (4 0)))-  (non-orig (privk "sig" a) (privk "sig" ca))-  (uniq-orig serial-b serial-a n)-  (uniq-gen ra ra-0)-  (gen-st (cat "privkey" a ra-0 serial-a ca)-    (cat "privkey" b ra serial-b ca))-  (leads-to ((1 3) (0 0)) ((5 3) (4 0)))-  (operation channel-test (displaced 4 6 get-cert 4)-    (ch-msg static-key-0 (cat pt-1 "privkey" a ra-1 serial-a ca)) (5 0))-  (strand-map 0 1 2 3 5 4)-  (traces-    ((load static-key (cat pt "privkey" b ra serial-b ca))-      (recv-        (sig (cert a (exp (gen) ra-0) ca serial-a) (privk "sig" ca)))-      (recv (enc n a b serial-a serial-b (exp (gen) (mul ra ra-0))))-      (send n))-    ((send (sig (cert-req b (exp (gen) ra) ca) (privk "sig" b)))-      (recv (sig (cert b (exp (gen) ra) ca serial-b) (privk "sig" ca)))-      (load static-key (cat pt-0 ignore))-      (stor static-key (cat pt "privkey" b ra serial-b ca)))-    ((recv (sig (cert-req b (exp (gen) ra) ca) (privk "sig" b)))-      (send (sig (cert b (exp (gen) ra) ca serial-b) (privk "sig" ca))))-    ((recv (sig (cert-req a (exp (gen) ra-0) ca) (privk "sig" a)))-      (send-        (sig (cert a (exp (gen) ra-0) ca serial-a) (privk "sig" ca))))-    ((load static-key-0 (cat pt-1 "privkey" a ra-0 serial-a ca))-      (recv (sig (cert b (exp (gen) ra) ca serial-b) (privk "sig" ca)))-      (send (enc n a b serial-a serial-b (exp (gen) (mul ra ra-0)))))-    ((send (sig (cert-req a (exp (gen) ra-0) ca) (privk "sig" a)))-      (recv-        (sig (cert a (exp (gen) ra-0) ca serial-a) (privk "sig" ca)))-      (load static-key-0 (cat pt-2 ignore-0))-      (stor static-key-0 (cat pt-1 "privkey" a ra-0 serial-a ca))))-  (label 32)-  (parent 24)-  (realized)-  (shape)-  (maps-    ((0)-      ((ca ca) (a a) (b b) (rb ra) (serial-b serial-b)-        (serial-a serial-a) (alpha ra-0) (n n)-        (static-key static-key))))-  (origs (pt-1 (5 3)) (n (4 2)) (serial-a (3 1)) (serial-b (2 1))-    (pt (1 3)))-  (ugens (ra-0 (5 0)) (ra (1 0))))--(comment "Nothing left to do")
− tst/defact-locn_envelope.tst 
@@ -1,5135 +0,0 @@-(herald "Envelope Protocol, location-based version" (bound 30)-  (limit 1200))--(comment "CPSA 4.4.5")-(comment "All input read from tst/locn_envelope.scm")-(comment "Step count limited to 1200")-(comment "Strand count bounded at 30")--(defprotocol envelope basic-  (defrole tpm-power-on-    (vars (current-value mesg) (pcr locn) (tpm chan))-    (trace (recv tpm "power on") (load pcr current-value)-      (stor pcr "0")))-  (defrole tpm-extend-enc-    (vars (value current-value mesg) (pcr-id text) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "extend" pcr-id value))-      (load pcr current-value) (stor pcr (hash current-value value))-      (send "ext ok")))-  (defrole tpm-quote-    (vars (nonce current-value mesg) (pcr-id text) (aik akey) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "quote" pcr-id nonce))-      (load pcr current-value)-      (send (enc "quote" pcr-id current-value nonce aik))))-  (defrole tpm-create-key-    (vars (k aik akey) (pcr-id text) (pcrval mesg) (tpm chan))-    (trace (recv tpm (cat "create-req" pcr-id pcrval))-      (send (enc "created" k pcr-id pcrval aik)))-    (non-orig (invk k))-    (uniq-orig k)-    (auth tpm))-  (defrole tpm-decrypt-    (vars (m current-value mesg) (pcr-id text) (k aik akey) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "decrypt" (enc m k)))-      (recv (enc "created" k pcr-id current-value aik))-      (load pcr current-value) (send m))-    (non-orig aik))-  (defrole alice-    (vars (n v data) (pcr-id text) (k aik akey) (tpm chan))-    (trace (send tpm (cat "extend" pcr-id n))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    (non-orig aik)-    (uniq-orig n v)-    (conf tpm)-    (neq (k aik)))-  (defrule genStV-if-hashed-tpm-power-on-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-power-on" z (idx 2))-          (p "tpm-power-on" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-extend-enc-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-extend-enc" z (idx 2))-          (p "tpm-extend-enc" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-decrypt-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-decrypt" z (idx 3))-          (p "tpm-decrypt" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-quote-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-quote" z (idx 2))-          (p "tpm-quote" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule shearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule invShearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule trRl_tpm-power-on-at-2-    (forall ((z strd))-      (implies (p "tpm-power-on" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_tpm-power-on-at-1-    (forall ((z strd))-      (implies (p "tpm-power-on" z (idx 3)) (trans z (idx 1)))))-  (defgenrule trRl_tpm-extend-enc-at-2-    (forall ((z strd))-      (implies (p "tpm-extend-enc" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_tpm-extend-enc-at-1-    (forall ((z strd))-      (implies (p "tpm-extend-enc" z (idx 3)) (trans z (idx 1))))))--(defskeleton envelope-  (vars (v n data) (pcr-id text) (k aik akey) (tpm chan))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id) (k k) (aik aik)-    (tpm tpm))-  (non-orig aik)-  (uniq-orig v n)-  (conf tpm)-  (traces ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id n))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k))))-  (label 0)-  (unrealized (0 0) (1 2))-  (preskeleton)-  (origs (v (1 3)) (n (1 0)))-  (comment "Not a skeleton"))--(defskeleton envelope-  (vars (v n data) (pcr-id text) (k aik akey) (tpm chan))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id) (k k) (aik aik)-    (tpm tpm))-  (precedes ((1 3) (0 0)))-  (non-orig aik)-  (uniq-orig v n)-  (conf tpm)-  (traces ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id n))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k))))-  (label 1)-  (parent 0)-  (unrealized (1 2))-  (origs (v (1 3)) (n (1 0)))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-  (vars (v n data) (pcr-id text) (k aik akey) (tpm tpm-0 chan))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id) (k k) (aik aik) (tpm tpm-0))-  (precedes ((1 3) (0 0)) ((2 1) (1 2)))-  (non-orig aik (invk k))-  (uniq-orig v n k)-  (conf tpm)-  (auth tpm-0)-  (operation encryption-test (added-strand tpm-create-key 2)-    (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik) (1 2))-  (strand-map 0 1)-  (traces ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id n))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm-0 (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (send (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))))-  (label 2)-  (parent 1)-  (unrealized (0 0) (2 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-  (vars (v n data) (pcr-id text) (k aik akey) (tpm chan))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id) (k k) (aik aik) (tpm tpm))-  (precedes ((1 1) (2 0)) ((1 3) (0 0)) ((2 1) (1 2)))-  (non-orig aik (invk k))-  (uniq-orig v n k)-  (conf tpm)-  (auth tpm)-  (operation channel-test (displaced 3 1 alice 2)-    (ch-msg tpm-0-      (cat "create-req" pcr-id (hash (hash "0" n) "obtain"))) (2 0))-  (strand-map 0 1 2)-  (traces ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id n))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (send (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))))-  (label 3)-  (parent 2)-  (unrealized (0 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-  (vars (current-value mesg) (v n data) (pcr-id pcr-id-0 text)-    (k aik aik-0 akey) (pt pval) (tpm tpm-0 chan) (pcr locn))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v) (current-value current-value)-    (pcr-id pcr-id-0) (k k) (aik aik-0) (tpm tpm-0) (pcr pcr))-  (precedes ((1 1) (2 0)) ((1 3) (3 0)) ((2 1) (1 2)) ((3 3) (0 0)))-  (non-orig aik aik-0 (invk k))-  (uniq-orig v n k)-  (conf tpm)-  (auth tpm)-  (operation nonce-test (added-strand tpm-decrypt 4) v (0 0) (enc v k))-  (strand-map 0 1 2)-  (traces ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id n))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (send (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-0 current-value aik-0))-      (load pcr (cat pt current-value)) (send v)))-  (label 4)-  (parent 3)-  (unrealized (3 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-  (vars (v n data) (pcr-id text) (k aik akey) (pt pval) (tpm tpm-0 chan)-    (pcr locn))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id) (k k)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (precedes ((1 1) (2 0)) ((1 3) (3 0)) ((2 1) (1 2)) ((3 3) (0 0)))-  (non-orig aik (invk k))-  (uniq-orig v n k)-  (gen-st (hash (hash "0" n) "obtain"))-  (conf tpm)-  (auth tpm)-  -  (operation encryption-test (displaced 4 2 tpm-create-key 2)-    (enc "created" k pcr-id-0 current-value aik-0) (3 1))-  (strand-map 0 1 2 3)-  (traces ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id n))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (send (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v)))-  (label 5)-  (parent 4)-  (unrealized (3 2))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-  (vars (v n data) (pcr-id pcr-id-0 text) (k aik akey) (pt pt-0 pval)-    (tpm tpm-0 tpm-1 chan) (pcr locn))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id) (k k)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 3 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-0) (tpm tpm-1)-    (pcr pcr))-  (precedes ((1 1) (2 0)) ((1 3) (3 0)) ((2 1) (1 2)) ((3 3) (0 0))-    ((4 2) (3 2)))-  (non-orig aik (invk k))-  (uniq-orig v n k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain"))-  (conf tpm)-  (auth tpm)-  (leads-to ((4 2) (3 2)))-  -  (operation channel-test (added-strand tpm-extend-enc 3)-    (ch-msg pcr (cat pt (hash (hash "0" n) "obtain"))) (3 2))-  (strand-map 0 1 2 3)-  (traces ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id n))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (send (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((recv tpm-1 (cat "extend" pcr-id-0 "obtain"))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain")))))-  (label 6)-  (parent 5)-  (unrealized (4 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-  (vars (v n data) (pcr-id pcr-id-0 pcr-id-1 text) (k aik akey)-    (pt pt-0 pt-1 pval) (tpm tpm-0 tpm-1 tpm-2 chan) (pcr locn))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id) (k k)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 3 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-0) (tpm tpm-1)-    (pcr pcr))-  (defstrand tpm-extend-enc 3 (value n) (current-value "0")-    (pcr-id pcr-id-1) (tpm tpm-2) (pcr pcr))-  (precedes ((1 0) (5 0)) ((1 1) (2 0)) ((1 3) (3 0)) ((2 1) (1 2))-    ((3 3) (0 0)) ((4 2) (3 2)) ((5 2) (4 1)))-  (non-orig aik (invk k))-  (uniq-orig v n k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain"))-  (conf tpm)-  (auth tpm)-  (leads-to ((4 2) (3 2)) ((5 2) (4 1)))-  -  (operation channel-test (added-strand tpm-extend-enc 3)-    (ch-msg pcr (cat pt-0 (hash "0" n))) (4 1))-  (strand-map 0 1 2 3 4)-  (traces ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id n))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (send (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((recv tpm-1 (cat "extend" pcr-id-0 "obtain"))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain"))))-    ((recv tpm-2 (cat "extend" pcr-id-1 n)) (load pcr (cat pt-1 "0"))-      (stor pcr (cat pt-0 (hash "0" n)))))-  (label 7)-  (parent 6)-  (unrealized (5 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-  (vars (v n data) (pcr-id pcr-id-0 text) (k aik akey)-    (pt pt-0 pt-1 pval) (tpm tpm-0 tpm-1 chan) (pcr locn))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id) (k k)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 3 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-0) (tpm tpm-1)-    (pcr pcr))-  (defstrand tpm-extend-enc 3 (value n) (current-value "0")-    (pcr-id pcr-id) (tpm tpm) (pcr pcr))-  (precedes ((1 0) (5 0)) ((1 1) (2 0)) ((1 3) (3 0)) ((2 1) (1 2))-    ((3 3) (0 0)) ((4 2) (3 2)) ((5 2) (4 1)))-  (non-orig aik (invk k))-  (uniq-orig v n k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain"))-  (conf tpm)-  (auth tpm)-  (leads-to ((4 2) (3 2)) ((5 2) (4 1)))-  -  (operation nonce-test (contracted (pcr-id-1 pcr-id) (tpm-2 tpm)) n-    (5 0) (ch-msg tpm (cat "extend" pcr-id n)))-  (strand-map 0 1 2 3 4 5)-  (traces ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id n))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (send (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((recv tpm-1 (cat "extend" pcr-id-0 "obtain"))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain"))))-    ((recv tpm (cat "extend" pcr-id n)) (load pcr (cat pt-1 "0"))-      (stor pcr (cat pt-0 (hash "0" n)))))-  (label 8)-  (parent 7)-  (realized)-  (shape)-  (maps ((0 1) ((v v) (n n) (pcr-id pcr-id) (k k) (aik aik) (tpm tpm))))-  (origs (pt-0 (5 2)) (pt (4 2)) (k (2 1)) (n (1 0)) (v (1 3))))--(comment "Nothing left to do")--(defprotocol envelope basic-  (defrole tpm-power-on-    (vars (current-value mesg) (pcr locn) (tpm chan))-    (trace (recv tpm "power on") (load pcr current-value)-      (stor pcr "0")))-  (defrole tpm-extend-enc-    (vars (value current-value mesg) (pcr-id text) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "extend" pcr-id value))-      (load pcr current-value) (stor pcr (hash current-value value))-      (send "ext ok")))-  (defrole tpm-quote-    (vars (nonce current-value mesg) (pcr-id text) (aik akey) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "quote" pcr-id nonce))-      (load pcr current-value)-      (send (enc "quote" pcr-id current-value nonce aik))))-  (defrole tpm-create-key-    (vars (k aik akey) (pcr-id text) (pcrval mesg) (tpm chan))-    (trace (recv tpm (cat "create-req" pcr-id pcrval))-      (send (enc "created" k pcr-id pcrval aik)))-    (non-orig (invk k))-    (uniq-orig k)-    (auth tpm))-  (defrole tpm-decrypt-    (vars (m current-value mesg) (pcr-id text) (k aik akey) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "decrypt" (enc m k)))-      (recv (enc "created" k pcr-id current-value aik))-      (load pcr current-value) (send m))-    (non-orig aik))-  (defrole alice-    (vars (n v data) (pcr-id text) (k aik akey) (tpm chan))-    (trace (send tpm (cat "extend" pcr-id n))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    (non-orig aik)-    (uniq-orig n v)-    (conf tpm)-    (neq (k aik)))-  (defrule genStV-if-hashed-tpm-power-on-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-power-on" z (idx 2))-          (p "tpm-power-on" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-extend-enc-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-extend-enc" z (idx 2))-          (p "tpm-extend-enc" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-decrypt-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-decrypt" z (idx 3))-          (p "tpm-decrypt" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-quote-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-quote" z (idx 2))-          (p "tpm-quote" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule shearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule invShearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule trRl_tpm-power-on-at-2-    (forall ((z strd))-      (implies (p "tpm-power-on" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_tpm-power-on-at-1-    (forall ((z strd))-      (implies (p "tpm-power-on" z (idx 3)) (trans z (idx 1)))))-  (defgenrule trRl_tpm-extend-enc-at-2-    (forall ((z strd))-      (implies (p "tpm-extend-enc" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_tpm-extend-enc-at-1-    (forall ((z strd))-      (implies (p "tpm-extend-enc" z (idx 3)) (trans z (idx 1))))))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 text) (k aik akey) (tpm chan))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (non-orig aik)-  (uniq-orig n v)-  (conf tpm)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k))))-  (label 9)-  (unrealized (0 0) (1 2))-  (preskeleton)-  (origs (v (1 3)) (n (1 0)))-  (comment "Not a skeleton"))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 text) (k aik akey) (tpm chan))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (precedes ((1 3) (0 0)))-  (non-orig aik)-  (uniq-orig n v)-  (conf tpm)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k))))-  (label 10)-  (parent 9)-  (unrealized (0 0) (1 2))-  (origs (v (1 3)) (n (1 0)))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 text) (k aik akey) (tpm tpm-0 chan))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm-0))-  (precedes ((1 3) (0 0)) ((2 1) (1 2)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (conf tpm)-  (auth tpm-0)-  (operation encryption-test (added-strand tpm-create-key 2)-    (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik) (1 2))-  (strand-map 0 1)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm-0-       (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))))-  (label 11)-  (parent 10)-  (unrealized (0 0) (2 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 text) (k aik akey) (tpm chan))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (precedes ((1 1) (2 0)) ((1 3) (0 0)) ((2 1) (1 2)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (conf tpm)-  (auth tpm)-  (operation channel-test (displaced 3 1 alice 2)-    (ch-msg tpm-0-      (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain"))) (2 0))-  (strand-map 0 1 2)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))))-  (label 12)-  (parent 11)-  (unrealized (0 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 text) (k aik akey) (pt pval)-    (tpm tpm-0 chan) (pcr locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-quote 3 (nonce (enc v k))-    (current-value (hash (hash "0" n) "refuse")) (pcr-id pcr-id)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (precedes ((1 1) (2 0)) ((1 3) (3 0)) ((2 1) (1 2)) ((3 2) (0 0)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (gen-st (hash (hash "0" n) "refuse"))-  (conf tpm)-  (auth tpm)-  -  (operation encryption-test (added-strand tpm-quote 3)-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik)-    (0 0))-  (strand-map 0 1 2)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "quote" pcr-id (enc v k)))-      (load pcr (cat pt (hash (hash "0" n) "refuse")))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))))-  (label 13)-  (parent 12)-  (unrealized (3 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 pcr-id-1 text) (k aik akey)-    (pt pt-0 pval) (tpm tpm-0 tpm-1 chan) (pcr locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-quote 3 (nonce (enc v k))-    (current-value (hash (hash "0" n) "refuse")) (pcr-id pcr-id)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 3 (value "refuse")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (tpm tpm-1)-    (pcr pcr))-  (precedes ((1 1) (2 0)) ((1 3) (3 0)) ((2 1) (1 2)) ((3 2) (0 0))-    ((4 2) (3 1)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (gen-st (hash "0" n) (hash (hash "0" n) "refuse"))-  (conf tpm)-  (auth tpm)-  (leads-to ((4 2) (3 1)))-  -  (operation channel-test (added-strand tpm-extend-enc 3)-    (ch-msg pcr (cat pt (hash (hash "0" n) "refuse"))) (3 1))-  (strand-map 0 1 2 3)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "quote" pcr-id (enc v k)))-      (load pcr (cat pt (hash (hash "0" n) "refuse")))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((recv tpm-1 (cat "extend" pcr-id-1 "refuse"))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "refuse")))))-  (label 14)-  (parent 13)-  (unrealized (4 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 pcr-id-1 pcr-id-2 text) (k aik akey)-    (pt pt-0 pt-1 pval) (tpm tpm-0 tpm-1 tpm-2 chan) (pcr locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-quote 3 (nonce (enc v k))-    (current-value (hash (hash "0" n) "refuse")) (pcr-id pcr-id)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 3 (value "refuse")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (tpm tpm-1)-    (pcr pcr))-  (defstrand tpm-extend-enc 3 (value n) (current-value "0")-    (pcr-id pcr-id-2) (tpm tpm-2) (pcr pcr))-  (precedes ((1 0) (5 0)) ((1 1) (2 0)) ((1 3) (3 0)) ((2 1) (1 2))-    ((3 2) (0 0)) ((4 2) (3 1)) ((5 2) (4 1)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (gen-st (hash "0" n) (hash (hash "0" n) "refuse"))-  (conf tpm)-  (auth tpm)-  (leads-to ((4 2) (3 1)) ((5 2) (4 1)))-  -  (operation channel-test (added-strand tpm-extend-enc 3)-    (ch-msg pcr (cat pt-0 (hash "0" n))) (4 1))-  (strand-map 0 1 2 3 4)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "quote" pcr-id (enc v k)))-      (load pcr (cat pt (hash (hash "0" n) "refuse")))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((recv tpm-1 (cat "extend" pcr-id-1 "refuse"))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "refuse"))))-    ((recv tpm-2 (cat "extend" pcr-id-2 n)) (load pcr (cat pt-1 "0"))-      (stor pcr (cat pt-0 (hash "0" n)))))-  (label 15)-  (parent 14)-  (unrealized (5 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 pcr-id-1 text) (k aik akey)-    (pt pt-0 pt-1 pval) (tpm tpm-0 tpm-1 chan) (pcr locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-quote 3 (nonce (enc v k))-    (current-value (hash (hash "0" n) "refuse")) (pcr-id pcr-id)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 3 (value "refuse")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (tpm tpm-1)-    (pcr pcr))-  (defstrand tpm-extend-enc 3 (value n) (current-value "0")-    (pcr-id pcr-id-0) (tpm tpm) (pcr pcr))-  (precedes ((1 0) (5 0)) ((1 1) (2 0)) ((1 3) (3 0)) ((2 1) (1 2))-    ((3 2) (0 0)) ((4 2) (3 1)) ((5 2) (4 1)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (gen-st (hash "0" n) (hash (hash "0" n) "refuse"))-  (conf tpm)-  (auth tpm)-  (leads-to ((4 2) (3 1)) ((5 2) (4 1)))-  -  (operation nonce-test (contracted (pcr-id-2 pcr-id-0) (tpm-2 tpm)) n-    (5 0) (ch-msg tpm (cat "extend" pcr-id-0 n)))-  (strand-map 0 1 2 3 4 5)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "quote" pcr-id (enc v k)))-      (load pcr (cat pt (hash (hash "0" n) "refuse")))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((recv tpm-1 (cat "extend" pcr-id-1 "refuse"))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "refuse"))))-    ((recv tpm (cat "extend" pcr-id-0 n)) (load pcr (cat pt-1 "0"))-      (stor pcr (cat pt-0 (hash "0" n)))))-  (label 16)-  (parent 15)-  (realized)-  (shape)-  (maps-    ((0 1)-      ((n n) (v v) (k k) (aik aik) (pcr-id pcr-id) (pcr-id-0 pcr-id-0)-        (tpm tpm))))-  (origs (pt-0 (5 2)) (pt (4 2)) (n (1 0)) (k (2 1)) (v (1 3))))--(comment "Nothing left to do")--(defprotocol envelope basic-  (defrole tpm-power-on-    (vars (current-value mesg) (pcr locn) (tpm chan))-    (trace (recv tpm "power on") (load pcr current-value)-      (stor pcr "0")))-  (defrole tpm-extend-enc-    (vars (value current-value mesg) (pcr-id text) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "extend" pcr-id value))-      (load pcr current-value) (stor pcr (hash current-value value))-      (send "ext ok")))-  (defrole tpm-quote-    (vars (nonce current-value mesg) (pcr-id text) (aik akey) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "quote" pcr-id nonce))-      (load pcr current-value)-      (send (enc "quote" pcr-id current-value nonce aik))))-  (defrole tpm-create-key-    (vars (k aik akey) (pcr-id text) (pcrval mesg) (tpm chan))-    (trace (recv tpm (cat "create-req" pcr-id pcrval))-      (send (enc "created" k pcr-id pcrval aik)))-    (non-orig (invk k))-    (uniq-orig k)-    (auth tpm))-  (defrole tpm-decrypt-    (vars (m current-value mesg) (pcr-id text) (k aik akey) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "decrypt" (enc m k)))-      (recv (enc "created" k pcr-id current-value aik))-      (load pcr current-value) (send m))-    (non-orig aik))-  (defrole alice-    (vars (n v data) (pcr-id text) (k aik akey) (tpm chan))-    (trace (send tpm (cat "extend" pcr-id n))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    (non-orig aik)-    (uniq-orig n v)-    (conf tpm)-    (neq (k aik)))-  (defrule genStV-if-hashed-tpm-power-on-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-power-on" z (idx 2))-          (p "tpm-power-on" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-extend-enc-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-extend-enc" z (idx 2))-          (p "tpm-extend-enc" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-decrypt-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-decrypt" z (idx 3))-          (p "tpm-decrypt" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-quote-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-quote" z (idx 2))-          (p "tpm-quote" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule shearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule invShearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule trRl_tpm-power-on-at-2-    (forall ((z strd))-      (implies (p "tpm-power-on" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_tpm-power-on-at-1-    (forall ((z strd))-      (implies (p "tpm-power-on" z (idx 3)) (trans z (idx 1)))))-  (defgenrule trRl_tpm-extend-enc-at-2-    (forall ((z strd))-      (implies (p "tpm-extend-enc" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_tpm-extend-enc-at-1-    (forall ((z strd))-      (implies (p "tpm-extend-enc" z (idx 3)) (trans z (idx 1))))))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 text) (k aik akey) (tpm chan))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (non-orig aik)-  (uniq-orig n v)-  (conf tpm)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k))))-  (label 17)-  (unrealized (0 0) (1 0) (2 2))-  (preskeleton)-  (origs (v (2 3)) (n (2 0)))-  (comment "Not a skeleton"))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 text) (k aik akey) (tpm chan))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (precedes ((2 3) (0 0)) ((2 3) (1 0)))-  (non-orig aik)-  (uniq-orig n v)-  (conf tpm)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k))))-  (label 18)-  (parent 17)-  (unrealized (0 0) (2 2))-  (origs (v (2 3)) (n (2 0)))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 text) (k aik akey) (tpm tpm-0 chan))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm-0))-  (precedes ((2 3) (0 0)) ((2 3) (1 0)) ((3 1) (2 2)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (conf tpm)-  (auth tpm-0)-  (operation encryption-test (added-strand tpm-create-key 2)-    (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik) (2 2))-  (strand-map 0 1 2)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm-0-       (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))))-  (label 19)-  (parent 18)-  (unrealized (0 0) (1 0) (3 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 text) (k aik akey) (tpm chan))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (precedes ((2 1) (3 0)) ((2 3) (0 0)) ((2 3) (1 0)) ((3 1) (2 2)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (conf tpm)-  (auth tpm)-  (operation channel-test (displaced 4 2 alice 2)-    (ch-msg tpm-0-      (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain"))) (3 0))-  (strand-map 0 1 2 3)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))))-  (label 20)-  (parent 19)-  (unrealized (0 0) (1 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-  (vars (current-value mesg) (n v data) (pcr-id pcr-id-0 pcr-id-1 text)-    (k aik aik-0 akey) (pt pval) (tpm tpm-0 chan) (pcr locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v) (current-value current-value)-    (pcr-id pcr-id-1) (k k) (aik aik-0) (tpm tpm-0) (pcr pcr))-  (precedes ((2 1) (3 0)) ((2 3) (0 0)) ((2 3) (4 0)) ((3 1) (2 2))-    ((4 3) (1 0)))-  (non-orig aik aik-0 (invk k))-  (uniq-orig n v k)-  (conf tpm)-  (auth tpm)-  (operation nonce-test (added-strand tpm-decrypt 4) v (1 0) (enc v k))-  (strand-map 0 1 2 3)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-1 current-value aik-0))-      (load pcr (cat pt current-value)) (send v)))-  (label 21)-  (parent 20)-  (unrealized (0 0) (4 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 text) (k aik akey) (pt pval)-    (tpm tpm-0 chan) (pcr locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id-0) (k k)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (precedes ((2 1) (3 0)) ((2 3) (0 0)) ((2 3) (4 0)) ((3 1) (2 2))-    ((4 3) (1 0)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (gen-st (hash (hash "0" n) "obtain"))-  (conf tpm)-  (auth tpm)-  -  (operation encryption-test (displaced 5 3 tpm-create-key 2)-    (enc "created" k pcr-id-1 current-value aik-0) (4 1))-  (strand-map 0 1 2 3 4)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v)))-  (label 22)-  (parent 21)-  (unrealized (0 0) (4 2))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 pcr-id-1 text) (k aik akey)-    (pt pt-0 pval) (tpm tpm-0 tpm-1 chan) (pcr locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id-0) (k k)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 3 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (tpm tpm-1)-    (pcr pcr))-  (precedes ((2 1) (3 0)) ((2 3) (0 0)) ((2 3) (4 0)) ((3 1) (2 2))-    ((4 3) (1 0)) ((5 2) (4 2)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain"))-  (conf tpm)-  (auth tpm)-  (leads-to ((5 2) (4 2)))-  -  (operation channel-test (added-strand tpm-extend-enc 3)-    (ch-msg pcr (cat pt (hash (hash "0" n) "obtain"))) (4 2))-  (strand-map 0 1 2 3 4)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((recv tpm-1 (cat "extend" pcr-id-1 "obtain"))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain")))))-  (label 23)-  (parent 22)-  (unrealized (0 0) (5 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 pcr-id-1 pcr-id-2 text) (k aik akey)-    (pt pt-0 pt-1 pval) (tpm tpm-0 tpm-1 tpm-2 chan) (pcr locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id-0) (k k)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 3 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (tpm tpm-1)-    (pcr pcr))-  (defstrand tpm-extend-enc 3 (value n) (current-value "0")-    (pcr-id pcr-id-2) (tpm tpm-2) (pcr pcr))-  (precedes ((2 0) (6 0)) ((2 1) (3 0)) ((2 3) (0 0)) ((2 3) (4 0))-    ((3 1) (2 2)) ((4 3) (1 0)) ((5 2) (4 2)) ((6 2) (5 1)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain"))-  (conf tpm)-  (auth tpm)-  (leads-to ((5 2) (4 2)) ((6 2) (5 1)))-  -  (operation channel-test (added-strand tpm-extend-enc 3)-    (ch-msg pcr (cat pt-0 (hash "0" n))) (5 1))-  (strand-map 0 1 2 3 4 5)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((recv tpm-1 (cat "extend" pcr-id-1 "obtain"))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain"))))-    ((recv tpm-2 (cat "extend" pcr-id-2 n)) (load pcr (cat pt-1 "0"))-      (stor pcr (cat pt-0 (hash "0" n)))))-  (label 24)-  (parent 23)-  (unrealized (0 0) (6 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 pcr-id-1 text) (k aik akey)-    (pt pt-0 pt-1 pval) (tpm tpm-0 tpm-1 chan) (pcr locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id-0) (k k)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 3 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (tpm tpm-1)-    (pcr pcr))-  (defstrand tpm-extend-enc 3 (value n) (current-value "0")-    (pcr-id pcr-id-0) (tpm tpm) (pcr pcr))-  (precedes ((2 0) (6 0)) ((2 1) (3 0)) ((2 3) (0 0)) ((2 3) (4 0))-    ((3 1) (2 2)) ((4 3) (1 0)) ((5 2) (4 2)) ((6 2) (5 1)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain"))-  (conf tpm)-  (auth tpm)-  (leads-to ((5 2) (4 2)) ((6 2) (5 1)))-  -  (operation nonce-test (contracted (pcr-id-2 pcr-id-0) (tpm-2 tpm)) n-    (6 0) (ch-msg tpm (cat "extend" pcr-id-0 n)))-  (strand-map 0 1 2 3 4 5 6)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((recv tpm-1 (cat "extend" pcr-id-1 "obtain"))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain"))))-    ((recv tpm (cat "extend" pcr-id-0 n)) (load pcr (cat pt-1 "0"))-      (stor pcr (cat pt-0 (hash "0" n)))))-  (label 25)-  (parent 24)-  (unrealized (0 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 pcr-id-1 text) (k aik akey)-    (pt pt-0 pt-1 pt-2 pval) (tpm tpm-0 tpm-1 tpm-2 chan)-    (pcr pcr-0 locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id-0) (k k)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 3 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (tpm tpm-1)-    (pcr pcr))-  (defstrand tpm-extend-enc 3 (value n) (current-value "0")-    (pcr-id pcr-id-0) (tpm tpm) (pcr pcr))-  (defstrand tpm-quote 3 (nonce (enc v k))-    (current-value (hash (hash "0" n) "refuse")) (pcr-id pcr-id)-    (aik aik) (tpm tpm-2) (pcr pcr-0))-  (precedes ((2 0) (6 0)) ((2 1) (3 0)) ((2 3) (4 0)) ((2 3) (7 0))-    ((3 1) (2 2)) ((4 3) (1 0)) ((5 2) (4 2)) ((6 2) (5 1))-    ((7 2) (0 0)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain")-    (hash (hash "0" n) "refuse"))-  (conf tpm)-  (auth tpm)-  (leads-to ((5 2) (4 2)) ((6 2) (5 1)))-  -  (operation encryption-test (added-strand tpm-quote 3)-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik)-    (0 0))-  (strand-map 0 1 2 3 4 5 6)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((recv tpm-1 (cat "extend" pcr-id-1 "obtain"))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain"))))-    ((recv tpm (cat "extend" pcr-id-0 n)) (load pcr (cat pt-1 "0"))-      (stor pcr (cat pt-0 (hash "0" n))))-    ((recv tpm-2 (cat "quote" pcr-id (enc v k)))-      (load pcr-0 (cat pt-2 (hash (hash "0" n) "refuse")))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))))-  (label 26)-  (parent 25)-  (unrealized (7 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 pcr-id-1 pcr-id-2 text) (k aik akey)-    (pt pt-0 pt-1 pt-2 pt-3 pval) (tpm tpm-0 tpm-1 tpm-2 tpm-3 chan)-    (pcr pcr-0 locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id-0) (k k)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 3 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (tpm tpm-1)-    (pcr pcr))-  (defstrand tpm-extend-enc 3 (value n) (current-value "0")-    (pcr-id pcr-id-0) (tpm tpm) (pcr pcr))-  (defstrand tpm-quote 3 (nonce (enc v k))-    (current-value (hash (hash "0" n) "refuse")) (pcr-id pcr-id)-    (aik aik) (tpm tpm-2) (pcr pcr-0))-  (defstrand tpm-extend-enc 3 (value "refuse")-    (current-value (hash "0" n)) (pcr-id pcr-id-2) (tpm tpm-3)-    (pcr pcr-0))-  (precedes ((2 0) (6 0)) ((2 1) (3 0)) ((2 3) (4 0)) ((2 3) (7 0))-    ((3 1) (2 2)) ((4 3) (1 0)) ((5 2) (4 2)) ((6 2) (5 1))-    ((7 2) (0 0)) ((8 2) (7 1)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain")-    (hash (hash "0" n) "refuse"))-  (conf tpm)-  (auth tpm)-  (leads-to ((5 2) (4 2)) ((6 2) (5 1)) ((8 2) (7 1)))-  -  (operation channel-test (added-strand tpm-extend-enc 3)-    (ch-msg pcr-0 (cat pt-2 (hash (hash "0" n) "refuse"))) (7 1))-  (strand-map 0 1 2 3 4 5 6 7)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((recv tpm-1 (cat "extend" pcr-id-1 "obtain"))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain"))))-    ((recv tpm (cat "extend" pcr-id-0 n)) (load pcr (cat pt-1 "0"))-      (stor pcr (cat pt-0 (hash "0" n))))-    ((recv tpm-2 (cat "quote" pcr-id (enc v k)))-      (load pcr-0 (cat pt-2 (hash (hash "0" n) "refuse")))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((recv tpm-3 (cat "extend" pcr-id-2 "refuse"))-      (load pcr-0 (cat pt-3 (hash "0" n)))-      (stor pcr-0 (cat pt-2 (hash (hash "0" n) "refuse")))))-  (label 27)-  (parent 26)-  (unrealized (8 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 pcr-id-1 pcr-id-2 pcr-id-3 text)-    (k aik akey) (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval)-    (tpm tpm-0 tpm-1 tpm-2 tpm-3 tpm-4 chan) (pcr pcr-0 locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id-0) (k k)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 3 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (tpm tpm-1)-    (pcr pcr))-  (defstrand tpm-extend-enc 3 (value n) (current-value "0")-    (pcr-id pcr-id-0) (tpm tpm) (pcr pcr))-  (defstrand tpm-quote 3 (nonce (enc v k))-    (current-value (hash (hash "0" n) "refuse")) (pcr-id pcr-id)-    (aik aik) (tpm tpm-2) (pcr pcr-0))-  (defstrand tpm-extend-enc 3 (value "refuse")-    (current-value (hash "0" n)) (pcr-id pcr-id-2) (tpm tpm-3)-    (pcr pcr-0))-  (defstrand tpm-extend-enc 3 (value n) (current-value "0")-    (pcr-id pcr-id-3) (tpm tpm-4) (pcr pcr-0))-  (precedes ((2 0) (6 0)) ((2 0) (9 0)) ((2 1) (3 0)) ((2 3) (4 0))-    ((2 3) (7 0)) ((3 1) (2 2)) ((4 3) (1 0)) ((5 2) (4 2))-    ((6 2) (5 1)) ((7 2) (0 0)) ((8 2) (7 1)) ((9 2) (8 1)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain")-    (hash (hash "0" n) "refuse"))-  (conf tpm)-  (auth tpm)-  (leads-to ((5 2) (4 2)) ((6 2) (5 1)) ((8 2) (7 1)) ((9 2) (8 1)))-  -  (operation channel-test (added-strand tpm-extend-enc 3)-    (ch-msg pcr-0 (cat pt-3 (hash "0" n))) (8 1))-  (strand-map 0 1 2 3 4 5 6 7 8)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((recv tpm-1 (cat "extend" pcr-id-1 "obtain"))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain"))))-    ((recv tpm (cat "extend" pcr-id-0 n)) (load pcr (cat pt-1 "0"))-      (stor pcr (cat pt-0 (hash "0" n))))-    ((recv tpm-2 (cat "quote" pcr-id (enc v k)))-      (load pcr-0 (cat pt-2 (hash (hash "0" n) "refuse")))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((recv tpm-3 (cat "extend" pcr-id-2 "refuse"))-      (load pcr-0 (cat pt-3 (hash "0" n)))-      (stor pcr-0 (cat pt-2 (hash (hash "0" n) "refuse"))))-    ((recv tpm-4 (cat "extend" pcr-id-3 n)) (load pcr-0 (cat pt-4 "0"))-      (stor pcr-0 (cat pt-3 (hash "0" n)))))-  (label 28)-  (parent 27)-  (unrealized (9 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 pcr-id-1 pcr-id-2 text) (k aik akey)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval)-    (tpm tpm-0 tpm-1 tpm-2 tpm-3 chan) (pcr pcr-0 locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id-0) (k k)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 3 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (tpm tpm-1)-    (pcr pcr))-  (defstrand tpm-extend-enc 3 (value n) (current-value "0")-    (pcr-id pcr-id-0) (tpm tpm) (pcr pcr))-  (defstrand tpm-quote 3 (nonce (enc v k))-    (current-value (hash (hash "0" n) "refuse")) (pcr-id pcr-id)-    (aik aik) (tpm tpm-2) (pcr pcr-0))-  (defstrand tpm-extend-enc 3 (value "refuse")-    (current-value (hash "0" n)) (pcr-id pcr-id-2) (tpm tpm-3)-    (pcr pcr-0))-  (defstrand tpm-extend-enc 3 (value n) (current-value "0")-    (pcr-id pcr-id-0) (tpm tpm) (pcr pcr-0))-  (precedes ((2 0) (6 0)) ((2 0) (9 0)) ((2 1) (3 0)) ((2 3) (4 0))-    ((2 3) (7 0)) ((3 1) (2 2)) ((4 3) (1 0)) ((5 2) (4 2))-    ((6 2) (5 1)) ((7 2) (0 0)) ((8 2) (7 1)) ((9 2) (8 1)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain")-    (hash (hash "0" n) "refuse"))-  (conf tpm)-  (auth tpm)-  (leads-to ((5 2) (4 2)) ((6 2) (5 1)) ((8 2) (7 1)) ((9 2) (8 1)))-  -  (operation nonce-test (contracted (pcr-id-3 pcr-id-0) (tpm-4 tpm)) n-    (9 0) (ch-msg tpm (cat "extend" pcr-id-0 n)))-  (strand-map 0 1 2 3 4 5 6 7 8 9)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((recv tpm-1 (cat "extend" pcr-id-1 "obtain"))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain"))))-    ((recv tpm (cat "extend" pcr-id-0 n)) (load pcr (cat pt-1 "0"))-      (stor pcr (cat pt-0 (hash "0" n))))-    ((recv tpm-2 (cat "quote" pcr-id (enc v k)))-      (load pcr-0 (cat pt-2 (hash (hash "0" n) "refuse")))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((recv tpm-3 (cat "extend" pcr-id-2 "refuse"))-      (load pcr-0 (cat pt-3 (hash "0" n)))-      (stor pcr-0 (cat pt-2 (hash (hash "0" n) "refuse"))))-    ((recv tpm (cat "extend" pcr-id-0 n)) (load pcr-0 (cat pt-4 "0"))-      (stor pcr-0 (cat pt-3 (hash "0" n)))))-  (label 29)-  (parent 28)-  (realized)-  (shape)-  (maps-    ((0 1 2)-      ((n n) (v v) (k k) (aik aik) (pcr-id pcr-id) (pcr-id-0 pcr-id-0)-        (tpm tpm))))-  (origs (pt-3 (9 2)) (pt-2 (8 2)) (pt-0 (6 2)) (pt (5 2)) (k (3 1))-    (n (2 0)) (v (2 3))))--(comment "Nothing left to do")--(defprotocol envelope-plus basic-  (defrole tpm-power-on-    (vars (current-value mesg) (pcr locn) (tpm chan))-    (trace (recv tpm "power on") (load pcr current-value)-      (stor pcr "0")))-  (defrole tpm-extend-enc-    (vars (value current-value mesg) (pcr-id text) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "extend" pcr-id value))-      (load pcr current-value) (stor pcr (hash current-value value))-      (send "ext ok")))-  (defrole tpm-quote-    (vars (nonce current-value mesg) (pcr-id text) (aik akey) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "quote" pcr-id nonce))-      (load pcr current-value)-      (send (enc "quote" pcr-id current-value nonce aik))))-  (defrole tpm-create-key-    (vars (k aik akey) (pcr-id text) (pcrval mesg) (tpm chan))-    (trace (recv tpm (cat "create-req" pcr-id pcrval))-      (send (enc "created" k pcr-id pcrval aik)))-    (non-orig (invk k))-    (uniq-orig k)-    (auth tpm))-  (defrole tpm-decrypt-    (vars (m current-value mesg) (pcr-id text) (k aik akey) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "decrypt" (enc m k)))-      (recv (enc "created" k pcr-id current-value aik))-      (load pcr current-value) (send m))-    (non-orig aik))-  (defrole alice-    (vars (n v data) (pcr-id text) (k aik akey) (tpm chan))-    (trace (send tpm (cat "extend" pcr-id n))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    (non-orig aik)-    (uniq-orig n v)-    (conf tpm)-    (neq (k aik)))-  (defrule genStV-if-hashed-tpm-power-on-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-power-on" z (idx 2))-          (p "tpm-power-on" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-extend-enc-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-extend-enc" z (idx 2))-          (p "tpm-extend-enc" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-decrypt-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-decrypt" z (idx 3))-          (p "tpm-decrypt" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-quote-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-quote" z (idx 2))-          (p "tpm-quote" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule ordered-extends-    (forall ((y z strd) (pcr locn))-      (implies-        (and (p "tpm-extend-enc" y (idx 3))-          (p "tpm-extend-enc" z (idx 3))-          (p "tpm-extend-enc" "pcr" y pcr)-          (p "tpm-extend-enc" "pcr" z pcr))-        (or-          (= y z)-          (prec y (idx 2) z (idx 1))-          (prec z (idx 2) y (idx 1))))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule shearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule invShearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule trRl_tpm-power-on-at-2-    (forall ((z strd))-      (implies (p "tpm-power-on" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_tpm-power-on-at-1-    (forall ((z strd))-      (implies (p "tpm-power-on" z (idx 3)) (trans z (idx 1)))))-  (defgenrule trRl_tpm-extend-enc-at-2-    (forall ((z strd))-      (implies (p "tpm-extend-enc" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_tpm-extend-enc-at-1-    (forall ((z strd))-      (implies (p "tpm-extend-enc" z (idx 3)) (trans z (idx 1))))))--(defskeleton envelope-plus-  (vars (v n data) (pcr-id text) (k aik akey) (tpm chan))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id) (k k) (aik aik)-    (tpm tpm))-  (non-orig aik)-  (uniq-orig v n)-  (conf tpm)-  (traces ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id n))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k))))-  (label 30)-  (unrealized (0 0) (1 2))-  (preskeleton)-  (origs (v (1 3)) (n (1 0)))-  (comment "Not a skeleton"))--(defskeleton envelope-plus-  (vars (v n data) (pcr-id text) (k aik akey) (tpm chan))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id) (k k) (aik aik)-    (tpm tpm))-  (precedes ((1 3) (0 0)))-  (non-orig aik)-  (uniq-orig v n)-  (conf tpm)-  (traces ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id n))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k))))-  (label 31)-  (parent 30)-  (unrealized (1 2))-  (origs (v (1 3)) (n (1 0)))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-plus-  (vars (v n data) (pcr-id text) (k aik akey) (tpm tpm-0 chan))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id) (k k) (aik aik) (tpm tpm-0))-  (precedes ((1 3) (0 0)) ((2 1) (1 2)))-  (non-orig aik (invk k))-  (uniq-orig v n k)-  (conf tpm)-  (auth tpm-0)-  (operation encryption-test (added-strand tpm-create-key 2)-    (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik) (1 2))-  (strand-map 0 1)-  (traces ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id n))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm-0 (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (send (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))))-  (label 32)-  (parent 31)-  (unrealized (0 0) (2 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-plus-  (vars (v n data) (pcr-id text) (k aik akey) (tpm chan))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id) (k k) (aik aik) (tpm tpm))-  (precedes ((1 1) (2 0)) ((1 3) (0 0)) ((2 1) (1 2)))-  (non-orig aik (invk k))-  (uniq-orig v n k)-  (conf tpm)-  (auth tpm)-  (operation channel-test (displaced 3 1 alice 2)-    (ch-msg tpm-0-      (cat "create-req" pcr-id (hash (hash "0" n) "obtain"))) (2 0))-  (strand-map 0 1 2)-  (traces ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id n))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (send (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))))-  (label 33)-  (parent 32)-  (unrealized (0 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-plus-  (vars (current-value mesg) (v n data) (pcr-id pcr-id-0 text)-    (k aik aik-0 akey) (pt pval) (tpm tpm-0 chan) (pcr locn))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v) (current-value current-value)-    (pcr-id pcr-id-0) (k k) (aik aik-0) (tpm tpm-0) (pcr pcr))-  (precedes ((1 1) (2 0)) ((1 3) (3 0)) ((2 1) (1 2)) ((3 3) (0 0)))-  (non-orig aik aik-0 (invk k))-  (uniq-orig v n k)-  (conf tpm)-  (auth tpm)-  (operation nonce-test (added-strand tpm-decrypt 4) v (0 0) (enc v k))-  (strand-map 0 1 2)-  (traces ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id n))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (send (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-0 current-value aik-0))-      (load pcr (cat pt current-value)) (send v)))-  (label 34)-  (parent 33)-  (unrealized (3 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-plus-  (vars (v n data) (pcr-id text) (k aik akey) (pt pval) (tpm tpm-0 chan)-    (pcr locn))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id) (k k)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (precedes ((1 1) (2 0)) ((1 3) (3 0)) ((2 1) (1 2)) ((3 3) (0 0)))-  (non-orig aik (invk k))-  (uniq-orig v n k)-  (gen-st (hash (hash "0" n) "obtain"))-  (conf tpm)-  (auth tpm)-  -  (operation encryption-test (displaced 4 2 tpm-create-key 2)-    (enc "created" k pcr-id-0 current-value aik-0) (3 1))-  (strand-map 0 1 2 3)-  (traces ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id n))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (send (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v)))-  (label 35)-  (parent 34)-  (unrealized (3 2))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-plus-  (vars (v n data) (pcr-id pcr-id-0 text) (k aik akey) (pt pt-0 pval)-    (tpm tpm-0 tpm-1 chan) (pcr locn))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id) (k k)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 3 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-0) (tpm tpm-1)-    (pcr pcr))-  (precedes ((1 1) (2 0)) ((1 3) (3 0)) ((2 1) (1 2)) ((3 3) (0 0))-    ((4 2) (3 2)))-  (non-orig aik (invk k))-  (uniq-orig v n k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain"))-  (conf tpm)-  (auth tpm)-  (leads-to ((4 2) (3 2)))-  -  (operation channel-test (added-strand tpm-extend-enc 3)-    (ch-msg pcr (cat pt (hash (hash "0" n) "obtain"))) (3 2))-  (strand-map 0 1 2 3)-  (traces ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id n))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (send (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((recv tpm-1 (cat "extend" pcr-id-0 "obtain"))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain")))))-  (label 36)-  (parent 35)-  (unrealized (4 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-plus-  (vars (v n data) (pcr-id pcr-id-0 pcr-id-1 text) (k aik akey)-    (pt pt-0 pt-1 pval) (tpm tpm-0 tpm-1 tpm-2 chan) (pcr locn))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id) (k k)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 3 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-0) (tpm tpm-1)-    (pcr pcr))-  (defstrand tpm-extend-enc 3 (value n) (current-value "0")-    (pcr-id pcr-id-1) (tpm tpm-2) (pcr pcr))-  (precedes ((1 0) (5 0)) ((1 1) (2 0)) ((1 3) (3 0)) ((2 1) (1 2))-    ((3 3) (0 0)) ((4 2) (3 2)) ((5 2) (4 1)))-  (non-orig aik (invk k))-  (uniq-orig v n k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain"))-  (conf tpm)-  (auth tpm)-  (leads-to ((4 2) (3 2)) ((5 2) (4 1)))-  -  (operation channel-test (added-strand tpm-extend-enc 3)-    (ch-msg pcr (cat pt-0 (hash "0" n))) (4 1))-  (strand-map 0 1 2 3 4)-  (traces ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id n))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (send (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((recv tpm-1 (cat "extend" pcr-id-0 "obtain"))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain"))))-    ((recv tpm-2 (cat "extend" pcr-id-1 n)) (load pcr (cat pt-1 "0"))-      (stor pcr (cat pt-0 (hash "0" n)))))-  (label 37)-  (parent 36)-  (unrealized (5 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-plus-  (vars (v n data) (pcr-id pcr-id-0 text) (k aik akey)-    (pt pt-0 pt-1 pval) (tpm tpm-0 tpm-1 chan) (pcr locn))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id) (k k)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 3 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-0) (tpm tpm-1)-    (pcr pcr))-  (defstrand tpm-extend-enc 3 (value n) (current-value "0")-    (pcr-id pcr-id) (tpm tpm) (pcr pcr))-  (precedes ((1 0) (5 0)) ((1 1) (2 0)) ((1 3) (3 0)) ((2 1) (1 2))-    ((3 3) (0 0)) ((4 2) (3 2)) ((5 2) (4 1)))-  (non-orig aik (invk k))-  (uniq-orig v n k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain"))-  (conf tpm)-  (auth tpm)-  (leads-to ((4 2) (3 2)) ((5 2) (4 1)))-  -  (operation nonce-test (contracted (pcr-id-1 pcr-id) (tpm-2 tpm)) n-    (5 0) (ch-msg tpm (cat "extend" pcr-id n)))-  (strand-map 0 1 2 3 4 5)-  (traces ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id n))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (send (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((recv tpm-1 (cat "extend" pcr-id-0 "obtain"))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain"))))-    ((recv tpm (cat "extend" pcr-id n)) (load pcr (cat pt-1 "0"))-      (stor pcr (cat pt-0 (hash "0" n)))))-  (label 38)-  (parent 37)-  (realized)-  (shape)-  (maps ((0 1) ((v v) (n n) (pcr-id pcr-id) (k k) (aik aik) (tpm tpm))))-  (origs (pt-0 (5 2)) (pt (4 2)) (k (2 1)) (n (1 0)) (v (1 3))))--(comment "Nothing left to do")--(defprotocol envelope-plus basic-  (defrole tpm-power-on-    (vars (current-value mesg) (pcr locn) (tpm chan))-    (trace (recv tpm "power on") (load pcr current-value)-      (stor pcr "0")))-  (defrole tpm-extend-enc-    (vars (value current-value mesg) (pcr-id text) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "extend" pcr-id value))-      (load pcr current-value) (stor pcr (hash current-value value))-      (send "ext ok")))-  (defrole tpm-quote-    (vars (nonce current-value mesg) (pcr-id text) (aik akey) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "quote" pcr-id nonce))-      (load pcr current-value)-      (send (enc "quote" pcr-id current-value nonce aik))))-  (defrole tpm-create-key-    (vars (k aik akey) (pcr-id text) (pcrval mesg) (tpm chan))-    (trace (recv tpm (cat "create-req" pcr-id pcrval))-      (send (enc "created" k pcr-id pcrval aik)))-    (non-orig (invk k))-    (uniq-orig k)-    (auth tpm))-  (defrole tpm-decrypt-    (vars (m current-value mesg) (pcr-id text) (k aik akey) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "decrypt" (enc m k)))-      (recv (enc "created" k pcr-id current-value aik))-      (load pcr current-value) (send m))-    (non-orig aik))-  (defrole alice-    (vars (n v data) (pcr-id text) (k aik akey) (tpm chan))-    (trace (send tpm (cat "extend" pcr-id n))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    (non-orig aik)-    (uniq-orig n v)-    (conf tpm)-    (neq (k aik)))-  (defrule genStV-if-hashed-tpm-power-on-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-power-on" z (idx 2))-          (p "tpm-power-on" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-extend-enc-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-extend-enc" z (idx 2))-          (p "tpm-extend-enc" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-decrypt-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-decrypt" z (idx 3))-          (p "tpm-decrypt" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-quote-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-quote" z (idx 2))-          (p "tpm-quote" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule ordered-extends-    (forall ((y z strd) (pcr locn))-      (implies-        (and (p "tpm-extend-enc" y (idx 3))-          (p "tpm-extend-enc" z (idx 3))-          (p "tpm-extend-enc" "pcr" y pcr)-          (p "tpm-extend-enc" "pcr" z pcr))-        (or-          (= y z)-          (prec y (idx 2) z (idx 1))-          (prec z (idx 2) y (idx 1))))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule shearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule invShearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule trRl_tpm-power-on-at-2-    (forall ((z strd))-      (implies (p "tpm-power-on" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_tpm-power-on-at-1-    (forall ((z strd))-      (implies (p "tpm-power-on" z (idx 3)) (trans z (idx 1)))))-  (defgenrule trRl_tpm-extend-enc-at-2-    (forall ((z strd))-      (implies (p "tpm-extend-enc" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_tpm-extend-enc-at-1-    (forall ((z strd))-      (implies (p "tpm-extend-enc" z (idx 3)) (trans z (idx 1))))))--(defskeleton envelope-plus-  (vars (n v data) (pcr-id pcr-id-0 text) (k aik akey) (tpm chan))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (non-orig aik)-  (uniq-orig n v)-  (conf tpm)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k))))-  (label 39)-  (unrealized (0 0) (1 2))-  (preskeleton)-  (origs (v (1 3)) (n (1 0)))-  (comment "Not a skeleton"))--(defskeleton envelope-plus-  (vars (n v data) (pcr-id pcr-id-0 text) (k aik akey) (tpm chan))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (precedes ((1 3) (0 0)))-  (non-orig aik)-  (uniq-orig n v)-  (conf tpm)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k))))-  (label 40)-  (parent 39)-  (unrealized (0 0) (1 2))-  (origs (v (1 3)) (n (1 0)))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-plus-  (vars (n v data) (pcr-id pcr-id-0 text) (k aik akey) (tpm tpm-0 chan))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm-0))-  (precedes ((1 3) (0 0)) ((2 1) (1 2)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (conf tpm)-  (auth tpm-0)-  (operation encryption-test (added-strand tpm-create-key 2)-    (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik) (1 2))-  (strand-map 0 1)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm-0-       (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))))-  (label 41)-  (parent 40)-  (unrealized (0 0) (2 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-plus-  (vars (n v data) (pcr-id pcr-id-0 text) (k aik akey) (tpm chan))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (precedes ((1 1) (2 0)) ((1 3) (0 0)) ((2 1) (1 2)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (conf tpm)-  (auth tpm)-  (operation channel-test (displaced 3 1 alice 2)-    (ch-msg tpm-0-      (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain"))) (2 0))-  (strand-map 0 1 2)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))))-  (label 42)-  (parent 41)-  (unrealized (0 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-plus-  (vars (n v data) (pcr-id pcr-id-0 text) (k aik akey) (pt pval)-    (tpm tpm-0 chan) (pcr locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-quote 3 (nonce (enc v k))-    (current-value (hash (hash "0" n) "refuse")) (pcr-id pcr-id)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (precedes ((1 1) (2 0)) ((1 3) (3 0)) ((2 1) (1 2)) ((3 2) (0 0)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (gen-st (hash (hash "0" n) "refuse"))-  (conf tpm)-  (auth tpm)-  -  (operation encryption-test (added-strand tpm-quote 3)-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik)-    (0 0))-  (strand-map 0 1 2)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "quote" pcr-id (enc v k)))-      (load pcr (cat pt (hash (hash "0" n) "refuse")))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))))-  (label 43)-  (parent 42)-  (unrealized (3 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-plus-  (vars (n v data) (pcr-id pcr-id-0 pcr-id-1 text) (k aik akey)-    (pt pt-0 pval) (tpm tpm-0 tpm-1 chan) (pcr locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-quote 3 (nonce (enc v k))-    (current-value (hash (hash "0" n) "refuse")) (pcr-id pcr-id)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 3 (value "refuse")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (tpm tpm-1)-    (pcr pcr))-  (precedes ((1 1) (2 0)) ((1 3) (3 0)) ((2 1) (1 2)) ((3 2) (0 0))-    ((4 2) (3 1)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (gen-st (hash "0" n) (hash (hash "0" n) "refuse"))-  (conf tpm)-  (auth tpm)-  (leads-to ((4 2) (3 1)))-  -  (operation channel-test (added-strand tpm-extend-enc 3)-    (ch-msg pcr (cat pt (hash (hash "0" n) "refuse"))) (3 1))-  (strand-map 0 1 2 3)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "quote" pcr-id (enc v k)))-      (load pcr (cat pt (hash (hash "0" n) "refuse")))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((recv tpm-1 (cat "extend" pcr-id-1 "refuse"))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "refuse")))))-  (label 44)-  (parent 43)-  (unrealized (4 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-plus-  (vars (n v data) (pcr-id pcr-id-0 pcr-id-1 pcr-id-2 text) (k aik akey)-    (pt pt-0 pt-1 pval) (tpm tpm-0 tpm-1 tpm-2 chan) (pcr locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-quote 3 (nonce (enc v k))-    (current-value (hash (hash "0" n) "refuse")) (pcr-id pcr-id)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 3 (value "refuse")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (tpm tpm-1)-    (pcr pcr))-  (defstrand tpm-extend-enc 3 (value n) (current-value "0")-    (pcr-id pcr-id-2) (tpm tpm-2) (pcr pcr))-  (precedes ((1 0) (5 0)) ((1 1) (2 0)) ((1 3) (3 0)) ((2 1) (1 2))-    ((3 2) (0 0)) ((4 2) (3 1)) ((5 2) (4 1)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (gen-st (hash "0" n) (hash (hash "0" n) "refuse"))-  (conf tpm)-  (auth tpm)-  (leads-to ((4 2) (3 1)) ((5 2) (4 1)))-  -  (operation channel-test (added-strand tpm-extend-enc 3)-    (ch-msg pcr (cat pt-0 (hash "0" n))) (4 1))-  (strand-map 0 1 2 3 4)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "quote" pcr-id (enc v k)))-      (load pcr (cat pt (hash (hash "0" n) "refuse")))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((recv tpm-1 (cat "extend" pcr-id-1 "refuse"))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "refuse"))))-    ((recv tpm-2 (cat "extend" pcr-id-2 n)) (load pcr (cat pt-1 "0"))-      (stor pcr (cat pt-0 (hash "0" n)))))-  (label 45)-  (parent 44)-  (unrealized (5 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-plus-  (vars (n v data) (pcr-id pcr-id-0 pcr-id-1 text) (k aik akey)-    (pt pt-0 pt-1 pval) (tpm tpm-0 tpm-1 chan) (pcr locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-quote 3 (nonce (enc v k))-    (current-value (hash (hash "0" n) "refuse")) (pcr-id pcr-id)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 3 (value "refuse")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (tpm tpm-1)-    (pcr pcr))-  (defstrand tpm-extend-enc 3 (value n) (current-value "0")-    (pcr-id pcr-id-0) (tpm tpm) (pcr pcr))-  (precedes ((1 0) (5 0)) ((1 1) (2 0)) ((1 3) (3 0)) ((2 1) (1 2))-    ((3 2) (0 0)) ((4 2) (3 1)) ((5 2) (4 1)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (gen-st (hash "0" n) (hash (hash "0" n) "refuse"))-  (conf tpm)-  (auth tpm)-  (leads-to ((4 2) (3 1)) ((5 2) (4 1)))-  -  (operation nonce-test (contracted (pcr-id-2 pcr-id-0) (tpm-2 tpm)) n-    (5 0) (ch-msg tpm (cat "extend" pcr-id-0 n)))-  (strand-map 0 1 2 3 4 5)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "quote" pcr-id (enc v k)))-      (load pcr (cat pt (hash (hash "0" n) "refuse")))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((recv tpm-1 (cat "extend" pcr-id-1 "refuse"))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "refuse"))))-    ((recv tpm (cat "extend" pcr-id-0 n)) (load pcr (cat pt-1 "0"))-      (stor pcr (cat pt-0 (hash "0" n)))))-  (label 46)-  (parent 45)-  (realized)-  (shape)-  (maps-    ((0 1)-      ((n n) (v v) (k k) (aik aik) (pcr-id pcr-id) (pcr-id-0 pcr-id-0)-        (tpm tpm))))-  (origs (pt-0 (5 2)) (pt (4 2)) (n (1 0)) (k (2 1)) (v (1 3))))--(comment "Nothing left to do")--(defprotocol envelope-plus basic-  (defrole tpm-power-on-    (vars (current-value mesg) (pcr locn) (tpm chan))-    (trace (recv tpm "power on") (load pcr current-value)-      (stor pcr "0")))-  (defrole tpm-extend-enc-    (vars (value current-value mesg) (pcr-id text) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "extend" pcr-id value))-      (load pcr current-value) (stor pcr (hash current-value value))-      (send "ext ok")))-  (defrole tpm-quote-    (vars (nonce current-value mesg) (pcr-id text) (aik akey) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "quote" pcr-id nonce))-      (load pcr current-value)-      (send (enc "quote" pcr-id current-value nonce aik))))-  (defrole tpm-create-key-    (vars (k aik akey) (pcr-id text) (pcrval mesg) (tpm chan))-    (trace (recv tpm (cat "create-req" pcr-id pcrval))-      (send (enc "created" k pcr-id pcrval aik)))-    (non-orig (invk k))-    (uniq-orig k)-    (auth tpm))-  (defrole tpm-decrypt-    (vars (m current-value mesg) (pcr-id text) (k aik akey) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "decrypt" (enc m k)))-      (recv (enc "created" k pcr-id current-value aik))-      (load pcr current-value) (send m))-    (non-orig aik))-  (defrole alice-    (vars (n v data) (pcr-id text) (k aik akey) (tpm chan))-    (trace (send tpm (cat "extend" pcr-id n))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    (non-orig aik)-    (uniq-orig n v)-    (conf tpm)-    (neq (k aik)))-  (defrule genStV-if-hashed-tpm-power-on-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-power-on" z (idx 2))-          (p "tpm-power-on" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-extend-enc-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-extend-enc" z (idx 2))-          (p "tpm-extend-enc" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-decrypt-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-decrypt" z (idx 3))-          (p "tpm-decrypt" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-quote-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-quote" z (idx 2))-          (p "tpm-quote" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule ordered-extends-    (forall ((y z strd) (pcr locn))-      (implies-        (and (p "tpm-extend-enc" y (idx 3))-          (p "tpm-extend-enc" z (idx 3))-          (p "tpm-extend-enc" "pcr" y pcr)-          (p "tpm-extend-enc" "pcr" z pcr))-        (or-          (= y z)-          (prec y (idx 2) z (idx 1))-          (prec z (idx 2) y (idx 1))))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule shearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule invShearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule trRl_tpm-power-on-at-2-    (forall ((z strd))-      (implies (p "tpm-power-on" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_tpm-power-on-at-1-    (forall ((z strd))-      (implies (p "tpm-power-on" z (idx 3)) (trans z (idx 1)))))-  (defgenrule trRl_tpm-extend-enc-at-2-    (forall ((z strd))-      (implies (p "tpm-extend-enc" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_tpm-extend-enc-at-1-    (forall ((z strd))-      (implies (p "tpm-extend-enc" z (idx 3)) (trans z (idx 1))))))--(defskeleton envelope-plus-  (vars (n v data) (pcr-id pcr-id-0 text) (k aik akey) (tpm chan))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (non-orig aik)-  (uniq-orig n v)-  (conf tpm)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k))))-  (label 47)-  (unrealized (0 0) (1 0) (2 2))-  (preskeleton)-  (origs (v (2 3)) (n (2 0)))-  (comment "Not a skeleton"))--(defskeleton envelope-plus-  (vars (n v data) (pcr-id pcr-id-0 text) (k aik akey) (tpm chan))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (precedes ((2 3) (0 0)) ((2 3) (1 0)))-  (non-orig aik)-  (uniq-orig n v)-  (conf tpm)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k))))-  (label 48)-  (parent 47)-  (unrealized (0 0) (2 2))-  (origs (v (2 3)) (n (2 0)))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-plus-  (vars (n v data) (pcr-id pcr-id-0 text) (k aik akey) (tpm tpm-0 chan))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm-0))-  (precedes ((2 3) (0 0)) ((2 3) (1 0)) ((3 1) (2 2)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (conf tpm)-  (auth tpm-0)-  (operation encryption-test (added-strand tpm-create-key 2)-    (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik) (2 2))-  (strand-map 0 1 2)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm-0-       (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))))-  (label 49)-  (parent 48)-  (unrealized (0 0) (1 0) (3 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-plus-  (vars (n v data) (pcr-id pcr-id-0 text) (k aik akey) (tpm chan))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (precedes ((2 1) (3 0)) ((2 3) (0 0)) ((2 3) (1 0)) ((3 1) (2 2)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (conf tpm)-  (auth tpm)-  (operation channel-test (displaced 4 2 alice 2)-    (ch-msg tpm-0-      (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain"))) (3 0))-  (strand-map 0 1 2 3)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))))-  (label 50)-  (parent 49)-  (unrealized (0 0) (1 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-plus-  (vars (current-value mesg) (n v data) (pcr-id pcr-id-0 pcr-id-1 text)-    (k aik aik-0 akey) (pt pval) (tpm tpm-0 chan) (pcr locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v) (current-value current-value)-    (pcr-id pcr-id-1) (k k) (aik aik-0) (tpm tpm-0) (pcr pcr))-  (precedes ((2 1) (3 0)) ((2 3) (0 0)) ((2 3) (4 0)) ((3 1) (2 2))-    ((4 3) (1 0)))-  (non-orig aik aik-0 (invk k))-  (uniq-orig n v k)-  (conf tpm)-  (auth tpm)-  (operation nonce-test (added-strand tpm-decrypt 4) v (1 0) (enc v k))-  (strand-map 0 1 2 3)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-1 current-value aik-0))-      (load pcr (cat pt current-value)) (send v)))-  (label 51)-  (parent 50)-  (unrealized (0 0) (4 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-plus-  (vars (n v data) (pcr-id pcr-id-0 text) (k aik akey) (pt pval)-    (tpm tpm-0 chan) (pcr locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id-0) (k k)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (precedes ((2 1) (3 0)) ((2 3) (0 0)) ((2 3) (4 0)) ((3 1) (2 2))-    ((4 3) (1 0)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (gen-st (hash (hash "0" n) "obtain"))-  (conf tpm)-  (auth tpm)-  -  (operation encryption-test (displaced 5 3 tpm-create-key 2)-    (enc "created" k pcr-id-1 current-value aik-0) (4 1))-  (strand-map 0 1 2 3 4)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v)))-  (label 52)-  (parent 51)-  (unrealized (0 0) (4 2))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-plus-  (vars (n v data) (pcr-id pcr-id-0 pcr-id-1 text) (k aik akey)-    (pt pt-0 pval) (tpm tpm-0 tpm-1 chan) (pcr locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id-0) (k k)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 3 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (tpm tpm-1)-    (pcr pcr))-  (precedes ((2 1) (3 0)) ((2 3) (0 0)) ((2 3) (4 0)) ((3 1) (2 2))-    ((4 3) (1 0)) ((5 2) (4 2)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain"))-  (conf tpm)-  (auth tpm)-  (leads-to ((5 2) (4 2)))-  -  (operation channel-test (added-strand tpm-extend-enc 3)-    (ch-msg pcr (cat pt (hash (hash "0" n) "obtain"))) (4 2))-  (strand-map 0 1 2 3 4)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((recv tpm-1 (cat "extend" pcr-id-1 "obtain"))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain")))))-  (label 53)-  (parent 52)-  (unrealized (0 0) (5 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-plus-  (vars (n v data) (pcr-id pcr-id-0 pcr-id-1 pcr-id-2 text) (k aik akey)-    (pt pt-0 pt-1 pval) (tpm tpm-0 tpm-1 tpm-2 chan) (pcr locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id-0) (k k)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 3 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (tpm tpm-1)-    (pcr pcr))-  (defstrand tpm-extend-enc 3 (value n) (current-value "0")-    (pcr-id pcr-id-2) (tpm tpm-2) (pcr pcr))-  (precedes ((2 0) (6 0)) ((2 1) (3 0)) ((2 3) (0 0)) ((2 3) (4 0))-    ((3 1) (2 2)) ((4 3) (1 0)) ((5 2) (4 2)) ((6 2) (5 1)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain"))-  (conf tpm)-  (auth tpm)-  (leads-to ((5 2) (4 2)) ((6 2) (5 1)))-  -  (operation channel-test (added-strand tpm-extend-enc 3)-    (ch-msg pcr (cat pt-0 (hash "0" n))) (5 1))-  (strand-map 0 1 2 3 4 5)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((recv tpm-1 (cat "extend" pcr-id-1 "obtain"))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain"))))-    ((recv tpm-2 (cat "extend" pcr-id-2 n)) (load pcr (cat pt-1 "0"))-      (stor pcr (cat pt-0 (hash "0" n)))))-  (label 54)-  (parent 53)-  (unrealized (0 0) (6 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-plus-  (vars (n v data) (pcr-id pcr-id-0 pcr-id-1 text) (k aik akey)-    (pt pt-0 pt-1 pval) (tpm tpm-0 tpm-1 chan) (pcr locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id-0) (k k)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 3 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (tpm tpm-1)-    (pcr pcr))-  (defstrand tpm-extend-enc 3 (value n) (current-value "0")-    (pcr-id pcr-id-0) (tpm tpm) (pcr pcr))-  (precedes ((2 0) (6 0)) ((2 1) (3 0)) ((2 3) (0 0)) ((2 3) (4 0))-    ((3 1) (2 2)) ((4 3) (1 0)) ((5 2) (4 2)) ((6 2) (5 1)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain"))-  (conf tpm)-  (auth tpm)-  (leads-to ((5 2) (4 2)) ((6 2) (5 1)))-  -  (operation nonce-test (contracted (pcr-id-2 pcr-id-0) (tpm-2 tpm)) n-    (6 0) (ch-msg tpm (cat "extend" pcr-id-0 n)))-  (strand-map 0 1 2 3 4 5 6)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((recv tpm-1 (cat "extend" pcr-id-1 "obtain"))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain"))))-    ((recv tpm (cat "extend" pcr-id-0 n)) (load pcr (cat pt-1 "0"))-      (stor pcr (cat pt-0 (hash "0" n)))))-  (label 55)-  (parent 54)-  (unrealized (0 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-plus-  (vars (n v data) (pcr-id pcr-id-0 pcr-id-1 text) (k aik akey)-    (pt pt-0 pt-1 pt-2 pval) (tpm tpm-0 tpm-1 tpm-2 chan)-    (pcr pcr-0 locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id-0) (k k)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 3 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (tpm tpm-1)-    (pcr pcr))-  (defstrand tpm-extend-enc 3 (value n) (current-value "0")-    (pcr-id pcr-id-0) (tpm tpm) (pcr pcr))-  (defstrand tpm-quote 3 (nonce (enc v k))-    (current-value (hash (hash "0" n) "refuse")) (pcr-id pcr-id)-    (aik aik) (tpm tpm-2) (pcr pcr-0))-  (precedes ((2 0) (6 0)) ((2 1) (3 0)) ((2 3) (4 0)) ((2 3) (7 0))-    ((3 1) (2 2)) ((4 3) (1 0)) ((5 2) (4 2)) ((6 2) (5 1))-    ((7 2) (0 0)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain")-    (hash (hash "0" n) "refuse"))-  (conf tpm)-  (auth tpm)-  (leads-to ((5 2) (4 2)) ((6 2) (5 1)))-  -  (operation encryption-test (added-strand tpm-quote 3)-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik)-    (0 0))-  (strand-map 0 1 2 3 4 5 6)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((recv tpm-1 (cat "extend" pcr-id-1 "obtain"))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain"))))-    ((recv tpm (cat "extend" pcr-id-0 n)) (load pcr (cat pt-1 "0"))-      (stor pcr (cat pt-0 (hash "0" n))))-    ((recv tpm-2 (cat "quote" pcr-id (enc v k)))-      (load pcr-0 (cat pt-2 (hash (hash "0" n) "refuse")))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))))-  (label 56)-  (parent 55)-  (unrealized (7 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-plus-  (vars (n v data) (pcr-id pcr-id-0 pcr-id-1 pcr-id-2 text) (k aik akey)-    (pt pt-0 pt-1 pt-2 pt-3 pval) (tpm tpm-0 tpm-1 tpm-2 tpm-3 chan)-    (pcr pcr-0 locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id-0) (k k)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 3 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (tpm tpm-1)-    (pcr pcr))-  (defstrand tpm-extend-enc 3 (value n) (current-value "0")-    (pcr-id pcr-id-0) (tpm tpm) (pcr pcr))-  (defstrand tpm-quote 3 (nonce (enc v k))-    (current-value (hash (hash "0" n) "refuse")) (pcr-id pcr-id)-    (aik aik) (tpm tpm-2) (pcr pcr-0))-  (defstrand tpm-extend-enc 3 (value "refuse")-    (current-value (hash "0" n)) (pcr-id pcr-id-2) (tpm tpm-3)-    (pcr pcr-0))-  (precedes ((2 0) (6 0)) ((2 1) (3 0)) ((2 3) (4 0)) ((2 3) (7 0))-    ((3 1) (2 2)) ((4 3) (1 0)) ((5 2) (4 2)) ((6 2) (5 1))-    ((7 2) (0 0)) ((8 2) (7 1)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain")-    (hash (hash "0" n) "refuse"))-  (conf tpm)-  (auth tpm)-  (leads-to ((5 2) (4 2)) ((6 2) (5 1)) ((8 2) (7 1)))-  -  (operation channel-test (added-strand tpm-extend-enc 3)-    (ch-msg pcr-0 (cat pt-2 (hash (hash "0" n) "refuse"))) (7 1))-  (strand-map 0 1 2 3 4 5 6 7)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((recv tpm-1 (cat "extend" pcr-id-1 "obtain"))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain"))))-    ((recv tpm (cat "extend" pcr-id-0 n)) (load pcr (cat pt-1 "0"))-      (stor pcr (cat pt-0 (hash "0" n))))-    ((recv tpm-2 (cat "quote" pcr-id (enc v k)))-      (load pcr-0 (cat pt-2 (hash (hash "0" n) "refuse")))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((recv tpm-3 (cat "extend" pcr-id-2 "refuse"))-      (load pcr-0 (cat pt-3 (hash "0" n)))-      (stor pcr-0 (cat pt-2 (hash (hash "0" n) "refuse")))))-  (label 57)-  (parent 56)-  (unrealized (8 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-plus-  (vars (n v data) (pcr-id pcr-id-0 pcr-id-1 pcr-id-2 pcr-id-3 text)-    (k aik akey) (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval)-    (tpm tpm-0 tpm-1 tpm-2 tpm-3 tpm-4 chan) (pcr pcr-0 locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id-0) (k k)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 3 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (tpm tpm-1)-    (pcr pcr))-  (defstrand tpm-extend-enc 3 (value n) (current-value "0")-    (pcr-id pcr-id-0) (tpm tpm) (pcr pcr))-  (defstrand tpm-quote 3 (nonce (enc v k))-    (current-value (hash (hash "0" n) "refuse")) (pcr-id pcr-id)-    (aik aik) (tpm tpm-2) (pcr pcr-0))-  (defstrand tpm-extend-enc 3 (value "refuse")-    (current-value (hash "0" n)) (pcr-id pcr-id-2) (tpm tpm-3)-    (pcr pcr-0))-  (defstrand tpm-extend-enc 3 (value n) (current-value "0")-    (pcr-id pcr-id-3) (tpm tpm-4) (pcr pcr-0))-  (precedes ((2 0) (6 0)) ((2 0) (9 0)) ((2 1) (3 0)) ((2 3) (4 0))-    ((2 3) (7 0)) ((3 1) (2 2)) ((4 3) (1 0)) ((5 2) (4 2))-    ((6 2) (5 1)) ((7 2) (0 0)) ((8 2) (7 1)) ((9 2) (8 1)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain")-    (hash (hash "0" n) "refuse"))-  (conf tpm)-  (auth tpm)-  (leads-to ((5 2) (4 2)) ((6 2) (5 1)) ((8 2) (7 1)) ((9 2) (8 1)))-  -  (operation channel-test (added-strand tpm-extend-enc 3)-    (ch-msg pcr-0 (cat pt-3 (hash "0" n))) (8 1))-  (strand-map 0 1 2 3 4 5 6 7 8)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((recv tpm-1 (cat "extend" pcr-id-1 "obtain"))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain"))))-    ((recv tpm (cat "extend" pcr-id-0 n)) (load pcr (cat pt-1 "0"))-      (stor pcr (cat pt-0 (hash "0" n))))-    ((recv tpm-2 (cat "quote" pcr-id (enc v k)))-      (load pcr-0 (cat pt-2 (hash (hash "0" n) "refuse")))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((recv tpm-3 (cat "extend" pcr-id-2 "refuse"))-      (load pcr-0 (cat pt-3 (hash "0" n)))-      (stor pcr-0 (cat pt-2 (hash (hash "0" n) "refuse"))))-    ((recv tpm-4 (cat "extend" pcr-id-3 n)) (load pcr-0 (cat pt-4 "0"))-      (stor pcr-0 (cat pt-3 (hash "0" n)))))-  (label 58)-  (parent 57)-  (unrealized (9 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-plus-  (vars (n v data) (pcr-id pcr-id-0 pcr-id-1 pcr-id-2 text) (k aik akey)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval)-    (tpm tpm-0 tpm-1 tpm-2 tpm-3 chan) (pcr pcr-0 locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id-0) (k k)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 3 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (tpm tpm-1)-    (pcr pcr))-  (defstrand tpm-extend-enc 3 (value n) (current-value "0")-    (pcr-id pcr-id-0) (tpm tpm) (pcr pcr))-  (defstrand tpm-quote 3 (nonce (enc v k))-    (current-value (hash (hash "0" n) "refuse")) (pcr-id pcr-id)-    (aik aik) (tpm tpm-2) (pcr pcr-0))-  (defstrand tpm-extend-enc 3 (value "refuse")-    (current-value (hash "0" n)) (pcr-id pcr-id-2) (tpm tpm-3)-    (pcr pcr-0))-  (defstrand tpm-extend-enc 3 (value n) (current-value "0")-    (pcr-id pcr-id-0) (tpm tpm) (pcr pcr-0))-  (precedes ((2 0) (6 0)) ((2 0) (9 0)) ((2 1) (3 0)) ((2 3) (4 0))-    ((2 3) (7 0)) ((3 1) (2 2)) ((4 3) (1 0)) ((5 2) (4 2))-    ((6 2) (5 1)) ((7 2) (0 0)) ((8 2) (7 1)) ((9 2) (8 1)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain")-    (hash (hash "0" n) "refuse"))-  (conf tpm)-  (auth tpm)-  (leads-to ((5 2) (4 2)) ((6 2) (5 1)) ((8 2) (7 1)) ((9 2) (8 1)))-  -  (operation nonce-test (contracted (pcr-id-3 pcr-id-0) (tpm-4 tpm)) n-    (9 0) (ch-msg tpm (cat "extend" pcr-id-0 n)))-  (strand-map 0 1 2 3 4 5 6 7 8 9)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((recv tpm-1 (cat "extend" pcr-id-1 "obtain"))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain"))))-    ((recv tpm (cat "extend" pcr-id-0 n)) (load pcr (cat pt-1 "0"))-      (stor pcr (cat pt-0 (hash "0" n))))-    ((recv tpm-2 (cat "quote" pcr-id (enc v k)))-      (load pcr-0 (cat pt-2 (hash (hash "0" n) "refuse")))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((recv tpm-3 (cat "extend" pcr-id-2 "refuse"))-      (load pcr-0 (cat pt-3 (hash "0" n)))-      (stor pcr-0 (cat pt-2 (hash (hash "0" n) "refuse"))))-    ((recv tpm (cat "extend" pcr-id-0 n)) (load pcr-0 (cat pt-4 "0"))-      (stor pcr-0 (cat pt-3 (hash "0" n)))))-  (label 59)-  (parent 58)-  (realized)-  (shape)-  (maps-    ((0 1 2)-      ((n n) (v v) (k k) (aik aik) (pcr-id pcr-id) (pcr-id-0 pcr-id-0)-        (tpm tpm))))-  (origs (pt-3 (9 2)) (pt-2 (8 2)) (pt-0 (6 2)) (pt (5 2)) (k (3 1))-    (n (2 0)) (v (2 3))))--(comment "Nothing left to do")--(defprotocol envelope-plus-2 basic-  (defrole tpm-power-on-    (vars (current-value mesg) (pcr locn) (tpm chan))-    (trace (recv tpm "power on") (load pcr current-value)-      (stor pcr "0")))-  (defrole tpm-extend-enc-    (vars (value current-value mesg) (pcr-id text) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "extend" pcr-id value))-      (load pcr current-value) (stor pcr (hash current-value value))-      (send "ext ok")))-  (defrole tpm-quote-    (vars (nonce current-value mesg) (pcr-id text) (aik akey) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "quote" pcr-id nonce))-      (load pcr current-value)-      (send (enc "quote" pcr-id current-value nonce aik))))-  (defrole tpm-create-key-    (vars (k aik akey) (pcr-id text) (pcrval mesg) (tpm chan))-    (trace (recv tpm (cat "create-req" pcr-id pcrval))-      (send (enc "created" k pcr-id pcrval aik)))-    (non-orig (invk k))-    (uniq-orig k)-    (auth tpm))-  (defrole tpm-decrypt-    (vars (m current-value mesg) (pcr-id text) (k aik akey) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "decrypt" (enc m k)))-      (recv (enc "created" k pcr-id current-value aik))-      (load pcr current-value) (send m))-    (non-orig aik))-  (defrole alice-    (vars (n v data) (pcr-id text) (k aik akey) (tpm chan))-    (trace (send tpm (cat "extend" pcr-id n))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    (non-orig aik)-    (uniq-orig n v)-    (conf tpm)-    (neq (k aik)))-  (defrule genStV-if-hashed-tpm-power-on-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-power-on" z (idx 2))-          (p "tpm-power-on" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-extend-enc-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-extend-enc" z (idx 2))-          (p "tpm-extend-enc" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-decrypt-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-decrypt" z (idx 3))-          (p "tpm-decrypt" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-quote-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-quote" z (idx 2))-          (p "tpm-quote" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule pcr-id-identifies-pcr-    (forall ((y z strd) (pcr-id text) (pcr pcr-0 locn))-      (implies-        (and (p "tpm-extend-enc" y (idx 3))-          (p "tpm-extend-enc" z (idx 3))-          (p "tpm-extend-enc" "pcr-id" y pcr-id)-          (p "tpm-extend-enc" "pcr-id" z pcr-id)-          (p "tpm-extend-enc" "pcr" y pcr)-          (p "tpm-extend-enc" "pcr" z pcr-0))-        (= pcr pcr-0))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule shearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule invShearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule trRl_tpm-power-on-at-2-    (forall ((z strd))-      (implies (p "tpm-power-on" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_tpm-power-on-at-1-    (forall ((z strd))-      (implies (p "tpm-power-on" z (idx 3)) (trans z (idx 1)))))-  (defgenrule trRl_tpm-extend-enc-at-2-    (forall ((z strd))-      (implies (p "tpm-extend-enc" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_tpm-extend-enc-at-1-    (forall ((z strd))-      (implies (p "tpm-extend-enc" z (idx 3)) (trans z (idx 1))))))--(defskeleton envelope-plus-2-  (vars (v n data) (pcr-id text) (k aik akey) (tpm chan))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id) (k k) (aik aik)-    (tpm tpm))-  (non-orig aik)-  (uniq-orig v n)-  (conf tpm)-  (traces ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id n))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k))))-  (label 60)-  (unrealized (0 0) (1 2))-  (preskeleton)-  (origs (v (1 3)) (n (1 0)))-  (comment "Not a skeleton"))--(defskeleton envelope-plus-2-  (vars (v n data) (pcr-id text) (k aik akey) (tpm chan))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id) (k k) (aik aik)-    (tpm tpm))-  (precedes ((1 3) (0 0)))-  (non-orig aik)-  (uniq-orig v n)-  (conf tpm)-  (traces ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id n))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k))))-  (label 61)-  (parent 60)-  (unrealized (1 2))-  (origs (v (1 3)) (n (1 0)))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-plus-2-  (vars (v n data) (pcr-id text) (k aik akey) (tpm tpm-0 chan))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id) (k k) (aik aik) (tpm tpm-0))-  (precedes ((1 3) (0 0)) ((2 1) (1 2)))-  (non-orig aik (invk k))-  (uniq-orig v n k)-  (conf tpm)-  (auth tpm-0)-  (operation encryption-test (added-strand tpm-create-key 2)-    (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik) (1 2))-  (strand-map 0 1)-  (traces ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id n))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm-0 (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (send (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))))-  (label 62)-  (parent 61)-  (unrealized (0 0) (2 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-plus-2-  (vars (v n data) (pcr-id text) (k aik akey) (tpm chan))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id) (k k) (aik aik) (tpm tpm))-  (precedes ((1 1) (2 0)) ((1 3) (0 0)) ((2 1) (1 2)))-  (non-orig aik (invk k))-  (uniq-orig v n k)-  (conf tpm)-  (auth tpm)-  (operation channel-test (displaced 3 1 alice 2)-    (ch-msg tpm-0-      (cat "create-req" pcr-id (hash (hash "0" n) "obtain"))) (2 0))-  (strand-map 0 1 2)-  (traces ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id n))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (send (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))))-  (label 63)-  (parent 62)-  (unrealized (0 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-plus-2-  (vars (current-value mesg) (v n data) (pcr-id pcr-id-0 text)-    (k aik aik-0 akey) (pt pval) (tpm tpm-0 chan) (pcr locn))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v) (current-value current-value)-    (pcr-id pcr-id-0) (k k) (aik aik-0) (tpm tpm-0) (pcr pcr))-  (precedes ((1 1) (2 0)) ((1 3) (3 0)) ((2 1) (1 2)) ((3 3) (0 0)))-  (non-orig aik aik-0 (invk k))-  (uniq-orig v n k)-  (conf tpm)-  (auth tpm)-  (operation nonce-test (added-strand tpm-decrypt 4) v (0 0) (enc v k))-  (strand-map 0 1 2)-  (traces ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id n))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (send (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-0 current-value aik-0))-      (load pcr (cat pt current-value)) (send v)))-  (label 64)-  (parent 63)-  (unrealized (3 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-plus-2-  (vars (v n data) (pcr-id text) (k aik akey) (pt pval) (tpm tpm-0 chan)-    (pcr locn))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id) (k k)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (precedes ((1 1) (2 0)) ((1 3) (3 0)) ((2 1) (1 2)) ((3 3) (0 0)))-  (non-orig aik (invk k))-  (uniq-orig v n k)-  (gen-st (hash (hash "0" n) "obtain"))-  (conf tpm)-  (auth tpm)-  -  (operation encryption-test (displaced 4 2 tpm-create-key 2)-    (enc "created" k pcr-id-0 current-value aik-0) (3 1))-  (strand-map 0 1 2 3)-  (traces ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id n))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (send (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v)))-  (label 65)-  (parent 64)-  (unrealized (3 2))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-plus-2-  (vars (v n data) (pcr-id pcr-id-0 text) (k aik akey) (pt pt-0 pval)-    (tpm tpm-0 tpm-1 chan) (pcr locn))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id) (k k)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 3 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-0) (tpm tpm-1)-    (pcr pcr))-  (precedes ((1 1) (2 0)) ((1 3) (3 0)) ((2 1) (1 2)) ((3 3) (0 0))-    ((4 2) (3 2)))-  (non-orig aik (invk k))-  (uniq-orig v n k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain"))-  (conf tpm)-  (auth tpm)-  (leads-to ((4 2) (3 2)))-  -  (operation channel-test (added-strand tpm-extend-enc 3)-    (ch-msg pcr (cat pt (hash (hash "0" n) "obtain"))) (3 2))-  (strand-map 0 1 2 3)-  (traces ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id n))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (send (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((recv tpm-1 (cat "extend" pcr-id-0 "obtain"))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain")))))-  (label 66)-  (parent 65)-  (unrealized (4 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-plus-2-  (vars (v n data) (pcr-id pcr-id-0 pcr-id-1 text) (k aik akey)-    (pt pt-0 pt-1 pval) (tpm tpm-0 tpm-1 tpm-2 chan) (pcr locn))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id) (k k)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 3 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-0) (tpm tpm-1)-    (pcr pcr))-  (defstrand tpm-extend-enc 3 (value n) (current-value "0")-    (pcr-id pcr-id-1) (tpm tpm-2) (pcr pcr))-  (precedes ((1 0) (5 0)) ((1 1) (2 0)) ((1 3) (3 0)) ((2 1) (1 2))-    ((3 3) (0 0)) ((4 2) (3 2)) ((5 2) (4 1)))-  (non-orig aik (invk k))-  (uniq-orig v n k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain"))-  (conf tpm)-  (auth tpm)-  (leads-to ((4 2) (3 2)) ((5 2) (4 1)))-  -  (operation channel-test (added-strand tpm-extend-enc 3)-    (ch-msg pcr (cat pt-0 (hash "0" n))) (4 1))-  (strand-map 0 1 2 3 4)-  (traces ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id n))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (send (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((recv tpm-1 (cat "extend" pcr-id-0 "obtain"))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain"))))-    ((recv tpm-2 (cat "extend" pcr-id-1 n)) (load pcr (cat pt-1 "0"))-      (stor pcr (cat pt-0 (hash "0" n)))))-  (label 67)-  (parent 66)-  (unrealized (5 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-plus-2-  (vars (v n data) (pcr-id pcr-id-0 text) (k aik akey)-    (pt pt-0 pt-1 pval) (tpm tpm-0 tpm-1 chan) (pcr locn))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id) (k k)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 3 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-0) (tpm tpm-1)-    (pcr pcr))-  (defstrand tpm-extend-enc 3 (value n) (current-value "0")-    (pcr-id pcr-id) (tpm tpm) (pcr pcr))-  (precedes ((1 0) (5 0)) ((1 1) (2 0)) ((1 3) (3 0)) ((2 1) (1 2))-    ((3 3) (0 0)) ((4 2) (3 2)) ((5 2) (4 1)))-  (non-orig aik (invk k))-  (uniq-orig v n k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain"))-  (conf tpm)-  (auth tpm)-  (leads-to ((4 2) (3 2)) ((5 2) (4 1)))-  -  (operation nonce-test (contracted (pcr-id-1 pcr-id) (tpm-2 tpm)) n-    (5 0) (ch-msg tpm (cat "extend" pcr-id n)))-  (strand-map 0 1 2 3 4 5)-  (traces ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id n))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (send (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((recv tpm-1 (cat "extend" pcr-id-0 "obtain"))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain"))))-    ((recv tpm (cat "extend" pcr-id n)) (load pcr (cat pt-1 "0"))-      (stor pcr (cat pt-0 (hash "0" n)))))-  (label 68)-  (parent 67)-  (realized)-  (shape)-  (maps ((0 1) ((v v) (n n) (pcr-id pcr-id) (k k) (aik aik) (tpm tpm))))-  (origs (pt-0 (5 2)) (pt (4 2)) (k (2 1)) (n (1 0)) (v (1 3))))--(comment "Nothing left to do")--(defprotocol envelope-plus-2 basic-  (defrole tpm-power-on-    (vars (current-value mesg) (pcr locn) (tpm chan))-    (trace (recv tpm "power on") (load pcr current-value)-      (stor pcr "0")))-  (defrole tpm-extend-enc-    (vars (value current-value mesg) (pcr-id text) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "extend" pcr-id value))-      (load pcr current-value) (stor pcr (hash current-value value))-      (send "ext ok")))-  (defrole tpm-quote-    (vars (nonce current-value mesg) (pcr-id text) (aik akey) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "quote" pcr-id nonce))-      (load pcr current-value)-      (send (enc "quote" pcr-id current-value nonce aik))))-  (defrole tpm-create-key-    (vars (k aik akey) (pcr-id text) (pcrval mesg) (tpm chan))-    (trace (recv tpm (cat "create-req" pcr-id pcrval))-      (send (enc "created" k pcr-id pcrval aik)))-    (non-orig (invk k))-    (uniq-orig k)-    (auth tpm))-  (defrole tpm-decrypt-    (vars (m current-value mesg) (pcr-id text) (k aik akey) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "decrypt" (enc m k)))-      (recv (enc "created" k pcr-id current-value aik))-      (load pcr current-value) (send m))-    (non-orig aik))-  (defrole alice-    (vars (n v data) (pcr-id text) (k aik akey) (tpm chan))-    (trace (send tpm (cat "extend" pcr-id n))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    (non-orig aik)-    (uniq-orig n v)-    (conf tpm)-    (neq (k aik)))-  (defrule genStV-if-hashed-tpm-power-on-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-power-on" z (idx 2))-          (p "tpm-power-on" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-extend-enc-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-extend-enc" z (idx 2))-          (p "tpm-extend-enc" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-decrypt-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-decrypt" z (idx 3))-          (p "tpm-decrypt" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-quote-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-quote" z (idx 2))-          (p "tpm-quote" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule pcr-id-identifies-pcr-    (forall ((y z strd) (pcr-id text) (pcr pcr-0 locn))-      (implies-        (and (p "tpm-extend-enc" y (idx 3))-          (p "tpm-extend-enc" z (idx 3))-          (p "tpm-extend-enc" "pcr-id" y pcr-id)-          (p "tpm-extend-enc" "pcr-id" z pcr-id)-          (p "tpm-extend-enc" "pcr" y pcr)-          (p "tpm-extend-enc" "pcr" z pcr-0))-        (= pcr pcr-0))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule shearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule invShearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule trRl_tpm-power-on-at-2-    (forall ((z strd))-      (implies (p "tpm-power-on" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_tpm-power-on-at-1-    (forall ((z strd))-      (implies (p "tpm-power-on" z (idx 3)) (trans z (idx 1)))))-  (defgenrule trRl_tpm-extend-enc-at-2-    (forall ((z strd))-      (implies (p "tpm-extend-enc" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_tpm-extend-enc-at-1-    (forall ((z strd))-      (implies (p "tpm-extend-enc" z (idx 3)) (trans z (idx 1))))))--(defskeleton envelope-plus-2-  (vars (n v data) (pcr-id pcr-id-0 text) (k aik akey) (tpm chan))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (non-orig aik)-  (uniq-orig n v)-  (conf tpm)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k))))-  (label 69)-  (unrealized (0 0) (1 2))-  (preskeleton)-  (origs (v (1 3)) (n (1 0)))-  (comment "Not a skeleton"))--(defskeleton envelope-plus-2-  (vars (n v data) (pcr-id pcr-id-0 text) (k aik akey) (tpm chan))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (precedes ((1 3) (0 0)))-  (non-orig aik)-  (uniq-orig n v)-  (conf tpm)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k))))-  (label 70)-  (parent 69)-  (unrealized (0 0) (1 2))-  (origs (v (1 3)) (n (1 0)))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-plus-2-  (vars (n v data) (pcr-id pcr-id-0 text) (k aik akey) (tpm tpm-0 chan))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm-0))-  (precedes ((1 3) (0 0)) ((2 1) (1 2)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (conf tpm)-  (auth tpm-0)-  (operation encryption-test (added-strand tpm-create-key 2)-    (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik) (1 2))-  (strand-map 0 1)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm-0-       (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))))-  (label 71)-  (parent 70)-  (unrealized (0 0) (2 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-plus-2-  (vars (n v data) (pcr-id pcr-id-0 text) (k aik akey) (tpm chan))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (precedes ((1 1) (2 0)) ((1 3) (0 0)) ((2 1) (1 2)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (conf tpm)-  (auth tpm)-  (operation channel-test (displaced 3 1 alice 2)-    (ch-msg tpm-0-      (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain"))) (2 0))-  (strand-map 0 1 2)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))))-  (label 72)-  (parent 71)-  (unrealized (0 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-plus-2-  (vars (n v data) (pcr-id pcr-id-0 text) (k aik akey) (pt pval)-    (tpm tpm-0 chan) (pcr locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-quote 3 (nonce (enc v k))-    (current-value (hash (hash "0" n) "refuse")) (pcr-id pcr-id)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (precedes ((1 1) (2 0)) ((1 3) (3 0)) ((2 1) (1 2)) ((3 2) (0 0)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (gen-st (hash (hash "0" n) "refuse"))-  (conf tpm)-  (auth tpm)-  -  (operation encryption-test (added-strand tpm-quote 3)-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik)-    (0 0))-  (strand-map 0 1 2)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "quote" pcr-id (enc v k)))-      (load pcr (cat pt (hash (hash "0" n) "refuse")))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))))-  (label 73)-  (parent 72)-  (unrealized (3 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-plus-2-  (vars (n v data) (pcr-id pcr-id-0 pcr-id-1 text) (k aik akey)-    (pt pt-0 pval) (tpm tpm-0 tpm-1 chan) (pcr locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-quote 3 (nonce (enc v k))-    (current-value (hash (hash "0" n) "refuse")) (pcr-id pcr-id)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 3 (value "refuse")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (tpm tpm-1)-    (pcr pcr))-  (precedes ((1 1) (2 0)) ((1 3) (3 0)) ((2 1) (1 2)) ((3 2) (0 0))-    ((4 2) (3 1)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (gen-st (hash "0" n) (hash (hash "0" n) "refuse"))-  (conf tpm)-  (auth tpm)-  (leads-to ((4 2) (3 1)))-  -  (operation channel-test (added-strand tpm-extend-enc 3)-    (ch-msg pcr (cat pt (hash (hash "0" n) "refuse"))) (3 1))-  (strand-map 0 1 2 3)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "quote" pcr-id (enc v k)))-      (load pcr (cat pt (hash (hash "0" n) "refuse")))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((recv tpm-1 (cat "extend" pcr-id-1 "refuse"))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "refuse")))))-  (label 74)-  (parent 73)-  (unrealized (4 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-plus-2-  (vars (n v data) (pcr-id pcr-id-0 pcr-id-1 pcr-id-2 text) (k aik akey)-    (pt pt-0 pt-1 pval) (tpm tpm-0 tpm-1 tpm-2 chan) (pcr locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-quote 3 (nonce (enc v k))-    (current-value (hash (hash "0" n) "refuse")) (pcr-id pcr-id)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 3 (value "refuse")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (tpm tpm-1)-    (pcr pcr))-  (defstrand tpm-extend-enc 3 (value n) (current-value "0")-    (pcr-id pcr-id-2) (tpm tpm-2) (pcr pcr))-  (precedes ((1 0) (5 0)) ((1 1) (2 0)) ((1 3) (3 0)) ((2 1) (1 2))-    ((3 2) (0 0)) ((4 2) (3 1)) ((5 2) (4 1)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (gen-st (hash "0" n) (hash (hash "0" n) "refuse"))-  (conf tpm)-  (auth tpm)-  (leads-to ((4 2) (3 1)) ((5 2) (4 1)))-  -  (operation channel-test (added-strand tpm-extend-enc 3)-    (ch-msg pcr (cat pt-0 (hash "0" n))) (4 1))-  (strand-map 0 1 2 3 4)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "quote" pcr-id (enc v k)))-      (load pcr (cat pt (hash (hash "0" n) "refuse")))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((recv tpm-1 (cat "extend" pcr-id-1 "refuse"))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "refuse"))))-    ((recv tpm-2 (cat "extend" pcr-id-2 n)) (load pcr (cat pt-1 "0"))-      (stor pcr (cat pt-0 (hash "0" n)))))-  (label 75)-  (parent 74)-  (unrealized (5 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-plus-2-  (vars (n v data) (pcr-id pcr-id-0 pcr-id-1 text) (k aik akey)-    (pt pt-0 pt-1 pval) (tpm tpm-0 tpm-1 chan) (pcr locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-quote 3 (nonce (enc v k))-    (current-value (hash (hash "0" n) "refuse")) (pcr-id pcr-id)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 3 (value "refuse")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (tpm tpm-1)-    (pcr pcr))-  (defstrand tpm-extend-enc 3 (value n) (current-value "0")-    (pcr-id pcr-id-0) (tpm tpm) (pcr pcr))-  (precedes ((1 0) (5 0)) ((1 1) (2 0)) ((1 3) (3 0)) ((2 1) (1 2))-    ((3 2) (0 0)) ((4 2) (3 1)) ((5 2) (4 1)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (gen-st (hash "0" n) (hash (hash "0" n) "refuse"))-  (conf tpm)-  (auth tpm)-  (leads-to ((4 2) (3 1)) ((5 2) (4 1)))-  -  (operation nonce-test (contracted (pcr-id-2 pcr-id-0) (tpm-2 tpm)) n-    (5 0) (ch-msg tpm (cat "extend" pcr-id-0 n)))-  (strand-map 0 1 2 3 4 5)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "quote" pcr-id (enc v k)))-      (load pcr (cat pt (hash (hash "0" n) "refuse")))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((recv tpm-1 (cat "extend" pcr-id-1 "refuse"))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "refuse"))))-    ((recv tpm (cat "extend" pcr-id-0 n)) (load pcr (cat pt-1 "0"))-      (stor pcr (cat pt-0 (hash "0" n)))))-  (label 76)-  (parent 75)-  (realized)-  (shape)-  (maps-    ((0 1)-      ((n n) (v v) (k k) (aik aik) (pcr-id pcr-id) (pcr-id-0 pcr-id-0)-        (tpm tpm))))-  (origs (pt-0 (5 2)) (pt (4 2)) (n (1 0)) (k (2 1)) (v (1 3))))--(comment "Nothing left to do")--(defprotocol envelope-plus-2 basic-  (defrole tpm-power-on-    (vars (current-value mesg) (pcr locn) (tpm chan))-    (trace (recv tpm "power on") (load pcr current-value)-      (stor pcr "0")))-  (defrole tpm-extend-enc-    (vars (value current-value mesg) (pcr-id text) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "extend" pcr-id value))-      (load pcr current-value) (stor pcr (hash current-value value))-      (send "ext ok")))-  (defrole tpm-quote-    (vars (nonce current-value mesg) (pcr-id text) (aik akey) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "quote" pcr-id nonce))-      (load pcr current-value)-      (send (enc "quote" pcr-id current-value nonce aik))))-  (defrole tpm-create-key-    (vars (k aik akey) (pcr-id text) (pcrval mesg) (tpm chan))-    (trace (recv tpm (cat "create-req" pcr-id pcrval))-      (send (enc "created" k pcr-id pcrval aik)))-    (non-orig (invk k))-    (uniq-orig k)-    (auth tpm))-  (defrole tpm-decrypt-    (vars (m current-value mesg) (pcr-id text) (k aik akey) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "decrypt" (enc m k)))-      (recv (enc "created" k pcr-id current-value aik))-      (load pcr current-value) (send m))-    (non-orig aik))-  (defrole alice-    (vars (n v data) (pcr-id text) (k aik akey) (tpm chan))-    (trace (send tpm (cat "extend" pcr-id n))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    (non-orig aik)-    (uniq-orig n v)-    (conf tpm)-    (neq (k aik)))-  (defrule genStV-if-hashed-tpm-power-on-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-power-on" z (idx 2))-          (p "tpm-power-on" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-extend-enc-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-extend-enc" z (idx 2))-          (p "tpm-extend-enc" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-decrypt-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-decrypt" z (idx 3))-          (p "tpm-decrypt" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-quote-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-quote" z (idx 2))-          (p "tpm-quote" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule pcr-id-identifies-pcr-    (forall ((y z strd) (pcr-id text) (pcr pcr-0 locn))-      (implies-        (and (p "tpm-extend-enc" y (idx 3))-          (p "tpm-extend-enc" z (idx 3))-          (p "tpm-extend-enc" "pcr-id" y pcr-id)-          (p "tpm-extend-enc" "pcr-id" z pcr-id)-          (p "tpm-extend-enc" "pcr" y pcr)-          (p "tpm-extend-enc" "pcr" z pcr-0))-        (= pcr pcr-0))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule shearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule invShearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule trRl_tpm-power-on-at-2-    (forall ((z strd))-      (implies (p "tpm-power-on" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_tpm-power-on-at-1-    (forall ((z strd))-      (implies (p "tpm-power-on" z (idx 3)) (trans z (idx 1)))))-  (defgenrule trRl_tpm-extend-enc-at-2-    (forall ((z strd))-      (implies (p "tpm-extend-enc" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_tpm-extend-enc-at-1-    (forall ((z strd))-      (implies (p "tpm-extend-enc" z (idx 3)) (trans z (idx 1))))))--(defskeleton envelope-plus-2-  (vars (n v data) (pcr-id pcr-id-0 text) (k aik akey) (tpm chan))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (non-orig aik)-  (uniq-orig n v)-  (conf tpm)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k))))-  (label 77)-  (unrealized (0 0) (1 0) (2 2))-  (preskeleton)-  (origs (v (2 3)) (n (2 0)))-  (comment "Not a skeleton"))--(defskeleton envelope-plus-2-  (vars (n v data) (pcr-id pcr-id-0 text) (k aik akey) (tpm chan))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (precedes ((2 3) (0 0)) ((2 3) (1 0)))-  (non-orig aik)-  (uniq-orig n v)-  (conf tpm)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k))))-  (label 78)-  (parent 77)-  (unrealized (0 0) (2 2))-  (origs (v (2 3)) (n (2 0)))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-plus-2-  (vars (n v data) (pcr-id pcr-id-0 text) (k aik akey) (tpm tpm-0 chan))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm-0))-  (precedes ((2 3) (0 0)) ((2 3) (1 0)) ((3 1) (2 2)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (conf tpm)-  (auth tpm-0)-  (operation encryption-test (added-strand tpm-create-key 2)-    (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik) (2 2))-  (strand-map 0 1 2)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm-0-       (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))))-  (label 79)-  (parent 78)-  (unrealized (0 0) (1 0) (3 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-plus-2-  (vars (n v data) (pcr-id pcr-id-0 text) (k aik akey) (tpm chan))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (precedes ((2 1) (3 0)) ((2 3) (0 0)) ((2 3) (1 0)) ((3 1) (2 2)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (conf tpm)-  (auth tpm)-  (operation channel-test (displaced 4 2 alice 2)-    (ch-msg tpm-0-      (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain"))) (3 0))-  (strand-map 0 1 2 3)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))))-  (label 80)-  (parent 79)-  (unrealized (0 0) (1 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-plus-2-  (vars (current-value mesg) (n v data) (pcr-id pcr-id-0 pcr-id-1 text)-    (k aik aik-0 akey) (pt pval) (tpm tpm-0 chan) (pcr locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v) (current-value current-value)-    (pcr-id pcr-id-1) (k k) (aik aik-0) (tpm tpm-0) (pcr pcr))-  (precedes ((2 1) (3 0)) ((2 3) (0 0)) ((2 3) (4 0)) ((3 1) (2 2))-    ((4 3) (1 0)))-  (non-orig aik aik-0 (invk k))-  (uniq-orig n v k)-  (conf tpm)-  (auth tpm)-  (operation nonce-test (added-strand tpm-decrypt 4) v (1 0) (enc v k))-  (strand-map 0 1 2 3)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-1 current-value aik-0))-      (load pcr (cat pt current-value)) (send v)))-  (label 81)-  (parent 80)-  (unrealized (0 0) (4 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-plus-2-  (vars (n v data) (pcr-id pcr-id-0 text) (k aik akey) (pt pval)-    (tpm tpm-0 chan) (pcr locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id-0) (k k)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (precedes ((2 1) (3 0)) ((2 3) (0 0)) ((2 3) (4 0)) ((3 1) (2 2))-    ((4 3) (1 0)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (gen-st (hash (hash "0" n) "obtain"))-  (conf tpm)-  (auth tpm)-  -  (operation encryption-test (displaced 5 3 tpm-create-key 2)-    (enc "created" k pcr-id-1 current-value aik-0) (4 1))-  (strand-map 0 1 2 3 4)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v)))-  (label 82)-  (parent 81)-  (unrealized (0 0) (4 2))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-plus-2-  (vars (n v data) (pcr-id pcr-id-0 pcr-id-1 text) (k aik akey)-    (pt pt-0 pval) (tpm tpm-0 tpm-1 chan) (pcr locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id-0) (k k)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 3 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (tpm tpm-1)-    (pcr pcr))-  (precedes ((2 1) (3 0)) ((2 3) (0 0)) ((2 3) (4 0)) ((3 1) (2 2))-    ((4 3) (1 0)) ((5 2) (4 2)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain"))-  (conf tpm)-  (auth tpm)-  (leads-to ((5 2) (4 2)))-  -  (operation channel-test (added-strand tpm-extend-enc 3)-    (ch-msg pcr (cat pt (hash (hash "0" n) "obtain"))) (4 2))-  (strand-map 0 1 2 3 4)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((recv tpm-1 (cat "extend" pcr-id-1 "obtain"))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain")))))-  (label 83)-  (parent 82)-  (unrealized (0 0) (5 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-plus-2-  (vars (n v data) (pcr-id pcr-id-0 pcr-id-1 pcr-id-2 text) (k aik akey)-    (pt pt-0 pt-1 pval) (tpm tpm-0 tpm-1 tpm-2 chan) (pcr locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id-0) (k k)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 3 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (tpm tpm-1)-    (pcr pcr))-  (defstrand tpm-extend-enc 3 (value n) (current-value "0")-    (pcr-id pcr-id-2) (tpm tpm-2) (pcr pcr))-  (precedes ((2 0) (6 0)) ((2 1) (3 0)) ((2 3) (0 0)) ((2 3) (4 0))-    ((3 1) (2 2)) ((4 3) (1 0)) ((5 2) (4 2)) ((6 2) (5 1)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain"))-  (conf tpm)-  (auth tpm)-  (leads-to ((5 2) (4 2)) ((6 2) (5 1)))-  -  (operation channel-test (added-strand tpm-extend-enc 3)-    (ch-msg pcr (cat pt-0 (hash "0" n))) (5 1))-  (strand-map 0 1 2 3 4 5)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((recv tpm-1 (cat "extend" pcr-id-1 "obtain"))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain"))))-    ((recv tpm-2 (cat "extend" pcr-id-2 n)) (load pcr (cat pt-1 "0"))-      (stor pcr (cat pt-0 (hash "0" n)))))-  (label 84)-  (parent 83)-  (unrealized (0 0) (6 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-plus-2-  (vars (n v data) (pcr-id pcr-id-0 pcr-id-1 text) (k aik akey)-    (pt pt-0 pt-1 pval) (tpm tpm-0 tpm-1 chan) (pcr locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id-0) (k k)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 3 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (tpm tpm-1)-    (pcr pcr))-  (defstrand tpm-extend-enc 3 (value n) (current-value "0")-    (pcr-id pcr-id-0) (tpm tpm) (pcr pcr))-  (precedes ((2 0) (6 0)) ((2 1) (3 0)) ((2 3) (0 0)) ((2 3) (4 0))-    ((3 1) (2 2)) ((4 3) (1 0)) ((5 2) (4 2)) ((6 2) (5 1)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain"))-  (conf tpm)-  (auth tpm)-  (leads-to ((5 2) (4 2)) ((6 2) (5 1)))-  -  (operation nonce-test (contracted (pcr-id-2 pcr-id-0) (tpm-2 tpm)) n-    (6 0) (ch-msg tpm (cat "extend" pcr-id-0 n)))-  (strand-map 0 1 2 3 4 5 6)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((recv tpm-1 (cat "extend" pcr-id-1 "obtain"))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain"))))-    ((recv tpm (cat "extend" pcr-id-0 n)) (load pcr (cat pt-1 "0"))-      (stor pcr (cat pt-0 (hash "0" n)))))-  (label 85)-  (parent 84)-  (unrealized (0 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-plus-2-  (vars (n v data) (pcr-id pcr-id-0 pcr-id-1 text) (k aik akey)-    (pt pt-0 pt-1 pt-2 pval) (tpm tpm-0 tpm-1 tpm-2 chan)-    (pcr pcr-0 locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id-0) (k k)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 3 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (tpm tpm-1)-    (pcr pcr))-  (defstrand tpm-extend-enc 3 (value n) (current-value "0")-    (pcr-id pcr-id-0) (tpm tpm) (pcr pcr))-  (defstrand tpm-quote 3 (nonce (enc v k))-    (current-value (hash (hash "0" n) "refuse")) (pcr-id pcr-id)-    (aik aik) (tpm tpm-2) (pcr pcr-0))-  (precedes ((2 0) (6 0)) ((2 1) (3 0)) ((2 3) (4 0)) ((2 3) (7 0))-    ((3 1) (2 2)) ((4 3) (1 0)) ((5 2) (4 2)) ((6 2) (5 1))-    ((7 2) (0 0)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain")-    (hash (hash "0" n) "refuse"))-  (conf tpm)-  (auth tpm)-  (leads-to ((5 2) (4 2)) ((6 2) (5 1)))-  -  (operation encryption-test (added-strand tpm-quote 3)-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik)-    (0 0))-  (strand-map 0 1 2 3 4 5 6)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((recv tpm-1 (cat "extend" pcr-id-1 "obtain"))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain"))))-    ((recv tpm (cat "extend" pcr-id-0 n)) (load pcr (cat pt-1 "0"))-      (stor pcr (cat pt-0 (hash "0" n))))-    ((recv tpm-2 (cat "quote" pcr-id (enc v k)))-      (load pcr-0 (cat pt-2 (hash (hash "0" n) "refuse")))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))))-  (label 86)-  (parent 85)-  (unrealized (7 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-plus-2-  (vars (n v data) (pcr-id pcr-id-0 pcr-id-1 pcr-id-2 text) (k aik akey)-    (pt pt-0 pt-1 pt-2 pt-3 pval) (tpm tpm-0 tpm-1 tpm-2 tpm-3 chan)-    (pcr pcr-0 locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id-0) (k k)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 3 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (tpm tpm-1)-    (pcr pcr))-  (defstrand tpm-extend-enc 3 (value n) (current-value "0")-    (pcr-id pcr-id-0) (tpm tpm) (pcr pcr))-  (defstrand tpm-quote 3 (nonce (enc v k))-    (current-value (hash (hash "0" n) "refuse")) (pcr-id pcr-id)-    (aik aik) (tpm tpm-2) (pcr pcr-0))-  (defstrand tpm-extend-enc 3 (value "refuse")-    (current-value (hash "0" n)) (pcr-id pcr-id-2) (tpm tpm-3)-    (pcr pcr-0))-  (precedes ((2 0) (6 0)) ((2 1) (3 0)) ((2 3) (4 0)) ((2 3) (7 0))-    ((3 1) (2 2)) ((4 3) (1 0)) ((5 2) (4 2)) ((6 2) (5 1))-    ((7 2) (0 0)) ((8 2) (7 1)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain")-    (hash (hash "0" n) "refuse"))-  (conf tpm)-  (auth tpm)-  (leads-to ((5 2) (4 2)) ((6 2) (5 1)) ((8 2) (7 1)))-  -  (operation channel-test (added-strand tpm-extend-enc 3)-    (ch-msg pcr-0 (cat pt-2 (hash (hash "0" n) "refuse"))) (7 1))-  (strand-map 0 1 2 3 4 5 6 7)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((recv tpm-1 (cat "extend" pcr-id-1 "obtain"))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain"))))-    ((recv tpm (cat "extend" pcr-id-0 n)) (load pcr (cat pt-1 "0"))-      (stor pcr (cat pt-0 (hash "0" n))))-    ((recv tpm-2 (cat "quote" pcr-id (enc v k)))-      (load pcr-0 (cat pt-2 (hash (hash "0" n) "refuse")))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((recv tpm-3 (cat "extend" pcr-id-2 "refuse"))-      (load pcr-0 (cat pt-3 (hash "0" n)))-      (stor pcr-0 (cat pt-2 (hash (hash "0" n) "refuse")))))-  (label 87)-  (parent 86)-  (unrealized (8 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-plus-2-  (vars (n v data) (pcr-id pcr-id-0 pcr-id-1 pcr-id-2 pcr-id-3 text)-    (k aik akey) (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval)-    (tpm tpm-0 tpm-1 tpm-2 tpm-3 tpm-4 chan) (pcr pcr-0 locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id-0) (k k)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 3 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (tpm tpm-1)-    (pcr pcr))-  (defstrand tpm-extend-enc 3 (value n) (current-value "0")-    (pcr-id pcr-id-0) (tpm tpm) (pcr pcr))-  (defstrand tpm-quote 3 (nonce (enc v k))-    (current-value (hash (hash "0" n) "refuse")) (pcr-id pcr-id)-    (aik aik) (tpm tpm-2) (pcr pcr-0))-  (defstrand tpm-extend-enc 3 (value "refuse")-    (current-value (hash "0" n)) (pcr-id pcr-id-2) (tpm tpm-3)-    (pcr pcr-0))-  (defstrand tpm-extend-enc 3 (value n) (current-value "0")-    (pcr-id pcr-id-3) (tpm tpm-4) (pcr pcr-0))-  (precedes ((2 0) (6 0)) ((2 0) (9 0)) ((2 1) (3 0)) ((2 3) (4 0))-    ((2 3) (7 0)) ((3 1) (2 2)) ((4 3) (1 0)) ((5 2) (4 2))-    ((6 2) (5 1)) ((7 2) (0 0)) ((8 2) (7 1)) ((9 2) (8 1)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain")-    (hash (hash "0" n) "refuse"))-  (conf tpm)-  (auth tpm)-  (leads-to ((5 2) (4 2)) ((6 2) (5 1)) ((8 2) (7 1)) ((9 2) (8 1)))-  -  (operation channel-test (added-strand tpm-extend-enc 3)-    (ch-msg pcr-0 (cat pt-3 (hash "0" n))) (8 1))-  (strand-map 0 1 2 3 4 5 6 7 8)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((recv tpm-1 (cat "extend" pcr-id-1 "obtain"))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain"))))-    ((recv tpm (cat "extend" pcr-id-0 n)) (load pcr (cat pt-1 "0"))-      (stor pcr (cat pt-0 (hash "0" n))))-    ((recv tpm-2 (cat "quote" pcr-id (enc v k)))-      (load pcr-0 (cat pt-2 (hash (hash "0" n) "refuse")))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((recv tpm-3 (cat "extend" pcr-id-2 "refuse"))-      (load pcr-0 (cat pt-3 (hash "0" n)))-      (stor pcr-0 (cat pt-2 (hash (hash "0" n) "refuse"))))-    ((recv tpm-4 (cat "extend" pcr-id-3 n)) (load pcr-0 (cat pt-4 "0"))-      (stor pcr-0 (cat pt-3 (hash "0" n)))))-  (label 88)-  (parent 87)-  (unrealized (9 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-plus-2-  (vars (n v data) (pcr-id pcr-id-0 pcr-id-1 pcr-id-2 text) (k aik akey)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval)-    (tpm tpm-0 tpm-1 tpm-2 tpm-3 chan) (pcr locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id-0) (k k)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 3 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (tpm tpm-1)-    (pcr pcr))-  (defstrand tpm-extend-enc 3 (value n) (current-value "0")-    (pcr-id pcr-id-0) (tpm tpm) (pcr pcr))-  (defstrand tpm-quote 3 (nonce (enc v k))-    (current-value (hash (hash "0" n) "refuse")) (pcr-id pcr-id)-    (aik aik) (tpm tpm-2) (pcr pcr))-  (defstrand tpm-extend-enc 3 (value "refuse")-    (current-value (hash "0" n)) (pcr-id pcr-id-2) (tpm tpm-3)-    (pcr pcr))-  (defstrand tpm-extend-enc 3 (value n) (current-value "0")-    (pcr-id pcr-id-0) (tpm tpm) (pcr pcr))-  (precedes ((2 0) (6 0)) ((2 0) (9 0)) ((2 1) (3 0)) ((2 3) (4 0))-    ((2 3) (7 0)) ((3 1) (2 2)) ((4 3) (1 0)) ((5 2) (4 2))-    ((6 2) (5 1)) ((7 2) (0 0)) ((8 2) (7 1)) ((9 2) (8 1)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain")-    (hash (hash "0" n) "refuse"))-  (conf tpm)-  (auth tpm)-  (leads-to ((5 2) (4 2)) ((6 2) (5 1)) ((8 2) (7 1)) ((9 2) (8 1)))-  -  (operation nonce-test-    (contracted (pcr-0 pcr) (pcr-id-3 pcr-id-0) (tpm-4 tpm)) n (9 0)-    (ch-msg tpm (cat "extend" pcr-id-0 n)))-  (strand-map 0 1 2 3 4 5 6 7 8 9)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((recv tpm-1 (cat "extend" pcr-id-1 "obtain"))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain"))))-    ((recv tpm (cat "extend" pcr-id-0 n)) (load pcr (cat pt-1 "0"))-      (stor pcr (cat pt-0 (hash "0" n))))-    ((recv tpm-2 (cat "quote" pcr-id (enc v k)))-      (load pcr (cat pt-2 (hash (hash "0" n) "refuse")))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((recv tpm-3 (cat "extend" pcr-id-2 "refuse"))-      (load pcr (cat pt-3 (hash "0" n)))-      (stor pcr (cat pt-2 (hash (hash "0" n) "refuse"))))-    ((recv tpm (cat "extend" pcr-id-0 n)) (load pcr (cat pt-4 "0"))-      (stor pcr (cat pt-3 (hash "0" n)))))-  (label 89)-  (parent 88)-  (realized)-  (shape)-  (maps-    ((0 1 2)-      ((n n) (v v) (k k) (aik aik) (pcr-id pcr-id) (pcr-id-0 pcr-id-0)-        (tpm tpm))))-  (origs (pt-3 (9 2)) (pt-2 (8 2)) (pt-0 (6 2)) (pt (5 2)) (k (3 1))-    (n (2 0)) (v (2 3))))--(comment "Nothing left to do")
− tst/defact-locn_envelope_shapes.tst 
@@ -1,1919 +0,0 @@-(comment "CPSA 4.4.5")-(comment "Extracted shapes")--(herald "Envelope Protocol, location-based version" (bound 30)-  (limit 1200))--(comment "CPSA 4.4.5")--(comment "All input read from tst/locn_envelope.scm")--(comment "Step count limited to 1200")--(comment "Strand count bounded at 30")--(defprotocol envelope basic-  (defrole tpm-power-on-    (vars (current-value mesg) (pcr locn) (tpm chan))-    (trace (recv tpm "power on") (load pcr current-value)-      (stor pcr "0")))-  (defrole tpm-extend-enc-    (vars (value current-value mesg) (pcr-id text) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "extend" pcr-id value))-      (load pcr current-value) (stor pcr (hash current-value value))-      (send "ext ok")))-  (defrole tpm-quote-    (vars (nonce current-value mesg) (pcr-id text) (aik akey) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "quote" pcr-id nonce))-      (load pcr current-value)-      (send (enc "quote" pcr-id current-value nonce aik))))-  (defrole tpm-create-key-    (vars (k aik akey) (pcr-id text) (pcrval mesg) (tpm chan))-    (trace (recv tpm (cat "create-req" pcr-id pcrval))-      (send (enc "created" k pcr-id pcrval aik)))-    (non-orig (invk k))-    (uniq-orig k)-    (auth tpm))-  (defrole tpm-decrypt-    (vars (m current-value mesg) (pcr-id text) (k aik akey) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "decrypt" (enc m k)))-      (recv (enc "created" k pcr-id current-value aik))-      (load pcr current-value) (send m))-    (non-orig aik))-  (defrole alice-    (vars (n v data) (pcr-id text) (k aik akey) (tpm chan))-    (trace (send tpm (cat "extend" pcr-id n))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    (non-orig aik)-    (uniq-orig n v)-    (conf tpm)-    (neq (k aik)))-  (defrule genStV-if-hashed-tpm-power-on-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-power-on" z (idx 2))-          (p "tpm-power-on" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-extend-enc-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-extend-enc" z (idx 2))-          (p "tpm-extend-enc" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-decrypt-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-decrypt" z (idx 3))-          (p "tpm-decrypt" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-quote-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-quote" z (idx 2))-          (p "tpm-quote" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule shearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule invShearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule trRl_tpm-power-on-at-2-    (forall ((z strd))-      (implies (p "tpm-power-on" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_tpm-power-on-at-1-    (forall ((z strd))-      (implies (p "tpm-power-on" z (idx 3)) (trans z (idx 1)))))-  (defgenrule trRl_tpm-extend-enc-at-2-    (forall ((z strd))-      (implies (p "tpm-extend-enc" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_tpm-extend-enc-at-1-    (forall ((z strd))-      (implies (p "tpm-extend-enc" z (idx 3)) (trans z (idx 1))))))--(defskeleton envelope-  (vars (v n data) (pcr-id text) (k aik akey) (tpm chan))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id) (k k) (aik aik)-    (tpm tpm))-  (non-orig aik)-  (uniq-orig v n)-  (conf tpm)-  (traces ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id n))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k))))-  (label 0)-  (unrealized (0 0) (1 2))-  (preskeleton)-  (origs (v (1 3)) (n (1 0)))-  (comment "Not a skeleton"))--(defskeleton envelope-  (vars (v n data) (pcr-id pcr-id-0 text) (k aik akey)-    (pt pt-0 pt-1 pval) (tpm tpm-0 tpm-1 chan) (pcr locn))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id) (k k)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 3 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-0) (tpm tpm-1)-    (pcr pcr))-  (defstrand tpm-extend-enc 3 (value n) (current-value "0")-    (pcr-id pcr-id) (tpm tpm) (pcr pcr))-  (precedes ((1 0) (5 0)) ((1 1) (2 0)) ((1 3) (3 0)) ((2 1) (1 2))-    ((3 3) (0 0)) ((4 2) (3 2)) ((5 2) (4 1)))-  (non-orig aik (invk k))-  (uniq-orig v n k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain"))-  (conf tpm)-  (auth tpm)-  (leads-to ((4 2) (3 2)) ((5 2) (4 1)))-  (operation nonce-test (contracted (pcr-id-1 pcr-id) (tpm-2 tpm)) n-    (5 0) (ch-msg tpm (cat "extend" pcr-id n)))-  (strand-map 0 1 2 3 4 5)-  (traces ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id n))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (send (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((recv tpm-1 (cat "extend" pcr-id-0 "obtain"))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain"))))-    ((recv tpm (cat "extend" pcr-id n)) (load pcr (cat pt-1 "0"))-      (stor pcr (cat pt-0 (hash "0" n)))))-  (label 8)-  (parent 0)-  (realized)-  (shape)-  (maps ((0 1) ((v v) (n n) (pcr-id pcr-id) (k k) (aik aik) (tpm tpm))))-  (origs (pt-0 (5 2)) (pt (4 2)) (k (2 1)) (n (1 0)) (v (1 3))))--(comment "Nothing left to do")--(defprotocol envelope basic-  (defrole tpm-power-on-    (vars (current-value mesg) (pcr locn) (tpm chan))-    (trace (recv tpm "power on") (load pcr current-value)-      (stor pcr "0")))-  (defrole tpm-extend-enc-    (vars (value current-value mesg) (pcr-id text) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "extend" pcr-id value))-      (load pcr current-value) (stor pcr (hash current-value value))-      (send "ext ok")))-  (defrole tpm-quote-    (vars (nonce current-value mesg) (pcr-id text) (aik akey) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "quote" pcr-id nonce))-      (load pcr current-value)-      (send (enc "quote" pcr-id current-value nonce aik))))-  (defrole tpm-create-key-    (vars (k aik akey) (pcr-id text) (pcrval mesg) (tpm chan))-    (trace (recv tpm (cat "create-req" pcr-id pcrval))-      (send (enc "created" k pcr-id pcrval aik)))-    (non-orig (invk k))-    (uniq-orig k)-    (auth tpm))-  (defrole tpm-decrypt-    (vars (m current-value mesg) (pcr-id text) (k aik akey) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "decrypt" (enc m k)))-      (recv (enc "created" k pcr-id current-value aik))-      (load pcr current-value) (send m))-    (non-orig aik))-  (defrole alice-    (vars (n v data) (pcr-id text) (k aik akey) (tpm chan))-    (trace (send tpm (cat "extend" pcr-id n))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    (non-orig aik)-    (uniq-orig n v)-    (conf tpm)-    (neq (k aik)))-  (defrule genStV-if-hashed-tpm-power-on-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-power-on" z (idx 2))-          (p "tpm-power-on" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-extend-enc-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-extend-enc" z (idx 2))-          (p "tpm-extend-enc" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-decrypt-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-decrypt" z (idx 3))-          (p "tpm-decrypt" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-quote-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-quote" z (idx 2))-          (p "tpm-quote" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule shearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule invShearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule trRl_tpm-power-on-at-2-    (forall ((z strd))-      (implies (p "tpm-power-on" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_tpm-power-on-at-1-    (forall ((z strd))-      (implies (p "tpm-power-on" z (idx 3)) (trans z (idx 1)))))-  (defgenrule trRl_tpm-extend-enc-at-2-    (forall ((z strd))-      (implies (p "tpm-extend-enc" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_tpm-extend-enc-at-1-    (forall ((z strd))-      (implies (p "tpm-extend-enc" z (idx 3)) (trans z (idx 1))))))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 text) (k aik akey) (tpm chan))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (non-orig aik)-  (uniq-orig n v)-  (conf tpm)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k))))-  (label 9)-  (unrealized (0 0) (1 2))-  (preskeleton)-  (origs (v (1 3)) (n (1 0)))-  (comment "Not a skeleton"))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 pcr-id-1 text) (k aik akey)-    (pt pt-0 pt-1 pval) (tpm tpm-0 tpm-1 chan) (pcr locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-quote 3 (nonce (enc v k))-    (current-value (hash (hash "0" n) "refuse")) (pcr-id pcr-id)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 3 (value "refuse")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (tpm tpm-1)-    (pcr pcr))-  (defstrand tpm-extend-enc 3 (value n) (current-value "0")-    (pcr-id pcr-id-0) (tpm tpm) (pcr pcr))-  (precedes ((1 0) (5 0)) ((1 1) (2 0)) ((1 3) (3 0)) ((2 1) (1 2))-    ((3 2) (0 0)) ((4 2) (3 1)) ((5 2) (4 1)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (gen-st (hash "0" n) (hash (hash "0" n) "refuse"))-  (conf tpm)-  (auth tpm)-  (leads-to ((4 2) (3 1)) ((5 2) (4 1)))-  (operation nonce-test (contracted (pcr-id-2 pcr-id-0) (tpm-2 tpm)) n-    (5 0) (ch-msg tpm (cat "extend" pcr-id-0 n)))-  (strand-map 0 1 2 3 4 5)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "quote" pcr-id (enc v k)))-      (load pcr (cat pt (hash (hash "0" n) "refuse")))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((recv tpm-1 (cat "extend" pcr-id-1 "refuse"))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "refuse"))))-    ((recv tpm (cat "extend" pcr-id-0 n)) (load pcr (cat pt-1 "0"))-      (stor pcr (cat pt-0 (hash "0" n)))))-  (label 16)-  (parent 9)-  (realized)-  (shape)-  (maps-    ((0 1)-      ((n n) (v v) (k k) (aik aik) (pcr-id pcr-id) (pcr-id-0 pcr-id-0)-        (tpm tpm))))-  (origs (pt-0 (5 2)) (pt (4 2)) (n (1 0)) (k (2 1)) (v (1 3))))--(comment "Nothing left to do")--(defprotocol envelope basic-  (defrole tpm-power-on-    (vars (current-value mesg) (pcr locn) (tpm chan))-    (trace (recv tpm "power on") (load pcr current-value)-      (stor pcr "0")))-  (defrole tpm-extend-enc-    (vars (value current-value mesg) (pcr-id text) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "extend" pcr-id value))-      (load pcr current-value) (stor pcr (hash current-value value))-      (send "ext ok")))-  (defrole tpm-quote-    (vars (nonce current-value mesg) (pcr-id text) (aik akey) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "quote" pcr-id nonce))-      (load pcr current-value)-      (send (enc "quote" pcr-id current-value nonce aik))))-  (defrole tpm-create-key-    (vars (k aik akey) (pcr-id text) (pcrval mesg) (tpm chan))-    (trace (recv tpm (cat "create-req" pcr-id pcrval))-      (send (enc "created" k pcr-id pcrval aik)))-    (non-orig (invk k))-    (uniq-orig k)-    (auth tpm))-  (defrole tpm-decrypt-    (vars (m current-value mesg) (pcr-id text) (k aik akey) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "decrypt" (enc m k)))-      (recv (enc "created" k pcr-id current-value aik))-      (load pcr current-value) (send m))-    (non-orig aik))-  (defrole alice-    (vars (n v data) (pcr-id text) (k aik akey) (tpm chan))-    (trace (send tpm (cat "extend" pcr-id n))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    (non-orig aik)-    (uniq-orig n v)-    (conf tpm)-    (neq (k aik)))-  (defrule genStV-if-hashed-tpm-power-on-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-power-on" z (idx 2))-          (p "tpm-power-on" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-extend-enc-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-extend-enc" z (idx 2))-          (p "tpm-extend-enc" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-decrypt-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-decrypt" z (idx 3))-          (p "tpm-decrypt" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-quote-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-quote" z (idx 2))-          (p "tpm-quote" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule shearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule invShearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule trRl_tpm-power-on-at-2-    (forall ((z strd))-      (implies (p "tpm-power-on" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_tpm-power-on-at-1-    (forall ((z strd))-      (implies (p "tpm-power-on" z (idx 3)) (trans z (idx 1)))))-  (defgenrule trRl_tpm-extend-enc-at-2-    (forall ((z strd))-      (implies (p "tpm-extend-enc" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_tpm-extend-enc-at-1-    (forall ((z strd))-      (implies (p "tpm-extend-enc" z (idx 3)) (trans z (idx 1))))))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 text) (k aik akey) (tpm chan))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (non-orig aik)-  (uniq-orig n v)-  (conf tpm)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k))))-  (label 17)-  (unrealized (0 0) (1 0) (2 2))-  (preskeleton)-  (origs (v (2 3)) (n (2 0)))-  (comment "Not a skeleton"))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 pcr-id-1 pcr-id-2 text) (k aik akey)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval)-    (tpm tpm-0 tpm-1 tpm-2 tpm-3 chan) (pcr pcr-0 locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id-0) (k k)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 3 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (tpm tpm-1)-    (pcr pcr))-  (defstrand tpm-extend-enc 3 (value n) (current-value "0")-    (pcr-id pcr-id-0) (tpm tpm) (pcr pcr))-  (defstrand tpm-quote 3 (nonce (enc v k))-    (current-value (hash (hash "0" n) "refuse")) (pcr-id pcr-id)-    (aik aik) (tpm tpm-2) (pcr pcr-0))-  (defstrand tpm-extend-enc 3 (value "refuse")-    (current-value (hash "0" n)) (pcr-id pcr-id-2) (tpm tpm-3)-    (pcr pcr-0))-  (defstrand tpm-extend-enc 3 (value n) (current-value "0")-    (pcr-id pcr-id-0) (tpm tpm) (pcr pcr-0))-  (precedes ((2 0) (6 0)) ((2 0) (9 0)) ((2 1) (3 0)) ((2 3) (4 0))-    ((2 3) (7 0)) ((3 1) (2 2)) ((4 3) (1 0)) ((5 2) (4 2))-    ((6 2) (5 1)) ((7 2) (0 0)) ((8 2) (7 1)) ((9 2) (8 1)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain")-    (hash (hash "0" n) "refuse"))-  (conf tpm)-  (auth tpm)-  (leads-to ((5 2) (4 2)) ((6 2) (5 1)) ((8 2) (7 1)) ((9 2) (8 1)))-  (operation nonce-test (contracted (pcr-id-3 pcr-id-0) (tpm-4 tpm)) n-    (9 0) (ch-msg tpm (cat "extend" pcr-id-0 n)))-  (strand-map 0 1 2 3 4 5 6 7 8 9)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((recv tpm-1 (cat "extend" pcr-id-1 "obtain"))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain"))))-    ((recv tpm (cat "extend" pcr-id-0 n)) (load pcr (cat pt-1 "0"))-      (stor pcr (cat pt-0 (hash "0" n))))-    ((recv tpm-2 (cat "quote" pcr-id (enc v k)))-      (load pcr-0 (cat pt-2 (hash (hash "0" n) "refuse")))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((recv tpm-3 (cat "extend" pcr-id-2 "refuse"))-      (load pcr-0 (cat pt-3 (hash "0" n)))-      (stor pcr-0 (cat pt-2 (hash (hash "0" n) "refuse"))))-    ((recv tpm (cat "extend" pcr-id-0 n)) (load pcr-0 (cat pt-4 "0"))-      (stor pcr-0 (cat pt-3 (hash "0" n)))))-  (label 29)-  (parent 17)-  (realized)-  (shape)-  (maps-    ((0 1 2)-      ((n n) (v v) (k k) (aik aik) (pcr-id pcr-id) (pcr-id-0 pcr-id-0)-        (tpm tpm))))-  (origs (pt-3 (9 2)) (pt-2 (8 2)) (pt-0 (6 2)) (pt (5 2)) (k (3 1))-    (n (2 0)) (v (2 3))))--(comment "Nothing left to do")--(defprotocol envelope-plus basic-  (defrole tpm-power-on-    (vars (current-value mesg) (pcr locn) (tpm chan))-    (trace (recv tpm "power on") (load pcr current-value)-      (stor pcr "0")))-  (defrole tpm-extend-enc-    (vars (value current-value mesg) (pcr-id text) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "extend" pcr-id value))-      (load pcr current-value) (stor pcr (hash current-value value))-      (send "ext ok")))-  (defrole tpm-quote-    (vars (nonce current-value mesg) (pcr-id text) (aik akey) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "quote" pcr-id nonce))-      (load pcr current-value)-      (send (enc "quote" pcr-id current-value nonce aik))))-  (defrole tpm-create-key-    (vars (k aik akey) (pcr-id text) (pcrval mesg) (tpm chan))-    (trace (recv tpm (cat "create-req" pcr-id pcrval))-      (send (enc "created" k pcr-id pcrval aik)))-    (non-orig (invk k))-    (uniq-orig k)-    (auth tpm))-  (defrole tpm-decrypt-    (vars (m current-value mesg) (pcr-id text) (k aik akey) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "decrypt" (enc m k)))-      (recv (enc "created" k pcr-id current-value aik))-      (load pcr current-value) (send m))-    (non-orig aik))-  (defrole alice-    (vars (n v data) (pcr-id text) (k aik akey) (tpm chan))-    (trace (send tpm (cat "extend" pcr-id n))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    (non-orig aik)-    (uniq-orig n v)-    (conf tpm)-    (neq (k aik)))-  (defrule genStV-if-hashed-tpm-power-on-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-power-on" z (idx 2))-          (p "tpm-power-on" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-extend-enc-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-extend-enc" z (idx 2))-          (p "tpm-extend-enc" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-decrypt-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-decrypt" z (idx 3))-          (p "tpm-decrypt" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-quote-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-quote" z (idx 2))-          (p "tpm-quote" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule ordered-extends-    (forall ((y z strd) (pcr locn))-      (implies-        (and (p "tpm-extend-enc" y (idx 3))-          (p "tpm-extend-enc" z (idx 3))-          (p "tpm-extend-enc" "pcr" y pcr)-          (p "tpm-extend-enc" "pcr" z pcr))-        (or-          (= y z)-          (prec y (idx 2) z (idx 1))-          (prec z (idx 2) y (idx 1))))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule shearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule invShearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule trRl_tpm-power-on-at-2-    (forall ((z strd))-      (implies (p "tpm-power-on" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_tpm-power-on-at-1-    (forall ((z strd))-      (implies (p "tpm-power-on" z (idx 3)) (trans z (idx 1)))))-  (defgenrule trRl_tpm-extend-enc-at-2-    (forall ((z strd))-      (implies (p "tpm-extend-enc" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_tpm-extend-enc-at-1-    (forall ((z strd))-      (implies (p "tpm-extend-enc" z (idx 3)) (trans z (idx 1))))))--(defskeleton envelope-plus-  (vars (v n data) (pcr-id text) (k aik akey) (tpm chan))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id) (k k) (aik aik)-    (tpm tpm))-  (non-orig aik)-  (uniq-orig v n)-  (conf tpm)-  (traces ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id n))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k))))-  (label 30)-  (unrealized (0 0) (1 2))-  (preskeleton)-  (origs (v (1 3)) (n (1 0)))-  (comment "Not a skeleton"))--(defskeleton envelope-plus-  (vars (v n data) (pcr-id pcr-id-0 text) (k aik akey)-    (pt pt-0 pt-1 pval) (tpm tpm-0 tpm-1 chan) (pcr locn))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id) (k k)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 3 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-0) (tpm tpm-1)-    (pcr pcr))-  (defstrand tpm-extend-enc 3 (value n) (current-value "0")-    (pcr-id pcr-id) (tpm tpm) (pcr pcr))-  (precedes ((1 0) (5 0)) ((1 1) (2 0)) ((1 3) (3 0)) ((2 1) (1 2))-    ((3 3) (0 0)) ((4 2) (3 2)) ((5 2) (4 1)))-  (non-orig aik (invk k))-  (uniq-orig v n k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain"))-  (conf tpm)-  (auth tpm)-  (leads-to ((4 2) (3 2)) ((5 2) (4 1)))-  (operation nonce-test (contracted (pcr-id-1 pcr-id) (tpm-2 tpm)) n-    (5 0) (ch-msg tpm (cat "extend" pcr-id n)))-  (strand-map 0 1 2 3 4 5)-  (traces ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id n))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (send (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((recv tpm-1 (cat "extend" pcr-id-0 "obtain"))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain"))))-    ((recv tpm (cat "extend" pcr-id n)) (load pcr (cat pt-1 "0"))-      (stor pcr (cat pt-0 (hash "0" n)))))-  (label 38)-  (parent 30)-  (realized)-  (shape)-  (maps ((0 1) ((v v) (n n) (pcr-id pcr-id) (k k) (aik aik) (tpm tpm))))-  (origs (pt-0 (5 2)) (pt (4 2)) (k (2 1)) (n (1 0)) (v (1 3))))--(comment "Nothing left to do")--(defprotocol envelope-plus basic-  (defrole tpm-power-on-    (vars (current-value mesg) (pcr locn) (tpm chan))-    (trace (recv tpm "power on") (load pcr current-value)-      (stor pcr "0")))-  (defrole tpm-extend-enc-    (vars (value current-value mesg) (pcr-id text) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "extend" pcr-id value))-      (load pcr current-value) (stor pcr (hash current-value value))-      (send "ext ok")))-  (defrole tpm-quote-    (vars (nonce current-value mesg) (pcr-id text) (aik akey) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "quote" pcr-id nonce))-      (load pcr current-value)-      (send (enc "quote" pcr-id current-value nonce aik))))-  (defrole tpm-create-key-    (vars (k aik akey) (pcr-id text) (pcrval mesg) (tpm chan))-    (trace (recv tpm (cat "create-req" pcr-id pcrval))-      (send (enc "created" k pcr-id pcrval aik)))-    (non-orig (invk k))-    (uniq-orig k)-    (auth tpm))-  (defrole tpm-decrypt-    (vars (m current-value mesg) (pcr-id text) (k aik akey) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "decrypt" (enc m k)))-      (recv (enc "created" k pcr-id current-value aik))-      (load pcr current-value) (send m))-    (non-orig aik))-  (defrole alice-    (vars (n v data) (pcr-id text) (k aik akey) (tpm chan))-    (trace (send tpm (cat "extend" pcr-id n))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    (non-orig aik)-    (uniq-orig n v)-    (conf tpm)-    (neq (k aik)))-  (defrule genStV-if-hashed-tpm-power-on-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-power-on" z (idx 2))-          (p "tpm-power-on" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-extend-enc-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-extend-enc" z (idx 2))-          (p "tpm-extend-enc" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-decrypt-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-decrypt" z (idx 3))-          (p "tpm-decrypt" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-quote-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-quote" z (idx 2))-          (p "tpm-quote" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule ordered-extends-    (forall ((y z strd) (pcr locn))-      (implies-        (and (p "tpm-extend-enc" y (idx 3))-          (p "tpm-extend-enc" z (idx 3))-          (p "tpm-extend-enc" "pcr" y pcr)-          (p "tpm-extend-enc" "pcr" z pcr))-        (or-          (= y z)-          (prec y (idx 2) z (idx 1))-          (prec z (idx 2) y (idx 1))))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule shearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule invShearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule trRl_tpm-power-on-at-2-    (forall ((z strd))-      (implies (p "tpm-power-on" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_tpm-power-on-at-1-    (forall ((z strd))-      (implies (p "tpm-power-on" z (idx 3)) (trans z (idx 1)))))-  (defgenrule trRl_tpm-extend-enc-at-2-    (forall ((z strd))-      (implies (p "tpm-extend-enc" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_tpm-extend-enc-at-1-    (forall ((z strd))-      (implies (p "tpm-extend-enc" z (idx 3)) (trans z (idx 1))))))--(defskeleton envelope-plus-  (vars (n v data) (pcr-id pcr-id-0 text) (k aik akey) (tpm chan))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (non-orig aik)-  (uniq-orig n v)-  (conf tpm)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k))))-  (label 39)-  (unrealized (0 0) (1 2))-  (preskeleton)-  (origs (v (1 3)) (n (1 0)))-  (comment "Not a skeleton"))--(defskeleton envelope-plus-  (vars (n v data) (pcr-id pcr-id-0 pcr-id-1 text) (k aik akey)-    (pt pt-0 pt-1 pval) (tpm tpm-0 tpm-1 chan) (pcr locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-quote 3 (nonce (enc v k))-    (current-value (hash (hash "0" n) "refuse")) (pcr-id pcr-id)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 3 (value "refuse")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (tpm tpm-1)-    (pcr pcr))-  (defstrand tpm-extend-enc 3 (value n) (current-value "0")-    (pcr-id pcr-id-0) (tpm tpm) (pcr pcr))-  (precedes ((1 0) (5 0)) ((1 1) (2 0)) ((1 3) (3 0)) ((2 1) (1 2))-    ((3 2) (0 0)) ((4 2) (3 1)) ((5 2) (4 1)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (gen-st (hash "0" n) (hash (hash "0" n) "refuse"))-  (conf tpm)-  (auth tpm)-  (leads-to ((4 2) (3 1)) ((5 2) (4 1)))-  (operation nonce-test (contracted (pcr-id-2 pcr-id-0) (tpm-2 tpm)) n-    (5 0) (ch-msg tpm (cat "extend" pcr-id-0 n)))-  (strand-map 0 1 2 3 4 5)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "quote" pcr-id (enc v k)))-      (load pcr (cat pt (hash (hash "0" n) "refuse")))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((recv tpm-1 (cat "extend" pcr-id-1 "refuse"))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "refuse"))))-    ((recv tpm (cat "extend" pcr-id-0 n)) (load pcr (cat pt-1 "0"))-      (stor pcr (cat pt-0 (hash "0" n)))))-  (label 46)-  (parent 39)-  (realized)-  (shape)-  (maps-    ((0 1)-      ((n n) (v v) (k k) (aik aik) (pcr-id pcr-id) (pcr-id-0 pcr-id-0)-        (tpm tpm))))-  (origs (pt-0 (5 2)) (pt (4 2)) (n (1 0)) (k (2 1)) (v (1 3))))--(comment "Nothing left to do")--(defprotocol envelope-plus basic-  (defrole tpm-power-on-    (vars (current-value mesg) (pcr locn) (tpm chan))-    (trace (recv tpm "power on") (load pcr current-value)-      (stor pcr "0")))-  (defrole tpm-extend-enc-    (vars (value current-value mesg) (pcr-id text) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "extend" pcr-id value))-      (load pcr current-value) (stor pcr (hash current-value value))-      (send "ext ok")))-  (defrole tpm-quote-    (vars (nonce current-value mesg) (pcr-id text) (aik akey) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "quote" pcr-id nonce))-      (load pcr current-value)-      (send (enc "quote" pcr-id current-value nonce aik))))-  (defrole tpm-create-key-    (vars (k aik akey) (pcr-id text) (pcrval mesg) (tpm chan))-    (trace (recv tpm (cat "create-req" pcr-id pcrval))-      (send (enc "created" k pcr-id pcrval aik)))-    (non-orig (invk k))-    (uniq-orig k)-    (auth tpm))-  (defrole tpm-decrypt-    (vars (m current-value mesg) (pcr-id text) (k aik akey) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "decrypt" (enc m k)))-      (recv (enc "created" k pcr-id current-value aik))-      (load pcr current-value) (send m))-    (non-orig aik))-  (defrole alice-    (vars (n v data) (pcr-id text) (k aik akey) (tpm chan))-    (trace (send tpm (cat "extend" pcr-id n))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    (non-orig aik)-    (uniq-orig n v)-    (conf tpm)-    (neq (k aik)))-  (defrule genStV-if-hashed-tpm-power-on-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-power-on" z (idx 2))-          (p "tpm-power-on" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-extend-enc-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-extend-enc" z (idx 2))-          (p "tpm-extend-enc" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-decrypt-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-decrypt" z (idx 3))-          (p "tpm-decrypt" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-quote-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-quote" z (idx 2))-          (p "tpm-quote" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule ordered-extends-    (forall ((y z strd) (pcr locn))-      (implies-        (and (p "tpm-extend-enc" y (idx 3))-          (p "tpm-extend-enc" z (idx 3))-          (p "tpm-extend-enc" "pcr" y pcr)-          (p "tpm-extend-enc" "pcr" z pcr))-        (or-          (= y z)-          (prec y (idx 2) z (idx 1))-          (prec z (idx 2) y (idx 1))))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule shearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule invShearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule trRl_tpm-power-on-at-2-    (forall ((z strd))-      (implies (p "tpm-power-on" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_tpm-power-on-at-1-    (forall ((z strd))-      (implies (p "tpm-power-on" z (idx 3)) (trans z (idx 1)))))-  (defgenrule trRl_tpm-extend-enc-at-2-    (forall ((z strd))-      (implies (p "tpm-extend-enc" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_tpm-extend-enc-at-1-    (forall ((z strd))-      (implies (p "tpm-extend-enc" z (idx 3)) (trans z (idx 1))))))--(defskeleton envelope-plus-  (vars (n v data) (pcr-id pcr-id-0 text) (k aik akey) (tpm chan))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (non-orig aik)-  (uniq-orig n v)-  (conf tpm)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k))))-  (label 47)-  (unrealized (0 0) (1 0) (2 2))-  (preskeleton)-  (origs (v (2 3)) (n (2 0)))-  (comment "Not a skeleton"))--(defskeleton envelope-plus-  (vars (n v data) (pcr-id pcr-id-0 pcr-id-1 pcr-id-2 text) (k aik akey)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval)-    (tpm tpm-0 tpm-1 tpm-2 tpm-3 chan) (pcr pcr-0 locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id-0) (k k)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 3 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (tpm tpm-1)-    (pcr pcr))-  (defstrand tpm-extend-enc 3 (value n) (current-value "0")-    (pcr-id pcr-id-0) (tpm tpm) (pcr pcr))-  (defstrand tpm-quote 3 (nonce (enc v k))-    (current-value (hash (hash "0" n) "refuse")) (pcr-id pcr-id)-    (aik aik) (tpm tpm-2) (pcr pcr-0))-  (defstrand tpm-extend-enc 3 (value "refuse")-    (current-value (hash "0" n)) (pcr-id pcr-id-2) (tpm tpm-3)-    (pcr pcr-0))-  (defstrand tpm-extend-enc 3 (value n) (current-value "0")-    (pcr-id pcr-id-0) (tpm tpm) (pcr pcr-0))-  (precedes ((2 0) (6 0)) ((2 0) (9 0)) ((2 1) (3 0)) ((2 3) (4 0))-    ((2 3) (7 0)) ((3 1) (2 2)) ((4 3) (1 0)) ((5 2) (4 2))-    ((6 2) (5 1)) ((7 2) (0 0)) ((8 2) (7 1)) ((9 2) (8 1)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain")-    (hash (hash "0" n) "refuse"))-  (conf tpm)-  (auth tpm)-  (leads-to ((5 2) (4 2)) ((6 2) (5 1)) ((8 2) (7 1)) ((9 2) (8 1)))-  (operation nonce-test (contracted (pcr-id-3 pcr-id-0) (tpm-4 tpm)) n-    (9 0) (ch-msg tpm (cat "extend" pcr-id-0 n)))-  (strand-map 0 1 2 3 4 5 6 7 8 9)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((recv tpm-1 (cat "extend" pcr-id-1 "obtain"))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain"))))-    ((recv tpm (cat "extend" pcr-id-0 n)) (load pcr (cat pt-1 "0"))-      (stor pcr (cat pt-0 (hash "0" n))))-    ((recv tpm-2 (cat "quote" pcr-id (enc v k)))-      (load pcr-0 (cat pt-2 (hash (hash "0" n) "refuse")))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((recv tpm-3 (cat "extend" pcr-id-2 "refuse"))-      (load pcr-0 (cat pt-3 (hash "0" n)))-      (stor pcr-0 (cat pt-2 (hash (hash "0" n) "refuse"))))-    ((recv tpm (cat "extend" pcr-id-0 n)) (load pcr-0 (cat pt-4 "0"))-      (stor pcr-0 (cat pt-3 (hash "0" n)))))-  (label 59)-  (parent 47)-  (realized)-  (shape)-  (maps-    ((0 1 2)-      ((n n) (v v) (k k) (aik aik) (pcr-id pcr-id) (pcr-id-0 pcr-id-0)-        (tpm tpm))))-  (origs (pt-3 (9 2)) (pt-2 (8 2)) (pt-0 (6 2)) (pt (5 2)) (k (3 1))-    (n (2 0)) (v (2 3))))--(comment "Nothing left to do")--(defprotocol envelope-plus-2 basic-  (defrole tpm-power-on-    (vars (current-value mesg) (pcr locn) (tpm chan))-    (trace (recv tpm "power on") (load pcr current-value)-      (stor pcr "0")))-  (defrole tpm-extend-enc-    (vars (value current-value mesg) (pcr-id text) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "extend" pcr-id value))-      (load pcr current-value) (stor pcr (hash current-value value))-      (send "ext ok")))-  (defrole tpm-quote-    (vars (nonce current-value mesg) (pcr-id text) (aik akey) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "quote" pcr-id nonce))-      (load pcr current-value)-      (send (enc "quote" pcr-id current-value nonce aik))))-  (defrole tpm-create-key-    (vars (k aik akey) (pcr-id text) (pcrval mesg) (tpm chan))-    (trace (recv tpm (cat "create-req" pcr-id pcrval))-      (send (enc "created" k pcr-id pcrval aik)))-    (non-orig (invk k))-    (uniq-orig k)-    (auth tpm))-  (defrole tpm-decrypt-    (vars (m current-value mesg) (pcr-id text) (k aik akey) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "decrypt" (enc m k)))-      (recv (enc "created" k pcr-id current-value aik))-      (load pcr current-value) (send m))-    (non-orig aik))-  (defrole alice-    (vars (n v data) (pcr-id text) (k aik akey) (tpm chan))-    (trace (send tpm (cat "extend" pcr-id n))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    (non-orig aik)-    (uniq-orig n v)-    (conf tpm)-    (neq (k aik)))-  (defrule genStV-if-hashed-tpm-power-on-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-power-on" z (idx 2))-          (p "tpm-power-on" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-extend-enc-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-extend-enc" z (idx 2))-          (p "tpm-extend-enc" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-decrypt-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-decrypt" z (idx 3))-          (p "tpm-decrypt" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-quote-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-quote" z (idx 2))-          (p "tpm-quote" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule pcr-id-identifies-pcr-    (forall ((y z strd) (pcr-id text) (pcr pcr-0 locn))-      (implies-        (and (p "tpm-extend-enc" y (idx 3))-          (p "tpm-extend-enc" z (idx 3))-          (p "tpm-extend-enc" "pcr-id" y pcr-id)-          (p "tpm-extend-enc" "pcr-id" z pcr-id)-          (p "tpm-extend-enc" "pcr" y pcr)-          (p "tpm-extend-enc" "pcr" z pcr-0))-        (= pcr pcr-0))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule shearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule invShearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule trRl_tpm-power-on-at-2-    (forall ((z strd))-      (implies (p "tpm-power-on" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_tpm-power-on-at-1-    (forall ((z strd))-      (implies (p "tpm-power-on" z (idx 3)) (trans z (idx 1)))))-  (defgenrule trRl_tpm-extend-enc-at-2-    (forall ((z strd))-      (implies (p "tpm-extend-enc" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_tpm-extend-enc-at-1-    (forall ((z strd))-      (implies (p "tpm-extend-enc" z (idx 3)) (trans z (idx 1))))))--(defskeleton envelope-plus-2-  (vars (v n data) (pcr-id text) (k aik akey) (tpm chan))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id) (k k) (aik aik)-    (tpm tpm))-  (non-orig aik)-  (uniq-orig v n)-  (conf tpm)-  (traces ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id n))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k))))-  (label 60)-  (unrealized (0 0) (1 2))-  (preskeleton)-  (origs (v (1 3)) (n (1 0)))-  (comment "Not a skeleton"))--(defskeleton envelope-plus-2-  (vars (v n data) (pcr-id pcr-id-0 text) (k aik akey)-    (pt pt-0 pt-1 pval) (tpm tpm-0 tpm-1 chan) (pcr locn))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id) (k k)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 3 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-0) (tpm tpm-1)-    (pcr pcr))-  (defstrand tpm-extend-enc 3 (value n) (current-value "0")-    (pcr-id pcr-id) (tpm tpm) (pcr pcr))-  (precedes ((1 0) (5 0)) ((1 1) (2 0)) ((1 3) (3 0)) ((2 1) (1 2))-    ((3 3) (0 0)) ((4 2) (3 2)) ((5 2) (4 1)))-  (non-orig aik (invk k))-  (uniq-orig v n k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain"))-  (conf tpm)-  (auth tpm)-  (leads-to ((4 2) (3 2)) ((5 2) (4 1)))-  (operation nonce-test (contracted (pcr-id-1 pcr-id) (tpm-2 tpm)) n-    (5 0) (ch-msg tpm (cat "extend" pcr-id n)))-  (strand-map 0 1 2 3 4 5)-  (traces ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id n))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (send (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((recv tpm-1 (cat "extend" pcr-id-0 "obtain"))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain"))))-    ((recv tpm (cat "extend" pcr-id n)) (load pcr (cat pt-1 "0"))-      (stor pcr (cat pt-0 (hash "0" n)))))-  (label 68)-  (parent 60)-  (realized)-  (shape)-  (maps ((0 1) ((v v) (n n) (pcr-id pcr-id) (k k) (aik aik) (tpm tpm))))-  (origs (pt-0 (5 2)) (pt (4 2)) (k (2 1)) (n (1 0)) (v (1 3))))--(comment "Nothing left to do")--(defprotocol envelope-plus-2 basic-  (defrole tpm-power-on-    (vars (current-value mesg) (pcr locn) (tpm chan))-    (trace (recv tpm "power on") (load pcr current-value)-      (stor pcr "0")))-  (defrole tpm-extend-enc-    (vars (value current-value mesg) (pcr-id text) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "extend" pcr-id value))-      (load pcr current-value) (stor pcr (hash current-value value))-      (send "ext ok")))-  (defrole tpm-quote-    (vars (nonce current-value mesg) (pcr-id text) (aik akey) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "quote" pcr-id nonce))-      (load pcr current-value)-      (send (enc "quote" pcr-id current-value nonce aik))))-  (defrole tpm-create-key-    (vars (k aik akey) (pcr-id text) (pcrval mesg) (tpm chan))-    (trace (recv tpm (cat "create-req" pcr-id pcrval))-      (send (enc "created" k pcr-id pcrval aik)))-    (non-orig (invk k))-    (uniq-orig k)-    (auth tpm))-  (defrole tpm-decrypt-    (vars (m current-value mesg) (pcr-id text) (k aik akey) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "decrypt" (enc m k)))-      (recv (enc "created" k pcr-id current-value aik))-      (load pcr current-value) (send m))-    (non-orig aik))-  (defrole alice-    (vars (n v data) (pcr-id text) (k aik akey) (tpm chan))-    (trace (send tpm (cat "extend" pcr-id n))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    (non-orig aik)-    (uniq-orig n v)-    (conf tpm)-    (neq (k aik)))-  (defrule genStV-if-hashed-tpm-power-on-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-power-on" z (idx 2))-          (p "tpm-power-on" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-extend-enc-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-extend-enc" z (idx 2))-          (p "tpm-extend-enc" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-decrypt-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-decrypt" z (idx 3))-          (p "tpm-decrypt" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-quote-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-quote" z (idx 2))-          (p "tpm-quote" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule pcr-id-identifies-pcr-    (forall ((y z strd) (pcr-id text) (pcr pcr-0 locn))-      (implies-        (and (p "tpm-extend-enc" y (idx 3))-          (p "tpm-extend-enc" z (idx 3))-          (p "tpm-extend-enc" "pcr-id" y pcr-id)-          (p "tpm-extend-enc" "pcr-id" z pcr-id)-          (p "tpm-extend-enc" "pcr" y pcr)-          (p "tpm-extend-enc" "pcr" z pcr-0))-        (= pcr pcr-0))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule shearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule invShearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule trRl_tpm-power-on-at-2-    (forall ((z strd))-      (implies (p "tpm-power-on" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_tpm-power-on-at-1-    (forall ((z strd))-      (implies (p "tpm-power-on" z (idx 3)) (trans z (idx 1)))))-  (defgenrule trRl_tpm-extend-enc-at-2-    (forall ((z strd))-      (implies (p "tpm-extend-enc" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_tpm-extend-enc-at-1-    (forall ((z strd))-      (implies (p "tpm-extend-enc" z (idx 3)) (trans z (idx 1))))))--(defskeleton envelope-plus-2-  (vars (n v data) (pcr-id pcr-id-0 text) (k aik akey) (tpm chan))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (non-orig aik)-  (uniq-orig n v)-  (conf tpm)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k))))-  (label 69)-  (unrealized (0 0) (1 2))-  (preskeleton)-  (origs (v (1 3)) (n (1 0)))-  (comment "Not a skeleton"))--(defskeleton envelope-plus-2-  (vars (n v data) (pcr-id pcr-id-0 pcr-id-1 text) (k aik akey)-    (pt pt-0 pt-1 pval) (tpm tpm-0 tpm-1 chan) (pcr locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-quote 3 (nonce (enc v k))-    (current-value (hash (hash "0" n) "refuse")) (pcr-id pcr-id)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 3 (value "refuse")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (tpm tpm-1)-    (pcr pcr))-  (defstrand tpm-extend-enc 3 (value n) (current-value "0")-    (pcr-id pcr-id-0) (tpm tpm) (pcr pcr))-  (precedes ((1 0) (5 0)) ((1 1) (2 0)) ((1 3) (3 0)) ((2 1) (1 2))-    ((3 2) (0 0)) ((4 2) (3 1)) ((5 2) (4 1)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (gen-st (hash "0" n) (hash (hash "0" n) "refuse"))-  (conf tpm)-  (auth tpm)-  (leads-to ((4 2) (3 1)) ((5 2) (4 1)))-  (operation nonce-test (contracted (pcr-id-2 pcr-id-0) (tpm-2 tpm)) n-    (5 0) (ch-msg tpm (cat "extend" pcr-id-0 n)))-  (strand-map 0 1 2 3 4 5)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "quote" pcr-id (enc v k)))-      (load pcr (cat pt (hash (hash "0" n) "refuse")))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((recv tpm-1 (cat "extend" pcr-id-1 "refuse"))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "refuse"))))-    ((recv tpm (cat "extend" pcr-id-0 n)) (load pcr (cat pt-1 "0"))-      (stor pcr (cat pt-0 (hash "0" n)))))-  (label 76)-  (parent 69)-  (realized)-  (shape)-  (maps-    ((0 1)-      ((n n) (v v) (k k) (aik aik) (pcr-id pcr-id) (pcr-id-0 pcr-id-0)-        (tpm tpm))))-  (origs (pt-0 (5 2)) (pt (4 2)) (n (1 0)) (k (2 1)) (v (1 3))))--(comment "Nothing left to do")--(defprotocol envelope-plus-2 basic-  (defrole tpm-power-on-    (vars (current-value mesg) (pcr locn) (tpm chan))-    (trace (recv tpm "power on") (load pcr current-value)-      (stor pcr "0")))-  (defrole tpm-extend-enc-    (vars (value current-value mesg) (pcr-id text) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "extend" pcr-id value))-      (load pcr current-value) (stor pcr (hash current-value value))-      (send "ext ok")))-  (defrole tpm-quote-    (vars (nonce current-value mesg) (pcr-id text) (aik akey) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "quote" pcr-id nonce))-      (load pcr current-value)-      (send (enc "quote" pcr-id current-value nonce aik))))-  (defrole tpm-create-key-    (vars (k aik akey) (pcr-id text) (pcrval mesg) (tpm chan))-    (trace (recv tpm (cat "create-req" pcr-id pcrval))-      (send (enc "created" k pcr-id pcrval aik)))-    (non-orig (invk k))-    (uniq-orig k)-    (auth tpm))-  (defrole tpm-decrypt-    (vars (m current-value mesg) (pcr-id text) (k aik akey) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "decrypt" (enc m k)))-      (recv (enc "created" k pcr-id current-value aik))-      (load pcr current-value) (send m))-    (non-orig aik))-  (defrole alice-    (vars (n v data) (pcr-id text) (k aik akey) (tpm chan))-    (trace (send tpm (cat "extend" pcr-id n))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    (non-orig aik)-    (uniq-orig n v)-    (conf tpm)-    (neq (k aik)))-  (defrule genStV-if-hashed-tpm-power-on-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-power-on" z (idx 2))-          (p "tpm-power-on" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-extend-enc-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-extend-enc" z (idx 2))-          (p "tpm-extend-enc" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-decrypt-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-decrypt" z (idx 3))-          (p "tpm-decrypt" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-quote-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-quote" z (idx 2))-          (p "tpm-quote" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule pcr-id-identifies-pcr-    (forall ((y z strd) (pcr-id text) (pcr pcr-0 locn))-      (implies-        (and (p "tpm-extend-enc" y (idx 3))-          (p "tpm-extend-enc" z (idx 3))-          (p "tpm-extend-enc" "pcr-id" y pcr-id)-          (p "tpm-extend-enc" "pcr-id" z pcr-id)-          (p "tpm-extend-enc" "pcr" y pcr)-          (p "tpm-extend-enc" "pcr" z pcr-0))-        (= pcr pcr-0))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule shearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule invShearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule trRl_tpm-power-on-at-2-    (forall ((z strd))-      (implies (p "tpm-power-on" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_tpm-power-on-at-1-    (forall ((z strd))-      (implies (p "tpm-power-on" z (idx 3)) (trans z (idx 1)))))-  (defgenrule trRl_tpm-extend-enc-at-2-    (forall ((z strd))-      (implies (p "tpm-extend-enc" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_tpm-extend-enc-at-1-    (forall ((z strd))-      (implies (p "tpm-extend-enc" z (idx 3)) (trans z (idx 1))))))--(defskeleton envelope-plus-2-  (vars (n v data) (pcr-id pcr-id-0 text) (k aik akey) (tpm chan))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (non-orig aik)-  (uniq-orig n v)-  (conf tpm)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k))))-  (label 77)-  (unrealized (0 0) (1 0) (2 2))-  (preskeleton)-  (origs (v (2 3)) (n (2 0)))-  (comment "Not a skeleton"))--(defskeleton envelope-plus-2-  (vars (n v data) (pcr-id pcr-id-0 pcr-id-1 pcr-id-2 text) (k aik akey)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval)-    (tpm tpm-0 tpm-1 tpm-2 tpm-3 chan) (pcr locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 4 (n n) (v v) (pcr-id pcr-id-0) (k k) (aik aik)-    (tpm tpm))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id-0) (k k)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 3 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (tpm tpm-1)-    (pcr pcr))-  (defstrand tpm-extend-enc 3 (value n) (current-value "0")-    (pcr-id pcr-id-0) (tpm tpm) (pcr pcr))-  (defstrand tpm-quote 3 (nonce (enc v k))-    (current-value (hash (hash "0" n) "refuse")) (pcr-id pcr-id)-    (aik aik) (tpm tpm-2) (pcr pcr))-  (defstrand tpm-extend-enc 3 (value "refuse")-    (current-value (hash "0" n)) (pcr-id pcr-id-2) (tpm tpm-3)-    (pcr pcr))-  (defstrand tpm-extend-enc 3 (value n) (current-value "0")-    (pcr-id pcr-id-0) (tpm tpm) (pcr pcr))-  (precedes ((2 0) (6 0)) ((2 0) (9 0)) ((2 1) (3 0)) ((2 3) (4 0))-    ((2 3) (7 0)) ((3 1) (2 2)) ((4 3) (1 0)) ((5 2) (4 2))-    ((6 2) (5 1)) ((7 2) (0 0)) ((8 2) (7 1)) ((9 2) (8 1)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain")-    (hash (hash "0" n) "refuse"))-  (conf tpm)-  (auth tpm)-  (leads-to ((5 2) (4 2)) ((6 2) (5 1)) ((8 2) (7 1)) ((9 2) (8 1)))-  (operation nonce-test-    (contracted (pcr-0 pcr) (pcr-id-3 pcr-id-0) (tpm-4 tpm)) n (9 0)-    (ch-msg tpm (cat "extend" pcr-id-0 n)))-  (strand-map 0 1 2 3 4 5 6 7 8 9)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((send tpm (cat "extend" pcr-id-0 n))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((recv tpm-1 (cat "extend" pcr-id-1 "obtain"))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain"))))-    ((recv tpm (cat "extend" pcr-id-0 n)) (load pcr (cat pt-1 "0"))-      (stor pcr (cat pt-0 (hash "0" n))))-    ((recv tpm-2 (cat "quote" pcr-id (enc v k)))-      (load pcr (cat pt-2 (hash (hash "0" n) "refuse")))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((recv tpm-3 (cat "extend" pcr-id-2 "refuse"))-      (load pcr (cat pt-3 (hash "0" n)))-      (stor pcr (cat pt-2 (hash (hash "0" n) "refuse"))))-    ((recv tpm (cat "extend" pcr-id-0 n)) (load pcr (cat pt-4 "0"))-      (stor pcr (cat pt-3 (hash "0" n)))))-  (label 89)-  (parent 77)-  (realized)-  (shape)-  (maps-    ((0 1 2)-      ((n n) (v v) (k k) (aik aik) (pcr-id pcr-id) (pcr-id-0 pcr-id-0)-        (tpm tpm))))-  (origs (pt-3 (9 2)) (pt-2 (8 2)) (pt-0 (6 2)) (pt (5 2)) (k (3 1))-    (n (2 0)) (v (2 3))))--(comment "Nothing left to do")
− tst/defact-open-closed-multiloc.tst 
@@ -1,857 +0,0 @@-(herald open-closed (bound 44))--(comment "CPSA 4.4.5")-(comment "All input read from tst/open-closed-multiloc.scm")-(comment "Strand count bounded at 44")--(defprotocol open-closed basic-  (defrole dev-up-    (vars (k skey) (d o name) (old old1 mesg) (start-ch chan)-      (lk ls locn))-    (trace (recv start-ch (cat "power-up" d o k)) (load lk old)-      (load ls old1) (stor ls (cat "st" d o))-      (stor lk (cat "st-k" d o k)) (send (enc "up" k)))-    (auth start-ch))-  (defrole owner-power-dev-    (vars (k skey) (d o name) (start-ch chan))-    (trace (send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    (conf start-ch))-  (defrole owner-open-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "open" d o n k)) (recv n)))-  (defrole owner-close-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "close" d o n k)) (recv n)))-  (defrole dev-open-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "open" d o n k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d o o)) (send n)))-  (defrole dev-close-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "close" d o n k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d o)) (send n)))-  (defrole dev-pass-    (vars (k skey) (n text) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat "st" d o o)) (send (enc "you may pass" n k)))-    (uniq-orig n))-  (defrole user-pass-    (vars (k skey))-    (trace (send (enc "may I pass" k)) (recv (enc "you may pass" k))))-  (defrule gen-state-close-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-close" z (idx 1)) (p "dev-close" "d" z d)-          (p "dev-close" "o" z o) (p "dev-close" "k" z k)-          (p "dev-close" "any" z (cat o o)))-        (gen-st (cat "st" d o o)))))-  (defrule gen-state-pass-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "d" z d)-          (p "dev-pass" "o" z o) (p "dev-pass" "k" z k))-        (gen-st (cat "st" d o o)))))-  (defrule power-deliver-once-    (forall ((z1 z2 strd) (k skey))-      (implies-        (and (p "dev-up" z1 (idx 2)) (p "dev-up" z2 (idx 2))-          (p "dev-up" "k" z1 k) (p "dev-up" "k" z2 k))-        (= z1 z2))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule shearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule invShearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule trRl_dev-up-at-4-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 4)))))-  (defgenrule trRl_dev-up-at-3-    (forall ((z strd))-      (implies (p "dev-up" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-up-at-2-    (forall ((z strd))-      (implies (p "dev-up" z (idx 4)) (trans z (idx 2)))))-  (defgenrule trRl_dev-up-at-1-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 1)))))-  (defgenrule trRl_dev-open-at-3-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-open-at-2-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 2)))))-  (defgenrule trRl_dev-close-at-3-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-close-at-2-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 2)))))-  (defgenrule eff-dev-up-3-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-up" z (idx 4)) (prec z (idx 3) z1 i))-        (or (= z z1)-          (and (p "dev-up" z (idx 5)) (prec z (idx 4) z1 i))))))-  (defgenrule cau-dev-up-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-up" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1)))))))--(defskeleton open-closed-  (vars (k skey) (d o name) (start-ch chan))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (deflistener k)-  (uniq-orig k)-  (conf start-ch)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv k) (send k)))-  (label 0)-  (unrealized (0 1) (1 0))-  (preskeleton)-  (origs (k (0 0)))-  (comment "Not a skeleton"))--(defskeleton open-closed-  (vars (k skey) (d o name) (start-ch chan))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (deflistener k)-  (precedes ((0 0) (1 0)))-  (uniq-orig k)-  (conf start-ch)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv k) (send k)))-  (label 1)-  (parent 0)-  (unrealized (0 1) (1 0))-  (origs (k (0 0)))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton open-closed-  (vars (old old1 mesg) (k skey) (d o name) (pt pt-0 pt-1 pt-2 pval)-    (start-ch chan) (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (deflistener k)-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (precedes ((0 0) (2 0)) ((2 4) (1 0)))-  (uniq-orig k)-  (conf start-ch)-  (auth start-ch)-  -  (operation nonce-test (added-strand dev-up 5) k (1 0)-    (ch-msg start-ch (cat "power-up" d o k)))-  (strand-map 0 1)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv k) (send k))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt old))-      (load ls (cat pt-0 old1)) (stor ls (cat pt-1 "st" d o))-      (stor lk (cat pt-2 "st-k" d o k))))-  (label 2)-  (parent 1)-  (unrealized (0 1) (1 0))-  (dead)-  (comment "empty cohort"))--(comment "Nothing left to do")--(defprotocol open-closed basic-  (defrole dev-up-    (vars (k skey) (d o name) (old old1 mesg) (start-ch chan)-      (lk ls locn))-    (trace (recv start-ch (cat "power-up" d o k)) (load lk old)-      (load ls old1) (stor ls (cat "st" d o))-      (stor lk (cat "st-k" d o k)) (send (enc "up" k)))-    (auth start-ch))-  (defrole owner-power-dev-    (vars (k skey) (d o name) (start-ch chan))-    (trace (send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    (conf start-ch))-  (defrole owner-open-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "open" d o n k)) (recv n)))-  (defrole owner-close-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "close" d o n k)) (recv n)))-  (defrole dev-open-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "open" d o n k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d o o)) (send n)))-  (defrole dev-close-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "close" d o n k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d o)) (send n)))-  (defrole dev-pass-    (vars (k skey) (n text) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat "st" d o o)) (send (enc "you may pass" n k)))-    (uniq-orig n))-  (defrole user-pass-    (vars (k skey))-    (trace (send (enc "may I pass" k)) (recv (enc "you may pass" k))))-  (defrule gen-state-close-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-close" z (idx 1)) (p "dev-close" "d" z d)-          (p "dev-close" "o" z o) (p "dev-close" "k" z k)-          (p "dev-close" "any" z (cat o o)))-        (gen-st (cat "st" d o o)))))-  (defrule gen-state-pass-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "d" z d)-          (p "dev-pass" "o" z o) (p "dev-pass" "k" z k))-        (gen-st (cat "st" d o o)))))-  (defrule power-deliver-once-    (forall ((z1 z2 strd) (k skey))-      (implies-        (and (p "dev-up" z1 (idx 2)) (p "dev-up" z2 (idx 2))-          (p "dev-up" "k" z1 k) (p "dev-up" "k" z2 k))-        (= z1 z2))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule shearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule invShearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule trRl_dev-up-at-4-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 4)))))-  (defgenrule trRl_dev-up-at-3-    (forall ((z strd))-      (implies (p "dev-up" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-up-at-2-    (forall ((z strd))-      (implies (p "dev-up" z (idx 4)) (trans z (idx 2)))))-  (defgenrule trRl_dev-up-at-1-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 1)))))-  (defgenrule trRl_dev-open-at-3-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-open-at-2-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 2)))))-  (defgenrule trRl_dev-close-at-3-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-close-at-2-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 2)))))-  (defgenrule eff-dev-up-3-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-up" z (idx 4)) (prec z (idx 3) z1 i))-        (or (= z z1)-          (and (p "dev-up" z (idx 5)) (prec z (idx 4) z1 i))))))-  (defgenrule cau-dev-up-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-up" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1)))))))--(defskeleton open-closed-  (vars (k skey) (n text) (d o name) (pt pt-0 pval) (lk ls locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (uniq-orig n)-  (traces-    ((load lk (cat pt "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat pt-0 "st" d o o)) (send (enc "you may pass" n k))))-  (label 3)-  (realized)-  (origs (n (0 3)))-  (comment "Not closed under rules"))--(defskeleton open-closed-  (vars (k skey) (n text) (d o name) (pt pt-0 pval) (lk ls locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (uniq-orig n)-  (gen-st (cat "st" d o o))-  -  (traces-    ((load lk (cat pt "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat pt-0 "st" d o o)) (send (enc "you may pass" n k))))-  (label 4)-  (parent 3)-  (unrealized (0 2))-  (origs (n (0 3)))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton open-closed-  (vars (any mesg) (k k-0 skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pval) (lk ls lk-0 locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k-0) (n n-0) (d d) (o o) (lk lk-0)-    (ls ls))-  (precedes ((1 3) (0 2)))-  (uniq-orig n)-  (gen-st (cat "st" d o o))-  (leads-to ((1 3) (0 2)))-  -  (operation channel-test (added-strand dev-open 4)-    (ch-msg ls (cat pt-0 "st" d o o)) (0 2))-  (strand-map 0)-  (traces-    ((load lk (cat pt "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat pt-0 "st" d o o)) (send (enc "you may pass" n k)))-    ((load lk-0 (cat pt-1 "st-k" d o k-0))-      (recv (enc "open" d o n-0 k-0)) (load ls (cat pt-2 "st" d any))-      (stor ls (cat pt-0 "st" d o o))))-  (label 5)-  (parent 4)-  (realized)-  (shape)-  (maps ((0) ((k k) (n n) (d d) (o o) (lk lk) (ls ls))))-  (origs (pt-0 (1 3)) (n (0 3))))--(comment "Nothing left to do")--(defprotocol open-closed basic-  (defrole dev-up-    (vars (k skey) (d o name) (old old1 mesg) (start-ch chan)-      (lk ls locn))-    (trace (recv start-ch (cat "power-up" d o k)) (load lk old)-      (load ls old1) (stor ls (cat "st" d o))-      (stor lk (cat "st-k" d o k)) (send (enc "up" k)))-    (auth start-ch))-  (defrole owner-power-dev-    (vars (k skey) (d o name) (start-ch chan))-    (trace (send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    (conf start-ch))-  (defrole owner-open-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "open" d o n k)) (recv n)))-  (defrole owner-close-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "close" d o n k)) (recv n)))-  (defrole dev-open-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "open" d o n k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d o o)) (send n)))-  (defrole dev-close-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "close" d o n k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d o)) (send n)))-  (defrole dev-pass-    (vars (k skey) (n text) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat "st" d o o)) (send (enc "you may pass" n k)))-    (uniq-orig n))-  (defrole user-pass-    (vars (k skey))-    (trace (send (enc "may I pass" k)) (recv (enc "you may pass" k))))-  (defrule gen-state-close-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-close" z (idx 1)) (p "dev-close" "d" z d)-          (p "dev-close" "o" z o) (p "dev-close" "k" z k)-          (p "dev-close" "any" z (cat o o)))-        (gen-st (cat "st" d o o)))))-  (defrule gen-state-pass-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "d" z d)-          (p "dev-pass" "o" z o) (p "dev-pass" "k" z k))-        (gen-st (cat "st" d o o)))))-  (defrule power-deliver-once-    (forall ((z1 z2 strd) (k skey))-      (implies-        (and (p "dev-up" z1 (idx 2)) (p "dev-up" z2 (idx 2))-          (p "dev-up" "k" z1 k) (p "dev-up" "k" z2 k))-        (= z1 z2))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule shearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule invShearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule trRl_dev-up-at-4-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 4)))))-  (defgenrule trRl_dev-up-at-3-    (forall ((z strd))-      (implies (p "dev-up" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-up-at-2-    (forall ((z strd))-      (implies (p "dev-up" z (idx 4)) (trans z (idx 2)))))-  (defgenrule trRl_dev-up-at-1-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 1)))))-  (defgenrule trRl_dev-open-at-3-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-open-at-2-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 2)))))-  (defgenrule trRl_dev-close-at-3-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-close-at-2-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 2)))))-  (defgenrule eff-dev-up-3-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-up" z (idx 4)) (prec z (idx 3) z1 i))-        (or (= z z1)-          (and (p "dev-up" z (idx 5)) (prec z (idx 4) z1 i))))))-  (defgenrule cau-dev-up-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-up" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1)))))))--(defskeleton open-closed-  (vars (k skey) (n text) (d o d-0 o-0 name) (pt pt-0 pval)-    (start-ch chan) (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d-0) (o o-0) (lk lk) (ls ls))-  (uniq-orig k n)-  (conf start-ch)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt "st-k" d-0 o-0 k)) (recv (enc "may I pass" k))-      (load ls (cat pt-0 "st" d-0 o-0 o-0))-      (send (enc "you may pass" n k))))-  (label 6)-  (unrealized (0 1) (1 0) (1 1))-  (preskeleton)-  (origs (n (1 3)) (k (0 0)))-  (comment "Not a skeleton"))--(defskeleton open-closed-  (vars (k skey) (n text) (d o d-0 o-0 name) (pt pt-0 pval)-    (start-ch chan) (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d-0) (o o-0) (lk lk) (ls ls))-  (precedes ((0 0) (1 0)))-  (uniq-orig k n)-  (conf start-ch)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt "st-k" d-0 o-0 k)) (recv (enc "may I pass" k))-      (load ls (cat pt-0 "st" d-0 o-0 o-0))-      (send (enc "you may pass" n k))))-  (label 7)-  (parent 6)-  (unrealized (0 1) (1 0) (1 1))-  (origs (n (1 3)) (k (0 0)))-  (comment "Not closed under rules"))--(defskeleton open-closed-  (vars (k skey) (n text) (d o d-0 o-0 name) (pt pt-0 pval)-    (start-ch chan) (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d-0) (o o-0) (lk lk) (ls ls))-  (precedes ((0 0) (1 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d-0 o-0 o-0))-  (conf start-ch)-  -  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt "st-k" d-0 o-0 k)) (recv (enc "may I pass" k))-      (load ls (cat pt-0 "st" d-0 o-0 o-0))-      (send (enc "you may pass" n k))))-  (label 8)-  (parent 7)-  (unrealized (0 1) (1 0) (1 1) (1 2))-  (origs (n (1 3)) (k (0 0)))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton open-closed-  (vars (old old1 mesg) (k skey) (n text) (d o d-0 o-0 name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (start-ch chan)-    (lk ls lk-0 ls-0 locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d-0) (o o-0) (lk lk) (ls ls))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk-0) (ls ls-0))-  (precedes ((0 0) (2 0)) ((2 4) (1 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d-0 o-0 o-0))-  (conf start-ch)-  (auth start-ch)-  -  (operation nonce-test (added-strand dev-up 5) k (1 0)-    (ch-msg start-ch (cat "power-up" d o k)))-  (strand-map 0 1)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt "st-k" d-0 o-0 k)) (recv (enc "may I pass" k))-      (load ls (cat pt-0 "st" d-0 o-0 o-0))-      (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk-0 (cat pt-1 old))-      (load ls-0 (cat pt-2 old1)) (stor ls-0 (cat pt-3 "st" d o))-      (stor lk-0 (cat pt-4 "st-k" d o k))))-  (label 9)-  (parent 8)-  (unrealized (0 1) (1 0) (1 1) (1 2))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton open-closed-  (vars (old old1 mesg) (k skey) (n text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pval) (start-ch chan) (ls lk ls-0 locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls-0))-  (precedes ((0 0) (2 0)) ((2 4) (1 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o))-  (conf start-ch)-  (auth start-ch)-  (leads-to ((2 4) (1 0)))-  -  (operation nonce-test-    (contracted (d-0 d) (o-0 o) (lk-0 lk) (pt-4 pt-3)) k (1 0)-    (ch-msg start-ch (cat "power-up" d o k))-    (ch-msg lk (cat pt-3 "st-k" d o k)))-  (strand-map 0 1 2)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt-3 "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat pt "st" d o o)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (load ls-0 (cat pt-1 old1)) (stor ls-0 (cat pt-2 "st" d o))-      (stor lk (cat pt-3 "st-k" d o k))))-  (label 10)-  (parent 9)-  (unrealized (0 1) (1 1) (1 2))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton open-closed-  (vars (old old1 mesg) (k skey) (n text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pval) (start-ch chan) (ls lk ls-0 locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls-0))-  (defstrand user-pass 1 (k k))-  (precedes ((0 0) (2 0)) ((2 4) (1 0)) ((3 0) (1 1)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o))-  (conf start-ch)-  (auth start-ch)-  (leads-to ((2 4) (1 0)))-  -  (operation encryption-test (added-strand user-pass 1)-    (enc "may I pass" k) (1 1))-  (strand-map 0 1 2)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt-3 "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat pt "st" d o o)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (load ls-0 (cat pt-1 old1)) (stor ls-0 (cat pt-2 "st" d o))-      (stor lk (cat pt-3 "st-k" d o k))) ((send (enc "may I pass" k))))-  (label 11)-  (parent 10)-  (unrealized (0 1) (1 2))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton open-closed-  (vars (old old1 mesg) (k skey) (n text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pval) (start-ch chan) (ls lk ls-0 locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls-0))-  (deflistener k)-  (precedes ((0 0) (2 0)) ((0 0) (3 0)) ((2 4) (1 0)) ((3 1) (1 1)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o))-  (conf start-ch)-  (auth start-ch)-  (leads-to ((2 4) (1 0)))-  -  (operation encryption-test (added-listener k) (enc "may I pass" k)-    (1 1))-  (strand-map 0 1 2)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt-3 "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat pt "st" d o o)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (load ls-0 (cat pt-1 old1)) (stor ls-0 (cat pt-2 "st" d o))-      (stor lk (cat pt-3 "st-k" d o k))) ((recv k) (send k)))-  (label 12)-  (parent 10)-  (seen 14)-  (seen-ops-    (14-      (operation nonce-test (added-strand dev-up 5) k (3 0)-        (ch-msg start-ch (cat "power-up" d o k))) (strand-map 0 1 2 3)))-  (unrealized (0 1) (1 2) (3 0))-  (comment "2 in cohort - 1 not yet seen"))--(defskeleton open-closed-  (vars (old old1 any mesg) (k k-0 skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pt-5 pval) (start-ch chan)-    (ls lk ls-0 lk-0 locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls-0))-  (defstrand user-pass 1 (k k))-  (defstrand dev-open 4 (any any) (k k-0) (n n-0) (d d) (o o) (lk lk-0)-    (ls ls))-  (precedes ((0 0) (2 0)) ((2 4) (1 0)) ((3 0) (1 1)) ((4 3) (1 2)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o))-  (conf start-ch)-  (auth start-ch)-  (leads-to ((2 4) (1 0)) ((4 3) (1 2)))-  -  (operation channel-test (added-strand dev-open 4)-    (ch-msg ls (cat pt "st" d o o)) (1 2))-  (strand-map 0 1 2 3)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt-3 "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat pt "st" d o o)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (load ls-0 (cat pt-1 old1)) (stor ls-0 (cat pt-2 "st" d o))-      (stor lk (cat pt-3 "st-k" d o k))) ((send (enc "may I pass" k)))-    ((load lk-0 (cat pt-4 "st-k" d o k-0))-      (recv (enc "open" d o n-0 k-0)) (load ls (cat pt-5 "st" d any))-      (stor ls (cat pt "st" d o o))))-  (label 13)-  (parent 11)-  (seen 15)-  (seen-ops-    (15-      (operation encryption-test (added-strand dev-up 6) (enc "up" k)-        (0 1)) (strand-map 0 1 4 2 3)))-  (unrealized (0 1))-  (comment "3 in cohort - 2 not yet seen"))--(defskeleton open-closed-  (vars (old old1 mesg) (k skey) (n text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pval) (start-ch chan) (ls lk ls-0 locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls-0))-  (deflistener k)-  (precedes ((0 0) (2 0)) ((2 4) (1 0)) ((2 4) (3 0)) ((3 1) (1 1)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o))-  (conf start-ch)-  (auth start-ch)-  (leads-to ((2 4) (1 0)))-  -  (operation nonce-test (displaced 4 2 dev-up 5) k (3 0)-    (ch-msg start-ch (cat "power-up" d o k)))-  (strand-map 0 1 2 3)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt-3 "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat pt "st" d o o)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (load ls-0 (cat pt-1 old1)) (stor ls-0 (cat pt-2 "st" d o))-      (stor lk (cat pt-3 "st-k" d o k))) ((recv k) (send k)))-  (label 14)-  (parent 12)-  (unrealized (0 1) (1 2) (3 0))-  (dead)-  (comment "empty cohort"))--(defskeleton open-closed-  (vars (any old old1 mesg) (k k-0 skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pt-5 pval) (start-ch chan)-    (ls lk lk-0 ls-0 locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk-0) (ls ls))-  (defstrand user-pass 1 (k k))-  (defstrand dev-open 4 (any any) (k k-0) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand dev-up 6 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk-0) (ls ls-0))-  (precedes ((0 0) (4 0)) ((2 0) (1 1)) ((3 3) (1 2)) ((4 4) (1 0))-    ((4 5) (0 1)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o))-  (conf start-ch)-  (auth start-ch)-  (leads-to ((3 3) (1 2)) ((4 4) (1 0)))-  -  (operation encryption-test (displaced 2 5 dev-up 6) (enc "up" k)-    (0 1))-  (strand-map 0 1 4 2 3)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk-0 (cat pt-5 "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat pt "st" d o o)) (send (enc "you may pass" n k)))-    ((send (enc "may I pass" k)))-    ((load lk (cat pt-0 "st-k" d o k-0)) (recv (enc "open" d o n-0 k-0))-      (load ls (cat pt-1 "st" d any)) (stor ls (cat pt "st" d o o)))-    ((recv start-ch (cat "power-up" d o k)) (load lk-0 (cat pt-2 old))-      (load ls-0 (cat pt-3 old1)) (stor ls-0 (cat pt-4 "st" d o))-      (stor lk-0 (cat pt-5 "st-k" d o k)) (send (enc "up" k))))-  (label 15)-  (parent 13)-  (realized)-  (shape)-  (maps-    ((0 1)-      ((k k) (d d) (o o) (start-ch start-ch) (n n) (d-0 d) (o-0 o)-        (lk lk-0) (ls ls))))-  (origs (pt-4 (4 3)) (pt-5 (4 4)) (pt (3 3)) (n (1 3)) (k (0 0))))--(defskeleton open-closed-  (vars (old old1 any mesg) (k k-0 skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pt-5 pval) (start-ch chan)-    (ls lk ls-0 lk-0 locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls-0))-  (defstrand user-pass 1 (k k))-  (defstrand dev-open 4 (any any) (k k-0) (n n-0) (d d) (o o) (lk lk-0)-    (ls ls))-  (deflistener k)-  (precedes ((0 0) (2 0)) ((0 0) (5 0)) ((2 4) (1 0)) ((3 0) (1 1))-    ((4 3) (1 2)) ((5 1) (0 1)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o))-  (conf start-ch)-  (auth start-ch)-  (leads-to ((2 4) (1 0)) ((4 3) (1 2)))-  -  (operation encryption-test (added-listener k) (enc "up" k) (0 1))-  (strand-map 0 1 2 3 4)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt-3 "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat pt "st" d o o)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (load ls-0 (cat pt-1 old1)) (stor ls-0 (cat pt-2 "st" d o))-      (stor lk (cat pt-3 "st-k" d o k))) ((send (enc "may I pass" k)))-    ((load lk-0 (cat pt-4 "st-k" d o k-0))-      (recv (enc "open" d o n-0 k-0)) (load ls (cat pt-5 "st" d any))-      (stor ls (cat pt "st" d o o))) ((recv k) (send k)))-  (label 16)-  (parent 13)-  (seen 17)-  (seen-ops-    (17-      (operation nonce-test (added-strand dev-up 5) k (5 0)-        (ch-msg start-ch (cat "power-up" d o k)))-      (strand-map 0 1 2 3 4 5)))-  (unrealized (5 0))-  (comment "2 in cohort - 1 not yet seen"))--(defskeleton open-closed-  (vars (old old1 any mesg) (k k-0 skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pt-5 pval) (start-ch chan)-    (ls lk ls-0 lk-0 locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls-0))-  (defstrand user-pass 1 (k k))-  (defstrand dev-open 4 (any any) (k k-0) (n n-0) (d d) (o o) (lk lk-0)-    (ls ls))-  (deflistener k)-  (precedes ((0 0) (2 0)) ((2 4) (1 0)) ((2 4) (5 0)) ((3 0) (1 1))-    ((4 3) (1 2)) ((5 1) (0 1)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o))-  (conf start-ch)-  (auth start-ch)-  (leads-to ((2 4) (1 0)) ((4 3) (1 2)))-  -  (operation nonce-test (displaced 6 2 dev-up 5) k (5 0)-    (ch-msg start-ch (cat "power-up" d o k)))-  (strand-map 0 1 2 3 4 5)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt-3 "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat pt "st" d o o)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (load ls-0 (cat pt-1 old1)) (stor ls-0 (cat pt-2 "st" d o))-      (stor lk (cat pt-3 "st-k" d o k))) ((send (enc "may I pass" k)))-    ((load lk-0 (cat pt-4 "st-k" d o k-0))-      (recv (enc "open" d o n-0 k-0)) (load ls (cat pt-5 "st" d any))-      (stor ls (cat pt "st" d o o))) ((recv k) (send k)))-  (label 17)-  (parent 16)-  (unrealized (5 0))-  (dead)-  (comment "empty cohort"))--(comment "Nothing left to do")
− tst/defact-open-closed-multiloc_shapes.tst 
@@ -1,494 +0,0 @@-(comment "CPSA 4.4.5")-(comment "Extracted shapes")--(herald open-closed (bound 44))--(comment "CPSA 4.4.5")--(comment "All input read from tst/open-closed-multiloc.scm")--(comment "Strand count bounded at 44")--(defprotocol open-closed basic-  (defrole dev-up-    (vars (k skey) (d o name) (old old1 mesg) (start-ch chan)-      (lk ls locn))-    (trace (recv start-ch (cat "power-up" d o k)) (load lk old)-      (load ls old1) (stor ls (cat "st" d o))-      (stor lk (cat "st-k" d o k)) (send (enc "up" k)))-    (auth start-ch))-  (defrole owner-power-dev-    (vars (k skey) (d o name) (start-ch chan))-    (trace (send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    (conf start-ch))-  (defrole owner-open-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "open" d o n k)) (recv n)))-  (defrole owner-close-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "close" d o n k)) (recv n)))-  (defrole dev-open-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "open" d o n k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d o o)) (send n)))-  (defrole dev-close-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "close" d o n k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d o)) (send n)))-  (defrole dev-pass-    (vars (k skey) (n text) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat "st" d o o)) (send (enc "you may pass" n k)))-    (uniq-orig n))-  (defrole user-pass-    (vars (k skey))-    (trace (send (enc "may I pass" k)) (recv (enc "you may pass" k))))-  (defrule gen-state-close-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-close" z (idx 1)) (p "dev-close" "d" z d)-          (p "dev-close" "o" z o) (p "dev-close" "k" z k)-          (p "dev-close" "any" z (cat o o)))-        (gen-st (cat "st" d o o)))))-  (defrule gen-state-pass-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "d" z d)-          (p "dev-pass" "o" z o) (p "dev-pass" "k" z k))-        (gen-st (cat "st" d o o)))))-  (defrule power-deliver-once-    (forall ((z1 z2 strd) (k skey))-      (implies-        (and (p "dev-up" z1 (idx 2)) (p "dev-up" z2 (idx 2))-          (p "dev-up" "k" z1 k) (p "dev-up" "k" z2 k))-        (= z1 z2))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule shearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule invShearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule trRl_dev-up-at-4-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 4)))))-  (defgenrule trRl_dev-up-at-3-    (forall ((z strd))-      (implies (p "dev-up" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-up-at-2-    (forall ((z strd))-      (implies (p "dev-up" z (idx 4)) (trans z (idx 2)))))-  (defgenrule trRl_dev-up-at-1-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 1)))))-  (defgenrule trRl_dev-open-at-3-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-open-at-2-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 2)))))-  (defgenrule trRl_dev-close-at-3-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-close-at-2-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 2)))))-  (defgenrule eff-dev-up-3-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-up" z (idx 4)) (prec z (idx 3) z1 i))-        (or (= z z1)-          (and (p "dev-up" z (idx 5)) (prec z (idx 4) z1 i))))))-  (defgenrule cau-dev-up-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-up" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1)))))))--(defskeleton open-closed-  (vars (k skey) (d o name) (start-ch chan))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (deflistener k)-  (uniq-orig k)-  (conf start-ch)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv k) (send k)))-  (label 0)-  (unrealized (0 1) (1 0))-  (preskeleton)-  (origs (k (0 0)))-  (comment "Not a skeleton"))--(comment "Nothing left to do")--(defprotocol open-closed basic-  (defrole dev-up-    (vars (k skey) (d o name) (old old1 mesg) (start-ch chan)-      (lk ls locn))-    (trace (recv start-ch (cat "power-up" d o k)) (load lk old)-      (load ls old1) (stor ls (cat "st" d o))-      (stor lk (cat "st-k" d o k)) (send (enc "up" k)))-    (auth start-ch))-  (defrole owner-power-dev-    (vars (k skey) (d o name) (start-ch chan))-    (trace (send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    (conf start-ch))-  (defrole owner-open-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "open" d o n k)) (recv n)))-  (defrole owner-close-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "close" d o n k)) (recv n)))-  (defrole dev-open-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "open" d o n k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d o o)) (send n)))-  (defrole dev-close-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "close" d o n k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d o)) (send n)))-  (defrole dev-pass-    (vars (k skey) (n text) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat "st" d o o)) (send (enc "you may pass" n k)))-    (uniq-orig n))-  (defrole user-pass-    (vars (k skey))-    (trace (send (enc "may I pass" k)) (recv (enc "you may pass" k))))-  (defrule gen-state-close-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-close" z (idx 1)) (p "dev-close" "d" z d)-          (p "dev-close" "o" z o) (p "dev-close" "k" z k)-          (p "dev-close" "any" z (cat o o)))-        (gen-st (cat "st" d o o)))))-  (defrule gen-state-pass-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "d" z d)-          (p "dev-pass" "o" z o) (p "dev-pass" "k" z k))-        (gen-st (cat "st" d o o)))))-  (defrule power-deliver-once-    (forall ((z1 z2 strd) (k skey))-      (implies-        (and (p "dev-up" z1 (idx 2)) (p "dev-up" z2 (idx 2))-          (p "dev-up" "k" z1 k) (p "dev-up" "k" z2 k))-        (= z1 z2))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule shearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule invShearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule trRl_dev-up-at-4-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 4)))))-  (defgenrule trRl_dev-up-at-3-    (forall ((z strd))-      (implies (p "dev-up" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-up-at-2-    (forall ((z strd))-      (implies (p "dev-up" z (idx 4)) (trans z (idx 2)))))-  (defgenrule trRl_dev-up-at-1-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 1)))))-  (defgenrule trRl_dev-open-at-3-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-open-at-2-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 2)))))-  (defgenrule trRl_dev-close-at-3-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-close-at-2-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 2)))))-  (defgenrule eff-dev-up-3-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-up" z (idx 4)) (prec z (idx 3) z1 i))-        (or (= z z1)-          (and (p "dev-up" z (idx 5)) (prec z (idx 4) z1 i))))))-  (defgenrule cau-dev-up-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-up" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1)))))))--(defskeleton open-closed-  (vars (k skey) (n text) (d o name) (pt pt-0 pval) (lk ls locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (uniq-orig n)-  (traces-    ((load lk (cat pt "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat pt-0 "st" d o o)) (send (enc "you may pass" n k))))-  (label 3)-  (realized)-  (origs (n (0 3)))-  (comment "Not closed under rules"))--(defskeleton open-closed-  (vars (any mesg) (k k-0 skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pval) (lk ls lk-0 locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k-0) (n n-0) (d d) (o o) (lk lk-0)-    (ls ls))-  (precedes ((1 3) (0 2)))-  (uniq-orig n)-  (gen-st (cat "st" d o o))-  (leads-to ((1 3) (0 2)))-  (operation channel-test (added-strand dev-open 4)-    (ch-msg ls (cat pt-0 "st" d o o)) (0 2))-  (strand-map 0)-  (traces-    ((load lk (cat pt "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat pt-0 "st" d o o)) (send (enc "you may pass" n k)))-    ((load lk-0 (cat pt-1 "st-k" d o k-0))-      (recv (enc "open" d o n-0 k-0)) (load ls (cat pt-2 "st" d any))-      (stor ls (cat pt-0 "st" d o o))))-  (label 5)-  (parent 3)-  (realized)-  (shape)-  (maps ((0) ((k k) (n n) (d d) (o o) (lk lk) (ls ls))))-  (origs (pt-0 (1 3)) (n (0 3))))--(comment "Nothing left to do")--(defprotocol open-closed basic-  (defrole dev-up-    (vars (k skey) (d o name) (old old1 mesg) (start-ch chan)-      (lk ls locn))-    (trace (recv start-ch (cat "power-up" d o k)) (load lk old)-      (load ls old1) (stor ls (cat "st" d o))-      (stor lk (cat "st-k" d o k)) (send (enc "up" k)))-    (auth start-ch))-  (defrole owner-power-dev-    (vars (k skey) (d o name) (start-ch chan))-    (trace (send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    (conf start-ch))-  (defrole owner-open-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "open" d o n k)) (recv n)))-  (defrole owner-close-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "close" d o n k)) (recv n)))-  (defrole dev-open-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "open" d o n k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d o o)) (send n)))-  (defrole dev-close-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "close" d o n k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d o)) (send n)))-  (defrole dev-pass-    (vars (k skey) (n text) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat "st" d o o)) (send (enc "you may pass" n k)))-    (uniq-orig n))-  (defrole user-pass-    (vars (k skey))-    (trace (send (enc "may I pass" k)) (recv (enc "you may pass" k))))-  (defrule gen-state-close-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-close" z (idx 1)) (p "dev-close" "d" z d)-          (p "dev-close" "o" z o) (p "dev-close" "k" z k)-          (p "dev-close" "any" z (cat o o)))-        (gen-st (cat "st" d o o)))))-  (defrule gen-state-pass-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "d" z d)-          (p "dev-pass" "o" z o) (p "dev-pass" "k" z k))-        (gen-st (cat "st" d o o)))))-  (defrule power-deliver-once-    (forall ((z1 z2 strd) (k skey))-      (implies-        (and (p "dev-up" z1 (idx 2)) (p "dev-up" z2 (idx 2))-          (p "dev-up" "k" z1 k) (p "dev-up" "k" z2 k))-        (= z1 z2))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule shearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule invShearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule trRl_dev-up-at-4-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 4)))))-  (defgenrule trRl_dev-up-at-3-    (forall ((z strd))-      (implies (p "dev-up" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-up-at-2-    (forall ((z strd))-      (implies (p "dev-up" z (idx 4)) (trans z (idx 2)))))-  (defgenrule trRl_dev-up-at-1-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 1)))))-  (defgenrule trRl_dev-open-at-3-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-open-at-2-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 2)))))-  (defgenrule trRl_dev-close-at-3-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-close-at-2-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 2)))))-  (defgenrule eff-dev-up-3-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-up" z (idx 4)) (prec z (idx 3) z1 i))-        (or (= z z1)-          (and (p "dev-up" z (idx 5)) (prec z (idx 4) z1 i))))))-  (defgenrule cau-dev-up-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-up" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1)))))))--(defskeleton open-closed-  (vars (k skey) (n text) (d o d-0 o-0 name) (pt pt-0 pval)-    (start-ch chan) (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d-0) (o o-0) (lk lk) (ls ls))-  (uniq-orig k n)-  (conf start-ch)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt "st-k" d-0 o-0 k)) (recv (enc "may I pass" k))-      (load ls (cat pt-0 "st" d-0 o-0 o-0))-      (send (enc "you may pass" n k))))-  (label 6)-  (unrealized (0 1) (1 0) (1 1))-  (preskeleton)-  (origs (n (1 3)) (k (0 0)))-  (comment "Not a skeleton"))--(defskeleton open-closed-  (vars (any old old1 mesg) (k k-0 skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pt-5 pval) (start-ch chan)-    (ls lk lk-0 ls-0 locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk-0) (ls ls))-  (defstrand user-pass 1 (k k))-  (defstrand dev-open 4 (any any) (k k-0) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand dev-up 6 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk-0) (ls ls-0))-  (precedes ((0 0) (4 0)) ((2 0) (1 1)) ((3 3) (1 2)) ((4 4) (1 0))-    ((4 5) (0 1)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o))-  (conf start-ch)-  (auth start-ch)-  (leads-to ((3 3) (1 2)) ((4 4) (1 0)))-  (operation encryption-test (displaced 2 5 dev-up 6) (enc "up" k)-    (0 1))-  (strand-map 0 1 4 2 3)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk-0 (cat pt-5 "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat pt "st" d o o)) (send (enc "you may pass" n k)))-    ((send (enc "may I pass" k)))-    ((load lk (cat pt-0 "st-k" d o k-0)) (recv (enc "open" d o n-0 k-0))-      (load ls (cat pt-1 "st" d any)) (stor ls (cat pt "st" d o o)))-    ((recv start-ch (cat "power-up" d o k)) (load lk-0 (cat pt-2 old))-      (load ls-0 (cat pt-3 old1)) (stor ls-0 (cat pt-4 "st" d o))-      (stor lk-0 (cat pt-5 "st-k" d o k)) (send (enc "up" k))))-  (label 15)-  (parent 6)-  (realized)-  (shape)-  (maps-    ((0 1)-      ((k k) (d d) (o o) (start-ch start-ch) (n n) (d-0 d) (o-0 o)-        (lk lk-0) (ls ls))))-  (origs (pt-4 (4 3)) (pt-5 (4 4)) (pt (3 3)) (n (1 3)) (k (0 0))))--(comment "Nothing left to do")
− tst/defact-open-closed-tag.tst 
@@ -1,1158 +0,0 @@-(herald open-closed (bound 44))--(comment "CPSA 4.4.5")-(comment "All input read from tst/open-closed-tag.scm")-(comment "Strand count bounded at 44")--(defprotocol open-closed basic-  (defrole dev-up-    (vars (k skey) (d o name) (old old1 mesg) (start-ch chan)-      (lk ls locn))-    (trace (recv start-ch (cat "power-up" d o k)) (load lk old)-      (stor lk (cat "st-k" d o k)) (load ls old1)-      (stor ls (cat "st" d "closed")) (send (enc "up" k)))-    (auth start-ch))-  (defrole owner-power-dev-    (vars (k skey) (d o name) (start-ch chan))-    (trace (send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    (conf start-ch))-  (defrole owner-open-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "open" d o n k)) (recv n)))-  (defrole owner-close-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "close" d o n k)) (recv n)))-  (defrole dev-open-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "open" d o n k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d "opened"))-      (send n)))-  (defrole dev-close-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "close" d o n k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d "closed"))-      (send n)))-  (defrole dev-pass-    (vars (k skey) (n text) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat "st" d "opened")) (send (enc "you may pass" n k)))-    (uniq-orig n))-  (defrole user-pass-    (vars (k skey))-    (trace (send (enc "may I pass" k)) (recv (enc "you may pass" k))))-  (defrule gen-state-close-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-close" z (idx 1)) (p "dev-close" "d" z d)-          (p "dev-close" "o" z o) (p "dev-close" "k" z k)-          (p "dev-close" "any" z "opened"))-        (gen-st (cat "st" d "opened")))))-  (defrule gen-state-pass-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "d" z d)-          (p "dev-pass" "o" z o) (p "dev-pass" "k" z k))-        (gen-st (cat "st" d "opened")))))-  (defrule power-deliver-once-    (forall ((z1 z2 strd) (k skey))-      (implies-        (and (p "dev-up" z1 (idx 2)) (p "dev-up" z2 (idx 2))-          (p "dev-up" "k" z1 k) (p "dev-up" "k" z2 k))-        (= z1 z2))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule discreteAfter-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule discreteBefore-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule trRl_dev-up-at-4-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 4)))))-  (defgenrule trRl_dev-up-at-3-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 3)))))-  (defgenrule trRl_dev-up-at-2-    (forall ((z strd))-      (implies (p "dev-up" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_dev-up-at-1-    (forall ((z strd))-      (implies (p "dev-up" z (idx 3)) (trans z (idx 1)))))-  (defgenrule trRl_dev-open-at-3-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-open-at-2-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 2)))))-  (defgenrule trRl_dev-close-at-3-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-close-at-2-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 2))))))--(defskeleton open-closed-  (vars (k skey) (d o name) (start-ch chan))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (deflistener k)-  (uniq-orig k)-  (conf start-ch)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv k) (send k)))-  (label 0)-  (unrealized (0 1) (1 0))-  (preskeleton)-  (origs (k (0 0)))-  (comment "Not a skeleton"))--(defskeleton open-closed-  (vars (k skey) (d o name) (start-ch chan))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (deflistener k)-  (precedes ((0 0) (1 0)))-  (uniq-orig k)-  (conf start-ch)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv k) (send k)))-  (label 1)-  (parent 0)-  (unrealized (0 1) (1 0))-  (origs (k (0 0)))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton open-closed-  (vars (old mesg) (k skey) (d o name) (pt pt-0 pval) (start-ch chan)-    (lk locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (deflistener k)-  (defstrand dev-up 3 (old old) (k k) (d d) (o o) (start-ch start-ch)-    (lk lk))-  (precedes ((0 0) (2 0)) ((2 2) (1 0)))-  (uniq-orig k)-  (conf start-ch)-  (auth start-ch)-  -  (operation nonce-test (added-strand dev-up 3) k (1 0)-    (ch-msg start-ch (cat "power-up" d o k)))-  (strand-map 0 1)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv k) (send k))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt old))-      (stor lk (cat pt-0 "st-k" d o k))))-  (label 2)-  (parent 1)-  (unrealized (0 1) (1 0))-  (dead)-  (comment "empty cohort"))--(comment "Nothing left to do")--(defprotocol open-closed basic-  (defrole dev-up-    (vars (k skey) (d o name) (old old1 mesg) (start-ch chan)-      (lk ls locn))-    (trace (recv start-ch (cat "power-up" d o k)) (load lk old)-      (stor lk (cat "st-k" d o k)) (load ls old1)-      (stor ls (cat "st" d "closed")) (send (enc "up" k)))-    (auth start-ch))-  (defrole owner-power-dev-    (vars (k skey) (d o name) (start-ch chan))-    (trace (send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    (conf start-ch))-  (defrole owner-open-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "open" d o n k)) (recv n)))-  (defrole owner-close-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "close" d o n k)) (recv n)))-  (defrole dev-open-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "open" d o n k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d "opened"))-      (send n)))-  (defrole dev-close-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "close" d o n k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d "closed"))-      (send n)))-  (defrole dev-pass-    (vars (k skey) (n text) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat "st" d "opened")) (send (enc "you may pass" n k)))-    (uniq-orig n))-  (defrole user-pass-    (vars (k skey))-    (trace (send (enc "may I pass" k)) (recv (enc "you may pass" k))))-  (defrule gen-state-close-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-close" z (idx 1)) (p "dev-close" "d" z d)-          (p "dev-close" "o" z o) (p "dev-close" "k" z k)-          (p "dev-close" "any" z "opened"))-        (gen-st (cat "st" d "opened")))))-  (defrule gen-state-pass-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "d" z d)-          (p "dev-pass" "o" z o) (p "dev-pass" "k" z k))-        (gen-st (cat "st" d "opened")))))-  (defrule power-deliver-once-    (forall ((z1 z2 strd) (k skey))-      (implies-        (and (p "dev-up" z1 (idx 2)) (p "dev-up" z2 (idx 2))-          (p "dev-up" "k" z1 k) (p "dev-up" "k" z2 k))-        (= z1 z2))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule discreteAfter-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule discreteBefore-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule trRl_dev-up-at-4-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 4)))))-  (defgenrule trRl_dev-up-at-3-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 3)))))-  (defgenrule trRl_dev-up-at-2-    (forall ((z strd))-      (implies (p "dev-up" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_dev-up-at-1-    (forall ((z strd))-      (implies (p "dev-up" z (idx 3)) (trans z (idx 1)))))-  (defgenrule trRl_dev-open-at-3-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-open-at-2-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 2)))))-  (defgenrule trRl_dev-close-at-3-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-close-at-2-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 2))))))--(defskeleton open-closed-  (vars (k skey) (n text) (d o name) (pt pt-0 pval) (lk ls locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (uniq-orig n)-  (traces-    ((load lk (cat pt "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat pt-0 "st" d "opened"))-      (send (enc "you may pass" n k))))-  (label 3)-  (realized)-  (origs (n (0 3)))-  (comment "Not closed under rules"))--(defskeleton open-closed-  (vars (k skey) (n text) (d o name) (pt pt-0 pval) (lk ls locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (uniq-orig n)-  (gen-st (cat "st" d "opened"))-  -  (traces-    ((load lk (cat pt "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat pt-0 "st" d "opened"))-      (send (enc "you may pass" n k))))-  (label 4)-  (parent 3)-  (unrealized (0 2))-  (origs (n (0 3)))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton open-closed-  (vars (any mesg) (k k-0 skey) (n n-0 text) (d o o-0 name)-    (pt pt-0 pt-1 pt-2 pval) (lk ls lk-0 locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k-0) (n n-0) (d d) (o o-0)-    (lk lk-0) (ls ls))-  (precedes ((1 3) (0 2)))-  (uniq-orig n)-  (gen-st (cat "st" d "opened"))-  (leads-to ((1 3) (0 2)))-  -  (operation channel-test (added-strand dev-open 4)-    (ch-msg ls (cat pt-0 "st" d "opened")) (0 2))-  (strand-map 0)-  (traces-    ((load lk (cat pt "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat pt-0 "st" d "opened"))-      (send (enc "you may pass" n k)))-    ((load lk-0 (cat pt-1 "st-k" d o-0 k-0))-      (recv (enc "open" d o-0 n-0 k-0)) (load ls (cat pt-2 "st" d any))-      (stor ls (cat pt-0 "st" d "opened"))))-  (label 5)-  (parent 4)-  (realized)-  (shape)-  (maps ((0) ((k k) (n n) (d d) (o o) (lk lk) (ls ls))))-  (origs (pt-0 (1 3)) (n (0 3))))--(comment "Nothing left to do")--(defprotocol open-closed basic-  (defrole dev-up-    (vars (k skey) (d o name) (old old1 mesg) (start-ch chan)-      (lk ls locn))-    (trace (recv start-ch (cat "power-up" d o k)) (load lk old)-      (stor lk (cat "st-k" d o k)) (load ls old1)-      (stor ls (cat "st" d "closed")) (send (enc "up" k)))-    (auth start-ch))-  (defrole owner-power-dev-    (vars (k skey) (d o name) (start-ch chan))-    (trace (send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    (conf start-ch))-  (defrole owner-open-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "open" d o n k)) (recv n)))-  (defrole owner-close-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "close" d o n k)) (recv n)))-  (defrole dev-open-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "open" d o n k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d "opened"))-      (send n)))-  (defrole dev-close-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "close" d o n k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d "closed"))-      (send n)))-  (defrole dev-pass-    (vars (k skey) (n text) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat "st" d "opened")) (send (enc "you may pass" n k)))-    (uniq-orig n))-  (defrole user-pass-    (vars (k skey))-    (trace (send (enc "may I pass" k)) (recv (enc "you may pass" k))))-  (defrule gen-state-close-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-close" z (idx 1)) (p "dev-close" "d" z d)-          (p "dev-close" "o" z o) (p "dev-close" "k" z k)-          (p "dev-close" "any" z "opened"))-        (gen-st (cat "st" d "opened")))))-  (defrule gen-state-pass-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "d" z d)-          (p "dev-pass" "o" z o) (p "dev-pass" "k" z k))-        (gen-st (cat "st" d "opened")))))-  (defrule power-deliver-once-    (forall ((z1 z2 strd) (k skey))-      (implies-        (and (p "dev-up" z1 (idx 2)) (p "dev-up" z2 (idx 2))-          (p "dev-up" "k" z1 k) (p "dev-up" "k" z2 k))-        (= z1 z2))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule discreteAfter-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule discreteBefore-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule trRl_dev-up-at-4-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 4)))))-  (defgenrule trRl_dev-up-at-3-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 3)))))-  (defgenrule trRl_dev-up-at-2-    (forall ((z strd))-      (implies (p "dev-up" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_dev-up-at-1-    (forall ((z strd))-      (implies (p "dev-up" z (idx 3)) (trans z (idx 1)))))-  (defgenrule trRl_dev-open-at-3-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-open-at-2-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 2)))))-  (defgenrule trRl_dev-close-at-3-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-close-at-2-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 2))))))--(defskeleton open-closed-  (vars (k skey) (n text) (d o d-0 o-0 name) (pt pt-0 pval)-    (start-ch chan) (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d-0) (o o-0) (lk lk) (ls ls))-  (uniq-orig k n)-  (conf start-ch)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt "st-k" d-0 o-0 k)) (recv (enc "may I pass" k))-      (load ls (cat pt-0 "st" d-0 "opened"))-      (send (enc "you may pass" n k))))-  (label 6)-  (unrealized (0 1) (1 0) (1 1))-  (preskeleton)-  (origs (n (1 3)) (k (0 0)))-  (comment "Not a skeleton"))--(defskeleton open-closed-  (vars (k skey) (n text) (d o d-0 o-0 name) (pt pt-0 pval)-    (start-ch chan) (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d-0) (o o-0) (lk lk) (ls ls))-  (precedes ((0 0) (1 0)))-  (uniq-orig k n)-  (conf start-ch)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt "st-k" d-0 o-0 k)) (recv (enc "may I pass" k))-      (load ls (cat pt-0 "st" d-0 "opened"))-      (send (enc "you may pass" n k))))-  (label 7)-  (parent 6)-  (unrealized (0 1) (1 0) (1 1))-  (origs (n (1 3)) (k (0 0)))-  (comment "Not closed under rules"))--(defskeleton open-closed-  (vars (k skey) (n text) (d o d-0 o-0 name) (pt pt-0 pval)-    (start-ch chan) (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d-0) (o o-0) (lk lk) (ls ls))-  (precedes ((0 0) (1 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d-0 "opened"))-  (conf start-ch)-  -  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt "st-k" d-0 o-0 k)) (recv (enc "may I pass" k))-      (load ls (cat pt-0 "st" d-0 "opened"))-      (send (enc "you may pass" n k))))-  (label 8)-  (parent 7)-  (unrealized (0 1) (1 0) (1 1) (1 2))-  (origs (n (1 3)) (k (0 0)))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton open-closed-  (vars (old mesg) (k skey) (n text) (d o d-0 o-0 name)-    (pt pt-0 pt-1 pt-2 pval) (start-ch chan) (lk ls lk-0 locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d-0) (o o-0) (lk lk) (ls ls))-  (defstrand dev-up 3 (old old) (k k) (d d) (o o) (start-ch start-ch)-    (lk lk-0))-  (precedes ((0 0) (2 0)) ((2 2) (1 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d-0 "opened"))-  (conf start-ch)-  (auth start-ch)-  -  (operation nonce-test (added-strand dev-up 3) k (1 0)-    (ch-msg start-ch (cat "power-up" d o k)))-  (strand-map 0 1)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt "st-k" d-0 o-0 k)) (recv (enc "may I pass" k))-      (load ls (cat pt-0 "st" d-0 "opened"))-      (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk-0 (cat pt-1 old))-      (stor lk-0 (cat pt-2 "st-k" d o k))))-  (label 9)-  (parent 8)-  (unrealized (0 1) (1 0) (1 1) (1 2))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton open-closed-  (vars (old mesg) (k skey) (n text) (d o name) (pt pt-0 pt-1 pval)-    (start-ch chan) (ls lk locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 3 (old old) (k k) (d d) (o o) (start-ch start-ch)-    (lk lk))-  (precedes ((0 0) (2 0)) ((2 2) (1 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d "opened"))-  (conf start-ch)-  (auth start-ch)-  (leads-to ((2 2) (1 0)))-  -  (operation nonce-test-    (contracted (d-0 d) (o-0 o) (lk-0 lk) (pt-2 pt-1)) k (1 0)-    (ch-msg start-ch (cat "power-up" d o k))-    (ch-msg lk (cat pt-1 "st-k" d o k)))-  (strand-map 0 1 2)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt-1 "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat pt "st" d "opened"))-      (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (stor lk (cat pt-1 "st-k" d o k))))-  (label 10)-  (parent 9)-  (unrealized (0 1) (1 1) (1 2))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton open-closed-  (vars (old mesg) (k skey) (n text) (d o name) (pt pt-0 pt-1 pval)-    (start-ch chan) (ls lk locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 3 (old old) (k k) (d d) (o o) (start-ch start-ch)-    (lk lk))-  (defstrand user-pass 1 (k k))-  (precedes ((0 0) (2 0)) ((2 2) (1 0)) ((3 0) (1 1)))-  (uniq-orig k n)-  (gen-st (cat "st" d "opened"))-  (conf start-ch)-  (auth start-ch)-  (leads-to ((2 2) (1 0)))-  -  (operation encryption-test (added-strand user-pass 1)-    (enc "may I pass" k) (1 1))-  (strand-map 0 1 2)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt-1 "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat pt "st" d "opened"))-      (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (stor lk (cat pt-1 "st-k" d o k))) ((send (enc "may I pass" k))))-  (label 11)-  (parent 10)-  (unrealized (0 1) (1 2))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton open-closed-  (vars (old mesg) (k skey) (n text) (d o name) (pt pt-0 pt-1 pval)-    (start-ch chan) (ls lk locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 3 (old old) (k k) (d d) (o o) (start-ch start-ch)-    (lk lk))-  (deflistener k)-  (precedes ((0 0) (2 0)) ((0 0) (3 0)) ((2 2) (1 0)) ((3 1) (1 1)))-  (uniq-orig k n)-  (gen-st (cat "st" d "opened"))-  (conf start-ch)-  (auth start-ch)-  (leads-to ((2 2) (1 0)))-  -  (operation encryption-test (added-listener k) (enc "may I pass" k)-    (1 1))-  (strand-map 0 1 2)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt-1 "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat pt "st" d "opened"))-      (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (stor lk (cat pt-1 "st-k" d o k))) ((recv k) (send k)))-  (label 12)-  (parent 10)-  (seen 14)-  (seen-ops-    (14-      (operation nonce-test (added-strand dev-up 3) k (3 0)-        (ch-msg start-ch (cat "power-up" d o k))) (strand-map 0 1 2 3)))-  (unrealized (0 1) (1 2) (3 0))-  (comment "2 in cohort - 1 not yet seen"))--(defskeleton open-closed-  (vars (old any mesg) (k k-0 skey) (n n-0 text) (d o o-0 name)-    (pt pt-0 pt-1 pt-2 pt-3 pval) (start-ch chan) (ls lk lk-0 locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 3 (old old) (k k) (d d) (o o) (start-ch start-ch)-    (lk lk))-  (defstrand user-pass 1 (k k))-  (defstrand dev-open 4 (any any) (k k-0) (n n-0) (d d) (o o-0)-    (lk lk-0) (ls ls))-  (precedes ((0 0) (2 0)) ((2 2) (1 0)) ((3 0) (1 1)) ((4 3) (1 2)))-  (uniq-orig k n)-  (gen-st (cat "st" d "opened"))-  (conf start-ch)-  (auth start-ch)-  (leads-to ((2 2) (1 0)) ((4 3) (1 2)))-  -  (operation channel-test (added-strand dev-open 4)-    (ch-msg ls (cat pt "st" d "opened")) (1 2))-  (strand-map 0 1 2 3)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt-1 "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat pt "st" d "opened"))-      (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (stor lk (cat pt-1 "st-k" d o k))) ((send (enc "may I pass" k)))-    ((load lk-0 (cat pt-2 "st-k" d o-0 k-0))-      (recv (enc "open" d o-0 n-0 k-0)) (load ls (cat pt-3 "st" d any))-      (stor ls (cat pt "st" d "opened"))))-  (label 13)-  (parent 11)-  (seen 15)-  (seen-ops-    (15-      (operation encryption-test (added-strand dev-up 6) (enc "up" k)-        (0 1)) (strand-map 0 1 4 2 3)))-  (unrealized (0 1))-  (comment "3 in cohort - 2 not yet seen"))--(defskeleton open-closed-  (vars (old mesg) (k skey) (n text) (d o name) (pt pt-0 pt-1 pval)-    (start-ch chan) (ls lk locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 3 (old old) (k k) (d d) (o o) (start-ch start-ch)-    (lk lk))-  (deflistener k)-  (precedes ((0 0) (2 0)) ((2 2) (1 0)) ((2 2) (3 0)) ((3 1) (1 1)))-  (uniq-orig k n)-  (gen-st (cat "st" d "opened"))-  (conf start-ch)-  (auth start-ch)-  (leads-to ((2 2) (1 0)))-  -  (operation nonce-test (displaced 4 2 dev-up 3) k (3 0)-    (ch-msg start-ch (cat "power-up" d o k)))-  (strand-map 0 1 2 3)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt-1 "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat pt "st" d "opened"))-      (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (stor lk (cat pt-1 "st-k" d o k))) ((recv k) (send k)))-  (label 14)-  (parent 12)-  (unrealized (0 1) (1 2) (3 0))-  (dead)-  (comment "empty cohort"))--(defskeleton open-closed-  (vars (any old old1 mesg) (k k-0 skey) (n n-0 text) (o d o-0 name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pt-5 pval) (start-ch chan)-    (ls lk lk-0 ls-0 locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o-0) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o-0) (lk lk-0) (ls ls))-  (defstrand user-pass 1 (k k))-  (defstrand dev-open 4 (any any) (k k-0) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand dev-up 6 (old old) (old1 old1) (k k) (d d) (o o-0)-    (start-ch start-ch) (lk lk-0) (ls ls-0))-  (precedes ((0 0) (4 0)) ((2 0) (1 1)) ((3 3) (1 2)) ((4 2) (1 0))-    ((4 5) (0 1)))-  (uniq-orig k n)-  (gen-st (cat "st" d "opened"))-  (conf start-ch)-  (auth start-ch)-  (leads-to ((3 3) (1 2)) ((4 2) (1 0)))-  -  (operation encryption-test (displaced 2 5 dev-up 6) (enc "up" k)-    (0 1))-  (strand-map 0 1 4 2 3)-  (traces ((send start-ch (cat "power-up" d o-0 k)) (recv (enc "up" k)))-    ((load lk-0 (cat pt-3 "st-k" d o-0 k)) (recv (enc "may I pass" k))-      (load ls (cat pt "st" d "opened"))-      (send (enc "you may pass" n k))) ((send (enc "may I pass" k)))-    ((load lk (cat pt-0 "st-k" d o k-0)) (recv (enc "open" d o n-0 k-0))-      (load ls (cat pt-1 "st" d any))-      (stor ls (cat pt "st" d "opened")))-    ((recv start-ch (cat "power-up" d o-0 k)) (load lk-0 (cat pt-2 old))-      (stor lk-0 (cat pt-3 "st-k" d o-0 k)) (load ls-0 (cat pt-4 old1))-      (stor ls-0 (cat pt-5 "st" d "closed")) (send (enc "up" k))))-  (label 15)-  (parent 13)-  (realized)-  (shape)-  (maps-    ((0 1)-      ((k k) (d d) (o o-0) (start-ch start-ch) (n n) (d-0 d) (o-0 o-0)-        (lk lk-0) (ls ls))))-  (origs (pt-3 (4 2)) (pt-5 (4 4)) (pt (3 3)) (n (1 3)) (k (0 0))))--(defskeleton open-closed-  (vars (old any mesg) (k k-0 skey) (n n-0 text) (d o o-0 name)-    (pt pt-0 pt-1 pt-2 pt-3 pval) (start-ch chan) (ls lk lk-0 locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 3 (old old) (k k) (d d) (o o) (start-ch start-ch)-    (lk lk))-  (defstrand user-pass 1 (k k))-  (defstrand dev-open 4 (any any) (k k-0) (n n-0) (d d) (o o-0)-    (lk lk-0) (ls ls))-  (deflistener k)-  (precedes ((0 0) (2 0)) ((0 0) (5 0)) ((2 2) (1 0)) ((3 0) (1 1))-    ((4 3) (1 2)) ((5 1) (0 1)))-  (uniq-orig k n)-  (gen-st (cat "st" d "opened"))-  (conf start-ch)-  (auth start-ch)-  (leads-to ((2 2) (1 0)) ((4 3) (1 2)))-  -  (operation encryption-test (added-listener k) (enc "up" k) (0 1))-  (strand-map 0 1 2 3 4)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt-1 "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat pt "st" d "opened"))-      (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (stor lk (cat pt-1 "st-k" d o k))) ((send (enc "may I pass" k)))-    ((load lk-0 (cat pt-2 "st-k" d o-0 k-0))-      (recv (enc "open" d o-0 n-0 k-0)) (load ls (cat pt-3 "st" d any))-      (stor ls (cat pt "st" d "opened"))) ((recv k) (send k)))-  (label 16)-  (parent 13)-  (seen 17)-  (seen-ops-    (17-      (operation nonce-test (added-strand dev-up 3) k (5 0)-        (ch-msg start-ch (cat "power-up" d o k)))-      (strand-map 0 1 2 3 4 5)))-  (unrealized (5 0))-  (comment "2 in cohort - 1 not yet seen"))--(defskeleton open-closed-  (vars (old any mesg) (k k-0 skey) (n n-0 text) (d o o-0 name)-    (pt pt-0 pt-1 pt-2 pt-3 pval) (start-ch chan) (ls lk lk-0 locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 3 (old old) (k k) (d d) (o o) (start-ch start-ch)-    (lk lk))-  (defstrand user-pass 1 (k k))-  (defstrand dev-open 4 (any any) (k k-0) (n n-0) (d d) (o o-0)-    (lk lk-0) (ls ls))-  (deflistener k)-  (precedes ((0 0) (2 0)) ((2 2) (1 0)) ((2 2) (5 0)) ((3 0) (1 1))-    ((4 3) (1 2)) ((5 1) (0 1)))-  (uniq-orig k n)-  (gen-st (cat "st" d "opened"))-  (conf start-ch)-  (auth start-ch)-  (leads-to ((2 2) (1 0)) ((4 3) (1 2)))-  -  (operation nonce-test (displaced 6 2 dev-up 3) k (5 0)-    (ch-msg start-ch (cat "power-up" d o k)))-  (strand-map 0 1 2 3 4 5)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt-1 "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat pt "st" d "opened"))-      (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (stor lk (cat pt-1 "st-k" d o k))) ((send (enc "may I pass" k)))-    ((load lk-0 (cat pt-2 "st-k" d o-0 k-0))-      (recv (enc "open" d o-0 n-0 k-0)) (load ls (cat pt-3 "st" d any))-      (stor ls (cat pt "st" d "opened"))) ((recv k) (send k)))-  (label 17)-  (parent 16)-  (unrealized (5 0))-  (dead)-  (comment "empty cohort"))--(comment "Nothing left to do")--(defprotocol open-closed basic-  (defrole dev-up-    (vars (k skey) (d o name) (old old1 mesg) (start-ch chan)-      (lk ls locn))-    (trace (recv start-ch (cat "power-up" d o k)) (load lk old)-      (stor lk (cat "st-k" d o k)) (load ls old1)-      (stor ls (cat "st" d "closed")) (send (enc "up" k)))-    (auth start-ch))-  (defrole owner-power-dev-    (vars (k skey) (d o name) (start-ch chan))-    (trace (send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    (conf start-ch))-  (defrole owner-open-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "open" d o n k)) (recv n)))-  (defrole owner-close-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "close" d o n k)) (recv n)))-  (defrole dev-open-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "open" d o n k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d "opened"))-      (send n)))-  (defrole dev-close-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "close" d o n k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d "closed"))-      (send n)))-  (defrole dev-pass-    (vars (k skey) (n text) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat "st" d "opened")) (send (enc "you may pass" n k)))-    (uniq-orig n))-  (defrole user-pass-    (vars (k skey))-    (trace (send (enc "may I pass" k)) (recv (enc "you may pass" k))))-  (defrule gen-state-close-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-close" z (idx 1)) (p "dev-close" "d" z d)-          (p "dev-close" "o" z o) (p "dev-close" "k" z k)-          (p "dev-close" "any" z "opened"))-        (gen-st (cat "st" d "opened")))))-  (defrule gen-state-pass-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "d" z d)-          (p "dev-pass" "o" z o) (p "dev-pass" "k" z k))-        (gen-st (cat "st" d "opened")))))-  (defrule power-deliver-once-    (forall ((z1 z2 strd) (k skey))-      (implies-        (and (p "dev-up" z1 (idx 2)) (p "dev-up" z2 (idx 2))-          (p "dev-up" "k" z1 k) (p "dev-up" "k" z2 k))-        (= z1 z2))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule discreteAfter-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule discreteBefore-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule trRl_dev-up-at-4-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 4)))))-  (defgenrule trRl_dev-up-at-3-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 3)))))-  (defgenrule trRl_dev-up-at-2-    (forall ((z strd))-      (implies (p "dev-up" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_dev-up-at-1-    (forall ((z strd))-      (implies (p "dev-up" z (idx 3)) (trans z (idx 1)))))-  (defgenrule trRl_dev-open-at-3-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-open-at-2-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 2)))))-  (defgenrule trRl_dev-close-at-3-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-close-at-2-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 2))))))--(defskeleton open-closed-  (vars (old old1 any mesg) (k k-0 skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pt-5 pt-6 pt-7 pval) (start-ch chan)-    (ls lk ls-0 lk-0 locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 6 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls-0))-  (defstrand user-pass 1 (k k))-  (defstrand dev-open 4 (any any) (k k-0) (n n-0) (d d) (o o) (lk lk-0)-    (ls ls))-  (precedes ((0 0) (2 0)) ((2 2) (1 0)) ((2 5) (0 1)) ((3 0) (1 1))-    ((4 3) (1 2)))-  (uniq-orig k n)-  (conf start-ch)-  (auth start-ch)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat pt-0 "st" d "opened"))-      (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-1 old))-      (stor lk (cat pt-2 "st-k" d o k)) (load ls-0 (cat pt-3 old1))-      (stor ls-0 (cat pt-4 "st" d "closed")) (send (enc "up" k)))-    ((send (enc "may I pass" k)))-    ((load lk-0 (cat pt-5 "st-k" d o k-0))-      (recv (enc "open" d o n-0 k-0)) (load ls (cat pt-6 "st" d any))-      (stor ls (cat pt-7 "st" d "opened"))))-  (label 18)-  (unrealized (1 0))-  (origs (pt-7 (4 3)) (pt-4 (2 4)) (pt-2 (2 2)) (n (1 3)) (k (0 0)))-  (comment "Not closed under rules"))--(defskeleton open-closed-  (vars (old old1 any mesg) (k k-0 skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pt-5 pt-6 pt-7 pval) (start-ch chan)-    (ls lk ls-0 lk-0 locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 6 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls-0))-  (defstrand user-pass 1 (k k))-  (defstrand dev-open 4 (any any) (k k-0) (n n-0) (d d) (o o) (lk lk-0)-    (ls ls))-  (precedes ((0 0) (2 0)) ((2 2) (1 0)) ((2 5) (0 1)) ((3 0) (1 1))-    ((4 3) (1 2)))-  (uniq-orig k n)-  (gen-st (cat "st" d "opened"))-  (conf start-ch)-  (auth start-ch)-  -  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat pt-0 "st" d "opened"))-      (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-1 old))-      (stor lk (cat pt-2 "st-k" d o k)) (load ls-0 (cat pt-3 old1))-      (stor ls-0 (cat pt-4 "st" d "closed")) (send (enc "up" k)))-    ((send (enc "may I pass" k)))-    ((load lk-0 (cat pt-5 "st-k" d o k-0))-      (recv (enc "open" d o n-0 k-0)) (load ls (cat pt-6 "st" d any))-      (stor ls (cat pt-7 "st" d "opened"))))-  (label 19)-  (parent 18)-  (unrealized (1 0) (1 2))-  (origs (pt-7 (4 3)) (pt-4 (2 4)) (pt-2 (2 2)) (n (1 3)) (k (0 0)))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton open-closed-  (vars (old old1 any mesg) (k k-0 skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pt-5 pt-6 pval) (start-ch chan)-    (ls lk ls-0 lk-0 locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 6 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls-0))-  (defstrand user-pass 1 (k k))-  (defstrand dev-open 4 (any any) (k k-0) (n n-0) (d d) (o o) (lk lk-0)-    (ls ls))-  (precedes ((0 0) (2 0)) ((2 2) (1 0)) ((2 5) (0 1)) ((3 0) (1 1))-    ((4 3) (1 2)))-  (uniq-orig k n)-  (gen-st (cat "st" d "opened"))-  (conf start-ch)-  (auth start-ch)-  (leads-to ((2 2) (1 0)))-  -  (operation nonce-test (contracted (pt-7 pt-1)) k (1 0)-    (ch-msg start-ch (cat "power-up" d o k))-    (ch-msg lk (cat pt-1 "st-k" d o k)))-  (strand-map 0 1 2 3 4)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt-1 "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat pt "st" d "opened"))-      (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (stor lk (cat pt-1 "st-k" d o k)) (load ls-0 (cat pt-2 old1))-      (stor ls-0 (cat pt-3 "st" d "closed")) (send (enc "up" k)))-    ((send (enc "may I pass" k)))-    ((load lk-0 (cat pt-4 "st-k" d o k-0))-      (recv (enc "open" d o n-0 k-0)) (load ls (cat pt-5 "st" d any))-      (stor ls (cat pt-6 "st" d "opened"))))-  (label 20)-  (parent 19)-  (seen 21)-  (seen-ops-    (21-      (operation channel-test (added-strand dev-open 4)-        (ch-msg ls (cat pt "st" d "opened")) (1 2))-      (strand-map 0 1 2 3 4)))-  (unrealized (1 2))-  (origs (pt-6 (4 3)) (pt-3 (2 4)) (pt-1 (2 2)) (n (1 3)) (k (0 0)))-  (comment "3 in cohort - 2 not yet seen"))--(defskeleton open-closed-  (vars (old old1 any mesg) (k k-0 skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pt-5 pval) (start-ch chan)-    (ls lk ls-0 lk-0 locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 6 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls-0))-  (defstrand user-pass 1 (k k))-  (defstrand dev-open 4 (any any) (k k-0) (n n-0) (d d) (o o) (lk lk-0)-    (ls ls))-  (precedes ((0 0) (2 0)) ((2 2) (1 0)) ((2 5) (0 1)) ((3 0) (1 1))-    ((4 3) (1 2)))-  (uniq-orig k n)-  (gen-st (cat "st" d "opened"))-  (conf start-ch)-  (auth start-ch)-  (leads-to ((2 2) (1 0)) ((4 3) (1 2)))-  -  (operation channel-test (displaced 5 4 dev-open 4)-    (ch-msg ls (cat pt-6 "st" d "opened")) (1 2))-  (strand-map 0 1 2 3 4)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt-0 "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat pt-5 "st" d "opened"))-      (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt old))-      (stor lk (cat pt-0 "st-k" d o k)) (load ls-0 (cat pt-1 old1))-      (stor ls-0 (cat pt-2 "st" d "closed")) (send (enc "up" k)))-    ((send (enc "may I pass" k)))-    ((load lk-0 (cat pt-3 "st-k" d o k-0))-      (recv (enc "open" d o n-0 k-0)) (load ls (cat pt-4 "st" d any))-      (stor ls (cat pt-5 "st" d "opened"))))-  (label 21)-  (parent 20)-  (realized)-  (shape)-  (maps-    ((0 1 2 3 4)-      ((old old) (old1 old1) (any any) (n n) (n-0 n-0) (d d) (o o) (k k)-        (k-0 k-0) (start-ch start-ch) (ls ls) (lk lk) (ls-0 ls-0)-        (lk-0 lk-0))))-  (origs (pt-5 (4 3)) (pt-2 (2 4)) (pt-0 (2 2)) (n (1 3)) (k (0 0))))--(defskeleton open-closed-  (vars (old old1 any any-0 mesg) (k k-0 k-1 skey) (n n-0 n-1 text)-    (d o o-0 name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pt-5 pt-6 pt-7 pt-8 pval)-    (start-ch chan) (ls lk ls-0 lk-0 lk-1 locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 6 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls-0))-  (defstrand user-pass 1 (k k))-  (defstrand dev-open 4 (any any) (k k-0) (n n-0) (d d) (o o) (lk lk-0)-    (ls ls))-  (defstrand dev-open 4 (any any-0) (k k-1) (n n-1) (d d) (o o-0)-    (lk lk-1) (ls ls))-  (precedes ((0 0) (2 0)) ((2 2) (1 0)) ((2 5) (0 1)) ((3 0) (1 1))-    ((4 3) (5 2)) ((5 3) (1 2)))-  (uniq-orig k n)-  (gen-st (cat "st" d "opened"))-  (conf start-ch)-  (auth start-ch)-  (leads-to ((2 2) (1 0)) ((5 3) (1 2)))-  -  (operation channel-test (added-strand dev-open 4)-    (ch-msg ls (cat pt "st" d "opened")) (1 2))-  (strand-map 0 1 2 3 4)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt-1 "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat pt "st" d "opened"))-      (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (stor lk (cat pt-1 "st-k" d o k)) (load ls-0 (cat pt-2 old1))-      (stor ls-0 (cat pt-3 "st" d "closed")) (send (enc "up" k)))-    ((send (enc "may I pass" k)))-    ((load lk-0 (cat pt-4 "st-k" d o k-0))-      (recv (enc "open" d o n-0 k-0)) (load ls (cat pt-5 "st" d any))-      (stor ls (cat pt-6 "st" d "opened")))-    ((load lk-1 (cat pt-7 "st-k" d o-0 k-1))-      (recv (enc "open" d o-0 n-1 k-1))-      (load ls (cat pt-8 "st" d any-0))-      (stor ls (cat pt "st" d "opened"))))-  (label 22)-  (parent 20)-  (seen 21)-  (seen-ops-    (21 (operation generalization weakened ((4 3) (5 2)))-      (strand-map 0 1 2 3 4)))-  (realized)-  (comment "1 in cohort - 0 not yet seen"))--(comment "Nothing left to do")
− tst/defact-open-closed-tag_shapes.tst 
@@ -1,669 +0,0 @@-(comment "CPSA 4.4.5")-(comment "Extracted shapes")--(herald open-closed (bound 44))--(comment "CPSA 4.4.5")--(comment "All input read from tst/open-closed-tag.scm")--(comment "Strand count bounded at 44")--(defprotocol open-closed basic-  (defrole dev-up-    (vars (k skey) (d o name) (old old1 mesg) (start-ch chan)-      (lk ls locn))-    (trace (recv start-ch (cat "power-up" d o k)) (load lk old)-      (stor lk (cat "st-k" d o k)) (load ls old1)-      (stor ls (cat "st" d "closed")) (send (enc "up" k)))-    (auth start-ch))-  (defrole owner-power-dev-    (vars (k skey) (d o name) (start-ch chan))-    (trace (send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    (conf start-ch))-  (defrole owner-open-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "open" d o n k)) (recv n)))-  (defrole owner-close-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "close" d o n k)) (recv n)))-  (defrole dev-open-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "open" d o n k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d "opened"))-      (send n)))-  (defrole dev-close-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "close" d o n k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d "closed"))-      (send n)))-  (defrole dev-pass-    (vars (k skey) (n text) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat "st" d "opened")) (send (enc "you may pass" n k)))-    (uniq-orig n))-  (defrole user-pass-    (vars (k skey))-    (trace (send (enc "may I pass" k)) (recv (enc "you may pass" k))))-  (defrule gen-state-close-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-close" z (idx 1)) (p "dev-close" "d" z d)-          (p "dev-close" "o" z o) (p "dev-close" "k" z k)-          (p "dev-close" "any" z "opened"))-        (gen-st (cat "st" d "opened")))))-  (defrule gen-state-pass-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "d" z d)-          (p "dev-pass" "o" z o) (p "dev-pass" "k" z k))-        (gen-st (cat "st" d "opened")))))-  (defrule power-deliver-once-    (forall ((z1 z2 strd) (k skey))-      (implies-        (and (p "dev-up" z1 (idx 2)) (p "dev-up" z2 (idx 2))-          (p "dev-up" "k" z1 k) (p "dev-up" "k" z2 k))-        (= z1 z2))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule discreteAfter-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule discreteBefore-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule trRl_dev-up-at-4-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 4)))))-  (defgenrule trRl_dev-up-at-3-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 3)))))-  (defgenrule trRl_dev-up-at-2-    (forall ((z strd))-      (implies (p "dev-up" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_dev-up-at-1-    (forall ((z strd))-      (implies (p "dev-up" z (idx 3)) (trans z (idx 1)))))-  (defgenrule trRl_dev-open-at-3-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-open-at-2-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 2)))))-  (defgenrule trRl_dev-close-at-3-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-close-at-2-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 2))))))--(defskeleton open-closed-  (vars (k skey) (d o name) (start-ch chan))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (deflistener k)-  (uniq-orig k)-  (conf start-ch)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv k) (send k)))-  (label 0)-  (unrealized (0 1) (1 0))-  (preskeleton)-  (origs (k (0 0)))-  (comment "Not a skeleton"))--(comment "Nothing left to do")--(defprotocol open-closed basic-  (defrole dev-up-    (vars (k skey) (d o name) (old old1 mesg) (start-ch chan)-      (lk ls locn))-    (trace (recv start-ch (cat "power-up" d o k)) (load lk old)-      (stor lk (cat "st-k" d o k)) (load ls old1)-      (stor ls (cat "st" d "closed")) (send (enc "up" k)))-    (auth start-ch))-  (defrole owner-power-dev-    (vars (k skey) (d o name) (start-ch chan))-    (trace (send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    (conf start-ch))-  (defrole owner-open-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "open" d o n k)) (recv n)))-  (defrole owner-close-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "close" d o n k)) (recv n)))-  (defrole dev-open-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "open" d o n k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d "opened"))-      (send n)))-  (defrole dev-close-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "close" d o n k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d "closed"))-      (send n)))-  (defrole dev-pass-    (vars (k skey) (n text) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat "st" d "opened")) (send (enc "you may pass" n k)))-    (uniq-orig n))-  (defrole user-pass-    (vars (k skey))-    (trace (send (enc "may I pass" k)) (recv (enc "you may pass" k))))-  (defrule gen-state-close-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-close" z (idx 1)) (p "dev-close" "d" z d)-          (p "dev-close" "o" z o) (p "dev-close" "k" z k)-          (p "dev-close" "any" z "opened"))-        (gen-st (cat "st" d "opened")))))-  (defrule gen-state-pass-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "d" z d)-          (p "dev-pass" "o" z o) (p "dev-pass" "k" z k))-        (gen-st (cat "st" d "opened")))))-  (defrule power-deliver-once-    (forall ((z1 z2 strd) (k skey))-      (implies-        (and (p "dev-up" z1 (idx 2)) (p "dev-up" z2 (idx 2))-          (p "dev-up" "k" z1 k) (p "dev-up" "k" z2 k))-        (= z1 z2))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule discreteAfter-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule discreteBefore-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule trRl_dev-up-at-4-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 4)))))-  (defgenrule trRl_dev-up-at-3-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 3)))))-  (defgenrule trRl_dev-up-at-2-    (forall ((z strd))-      (implies (p "dev-up" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_dev-up-at-1-    (forall ((z strd))-      (implies (p "dev-up" z (idx 3)) (trans z (idx 1)))))-  (defgenrule trRl_dev-open-at-3-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-open-at-2-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 2)))))-  (defgenrule trRl_dev-close-at-3-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-close-at-2-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 2))))))--(defskeleton open-closed-  (vars (k skey) (n text) (d o name) (pt pt-0 pval) (lk ls locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (uniq-orig n)-  (traces-    ((load lk (cat pt "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat pt-0 "st" d "opened"))-      (send (enc "you may pass" n k))))-  (label 3)-  (realized)-  (origs (n (0 3)))-  (comment "Not closed under rules"))--(defskeleton open-closed-  (vars (any mesg) (k k-0 skey) (n n-0 text) (d o o-0 name)-    (pt pt-0 pt-1 pt-2 pval) (lk ls lk-0 locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k-0) (n n-0) (d d) (o o-0)-    (lk lk-0) (ls ls))-  (precedes ((1 3) (0 2)))-  (uniq-orig n)-  (gen-st (cat "st" d "opened"))-  (leads-to ((1 3) (0 2)))-  (operation channel-test (added-strand dev-open 4)-    (ch-msg ls (cat pt-0 "st" d "opened")) (0 2))-  (strand-map 0)-  (traces-    ((load lk (cat pt "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat pt-0 "st" d "opened"))-      (send (enc "you may pass" n k)))-    ((load lk-0 (cat pt-1 "st-k" d o-0 k-0))-      (recv (enc "open" d o-0 n-0 k-0)) (load ls (cat pt-2 "st" d any))-      (stor ls (cat pt-0 "st" d "opened"))))-  (label 5)-  (parent 3)-  (realized)-  (shape)-  (maps ((0) ((k k) (n n) (d d) (o o) (lk lk) (ls ls))))-  (origs (pt-0 (1 3)) (n (0 3))))--(comment "Nothing left to do")--(defprotocol open-closed basic-  (defrole dev-up-    (vars (k skey) (d o name) (old old1 mesg) (start-ch chan)-      (lk ls locn))-    (trace (recv start-ch (cat "power-up" d o k)) (load lk old)-      (stor lk (cat "st-k" d o k)) (load ls old1)-      (stor ls (cat "st" d "closed")) (send (enc "up" k)))-    (auth start-ch))-  (defrole owner-power-dev-    (vars (k skey) (d o name) (start-ch chan))-    (trace (send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    (conf start-ch))-  (defrole owner-open-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "open" d o n k)) (recv n)))-  (defrole owner-close-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "close" d o n k)) (recv n)))-  (defrole dev-open-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "open" d o n k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d "opened"))-      (send n)))-  (defrole dev-close-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "close" d o n k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d "closed"))-      (send n)))-  (defrole dev-pass-    (vars (k skey) (n text) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat "st" d "opened")) (send (enc "you may pass" n k)))-    (uniq-orig n))-  (defrole user-pass-    (vars (k skey))-    (trace (send (enc "may I pass" k)) (recv (enc "you may pass" k))))-  (defrule gen-state-close-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-close" z (idx 1)) (p "dev-close" "d" z d)-          (p "dev-close" "o" z o) (p "dev-close" "k" z k)-          (p "dev-close" "any" z "opened"))-        (gen-st (cat "st" d "opened")))))-  (defrule gen-state-pass-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "d" z d)-          (p "dev-pass" "o" z o) (p "dev-pass" "k" z k))-        (gen-st (cat "st" d "opened")))))-  (defrule power-deliver-once-    (forall ((z1 z2 strd) (k skey))-      (implies-        (and (p "dev-up" z1 (idx 2)) (p "dev-up" z2 (idx 2))-          (p "dev-up" "k" z1 k) (p "dev-up" "k" z2 k))-        (= z1 z2))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule discreteAfter-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule discreteBefore-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule trRl_dev-up-at-4-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 4)))))-  (defgenrule trRl_dev-up-at-3-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 3)))))-  (defgenrule trRl_dev-up-at-2-    (forall ((z strd))-      (implies (p "dev-up" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_dev-up-at-1-    (forall ((z strd))-      (implies (p "dev-up" z (idx 3)) (trans z (idx 1)))))-  (defgenrule trRl_dev-open-at-3-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-open-at-2-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 2)))))-  (defgenrule trRl_dev-close-at-3-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-close-at-2-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 2))))))--(defskeleton open-closed-  (vars (k skey) (n text) (d o d-0 o-0 name) (pt pt-0 pval)-    (start-ch chan) (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d-0) (o o-0) (lk lk) (ls ls))-  (uniq-orig k n)-  (conf start-ch)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt "st-k" d-0 o-0 k)) (recv (enc "may I pass" k))-      (load ls (cat pt-0 "st" d-0 "opened"))-      (send (enc "you may pass" n k))))-  (label 6)-  (unrealized (0 1) (1 0) (1 1))-  (preskeleton)-  (origs (n (1 3)) (k (0 0)))-  (comment "Not a skeleton"))--(defskeleton open-closed-  (vars (any old old1 mesg) (k k-0 skey) (n n-0 text) (o d o-0 name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pt-5 pval) (start-ch chan)-    (ls lk lk-0 ls-0 locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o-0) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o-0) (lk lk-0) (ls ls))-  (defstrand user-pass 1 (k k))-  (defstrand dev-open 4 (any any) (k k-0) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand dev-up 6 (old old) (old1 old1) (k k) (d d) (o o-0)-    (start-ch start-ch) (lk lk-0) (ls ls-0))-  (precedes ((0 0) (4 0)) ((2 0) (1 1)) ((3 3) (1 2)) ((4 2) (1 0))-    ((4 5) (0 1)))-  (uniq-orig k n)-  (gen-st (cat "st" d "opened"))-  (conf start-ch)-  (auth start-ch)-  (leads-to ((3 3) (1 2)) ((4 2) (1 0)))-  (operation encryption-test (displaced 2 5 dev-up 6) (enc "up" k)-    (0 1))-  (strand-map 0 1 4 2 3)-  (traces ((send start-ch (cat "power-up" d o-0 k)) (recv (enc "up" k)))-    ((load lk-0 (cat pt-3 "st-k" d o-0 k)) (recv (enc "may I pass" k))-      (load ls (cat pt "st" d "opened"))-      (send (enc "you may pass" n k))) ((send (enc "may I pass" k)))-    ((load lk (cat pt-0 "st-k" d o k-0)) (recv (enc "open" d o n-0 k-0))-      (load ls (cat pt-1 "st" d any))-      (stor ls (cat pt "st" d "opened")))-    ((recv start-ch (cat "power-up" d o-0 k)) (load lk-0 (cat pt-2 old))-      (stor lk-0 (cat pt-3 "st-k" d o-0 k)) (load ls-0 (cat pt-4 old1))-      (stor ls-0 (cat pt-5 "st" d "closed")) (send (enc "up" k))))-  (label 15)-  (parent 6)-  (realized)-  (shape)-  (maps-    ((0 1)-      ((k k) (d d) (o o-0) (start-ch start-ch) (n n) (d-0 d) (o-0 o-0)-        (lk lk-0) (ls ls))))-  (origs (pt-3 (4 2)) (pt-5 (4 4)) (pt (3 3)) (n (1 3)) (k (0 0))))--(comment "Nothing left to do")--(defprotocol open-closed basic-  (defrole dev-up-    (vars (k skey) (d o name) (old old1 mesg) (start-ch chan)-      (lk ls locn))-    (trace (recv start-ch (cat "power-up" d o k)) (load lk old)-      (stor lk (cat "st-k" d o k)) (load ls old1)-      (stor ls (cat "st" d "closed")) (send (enc "up" k)))-    (auth start-ch))-  (defrole owner-power-dev-    (vars (k skey) (d o name) (start-ch chan))-    (trace (send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    (conf start-ch))-  (defrole owner-open-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "open" d o n k)) (recv n)))-  (defrole owner-close-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "close" d o n k)) (recv n)))-  (defrole dev-open-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "open" d o n k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d "opened"))-      (send n)))-  (defrole dev-close-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "close" d o n k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d "closed"))-      (send n)))-  (defrole dev-pass-    (vars (k skey) (n text) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat "st" d "opened")) (send (enc "you may pass" n k)))-    (uniq-orig n))-  (defrole user-pass-    (vars (k skey))-    (trace (send (enc "may I pass" k)) (recv (enc "you may pass" k))))-  (defrule gen-state-close-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-close" z (idx 1)) (p "dev-close" "d" z d)-          (p "dev-close" "o" z o) (p "dev-close" "k" z k)-          (p "dev-close" "any" z "opened"))-        (gen-st (cat "st" d "opened")))))-  (defrule gen-state-pass-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "d" z d)-          (p "dev-pass" "o" z o) (p "dev-pass" "k" z k))-        (gen-st (cat "st" d "opened")))))-  (defrule power-deliver-once-    (forall ((z1 z2 strd) (k skey))-      (implies-        (and (p "dev-up" z1 (idx 2)) (p "dev-up" z2 (idx 2))-          (p "dev-up" "k" z1 k) (p "dev-up" "k" z2 k))-        (= z1 z2))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule discreteAfter-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule discreteBefore-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule trRl_dev-up-at-4-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 4)))))-  (defgenrule trRl_dev-up-at-3-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 3)))))-  (defgenrule trRl_dev-up-at-2-    (forall ((z strd))-      (implies (p "dev-up" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_dev-up-at-1-    (forall ((z strd))-      (implies (p "dev-up" z (idx 3)) (trans z (idx 1)))))-  (defgenrule trRl_dev-open-at-3-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-open-at-2-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 2)))))-  (defgenrule trRl_dev-close-at-3-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-close-at-2-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 2))))))--(defskeleton open-closed-  (vars (old old1 any mesg) (k k-0 skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pt-5 pt-6 pt-7 pval) (start-ch chan)-    (ls lk ls-0 lk-0 locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 6 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls-0))-  (defstrand user-pass 1 (k k))-  (defstrand dev-open 4 (any any) (k k-0) (n n-0) (d d) (o o) (lk lk-0)-    (ls ls))-  (precedes ((0 0) (2 0)) ((2 2) (1 0)) ((2 5) (0 1)) ((3 0) (1 1))-    ((4 3) (1 2)))-  (uniq-orig k n)-  (conf start-ch)-  (auth start-ch)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat pt-0 "st" d "opened"))-      (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-1 old))-      (stor lk (cat pt-2 "st-k" d o k)) (load ls-0 (cat pt-3 old1))-      (stor ls-0 (cat pt-4 "st" d "closed")) (send (enc "up" k)))-    ((send (enc "may I pass" k)))-    ((load lk-0 (cat pt-5 "st-k" d o k-0))-      (recv (enc "open" d o n-0 k-0)) (load ls (cat pt-6 "st" d any))-      (stor ls (cat pt-7 "st" d "opened"))))-  (label 18)-  (unrealized (1 0))-  (origs (pt-7 (4 3)) (pt-4 (2 4)) (pt-2 (2 2)) (n (1 3)) (k (0 0)))-  (comment "Not closed under rules"))--(defskeleton open-closed-  (vars (old old1 any mesg) (k k-0 skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pt-5 pval) (start-ch chan)-    (ls lk ls-0 lk-0 locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 6 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls-0))-  (defstrand user-pass 1 (k k))-  (defstrand dev-open 4 (any any) (k k-0) (n n-0) (d d) (o o) (lk lk-0)-    (ls ls))-  (precedes ((0 0) (2 0)) ((2 2) (1 0)) ((2 5) (0 1)) ((3 0) (1 1))-    ((4 3) (1 2)))-  (uniq-orig k n)-  (gen-st (cat "st" d "opened"))-  (conf start-ch)-  (auth start-ch)-  (leads-to ((2 2) (1 0)) ((4 3) (1 2)))-  (operation channel-test (displaced 5 4 dev-open 4)-    (ch-msg ls (cat pt-6 "st" d "opened")) (1 2))-  (strand-map 0 1 2 3 4)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt-0 "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat pt-5 "st" d "opened"))-      (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt old))-      (stor lk (cat pt-0 "st-k" d o k)) (load ls-0 (cat pt-1 old1))-      (stor ls-0 (cat pt-2 "st" d "closed")) (send (enc "up" k)))-    ((send (enc "may I pass" k)))-    ((load lk-0 (cat pt-3 "st-k" d o k-0))-      (recv (enc "open" d o n-0 k-0)) (load ls (cat pt-4 "st" d any))-      (stor ls (cat pt-5 "st" d "opened"))))-  (label 21)-  (parent 18)-  (realized)-  (shape)-  (maps-    ((0 1 2 3 4)-      ((old old) (old1 old1) (any any) (n n) (n-0 n-0) (d d) (o o) (k k)-        (k-0 k-0) (start-ch start-ch) (ls ls) (lk lk) (ls-0 ls-0)-        (lk-0 lk-0))))-  (origs (pt-5 (4 3)) (pt-2 (2 4)) (pt-0 (2 2)) (n (1 3)) (k (0 0))))--(comment "Nothing left to do")
− tst/defact-open-closed.tst 
@@ -1,926 +0,0 @@-(herald open-closed (bound 44))--(comment "CPSA 4.4.5")-(comment "All input read from tst/open-closed.scm")-(comment "Strand count bounded at 44")--(defprotocol open-closed basic-  (defrole dev-up-    (vars (k skey) (d o name) (old old1 mesg) (start-ch chan)-      (lk ls locn))-    (trace (recv start-ch (cat "power-up" d o k)) (load lk old)-      (stor lk (cat "st-k" d o k)) (load ls old1)-      (stor ls (cat "st" d o)) (send (enc "up" k)))-    (auth start-ch))-  (defrole owner-power-dev-    (vars (k skey) (d o name) (start-ch chan))-    (trace (send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    (conf start-ch))-  (defrole owner-open-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "open" d o n k)) (recv n)))-  (defrole owner-close-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "close" d o n k)) (recv n)))-  (defrole dev-open-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "open" d o n k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d o o)) (send n)))-  (defrole dev-close-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "close" d o n k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d o)) (send n)))-  (defrole dev-pass-    (vars (k skey) (n text) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat "st" d o o)) (send (enc "you may pass" n k)))-    (uniq-orig n))-  (defrole user-pass-    (vars (k skey))-    (trace (send (enc "may I pass" k)) (recv (enc "you may pass" k))))-  (defrule gen-state-close-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-close" z (idx 1)) (p "dev-close" "d" z d)-          (p "dev-close" "o" z o) (p "dev-close" "k" z k)-          (p "dev-close" "any" z (cat o o)))-        (gen-st (cat "st" d o o)))))-  (defrule gen-state-pass-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "d" z d)-          (p "dev-pass" "o" z o) (p "dev-pass" "k" z k))-        (gen-st (cat "st" d o o)))))-  (defrule power-deliver-once-    (forall ((z1 z2 strd) (k skey))-      (implies-        (and (p "dev-up" z1 (idx 2)) (p "dev-up" z2 (idx 2))-          (p "dev-up" "k" z1 k) (p "dev-up" "k" z2 k))-        (= z2 z1))))-  (defrule same-locn-    (forall ((z1 z2 strd) (i1 i2 indx))-      (implies (same-locn z1 i1 z2 i2) (fact ha z1 i1 z2 i2)))-    (comment this is a rule comment))-  (defrule leadsto-la-    (forall ((z1 z2 strd) (i1 i2 indx))-      (implies (leads-to z1 i1 z2 i2) (fact la z1 i1 z2 i2)))-    (comment this is a rule comment))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule discreteAfter-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule discreteBefore-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule causeRule-    (forall ((z z1 strd) (i j i1 indx))-      (implies (and (fact st-sg-str z i j) (prec z1 i1 z j))-        (or (= z z1) (prec z1 i1 z i)))))-  (defgenrule effectRule-    (forall ((z z1 strd) (i j i1 indx))-      (implies (and (fact st-sg-str z i j) (prec z i z1 i1))-        (or (= z z1) (prec z j z1 i1)))))-  (defgenrule trRl_dev-up-at-4-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 4)))))-  (defgenrule trRl_dev-up-at-3-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 3)))))-  (defgenrule trRl_dev-up-at-2-    (forall ((z strd))-      (implies (p "dev-up" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_dev-up-at-1-    (forall ((z strd))-      (implies (p "dev-up" z (idx 3)) (trans z (idx 1)))))-  (defgenrule trRl_dev-open-at-3-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-open-at-2-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 2)))))-  (defgenrule trRl_dev-close-at-3-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-close-at-2-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 2)))))-  (defgenrule st-sg-dev-up-2-    (forall ((z strd))-      (implies (p "dev-up" z (idx 3))-        (fact st-sg-str z (idx 1) (idx 2)))))-  (defgenrule st-sg-dev-up-4-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5))-        (fact st-sg-str z (idx 3) (idx 4)))))-  (defgenrule st-sg-dev-open-3-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4))-        (fact st-sg-str z (idx 2) (idx 3)))))-  (defgenrule st-sg-dev-close-3-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4))-        (fact st-sg-str z (idx 2) (idx 3))))))--(defskeleton open-closed-  (vars (k skey) (d o name) (start-ch chan))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (deflistener k)-  (uniq-orig k)-  (conf start-ch)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv k) (send k)))-  (label 0)-  (unrealized (0 1) (1 0))-  (preskeleton)-  (origs (k (0 0)))-  (comment "Not a skeleton"))--(defskeleton open-closed-  (vars (k skey) (d o name) (start-ch chan))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (deflistener k)-  (precedes ((0 0) (1 0)))-  (uniq-orig k)-  (conf start-ch)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv k) (send k)))-  (label 1)-  (parent 0)-  (unrealized (0 1) (1 0))-  (origs (k (0 0)))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton open-closed-  (vars (old mesg) (k skey) (d o name) (pt pt-0 pval) (start-ch chan)-    (lk locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (deflistener k)-  (defstrand dev-up 3 (old old) (k k) (d d) (o o) (start-ch start-ch)-    (lk lk))-  (precedes ((0 0) (2 0)) ((2 2) (1 0)))-  (uniq-orig k)-  (conf start-ch)-  (auth start-ch)-  -  -  (operation nonce-test (added-strand dev-up 3) k (1 0)-    (ch-msg start-ch (cat "power-up" d o k)))-  (strand-map 0 1)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv k) (send k))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt old))-      (stor lk (cat pt-0 "st-k" d o k))))-  (label 2)-  (parent 1)-  (unrealized (0 1) (1 0))-  (dead)-  (comment "empty cohort"))--(comment "Nothing left to do")--(defprotocol open-closed basic-  (defrole dev-up-    (vars (k skey) (d o name) (old old1 mesg) (start-ch chan)-      (lk ls locn))-    (trace (recv start-ch (cat "power-up" d o k)) (load lk old)-      (stor lk (cat "st-k" d o k)) (load ls old1)-      (stor ls (cat "st" d o)) (send (enc "up" k)))-    (auth start-ch))-  (defrole owner-power-dev-    (vars (k skey) (d o name) (start-ch chan))-    (trace (send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    (conf start-ch))-  (defrole owner-open-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "open" d o n k)) (recv n)))-  (defrole owner-close-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "close" d o n k)) (recv n)))-  (defrole dev-open-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "open" d o n k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d o o)) (send n)))-  (defrole dev-close-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "close" d o n k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d o)) (send n)))-  (defrole dev-pass-    (vars (k skey) (n text) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat "st" d o o)) (send (enc "you may pass" n k)))-    (uniq-orig n))-  (defrole user-pass-    (vars (k skey))-    (trace (send (enc "may I pass" k)) (recv (enc "you may pass" k))))-  (defrule gen-state-close-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-close" z (idx 1)) (p "dev-close" "d" z d)-          (p "dev-close" "o" z o) (p "dev-close" "k" z k)-          (p "dev-close" "any" z (cat o o)))-        (gen-st (cat "st" d o o)))))-  (defrule gen-state-pass-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "d" z d)-          (p "dev-pass" "o" z o) (p "dev-pass" "k" z k))-        (gen-st (cat "st" d o o)))))-  (defrule power-deliver-once-    (forall ((z1 z2 strd) (k skey))-      (implies-        (and (p "dev-up" z1 (idx 2)) (p "dev-up" z2 (idx 2))-          (p "dev-up" "k" z1 k) (p "dev-up" "k" z2 k))-        (= z2 z1))))-  (defrule same-locn-    (forall ((z1 z2 strd) (i1 i2 indx))-      (implies (same-locn z1 i1 z2 i2) (fact ha z1 i1 z2 i2)))-    (comment this is a rule comment))-  (defrule leadsto-la-    (forall ((z1 z2 strd) (i1 i2 indx))-      (implies (leads-to z1 i1 z2 i2) (fact la z1 i1 z2 i2)))-    (comment this is a rule comment))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule discreteAfter-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule discreteBefore-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule causeRule-    (forall ((z z1 strd) (i j i1 indx))-      (implies (and (fact st-sg-str z i j) (prec z1 i1 z j))-        (or (= z z1) (prec z1 i1 z i)))))-  (defgenrule effectRule-    (forall ((z z1 strd) (i j i1 indx))-      (implies (and (fact st-sg-str z i j) (prec z i z1 i1))-        (or (= z z1) (prec z j z1 i1)))))-  (defgenrule trRl_dev-up-at-4-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 4)))))-  (defgenrule trRl_dev-up-at-3-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 3)))))-  (defgenrule trRl_dev-up-at-2-    (forall ((z strd))-      (implies (p "dev-up" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_dev-up-at-1-    (forall ((z strd))-      (implies (p "dev-up" z (idx 3)) (trans z (idx 1)))))-  (defgenrule trRl_dev-open-at-3-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-open-at-2-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 2)))))-  (defgenrule trRl_dev-close-at-3-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-close-at-2-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 2)))))-  (defgenrule st-sg-dev-up-2-    (forall ((z strd))-      (implies (p "dev-up" z (idx 3))-        (fact st-sg-str z (idx 1) (idx 2)))))-  (defgenrule st-sg-dev-up-4-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5))-        (fact st-sg-str z (idx 3) (idx 4)))))-  (defgenrule st-sg-dev-open-3-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4))-        (fact st-sg-str z (idx 2) (idx 3)))))-  (defgenrule st-sg-dev-close-3-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4))-        (fact st-sg-str z (idx 2) (idx 3))))))--(defskeleton open-closed-  (vars (k skey) (n text) (d o name) (pt pt-0 pval) (lk ls locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (uniq-orig n)-  (traces-    ((load lk (cat pt "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat pt-0 "st" d o o)) (send (enc "you may pass" n k))))-  (label 3)-  (realized)-  (origs (n (0 3)))-  (comment "Not closed under rules"))--(defskeleton open-closed-  (vars (k skey) (n text) (d o name) (pt pt-0 pval) (lk ls locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (uniq-orig n)-  (gen-st (cat "st" d o o))-  -  -  (traces-    ((load lk (cat pt "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat pt-0 "st" d o o)) (send (enc "you may pass" n k))))-  (label 4)-  (parent 3)-  (unrealized (0 2))-  (origs (n (0 3)))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton open-closed-  (vars (any mesg) (k k-0 skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pval) (lk ls lk-0 locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k-0) (n n-0) (d d) (o o) (lk lk-0)-    (ls ls))-  (precedes ((1 3) (0 2)))-  (uniq-orig n)-  (gen-st (cat "st" d o o))-  -  (leads-to ((1 3) (0 2)))-  -  (operation channel-test (added-strand dev-open 4)-    (ch-msg ls (cat pt-0 "st" d o o)) (0 2))-  (strand-map 0)-  (traces-    ((load lk (cat pt "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat pt-0 "st" d o o)) (send (enc "you may pass" n k)))-    ((load lk-0 (cat pt-1 "st-k" d o k-0))-      (recv (enc "open" d o n-0 k-0)) (load ls (cat pt-2 "st" d any))-      (stor ls (cat pt-0 "st" d o o))))-  (label 5)-  (parent 4)-  (realized)-  (shape)-  (maps ((0) ((k k) (n n) (d d) (o o) (lk lk) (ls ls))))-  (origs (pt-0 (1 3)) (n (0 3))))--(comment "Nothing left to do")--(defprotocol open-closed basic-  (defrole dev-up-    (vars (k skey) (d o name) (old old1 mesg) (start-ch chan)-      (lk ls locn))-    (trace (recv start-ch (cat "power-up" d o k)) (load lk old)-      (stor lk (cat "st-k" d o k)) (load ls old1)-      (stor ls (cat "st" d o)) (send (enc "up" k)))-    (auth start-ch))-  (defrole owner-power-dev-    (vars (k skey) (d o name) (start-ch chan))-    (trace (send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    (conf start-ch))-  (defrole owner-open-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "open" d o n k)) (recv n)))-  (defrole owner-close-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "close" d o n k)) (recv n)))-  (defrole dev-open-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "open" d o n k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d o o)) (send n)))-  (defrole dev-close-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "close" d o n k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d o)) (send n)))-  (defrole dev-pass-    (vars (k skey) (n text) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat "st" d o o)) (send (enc "you may pass" n k)))-    (uniq-orig n))-  (defrole user-pass-    (vars (k skey))-    (trace (send (enc "may I pass" k)) (recv (enc "you may pass" k))))-  (defrule gen-state-close-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-close" z (idx 1)) (p "dev-close" "d" z d)-          (p "dev-close" "o" z o) (p "dev-close" "k" z k)-          (p "dev-close" "any" z (cat o o)))-        (gen-st (cat "st" d o o)))))-  (defrule gen-state-pass-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "d" z d)-          (p "dev-pass" "o" z o) (p "dev-pass" "k" z k))-        (gen-st (cat "st" d o o)))))-  (defrule power-deliver-once-    (forall ((z1 z2 strd) (k skey))-      (implies-        (and (p "dev-up" z1 (idx 2)) (p "dev-up" z2 (idx 2))-          (p "dev-up" "k" z1 k) (p "dev-up" "k" z2 k))-        (= z2 z1))))-  (defrule same-locn-    (forall ((z1 z2 strd) (i1 i2 indx))-      (implies (same-locn z1 i1 z2 i2) (fact ha z1 i1 z2 i2)))-    (comment this is a rule comment))-  (defrule leadsto-la-    (forall ((z1 z2 strd) (i1 i2 indx))-      (implies (leads-to z1 i1 z2 i2) (fact la z1 i1 z2 i2)))-    (comment this is a rule comment))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule discreteAfter-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule discreteBefore-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule causeRule-    (forall ((z z1 strd) (i j i1 indx))-      (implies (and (fact st-sg-str z i j) (prec z1 i1 z j))-        (or (= z z1) (prec z1 i1 z i)))))-  (defgenrule effectRule-    (forall ((z z1 strd) (i j i1 indx))-      (implies (and (fact st-sg-str z i j) (prec z i z1 i1))-        (or (= z z1) (prec z j z1 i1)))))-  (defgenrule trRl_dev-up-at-4-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 4)))))-  (defgenrule trRl_dev-up-at-3-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 3)))))-  (defgenrule trRl_dev-up-at-2-    (forall ((z strd))-      (implies (p "dev-up" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_dev-up-at-1-    (forall ((z strd))-      (implies (p "dev-up" z (idx 3)) (trans z (idx 1)))))-  (defgenrule trRl_dev-open-at-3-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-open-at-2-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 2)))))-  (defgenrule trRl_dev-close-at-3-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-close-at-2-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 2)))))-  (defgenrule st-sg-dev-up-2-    (forall ((z strd))-      (implies (p "dev-up" z (idx 3))-        (fact st-sg-str z (idx 1) (idx 2)))))-  (defgenrule st-sg-dev-up-4-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5))-        (fact st-sg-str z (idx 3) (idx 4)))))-  (defgenrule st-sg-dev-open-3-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4))-        (fact st-sg-str z (idx 2) (idx 3)))))-  (defgenrule st-sg-dev-close-3-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4))-        (fact st-sg-str z (idx 2) (idx 3))))))--(defskeleton open-closed-  (vars (k skey) (n text) (d o d-0 o-0 name) (pt pt-0 pval)-    (start-ch chan) (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d-0) (o o-0) (lk lk) (ls ls))-  (uniq-orig k n)-  (conf start-ch)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt "st-k" d-0 o-0 k)) (recv (enc "may I pass" k))-      (load ls (cat pt-0 "st" d-0 o-0 o-0))-      (send (enc "you may pass" n k))))-  (label 6)-  (unrealized (0 1) (1 0) (1 1))-  (preskeleton)-  (origs (n (1 3)) (k (0 0)))-  (comment "Not a skeleton"))--(defskeleton open-closed-  (vars (k skey) (n text) (d o d-0 o-0 name) (pt pt-0 pval)-    (start-ch chan) (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d-0) (o o-0) (lk lk) (ls ls))-  (precedes ((0 0) (1 0)))-  (uniq-orig k n)-  (conf start-ch)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt "st-k" d-0 o-0 k)) (recv (enc "may I pass" k))-      (load ls (cat pt-0 "st" d-0 o-0 o-0))-      (send (enc "you may pass" n k))))-  (label 7)-  (parent 6)-  (unrealized (0 1) (1 0) (1 1))-  (origs (n (1 3)) (k (0 0)))-  (comment "Not closed under rules"))--(defskeleton open-closed-  (vars (k skey) (n text) (d o d-0 o-0 name) (pt pt-0 pval)-    (start-ch chan) (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d-0) (o o-0) (lk lk) (ls ls))-  (precedes ((0 0) (1 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d-0 o-0 o-0))-  (conf start-ch)-  -  -  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt "st-k" d-0 o-0 k)) (recv (enc "may I pass" k))-      (load ls (cat pt-0 "st" d-0 o-0 o-0))-      (send (enc "you may pass" n k))))-  (label 8)-  (parent 7)-  (unrealized (0 1) (1 0) (1 1) (1 2))-  (origs (n (1 3)) (k (0 0)))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton open-closed-  (vars (old mesg) (k skey) (n text) (d o d-0 o-0 name)-    (pt pt-0 pt-1 pt-2 pval) (start-ch chan) (lk ls lk-0 locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d-0) (o o-0) (lk lk) (ls ls))-  (defstrand dev-up 3 (old old) (k k) (d d) (o o) (start-ch start-ch)-    (lk lk-0))-  (precedes ((0 0) (2 0)) ((2 2) (1 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d-0 o-0 o-0))-  (conf start-ch)-  (auth start-ch)-  -  -  (operation nonce-test (added-strand dev-up 3) k (1 0)-    (ch-msg start-ch (cat "power-up" d o k)))-  (strand-map 0 1)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt "st-k" d-0 o-0 k)) (recv (enc "may I pass" k))-      (load ls (cat pt-0 "st" d-0 o-0 o-0))-      (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk-0 (cat pt-1 old))-      (stor lk-0 (cat pt-2 "st-k" d o k))))-  (label 9)-  (parent 8)-  (unrealized (0 1) (1 0) (1 1) (1 2))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton open-closed-  (vars (old mesg) (k skey) (n text) (d o name) (pt pt-0 pt-1 pval)-    (start-ch chan) (ls lk locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 3 (old old) (k k) (d d) (o o) (start-ch start-ch)-    (lk lk))-  (precedes ((0 0) (2 0)) ((2 2) (1 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o))-  (conf start-ch)-  (auth start-ch)-  -  (leads-to ((2 2) (1 0)))-  -  (operation nonce-test-    (contracted (d-0 d) (o-0 o) (lk-0 lk) (pt-2 pt-1)) k (1 0)-    (ch-msg start-ch (cat "power-up" d o k))-    (ch-msg lk (cat pt-1 "st-k" d o k)))-  (strand-map 0 1 2)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt-1 "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat pt "st" d o o)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (stor lk (cat pt-1 "st-k" d o k))))-  (label 10)-  (parent 9)-  (unrealized (0 1) (1 1) (1 2))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton open-closed-  (vars (old mesg) (k skey) (n text) (d o name) (pt pt-0 pt-1 pval)-    (start-ch chan) (ls lk locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 3 (old old) (k k) (d d) (o o) (start-ch start-ch)-    (lk lk))-  (defstrand user-pass 1 (k k))-  (precedes ((0 0) (2 0)) ((2 2) (1 0)) ((3 0) (1 1)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o))-  (conf start-ch)-  (auth start-ch)-  -  (leads-to ((2 2) (1 0)))-  -  (operation encryption-test (added-strand user-pass 1)-    (enc "may I pass" k) (1 1))-  (strand-map 0 1 2)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt-1 "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat pt "st" d o o)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (stor lk (cat pt-1 "st-k" d o k))) ((send (enc "may I pass" k))))-  (label 11)-  (parent 10)-  (unrealized (0 1) (1 2))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton open-closed-  (vars (old mesg) (k skey) (n text) (d o name) (pt pt-0 pt-1 pval)-    (start-ch chan) (ls lk locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 3 (old old) (k k) (d d) (o o) (start-ch start-ch)-    (lk lk))-  (deflistener k)-  (precedes ((0 0) (2 0)) ((0 0) (3 0)) ((2 2) (1 0)) ((3 1) (1 1)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o))-  (conf start-ch)-  (auth start-ch)-  -  (leads-to ((2 2) (1 0)))-  -  (operation encryption-test (added-listener k) (enc "may I pass" k)-    (1 1))-  (strand-map 0 1 2)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt-1 "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat pt "st" d o o)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (stor lk (cat pt-1 "st-k" d o k))) ((recv k) (send k)))-  (label 12)-  (parent 10)-  (seen 14)-  (seen-ops-    (14-      (operation nonce-test (added-strand dev-up 3) k (3 0)-        (ch-msg start-ch (cat "power-up" d o k))) (strand-map 0 1 2 3)))-  (unrealized (0 1) (1 2) (3 0))-  (comment "2 in cohort - 1 not yet seen"))--(defskeleton open-closed-  (vars (old any mesg) (k k-0 skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pval) (start-ch chan) (ls lk lk-0 locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 3 (old old) (k k) (d d) (o o) (start-ch start-ch)-    (lk lk))-  (defstrand user-pass 1 (k k))-  (defstrand dev-open 4 (any any) (k k-0) (n n-0) (d d) (o o) (lk lk-0)-    (ls ls))-  (precedes ((0 0) (2 0)) ((2 2) (1 0)) ((3 0) (1 1)) ((4 3) (1 2)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o))-  (conf start-ch)-  (auth start-ch)-  -  (leads-to ((2 2) (1 0)) ((4 3) (1 2)))-  -  (operation channel-test (added-strand dev-open 4)-    (ch-msg ls (cat pt "st" d o o)) (1 2))-  (strand-map 0 1 2 3)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt-1 "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat pt "st" d o o)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (stor lk (cat pt-1 "st-k" d o k))) ((send (enc "may I pass" k)))-    ((load lk-0 (cat pt-2 "st-k" d o k-0))-      (recv (enc "open" d o n-0 k-0)) (load ls (cat pt-3 "st" d any))-      (stor ls (cat pt "st" d o o))))-  (label 13)-  (parent 11)-  (seen 15)-  (seen-ops-    (15-      (operation encryption-test (added-strand dev-up 6) (enc "up" k)-        (0 1)) (strand-map 0 1 4 2 3)))-  (unrealized (0 1))-  (comment "3 in cohort - 2 not yet seen"))--(defskeleton open-closed-  (vars (old mesg) (k skey) (n text) (d o name) (pt pt-0 pt-1 pval)-    (start-ch chan) (ls lk locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 3 (old old) (k k) (d d) (o o) (start-ch start-ch)-    (lk lk))-  (deflistener k)-  (precedes ((0 0) (2 0)) ((2 2) (1 0)) ((2 2) (3 0)) ((3 1) (1 1)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o))-  (conf start-ch)-  (auth start-ch)-  -  (leads-to ((2 2) (1 0)))-  -  (operation nonce-test (displaced 4 2 dev-up 3) k (3 0)-    (ch-msg start-ch (cat "power-up" d o k)))-  (strand-map 0 1 2 3)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt-1 "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat pt "st" d o o)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (stor lk (cat pt-1 "st-k" d o k))) ((recv k) (send k)))-  (label 14)-  (parent 12)-  (unrealized (0 1) (1 2) (3 0))-  (dead)-  (comment "empty cohort"))--(defskeleton open-closed-  (vars (any old old1 mesg) (k k-0 skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pt-5 pval) (start-ch chan)-    (ls lk lk-0 ls-0 locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk-0) (ls ls))-  (defstrand user-pass 1 (k k))-  (defstrand dev-open 4 (any any) (k k-0) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand dev-up 6 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk-0) (ls ls-0))-  (precedes ((0 0) (4 0)) ((2 0) (1 1)) ((3 3) (1 2)) ((4 2) (1 0))-    ((4 5) (0 1)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o))-  (conf start-ch)-  (auth start-ch)-  -  (leads-to ((3 3) (1 2)) ((4 2) (1 0)))-  -  (operation encryption-test (displaced 2 5 dev-up 6) (enc "up" k)-    (0 1))-  (strand-map 0 1 4 2 3)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk-0 (cat pt-3 "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat pt "st" d o o)) (send (enc "you may pass" n k)))-    ((send (enc "may I pass" k)))-    ((load lk (cat pt-0 "st-k" d o k-0)) (recv (enc "open" d o n-0 k-0))-      (load ls (cat pt-1 "st" d any)) (stor ls (cat pt "st" d o o)))-    ((recv start-ch (cat "power-up" d o k)) (load lk-0 (cat pt-2 old))-      (stor lk-0 (cat pt-3 "st-k" d o k)) (load ls-0 (cat pt-4 old1))-      (stor ls-0 (cat pt-5 "st" d o)) (send (enc "up" k))))-  (label 15)-  (parent 13)-  (realized)-  (shape)-  (maps-    ((0 1)-      ((k k) (d d) (o o) (start-ch start-ch) (n n) (d-0 d) (o-0 o)-        (lk lk-0) (ls ls))))-  (origs (pt-3 (4 2)) (pt-5 (4 4)) (pt (3 3)) (n (1 3)) (k (0 0))))--(defskeleton open-closed-  (vars (old any mesg) (k k-0 skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pval) (start-ch chan) (ls lk lk-0 locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 3 (old old) (k k) (d d) (o o) (start-ch start-ch)-    (lk lk))-  (defstrand user-pass 1 (k k))-  (defstrand dev-open 4 (any any) (k k-0) (n n-0) (d d) (o o) (lk lk-0)-    (ls ls))-  (deflistener k)-  (precedes ((0 0) (2 0)) ((0 0) (5 0)) ((2 2) (1 0)) ((3 0) (1 1))-    ((4 3) (1 2)) ((5 1) (0 1)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o))-  (conf start-ch)-  (auth start-ch)-  -  (leads-to ((2 2) (1 0)) ((4 3) (1 2)))-  -  (operation encryption-test (added-listener k) (enc "up" k) (0 1))-  (strand-map 0 1 2 3 4)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt-1 "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat pt "st" d o o)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (stor lk (cat pt-1 "st-k" d o k))) ((send (enc "may I pass" k)))-    ((load lk-0 (cat pt-2 "st-k" d o k-0))-      (recv (enc "open" d o n-0 k-0)) (load ls (cat pt-3 "st" d any))-      (stor ls (cat pt "st" d o o))) ((recv k) (send k)))-  (label 16)-  (parent 13)-  (seen 17)-  (seen-ops-    (17-      (operation nonce-test (added-strand dev-up 3) k (5 0)-        (ch-msg start-ch (cat "power-up" d o k)))-      (strand-map 0 1 2 3 4 5)))-  (unrealized (5 0))-  (comment "2 in cohort - 1 not yet seen"))--(defskeleton open-closed-  (vars (old any mesg) (k k-0 skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pval) (start-ch chan) (ls lk lk-0 locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 3 (old old) (k k) (d d) (o o) (start-ch start-ch)-    (lk lk))-  (defstrand user-pass 1 (k k))-  (defstrand dev-open 4 (any any) (k k-0) (n n-0) (d d) (o o) (lk lk-0)-    (ls ls))-  (deflistener k)-  (precedes ((0 0) (2 0)) ((2 2) (1 0)) ((2 2) (5 0)) ((3 0) (1 1))-    ((4 3) (1 2)) ((5 1) (0 1)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o))-  (conf start-ch)-  (auth start-ch)-  -  (leads-to ((2 2) (1 0)) ((4 3) (1 2)))-  -  (operation nonce-test (displaced 6 2 dev-up 3) k (5 0)-    (ch-msg start-ch (cat "power-up" d o k)))-  (strand-map 0 1 2 3 4 5)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt-1 "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat pt "st" d o o)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (stor lk (cat pt-1 "st-k" d o k))) ((send (enc "may I pass" k)))-    ((load lk-0 (cat pt-2 "st-k" d o k-0))-      (recv (enc "open" d o n-0 k-0)) (load ls (cat pt-3 "st" d any))-      (stor ls (cat pt "st" d o o))) ((recv k) (send k)))-  (label 17)-  (parent 16)-  (unrealized (5 0))-  (dead)-  (comment "empty cohort"))--(comment "Nothing left to do")
− tst/defact-open-closed_shapes.tst 
@@ -1,491 +0,0 @@-(comment "CPSA 4.4.5")-(comment "Extracted shapes")--(herald open-closed (bound 44))--(comment "CPSA 4.4.5")--(comment "All input read from tst/open-closed.scm")--(comment "Strand count bounded at 44")--(defprotocol open-closed basic-  (defrole dev-up-    (vars (k skey) (d o name) (old old1 mesg) (start-ch chan)-      (lk ls locn))-    (trace (recv start-ch (cat "power-up" d o k)) (load lk old)-      (stor lk (cat "st-k" d o k)) (load ls old1)-      (stor ls (cat "st" d o)) (send (enc "up" k)))-    (auth start-ch))-  (defrole owner-power-dev-    (vars (k skey) (d o name) (start-ch chan))-    (trace (send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    (conf start-ch))-  (defrole owner-open-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "open" d o n k)) (recv n)))-  (defrole owner-close-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "close" d o n k)) (recv n)))-  (defrole dev-open-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "open" d o n k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d o o)) (send n)))-  (defrole dev-close-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "close" d o n k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d o)) (send n)))-  (defrole dev-pass-    (vars (k skey) (n text) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat "st" d o o)) (send (enc "you may pass" n k)))-    (uniq-orig n))-  (defrole user-pass-    (vars (k skey))-    (trace (send (enc "may I pass" k)) (recv (enc "you may pass" k))))-  (defrule gen-state-close-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-close" z (idx 1)) (p "dev-close" "d" z d)-          (p "dev-close" "o" z o) (p "dev-close" "k" z k)-          (p "dev-close" "any" z (cat o o)))-        (gen-st (cat "st" d o o)))))-  (defrule gen-state-pass-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "d" z d)-          (p "dev-pass" "o" z o) (p "dev-pass" "k" z k))-        (gen-st (cat "st" d o o)))))-  (defrule power-deliver-once-    (forall ((z1 z2 strd) (k skey))-      (implies-        (and (p "dev-up" z1 (idx 2)) (p "dev-up" z2 (idx 2))-          (p "dev-up" "k" z1 k) (p "dev-up" "k" z2 k))-        (= z2 z1))))-  (defrule same-locn-    (forall ((z1 z2 strd) (i1 i2 indx))-      (implies (same-locn z1 i1 z2 i2) (fact ha z1 i1 z2 i2)))-    (comment this is a rule comment))-  (defrule leadsto-la-    (forall ((z1 z2 strd) (i1 i2 indx))-      (implies (leads-to z1 i1 z2 i2) (fact la z1 i1 z2 i2)))-    (comment this is a rule comment))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule shearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule invShearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule trRl_dev-up-at-4-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 4)))))-  (defgenrule trRl_dev-up-at-3-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 3)))))-  (defgenrule trRl_dev-up-at-2-    (forall ((z strd))-      (implies (p "dev-up" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_dev-up-at-1-    (forall ((z strd))-      (implies (p "dev-up" z (idx 3)) (trans z (idx 1)))))-  (defgenrule trRl_dev-open-at-3-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-open-at-2-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 2)))))-  (defgenrule trRl_dev-close-at-3-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-close-at-2-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 2))))))--(defskeleton open-closed-  (vars (k skey) (d o name) (start-ch chan))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (deflistener k)-  (uniq-orig k)-  (conf start-ch)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv k) (send k)))-  (label 0)-  (unrealized (0 1) (1 0))-  (preskeleton)-  (origs (k (0 0)))-  (comment "Not a skeleton"))--(comment "Nothing left to do")--(defprotocol open-closed basic-  (defrole dev-up-    (vars (k skey) (d o name) (old old1 mesg) (start-ch chan)-      (lk ls locn))-    (trace (recv start-ch (cat "power-up" d o k)) (load lk old)-      (stor lk (cat "st-k" d o k)) (load ls old1)-      (stor ls (cat "st" d o)) (send (enc "up" k)))-    (auth start-ch))-  (defrole owner-power-dev-    (vars (k skey) (d o name) (start-ch chan))-    (trace (send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    (conf start-ch))-  (defrole owner-open-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "open" d o n k)) (recv n)))-  (defrole owner-close-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "close" d o n k)) (recv n)))-  (defrole dev-open-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "open" d o n k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d o o)) (send n)))-  (defrole dev-close-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "close" d o n k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d o)) (send n)))-  (defrole dev-pass-    (vars (k skey) (n text) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat "st" d o o)) (send (enc "you may pass" n k)))-    (uniq-orig n))-  (defrole user-pass-    (vars (k skey))-    (trace (send (enc "may I pass" k)) (recv (enc "you may pass" k))))-  (defrule gen-state-close-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-close" z (idx 1)) (p "dev-close" "d" z d)-          (p "dev-close" "o" z o) (p "dev-close" "k" z k)-          (p "dev-close" "any" z (cat o o)))-        (gen-st (cat "st" d o o)))))-  (defrule gen-state-pass-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "d" z d)-          (p "dev-pass" "o" z o) (p "dev-pass" "k" z k))-        (gen-st (cat "st" d o o)))))-  (defrule power-deliver-once-    (forall ((z1 z2 strd) (k skey))-      (implies-        (and (p "dev-up" z1 (idx 2)) (p "dev-up" z2 (idx 2))-          (p "dev-up" "k" z1 k) (p "dev-up" "k" z2 k))-        (= z2 z1))))-  (defrule same-locn-    (forall ((z1 z2 strd) (i1 i2 indx))-      (implies (same-locn z1 i1 z2 i2) (fact ha z1 i1 z2 i2)))-    (comment this is a rule comment))-  (defrule leadsto-la-    (forall ((z1 z2 strd) (i1 i2 indx))-      (implies (leads-to z1 i1 z2 i2) (fact la z1 i1 z2 i2)))-    (comment this is a rule comment))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule shearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule invShearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule trRl_dev-up-at-4-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 4)))))-  (defgenrule trRl_dev-up-at-3-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 3)))))-  (defgenrule trRl_dev-up-at-2-    (forall ((z strd))-      (implies (p "dev-up" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_dev-up-at-1-    (forall ((z strd))-      (implies (p "dev-up" z (idx 3)) (trans z (idx 1)))))-  (defgenrule trRl_dev-open-at-3-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-open-at-2-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 2)))))-  (defgenrule trRl_dev-close-at-3-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-close-at-2-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 2))))))--(defskeleton open-closed-  (vars (k skey) (n text) (d o name) (pt pt-0 pval) (lk ls locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (uniq-orig n)-  (traces-    ((load lk (cat pt "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat pt-0 "st" d o o)) (send (enc "you may pass" n k))))-  (label 3)-  (realized)-  (origs (n (0 3)))-  (comment "Not closed under rules"))--(defskeleton open-closed-  (vars (any mesg) (k k-0 skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pval) (lk ls lk-0 locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k-0) (n n-0) (d d) (o o) (lk lk-0)-    (ls ls))-  (precedes ((1 3) (0 2)))-  (uniq-orig n)-  (gen-st (cat "st" d o o))-  (leads-to ((1 3) (0 2)))-  (operation channel-test (added-strand dev-open 4)-    (ch-msg ls (cat pt-0 "st" d o o)) (0 2))-  (strand-map 0)-  (traces-    ((load lk (cat pt "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat pt-0 "st" d o o)) (send (enc "you may pass" n k)))-    ((load lk-0 (cat pt-1 "st-k" d o k-0))-      (recv (enc "open" d o n-0 k-0)) (load ls (cat pt-2 "st" d any))-      (stor ls (cat pt-0 "st" d o o))))-  (label 5)-  (parent 3)-  (realized)-  (shape)-  (maps ((0) ((k k) (n n) (d d) (o o) (lk lk) (ls ls))))-  (origs (pt-0 (1 3)) (n (0 3))))--(comment "Nothing left to do")--(defprotocol open-closed basic-  (defrole dev-up-    (vars (k skey) (d o name) (old old1 mesg) (start-ch chan)-      (lk ls locn))-    (trace (recv start-ch (cat "power-up" d o k)) (load lk old)-      (stor lk (cat "st-k" d o k)) (load ls old1)-      (stor ls (cat "st" d o)) (send (enc "up" k)))-    (auth start-ch))-  (defrole owner-power-dev-    (vars (k skey) (d o name) (start-ch chan))-    (trace (send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    (conf start-ch))-  (defrole owner-open-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "open" d o n k)) (recv n)))-  (defrole owner-close-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "close" d o n k)) (recv n)))-  (defrole dev-open-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "open" d o n k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d o o)) (send n)))-  (defrole dev-close-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "close" d o n k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d o)) (send n)))-  (defrole dev-pass-    (vars (k skey) (n text) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat "st" d o o)) (send (enc "you may pass" n k)))-    (uniq-orig n))-  (defrole user-pass-    (vars (k skey))-    (trace (send (enc "may I pass" k)) (recv (enc "you may pass" k))))-  (defrule gen-state-close-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-close" z (idx 1)) (p "dev-close" "d" z d)-          (p "dev-close" "o" z o) (p "dev-close" "k" z k)-          (p "dev-close" "any" z (cat o o)))-        (gen-st (cat "st" d o o)))))-  (defrule gen-state-pass-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "d" z d)-          (p "dev-pass" "o" z o) (p "dev-pass" "k" z k))-        (gen-st (cat "st" d o o)))))-  (defrule power-deliver-once-    (forall ((z1 z2 strd) (k skey))-      (implies-        (and (p "dev-up" z1 (idx 2)) (p "dev-up" z2 (idx 2))-          (p "dev-up" "k" z1 k) (p "dev-up" "k" z2 k))-        (= z2 z1))))-  (defrule same-locn-    (forall ((z1 z2 strd) (i1 i2 indx))-      (implies (same-locn z1 i1 z2 i2) (fact ha z1 i1 z2 i2)))-    (comment this is a rule comment))-  (defrule leadsto-la-    (forall ((z1 z2 strd) (i1 i2 indx))-      (implies (leads-to z1 i1 z2 i2) (fact la z1 i1 z2 i2)))-    (comment this is a rule comment))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule shearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule invShearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule trRl_dev-up-at-4-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 4)))))-  (defgenrule trRl_dev-up-at-3-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 3)))))-  (defgenrule trRl_dev-up-at-2-    (forall ((z strd))-      (implies (p "dev-up" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_dev-up-at-1-    (forall ((z strd))-      (implies (p "dev-up" z (idx 3)) (trans z (idx 1)))))-  (defgenrule trRl_dev-open-at-3-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-open-at-2-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 2)))))-  (defgenrule trRl_dev-close-at-3-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-close-at-2-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 2))))))--(defskeleton open-closed-  (vars (k skey) (n text) (d o d-0 o-0 name) (pt pt-0 pval)-    (start-ch chan) (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d-0) (o o-0) (lk lk) (ls ls))-  (uniq-orig k n)-  (conf start-ch)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt "st-k" d-0 o-0 k)) (recv (enc "may I pass" k))-      (load ls (cat pt-0 "st" d-0 o-0 o-0))-      (send (enc "you may pass" n k))))-  (label 6)-  (unrealized (0 1) (1 0) (1 1))-  (preskeleton)-  (origs (n (1 3)) (k (0 0)))-  (comment "Not a skeleton"))--(defskeleton open-closed-  (vars (any old old1 mesg) (k k-0 skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pt-5 pval) (start-ch chan)-    (ls lk lk-0 ls-0 locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk-0) (ls ls))-  (defstrand user-pass 1 (k k))-  (defstrand dev-open 4 (any any) (k k-0) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand dev-up 6 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk-0) (ls ls-0))-  (precedes ((0 0) (4 0)) ((2 0) (1 1)) ((3 3) (1 2)) ((4 2) (1 0))-    ((4 5) (0 1)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o))-  (conf start-ch)-  (auth start-ch)-  (leads-to ((3 3) (1 2)) ((4 2) (1 0)))-  (operation encryption-test (displaced 2 5 dev-up 6) (enc "up" k)-    (0 1))-  (strand-map 0 1 4 2 3)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk-0 (cat pt-3 "st-k" d o k)) (recv (enc "may I pass" k))-      (load ls (cat pt "st" d o o)) (send (enc "you may pass" n k)))-    ((send (enc "may I pass" k)))-    ((load lk (cat pt-0 "st-k" d o k-0)) (recv (enc "open" d o n-0 k-0))-      (load ls (cat pt-1 "st" d any)) (stor ls (cat pt "st" d o o)))-    ((recv start-ch (cat "power-up" d o k)) (load lk-0 (cat pt-2 old))-      (stor lk-0 (cat pt-3 "st-k" d o k)) (load ls-0 (cat pt-4 old1))-      (stor ls-0 (cat pt-5 "st" d o)) (send (enc "up" k))))-  (label 15)-  (parent 6)-  (realized)-  (shape)-  (maps-    ((0 1)-      ((k k) (d d) (o o) (start-ch start-ch) (n n) (d-0 d) (o-0 o)-        (lk lk-0) (ls ls))))-  (origs (pt-3 (4 2)) (pt-5 (4 4)) (pt (3 3)) (n (1 3)) (k (0 0))))--(comment "Nothing left to do")
− tst/defact-subatomic-open-closed-test-genrule.tst 
@@ -1,1722 +0,0 @@-(herald subatomic-open-closed-test-genrule (bound 40))--(comment "CPSA 4.4.5")-(comment-  "All input read from tst/subatomic-open-closed-test-genrule.scm")-(comment "Strand count bounded at 40")--(defprotocol subatomic-open-closed basic-  (defrole dev-up-    (vars (k skey) (d o name) (old old1 mesg) (start-ch chan)-      (lk ls locn))-    (trace (recv start-ch (cat "power-up" d o k)) (load lk old)-      (load ls old1) (stor lk (cat "st-k" d o k))-      (stor ls (cat "st" d o)) (send (enc "up" k)))-    (auth start-ch)-    (critical-sections (1 4))-    )-  (defrole owner-power-dev-    (vars (k skey) (d o name) (start-ch chan))-    (trace (send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    (conf start-ch))-  (defrole owner-open-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "open" d o n k)) (recv n)))-  (defrole owner-close-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "close" d o n k)) (recv n)))-  (defrole dev-open-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (recv (enc "open" d o n k)) (load ls (cat "st" d any))-      (load lk (cat "st-k" d o k)) (stor ls (cat "st" d o o)) (send n))-    (critical-sections (1 3))-    (gen-st (cat "st-k" d o k) (cat "st" d (cat o o)))-    )-  (defrole dev-close-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (recv (enc "close" d o n k)) (load lk (cat "st-k" d o k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d o)) (send n))-    (gen-st (cat "st-k" d o k))-    (critical-sections (1 3))-    )-  (defrole dev-pass-    (vars (k skey) (n text) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (load ls (cat "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    (uniq-orig n)-    (gen-st (cat "st-k" d o k) (cat "st" d (cat o o)))-    (critical-sections (0 1))-    )-  (defrole user-pass-    (vars (k skey))-    (trace (send (enc "may I pass" k)) (recv (enc "you may pass" k))))-  (defrule power-deliver-once-    (forall ((z1 z2 strd) (k skey))-      (implies-        (and (p "dev-up" z1 (idx 2)) (p "dev-up" z2 (idx 2))-          (p "dev-up" "k" z1 k) (p "dev-up" "k" z2 k))-        (= z1 z2))))-  (defrule same-dev-ls-lk-    (forall ((ls lk lk-0 locn))-      (implies-        (and (fact same-dev ls lk) (fact same-dev ls lk-0))-        (= lk lk-0))))-  (defrule same-dev-lk-ls-    (forall ((lk ls ls-0 locn))-      (implies-        (and (fact same-dev ls lk) (fact same-dev ls-0 lk))-        (= ls ls-0))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule discreteAfter-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule discreteBefore-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule fact-dev-up-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-up" z (idx 3)) (p "dev-up" "ls" z ls)-          (p "dev-up" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule fact-dev-open-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-open" z (idx 3)) (p "dev-open" "ls" z ls)-          (p "dev-open" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule fact-dev-close-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-close" z (idx 3)) (p "dev-close" "ls" z ls)-          (p "dev-close" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule fact-dev-pass-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-pass" z (idx 2)) (p "dev-pass" "ls" z ls)-          (p "dev-pass" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule trRl_dev-up-at-4-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 4)))))-  (defgenrule trRl_dev-up-at-3-    (forall ((z strd))-      (implies (p "dev-up" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-up-at-2-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 2)))))-  (defgenrule trRl_dev-up-at-1-    (forall ((z strd))-      (implies (p "dev-up" z (idx 4)) (trans z (idx 1)))))-  (defgenrule trRl_dev-open-at-3-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-open-at-1-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 1)))))-  (defgenrule trRl_dev-close-at-3-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-close-at-2-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 2)))))-  (defgenrule eff-dev-up-3-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-up" z (idx 4)) (prec z (idx 3) z1 i))-        (or (= z z1)-          (and (p "dev-up" z (idx 5)) (prec z (idx 4) z1 i))))))-  (defgenrule cau-dev-up-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-up" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1))))))-  (defgenrule cau-dev-open-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-open" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1))))))-  (defgenrule cau-dev-close-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-close" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1))))))-  (defgenrule cau-dev-pass-1-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-pass" z (idx 2)) (prec z1 i z (idx 1)))-        (or (= z z1) (prec z1 i z (idx 0))))))-  (defgenrule gen-st-dev-open-1-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-open" z (idx 1)) (p "dev-open" "k" z k)-          (p "dev-open" "o" z o) (p "dev-open" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule gen-st-dev-open-0-    (forall ((z strd) (d o name))-      (implies-        (and (p "dev-open" z (idx 1)) (p "dev-open" "o" z o)-          (p "dev-open" "d" z d)) (gen-st (cat "st" d o o)))))-  (defgenrule gen-st-dev-close-0-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-close" z (idx 1)) (p "dev-close" "k" z k)-          (p "dev-close" "o" z o) (p "dev-close" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule gen-st-dev-pass-1-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "k" z k)-          (p "dev-pass" "o" z o) (p "dev-pass" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule gen-st-dev-pass-0-    (forall ((z strd) (d o name))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "o" z o)-          (p "dev-pass" "d" z d)) (gen-st (cat "st" d o o)))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule gen-st-dev-pass-0-    (forall ((z strd) (o d name))-      (implies-        (and (p "dev-pass" z 1) (p "dev-pass" "o" z o)-          (p "dev-pass" "d" z d)) (gen-st (cat "st" d o o)))))-  (defgenrule gen-st-dev-pass-1-    (forall ((z strd) (k skey) (o d name))-      (implies-        (and (p "dev-pass" z 1) (p "dev-pass" "k" z k)-          (p "dev-pass" "o" z o) (p "dev-pass" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule fact-dev-pass-same-dev0-    (forall ((z strd) (ls lk locn))-      (implies-        (and (p "dev-pass" z 2) (p "dev-pass" "ls" z ls)-          (p "dev-pass" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule trRl_dev-close-at-2-    (forall ((z strd)) (implies (p "dev-close" z 3) (trans z 2))))-  (defgenrule trRl_dev-close-at-3-    (forall ((z strd)) (implies (p "dev-close" z 4) (trans z 3))))-  (defgenrule gen-st-dev-close-0-    (forall ((z strd) (k skey) (o d name))-      (implies-        (and (p "dev-close" z 1) (p "dev-close" "k" z k)-          (p "dev-close" "o" z o) (p "dev-close" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule fact-dev-close-same-dev0-    (forall ((z strd) (ls lk locn))-      (implies-        (and (p "dev-close" z 3) (p "dev-close" "ls" z ls)-          (p "dev-close" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule trRl_dev-open-at-1-    (forall ((z strd)) (implies (p "dev-open" z 2) (trans z 1))))-  (defgenrule trRl_dev-open-at-3-    (forall ((z strd)) (implies (p "dev-open" z 4) (trans z 3))))-  (defgenrule gen-st-dev-open-0-    (forall ((z strd) (o d name))-      (implies-        (and (p "dev-open" z 1) (p "dev-open" "o" z o)-          (p "dev-open" "d" z d)) (gen-st (cat "st" d o o)))))-  (defgenrule gen-st-dev-open-1-    (forall ((z strd) (k skey) (o d name))-      (implies-        (and (p "dev-open" z 1) (p "dev-open" "k" z k)-          (p "dev-open" "o" z o) (p "dev-open" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule fact-dev-open-same-dev0-    (forall ((z strd) (ls lk locn))-      (implies-        (and (p "dev-open" z 3) (p "dev-open" "ls" z ls)-          (p "dev-open" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule trRl_dev-up-at-1-    (forall ((z strd)) (implies (p "dev-up" z 2) (trans z 1))))-  (defgenrule trRl_dev-up-at-2-    (forall ((z strd)) (implies (p "dev-up" z 3) (trans z 2))))-  (defgenrule trRl_dev-up-at-3-    (forall ((z strd)) (implies (p "dev-up" z 4) (trans z 3))))-  (defgenrule trRl_dev-up-at-4-    (forall ((z strd)) (implies (p "dev-up" z 5) (trans z 4))))-  (defgenrule fact-dev-up-same-dev0-    (forall ((z strd) (ls lk locn))-      (implies-        (and (p "dev-up" z 3) (p "dev-up" "ls" z ls)-          (p "dev-up" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cau-dev-pass-1-    (forall ((z z1 strd) (i indx))-      (implies (and (p "dev-pass" z 2) (prec z1 i z 1))-        (or (= z z1) (prec z1 i z 0)))))-  (defgenrule cau-dev-close-2-    (forall ((z z1 strd) (i indx))-      (implies (and (p "dev-close" z 3) (prec z1 i z 2))-        (or (= z z1) (prec z1 i z 1)))))-  (defgenrule cau-dev-open-2-    (forall ((z z1 strd) (i indx))-      (implies (and (p "dev-open" z 3) (prec z1 i z 2))-        (or (= z z1) (prec z1 i z 1)))))-  (defgenrule cau-dev-up-2-    (forall ((z z1 strd) (i indx))-      (implies (and (p "dev-up" z 3) (prec z1 i z 2))-        (or (= z z1) (prec z1 i z 1)))))-  (defgenrule eff-dev-up-3-    (forall ((z z1 strd) (i indx))-      (implies (and (p "dev-up" z 4) (prec z 3 z1 i))-        (or (= z z1) (and (p "dev-up" z 5) (prec z 4 z1 i))))))-  (defgenrule invShearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule shearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2))))))--(defskeleton subatomic-open-closed-  (vars (k skey) (d o name) (start-ch chan))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (deflistener k)-  (uniq-orig k)-  (conf start-ch)-  -  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv k) (send k)))-  (label 0)-  (unrealized (0 1) (1 0))-  (preskeleton)-  (origs (k (0 0)))-  (comment "Not a skeleton"))--(defskeleton subatomic-open-closed-  (vars (k skey) (d o name) (start-ch chan))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (deflistener k)-  (precedes ((0 0) (1 0)))-  (uniq-orig k)-  (conf start-ch)-  -  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv k) (send k)))-  (label 1)-  (parent 0)-  (unrealized (0 1) (1 0))-  (origs (k (0 0)))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 mesg) (k skey) (d o name) (pt pt-0 pt-1 pt-2 pval)-    (start-ch chan) (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (deflistener k)-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (precedes ((0 0) (2 0)) ((2 4) (1 0)))-  (uniq-orig k)-  (conf start-ch)-  (auth start-ch)-  -  -  (operation nonce-test (added-strand dev-up 4) k (1 0)-    (ch-msg start-ch (cat "power-up" d o k)))-  (strand-map 0 1)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv k) (send k))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt old))-      (load ls (cat pt-0 old1)) (stor lk (cat pt-1 "st-k" d o k))-      (stor ls (cat pt-2 "st" d o))))-  (label 2)-  (parent 1)-  (unrealized (0 1) (1 0))-  (dead)-  (comment "empty cohort"))--(comment "Nothing left to do")--(defprotocol subatomic-open-closed basic-  (defrole dev-up-    (vars (k skey) (d o name) (old old1 mesg) (start-ch chan)-      (lk ls locn))-    (trace (recv start-ch (cat "power-up" d o k)) (load lk old)-      (load ls old1) (stor lk (cat "st-k" d o k))-      (stor ls (cat "st" d o)) (send (enc "up" k)))-    (auth start-ch)-    (critical-sections (1 4))-    )-  (defrole owner-power-dev-    (vars (k skey) (d o name) (start-ch chan))-    (trace (send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    (conf start-ch))-  (defrole owner-open-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "open" d o n k)) (recv n)))-  (defrole owner-close-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "close" d o n k)) (recv n)))-  (defrole dev-open-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (recv (enc "open" d o n k)) (load ls (cat "st" d any))-      (load lk (cat "st-k" d o k)) (stor ls (cat "st" d o o)) (send n))-    (critical-sections (1 3))-    (gen-st (cat "st-k" d o k) (cat "st" d (cat o o)))-    )-  (defrole dev-close-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (recv (enc "close" d o n k)) (load lk (cat "st-k" d o k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d o)) (send n))-    (gen-st (cat "st-k" d o k))-    (critical-sections (1 3))-    )-  (defrole dev-pass-    (vars (k skey) (n text) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (load ls (cat "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    (uniq-orig n)-    (gen-st (cat "st-k" d o k) (cat "st" d (cat o o)))-    (critical-sections (0 1))-    )-  (defrole user-pass-    (vars (k skey))-    (trace (send (enc "may I pass" k)) (recv (enc "you may pass" k))))-  (defrule power-deliver-once-    (forall ((z1 z2 strd) (k skey))-      (implies-        (and (p "dev-up" z1 (idx 2)) (p "dev-up" z2 (idx 2))-          (p "dev-up" "k" z1 k) (p "dev-up" "k" z2 k))-        (= z1 z2))))-  (defrule same-dev-ls-lk-    (forall ((ls lk lk-0 locn))-      (implies-        (and (fact same-dev ls lk) (fact same-dev ls lk-0))-        (= lk lk-0))))-  (defrule same-dev-lk-ls-    (forall ((lk ls ls-0 locn))-      (implies-        (and (fact same-dev ls lk) (fact same-dev ls-0 lk))-        (= ls ls-0))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule discreteAfter-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule discreteBefore-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule fact-dev-up-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-up" z (idx 3)) (p "dev-up" "ls" z ls)-          (p "dev-up" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule fact-dev-open-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-open" z (idx 3)) (p "dev-open" "ls" z ls)-          (p "dev-open" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule fact-dev-close-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-close" z (idx 3)) (p "dev-close" "ls" z ls)-          (p "dev-close" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule fact-dev-pass-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-pass" z (idx 2)) (p "dev-pass" "ls" z ls)-          (p "dev-pass" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule trRl_dev-up-at-4-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 4)))))-  (defgenrule trRl_dev-up-at-3-    (forall ((z strd))-      (implies (p "dev-up" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-up-at-2-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 2)))))-  (defgenrule trRl_dev-up-at-1-    (forall ((z strd))-      (implies (p "dev-up" z (idx 4)) (trans z (idx 1)))))-  (defgenrule trRl_dev-open-at-3-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-open-at-1-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 1)))))-  (defgenrule trRl_dev-close-at-3-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-close-at-2-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 2)))))-  (defgenrule eff-dev-up-3-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-up" z (idx 4)) (prec z (idx 3) z1 i))-        (or (= z z1)-          (and (p "dev-up" z (idx 5)) (prec z (idx 4) z1 i))))))-  (defgenrule cau-dev-up-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-up" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1))))))-  (defgenrule cau-dev-open-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-open" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1))))))-  (defgenrule cau-dev-close-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-close" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1))))))-  (defgenrule cau-dev-pass-1-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-pass" z (idx 2)) (prec z1 i z (idx 1)))-        (or (= z z1) (prec z1 i z (idx 0))))))-  (defgenrule gen-st-dev-open-1-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-open" z (idx 1)) (p "dev-open" "k" z k)-          (p "dev-open" "o" z o) (p "dev-open" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule gen-st-dev-open-0-    (forall ((z strd) (d o name))-      (implies-        (and (p "dev-open" z (idx 1)) (p "dev-open" "o" z o)-          (p "dev-open" "d" z d)) (gen-st (cat "st" d o o)))))-  (defgenrule gen-st-dev-close-0-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-close" z (idx 1)) (p "dev-close" "k" z k)-          (p "dev-close" "o" z o) (p "dev-close" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule gen-st-dev-pass-1-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "k" z k)-          (p "dev-pass" "o" z o) (p "dev-pass" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule gen-st-dev-pass-0-    (forall ((z strd) (d o name))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "o" z o)-          (p "dev-pass" "d" z d)) (gen-st (cat "st" d o o)))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule gen-st-dev-pass-0-    (forall ((z strd) (o d name))-      (implies-        (and (p "dev-pass" z 1) (p "dev-pass" "o" z o)-          (p "dev-pass" "d" z d)) (gen-st (cat "st" d o o)))))-  (defgenrule gen-st-dev-pass-1-    (forall ((z strd) (k skey) (o d name))-      (implies-        (and (p "dev-pass" z 1) (p "dev-pass" "k" z k)-          (p "dev-pass" "o" z o) (p "dev-pass" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule fact-dev-pass-same-dev0-    (forall ((z strd) (ls lk locn))-      (implies-        (and (p "dev-pass" z 2) (p "dev-pass" "ls" z ls)-          (p "dev-pass" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule trRl_dev-close-at-2-    (forall ((z strd)) (implies (p "dev-close" z 3) (trans z 2))))-  (defgenrule trRl_dev-close-at-3-    (forall ((z strd)) (implies (p "dev-close" z 4) (trans z 3))))-  (defgenrule gen-st-dev-close-0-    (forall ((z strd) (k skey) (o d name))-      (implies-        (and (p "dev-close" z 1) (p "dev-close" "k" z k)-          (p "dev-close" "o" z o) (p "dev-close" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule fact-dev-close-same-dev0-    (forall ((z strd) (ls lk locn))-      (implies-        (and (p "dev-close" z 3) (p "dev-close" "ls" z ls)-          (p "dev-close" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule trRl_dev-open-at-1-    (forall ((z strd)) (implies (p "dev-open" z 2) (trans z 1))))-  (defgenrule trRl_dev-open-at-3-    (forall ((z strd)) (implies (p "dev-open" z 4) (trans z 3))))-  (defgenrule gen-st-dev-open-0-    (forall ((z strd) (o d name))-      (implies-        (and (p "dev-open" z 1) (p "dev-open" "o" z o)-          (p "dev-open" "d" z d)) (gen-st (cat "st" d o o)))))-  (defgenrule gen-st-dev-open-1-    (forall ((z strd) (k skey) (o d name))-      (implies-        (and (p "dev-open" z 1) (p "dev-open" "k" z k)-          (p "dev-open" "o" z o) (p "dev-open" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule fact-dev-open-same-dev0-    (forall ((z strd) (ls lk locn))-      (implies-        (and (p "dev-open" z 3) (p "dev-open" "ls" z ls)-          (p "dev-open" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule trRl_dev-up-at-1-    (forall ((z strd)) (implies (p "dev-up" z 2) (trans z 1))))-  (defgenrule trRl_dev-up-at-2-    (forall ((z strd)) (implies (p "dev-up" z 3) (trans z 2))))-  (defgenrule trRl_dev-up-at-3-    (forall ((z strd)) (implies (p "dev-up" z 4) (trans z 3))))-  (defgenrule trRl_dev-up-at-4-    (forall ((z strd)) (implies (p "dev-up" z 5) (trans z 4))))-  (defgenrule fact-dev-up-same-dev0-    (forall ((z strd) (ls lk locn))-      (implies-        (and (p "dev-up" z 3) (p "dev-up" "ls" z ls)-          (p "dev-up" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cau-dev-pass-1-    (forall ((z z1 strd) (i indx))-      (implies (and (p "dev-pass" z 2) (prec z1 i z 1))-        (or (= z z1) (prec z1 i z 0)))))-  (defgenrule cau-dev-close-2-    (forall ((z z1 strd) (i indx))-      (implies (and (p "dev-close" z 3) (prec z1 i z 2))-        (or (= z z1) (prec z1 i z 1)))))-  (defgenrule cau-dev-open-2-    (forall ((z z1 strd) (i indx))-      (implies (and (p "dev-open" z 3) (prec z1 i z 2))-        (or (= z z1) (prec z1 i z 1)))))-  (defgenrule cau-dev-up-2-    (forall ((z z1 strd) (i indx))-      (implies (and (p "dev-up" z 3) (prec z1 i z 2))-        (or (= z z1) (prec z1 i z 1)))))-  (defgenrule eff-dev-up-3-    (forall ((z z1 strd) (i indx))-      (implies (and (p "dev-up" z 4) (prec z 3 z1 i))-        (or (= z z1) (and (p "dev-up" z 5) (prec z 4 z1 i))))))-  (defgenrule invShearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule shearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2))))))--(defskeleton subatomic-open-closed-  (vars (k skey) (n text) (d o name) (pt pt-0 pval) (lk ls locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (uniq-orig n)-  -  (traces-    ((load lk (cat pt "st-k" d o k)) (load ls (cat pt-0 "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k))))-  (label 3)-  (realized)-  (origs (n (0 3)))-  (comment "Not closed under rules"))--(defskeleton subatomic-open-closed-  (vars (k skey) (n text) (d o name) (pt pt-0 pval) (lk ls locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (uniq-orig n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  -  -  (traces-    ((load lk (cat pt "st-k" d o k)) (load ls (cat pt-0 "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k))))-  (label 4)-  (parent 3)-  (unrealized (0 0) (0 1))-  (origs (n (0 3)))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 mesg) (k skey) (n text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pval) (start-ch chan) (lk ls locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (precedes ((1 4) (0 0)))-  (uniq-orig n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (auth start-ch)-  -  (leads-to ((1 3) (0 0)))-  -  (operation channel-test (added-strand dev-up 4)-    (ch-msg lk (cat pt-2 "st-k" d o k)) (0 0))-  (strand-map 0)-  (traces-    ((load lk (cat pt-2 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (load ls (cat pt-1 old1)) (stor lk (cat pt-2 "st-k" d o k))-      (stor ls (cat pt-3 "st" d o))))-  (label 5)-  (parent 4)-  (unrealized (0 1) (1 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 mesg) (k skey) (n text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pval) (start-ch chan) (lk ls locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand owner-power-dev 1 (k k) (d d) (o o) (start-ch start-ch))-  (precedes ((1 4) (0 0)) ((2 0) (1 0)))-  (uniq-orig n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  -  (leads-to ((1 3) (0 0)))-  -  (operation channel-test (added-strand owner-power-dev 1)-    (ch-msg start-ch (cat "power-up" d o k)) (1 0))-  (strand-map 0 1)-  (traces-    ((load lk (cat pt-2 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (load ls (cat pt-1 old1)) (stor lk (cat pt-2 "st-k" d o k))-      (stor ls (cat pt-3 "st" d o)))-    ((send start-ch (cat "power-up" d o k))))-  (label 6)-  (parent 5)-  (unrealized (0 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 any mesg) (k k-0 skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pt-5 pval) (start-ch chan)-    (ls lk locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand owner-power-dev 1 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-open 4 (any any) (k k-0) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (precedes ((1 4) (3 1)) ((2 0) (1 0)) ((3 3) (0 0)))-  (uniq-orig n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k) (cat "st-k" d o k-0))-  (conf start-ch)-  (auth start-ch)-  -  (leads-to ((1 3) (0 0)) ((3 3) (0 1)))-  -  (operation channel-test (added-strand dev-open 4)-    (ch-msg ls (cat pt "st" d o o)) (0 1))-  (strand-map 0 1 2)-  (traces-    ((load lk (cat pt-2 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (load ls (cat pt-1 old1)) (stor lk (cat pt-2 "st-k" d o k))-      (stor ls (cat pt-3 "st" d o)))-    ((send start-ch (cat "power-up" d o k)))-    ((recv (enc "open" d o n-0 k-0)) (load ls (cat pt-4 "st" d any))-      (load lk (cat pt-5 "st-k" d o k-0))-      (stor ls (cat pt "st" d o o))))-  (label 7)-  (parent 6)-  (seen 8)-  (seen-ops-    (8-      (operation channel-test (added-strand dev-up 4)-        (ch-msg lk (cat pt-3 "st-k" d o k)) (3 2))-      (strand-map 0 1 2 3)))-  (unrealized (3 2))-  (comment "2 in cohort - 1 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 any mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (start-ch chan) (ls lk locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand owner-power-dev 1 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (precedes ((1 4) (3 1)) ((2 0) (1 0)) ((3 3) (0 0)))-  (uniq-orig n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  -  (leads-to ((1 3) (0 0)) ((1 3) (3 2)) ((3 3) (0 1)))-  -  (operation channel-test (displaced 4 1 dev-up 4)-    (ch-msg lk (cat pt-5 "st-k" d o k-0)) (3 2))-  (strand-map 0 1 2 3)-  (traces-    ((load lk (cat pt-2 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (load ls (cat pt-1 old1)) (stor lk (cat pt-2 "st-k" d o k))-      (stor ls (cat pt-3 "st" d o)))-    ((send start-ch (cat "power-up" d o k)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-4 "st" d any))-      (load lk (cat pt-2 "st-k" d o k)) (stor ls (cat pt "st" d o o))))-  (label 8)-  (parent 7)-  (realized)-  (shape)-  (maps ((0) ((k k) (n n) (d d) (o o) (lk lk) (ls ls))))-  (origs (pt-2 (1 3)) (pt-3 (1 4)) (pt (3 3)) (n (0 3))))--(comment "Nothing left to do")--(defprotocol subatomic-open-closed basic-  (defrole dev-up-    (vars (k skey) (d o name) (old old1 mesg) (start-ch chan)-      (lk ls locn))-    (trace (recv start-ch (cat "power-up" d o k)) (load lk old)-      (load ls old1) (stor lk (cat "st-k" d o k))-      (stor ls (cat "st" d o)) (send (enc "up" k)))-    (auth start-ch)-    (critical-sections (1 4))-    )-  (defrole owner-power-dev-    (vars (k skey) (d o name) (start-ch chan))-    (trace (send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    (conf start-ch))-  (defrole owner-open-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "open" d o n k)) (recv n)))-  (defrole owner-close-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "close" d o n k)) (recv n)))-  (defrole dev-open-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (recv (enc "open" d o n k)) (load ls (cat "st" d any))-      (load lk (cat "st-k" d o k)) (stor ls (cat "st" d o o)) (send n))-    (critical-sections (1 3))-    (gen-st (cat "st-k" d o k) (cat "st" d (cat o o)))-    )-  (defrole dev-close-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (recv (enc "close" d o n k)) (load lk (cat "st-k" d o k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d o)) (send n))-    (gen-st (cat "st-k" d o k))-    (critical-sections (1 3))-    )-  (defrole dev-pass-    (vars (k skey) (n text) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (load ls (cat "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    (uniq-orig n)-    (gen-st (cat "st-k" d o k) (cat "st" d (cat o o)))-    (critical-sections (0 1))-    )-  (defrole user-pass-    (vars (k skey))-    (trace (send (enc "may I pass" k)) (recv (enc "you may pass" k))))-  (defrule power-deliver-once-    (forall ((z1 z2 strd) (k skey))-      (implies-        (and (p "dev-up" z1 (idx 2)) (p "dev-up" z2 (idx 2))-          (p "dev-up" "k" z1 k) (p "dev-up" "k" z2 k))-        (= z1 z2))))-  (defrule same-dev-ls-lk-    (forall ((ls lk lk-0 locn))-      (implies-        (and (fact same-dev ls lk) (fact same-dev ls lk-0))-        (= lk lk-0))))-  (defrule same-dev-lk-ls-    (forall ((lk ls ls-0 locn))-      (implies-        (and (fact same-dev ls lk) (fact same-dev ls-0 lk))-        (= ls ls-0))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule discreteAfter-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule discreteBefore-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule fact-dev-up-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-up" z (idx 3)) (p "dev-up" "ls" z ls)-          (p "dev-up" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule fact-dev-open-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-open" z (idx 3)) (p "dev-open" "ls" z ls)-          (p "dev-open" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule fact-dev-close-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-close" z (idx 3)) (p "dev-close" "ls" z ls)-          (p "dev-close" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule fact-dev-pass-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-pass" z (idx 2)) (p "dev-pass" "ls" z ls)-          (p "dev-pass" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule trRl_dev-up-at-4-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 4)))))-  (defgenrule trRl_dev-up-at-3-    (forall ((z strd))-      (implies (p "dev-up" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-up-at-2-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 2)))))-  (defgenrule trRl_dev-up-at-1-    (forall ((z strd))-      (implies (p "dev-up" z (idx 4)) (trans z (idx 1)))))-  (defgenrule trRl_dev-open-at-3-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-open-at-1-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 1)))))-  (defgenrule trRl_dev-close-at-3-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-close-at-2-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 2)))))-  (defgenrule eff-dev-up-3-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-up" z (idx 4)) (prec z (idx 3) z1 i))-        (or (= z z1)-          (and (p "dev-up" z (idx 5)) (prec z (idx 4) z1 i))))))-  (defgenrule cau-dev-up-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-up" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1))))))-  (defgenrule cau-dev-open-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-open" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1))))))-  (defgenrule cau-dev-close-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-close" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1))))))-  (defgenrule cau-dev-pass-1-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-pass" z (idx 2)) (prec z1 i z (idx 1)))-        (or (= z z1) (prec z1 i z (idx 0))))))-  (defgenrule gen-st-dev-open-1-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-open" z (idx 1)) (p "dev-open" "k" z k)-          (p "dev-open" "o" z o) (p "dev-open" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule gen-st-dev-open-0-    (forall ((z strd) (d o name))-      (implies-        (and (p "dev-open" z (idx 1)) (p "dev-open" "o" z o)-          (p "dev-open" "d" z d)) (gen-st (cat "st" d o o)))))-  (defgenrule gen-st-dev-close-0-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-close" z (idx 1)) (p "dev-close" "k" z k)-          (p "dev-close" "o" z o) (p "dev-close" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule gen-st-dev-pass-1-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "k" z k)-          (p "dev-pass" "o" z o) (p "dev-pass" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule gen-st-dev-pass-0-    (forall ((z strd) (d o name))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "o" z o)-          (p "dev-pass" "d" z d)) (gen-st (cat "st" d o o)))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule gen-st-dev-pass-0-    (forall ((z strd) (o d name))-      (implies-        (and (p "dev-pass" z 1) (p "dev-pass" "o" z o)-          (p "dev-pass" "d" z d)) (gen-st (cat "st" d o o)))))-  (defgenrule gen-st-dev-pass-1-    (forall ((z strd) (k skey) (o d name))-      (implies-        (and (p "dev-pass" z 1) (p "dev-pass" "k" z k)-          (p "dev-pass" "o" z o) (p "dev-pass" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule fact-dev-pass-same-dev0-    (forall ((z strd) (ls lk locn))-      (implies-        (and (p "dev-pass" z 2) (p "dev-pass" "ls" z ls)-          (p "dev-pass" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule trRl_dev-close-at-2-    (forall ((z strd)) (implies (p "dev-close" z 3) (trans z 2))))-  (defgenrule trRl_dev-close-at-3-    (forall ((z strd)) (implies (p "dev-close" z 4) (trans z 3))))-  (defgenrule gen-st-dev-close-0-    (forall ((z strd) (k skey) (o d name))-      (implies-        (and (p "dev-close" z 1) (p "dev-close" "k" z k)-          (p "dev-close" "o" z o) (p "dev-close" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule fact-dev-close-same-dev0-    (forall ((z strd) (ls lk locn))-      (implies-        (and (p "dev-close" z 3) (p "dev-close" "ls" z ls)-          (p "dev-close" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule trRl_dev-open-at-1-    (forall ((z strd)) (implies (p "dev-open" z 2) (trans z 1))))-  (defgenrule trRl_dev-open-at-3-    (forall ((z strd)) (implies (p "dev-open" z 4) (trans z 3))))-  (defgenrule gen-st-dev-open-0-    (forall ((z strd) (o d name))-      (implies-        (and (p "dev-open" z 1) (p "dev-open" "o" z o)-          (p "dev-open" "d" z d)) (gen-st (cat "st" d o o)))))-  (defgenrule gen-st-dev-open-1-    (forall ((z strd) (k skey) (o d name))-      (implies-        (and (p "dev-open" z 1) (p "dev-open" "k" z k)-          (p "dev-open" "o" z o) (p "dev-open" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule fact-dev-open-same-dev0-    (forall ((z strd) (ls lk locn))-      (implies-        (and (p "dev-open" z 3) (p "dev-open" "ls" z ls)-          (p "dev-open" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule trRl_dev-up-at-1-    (forall ((z strd)) (implies (p "dev-up" z 2) (trans z 1))))-  (defgenrule trRl_dev-up-at-2-    (forall ((z strd)) (implies (p "dev-up" z 3) (trans z 2))))-  (defgenrule trRl_dev-up-at-3-    (forall ((z strd)) (implies (p "dev-up" z 4) (trans z 3))))-  (defgenrule trRl_dev-up-at-4-    (forall ((z strd)) (implies (p "dev-up" z 5) (trans z 4))))-  (defgenrule fact-dev-up-same-dev0-    (forall ((z strd) (ls lk locn))-      (implies-        (and (p "dev-up" z 3) (p "dev-up" "ls" z ls)-          (p "dev-up" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cau-dev-pass-1-    (forall ((z z1 strd) (i indx))-      (implies (and (p "dev-pass" z 2) (prec z1 i z 1))-        (or (= z z1) (prec z1 i z 0)))))-  (defgenrule cau-dev-close-2-    (forall ((z z1 strd) (i indx))-      (implies (and (p "dev-close" z 3) (prec z1 i z 2))-        (or (= z z1) (prec z1 i z 1)))))-  (defgenrule cau-dev-open-2-    (forall ((z z1 strd) (i indx))-      (implies (and (p "dev-open" z 3) (prec z1 i z 2))-        (or (= z z1) (prec z1 i z 1)))))-  (defgenrule cau-dev-up-2-    (forall ((z z1 strd) (i indx))-      (implies (and (p "dev-up" z 3) (prec z1 i z 2))-        (or (= z z1) (prec z1 i z 1)))))-  (defgenrule eff-dev-up-3-    (forall ((z z1 strd) (i indx))-      (implies (and (p "dev-up" z 4) (prec z 3 z1 i))-        (or (= z z1) (and (p "dev-up" z 5) (prec z 4 z1 i))))))-  (defgenrule invShearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule shearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2))))))--(defskeleton subatomic-open-closed-  (vars (k skey) (n text) (d o d-0 o-0 name) (pt pt-0 pval)-    (start-ch chan) (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d-0) (o o-0) (lk lk) (ls ls))-  (uniq-orig k n)-  (conf start-ch)-  -  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt "st-k" d-0 o-0 k))-      (load ls (cat pt-0 "st" d-0 o-0 o-0)) (recv (enc "may I pass" k))-      (send (enc "you may pass" n k))))-  (label 9)-  (unrealized (0 1) (1 0) (1 2))-  (preskeleton)-  (origs (n (1 3)) (k (0 0)))-  (comment "Not a skeleton"))--(defskeleton subatomic-open-closed-  (vars (k skey) (n text) (d o d-0 o-0 name) (pt pt-0 pval)-    (start-ch chan) (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d-0) (o o-0) (lk lk) (ls ls))-  (precedes ((0 0) (1 0)))-  (uniq-orig k n)-  (conf start-ch)-  -  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt "st-k" d-0 o-0 k))-      (load ls (cat pt-0 "st" d-0 o-0 o-0)) (recv (enc "may I pass" k))-      (send (enc "you may pass" n k))))-  (label 10)-  (parent 9)-  (unrealized (0 1) (1 0) (1 2))-  (origs (n (1 3)) (k (0 0)))-  (comment "Not closed under rules"))--(defskeleton subatomic-open-closed-  (vars (k skey) (n text) (d o d-0 o-0 name) (pt pt-0 pval)-    (start-ch chan) (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d-0) (o o-0) (lk lk) (ls ls))-  (precedes ((0 0) (1 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d-0 o-0 o-0) (cat "st-k" d-0 o-0 k))-  (conf start-ch)-  -  -  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt "st-k" d-0 o-0 k))-      (load ls (cat pt-0 "st" d-0 o-0 o-0)) (recv (enc "may I pass" k))-      (send (enc "you may pass" n k))))-  (label 11)-  (parent 10)-  (unrealized (0 1) (1 0) (1 1) (1 2))-  (origs (n (1 3)) (k (0 0)))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 mesg) (k skey) (n text) (d o d-0 o-0 name)-    (pt pt-0 pt-1 pt-2 pt-3 pval) (start-ch start-ch-0 chan)-    (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d-0) (o o-0) (lk lk) (ls ls))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d-0) (o o-0)-    (start-ch start-ch-0) (lk lk) (ls ls))-  (precedes ((0 0) (2 0)) ((2 4) (1 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d-0 o-0 o-0) (cat "st-k" d-0 o-0 k))-  (conf start-ch)-  (auth start-ch-0)-  -  (leads-to ((2 3) (1 0)))-  -  (operation channel-test (added-strand dev-up 4)-    (ch-msg lk (cat pt-2 "st-k" d-0 o-0 k)) (1 0))-  (strand-map 0 1)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt-2 "st-k" d-0 o-0 k))-      (load ls (cat pt "st" d-0 o-0 o-0)) (recv (enc "may I pass" k))-      (send (enc "you may pass" n k)))-    ((recv start-ch-0 (cat "power-up" d-0 o-0 k))-      (load lk (cat pt-0 old)) (load ls (cat pt-1 old1))-      (stor lk (cat pt-2 "st-k" d-0 o-0 k))-      (stor ls (cat pt-3 "st" d-0 o-0))))-  (label 12)-  (parent 11)-  (unrealized (0 1) (1 1) (1 2) (2 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 mesg) (k skey) (n text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pval) (start-ch chan) (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (precedes ((0 0) (2 0)) ((2 4) (1 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  -  (leads-to ((2 3) (1 0)))-  -  (operation channel-test (displaced 3 0 owner-power-dev 1)-    (ch-msg start-ch-0 (cat "power-up" d-0 o-0 k)) (2 0))-  (strand-map 0 1 2)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt-2 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (load ls (cat pt-1 old1)) (stor lk (cat pt-2 "st-k" d o k))-      (stor ls (cat pt-3 "st" d o))))-  (label 13)-  (parent 12)-  (unrealized (0 1) (1 1) (1 2))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 any mesg) (k k-0 skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pt-5 pval) (start-ch chan)-    (ls lk locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k-0) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (precedes ((0 0) (2 0)) ((2 4) (3 1)) ((3 3) (1 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k) (cat "st-k" d o k-0))-  (conf start-ch)-  (auth start-ch)-  -  (leads-to ((2 3) (1 0)) ((3 3) (1 1)))-  -  (operation channel-test (added-strand dev-open 4)-    (ch-msg ls (cat pt "st" d o o)) (1 1))-  (strand-map 0 1 2)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt-2 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (load ls (cat pt-1 old1)) (stor lk (cat pt-2 "st-k" d o k))-      (stor ls (cat pt-3 "st" d o)))-    ((recv (enc "open" d o n-0 k-0)) (load ls (cat pt-4 "st" d any))-      (load lk (cat pt-5 "st-k" d o k-0))-      (stor ls (cat pt "st" d o o))))-  (label 14)-  (parent 13)-  (seen 15)-  (seen-ops-    (15-      (operation channel-test (added-strand dev-up 4)-        (ch-msg lk (cat pt-3 "st-k" d o k)) (3 2))-      (strand-map 0 1 2 3)))-  (unrealized (0 1) (1 2) (3 2))-  (comment "2 in cohort - 1 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 any mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (start-ch chan) (ls lk locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (precedes ((0 0) (2 0)) ((2 4) (3 1)) ((3 3) (1 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  -  (leads-to ((2 3) (1 0)) ((2 3) (3 2)) ((3 3) (1 1)))-  -  (operation channel-test (displaced 4 2 dev-up 4)-    (ch-msg lk (cat pt-5 "st-k" d o k-0)) (3 2))-  (strand-map 0 1 2 3)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt-2 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (load ls (cat pt-1 old1)) (stor lk (cat pt-2 "st-k" d o k))-      (stor ls (cat pt-3 "st" d o)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-4 "st" d any))-      (load lk (cat pt-2 "st-k" d o k)) (stor ls (cat pt "st" d o o))))-  (label 15)-  (parent 14)-  (unrealized (0 1) (1 2) (3 0))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 any mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (start-ch chan) (ls lk locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand owner-open 1 (k k) (n n-0) (d d) (o o))-  (precedes ((0 0) (2 0)) ((2 4) (3 1)) ((3 3) (1 0)) ((4 0) (3 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  -  (leads-to ((2 3) (1 0)) ((2 3) (3 2)) ((3 3) (1 1)))-  -  (operation encryption-test (added-strand owner-open 1)-    (enc "open" d o n-0 k) (3 0))-  (strand-map 0 1 2 3)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt-2 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (load ls (cat pt-1 old1)) (stor lk (cat pt-2 "st-k" d o k))-      (stor ls (cat pt-3 "st" d o)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-4 "st" d any))-      (load lk (cat pt-2 "st-k" d o k)) (stor ls (cat pt "st" d o o)))-    ((send (enc "open" d o n-0 k))))-  (label 16)-  (parent 15)-  (unrealized (0 1) (1 2))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 any mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (start-ch chan) (ls lk locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (deflistener k)-  (precedes ((0 0) (2 0)) ((0 0) (4 0)) ((2 4) (3 1)) ((3 3) (1 0))-    ((4 1) (3 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  -  (leads-to ((2 3) (1 0)) ((2 3) (3 2)) ((3 3) (1 1)))-  -  (operation encryption-test (added-listener k) (enc "open" d o n-0 k)-    (3 0))-  (strand-map 0 1 2 3)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt-2 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (load ls (cat pt-1 old1)) (stor lk (cat pt-2 "st-k" d o k))-      (stor ls (cat pt-3 "st" d o)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-4 "st" d any))-      (load lk (cat pt-2 "st-k" d o k)) (stor ls (cat pt "st" d o o)))-    ((recv k) (send k)))-  (label 17)-  (parent 15)-  (seen 20)-  (seen-ops-    (20-      (operation nonce-test (added-strand dev-up 4) k (4 0)-        (ch-msg start-ch (cat "power-up" d o k)))-      (strand-map 0 1 2 3 4)))-  (unrealized (0 1) (4 0))-  (comment "2 in cohort - 1 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 any mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (start-ch chan) (ls lk locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand owner-open 1 (k k) (n n-0) (d d) (o o))-  (defstrand user-pass 1 (k k))-  (precedes ((0 0) (2 0)) ((2 4) (3 1)) ((3 3) (1 0)) ((4 0) (3 0))-    ((5 0) (1 2)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  -  (leads-to ((2 3) (1 0)) ((2 3) (3 2)) ((3 3) (1 1)))-  -  (operation encryption-test (added-strand user-pass 1)-    (enc "may I pass" k) (1 2))-  (strand-map 0 1 2 3 4)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt-2 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (load ls (cat pt-1 old1)) (stor lk (cat pt-2 "st-k" d o k))-      (stor ls (cat pt-3 "st" d o)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-4 "st" d any))-      (load lk (cat pt-2 "st-k" d o k)) (stor ls (cat pt "st" d o o)))-    ((send (enc "open" d o n-0 k))) ((send (enc "may I pass" k))))-  (label 18)-  (parent 16)-  (seen 21)-  (seen-ops-    (21-      (operation encryption-test (added-strand dev-up 6) (enc "up" k)-        (0 1)) (strand-map 0 1 5 2 3 4)))-  (unrealized (0 1))-  (comment "3 in cohort - 2 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 any mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (start-ch chan) (ls lk locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand owner-open 1 (k k) (n n-0) (d d) (o o))-  (deflistener k)-  (precedes ((0 0) (2 0)) ((0 0) (5 0)) ((2 4) (3 1)) ((3 3) (1 0))-    ((4 0) (3 0)) ((5 1) (1 2)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  -  (leads-to ((2 3) (1 0)) ((2 3) (3 2)) ((3 3) (1 1)))-  -  (operation encryption-test (added-listener k) (enc "may I pass" k)-    (1 2))-  (strand-map 0 1 2 3 4)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt-2 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (load ls (cat pt-1 old1)) (stor lk (cat pt-2 "st-k" d o k))-      (stor ls (cat pt-3 "st" d o)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-4 "st" d any))-      (load lk (cat pt-2 "st-k" d o k)) (stor ls (cat pt "st" d o o)))-    ((send (enc "open" d o n-0 k))) ((recv k) (send k)))-  (label 19)-  (parent 16)-  (seen 23)-  (seen-ops-    (23-      (operation nonce-test (added-strand dev-up 4) k (5 0)-        (ch-msg start-ch (cat "power-up" d o k)))-      (strand-map 0 1 2 3 4 5)))-  (unrealized (0 1) (5 0))-  (comment "2 in cohort - 1 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 any mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (start-ch chan) (ls lk locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (deflistener k)-  (precedes ((0 0) (2 0)) ((2 4) (4 0)) ((3 3) (1 0)) ((4 1) (3 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  -  (leads-to ((2 3) (1 0)) ((2 3) (3 2)) ((3 3) (1 1)))-  -  (operation nonce-test (displaced 5 2 dev-up 4) k (4 0)-    (ch-msg start-ch (cat "power-up" d o k)))-  (strand-map 0 1 2 3 4)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt-2 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (load ls (cat pt-1 old1)) (stor lk (cat pt-2 "st-k" d o k))-      (stor ls (cat pt-3 "st" d o)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-4 "st" d any))-      (load lk (cat pt-2 "st-k" d o k)) (stor ls (cat pt "st" d o o)))-    ((recv k) (send k)))-  (label 20)-  (parent 17)-  (unrealized (0 1) (4 0))-  (dead)-  (comment "empty cohort"))--(defskeleton subatomic-open-closed-  (vars (any old old1 mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (start-ch chan) (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand owner-open 1 (k k) (n n-0) (d d) (o o))-  (defstrand user-pass 1 (k k))-  (defstrand dev-up 6 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (precedes ((0 0) (5 0)) ((2 3) (1 0)) ((3 0) (2 0)) ((4 0) (1 2))-    ((5 4) (2 1)) ((5 5) (0 1)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  -  (leads-to ((2 3) (1 1)) ((5 3) (1 0)) ((5 3) (2 2)))-  -  (operation encryption-test (displaced 2 6 dev-up 6) (enc "up" k)-    (0 1))-  (strand-map 0 1 5 2 3 4)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt-3 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-0 "st" d any))-      (load lk (cat pt-3 "st-k" d o k)) (stor ls (cat pt "st" d o o)))-    ((send (enc "open" d o n-0 k))) ((send (enc "may I pass" k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-1 old))-      (load ls (cat pt-2 old1)) (stor lk (cat pt-3 "st-k" d o k))-      (stor ls (cat pt-4 "st" d o)) (send (enc "up" k))))-  (label 21)-  (parent 18)-  (realized)-  (shape)-  (maps-    ((0 1)-      ((k k) (d d) (o o) (start-ch start-ch) (n n) (d-0 d) (o-0 o)-        (lk lk) (ls ls))))-  (origs (pt-3 (5 3)) (pt-4 (5 4)) (pt (2 3)) (n (1 3)) (k (0 0))))--(defskeleton subatomic-open-closed-  (vars (old old1 any mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (start-ch chan) (ls lk locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand owner-open 1 (k k) (n n-0) (d d) (o o))-  (defstrand user-pass 1 (k k))-  (deflistener k)-  (precedes ((0 0) (2 0)) ((0 0) (6 0)) ((2 4) (3 1)) ((3 3) (1 0))-    ((4 0) (3 0)) ((5 0) (1 2)) ((6 1) (0 1)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  -  (leads-to ((2 3) (1 0)) ((2 3) (3 2)) ((3 3) (1 1)))-  -  (operation encryption-test (added-listener k) (enc "up" k) (0 1))-  (strand-map 0 1 2 3 4 5)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt-2 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (load ls (cat pt-1 old1)) (stor lk (cat pt-2 "st-k" d o k))-      (stor ls (cat pt-3 "st" d o)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-4 "st" d any))-      (load lk (cat pt-2 "st-k" d o k)) (stor ls (cat pt "st" d o o)))-    ((send (enc "open" d o n-0 k))) ((send (enc "may I pass" k)))-    ((recv k) (send k)))-  (label 22)-  (parent 18)-  (seen 24)-  (seen-ops-    (24-      (operation nonce-test (added-strand dev-up 4) k (6 0)-        (ch-msg start-ch (cat "power-up" d o k)))-      (strand-map 0 1 2 3 4 5 6)))-  (unrealized (6 0))-  (comment "2 in cohort - 1 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 any mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (start-ch chan) (ls lk locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand owner-open 1 (k k) (n n-0) (d d) (o o))-  (deflistener k)-  (precedes ((0 0) (2 0)) ((2 4) (3 1)) ((2 4) (5 0)) ((3 3) (1 0))-    ((4 0) (3 0)) ((5 1) (1 2)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  -  (leads-to ((2 3) (1 0)) ((2 3) (3 2)) ((3 3) (1 1)))-  -  (operation nonce-test (displaced 6 2 dev-up 4) k (5 0)-    (ch-msg start-ch (cat "power-up" d o k)))-  (strand-map 0 1 2 3 4 5)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt-2 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (load ls (cat pt-1 old1)) (stor lk (cat pt-2 "st-k" d o k))-      (stor ls (cat pt-3 "st" d o)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-4 "st" d any))-      (load lk (cat pt-2 "st-k" d o k)) (stor ls (cat pt "st" d o o)))-    ((send (enc "open" d o n-0 k))) ((recv k) (send k)))-  (label 23)-  (parent 19)-  (unrealized (0 1) (5 0))-  (dead)-  (comment "empty cohort"))--(defskeleton subatomic-open-closed-  (vars (old old1 any mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (start-ch chan) (ls lk locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand owner-open 1 (k k) (n n-0) (d d) (o o))-  (defstrand user-pass 1 (k k))-  (deflistener k)-  (precedes ((0 0) (2 0)) ((2 4) (3 1)) ((2 4) (6 0)) ((3 3) (1 0))-    ((4 0) (3 0)) ((5 0) (1 2)) ((6 1) (0 1)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  -  (leads-to ((2 3) (1 0)) ((2 3) (3 2)) ((3 3) (1 1)))-  -  (operation nonce-test (displaced 7 2 dev-up 4) k (6 0)-    (ch-msg start-ch (cat "power-up" d o k)))-  (strand-map 0 1 2 3 4 5 6)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt-2 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (load ls (cat pt-1 old1)) (stor lk (cat pt-2 "st-k" d o k))-      (stor ls (cat pt-3 "st" d o)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-4 "st" d any))-      (load lk (cat pt-2 "st-k" d o k)) (stor ls (cat pt "st" d o o)))-    ((send (enc "open" d o n-0 k))) ((send (enc "may I pass" k)))-    ((recv k) (send k)))-  (label 24)-  (parent 22)-  (unrealized (6 0))-  (dead)-  (comment "empty cohort"))--(comment "Nothing left to do")
− tst/defact-subatomic-open-closed-test-genrule_shapes.tst 
@@ -1,1055 +0,0 @@-(comment "CPSA 4.4.5")-(comment "Extracted shapes")--(herald subatomic-open-closed-test-genrule (bound 40))--(comment "CPSA 4.4.5")--(comment-  "All input read from tst/subatomic-open-closed-test-genrule.scm")--(comment "Strand count bounded at 40")--(defprotocol subatomic-open-closed basic-  (defrole dev-up-    (vars (k skey) (d o name) (old old1 mesg) (start-ch chan)-      (lk ls locn))-    (trace (recv start-ch (cat "power-up" d o k)) (load lk old)-      (load ls old1) (stor lk (cat "st-k" d o k))-      (stor ls (cat "st" d o)) (send (enc "up" k)))-    (auth start-ch)-    (critical-sections (1 4)))-  (defrole owner-power-dev-    (vars (k skey) (d o name) (start-ch chan))-    (trace (send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    (conf start-ch))-  (defrole owner-open-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "open" d o n k)) (recv n)))-  (defrole owner-close-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "close" d o n k)) (recv n)))-  (defrole dev-open-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (recv (enc "open" d o n k)) (load ls (cat "st" d any))-      (load lk (cat "st-k" d o k)) (stor ls (cat "st" d o o)) (send n))-    (critical-sections (1 3))-    (gen-st (cat "st-k" d o k) (cat "st" d (cat o o))))-  (defrole dev-close-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (recv (enc "close" d o n k)) (load lk (cat "st-k" d o k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d o)) (send n))-    (gen-st (cat "st-k" d o k))-    (critical-sections (1 3)))-  (defrole dev-pass-    (vars (k skey) (n text) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (load ls (cat "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    (uniq-orig n)-    (gen-st (cat "st-k" d o k) (cat "st" d (cat o o)))-    (critical-sections (0 1)))-  (defrole user-pass-    (vars (k skey))-    (trace (send (enc "may I pass" k)) (recv (enc "you may pass" k))))-  (defrule power-deliver-once-    (forall ((z1 z2 strd) (k skey))-      (implies-        (and (p "dev-up" z1 (idx 2)) (p "dev-up" z2 (idx 2))-          (p "dev-up" "k" z1 k) (p "dev-up" "k" z2 k))-        (= z1 z2))))-  (defrule same-dev-ls-lk-    (forall ((ls lk lk-0 locn))-      (implies-        (and (fact same-dev ls lk) (fact same-dev ls lk-0))-        (= lk lk-0))))-  (defrule same-dev-lk-ls-    (forall ((lk ls ls-0 locn))-      (implies-        (and (fact same-dev ls lk) (fact same-dev ls-0 lk))-        (= ls ls-0))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule discreteAfter-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule discreteBefore-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule fact-dev-up-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-up" z (idx 3)) (p "dev-up" "ls" z ls)-          (p "dev-up" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule fact-dev-open-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-open" z (idx 3)) (p "dev-open" "ls" z ls)-          (p "dev-open" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule fact-dev-close-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-close" z (idx 3)) (p "dev-close" "ls" z ls)-          (p "dev-close" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule fact-dev-pass-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-pass" z (idx 2)) (p "dev-pass" "ls" z ls)-          (p "dev-pass" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule trRl_dev-up-at-4-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 4)))))-  (defgenrule trRl_dev-up-at-3-    (forall ((z strd))-      (implies (p "dev-up" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-up-at-2-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 2)))))-  (defgenrule trRl_dev-up-at-1-    (forall ((z strd))-      (implies (p "dev-up" z (idx 4)) (trans z (idx 1)))))-  (defgenrule trRl_dev-open-at-3-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-open-at-1-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 1)))))-  (defgenrule trRl_dev-close-at-3-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-close-at-2-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 2)))))-  (defgenrule eff-dev-up-3-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-up" z (idx 4)) (prec z (idx 3) z1 i))-        (or (= z z1)-          (and (p "dev-up" z (idx 5)) (prec z (idx 4) z1 i))))))-  (defgenrule cau-dev-up-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-up" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1))))))-  (defgenrule cau-dev-open-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-open" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1))))))-  (defgenrule cau-dev-close-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-close" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1))))))-  (defgenrule cau-dev-pass-1-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-pass" z (idx 2)) (prec z1 i z (idx 1)))-        (or (= z z1) (prec z1 i z (idx 0))))))-  (defgenrule gen-st-dev-open-1-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-open" z (idx 1)) (p "dev-open" "k" z k)-          (p "dev-open" "o" z o) (p "dev-open" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule gen-st-dev-open-0-    (forall ((z strd) (d o name))-      (implies-        (and (p "dev-open" z (idx 1)) (p "dev-open" "o" z o)-          (p "dev-open" "d" z d)) (gen-st (cat "st" d o o)))))-  (defgenrule gen-st-dev-close-0-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-close" z (idx 1)) (p "dev-close" "k" z k)-          (p "dev-close" "o" z o) (p "dev-close" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule gen-st-dev-pass-1-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "k" z k)-          (p "dev-pass" "o" z o) (p "dev-pass" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule gen-st-dev-pass-0-    (forall ((z strd) (d o name))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "o" z o)-          (p "dev-pass" "d" z d)) (gen-st (cat "st" d o o)))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule gen-st-dev-pass-0-    (forall ((z strd) (o d name))-      (implies-        (and (p "dev-pass" z 1) (p "dev-pass" "o" z o)-          (p "dev-pass" "d" z d)) (gen-st (cat "st" d o o)))))-  (defgenrule gen-st-dev-pass-1-    (forall ((z strd) (k skey) (o d name))-      (implies-        (and (p "dev-pass" z 1) (p "dev-pass" "k" z k)-          (p "dev-pass" "o" z o) (p "dev-pass" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule fact-dev-pass-same-dev0-    (forall ((z strd) (ls lk locn))-      (implies-        (and (p "dev-pass" z 2) (p "dev-pass" "ls" z ls)-          (p "dev-pass" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule trRl_dev-close-at-2-    (forall ((z strd)) (implies (p "dev-close" z 3) (trans z 2))))-  (defgenrule trRl_dev-close-at-3-    (forall ((z strd)) (implies (p "dev-close" z 4) (trans z 3))))-  (defgenrule gen-st-dev-close-0-    (forall ((z strd) (k skey) (o d name))-      (implies-        (and (p "dev-close" z 1) (p "dev-close" "k" z k)-          (p "dev-close" "o" z o) (p "dev-close" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule fact-dev-close-same-dev0-    (forall ((z strd) (ls lk locn))-      (implies-        (and (p "dev-close" z 3) (p "dev-close" "ls" z ls)-          (p "dev-close" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule trRl_dev-open-at-1-    (forall ((z strd)) (implies (p "dev-open" z 2) (trans z 1))))-  (defgenrule trRl_dev-open-at-3-    (forall ((z strd)) (implies (p "dev-open" z 4) (trans z 3))))-  (defgenrule gen-st-dev-open-0-    (forall ((z strd) (o d name))-      (implies-        (and (p "dev-open" z 1) (p "dev-open" "o" z o)-          (p "dev-open" "d" z d)) (gen-st (cat "st" d o o)))))-  (defgenrule gen-st-dev-open-1-    (forall ((z strd) (k skey) (o d name))-      (implies-        (and (p "dev-open" z 1) (p "dev-open" "k" z k)-          (p "dev-open" "o" z o) (p "dev-open" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule fact-dev-open-same-dev0-    (forall ((z strd) (ls lk locn))-      (implies-        (and (p "dev-open" z 3) (p "dev-open" "ls" z ls)-          (p "dev-open" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule trRl_dev-up-at-1-    (forall ((z strd)) (implies (p "dev-up" z 2) (trans z 1))))-  (defgenrule trRl_dev-up-at-2-    (forall ((z strd)) (implies (p "dev-up" z 3) (trans z 2))))-  (defgenrule trRl_dev-up-at-3-    (forall ((z strd)) (implies (p "dev-up" z 4) (trans z 3))))-  (defgenrule trRl_dev-up-at-4-    (forall ((z strd)) (implies (p "dev-up" z 5) (trans z 4))))-  (defgenrule fact-dev-up-same-dev0-    (forall ((z strd) (ls lk locn))-      (implies-        (and (p "dev-up" z 3) (p "dev-up" "ls" z ls)-          (p "dev-up" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cau-dev-pass-1-    (forall ((z z1 strd) (i indx))-      (implies (and (p "dev-pass" z 2) (prec z1 i z 1))-        (or (= z z1) (prec z1 i z 0)))))-  (defgenrule cau-dev-close-2-    (forall ((z z1 strd) (i indx))-      (implies (and (p "dev-close" z 3) (prec z1 i z 2))-        (or (= z z1) (prec z1 i z 1)))))-  (defgenrule cau-dev-open-2-    (forall ((z z1 strd) (i indx))-      (implies (and (p "dev-open" z 3) (prec z1 i z 2))-        (or (= z z1) (prec z1 i z 1)))))-  (defgenrule cau-dev-up-2-    (forall ((z z1 strd) (i indx))-      (implies (and (p "dev-up" z 3) (prec z1 i z 2))-        (or (= z z1) (prec z1 i z 1)))))-  (defgenrule eff-dev-up-3-    (forall ((z z1 strd) (i indx))-      (implies (and (p "dev-up" z 4) (prec z 3 z1 i))-        (or (= z z1) (and (p "dev-up" z 5) (prec z 4 z1 i))))))-  (defgenrule invShearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule shearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2))))))--(defskeleton subatomic-open-closed-  (vars (k skey) (d o name) (start-ch chan))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (deflistener k)-  (uniq-orig k)-  (conf start-ch)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv k) (send k)))-  (label 0)-  (unrealized (0 1) (1 0))-  (preskeleton)-  (origs (k (0 0)))-  (comment "Not a skeleton"))--(comment "Nothing left to do")--(defprotocol subatomic-open-closed basic-  (defrole dev-up-    (vars (k skey) (d o name) (old old1 mesg) (start-ch chan)-      (lk ls locn))-    (trace (recv start-ch (cat "power-up" d o k)) (load lk old)-      (load ls old1) (stor lk (cat "st-k" d o k))-      (stor ls (cat "st" d o)) (send (enc "up" k)))-    (auth start-ch)-    (critical-sections (1 4)))-  (defrole owner-power-dev-    (vars (k skey) (d o name) (start-ch chan))-    (trace (send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    (conf start-ch))-  (defrole owner-open-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "open" d o n k)) (recv n)))-  (defrole owner-close-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "close" d o n k)) (recv n)))-  (defrole dev-open-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (recv (enc "open" d o n k)) (load ls (cat "st" d any))-      (load lk (cat "st-k" d o k)) (stor ls (cat "st" d o o)) (send n))-    (critical-sections (1 3))-    (gen-st (cat "st-k" d o k) (cat "st" d (cat o o))))-  (defrole dev-close-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (recv (enc "close" d o n k)) (load lk (cat "st-k" d o k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d o)) (send n))-    (gen-st (cat "st-k" d o k))-    (critical-sections (1 3)))-  (defrole dev-pass-    (vars (k skey) (n text) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (load ls (cat "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    (uniq-orig n)-    (gen-st (cat "st-k" d o k) (cat "st" d (cat o o)))-    (critical-sections (0 1)))-  (defrole user-pass-    (vars (k skey))-    (trace (send (enc "may I pass" k)) (recv (enc "you may pass" k))))-  (defrule power-deliver-once-    (forall ((z1 z2 strd) (k skey))-      (implies-        (and (p "dev-up" z1 (idx 2)) (p "dev-up" z2 (idx 2))-          (p "dev-up" "k" z1 k) (p "dev-up" "k" z2 k))-        (= z1 z2))))-  (defrule same-dev-ls-lk-    (forall ((ls lk lk-0 locn))-      (implies-        (and (fact same-dev ls lk) (fact same-dev ls lk-0))-        (= lk lk-0))))-  (defrule same-dev-lk-ls-    (forall ((lk ls ls-0 locn))-      (implies-        (and (fact same-dev ls lk) (fact same-dev ls-0 lk))-        (= ls ls-0))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule discreteAfter-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule discreteBefore-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule fact-dev-up-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-up" z (idx 3)) (p "dev-up" "ls" z ls)-          (p "dev-up" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule fact-dev-open-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-open" z (idx 3)) (p "dev-open" "ls" z ls)-          (p "dev-open" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule fact-dev-close-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-close" z (idx 3)) (p "dev-close" "ls" z ls)-          (p "dev-close" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule fact-dev-pass-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-pass" z (idx 2)) (p "dev-pass" "ls" z ls)-          (p "dev-pass" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule trRl_dev-up-at-4-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 4)))))-  (defgenrule trRl_dev-up-at-3-    (forall ((z strd))-      (implies (p "dev-up" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-up-at-2-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 2)))))-  (defgenrule trRl_dev-up-at-1-    (forall ((z strd))-      (implies (p "dev-up" z (idx 4)) (trans z (idx 1)))))-  (defgenrule trRl_dev-open-at-3-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-open-at-1-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 1)))))-  (defgenrule trRl_dev-close-at-3-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-close-at-2-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 2)))))-  (defgenrule eff-dev-up-3-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-up" z (idx 4)) (prec z (idx 3) z1 i))-        (or (= z z1)-          (and (p "dev-up" z (idx 5)) (prec z (idx 4) z1 i))))))-  (defgenrule cau-dev-up-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-up" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1))))))-  (defgenrule cau-dev-open-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-open" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1))))))-  (defgenrule cau-dev-close-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-close" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1))))))-  (defgenrule cau-dev-pass-1-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-pass" z (idx 2)) (prec z1 i z (idx 1)))-        (or (= z z1) (prec z1 i z (idx 0))))))-  (defgenrule gen-st-dev-open-1-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-open" z (idx 1)) (p "dev-open" "k" z k)-          (p "dev-open" "o" z o) (p "dev-open" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule gen-st-dev-open-0-    (forall ((z strd) (d o name))-      (implies-        (and (p "dev-open" z (idx 1)) (p "dev-open" "o" z o)-          (p "dev-open" "d" z d)) (gen-st (cat "st" d o o)))))-  (defgenrule gen-st-dev-close-0-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-close" z (idx 1)) (p "dev-close" "k" z k)-          (p "dev-close" "o" z o) (p "dev-close" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule gen-st-dev-pass-1-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "k" z k)-          (p "dev-pass" "o" z o) (p "dev-pass" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule gen-st-dev-pass-0-    (forall ((z strd) (d o name))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "o" z o)-          (p "dev-pass" "d" z d)) (gen-st (cat "st" d o o)))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule gen-st-dev-pass-0-    (forall ((z strd) (o d name))-      (implies-        (and (p "dev-pass" z 1) (p "dev-pass" "o" z o)-          (p "dev-pass" "d" z d)) (gen-st (cat "st" d o o)))))-  (defgenrule gen-st-dev-pass-1-    (forall ((z strd) (k skey) (o d name))-      (implies-        (and (p "dev-pass" z 1) (p "dev-pass" "k" z k)-          (p "dev-pass" "o" z o) (p "dev-pass" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule fact-dev-pass-same-dev0-    (forall ((z strd) (ls lk locn))-      (implies-        (and (p "dev-pass" z 2) (p "dev-pass" "ls" z ls)-          (p "dev-pass" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule trRl_dev-close-at-2-    (forall ((z strd)) (implies (p "dev-close" z 3) (trans z 2))))-  (defgenrule trRl_dev-close-at-3-    (forall ((z strd)) (implies (p "dev-close" z 4) (trans z 3))))-  (defgenrule gen-st-dev-close-0-    (forall ((z strd) (k skey) (o d name))-      (implies-        (and (p "dev-close" z 1) (p "dev-close" "k" z k)-          (p "dev-close" "o" z o) (p "dev-close" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule fact-dev-close-same-dev0-    (forall ((z strd) (ls lk locn))-      (implies-        (and (p "dev-close" z 3) (p "dev-close" "ls" z ls)-          (p "dev-close" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule trRl_dev-open-at-1-    (forall ((z strd)) (implies (p "dev-open" z 2) (trans z 1))))-  (defgenrule trRl_dev-open-at-3-    (forall ((z strd)) (implies (p "dev-open" z 4) (trans z 3))))-  (defgenrule gen-st-dev-open-0-    (forall ((z strd) (o d name))-      (implies-        (and (p "dev-open" z 1) (p "dev-open" "o" z o)-          (p "dev-open" "d" z d)) (gen-st (cat "st" d o o)))))-  (defgenrule gen-st-dev-open-1-    (forall ((z strd) (k skey) (o d name))-      (implies-        (and (p "dev-open" z 1) (p "dev-open" "k" z k)-          (p "dev-open" "o" z o) (p "dev-open" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule fact-dev-open-same-dev0-    (forall ((z strd) (ls lk locn))-      (implies-        (and (p "dev-open" z 3) (p "dev-open" "ls" z ls)-          (p "dev-open" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule trRl_dev-up-at-1-    (forall ((z strd)) (implies (p "dev-up" z 2) (trans z 1))))-  (defgenrule trRl_dev-up-at-2-    (forall ((z strd)) (implies (p "dev-up" z 3) (trans z 2))))-  (defgenrule trRl_dev-up-at-3-    (forall ((z strd)) (implies (p "dev-up" z 4) (trans z 3))))-  (defgenrule trRl_dev-up-at-4-    (forall ((z strd)) (implies (p "dev-up" z 5) (trans z 4))))-  (defgenrule fact-dev-up-same-dev0-    (forall ((z strd) (ls lk locn))-      (implies-        (and (p "dev-up" z 3) (p "dev-up" "ls" z ls)-          (p "dev-up" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cau-dev-pass-1-    (forall ((z z1 strd) (i indx))-      (implies (and (p "dev-pass" z 2) (prec z1 i z 1))-        (or (= z z1) (prec z1 i z 0)))))-  (defgenrule cau-dev-close-2-    (forall ((z z1 strd) (i indx))-      (implies (and (p "dev-close" z 3) (prec z1 i z 2))-        (or (= z z1) (prec z1 i z 1)))))-  (defgenrule cau-dev-open-2-    (forall ((z z1 strd) (i indx))-      (implies (and (p "dev-open" z 3) (prec z1 i z 2))-        (or (= z z1) (prec z1 i z 1)))))-  (defgenrule cau-dev-up-2-    (forall ((z z1 strd) (i indx))-      (implies (and (p "dev-up" z 3) (prec z1 i z 2))-        (or (= z z1) (prec z1 i z 1)))))-  (defgenrule eff-dev-up-3-    (forall ((z z1 strd) (i indx))-      (implies (and (p "dev-up" z 4) (prec z 3 z1 i))-        (or (= z z1) (and (p "dev-up" z 5) (prec z 4 z1 i))))))-  (defgenrule invShearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule shearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2))))))--(defskeleton subatomic-open-closed-  (vars (k skey) (n text) (d o name) (pt pt-0 pval) (lk ls locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (uniq-orig n)-  (traces-    ((load lk (cat pt "st-k" d o k)) (load ls (cat pt-0 "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k))))-  (label 3)-  (realized)-  (origs (n (0 3)))-  (comment "Not closed under rules"))--(defskeleton subatomic-open-closed-  (vars (old old1 any mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (start-ch chan) (ls lk locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand owner-power-dev 1 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (precedes ((1 4) (3 1)) ((2 0) (1 0)) ((3 3) (0 0)))-  (uniq-orig n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  (leads-to ((1 3) (0 0)) ((1 3) (3 2)) ((3 3) (0 1)))-  (operation channel-test (displaced 4 1 dev-up 4)-    (ch-msg lk (cat pt-5 "st-k" d o k-0)) (3 2))-  (strand-map 0 1 2 3)-  (traces-    ((load lk (cat pt-2 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (load ls (cat pt-1 old1)) (stor lk (cat pt-2 "st-k" d o k))-      (stor ls (cat pt-3 "st" d o)))-    ((send start-ch (cat "power-up" d o k)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-4 "st" d any))-      (load lk (cat pt-2 "st-k" d o k)) (stor ls (cat pt "st" d o o))))-  (label 8)-  (parent 3)-  (realized)-  (shape)-  (maps ((0) ((k k) (n n) (d d) (o o) (lk lk) (ls ls))))-  (origs (pt-2 (1 3)) (pt-3 (1 4)) (pt (3 3)) (n (0 3))))--(comment "Nothing left to do")--(defprotocol subatomic-open-closed basic-  (defrole dev-up-    (vars (k skey) (d o name) (old old1 mesg) (start-ch chan)-      (lk ls locn))-    (trace (recv start-ch (cat "power-up" d o k)) (load lk old)-      (load ls old1) (stor lk (cat "st-k" d o k))-      (stor ls (cat "st" d o)) (send (enc "up" k)))-    (auth start-ch)-    (critical-sections (1 4)))-  (defrole owner-power-dev-    (vars (k skey) (d o name) (start-ch chan))-    (trace (send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    (conf start-ch))-  (defrole owner-open-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "open" d o n k)) (recv n)))-  (defrole owner-close-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "close" d o n k)) (recv n)))-  (defrole dev-open-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (recv (enc "open" d o n k)) (load ls (cat "st" d any))-      (load lk (cat "st-k" d o k)) (stor ls (cat "st" d o o)) (send n))-    (critical-sections (1 3))-    (gen-st (cat "st-k" d o k) (cat "st" d (cat o o))))-  (defrole dev-close-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (recv (enc "close" d o n k)) (load lk (cat "st-k" d o k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d o)) (send n))-    (gen-st (cat "st-k" d o k))-    (critical-sections (1 3)))-  (defrole dev-pass-    (vars (k skey) (n text) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (load ls (cat "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    (uniq-orig n)-    (gen-st (cat "st-k" d o k) (cat "st" d (cat o o)))-    (critical-sections (0 1)))-  (defrole user-pass-    (vars (k skey))-    (trace (send (enc "may I pass" k)) (recv (enc "you may pass" k))))-  (defrule power-deliver-once-    (forall ((z1 z2 strd) (k skey))-      (implies-        (and (p "dev-up" z1 (idx 2)) (p "dev-up" z2 (idx 2))-          (p "dev-up" "k" z1 k) (p "dev-up" "k" z2 k))-        (= z1 z2))))-  (defrule same-dev-ls-lk-    (forall ((ls lk lk-0 locn))-      (implies-        (and (fact same-dev ls lk) (fact same-dev ls lk-0))-        (= lk lk-0))))-  (defrule same-dev-lk-ls-    (forall ((lk ls ls-0 locn))-      (implies-        (and (fact same-dev ls lk) (fact same-dev ls-0 lk))-        (= ls ls-0))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule discreteAfter-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule discreteBefore-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule fact-dev-up-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-up" z (idx 3)) (p "dev-up" "ls" z ls)-          (p "dev-up" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule fact-dev-open-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-open" z (idx 3)) (p "dev-open" "ls" z ls)-          (p "dev-open" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule fact-dev-close-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-close" z (idx 3)) (p "dev-close" "ls" z ls)-          (p "dev-close" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule fact-dev-pass-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-pass" z (idx 2)) (p "dev-pass" "ls" z ls)-          (p "dev-pass" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule trRl_dev-up-at-4-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 4)))))-  (defgenrule trRl_dev-up-at-3-    (forall ((z strd))-      (implies (p "dev-up" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-up-at-2-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 2)))))-  (defgenrule trRl_dev-up-at-1-    (forall ((z strd))-      (implies (p "dev-up" z (idx 4)) (trans z (idx 1)))))-  (defgenrule trRl_dev-open-at-3-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-open-at-1-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 1)))))-  (defgenrule trRl_dev-close-at-3-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-close-at-2-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 2)))))-  (defgenrule eff-dev-up-3-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-up" z (idx 4)) (prec z (idx 3) z1 i))-        (or (= z z1)-          (and (p "dev-up" z (idx 5)) (prec z (idx 4) z1 i))))))-  (defgenrule cau-dev-up-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-up" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1))))))-  (defgenrule cau-dev-open-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-open" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1))))))-  (defgenrule cau-dev-close-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-close" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1))))))-  (defgenrule cau-dev-pass-1-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-pass" z (idx 2)) (prec z1 i z (idx 1)))-        (or (= z z1) (prec z1 i z (idx 0))))))-  (defgenrule gen-st-dev-open-1-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-open" z (idx 1)) (p "dev-open" "k" z k)-          (p "dev-open" "o" z o) (p "dev-open" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule gen-st-dev-open-0-    (forall ((z strd) (d o name))-      (implies-        (and (p "dev-open" z (idx 1)) (p "dev-open" "o" z o)-          (p "dev-open" "d" z d)) (gen-st (cat "st" d o o)))))-  (defgenrule gen-st-dev-close-0-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-close" z (idx 1)) (p "dev-close" "k" z k)-          (p "dev-close" "o" z o) (p "dev-close" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule gen-st-dev-pass-1-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "k" z k)-          (p "dev-pass" "o" z o) (p "dev-pass" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule gen-st-dev-pass-0-    (forall ((z strd) (d o name))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "o" z o)-          (p "dev-pass" "d" z d)) (gen-st (cat "st" d o o)))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule gen-st-dev-pass-0-    (forall ((z strd) (o d name))-      (implies-        (and (p "dev-pass" z 1) (p "dev-pass" "o" z o)-          (p "dev-pass" "d" z d)) (gen-st (cat "st" d o o)))))-  (defgenrule gen-st-dev-pass-1-    (forall ((z strd) (k skey) (o d name))-      (implies-        (and (p "dev-pass" z 1) (p "dev-pass" "k" z k)-          (p "dev-pass" "o" z o) (p "dev-pass" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule fact-dev-pass-same-dev0-    (forall ((z strd) (ls lk locn))-      (implies-        (and (p "dev-pass" z 2) (p "dev-pass" "ls" z ls)-          (p "dev-pass" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule trRl_dev-close-at-2-    (forall ((z strd)) (implies (p "dev-close" z 3) (trans z 2))))-  (defgenrule trRl_dev-close-at-3-    (forall ((z strd)) (implies (p "dev-close" z 4) (trans z 3))))-  (defgenrule gen-st-dev-close-0-    (forall ((z strd) (k skey) (o d name))-      (implies-        (and (p "dev-close" z 1) (p "dev-close" "k" z k)-          (p "dev-close" "o" z o) (p "dev-close" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule fact-dev-close-same-dev0-    (forall ((z strd) (ls lk locn))-      (implies-        (and (p "dev-close" z 3) (p "dev-close" "ls" z ls)-          (p "dev-close" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule trRl_dev-open-at-1-    (forall ((z strd)) (implies (p "dev-open" z 2) (trans z 1))))-  (defgenrule trRl_dev-open-at-3-    (forall ((z strd)) (implies (p "dev-open" z 4) (trans z 3))))-  (defgenrule gen-st-dev-open-0-    (forall ((z strd) (o d name))-      (implies-        (and (p "dev-open" z 1) (p "dev-open" "o" z o)-          (p "dev-open" "d" z d)) (gen-st (cat "st" d o o)))))-  (defgenrule gen-st-dev-open-1-    (forall ((z strd) (k skey) (o d name))-      (implies-        (and (p "dev-open" z 1) (p "dev-open" "k" z k)-          (p "dev-open" "o" z o) (p "dev-open" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule fact-dev-open-same-dev0-    (forall ((z strd) (ls lk locn))-      (implies-        (and (p "dev-open" z 3) (p "dev-open" "ls" z ls)-          (p "dev-open" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule trRl_dev-up-at-1-    (forall ((z strd)) (implies (p "dev-up" z 2) (trans z 1))))-  (defgenrule trRl_dev-up-at-2-    (forall ((z strd)) (implies (p "dev-up" z 3) (trans z 2))))-  (defgenrule trRl_dev-up-at-3-    (forall ((z strd)) (implies (p "dev-up" z 4) (trans z 3))))-  (defgenrule trRl_dev-up-at-4-    (forall ((z strd)) (implies (p "dev-up" z 5) (trans z 4))))-  (defgenrule fact-dev-up-same-dev0-    (forall ((z strd) (ls lk locn))-      (implies-        (and (p "dev-up" z 3) (p "dev-up" "ls" z ls)-          (p "dev-up" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cau-dev-pass-1-    (forall ((z z1 strd) (i indx))-      (implies (and (p "dev-pass" z 2) (prec z1 i z 1))-        (or (= z z1) (prec z1 i z 0)))))-  (defgenrule cau-dev-close-2-    (forall ((z z1 strd) (i indx))-      (implies (and (p "dev-close" z 3) (prec z1 i z 2))-        (or (= z z1) (prec z1 i z 1)))))-  (defgenrule cau-dev-open-2-    (forall ((z z1 strd) (i indx))-      (implies (and (p "dev-open" z 3) (prec z1 i z 2))-        (or (= z z1) (prec z1 i z 1)))))-  (defgenrule cau-dev-up-2-    (forall ((z z1 strd) (i indx))-      (implies (and (p "dev-up" z 3) (prec z1 i z 2))-        (or (= z z1) (prec z1 i z 1)))))-  (defgenrule eff-dev-up-3-    (forall ((z z1 strd) (i indx))-      (implies (and (p "dev-up" z 4) (prec z 3 z1 i))-        (or (= z z1) (and (p "dev-up" z 5) (prec z 4 z1 i))))))-  (defgenrule invShearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule shearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2))))))--(defskeleton subatomic-open-closed-  (vars (k skey) (n text) (d o d-0 o-0 name) (pt pt-0 pval)-    (start-ch chan) (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d-0) (o o-0) (lk lk) (ls ls))-  (uniq-orig k n)-  (conf start-ch)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt "st-k" d-0 o-0 k))-      (load ls (cat pt-0 "st" d-0 o-0 o-0)) (recv (enc "may I pass" k))-      (send (enc "you may pass" n k))))-  (label 9)-  (unrealized (0 1) (1 0) (1 2))-  (preskeleton)-  (origs (n (1 3)) (k (0 0)))-  (comment "Not a skeleton"))--(defskeleton subatomic-open-closed-  (vars (any old old1 mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (start-ch chan) (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand owner-open 1 (k k) (n n-0) (d d) (o o))-  (defstrand user-pass 1 (k k))-  (defstrand dev-up 6 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (precedes ((0 0) (5 0)) ((2 3) (1 0)) ((3 0) (2 0)) ((4 0) (1 2))-    ((5 4) (2 1)) ((5 5) (0 1)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  (leads-to ((2 3) (1 1)) ((5 3) (1 0)) ((5 3) (2 2)))-  (operation encryption-test (displaced 2 6 dev-up 6) (enc "up" k)-    (0 1))-  (strand-map 0 1 5 2 3 4)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt-3 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-0 "st" d any))-      (load lk (cat pt-3 "st-k" d o k)) (stor ls (cat pt "st" d o o)))-    ((send (enc "open" d o n-0 k))) ((send (enc "may I pass" k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-1 old))-      (load ls (cat pt-2 old1)) (stor lk (cat pt-3 "st-k" d o k))-      (stor ls (cat pt-4 "st" d o)) (send (enc "up" k))))-  (label 21)-  (parent 9)-  (realized)-  (shape)-  (maps-    ((0 1)-      ((k k) (d d) (o o) (start-ch start-ch) (n n) (d-0 d) (o-0 o)-        (lk lk) (ls ls))))-  (origs (pt-3 (5 3)) (pt-4 (5 4)) (pt (2 3)) (n (1 3)) (k (0 0))))--(comment "Nothing left to do")
− tst/defact-subatomic-open-closed.tst 
@@ -1,1794 +0,0 @@-(herald subatomic-open-closed (bound 40))--(comment "CPSA 4.4.5")-(comment "All input read from tst/subatomic-open-closed.scm")-(comment "Strand count bounded at 40")--(defprotocol subatomic-open-closed basic-  (defrole dev-up-    (vars (k skey) (d o name) (old old1 mesg) (start-ch chan)-      (lk ls locn))-    (trace (recv start-ch (cat "power-up" d o k)) (load lk old)-      (load ls old1) (stor lk (cat "st-k" d o k))-      (stor ls (cat "st" d o)) (send (enc "up" k)))-    (auth start-ch)-    )-  (defrole owner-power-dev-    (vars (k skey) (d o name) (start-ch chan))-    (trace (send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    (conf start-ch))-  (defrole owner-open-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "open" d o n k)) (recv n)))-  (defrole owner-close-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "close" d o n k)) (recv n)))-  (defrole dev-open-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (recv (enc "open" d o n k)) (load ls (cat "st" d any))-      (load lk (cat "st-k" d o k)) (stor ls (cat "st" d o o)) (send n))-    (gen-st (cat "st-k" d o k) (cat "st" d (cat o o)))-    )-  (defrole dev-close-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (recv (enc "close" d o n k)) (load lk (cat "st-k" d o k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d o)) (send n))-    (gen-st (cat "st-k" d o k))-    )-  (defrole dev-pass-    (vars (k skey) (n text) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (load ls (cat "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    (uniq-orig n)-    (gen-st (cat "st-k" d o k) (cat "st" d (cat o o)))-    )-  (defrole user-pass-    (vars (k skey))-    (trace (send (enc "may I pass" k)) (recv (enc "you may pass" k))))-  (defrule power-deliver-once-    (forall ((z1 z2 strd) (k skey))-      (implies-        (and (p "dev-up" z1 (idx 2)) (p "dev-up" z2 (idx 2))-          (p "dev-up" "k" z1 k) (p "dev-up" "k" z2 k))-        (= z1 z2))))-  (defrule same-dev-ls-lk-    (forall ((ls lk lk-0 locn))-      (implies-        (and (fact same-dev ls lk) (fact same-dev ls lk-0))-        (= lk lk-0))))-  (defrule same-dev-lk-ls-    (forall ((lk ls ls-0 locn))-      (implies-        (and (fact same-dev ls lk) (fact same-dev ls-0 lk))-        (= ls ls-0))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule discreteAfter-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule discreteBefore-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule causeRule-    (forall ((z z1 strd) (i j i1 indx))-      (implies (and (fact st-sg-str z i j) (prec z1 i1 z j))-        (or (= z z1) (prec z1 i1 z i)))))-  (defgenrule effectRule-    (forall ((z z1 strd) (i j i1 indx))-      (implies (and (fact st-sg-str z i j) (prec z i z1 i1))-        (or (= z z1) (prec z j z1 i1)))))-  (defgenrule fact-dev-up-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-up" z (idx 3)) (p "dev-up" "ls" z ls)-          (p "dev-up" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule fact-dev-open-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-open" z (idx 3)) (p "dev-open" "ls" z ls)-          (p "dev-open" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule fact-dev-close-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-close" z (idx 3)) (p "dev-close" "ls" z ls)-          (p "dev-close" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule fact-dev-pass-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-pass" z (idx 2)) (p "dev-pass" "ls" z ls)-          (p "dev-pass" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule trRl_dev-up-at-4-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 4)))))-  (defgenrule trRl_dev-up-at-3-    (forall ((z strd))-      (implies (p "dev-up" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-up-at-2-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 2)))))-  (defgenrule trRl_dev-up-at-1-    (forall ((z strd))-      (implies (p "dev-up" z (idx 4)) (trans z (idx 1)))))-  (defgenrule trRl_dev-open-at-3-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-open-at-1-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 1)))))-  (defgenrule trRl_dev-close-at-3-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-close-at-2-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 2)))))-  (defgenrule st-sg-dev-up-2-    (forall ((z strd))-      (implies (p "dev-up" z (idx 3))-        (fact st-sg-str z (idx 1) (idx 2)))))-  (defgenrule st-sg-dev-up-3-    (forall ((z strd))-      (implies (p "dev-up" z (idx 4))-        (fact st-sg-str z (idx 1) (idx 3)))))-  (defgenrule st-sg-dev-up-4-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5))-        (fact st-sg-str z (idx 1) (idx 4)))))-  (defgenrule st-sg-dev-open-2-    (forall ((z strd))-      (implies (p "dev-open" z (idx 3))-        (fact st-sg-str z (idx 1) (idx 2)))))-  (defgenrule st-sg-dev-open-3-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4))-        (fact st-sg-str z (idx 1) (idx 3)))))-  (defgenrule st-sg-dev-close-2-    (forall ((z strd))-      (implies (p "dev-close" z (idx 3))-        (fact st-sg-str z (idx 1) (idx 2)))))-  (defgenrule st-sg-dev-close-3-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4))-        (fact st-sg-str z (idx 1) (idx 3)))))-  (defgenrule st-sg-dev-pass-1-    (forall ((z strd))-      (implies (p "dev-pass" z (idx 2))-        (fact st-sg-str z (idx 0) (idx 1)))))-  (defgenrule gen-st-dev-open-1-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-open" z (idx 1)) (p "dev-open" "k" z k)-          (p "dev-open" "o" z o) (p "dev-open" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule gen-st-dev-open-0-    (forall ((z strd) (d o name))-      (implies-        (and (p "dev-open" z (idx 1)) (p "dev-open" "o" z o)-          (p "dev-open" "d" z d)) (gen-st (cat "st" d o o)))))-  (defgenrule gen-st-dev-close-0-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-close" z (idx 1)) (p "dev-close" "k" z k)-          (p "dev-close" "o" z o) (p "dev-close" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule gen-st-dev-pass-1-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "k" z k)-          (p "dev-pass" "o" z o) (p "dev-pass" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule gen-st-dev-pass-0-    (forall ((z strd) (d o name))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "o" z o)-          (p "dev-pass" "d" z d)) (gen-st (cat "st" d o o))))))--(defskeleton subatomic-open-closed-  (vars (k skey) (d o name) (start-ch chan))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (deflistener k)-  (uniq-orig k)-  (conf start-ch)-  -  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv k) (send k)))-  (label 0)-  (unrealized (0 1) (1 0))-  (preskeleton)-  (origs (k (0 0)))-  (comment "Not a skeleton"))--(defskeleton subatomic-open-closed-  (vars (k skey) (d o name) (start-ch chan))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (deflistener k)-  (precedes ((0 0) (1 0)))-  (uniq-orig k)-  (conf start-ch)-  -  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv k) (send k)))-  (label 1)-  (parent 0)-  (unrealized (0 1) (1 0))-  (origs (k (0 0)))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 mesg) (k skey) (d o name) (pt pt-0 pt-1 pval)-    (start-ch chan) (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (deflistener k)-  (defstrand dev-up 4 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (precedes ((0 0) (2 0)) ((2 3) (1 0)))-  (uniq-orig k)-  (conf start-ch)-  (auth start-ch)-  -  -  (operation nonce-test (added-strand dev-up 4) k (1 0)-    (ch-msg start-ch (cat "power-up" d o k)))-  (strand-map 0 1)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv k) (send k))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt old))-      (load ls (cat pt-0 old1)) (stor lk (cat pt-1 "st-k" d o k))))-  (label 2)-  (parent 1)-  (unrealized (0 1) (1 0))-  (dead)-  (comment "empty cohort"))--(comment "Nothing left to do")--(defprotocol subatomic-open-closed basic-  (defrole dev-up-    (vars (k skey) (d o name) (old old1 mesg) (start-ch chan)-      (lk ls locn))-    (trace (recv start-ch (cat "power-up" d o k)) (load lk old)-      (load ls old1) (stor lk (cat "st-k" d o k))-      (stor ls (cat "st" d o)) (send (enc "up" k)))-    (auth start-ch)-    )-  (defrole owner-power-dev-    (vars (k skey) (d o name) (start-ch chan))-    (trace (send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    (conf start-ch))-  (defrole owner-open-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "open" d o n k)) (recv n)))-  (defrole owner-close-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "close" d o n k)) (recv n)))-  (defrole dev-open-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (recv (enc "open" d o n k)) (load ls (cat "st" d any))-      (load lk (cat "st-k" d o k)) (stor ls (cat "st" d o o)) (send n))-    (gen-st (cat "st-k" d o k) (cat "st" d (cat o o)))-    )-  (defrole dev-close-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (recv (enc "close" d o n k)) (load lk (cat "st-k" d o k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d o)) (send n))-    (gen-st (cat "st-k" d o k))-    )-  (defrole dev-pass-    (vars (k skey) (n text) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (load ls (cat "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    (uniq-orig n)-    (gen-st (cat "st-k" d o k) (cat "st" d (cat o o)))-    )-  (defrole user-pass-    (vars (k skey))-    (trace (send (enc "may I pass" k)) (recv (enc "you may pass" k))))-  (defrule power-deliver-once-    (forall ((z1 z2 strd) (k skey))-      (implies-        (and (p "dev-up" z1 (idx 2)) (p "dev-up" z2 (idx 2))-          (p "dev-up" "k" z1 k) (p "dev-up" "k" z2 k))-        (= z1 z2))))-  (defrule same-dev-ls-lk-    (forall ((ls lk lk-0 locn))-      (implies-        (and (fact same-dev ls lk) (fact same-dev ls lk-0))-        (= lk lk-0))))-  (defrule same-dev-lk-ls-    (forall ((lk ls ls-0 locn))-      (implies-        (and (fact same-dev ls lk) (fact same-dev ls-0 lk))-        (= ls ls-0))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule discreteAfter-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule discreteBefore-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule causeRule-    (forall ((z z1 strd) (i j i1 indx))-      (implies (and (fact st-sg-str z i j) (prec z1 i1 z j))-        (or (= z z1) (prec z1 i1 z i)))))-  (defgenrule effectRule-    (forall ((z z1 strd) (i j i1 indx))-      (implies (and (fact st-sg-str z i j) (prec z i z1 i1))-        (or (= z z1) (prec z j z1 i1)))))-  (defgenrule fact-dev-up-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-up" z (idx 3)) (p "dev-up" "ls" z ls)-          (p "dev-up" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule fact-dev-open-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-open" z (idx 3)) (p "dev-open" "ls" z ls)-          (p "dev-open" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule fact-dev-close-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-close" z (idx 3)) (p "dev-close" "ls" z ls)-          (p "dev-close" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule fact-dev-pass-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-pass" z (idx 2)) (p "dev-pass" "ls" z ls)-          (p "dev-pass" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule trRl_dev-up-at-4-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 4)))))-  (defgenrule trRl_dev-up-at-3-    (forall ((z strd))-      (implies (p "dev-up" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-up-at-2-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 2)))))-  (defgenrule trRl_dev-up-at-1-    (forall ((z strd))-      (implies (p "dev-up" z (idx 4)) (trans z (idx 1)))))-  (defgenrule trRl_dev-open-at-3-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-open-at-1-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 1)))))-  (defgenrule trRl_dev-close-at-3-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-close-at-2-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 2)))))-  (defgenrule st-sg-dev-up-2-    (forall ((z strd))-      (implies (p "dev-up" z (idx 3))-        (fact st-sg-str z (idx 1) (idx 2)))))-  (defgenrule st-sg-dev-up-3-    (forall ((z strd))-      (implies (p "dev-up" z (idx 4))-        (fact st-sg-str z (idx 1) (idx 3)))))-  (defgenrule st-sg-dev-up-4-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5))-        (fact st-sg-str z (idx 1) (idx 4)))))-  (defgenrule st-sg-dev-open-2-    (forall ((z strd))-      (implies (p "dev-open" z (idx 3))-        (fact st-sg-str z (idx 1) (idx 2)))))-  (defgenrule st-sg-dev-open-3-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4))-        (fact st-sg-str z (idx 1) (idx 3)))))-  (defgenrule st-sg-dev-close-2-    (forall ((z strd))-      (implies (p "dev-close" z (idx 3))-        (fact st-sg-str z (idx 1) (idx 2)))))-  (defgenrule st-sg-dev-close-3-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4))-        (fact st-sg-str z (idx 1) (idx 3)))))-  (defgenrule st-sg-dev-pass-1-    (forall ((z strd))-      (implies (p "dev-pass" z (idx 2))-        (fact st-sg-str z (idx 0) (idx 1)))))-  (defgenrule gen-st-dev-open-1-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-open" z (idx 1)) (p "dev-open" "k" z k)-          (p "dev-open" "o" z o) (p "dev-open" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule gen-st-dev-open-0-    (forall ((z strd) (d o name))-      (implies-        (and (p "dev-open" z (idx 1)) (p "dev-open" "o" z o)-          (p "dev-open" "d" z d)) (gen-st (cat "st" d o o)))))-  (defgenrule gen-st-dev-close-0-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-close" z (idx 1)) (p "dev-close" "k" z k)-          (p "dev-close" "o" z o) (p "dev-close" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule gen-st-dev-pass-1-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "k" z k)-          (p "dev-pass" "o" z o) (p "dev-pass" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule gen-st-dev-pass-0-    (forall ((z strd) (d o name))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "o" z o)-          (p "dev-pass" "d" z d)) (gen-st (cat "st" d o o))))))--(defskeleton subatomic-open-closed-  (vars (k skey) (n text) (d o name) (pt pt-0 pval) (lk ls locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (uniq-orig n)-  -  (traces-    ((load lk (cat pt "st-k" d o k)) (load ls (cat pt-0 "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k))))-  (label 3)-  (realized)-  (origs (n (0 3)))-  (comment "Not closed under rules"))--(defskeleton subatomic-open-closed-  (vars (k skey) (n text) (d o name) (pt pt-0 pval) (lk ls locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (uniq-orig n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  -  -  (traces-    ((load lk (cat pt "st-k" d o k)) (load ls (cat pt-0 "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k))))-  (label 4)-  (parent 3)-  (unrealized (0 0) (0 1))-  (origs (n (0 3)))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 mesg) (k skey) (n text) (d o name)-    (pt pt-0 pt-1 pt-2 pval) (start-ch chan) (lk ls locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 4 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (precedes ((1 3) (0 0)))-  (uniq-orig n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (auth start-ch)-  -  (leads-to ((1 3) (0 0)))-  -  (operation channel-test (added-strand dev-up 4)-    (ch-msg lk (cat pt "st-k" d o k)) (0 0))-  (strand-map 0)-  (traces-    ((load lk (cat pt "st-k" d o k)) (load ls (cat pt-0 "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-1 old))-      (load ls (cat pt-2 old1)) (stor lk (cat pt "st-k" d o k))))-  (label 5)-  (parent 4)-  (unrealized (0 1) (1 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 mesg) (k skey) (n text) (d o name)-    (pt pt-0 pt-1 pt-2 pval) (start-ch chan) (lk ls locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 4 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand owner-power-dev 1 (k k) (d d) (o o) (start-ch start-ch))-  (precedes ((1 3) (0 0)) ((2 0) (1 0)))-  (uniq-orig n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  -  (leads-to ((1 3) (0 0)))-  -  (operation channel-test (added-strand owner-power-dev 1)-    (ch-msg start-ch (cat "power-up" d o k)) (1 0))-  (strand-map 0 1)-  (traces-    ((load lk (cat pt "st-k" d o k)) (load ls (cat pt-0 "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-1 old))-      (load ls (cat pt-2 old1)) (stor lk (cat pt "st-k" d o k)))-    ((send start-ch (cat "power-up" d o k))))-  (label 6)-  (parent 5)-  (unrealized (0 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 any mesg) (k k-0 skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (start-ch chan) (ls lk locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 4 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand owner-power-dev 1 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-open 4 (any any) (k k-0) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (precedes ((1 3) (0 0)) ((2 0) (1 0)) ((3 3) (0 0)))-  (uniq-orig n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k) (cat "st-k" d o k-0))-  (conf start-ch)-  (auth start-ch)-  -  (leads-to ((1 3) (0 0)) ((3 3) (0 1)))-  -  (operation channel-test (added-strand dev-open 4)-    (ch-msg ls (cat pt-0 "st" d o o)) (0 1))-  (strand-map 0 1 2)-  (traces-    ((load lk (cat pt "st-k" d o k)) (load ls (cat pt-0 "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-1 old))-      (load ls (cat pt-2 old1)) (stor lk (cat pt "st-k" d o k)))-    ((send start-ch (cat "power-up" d o k)))-    ((recv (enc "open" d o n-0 k-0)) (load ls (cat pt-3 "st" d any))-      (load lk (cat pt-4 "st-k" d o k-0))-      (stor ls (cat pt-0 "st" d o o))))-  (label 7)-  (parent 6)-  (seen 8)-  (seen-ops-    (8-      (operation channel-test (added-strand dev-up 4)-        (ch-msg lk (cat pt "st-k" d o k)) (3 2)) (strand-map 0 1 2 3)))-  (unrealized (3 2))-  (comment "3 in cohort - 2 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 any mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pval) (start-ch chan) (ls lk locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 4 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand owner-power-dev 1 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (precedes ((1 3) (3 1)) ((2 0) (1 0)) ((3 3) (0 0)))-  (uniq-orig n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  -  (leads-to ((1 3) (0 0)) ((1 3) (3 2)) ((3 3) (0 1)))-  -  (operation channel-test (displaced 4 1 dev-up 4)-    (ch-msg lk (cat pt-4 "st-k" d o k-0)) (3 2))-  (strand-map 0 1 2 3)-  (traces-    ((load lk (cat pt "st-k" d o k)) (load ls (cat pt-0 "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-1 old))-      (load ls (cat pt-2 old1)) (stor lk (cat pt "st-k" d o k)))-    ((send start-ch (cat "power-up" d o k)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-3 "st" d any))-      (load lk (cat pt "st-k" d o k)) (stor ls (cat pt-0 "st" d o o))))-  (label 8)-  (parent 7)-  (realized)-  (shape)-  (maps ((0) ((k k) (n n) (d d) (o o) (lk lk) (ls ls))))-  (origs (pt (1 3)) (pt-0 (3 3)) (n (0 3))))--(defskeleton subatomic-open-closed-  (vars (old old1 any old-0 old1-0 mesg) (k k-0 skey) (n n-0 text)-    (d o name) (pt pt-0 pt-1 pt-2 pt-3 pt-4 pt-5 pt-6 pval)-    (start-ch start-ch-0 chan) (lk ls locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 4 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand owner-power-dev 1 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-open 4 (any any) (k k-0) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand dev-up 4 (old old-0) (old1 old1-0) (k k-0) (d d) (o o)-    (start-ch start-ch-0) (lk lk) (ls ls))-  (precedes ((1 3) (0 0)) ((2 0) (1 0)) ((3 3) (0 0)) ((4 3) (1 1))-    ((4 3) (3 1)))-  (uniq-orig n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k) (cat "st-k" d o k-0))-  (conf start-ch)-  (auth start-ch start-ch-0)-  -  (leads-to ((1 3) (0 0)) ((3 3) (0 1)) ((4 3) (3 2)))-  -  (operation channel-test (added-strand dev-up 4)-    (ch-msg lk (cat pt-4 "st-k" d o k-0)) (3 2))-  (strand-map 0 1 2 3)-  (traces-    ((load lk (cat pt "st-k" d o k)) (load ls (cat pt-0 "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-1 old))-      (load ls (cat pt-2 old1)) (stor lk (cat pt "st-k" d o k)))-    ((send start-ch (cat "power-up" d o k)))-    ((recv (enc "open" d o n-0 k-0)) (load ls (cat pt-3 "st" d any))-      (load lk (cat pt-4 "st-k" d o k-0))-      (stor ls (cat pt-0 "st" d o o)))-    ((recv start-ch-0 (cat "power-up" d o k-0))-      (load lk (cat pt-5 old-0)) (load ls (cat pt-6 old1-0))-      (stor lk (cat pt-4 "st-k" d o k-0))))-  (label 9)-  (parent 7)-  (unrealized (4 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 any old-0 old1-0 mesg) (k k-0 skey) (n n-0 text)-    (d o name) (pt pt-0 pt-1 pt-2 pt-3 pt-4 pt-5 pt-6 pval)-    (start-ch start-ch-0 chan) (lk ls locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 4 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand owner-power-dev 1 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-open 4 (any any) (k k-0) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand dev-up 4 (old old-0) (old1 old1-0) (k k-0) (d d) (o o)-    (start-ch start-ch-0) (lk lk) (ls ls))-  (defstrand owner-power-dev 1 (k k-0) (d d) (o o)-    (start-ch start-ch-0))-  (precedes ((1 3) (0 0)) ((2 0) (1 0)) ((3 3) (0 0)) ((4 3) (1 1))-    ((4 3) (3 1)) ((5 0) (4 0)))-  (uniq-orig n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k) (cat "st-k" d o k-0))-  (conf start-ch start-ch-0)-  (auth start-ch start-ch-0)-  -  (leads-to ((1 3) (0 0)) ((3 3) (0 1)) ((4 3) (3 2)))-  -  (operation channel-test (added-strand owner-power-dev 1)-    (ch-msg start-ch-0 (cat "power-up" d o k-0)) (4 0))-  (strand-map 0 1 2 3 4)-  (traces-    ((load lk (cat pt "st-k" d o k)) (load ls (cat pt-0 "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-1 old))-      (load ls (cat pt-2 old1)) (stor lk (cat pt "st-k" d o k)))-    ((send start-ch (cat "power-up" d o k)))-    ((recv (enc "open" d o n-0 k-0)) (load ls (cat pt-3 "st" d any))-      (load lk (cat pt-4 "st-k" d o k-0))-      (stor ls (cat pt-0 "st" d o o)))-    ((recv start-ch-0 (cat "power-up" d o k-0))-      (load lk (cat pt-5 old-0)) (load ls (cat pt-6 old1-0))-      (stor lk (cat pt-4 "st-k" d o k-0)))-    ((send start-ch-0 (cat "power-up" d o k-0))))-  (label 10)-  (parent 9)-  (realized)-  (shape)-  (maps ((0) ((k k) (n n) (d d) (o o) (lk lk) (ls ls))))-  (origs (pt-4 (4 3)) (pt-0 (3 3)) (pt (1 3)) (n (0 3))))--(comment "Nothing left to do")--(defprotocol subatomic-open-closed basic-  (defrole dev-up-    (vars (k skey) (d o name) (old old1 mesg) (start-ch chan)-      (lk ls locn))-    (trace (recv start-ch (cat "power-up" d o k)) (load lk old)-      (load ls old1) (stor lk (cat "st-k" d o k))-      (stor ls (cat "st" d o)) (send (enc "up" k)))-    (auth start-ch)-    )-  (defrole owner-power-dev-    (vars (k skey) (d o name) (start-ch chan))-    (trace (send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    (conf start-ch))-  (defrole owner-open-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "open" d o n k)) (recv n)))-  (defrole owner-close-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "close" d o n k)) (recv n)))-  (defrole dev-open-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (recv (enc "open" d o n k)) (load ls (cat "st" d any))-      (load lk (cat "st-k" d o k)) (stor ls (cat "st" d o o)) (send n))-    (gen-st (cat "st-k" d o k) (cat "st" d (cat o o)))-    )-  (defrole dev-close-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (recv (enc "close" d o n k)) (load lk (cat "st-k" d o k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d o)) (send n))-    (gen-st (cat "st-k" d o k))-    )-  (defrole dev-pass-    (vars (k skey) (n text) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (load ls (cat "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    (uniq-orig n)-    (gen-st (cat "st-k" d o k) (cat "st" d (cat o o)))-    )-  (defrole user-pass-    (vars (k skey))-    (trace (send (enc "may I pass" k)) (recv (enc "you may pass" k))))-  (defrule power-deliver-once-    (forall ((z1 z2 strd) (k skey))-      (implies-        (and (p "dev-up" z1 (idx 2)) (p "dev-up" z2 (idx 2))-          (p "dev-up" "k" z1 k) (p "dev-up" "k" z2 k))-        (= z1 z2))))-  (defrule same-dev-ls-lk-    (forall ((ls lk lk-0 locn))-      (implies-        (and (fact same-dev ls lk) (fact same-dev ls lk-0))-        (= lk lk-0))))-  (defrule same-dev-lk-ls-    (forall ((lk ls ls-0 locn))-      (implies-        (and (fact same-dev ls lk) (fact same-dev ls-0 lk))-        (= ls ls-0))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule discreteAfter-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule discreteBefore-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule causeRule-    (forall ((z z1 strd) (i j i1 indx))-      (implies (and (fact st-sg-str z i j) (prec z1 i1 z j))-        (or (= z z1) (prec z1 i1 z i)))))-  (defgenrule effectRule-    (forall ((z z1 strd) (i j i1 indx))-      (implies (and (fact st-sg-str z i j) (prec z i z1 i1))-        (or (= z z1) (prec z j z1 i1)))))-  (defgenrule fact-dev-up-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-up" z (idx 3)) (p "dev-up" "ls" z ls)-          (p "dev-up" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule fact-dev-open-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-open" z (idx 3)) (p "dev-open" "ls" z ls)-          (p "dev-open" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule fact-dev-close-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-close" z (idx 3)) (p "dev-close" "ls" z ls)-          (p "dev-close" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule fact-dev-pass-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-pass" z (idx 2)) (p "dev-pass" "ls" z ls)-          (p "dev-pass" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule trRl_dev-up-at-4-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 4)))))-  (defgenrule trRl_dev-up-at-3-    (forall ((z strd))-      (implies (p "dev-up" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-up-at-2-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 2)))))-  (defgenrule trRl_dev-up-at-1-    (forall ((z strd))-      (implies (p "dev-up" z (idx 4)) (trans z (idx 1)))))-  (defgenrule trRl_dev-open-at-3-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-open-at-1-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 1)))))-  (defgenrule trRl_dev-close-at-3-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-close-at-2-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 2)))))-  (defgenrule st-sg-dev-up-2-    (forall ((z strd))-      (implies (p "dev-up" z (idx 3))-        (fact st-sg-str z (idx 1) (idx 2)))))-  (defgenrule st-sg-dev-up-3-    (forall ((z strd))-      (implies (p "dev-up" z (idx 4))-        (fact st-sg-str z (idx 1) (idx 3)))))-  (defgenrule st-sg-dev-up-4-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5))-        (fact st-sg-str z (idx 1) (idx 4)))))-  (defgenrule st-sg-dev-open-2-    (forall ((z strd))-      (implies (p "dev-open" z (idx 3))-        (fact st-sg-str z (idx 1) (idx 2)))))-  (defgenrule st-sg-dev-open-3-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4))-        (fact st-sg-str z (idx 1) (idx 3)))))-  (defgenrule st-sg-dev-close-2-    (forall ((z strd))-      (implies (p "dev-close" z (idx 3))-        (fact st-sg-str z (idx 1) (idx 2)))))-  (defgenrule st-sg-dev-close-3-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4))-        (fact st-sg-str z (idx 1) (idx 3)))))-  (defgenrule st-sg-dev-pass-1-    (forall ((z strd))-      (implies (p "dev-pass" z (idx 2))-        (fact st-sg-str z (idx 0) (idx 1)))))-  (defgenrule gen-st-dev-open-1-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-open" z (idx 1)) (p "dev-open" "k" z k)-          (p "dev-open" "o" z o) (p "dev-open" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule gen-st-dev-open-0-    (forall ((z strd) (d o name))-      (implies-        (and (p "dev-open" z (idx 1)) (p "dev-open" "o" z o)-          (p "dev-open" "d" z d)) (gen-st (cat "st" d o o)))))-  (defgenrule gen-st-dev-close-0-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-close" z (idx 1)) (p "dev-close" "k" z k)-          (p "dev-close" "o" z o) (p "dev-close" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule gen-st-dev-pass-1-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "k" z k)-          (p "dev-pass" "o" z o) (p "dev-pass" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule gen-st-dev-pass-0-    (forall ((z strd) (d o name))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "o" z o)-          (p "dev-pass" "d" z d)) (gen-st (cat "st" d o o))))))--(defskeleton subatomic-open-closed-  (vars (k skey) (n text) (d o d-0 o-0 name) (pt pt-0 pval)-    (start-ch chan) (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d-0) (o o-0) (lk lk) (ls ls))-  (uniq-orig k n)-  (conf start-ch)-  -  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt "st-k" d-0 o-0 k))-      (load ls (cat pt-0 "st" d-0 o-0 o-0)) (recv (enc "may I pass" k))-      (send (enc "you may pass" n k))))-  (label 11)-  (unrealized (0 1) (1 0) (1 2))-  (preskeleton)-  (origs (n (1 3)) (k (0 0)))-  (comment "Not a skeleton"))--(defskeleton subatomic-open-closed-  (vars (k skey) (n text) (d o d-0 o-0 name) (pt pt-0 pval)-    (start-ch chan) (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d-0) (o o-0) (lk lk) (ls ls))-  (precedes ((0 0) (1 0)))-  (uniq-orig k n)-  (conf start-ch)-  -  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt "st-k" d-0 o-0 k))-      (load ls (cat pt-0 "st" d-0 o-0 o-0)) (recv (enc "may I pass" k))-      (send (enc "you may pass" n k))))-  (label 12)-  (parent 11)-  (unrealized (0 1) (1 0) (1 2))-  (origs (n (1 3)) (k (0 0)))-  (comment "Not closed under rules"))--(defskeleton subatomic-open-closed-  (vars (k skey) (n text) (d o d-0 o-0 name) (pt pt-0 pval)-    (start-ch chan) (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d-0) (o o-0) (lk lk) (ls ls))-  (precedes ((0 0) (1 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d-0 o-0 o-0) (cat "st-k" d-0 o-0 k))-  (conf start-ch)-  -  -  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt "st-k" d-0 o-0 k))-      (load ls (cat pt-0 "st" d-0 o-0 o-0)) (recv (enc "may I pass" k))-      (send (enc "you may pass" n k))))-  (label 13)-  (parent 12)-  (unrealized (0 1) (1 0) (1 1) (1 2))-  (origs (n (1 3)) (k (0 0)))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 mesg) (k skey) (n text) (d o d-0 o-0 name)-    (pt pt-0 pt-1 pt-2 pval) (start-ch start-ch-0 chan) (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d-0) (o o-0) (lk lk) (ls ls))-  (defstrand dev-up 4 (old old) (old1 old1) (k k) (d d-0) (o o-0)-    (start-ch start-ch-0) (lk lk) (ls ls))-  (precedes ((0 0) (2 0)) ((2 3) (1 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d-0 o-0 o-0) (cat "st-k" d-0 o-0 k))-  (conf start-ch)-  (auth start-ch-0)-  -  (leads-to ((2 3) (1 0)))-  -  (operation channel-test (added-strand dev-up 4)-    (ch-msg lk (cat pt "st-k" d-0 o-0 k)) (1 0))-  (strand-map 0 1)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt "st-k" d-0 o-0 k))-      (load ls (cat pt-0 "st" d-0 o-0 o-0)) (recv (enc "may I pass" k))-      (send (enc "you may pass" n k)))-    ((recv start-ch-0 (cat "power-up" d-0 o-0 k))-      (load lk (cat pt-1 old)) (load ls (cat pt-2 old1))-      (stor lk (cat pt "st-k" d-0 o-0 k))))-  (label 14)-  (parent 13)-  (unrealized (0 1) (1 1) (1 2) (2 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 mesg) (k skey) (n text) (d o name)-    (pt pt-0 pt-1 pt-2 pval) (start-ch chan) (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 4 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (precedes ((0 0) (2 0)) ((2 3) (1 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  -  (leads-to ((2 3) (1 0)))-  -  (operation channel-test (displaced 3 0 owner-power-dev 1)-    (ch-msg start-ch-0 (cat "power-up" d-0 o-0 k)) (2 0))-  (strand-map 0 1 2)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt "st-k" d o k)) (load ls (cat pt-0 "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-1 old))-      (load ls (cat pt-2 old1)) (stor lk (cat pt "st-k" d o k))))-  (label 15)-  (parent 14)-  (unrealized (0 1) (1 1) (1 2))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 any mesg) (k k-0 skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (start-ch chan) (ls lk locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 4 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k-0) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (precedes ((0 0) (2 0)) ((2 3) (1 0)) ((3 3) (1 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k) (cat "st-k" d o k-0))-  (conf start-ch)-  (auth start-ch)-  -  (leads-to ((2 3) (1 0)) ((3 3) (1 1)))-  -  (operation channel-test (added-strand dev-open 4)-    (ch-msg ls (cat pt-0 "st" d o o)) (1 1))-  (strand-map 0 1 2)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt "st-k" d o k)) (load ls (cat pt-0 "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-1 old))-      (load ls (cat pt-2 old1)) (stor lk (cat pt "st-k" d o k)))-    ((recv (enc "open" d o n-0 k-0)) (load ls (cat pt-3 "st" d any))-      (load lk (cat pt-4 "st-k" d o k-0))-      (stor ls (cat pt-0 "st" d o o))))-  (label 16)-  (parent 15)-  (seen 17)-  (seen-ops-    (17-      (operation channel-test (added-strand dev-up 4)-        (ch-msg lk (cat pt "st-k" d o k)) (3 2)) (strand-map 0 1 2 3)))-  (unrealized (0 1) (1 2) (3 2))-  (comment "3 in cohort - 2 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 any mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pval) (start-ch chan) (ls lk locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 4 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (precedes ((0 0) (2 0)) ((2 3) (3 1)) ((3 3) (1 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  -  (leads-to ((2 3) (1 0)) ((2 3) (3 2)) ((3 3) (1 1)))-  -  (operation channel-test (displaced 4 2 dev-up 4)-    (ch-msg lk (cat pt-4 "st-k" d o k-0)) (3 2))-  (strand-map 0 1 2 3)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt "st-k" d o k)) (load ls (cat pt-0 "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-1 old))-      (load ls (cat pt-2 old1)) (stor lk (cat pt "st-k" d o k)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-3 "st" d any))-      (load lk (cat pt "st-k" d o k)) (stor ls (cat pt-0 "st" d o o))))-  (label 17)-  (parent 16)-  (unrealized (0 1) (1 2) (3 0))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 any old-0 old1-0 mesg) (k k-0 skey) (n n-0 text)-    (d o name) (pt pt-0 pt-1 pt-2 pt-3 pt-4 pt-5 pt-6 pval)-    (start-ch start-ch-0 chan) (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 4 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k-0) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand dev-up 4 (old old-0) (old1 old1-0) (k k-0) (d d) (o o)-    (start-ch start-ch-0) (lk lk) (ls ls))-  (precedes ((0 0) (2 0)) ((2 3) (1 0)) ((3 3) (1 0)) ((4 3) (2 1))-    ((4 3) (3 1)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k) (cat "st-k" d o k-0))-  (conf start-ch)-  (auth start-ch start-ch-0)-  -  (leads-to ((2 3) (1 0)) ((3 3) (1 1)) ((4 3) (3 2)))-  -  (operation channel-test (added-strand dev-up 4)-    (ch-msg lk (cat pt-4 "st-k" d o k-0)) (3 2))-  (strand-map 0 1 2 3)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt "st-k" d o k)) (load ls (cat pt-0 "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-1 old))-      (load ls (cat pt-2 old1)) (stor lk (cat pt "st-k" d o k)))-    ((recv (enc "open" d o n-0 k-0)) (load ls (cat pt-3 "st" d any))-      (load lk (cat pt-4 "st-k" d o k-0))-      (stor ls (cat pt-0 "st" d o o)))-    ((recv start-ch-0 (cat "power-up" d o k-0))-      (load lk (cat pt-5 old-0)) (load ls (cat pt-6 old1-0))-      (stor lk (cat pt-4 "st-k" d o k-0))))-  (label 18)-  (parent 16)-  (unrealized (0 1) (1 2) (4 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 any mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pval) (start-ch chan) (ls lk locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 4 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand owner-open 1 (k k) (n n-0) (d d) (o o))-  (precedes ((0 0) (2 0)) ((2 3) (3 1)) ((3 3) (1 0)) ((4 0) (3 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  -  (leads-to ((2 3) (1 0)) ((2 3) (3 2)) ((3 3) (1 1)))-  -  (operation encryption-test (added-strand owner-open 1)-    (enc "open" d o n-0 k) (3 0))-  (strand-map 0 1 2 3)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt "st-k" d o k)) (load ls (cat pt-0 "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-1 old))-      (load ls (cat pt-2 old1)) (stor lk (cat pt "st-k" d o k)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-3 "st" d any))-      (load lk (cat pt "st-k" d o k)) (stor ls (cat pt-0 "st" d o o)))-    ((send (enc "open" d o n-0 k))))-  (label 19)-  (parent 17)-  (unrealized (0 1) (1 2))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 any mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pval) (start-ch chan) (ls lk locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 4 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (deflistener k)-  (precedes ((0 0) (2 0)) ((0 0) (4 0)) ((2 3) (3 1)) ((3 3) (1 0))-    ((4 1) (3 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  -  (leads-to ((2 3) (1 0)) ((2 3) (3 2)) ((3 3) (1 1)))-  -  (operation encryption-test (added-listener k) (enc "open" d o n-0 k)-    (3 0))-  (strand-map 0 1 2 3)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt "st-k" d o k)) (load ls (cat pt-0 "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-1 old))-      (load ls (cat pt-2 old1)) (stor lk (cat pt "st-k" d o k)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-3 "st" d any))-      (load lk (cat pt "st-k" d o k)) (stor ls (cat pt-0 "st" d o o)))-    ((recv k) (send k)))-  (label 20)-  (parent 17)-  (seen 24)-  (seen-ops-    (24-      (operation nonce-test (added-strand dev-up 4) k (4 0)-        (ch-msg start-ch (cat "power-up" d o k)))-      (strand-map 0 1 2 3 4)))-  (unrealized (0 1) (4 0))-  (comment "2 in cohort - 1 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 any old-0 old1-0 mesg) (k k-0 skey) (n n-0 text)-    (d o name) (pt pt-0 pt-1 pt-2 pt-3 pt-4 pt-5 pt-6 pval)-    (start-ch start-ch-0 chan) (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 4 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k-0) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand dev-up 4 (old old-0) (old1 old1-0) (k k-0) (d d) (o o)-    (start-ch start-ch-0) (lk lk) (ls ls))-  (defstrand owner-power-dev 1 (k k-0) (d d) (o o)-    (start-ch start-ch-0))-  (precedes ((0 0) (2 0)) ((2 3) (1 0)) ((3 3) (1 0)) ((4 3) (2 1))-    ((4 3) (3 1)) ((5 0) (4 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k) (cat "st-k" d o k-0))-  (conf start-ch start-ch-0)-  (auth start-ch start-ch-0)-  -  (leads-to ((2 3) (1 0)) ((3 3) (1 1)) ((4 3) (3 2)))-  -  (operation channel-test (added-strand owner-power-dev 1)-    (ch-msg start-ch-0 (cat "power-up" d o k-0)) (4 0))-  (strand-map 0 1 2 3 4)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt "st-k" d o k)) (load ls (cat pt-0 "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-1 old))-      (load ls (cat pt-2 old1)) (stor lk (cat pt "st-k" d o k)))-    ((recv (enc "open" d o n-0 k-0)) (load ls (cat pt-3 "st" d any))-      (load lk (cat pt-4 "st-k" d o k-0))-      (stor ls (cat pt-0 "st" d o o)))-    ((recv start-ch-0 (cat "power-up" d o k-0))-      (load lk (cat pt-5 old-0)) (load ls (cat pt-6 old1-0))-      (stor lk (cat pt-4 "st-k" d o k-0)))-    ((send start-ch-0 (cat "power-up" d o k-0))))-  (label 21)-  (parent 18)-  (unrealized (0 1) (1 2))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 any mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pval) (start-ch chan) (ls lk locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 4 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand owner-open 1 (k k) (n n-0) (d d) (o o))-  (defstrand user-pass 1 (k k))-  (precedes ((0 0) (2 0)) ((2 3) (3 1)) ((3 3) (1 0)) ((4 0) (3 0))-    ((5 0) (1 2)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  -  (leads-to ((2 3) (1 0)) ((2 3) (3 2)) ((3 3) (1 1)))-  -  (operation encryption-test (added-strand user-pass 1)-    (enc "may I pass" k) (1 2))-  (strand-map 0 1 2 3 4)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt "st-k" d o k)) (load ls (cat pt-0 "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-1 old))-      (load ls (cat pt-2 old1)) (stor lk (cat pt "st-k" d o k)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-3 "st" d any))-      (load lk (cat pt "st-k" d o k)) (stor ls (cat pt-0 "st" d o o)))-    ((send (enc "open" d o n-0 k))) ((send (enc "may I pass" k))))-  (label 22)-  (parent 19)-  (seen 27)-  (seen-ops-    (27-      (operation encryption-test (added-strand dev-up 6) (enc "up" k)-        (0 1)) (strand-map 0 1 5 2 3 4)))-  (unrealized (0 1))-  (comment "3 in cohort - 2 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 any mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pval) (start-ch chan) (ls lk locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 4 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand owner-open 1 (k k) (n n-0) (d d) (o o))-  (deflistener k)-  (precedes ((0 0) (2 0)) ((0 0) (5 0)) ((2 3) (3 1)) ((3 3) (1 0))-    ((4 0) (3 0)) ((5 1) (1 2)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  -  (leads-to ((2 3) (1 0)) ((2 3) (3 2)) ((3 3) (1 1)))-  -  (operation encryption-test (added-listener k) (enc "may I pass" k)-    (1 2))-  (strand-map 0 1 2 3 4)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt "st-k" d o k)) (load ls (cat pt-0 "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-1 old))-      (load ls (cat pt-2 old1)) (stor lk (cat pt "st-k" d o k)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-3 "st" d any))-      (load lk (cat pt "st-k" d o k)) (stor ls (cat pt-0 "st" d o o)))-    ((send (enc "open" d o n-0 k))) ((recv k) (send k)))-  (label 23)-  (parent 19)-  (seen 29)-  (seen-ops-    (29-      (operation nonce-test (added-strand dev-up 4) k (5 0)-        (ch-msg start-ch (cat "power-up" d o k)))-      (strand-map 0 1 2 3 4 5)))-  (unrealized (0 1) (5 0))-  (comment "2 in cohort - 1 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 any mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pval) (start-ch chan) (ls lk locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 4 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (deflistener k)-  (precedes ((0 0) (2 0)) ((2 3) (4 0)) ((3 3) (1 0)) ((4 1) (3 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  -  (leads-to ((2 3) (1 0)) ((2 3) (3 2)) ((3 3) (1 1)))-  -  (operation nonce-test (displaced 5 2 dev-up 4) k (4 0)-    (ch-msg start-ch (cat "power-up" d o k)))-  (strand-map 0 1 2 3 4)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt "st-k" d o k)) (load ls (cat pt-0 "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-1 old))-      (load ls (cat pt-2 old1)) (stor lk (cat pt "st-k" d o k)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-3 "st" d any))-      (load lk (cat pt "st-k" d o k)) (stor ls (cat pt-0 "st" d o o)))-    ((recv k) (send k)))-  (label 24)-  (parent 20)-  (unrealized (0 1) (4 0))-  (dead)-  (comment "empty cohort"))--(defskeleton subatomic-open-closed-  (vars (old old1 any old-0 old1-0 mesg) (k k-0 skey) (n n-0 text)-    (d o name) (pt pt-0 pt-1 pt-2 pt-3 pt-4 pt-5 pt-6 pval)-    (start-ch start-ch-0 chan) (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 4 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k-0) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand dev-up 4 (old old-0) (old1 old1-0) (k k-0) (d d) (o o)-    (start-ch start-ch-0) (lk lk) (ls ls))-  (defstrand owner-power-dev 1 (k k-0) (d d) (o o)-    (start-ch start-ch-0))-  (defstrand user-pass 1 (k k))-  (precedes ((0 0) (2 0)) ((2 3) (1 0)) ((3 3) (1 0)) ((4 3) (2 1))-    ((4 3) (3 1)) ((5 0) (4 0)) ((6 0) (1 2)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k) (cat "st-k" d o k-0))-  (conf start-ch start-ch-0)-  (auth start-ch start-ch-0)-  -  (leads-to ((2 3) (1 0)) ((3 3) (1 1)) ((4 3) (3 2)))-  -  (operation encryption-test (added-strand user-pass 1)-    (enc "may I pass" k) (1 2))-  (strand-map 0 1 2 3 4 5)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt "st-k" d o k)) (load ls (cat pt-0 "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-1 old))-      (load ls (cat pt-2 old1)) (stor lk (cat pt "st-k" d o k)))-    ((recv (enc "open" d o n-0 k-0)) (load ls (cat pt-3 "st" d any))-      (load lk (cat pt-4 "st-k" d o k-0))-      (stor ls (cat pt-0 "st" d o o)))-    ((recv start-ch-0 (cat "power-up" d o k-0))-      (load lk (cat pt-5 old-0)) (load ls (cat pt-6 old1-0))-      (stor lk (cat pt-4 "st-k" d o k-0)))-    ((send start-ch-0 (cat "power-up" d o k-0)))-    ((send (enc "may I pass" k))))-  (label 25)-  (parent 21)-  (unrealized (0 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 any old-0 old1-0 mesg) (k k-0 skey) (n n-0 text)-    (d o name) (pt pt-0 pt-1 pt-2 pt-3 pt-4 pt-5 pt-6 pval)-    (start-ch start-ch-0 chan) (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 4 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k-0) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand dev-up 4 (old old-0) (old1 old1-0) (k k-0) (d d) (o o)-    (start-ch start-ch-0) (lk lk) (ls ls))-  (defstrand owner-power-dev 1 (k k-0) (d d) (o o)-    (start-ch start-ch-0))-  (deflistener k)-  (precedes ((0 0) (2 0)) ((0 0) (6 0)) ((2 3) (1 0)) ((3 3) (1 0))-    ((4 3) (2 1)) ((4 3) (3 1)) ((5 0) (4 0)) ((6 1) (1 2)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k) (cat "st-k" d o k-0))-  (conf start-ch start-ch-0)-  (auth start-ch start-ch-0)-  -  (leads-to ((2 3) (1 0)) ((3 3) (1 1)) ((4 3) (3 2)))-  -  (operation encryption-test (added-listener k) (enc "may I pass" k)-    (1 2))-  (strand-map 0 1 2 3 4 5)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt "st-k" d o k)) (load ls (cat pt-0 "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-1 old))-      (load ls (cat pt-2 old1)) (stor lk (cat pt "st-k" d o k)))-    ((recv (enc "open" d o n-0 k-0)) (load ls (cat pt-3 "st" d any))-      (load lk (cat pt-4 "st-k" d o k-0))-      (stor ls (cat pt-0 "st" d o o)))-    ((recv start-ch-0 (cat "power-up" d o k-0))-      (load lk (cat pt-5 old-0)) (load ls (cat pt-6 old1-0))-      (stor lk (cat pt-4 "st-k" d o k-0)))-    ((send start-ch-0 (cat "power-up" d o k-0))) ((recv k) (send k)))-  (label 26)-  (parent 21)-  (seen 31)-  (seen-ops-    (31-      (operation nonce-test (added-strand dev-up 4) k (6 0)-        (ch-msg start-ch (cat "power-up" d o k)))-      (strand-map 0 1 2 3 4 5 6)))-  (unrealized (0 1) (6 0))-  (comment "2 in cohort - 1 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (any old old1 mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (start-ch chan) (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand owner-open 1 (k k) (n n-0) (d d) (o o))-  (defstrand user-pass 1 (k k))-  (defstrand dev-up 6 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (precedes ((0 0) (5 0)) ((2 3) (1 0)) ((3 0) (2 0)) ((4 0) (1 2))-    ((5 4) (2 1)) ((5 5) (0 1)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  -  (leads-to ((2 3) (1 1)) ((5 3) (1 0)) ((5 3) (2 2)))-  -  (operation encryption-test (displaced 2 6 dev-up 6) (enc "up" k)-    (0 1))-  (strand-map 0 1 5 2 3 4)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt-3 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-0 "st" d any))-      (load lk (cat pt-3 "st-k" d o k)) (stor ls (cat pt "st" d o o)))-    ((send (enc "open" d o n-0 k))) ((send (enc "may I pass" k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-1 old))-      (load ls (cat pt-2 old1)) (stor lk (cat pt-3 "st-k" d o k))-      (stor ls (cat pt-4 "st" d o)) (send (enc "up" k))))-  (label 27)-  (parent 22)-  (realized)-  (shape)-  (maps-    ((0 1)-      ((k k) (d d) (o o) (start-ch start-ch) (n n) (d-0 d) (o-0 o)-        (lk lk) (ls ls))))-  (origs (pt-3 (5 3)) (pt-4 (5 4)) (pt (2 3)) (n (1 3)) (k (0 0))))--(defskeleton subatomic-open-closed-  (vars (old old1 any mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pval) (start-ch chan) (ls lk locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 4 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand owner-open 1 (k k) (n n-0) (d d) (o o))-  (defstrand user-pass 1 (k k))-  (deflistener k)-  (precedes ((0 0) (2 0)) ((0 0) (6 0)) ((2 3) (3 1)) ((3 3) (1 0))-    ((4 0) (3 0)) ((5 0) (1 2)) ((6 1) (0 1)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  -  (leads-to ((2 3) (1 0)) ((2 3) (3 2)) ((3 3) (1 1)))-  -  (operation encryption-test (added-listener k) (enc "up" k) (0 1))-  (strand-map 0 1 2 3 4 5)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt "st-k" d o k)) (load ls (cat pt-0 "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-1 old))-      (load ls (cat pt-2 old1)) (stor lk (cat pt "st-k" d o k)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-3 "st" d any))-      (load lk (cat pt "st-k" d o k)) (stor ls (cat pt-0 "st" d o o)))-    ((send (enc "open" d o n-0 k))) ((send (enc "may I pass" k)))-    ((recv k) (send k)))-  (label 28)-  (parent 22)-  (seen 32)-  (seen-ops-    (32-      (operation nonce-test (added-strand dev-up 4) k (6 0)-        (ch-msg start-ch (cat "power-up" d o k)))-      (strand-map 0 1 2 3 4 5 6)))-  (unrealized (6 0))-  (comment "2 in cohort - 1 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 any mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pval) (start-ch chan) (ls lk locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 4 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand owner-open 1 (k k) (n n-0) (d d) (o o))-  (deflistener k)-  (precedes ((0 0) (2 0)) ((2 3) (3 1)) ((2 3) (5 0)) ((3 3) (1 0))-    ((4 0) (3 0)) ((5 1) (1 2)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  -  (leads-to ((2 3) (1 0)) ((2 3) (3 2)) ((3 3) (1 1)))-  -  (operation nonce-test (displaced 6 2 dev-up 4) k (5 0)-    (ch-msg start-ch (cat "power-up" d o k)))-  (strand-map 0 1 2 3 4 5)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt "st-k" d o k)) (load ls (cat pt-0 "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-1 old))-      (load ls (cat pt-2 old1)) (stor lk (cat pt "st-k" d o k)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-3 "st" d any))-      (load lk (cat pt "st-k" d o k)) (stor ls (cat pt-0 "st" d o o)))-    ((send (enc "open" d o n-0 k))) ((recv k) (send k)))-  (label 29)-  (parent 23)-  (unrealized (0 1) (5 0))-  (dead)-  (comment "empty cohort"))--(defskeleton subatomic-open-closed-  (vars (old old1 any old-0 old1-0 mesg) (k k-0 skey) (n n-0 text)-    (d o name) (pt pt-0 pt-1 pt-2 pt-3 pt-4 pt-5 pt-6 pval)-    (start-ch start-ch-0 chan) (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 4 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k-0) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand dev-up 4 (old old-0) (old1 old1-0) (k k-0) (d d) (o o)-    (start-ch start-ch-0) (lk lk) (ls ls))-  (defstrand owner-power-dev 1 (k k-0) (d d) (o o)-    (start-ch start-ch-0))-  (defstrand user-pass 1 (k k))-  (deflistener k)-  (precedes ((0 0) (2 0)) ((0 0) (7 0)) ((2 3) (1 0)) ((3 3) (1 0))-    ((4 3) (2 1)) ((4 3) (3 1)) ((5 0) (4 0)) ((6 0) (1 2))-    ((7 1) (0 1)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k) (cat "st-k" d o k-0))-  (conf start-ch start-ch-0)-  (auth start-ch start-ch-0)-  -  (leads-to ((2 3) (1 0)) ((3 3) (1 1)) ((4 3) (3 2)))-  -  (operation encryption-test (added-listener k) (enc "up" k) (0 1))-  (strand-map 0 1 2 3 4 5 6)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt "st-k" d o k)) (load ls (cat pt-0 "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-1 old))-      (load ls (cat pt-2 old1)) (stor lk (cat pt "st-k" d o k)))-    ((recv (enc "open" d o n-0 k-0)) (load ls (cat pt-3 "st" d any))-      (load lk (cat pt-4 "st-k" d o k-0))-      (stor ls (cat pt-0 "st" d o o)))-    ((recv start-ch-0 (cat "power-up" d o k-0))-      (load lk (cat pt-5 old-0)) (load ls (cat pt-6 old1-0))-      (stor lk (cat pt-4 "st-k" d o k-0)))-    ((send start-ch-0 (cat "power-up" d o k-0)))-    ((send (enc "may I pass" k))) ((recv k) (send k)))-  (label 30)-  (parent 25)-  (seen 33)-  (seen-ops-    (33-      (operation nonce-test (added-strand dev-up 4) k (7 0)-        (ch-msg start-ch (cat "power-up" d o k)))-      (strand-map 0 1 2 3 4 5 6 7)))-  (unrealized (7 0))-  (comment "2 in cohort - 1 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 any old-0 old1-0 mesg) (k k-0 skey) (n n-0 text)-    (d o name) (pt pt-0 pt-1 pt-2 pt-3 pt-4 pt-5 pt-6 pval)-    (start-ch start-ch-0 chan) (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 4 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k-0) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand dev-up 4 (old old-0) (old1 old1-0) (k k-0) (d d) (o o)-    (start-ch start-ch-0) (lk lk) (ls ls))-  (defstrand owner-power-dev 1 (k k-0) (d d) (o o)-    (start-ch start-ch-0))-  (deflistener k)-  (precedes ((0 0) (2 0)) ((2 3) (1 0)) ((2 3) (6 0)) ((3 3) (1 0))-    ((4 3) (2 1)) ((4 3) (3 1)) ((5 0) (4 0)) ((6 1) (1 2)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k) (cat "st-k" d o k-0))-  (conf start-ch start-ch-0)-  (auth start-ch start-ch-0)-  -  (leads-to ((2 3) (1 0)) ((3 3) (1 1)) ((4 3) (3 2)))-  -  (operation nonce-test (displaced 7 2 dev-up 4) k (6 0)-    (ch-msg start-ch (cat "power-up" d o k)))-  (strand-map 0 1 2 3 4 5 6)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt "st-k" d o k)) (load ls (cat pt-0 "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-1 old))-      (load ls (cat pt-2 old1)) (stor lk (cat pt "st-k" d o k)))-    ((recv (enc "open" d o n-0 k-0)) (load ls (cat pt-3 "st" d any))-      (load lk (cat pt-4 "st-k" d o k-0))-      (stor ls (cat pt-0 "st" d o o)))-    ((recv start-ch-0 (cat "power-up" d o k-0))-      (load lk (cat pt-5 old-0)) (load ls (cat pt-6 old1-0))-      (stor lk (cat pt-4 "st-k" d o k-0)))-    ((send start-ch-0 (cat "power-up" d o k-0))) ((recv k) (send k)))-  (label 31)-  (parent 26)-  (unrealized (0 1) (6 0))-  (dead)-  (comment "empty cohort"))--(defskeleton subatomic-open-closed-  (vars (old old1 any mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pval) (start-ch chan) (ls lk locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 4 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand owner-open 1 (k k) (n n-0) (d d) (o o))-  (defstrand user-pass 1 (k k))-  (deflistener k)-  (precedes ((0 0) (2 0)) ((2 3) (3 1)) ((2 3) (6 0)) ((3 3) (1 0))-    ((4 0) (3 0)) ((5 0) (1 2)) ((6 1) (0 1)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  -  (leads-to ((2 3) (1 0)) ((2 3) (3 2)) ((3 3) (1 1)))-  -  (operation nonce-test (displaced 7 2 dev-up 4) k (6 0)-    (ch-msg start-ch (cat "power-up" d o k)))-  (strand-map 0 1 2 3 4 5 6)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt "st-k" d o k)) (load ls (cat pt-0 "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-1 old))-      (load ls (cat pt-2 old1)) (stor lk (cat pt "st-k" d o k)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-3 "st" d any))-      (load lk (cat pt "st-k" d o k)) (stor ls (cat pt-0 "st" d o o)))-    ((send (enc "open" d o n-0 k))) ((send (enc "may I pass" k)))-    ((recv k) (send k)))-  (label 32)-  (parent 28)-  (unrealized (6 0))-  (dead)-  (comment "empty cohort"))--(defskeleton subatomic-open-closed-  (vars (old old1 any old-0 old1-0 mesg) (k k-0 skey) (n n-0 text)-    (d o name) (pt pt-0 pt-1 pt-2 pt-3 pt-4 pt-5 pt-6 pval)-    (start-ch start-ch-0 chan) (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 4 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k-0) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand dev-up 4 (old old-0) (old1 old1-0) (k k-0) (d d) (o o)-    (start-ch start-ch-0) (lk lk) (ls ls))-  (defstrand owner-power-dev 1 (k k-0) (d d) (o o)-    (start-ch start-ch-0))-  (defstrand user-pass 1 (k k))-  (deflistener k)-  (precedes ((0 0) (2 0)) ((2 3) (1 0)) ((2 3) (7 0)) ((3 3) (1 0))-    ((4 3) (2 1)) ((4 3) (3 1)) ((5 0) (4 0)) ((6 0) (1 2))-    ((7 1) (0 1)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k) (cat "st-k" d o k-0))-  (conf start-ch start-ch-0)-  (auth start-ch start-ch-0)-  -  (leads-to ((2 3) (1 0)) ((3 3) (1 1)) ((4 3) (3 2)))-  -  (operation nonce-test (displaced 8 2 dev-up 4) k (7 0)-    (ch-msg start-ch (cat "power-up" d o k)))-  (strand-map 0 1 2 3 4 5 6 7)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt "st-k" d o k)) (load ls (cat pt-0 "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-1 old))-      (load ls (cat pt-2 old1)) (stor lk (cat pt "st-k" d o k)))-    ((recv (enc "open" d o n-0 k-0)) (load ls (cat pt-3 "st" d any))-      (load lk (cat pt-4 "st-k" d o k-0))-      (stor ls (cat pt-0 "st" d o o)))-    ((recv start-ch-0 (cat "power-up" d o k-0))-      (load lk (cat pt-5 old-0)) (load ls (cat pt-6 old1-0))-      (stor lk (cat pt-4 "st-k" d o k-0)))-    ((send start-ch-0 (cat "power-up" d o k-0)))-    ((send (enc "may I pass" k))) ((recv k) (send k)))-  (label 33)-  (parent 30)-  (unrealized (7 0))-  (dead)-  (comment "empty cohort"))--(comment "Nothing left to do")
− tst/defact-subatomic-open-closed_shapes.tst 
@@ -1,694 +0,0 @@-(comment "CPSA 4.4.5")-(comment "Extracted shapes")--(herald subatomic-open-closed (bound 40))--(comment "CPSA 4.4.5")--(comment "All input read from tst/subatomic-open-closed.scm")--(comment "Strand count bounded at 40")--(defprotocol subatomic-open-closed basic-  (defrole dev-up-    (vars (k skey) (d o name) (old old1 mesg) (start-ch chan)-      (lk ls locn))-    (trace (recv start-ch (cat "power-up" d o k)) (load lk old)-      (load ls old1) (stor lk (cat "st-k" d o k))-      (stor ls (cat "st" d o)) (send (enc "up" k)))-    (auth start-ch)-    (critical-sections (1 4)))-  (defrole owner-power-dev-    (vars (k skey) (d o name) (start-ch chan))-    (trace (send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    (conf start-ch))-  (defrole owner-open-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "open" d o n k)) (recv n)))-  (defrole owner-close-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "close" d o n k)) (recv n)))-  (defrole dev-open-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (recv (enc "open" d o n k)) (load ls (cat "st" d any))-      (load lk (cat "st-k" d o k)) (stor ls (cat "st" d o o)) (send n))-    (critical-sections (1 3))-    (gen-st (cat "st-k" d o k) (cat "st" d (cat o o))))-  (defrole dev-close-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (recv (enc "close" d o n k)) (load lk (cat "st-k" d o k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d o)) (send n))-    (gen-st (cat "st-k" d o k))-    (critical-sections (1 3)))-  (defrole dev-pass-    (vars (k skey) (n text) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (load ls (cat "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    (uniq-orig n)-    (gen-st (cat "st-k" d o k) (cat "st" d (cat o o)))-    (critical-sections (0 1)))-  (defrole user-pass-    (vars (k skey))-    (trace (send (enc "may I pass" k)) (recv (enc "you may pass" k))))-  (defrule power-deliver-once-    (forall ((z1 z2 strd) (k skey))-      (implies-        (and (p "dev-up" z1 (idx 2)) (p "dev-up" z2 (idx 2))-          (p "dev-up" "k" z1 k) (p "dev-up" "k" z2 k))-        (= z1 z2))))-  (defrule same-dev-ls-lk-    (forall ((ls lk lk-0 locn))-      (implies-        (and (fact same-dev ls lk) (fact same-dev ls lk-0))-        (= lk lk-0))))-  (defrule same-dev-lk-ls-    (forall ((lk ls ls-0 locn))-      (implies-        (and (fact same-dev ls lk) (fact same-dev ls-0 lk))-        (= ls ls-0))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule discreteAfter-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule discreteBefore-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule fact-dev-up-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-up" z (idx 3)) (p "dev-up" "ls" z ls)-          (p "dev-up" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule fact-dev-open-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-open" z (idx 3)) (p "dev-open" "ls" z ls)-          (p "dev-open" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule fact-dev-close-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-close" z (idx 3)) (p "dev-close" "ls" z ls)-          (p "dev-close" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule fact-dev-pass-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-pass" z (idx 2)) (p "dev-pass" "ls" z ls)-          (p "dev-pass" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule trRl_dev-up-at-4-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 4)))))-  (defgenrule trRl_dev-up-at-3-    (forall ((z strd))-      (implies (p "dev-up" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-up-at-2-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 2)))))-  (defgenrule trRl_dev-up-at-1-    (forall ((z strd))-      (implies (p "dev-up" z (idx 4)) (trans z (idx 1)))))-  (defgenrule trRl_dev-open-at-3-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-open-at-1-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 1)))))-  (defgenrule trRl_dev-close-at-3-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-close-at-2-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 2)))))-  (defgenrule eff-dev-up-3-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-up" z (idx 4)) (prec z (idx 3) z1 i))-        (or (= z z1)-          (and (p "dev-up" z (idx 5)) (prec z (idx 4) z1 i))))))-  (defgenrule cau-dev-up-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-up" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1))))))-  (defgenrule cau-dev-open-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-open" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1))))))-  (defgenrule cau-dev-close-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-close" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1))))))-  (defgenrule cau-dev-pass-1-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-pass" z (idx 2)) (prec z1 i z (idx 1)))-        (or (= z z1) (prec z1 i z (idx 0))))))-  (defgenrule gen-st-dev-open-1-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-open" z (idx 1)) (p "dev-open" "k" z k)-          (p "dev-open" "o" z o) (p "dev-open" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule gen-st-dev-open-0-    (forall ((z strd) (d o name))-      (implies-        (and (p "dev-open" z (idx 1)) (p "dev-open" "o" z o)-          (p "dev-open" "d" z d)) (gen-st (cat "st" d o o)))))-  (defgenrule gen-st-dev-close-0-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-close" z (idx 1)) (p "dev-close" "k" z k)-          (p "dev-close" "o" z o) (p "dev-close" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule gen-st-dev-pass-1-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "k" z k)-          (p "dev-pass" "o" z o) (p "dev-pass" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule gen-st-dev-pass-0-    (forall ((z strd) (d o name))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "o" z o)-          (p "dev-pass" "d" z d)) (gen-st (cat "st" d o o))))))--(defskeleton subatomic-open-closed-  (vars (k skey) (d o name) (start-ch chan))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (deflistener k)-  (uniq-orig k)-  (conf start-ch)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv k) (send k)))-  (label 0)-  (unrealized (0 1) (1 0))-  (preskeleton)-  (origs (k (0 0)))-  (comment "Not a skeleton"))--(comment "Nothing left to do")--(defprotocol subatomic-open-closed basic-  (defrole dev-up-    (vars (k skey) (d o name) (old old1 mesg) (start-ch chan)-      (lk ls locn))-    (trace (recv start-ch (cat "power-up" d o k)) (load lk old)-      (load ls old1) (stor lk (cat "st-k" d o k))-      (stor ls (cat "st" d o)) (send (enc "up" k)))-    (auth start-ch)-    (critical-sections (1 4)))-  (defrole owner-power-dev-    (vars (k skey) (d o name) (start-ch chan))-    (trace (send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    (conf start-ch))-  (defrole owner-open-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "open" d o n k)) (recv n)))-  (defrole owner-close-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "close" d o n k)) (recv n)))-  (defrole dev-open-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (recv (enc "open" d o n k)) (load ls (cat "st" d any))-      (load lk (cat "st-k" d o k)) (stor ls (cat "st" d o o)) (send n))-    (critical-sections (1 3))-    (gen-st (cat "st-k" d o k) (cat "st" d (cat o o))))-  (defrole dev-close-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (recv (enc "close" d o n k)) (load lk (cat "st-k" d o k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d o)) (send n))-    (gen-st (cat "st-k" d o k))-    (critical-sections (1 3)))-  (defrole dev-pass-    (vars (k skey) (n text) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (load ls (cat "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    (uniq-orig n)-    (gen-st (cat "st-k" d o k) (cat "st" d (cat o o)))-    (critical-sections (0 1)))-  (defrole user-pass-    (vars (k skey))-    (trace (send (enc "may I pass" k)) (recv (enc "you may pass" k))))-  (defrule power-deliver-once-    (forall ((z1 z2 strd) (k skey))-      (implies-        (and (p "dev-up" z1 (idx 2)) (p "dev-up" z2 (idx 2))-          (p "dev-up" "k" z1 k) (p "dev-up" "k" z2 k))-        (= z1 z2))))-  (defrule same-dev-ls-lk-    (forall ((ls lk lk-0 locn))-      (implies-        (and (fact same-dev ls lk) (fact same-dev ls lk-0))-        (= lk lk-0))))-  (defrule same-dev-lk-ls-    (forall ((lk ls ls-0 locn))-      (implies-        (and (fact same-dev ls lk) (fact same-dev ls-0 lk))-        (= ls ls-0))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule discreteAfter-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule discreteBefore-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule fact-dev-up-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-up" z (idx 3)) (p "dev-up" "ls" z ls)-          (p "dev-up" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule fact-dev-open-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-open" z (idx 3)) (p "dev-open" "ls" z ls)-          (p "dev-open" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule fact-dev-close-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-close" z (idx 3)) (p "dev-close" "ls" z ls)-          (p "dev-close" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule fact-dev-pass-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-pass" z (idx 2)) (p "dev-pass" "ls" z ls)-          (p "dev-pass" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule trRl_dev-up-at-4-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 4)))))-  (defgenrule trRl_dev-up-at-3-    (forall ((z strd))-      (implies (p "dev-up" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-up-at-2-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 2)))))-  (defgenrule trRl_dev-up-at-1-    (forall ((z strd))-      (implies (p "dev-up" z (idx 4)) (trans z (idx 1)))))-  (defgenrule trRl_dev-open-at-3-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-open-at-1-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 1)))))-  (defgenrule trRl_dev-close-at-3-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-close-at-2-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 2)))))-  (defgenrule eff-dev-up-3-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-up" z (idx 4)) (prec z (idx 3) z1 i))-        (or (= z z1)-          (and (p "dev-up" z (idx 5)) (prec z (idx 4) z1 i))))))-  (defgenrule cau-dev-up-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-up" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1))))))-  (defgenrule cau-dev-open-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-open" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1))))))-  (defgenrule cau-dev-close-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-close" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1))))))-  (defgenrule cau-dev-pass-1-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-pass" z (idx 2)) (prec z1 i z (idx 1)))-        (or (= z z1) (prec z1 i z (idx 0))))))-  (defgenrule gen-st-dev-open-1-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-open" z (idx 1)) (p "dev-open" "k" z k)-          (p "dev-open" "o" z o) (p "dev-open" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule gen-st-dev-open-0-    (forall ((z strd) (d o name))-      (implies-        (and (p "dev-open" z (idx 1)) (p "dev-open" "o" z o)-          (p "dev-open" "d" z d)) (gen-st (cat "st" d o o)))))-  (defgenrule gen-st-dev-close-0-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-close" z (idx 1)) (p "dev-close" "k" z k)-          (p "dev-close" "o" z o) (p "dev-close" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule gen-st-dev-pass-1-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "k" z k)-          (p "dev-pass" "o" z o) (p "dev-pass" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule gen-st-dev-pass-0-    (forall ((z strd) (d o name))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "o" z o)-          (p "dev-pass" "d" z d)) (gen-st (cat "st" d o o))))))--(defskeleton subatomic-open-closed-  (vars (k skey) (n text) (d o name) (pt pt-0 pval) (lk ls locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (uniq-orig n)-  (traces-    ((load lk (cat pt "st-k" d o k)) (load ls (cat pt-0 "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k))))-  (label 3)-  (realized)-  (origs (n (0 3)))-  (comment "Not closed under rules"))--(defskeleton subatomic-open-closed-  (vars (old old1 any mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (start-ch chan) (ls lk locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand owner-power-dev 1 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (precedes ((1 4) (3 1)) ((2 0) (1 0)) ((3 3) (0 0)))-  (uniq-orig n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  (leads-to ((1 3) (0 0)) ((1 3) (3 2)) ((3 3) (0 1)))-  (operation channel-test (displaced 4 1 dev-up 4)-    (ch-msg lk (cat pt-5 "st-k" d o k-0)) (3 2))-  (strand-map 0 1 2 3)-  (traces-    ((load lk (cat pt-2 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (load ls (cat pt-1 old1)) (stor lk (cat pt-2 "st-k" d o k))-      (stor ls (cat pt-3 "st" d o)))-    ((send start-ch (cat "power-up" d o k)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-4 "st" d any))-      (load lk (cat pt-2 "st-k" d o k)) (stor ls (cat pt "st" d o o))))-  (label 8)-  (parent 3)-  (realized)-  (shape)-  (maps ((0) ((k k) (n n) (d d) (o o) (lk lk) (ls ls))))-  (origs (pt-2 (1 3)) (pt-3 (1 4)) (pt (3 3)) (n (0 3))))--(comment "Nothing left to do")--(defprotocol subatomic-open-closed basic-  (defrole dev-up-    (vars (k skey) (d o name) (old old1 mesg) (start-ch chan)-      (lk ls locn))-    (trace (recv start-ch (cat "power-up" d o k)) (load lk old)-      (load ls old1) (stor lk (cat "st-k" d o k))-      (stor ls (cat "st" d o)) (send (enc "up" k)))-    (auth start-ch)-    (critical-sections (1 4)))-  (defrole owner-power-dev-    (vars (k skey) (d o name) (start-ch chan))-    (trace (send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    (conf start-ch))-  (defrole owner-open-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "open" d o n k)) (recv n)))-  (defrole owner-close-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "close" d o n k)) (recv n)))-  (defrole dev-open-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (recv (enc "open" d o n k)) (load ls (cat "st" d any))-      (load lk (cat "st-k" d o k)) (stor ls (cat "st" d o o)) (send n))-    (critical-sections (1 3))-    (gen-st (cat "st-k" d o k) (cat "st" d (cat o o))))-  (defrole dev-close-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (recv (enc "close" d o n k)) (load lk (cat "st-k" d o k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d o)) (send n))-    (gen-st (cat "st-k" d o k))-    (critical-sections (1 3)))-  (defrole dev-pass-    (vars (k skey) (n text) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (load ls (cat "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    (uniq-orig n)-    (gen-st (cat "st-k" d o k) (cat "st" d (cat o o)))-    (critical-sections (0 1)))-  (defrole user-pass-    (vars (k skey))-    (trace (send (enc "may I pass" k)) (recv (enc "you may pass" k))))-  (defrule power-deliver-once-    (forall ((z1 z2 strd) (k skey))-      (implies-        (and (p "dev-up" z1 (idx 2)) (p "dev-up" z2 (idx 2))-          (p "dev-up" "k" z1 k) (p "dev-up" "k" z2 k))-        (= z1 z2))))-  (defrule same-dev-ls-lk-    (forall ((ls lk lk-0 locn))-      (implies-        (and (fact same-dev ls lk) (fact same-dev ls lk-0))-        (= lk lk-0))))-  (defrule same-dev-lk-ls-    (forall ((lk ls ls-0 locn))-      (implies-        (and (fact same-dev ls lk) (fact same-dev ls-0 lk))-        (= ls ls-0))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule discreteAfter-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule discreteBefore-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule fact-dev-up-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-up" z (idx 3)) (p "dev-up" "ls" z ls)-          (p "dev-up" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule fact-dev-open-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-open" z (idx 3)) (p "dev-open" "ls" z ls)-          (p "dev-open" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule fact-dev-close-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-close" z (idx 3)) (p "dev-close" "ls" z ls)-          (p "dev-close" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule fact-dev-pass-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-pass" z (idx 2)) (p "dev-pass" "ls" z ls)-          (p "dev-pass" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule trRl_dev-up-at-4-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 4)))))-  (defgenrule trRl_dev-up-at-3-    (forall ((z strd))-      (implies (p "dev-up" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-up-at-2-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 2)))))-  (defgenrule trRl_dev-up-at-1-    (forall ((z strd))-      (implies (p "dev-up" z (idx 4)) (trans z (idx 1)))))-  (defgenrule trRl_dev-open-at-3-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-open-at-1-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 1)))))-  (defgenrule trRl_dev-close-at-3-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-close-at-2-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 2)))))-  (defgenrule eff-dev-up-3-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-up" z (idx 4)) (prec z (idx 3) z1 i))-        (or (= z z1)-          (and (p "dev-up" z (idx 5)) (prec z (idx 4) z1 i))))))-  (defgenrule cau-dev-up-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-up" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1))))))-  (defgenrule cau-dev-open-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-open" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1))))))-  (defgenrule cau-dev-close-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-close" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1))))))-  (defgenrule cau-dev-pass-1-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-pass" z (idx 2)) (prec z1 i z (idx 1)))-        (or (= z z1) (prec z1 i z (idx 0))))))-  (defgenrule gen-st-dev-open-1-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-open" z (idx 1)) (p "dev-open" "k" z k)-          (p "dev-open" "o" z o) (p "dev-open" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule gen-st-dev-open-0-    (forall ((z strd) (d o name))-      (implies-        (and (p "dev-open" z (idx 1)) (p "dev-open" "o" z o)-          (p "dev-open" "d" z d)) (gen-st (cat "st" d o o)))))-  (defgenrule gen-st-dev-close-0-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-close" z (idx 1)) (p "dev-close" "k" z k)-          (p "dev-close" "o" z o) (p "dev-close" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule gen-st-dev-pass-1-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "k" z k)-          (p "dev-pass" "o" z o) (p "dev-pass" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule gen-st-dev-pass-0-    (forall ((z strd) (d o name))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "o" z o)-          (p "dev-pass" "d" z d)) (gen-st (cat "st" d o o))))))--(defskeleton subatomic-open-closed-  (vars (k skey) (n text) (d o d-0 o-0 name) (pt pt-0 pval)-    (start-ch chan) (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d-0) (o o-0) (lk lk) (ls ls))-  (uniq-orig k n)-  (conf start-ch)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt "st-k" d-0 o-0 k))-      (load ls (cat pt-0 "st" d-0 o-0 o-0)) (recv (enc "may I pass" k))-      (send (enc "you may pass" n k))))-  (label 9)-  (unrealized (0 1) (1 0) (1 2))-  (preskeleton)-  (origs (n (1 3)) (k (0 0)))-  (comment "Not a skeleton"))--(defskeleton subatomic-open-closed-  (vars (any old old1 mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (start-ch chan) (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand owner-open 1 (k k) (n n-0) (d d) (o o))-  (defstrand user-pass 1 (k k))-  (defstrand dev-up 6 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (precedes ((0 0) (5 0)) ((2 3) (1 0)) ((3 0) (2 0)) ((4 0) (1 2))-    ((5 4) (2 1)) ((5 5) (0 1)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  (leads-to ((2 3) (1 1)) ((5 3) (1 0)) ((5 3) (2 2)))-  (operation encryption-test (displaced 2 6 dev-up 6) (enc "up" k)-    (0 1))-  (strand-map 0 1 5 2 3 4)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt-3 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-0 "st" d any))-      (load lk (cat pt-3 "st-k" d o k)) (stor ls (cat pt "st" d o o)))-    ((send (enc "open" d o n-0 k))) ((send (enc "may I pass" k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-1 old))-      (load ls (cat pt-2 old1)) (stor lk (cat pt-3 "st-k" d o k))-      (stor ls (cat pt-4 "st" d o)) (send (enc "up" k))))-  (label 21)-  (parent 9)-  (realized)-  (shape)-  (maps-    ((0 1)-      ((k k) (d d) (o o) (start-ch start-ch) (n n) (d-0 d) (o-0 o)-        (lk lk) (ls ls))))-  (origs (pt-3 (5 3)) (pt-4 (5 4)) (pt (2 3)) (n (1 3)) (k (0 0))))--(comment "Nothing left to do")
− tst/defact-sync_locn_envelope.tst 
@@ -1,3195 +0,0 @@-(herald "Envelope Protocol, location-based version" (check-nonces)-  (bound 30) (limit 6000))--(comment "CPSA 4.4.5")-(comment "All input read from tst/sync_locn_envelope.scm")-(comment "Step count limited to 6000")-(comment "Strand count bounded at 30")-(comment "Nonces checked first")--(defprotocol envelope basic-  (defrole tpm-power-on-    (vars (current-value mesg) (pcr locn) (tpm chan))-    (trace (recv tpm "power on") (load pcr current-value)-      (stor pcr "0")))-  (defrole tpm-extend-enc-    (vars (value current-value mesg) (pcr-id nonce text) (pcr locn)-      (tpm chan))-    (trace (send tpm (cat "token" nonce))-      (recv tpm (cat "extend" pcr-id value (hash pcr-id value nonce)))-      (load pcr current-value) (stor pcr (hash current-value value))-      (send "ext ok"))-    (uniq-orig nonce))-  (defrole tpm-quote-    (vars (nonce current-value mesg) (pcr-id text) (aik akey) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "quote" pcr-id nonce))-      (load pcr current-value)-      (send (enc "quote" pcr-id current-value nonce aik))))-  (defrole tpm-create-key-    (vars (k aik akey) (pcr-id text) (pcrval mesg) (tpm chan))-    (trace (recv tpm (cat "create-req" pcr-id pcrval))-      (send (enc "created" k pcr-id pcrval aik)))-    (non-orig (invk k))-    (uniq-orig k)-    (auth tpm))-  (defrole tpm-decrypt-    (vars (m current-value mesg) (pcr-id text) (k aik akey) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "decrypt" (enc m k)))-      (recv (enc "created" k pcr-id current-value aik))-      (load pcr current-value) (send m))-    (non-orig aik))-  (defrole alice-    (vars (n v data) (pcr-id nonce text) (k aik akey)-      (tpm tpmconf chan))-    (trace (recv tpm (cat "token" nonce))-      (send tpmconf (cat "extend" pcr-id n (hash pcr-id n nonce)))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    (non-orig aik)-    (uniq-orig n v)-    (conf tpmconf)-    (neq (k aik)))-  (defrule genStV-if-hashed-tpm-power-on-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-power-on" z (idx 2))-          (p "tpm-power-on" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-extend-enc-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-extend-enc" z (idx 3))-          (p "tpm-extend-enc" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-decrypt-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-decrypt" z (idx 3))-          (p "tpm-decrypt" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-quote-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-quote" z (idx 2))-          (p "tpm-quote" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule shearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule invShearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule trRl_tpm-power-on-at-2-    (forall ((z strd))-      (implies (p "tpm-power-on" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_tpm-power-on-at-1-    (forall ((z strd))-      (implies (p "tpm-power-on" z (idx 3)) (trans z (idx 1)))))-  (defgenrule trRl_tpm-extend-enc-at-3-    (forall ((z strd))-      (implies (p "tpm-extend-enc" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_tpm-extend-enc-at-2-    (forall ((z strd))-      (implies (p "tpm-extend-enc" z (idx 4)) (trans z (idx 2))))))--(defskeleton envelope-  (vars (v n data) (pcr-id nonce text) (k aik akey) (tpm tpmconf chan))-  (deflistener v)-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id) (nonce nonce) (k k)-    (aik aik) (tpm tpm) (tpmconf tpmconf))-  (non-orig aik)-  (uniq-orig v n)-  (conf tpmconf)-  (traces ((recv v) (send v))-    ((recv tpm (cat "token" nonce))-      (send tpmconf (cat "extend" pcr-id n (hash pcr-id n nonce)))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k))))-  (label 0)-  (unrealized (0 0) (1 3))-  (preskeleton)-  (origs (v (1 4)) (n (1 1)))-  (comment "Not a skeleton"))--(defskeleton envelope-  (vars (v n data) (pcr-id nonce text) (k aik akey) (tpm tpmconf chan))-  (deflistener v)-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id) (nonce nonce) (k k)-    (aik aik) (tpm tpm) (tpmconf tpmconf))-  (precedes ((1 4) (0 0)))-  (non-orig aik)-  (uniq-orig v n)-  (conf tpmconf)-  (traces ((recv v) (send v))-    ((recv tpm (cat "token" nonce))-      (send tpmconf (cat "extend" pcr-id n (hash pcr-id n nonce)))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k))))-  (label 1)-  (parent 0)-  (unrealized (1 3))-  (origs (v (1 4)) (n (1 1)))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-  (vars (v n data) (pcr-id nonce text) (k aik akey)-    (tpm tpmconf tpm-0 chan))-  (deflistener v)-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id) (nonce nonce) (k k)-    (aik aik) (tpm tpm) (tpmconf tpmconf))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id) (k k) (aik aik) (tpm tpm-0))-  (precedes ((1 4) (0 0)) ((2 1) (1 3)))-  (non-orig aik (invk k))-  (uniq-orig v n k)-  (conf tpmconf)-  (auth tpm-0)-  (operation encryption-test (added-strand tpm-create-key 2)-    (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik) (1 3))-  (strand-map 0 1)-  (traces ((recv v) (send v))-    ((recv tpm (cat "token" nonce))-      (send tpmconf (cat "extend" pcr-id n (hash pcr-id n nonce)))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm-0 (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (send (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))))-  (label 2)-  (parent 1)-  (unrealized (0 0) (2 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-  (vars (v n data) (pcr-id nonce text) (k aik akey) (tpm tpmconf chan))-  (deflistener v)-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id) (nonce nonce) (k k)-    (aik aik) (tpm tpm) (tpmconf tpmconf))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id) (k k) (aik aik) (tpm tpm))-  (precedes ((1 2) (2 0)) ((1 4) (0 0)) ((2 1) (1 3)))-  (non-orig aik (invk k))-  (uniq-orig v n k)-  (conf tpmconf)-  (auth tpm)-  (operation channel-test (displaced 3 1 alice 3)-    (ch-msg tpm-0-      (cat "create-req" pcr-id (hash (hash "0" n) "obtain"))) (2 0))-  (strand-map 0 1 2)-  (traces ((recv v) (send v))-    ((recv tpm (cat "token" nonce))-      (send tpmconf (cat "extend" pcr-id n (hash pcr-id n nonce)))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (send (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))))-  (label 3)-  (parent 2)-  (unrealized (0 0) (1 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-  (vars (v n data) (pcr-id nonce text) (k aik akey) (tpm tpmconf chan))-  (deflistener v)-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id) (nonce nonce) (k k)-    (aik aik) (tpm tpm) (tpmconf tpmconf))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-extend-enc 1 (nonce nonce) (tpm tpm))-  (precedes ((1 2) (2 0)) ((1 4) (0 0)) ((2 1) (1 3)) ((3 0) (1 0)))-  (non-orig aik (invk k))-  (uniq-orig v n nonce k)-  (conf tpmconf)-  (auth tpm)-  (operation channel-test (added-strand tpm-extend-enc 1)-    (ch-msg tpm (cat "token" nonce)) (1 0))-  (strand-map 0 1 2)-  (traces ((recv v) (send v))-    ((recv tpm (cat "token" nonce))-      (send tpmconf (cat "extend" pcr-id n (hash pcr-id n nonce)))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (send (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik)))-    ((send tpm (cat "token" nonce))))-  (label 4)-  (parent 3)-  (unrealized (0 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-  (vars (current-value mesg) (v n data) (pcr-id nonce pcr-id-0 text)-    (k aik aik-0 akey) (pt pval) (tpm tpmconf tpm-0 chan) (pcr locn))-  (deflistener v)-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id) (nonce nonce) (k k)-    (aik aik) (tpm tpm) (tpmconf tpmconf))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-extend-enc 1 (nonce nonce) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v) (current-value current-value)-    (pcr-id pcr-id-0) (k k) (aik aik-0) (tpm tpm-0) (pcr pcr))-  (precedes ((1 2) (2 0)) ((1 4) (4 0)) ((2 1) (1 3)) ((3 0) (1 0))-    ((4 3) (0 0)))-  (non-orig aik aik-0 (invk k))-  (uniq-orig v n nonce k)-  (conf tpmconf)-  (auth tpm)-  (operation nonce-test (added-strand tpm-decrypt 4) v (0 0) (enc v k))-  (strand-map 0 1 2 3)-  (traces ((recv v) (send v))-    ((recv tpm (cat "token" nonce))-      (send tpmconf (cat "extend" pcr-id n (hash pcr-id n nonce)))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (send (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik)))-    ((send tpm (cat "token" nonce)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-0 current-value aik-0))-      (load pcr (cat pt current-value)) (send v)))-  (label 5)-  (parent 4)-  (unrealized (4 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-  (vars (v n data) (pcr-id nonce text) (k aik akey) (pt pval)-    (tpm tpmconf tpm-0 chan) (pcr locn))-  (deflistener v)-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id) (nonce nonce) (k k)-    (aik aik) (tpm tpm) (tpmconf tpmconf))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-extend-enc 1 (nonce nonce) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id) (k k)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (precedes ((1 2) (2 0)) ((1 4) (4 0)) ((2 1) (1 3)) ((3 0) (1 0))-    ((4 3) (0 0)))-  (non-orig aik (invk k))-  (uniq-orig v n nonce k)-  (gen-st (hash (hash "0" n) "obtain"))-  (conf tpmconf)-  (auth tpm)-  -  (operation encryption-test (displaced 5 2 tpm-create-key 2)-    (enc "created" k pcr-id-0 current-value aik-0) (4 1))-  (strand-map 0 1 2 3 4)-  (traces ((recv v) (send v))-    ((recv tpm (cat "token" nonce))-      (send tpmconf (cat "extend" pcr-id n (hash pcr-id n nonce)))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (send (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik)))-    ((send tpm (cat "token" nonce)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v)))-  (label 6)-  (parent 5)-  (unrealized (4 2))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton envelope-  (vars (v n data) (pcr-id pcr-id-0 nonce text) (k aik akey)-    (pt pt-0 pval) (tpmconf tpm tpm-0 chan) (pcr locn))-  (deflistener v)-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id) (nonce nonce) (k k)-    (aik aik) (tpm tpm-0) (tpmconf tpmconf))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id) (k k) (aik aik) (tpm tpm-0))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id) (k k)-    (aik aik) (tpm tpm) (pcr pcr))-  (defstrand tpm-extend-enc 4 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-0) (nonce nonce)-    (tpm tpm-0) (pcr pcr))-  (precedes ((1 2) (2 0)) ((1 4) (3 0)) ((2 1) (1 3)) ((3 3) (0 0))-    ((4 0) (1 0)) ((4 3) (3 2)))-  (non-orig aik (invk k))-  (uniq-orig v n nonce k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain"))-  (conf tpmconf)-  (auth tpm-0)-  (leads-to ((4 3) (3 2)))-  -  (operation channel-test (displaced 3 5 tpm-extend-enc 4)-    (ch-msg pcr (cat pt (hash (hash "0" n) "obtain"))) (4 2))-  (strand-map 0 1 2 4 3)-  (traces ((recv v) (send v))-    ((recv tpm-0 (cat "token" nonce))-      (send tpmconf (cat "extend" pcr-id n (hash pcr-id n nonce)))-      (send tpm-0-        (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm-0 (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (send (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik)))-    ((recv tpm (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((send tpm-0 (cat "token" nonce))-      (recv tpm-0-        (cat "extend" pcr-id-0 "obtain" (hash pcr-id-0 "obtain" nonce)))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain")))))-  (label 7)-  (parent 6)-  (unrealized (4 1) (4 2))-  (dead)-  (comment "empty cohort"))--(defskeleton envelope-  (vars (v n data) (pcr-id nonce pcr-id-0 nonce-0 text) (k aik akey)-    (pt pt-0 pval) (tpm tpmconf tpm-0 tpm-1 chan) (pcr locn))-  (deflistener v)-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id) (nonce nonce) (k k)-    (aik aik) (tpm tpm) (tpmconf tpmconf))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-extend-enc 1 (nonce nonce) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id) (k k)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 4 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-0) (nonce nonce-0)-    (tpm tpm-1) (pcr pcr))-  (precedes ((1 2) (2 0)) ((1 4) (4 0)) ((2 1) (1 3)) ((3 0) (1 0))-    ((4 3) (0 0)) ((5 3) (4 2)))-  (non-orig aik (invk k))-  (uniq-orig v n nonce nonce-0 k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain"))-  (conf tpmconf)-  (auth tpm)-  (leads-to ((5 3) (4 2)))-  -  (operation channel-test (added-strand tpm-extend-enc 4)-    (ch-msg pcr (cat pt (hash (hash "0" n) "obtain"))) (4 2))-  (strand-map 0 1 2 3 4)-  (traces ((recv v) (send v))-    ((recv tpm (cat "token" nonce))-      (send tpmconf (cat "extend" pcr-id n (hash pcr-id n nonce)))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (send (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik)))-    ((send tpm (cat "token" nonce)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((send tpm-1 (cat "token" nonce-0))-      (recv tpm-1-        (cat "extend" pcr-id-0 "obtain"-          (hash pcr-id-0 "obtain" nonce-0)))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain")))))-  (label 8)-  (parent 6)-  (unrealized (5 2))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton envelope-  (vars (v n data) (pcr-id pcr-id-0 nonce pcr-id-1 nonce-0 text)-    (k aik akey) (pt pt-0 pt-1 pval) (tpmconf tpm tpm-0 tpm-1 chan)-    (pcr locn))-  (deflistener v)-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id) (nonce nonce-0) (k k)-    (aik aik) (tpm tpm-1) (tpmconf tpmconf))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id) (k k) (aik aik) (tpm tpm-1))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id) (k k)-    (aik aik) (tpm tpm) (pcr pcr))-  (defstrand tpm-extend-enc 4 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-0) (nonce nonce)-    (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 4 (value n) (current-value "0")-    (pcr-id pcr-id-1) (nonce nonce-0) (tpm tpm-1) (pcr pcr))-  (precedes ((1 1) (5 1)) ((1 2) (2 0)) ((1 4) (3 0)) ((2 1) (1 3))-    ((3 3) (0 0)) ((4 3) (3 2)) ((5 0) (1 0)) ((5 3) (4 2)))-  (non-orig aik (invk k))-  (uniq-orig v n nonce nonce-0 k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain"))-  (conf tpmconf)-  (auth tpm-1)-  (leads-to ((4 3) (3 2)) ((5 3) (4 2)))-  -  (operation channel-test (displaced 3 6 tpm-extend-enc 4)-    (ch-msg pcr (cat pt-0 (hash "0" n))) (5 2))-  (strand-map 0 1 2 5 3 4)-  (traces ((recv v) (send v))-    ((recv tpm-1 (cat "token" nonce-0))-      (send tpmconf (cat "extend" pcr-id n (hash pcr-id n nonce-0)))-      (send tpm-1-        (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm-1 (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (send (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik)))-    ((recv tpm (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((send tpm-0 (cat "token" nonce))-      (recv tpm-0-        (cat "extend" pcr-id-0 "obtain" (hash pcr-id-0 "obtain" nonce)))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain"))))-    ((send tpm-1 (cat "token" nonce-0))-      (recv tpm-1 (cat "extend" pcr-id-1 n (hash pcr-id-1 n nonce-0)))-      (load pcr (cat pt-1 "0")) (stor pcr (cat pt-0 (hash "0" n)))))-  (label 9)-  (parent 8)-  (unrealized (5 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-  (vars (v n data) (pcr-id nonce pcr-id-0 nonce-0 pcr-id-1 nonce-1 text)-    (k aik akey) (pt pt-0 pt-1 pval)-    (tpm tpmconf tpm-0 tpm-1 tpm-2 chan) (pcr locn))-  (deflistener v)-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id) (nonce nonce) (k k)-    (aik aik) (tpm tpm) (tpmconf tpmconf))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-extend-enc 1 (nonce nonce) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id) (k k)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 4 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-0) (nonce nonce-0)-    (tpm tpm-1) (pcr pcr))-  (defstrand tpm-extend-enc 4 (value n) (current-value "0")-    (pcr-id pcr-id-1) (nonce nonce-1) (tpm tpm-2) (pcr pcr))-  (precedes ((1 1) (6 1)) ((1 2) (2 0)) ((1 4) (4 0)) ((2 1) (1 3))-    ((3 0) (1 0)) ((4 3) (0 0)) ((5 3) (4 2)) ((6 3) (5 2)))-  (non-orig aik (invk k))-  (uniq-orig v n nonce nonce-0 nonce-1 k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain"))-  (conf tpmconf)-  (auth tpm)-  (leads-to ((5 3) (4 2)) ((6 3) (5 2)))-  -  (operation channel-test (added-strand tpm-extend-enc 4)-    (ch-msg pcr (cat pt-0 (hash "0" n))) (5 2))-  (strand-map 0 1 2 3 4 5)-  (traces ((recv v) (send v))-    ((recv tpm (cat "token" nonce))-      (send tpmconf (cat "extend" pcr-id n (hash pcr-id n nonce)))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (send (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik)))-    ((send tpm (cat "token" nonce)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((send tpm-1 (cat "token" nonce-0))-      (recv tpm-1-        (cat "extend" pcr-id-0 "obtain"-          (hash pcr-id-0 "obtain" nonce-0)))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain"))))-    ((send tpm-2 (cat "token" nonce-1))-      (recv tpm-2 (cat "extend" pcr-id-1 n (hash pcr-id-1 n nonce-1)))-      (load pcr (cat pt-1 "0")) (stor pcr (cat pt-0 (hash "0" n)))))-  (label 10)-  (parent 8)-  (unrealized (6 1))-  (dead)-  (comment "empty cohort"))--(defskeleton envelope-  (vars (v n data) (pcr-id pcr-id-0 nonce nonce-0 text) (k aik akey)-    (pt pt-0 pt-1 pval) (tpmconf tpm tpm-0 chan) (pcr locn))-  (deflistener v)-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id) (nonce nonce-0) (k k)-    (aik aik) (tpm tpmconf) (tpmconf tpmconf))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id) (k k) (aik aik) (tpm tpmconf))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id) (k k)-    (aik aik) (tpm tpm) (pcr pcr))-  (defstrand tpm-extend-enc 4 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-0) (nonce nonce)-    (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 4 (value n) (current-value "0")-    (pcr-id pcr-id) (nonce nonce-0) (tpm tpmconf) (pcr pcr))-  (precedes ((1 1) (5 1)) ((1 2) (2 0)) ((1 4) (3 0)) ((2 1) (1 3))-    ((3 3) (0 0)) ((4 3) (3 2)) ((5 0) (1 0)) ((5 3) (4 2)))-  (non-orig aik (invk k))-  (uniq-orig v n nonce nonce-0 k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain"))-  (conf tpmconf)-  (auth tpmconf)-  (leads-to ((4 3) (3 2)) ((5 3) (4 2)))-  -  (operation channel-test (displaced 6 1 alice 2)-    (ch-msg tpm-1 (cat "extend" pcr-id-1 n (hash pcr-id-1 n nonce-0)))-    (5 1))-  (strand-map 0 1 2 3 4 5)-  (traces ((recv v) (send v))-    ((recv tpmconf (cat "token" nonce-0))-      (send tpmconf (cat "extend" pcr-id n (hash pcr-id n nonce-0)))-      (send tpmconf-        (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpmconf-       (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (send (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik)))-    ((recv tpm (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((send tpm-0 (cat "token" nonce))-      (recv tpm-0-        (cat "extend" pcr-id-0 "obtain" (hash pcr-id-0 "obtain" nonce)))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain"))))-    ((send tpmconf (cat "token" nonce-0))-      (recv tpmconf (cat "extend" pcr-id n (hash pcr-id n nonce-0)))-      (load pcr (cat pt-1 "0")) (stor pcr (cat pt-0 (hash "0" n)))))-  (label 11)-  (parent 9)-  (realized)-  (shape)-  (maps-    ((0 1)-      ((v v) (n n) (pcr-id pcr-id) (nonce nonce-0) (k k) (aik aik)-        (tpm tpmconf) (tpmconf tpmconf))))-  (origs (n (1 1)) (nonce-0 (5 0)) (pt-0 (5 3)) (nonce (4 0)) (pt (4 3))-    (k (2 1)) (v (1 4))))--(comment "Nothing left to do")--(defprotocol envelope basic-  (defrole tpm-power-on-    (vars (current-value mesg) (pcr locn) (tpm chan))-    (trace (recv tpm "power on") (load pcr current-value)-      (stor pcr "0")))-  (defrole tpm-extend-enc-    (vars (value current-value mesg) (pcr-id nonce text) (pcr locn)-      (tpm chan))-    (trace (send tpm (cat "token" nonce))-      (recv tpm (cat "extend" pcr-id value (hash pcr-id value nonce)))-      (load pcr current-value) (stor pcr (hash current-value value))-      (send "ext ok"))-    (uniq-orig nonce))-  (defrole tpm-quote-    (vars (nonce current-value mesg) (pcr-id text) (aik akey) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "quote" pcr-id nonce))-      (load pcr current-value)-      (send (enc "quote" pcr-id current-value nonce aik))))-  (defrole tpm-create-key-    (vars (k aik akey) (pcr-id text) (pcrval mesg) (tpm chan))-    (trace (recv tpm (cat "create-req" pcr-id pcrval))-      (send (enc "created" k pcr-id pcrval aik)))-    (non-orig (invk k))-    (uniq-orig k)-    (auth tpm))-  (defrole tpm-decrypt-    (vars (m current-value mesg) (pcr-id text) (k aik akey) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "decrypt" (enc m k)))-      (recv (enc "created" k pcr-id current-value aik))-      (load pcr current-value) (send m))-    (non-orig aik))-  (defrole alice-    (vars (n v data) (pcr-id nonce text) (k aik akey)-      (tpm tpmconf chan))-    (trace (recv tpm (cat "token" nonce))-      (send tpmconf (cat "extend" pcr-id n (hash pcr-id n nonce)))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    (non-orig aik)-    (uniq-orig n v)-    (conf tpmconf)-    (neq (k aik)))-  (defrule genStV-if-hashed-tpm-power-on-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-power-on" z (idx 2))-          (p "tpm-power-on" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-extend-enc-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-extend-enc" z (idx 3))-          (p "tpm-extend-enc" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-decrypt-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-decrypt" z (idx 3))-          (p "tpm-decrypt" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-quote-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-quote" z (idx 2))-          (p "tpm-quote" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule shearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule invShearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule trRl_tpm-power-on-at-2-    (forall ((z strd))-      (implies (p "tpm-power-on" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_tpm-power-on-at-1-    (forall ((z strd))-      (implies (p "tpm-power-on" z (idx 3)) (trans z (idx 1)))))-  (defgenrule trRl_tpm-extend-enc-at-3-    (forall ((z strd))-      (implies (p "tpm-extend-enc" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_tpm-extend-enc-at-2-    (forall ((z strd))-      (implies (p "tpm-extend-enc" z (idx 4)) (trans z (idx 2))))))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 nonce text) (k aik akey)-    (tpm tpmconf chan))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id-0) (nonce nonce) (k k)-    (aik aik) (tpm tpm) (tpmconf tpmconf))-  (non-orig aik)-  (uniq-orig n v)-  (conf tpmconf)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((recv tpm (cat "token" nonce))-      (send tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce)))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k))))-  (label 12)-  (unrealized (0 0) (1 3))-  (preskeleton)-  (origs (v (1 4)) (n (1 1)))-  (comment "Not a skeleton"))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 nonce text) (k aik akey)-    (tpm tpmconf chan))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id-0) (nonce nonce) (k k)-    (aik aik) (tpm tpm) (tpmconf tpmconf))-  (precedes ((1 4) (0 0)))-  (non-orig aik)-  (uniq-orig n v)-  (conf tpmconf)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((recv tpm (cat "token" nonce))-      (send tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce)))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k))))-  (label 13)-  (parent 12)-  (unrealized (0 0) (1 3))-  (origs (v (1 4)) (n (1 1)))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 nonce text) (k aik akey)-    (tpm tpmconf tpm-0 chan))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id-0) (nonce nonce) (k k)-    (aik aik) (tpm tpm) (tpmconf tpmconf))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm-0))-  (precedes ((1 4) (0 0)) ((2 1) (1 3)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (conf tpmconf)-  (auth tpm-0)-  (operation encryption-test (added-strand tpm-create-key 2)-    (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik) (1 3))-  (strand-map 0 1)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((recv tpm (cat "token" nonce))-      (send tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce)))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm-0-       (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))))-  (label 14)-  (parent 13)-  (unrealized (0 0) (2 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 nonce text) (k aik akey)-    (tpm tpmconf chan))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id-0) (nonce nonce) (k k)-    (aik aik) (tpm tpm) (tpmconf tpmconf))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (precedes ((1 2) (2 0)) ((1 4) (0 0)) ((2 1) (1 3)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (conf tpmconf)-  (auth tpm)-  (operation channel-test (displaced 3 1 alice 3)-    (ch-msg tpm-0-      (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain"))) (2 0))-  (strand-map 0 1 2)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((recv tpm (cat "token" nonce))-      (send tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce)))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))))-  (label 15)-  (parent 14)-  (unrealized (0 0) (1 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 nonce text) (k aik akey)-    (tpm tpmconf chan))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id-0) (nonce nonce) (k k)-    (aik aik) (tpm tpm) (tpmconf tpmconf))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-extend-enc 1 (nonce nonce) (tpm tpm))-  (precedes ((1 2) (2 0)) ((1 4) (0 0)) ((2 1) (1 3)) ((3 0) (1 0)))-  (non-orig aik (invk k))-  (uniq-orig n v nonce k)-  (conf tpmconf)-  (auth tpm)-  (operation channel-test (added-strand tpm-extend-enc 1)-    (ch-msg tpm (cat "token" nonce)) (1 0))-  (strand-map 0 1 2)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((recv tpm (cat "token" nonce))-      (send tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce)))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((send tpm (cat "token" nonce))))-  (label 16)-  (parent 15)-  (unrealized (0 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 nonce text) (k aik akey) (pt pval)-    (tpm tpmconf tpm-0 chan) (pcr locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id-0) (nonce nonce) (k k)-    (aik aik) (tpm tpm) (tpmconf tpmconf))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-extend-enc 1 (nonce nonce) (tpm tpm))-  (defstrand tpm-quote 3 (nonce (enc v k))-    (current-value (hash (hash "0" n) "refuse")) (pcr-id pcr-id)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (precedes ((1 2) (2 0)) ((1 4) (4 0)) ((2 1) (1 3)) ((3 0) (1 0))-    ((4 2) (0 0)))-  (non-orig aik (invk k))-  (uniq-orig n v nonce k)-  (gen-st (hash (hash "0" n) "refuse"))-  (conf tpmconf)-  (auth tpm)-  -  (operation encryption-test (added-strand tpm-quote 3)-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik)-    (0 0))-  (strand-map 0 1 2 3)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((recv tpm (cat "token" nonce))-      (send tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce)))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((send tpm (cat "token" nonce)))-    ((recv tpm-0 (cat "quote" pcr-id (enc v k)))-      (load pcr (cat pt (hash (hash "0" n) "refuse")))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))))-  (label 17)-  (parent 16)-  (unrealized (4 1))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 pcr-id-1 nonce text) (k aik akey)-    (pt pt-0 pval) (tpmconf tpm tpm-0 chan) (pcr locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id-0) (nonce nonce) (k k)-    (aik aik) (tpm tpm-0) (tpmconf tpmconf))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm-0))-  (defstrand tpm-quote 3 (nonce (enc v k))-    (current-value (hash (hash "0" n) "refuse")) (pcr-id pcr-id)-    (aik aik) (tpm tpm) (pcr pcr))-  (defstrand tpm-extend-enc 4 (value "refuse")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (nonce nonce)-    (tpm tpm-0) (pcr pcr))-  (precedes ((1 2) (2 0)) ((1 4) (3 0)) ((2 1) (1 3)) ((3 2) (0 0))-    ((4 0) (1 0)) ((4 3) (3 1)))-  (non-orig aik (invk k))-  (uniq-orig n v nonce k)-  (gen-st (hash "0" n) (hash (hash "0" n) "refuse"))-  (conf tpmconf)-  (auth tpm-0)-  (leads-to ((4 3) (3 1)))-  -  (operation channel-test (displaced 3 5 tpm-extend-enc 4)-    (ch-msg pcr (cat pt (hash (hash "0" n) "refuse"))) (4 1))-  (strand-map 0 1 2 4 3)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((recv tpm-0 (cat "token" nonce))-      (send tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce)))-      (send tpm-0-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm-0-       (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm (cat "quote" pcr-id (enc v k)))-      (load pcr (cat pt (hash (hash "0" n) "refuse")))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((send tpm-0 (cat "token" nonce))-      (recv tpm-0-        (cat "extend" pcr-id-1 "refuse" (hash pcr-id-1 "refuse" nonce)))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "refuse")))))-  (label 18)-  (parent 17)-  (unrealized (4 1) (4 2))-  (dead)-  (comment "empty cohort"))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 nonce pcr-id-1 nonce-0 text)-    (k aik akey) (pt pt-0 pval) (tpm tpmconf tpm-0 tpm-1 chan)-    (pcr locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id-0) (nonce nonce) (k k)-    (aik aik) (tpm tpm) (tpmconf tpmconf))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-extend-enc 1 (nonce nonce) (tpm tpm))-  (defstrand tpm-quote 3 (nonce (enc v k))-    (current-value (hash (hash "0" n) "refuse")) (pcr-id pcr-id)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 4 (value "refuse")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (nonce nonce-0)-    (tpm tpm-1) (pcr pcr))-  (precedes ((1 2) (2 0)) ((1 4) (4 0)) ((2 1) (1 3)) ((3 0) (1 0))-    ((4 2) (0 0)) ((5 3) (4 1)))-  (non-orig aik (invk k))-  (uniq-orig n v nonce nonce-0 k)-  (gen-st (hash "0" n) (hash (hash "0" n) "refuse"))-  (conf tpmconf)-  (auth tpm)-  (leads-to ((5 3) (4 1)))-  -  (operation channel-test (added-strand tpm-extend-enc 4)-    (ch-msg pcr (cat pt (hash (hash "0" n) "refuse"))) (4 1))-  (strand-map 0 1 2 3 4)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((recv tpm (cat "token" nonce))-      (send tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce)))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((send tpm (cat "token" nonce)))-    ((recv tpm-0 (cat "quote" pcr-id (enc v k)))-      (load pcr (cat pt (hash (hash "0" n) "refuse")))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((send tpm-1 (cat "token" nonce-0))-      (recv tpm-1-        (cat "extend" pcr-id-1 "refuse"-          (hash pcr-id-1 "refuse" nonce-0)))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "refuse")))))-  (label 19)-  (parent 17)-  (unrealized (5 2))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton envelope-  (vars (n v data)-    (pcr-id pcr-id-0 pcr-id-1 nonce pcr-id-2 nonce-0 text) (k aik akey)-    (pt pt-0 pt-1 pval) (tpmconf tpm tpm-0 tpm-1 chan) (pcr locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id-0) (nonce nonce-0) (k k)-    (aik aik) (tpm tpm-1) (tpmconf tpmconf))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm-1))-  (defstrand tpm-quote 3 (nonce (enc v k))-    (current-value (hash (hash "0" n) "refuse")) (pcr-id pcr-id)-    (aik aik) (tpm tpm) (pcr pcr))-  (defstrand tpm-extend-enc 4 (value "refuse")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (nonce nonce)-    (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 4 (value n) (current-value "0")-    (pcr-id pcr-id-2) (nonce nonce-0) (tpm tpm-1) (pcr pcr))-  (precedes ((1 1) (5 1)) ((1 2) (2 0)) ((1 4) (3 0)) ((2 1) (1 3))-    ((3 2) (0 0)) ((4 3) (3 1)) ((5 0) (1 0)) ((5 3) (4 2)))-  (non-orig aik (invk k))-  (uniq-orig n v nonce nonce-0 k)-  (gen-st (hash "0" n) (hash (hash "0" n) "refuse"))-  (conf tpmconf)-  (auth tpm-1)-  (leads-to ((4 3) (3 1)) ((5 3) (4 2)))-  -  (operation channel-test (displaced 3 6 tpm-extend-enc 4)-    (ch-msg pcr (cat pt-0 (hash "0" n))) (5 2))-  (strand-map 0 1 2 5 3 4)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((recv tpm-1 (cat "token" nonce-0))-      (send tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce-0)))-      (send tpm-1-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm-1-       (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm (cat "quote" pcr-id (enc v k)))-      (load pcr (cat pt (hash (hash "0" n) "refuse")))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((send tpm-0 (cat "token" nonce))-      (recv tpm-0-        (cat "extend" pcr-id-1 "refuse" (hash pcr-id-1 "refuse" nonce)))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "refuse"))))-    ((send tpm-1 (cat "token" nonce-0))-      (recv tpm-1 (cat "extend" pcr-id-2 n (hash pcr-id-2 n nonce-0)))-      (load pcr (cat pt-1 "0")) (stor pcr (cat pt-0 (hash "0" n)))))-  (label 20)-  (parent 19)-  (unrealized (5 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-  (vars (n v data)-    (pcr-id pcr-id-0 nonce pcr-id-1 nonce-0 pcr-id-2 nonce-1 text)-    (k aik akey) (pt pt-0 pt-1 pval)-    (tpm tpmconf tpm-0 tpm-1 tpm-2 chan) (pcr locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id-0) (nonce nonce) (k k)-    (aik aik) (tpm tpm) (tpmconf tpmconf))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-extend-enc 1 (nonce nonce) (tpm tpm))-  (defstrand tpm-quote 3 (nonce (enc v k))-    (current-value (hash (hash "0" n) "refuse")) (pcr-id pcr-id)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 4 (value "refuse")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (nonce nonce-0)-    (tpm tpm-1) (pcr pcr))-  (defstrand tpm-extend-enc 4 (value n) (current-value "0")-    (pcr-id pcr-id-2) (nonce nonce-1) (tpm tpm-2) (pcr pcr))-  (precedes ((1 1) (6 1)) ((1 2) (2 0)) ((1 4) (4 0)) ((2 1) (1 3))-    ((3 0) (1 0)) ((4 2) (0 0)) ((5 3) (4 1)) ((6 3) (5 2)))-  (non-orig aik (invk k))-  (uniq-orig n v nonce nonce-0 nonce-1 k)-  (gen-st (hash "0" n) (hash (hash "0" n) "refuse"))-  (conf tpmconf)-  (auth tpm)-  (leads-to ((5 3) (4 1)) ((6 3) (5 2)))-  -  (operation channel-test (added-strand tpm-extend-enc 4)-    (ch-msg pcr (cat pt-0 (hash "0" n))) (5 2))-  (strand-map 0 1 2 3 4 5)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((recv tpm (cat "token" nonce))-      (send tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce)))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((send tpm (cat "token" nonce)))-    ((recv tpm-0 (cat "quote" pcr-id (enc v k)))-      (load pcr (cat pt (hash (hash "0" n) "refuse")))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((send tpm-1 (cat "token" nonce-0))-      (recv tpm-1-        (cat "extend" pcr-id-1 "refuse"-          (hash pcr-id-1 "refuse" nonce-0)))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "refuse"))))-    ((send tpm-2 (cat "token" nonce-1))-      (recv tpm-2 (cat "extend" pcr-id-2 n (hash pcr-id-2 n nonce-1)))-      (load pcr (cat pt-1 "0")) (stor pcr (cat pt-0 (hash "0" n)))))-  (label 21)-  (parent 19)-  (unrealized (6 1))-  (dead)-  (comment "empty cohort"))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 pcr-id-1 nonce nonce-0 text)-    (k aik akey) (pt pt-0 pt-1 pval) (tpmconf tpm tpm-0 chan)-    (pcr locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id-0) (nonce nonce-0) (k k)-    (aik aik) (tpm tpmconf) (tpmconf tpmconf))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpmconf))-  (defstrand tpm-quote 3 (nonce (enc v k))-    (current-value (hash (hash "0" n) "refuse")) (pcr-id pcr-id)-    (aik aik) (tpm tpm) (pcr pcr))-  (defstrand tpm-extend-enc 4 (value "refuse")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (nonce nonce)-    (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 4 (value n) (current-value "0")-    (pcr-id pcr-id-0) (nonce nonce-0) (tpm tpmconf) (pcr pcr))-  (precedes ((1 1) (5 1)) ((1 2) (2 0)) ((1 4) (3 0)) ((2 1) (1 3))-    ((3 2) (0 0)) ((4 3) (3 1)) ((5 0) (1 0)) ((5 3) (4 2)))-  (non-orig aik (invk k))-  (uniq-orig n v nonce nonce-0 k)-  (gen-st (hash "0" n) (hash (hash "0" n) "refuse"))-  (conf tpmconf)-  (auth tpmconf)-  (leads-to ((4 3) (3 1)) ((5 3) (4 2)))-  -  (operation channel-test (displaced 6 1 alice 2)-    (ch-msg tpm-1 (cat "extend" pcr-id-2 n (hash pcr-id-2 n nonce-0)))-    (5 1))-  (strand-map 0 1 2 3 4 5)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((recv tpmconf (cat "token" nonce-0))-      (send tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce-0)))-      (send tpmconf-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpmconf-       (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm (cat "quote" pcr-id (enc v k)))-      (load pcr (cat pt (hash (hash "0" n) "refuse")))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((send tpm-0 (cat "token" nonce))-      (recv tpm-0-        (cat "extend" pcr-id-1 "refuse" (hash pcr-id-1 "refuse" nonce)))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "refuse"))))-    ((send tpmconf (cat "token" nonce-0))-      (recv tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce-0)))-      (load pcr (cat pt-1 "0")) (stor pcr (cat pt-0 (hash "0" n)))))-  (label 22)-  (parent 20)-  (realized)-  (shape)-  (maps-    ((0 1)-      ((n n) (v v) (k k) (aik aik) (pcr-id pcr-id) (pcr-id-0 pcr-id-0)-        (nonce nonce-0) (tpm tpmconf) (tpmconf tpmconf))))-  (origs (n (1 1)) (nonce-0 (5 0)) (pt-0 (5 3)) (nonce (4 0)) (pt (4 3))-    (k (2 1)) (v (1 4))))--(comment "Nothing left to do")--(defprotocol envelope basic-  (defrole tpm-power-on-    (vars (current-value mesg) (pcr locn) (tpm chan))-    (trace (recv tpm "power on") (load pcr current-value)-      (stor pcr "0")))-  (defrole tpm-extend-enc-    (vars (value current-value mesg) (pcr-id nonce text) (pcr locn)-      (tpm chan))-    (trace (send tpm (cat "token" nonce))-      (recv tpm (cat "extend" pcr-id value (hash pcr-id value nonce)))-      (load pcr current-value) (stor pcr (hash current-value value))-      (send "ext ok"))-    (uniq-orig nonce))-  (defrole tpm-quote-    (vars (nonce current-value mesg) (pcr-id text) (aik akey) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "quote" pcr-id nonce))-      (load pcr current-value)-      (send (enc "quote" pcr-id current-value nonce aik))))-  (defrole tpm-create-key-    (vars (k aik akey) (pcr-id text) (pcrval mesg) (tpm chan))-    (trace (recv tpm (cat "create-req" pcr-id pcrval))-      (send (enc "created" k pcr-id pcrval aik)))-    (non-orig (invk k))-    (uniq-orig k)-    (auth tpm))-  (defrole tpm-decrypt-    (vars (m current-value mesg) (pcr-id text) (k aik akey) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "decrypt" (enc m k)))-      (recv (enc "created" k pcr-id current-value aik))-      (load pcr current-value) (send m))-    (non-orig aik))-  (defrole alice-    (vars (n v data) (pcr-id nonce text) (k aik akey)-      (tpm tpmconf chan))-    (trace (recv tpm (cat "token" nonce))-      (send tpmconf (cat "extend" pcr-id n (hash pcr-id n nonce)))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    (non-orig aik)-    (uniq-orig n v)-    (conf tpmconf)-    (neq (k aik)))-  (defrule genStV-if-hashed-tpm-power-on-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-power-on" z (idx 2))-          (p "tpm-power-on" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-extend-enc-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-extend-enc" z (idx 3))-          (p "tpm-extend-enc" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-decrypt-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-decrypt" z (idx 3))-          (p "tpm-decrypt" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-quote-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-quote" z (idx 2))-          (p "tpm-quote" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule shearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule invShearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule trRl_tpm-power-on-at-2-    (forall ((z strd))-      (implies (p "tpm-power-on" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_tpm-power-on-at-1-    (forall ((z strd))-      (implies (p "tpm-power-on" z (idx 3)) (trans z (idx 1)))))-  (defgenrule trRl_tpm-extend-enc-at-3-    (forall ((z strd))-      (implies (p "tpm-extend-enc" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_tpm-extend-enc-at-2-    (forall ((z strd))-      (implies (p "tpm-extend-enc" z (idx 4)) (trans z (idx 2))))))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 nonce text) (k aik akey)-    (tpm tpmconf chan))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id-0) (nonce nonce) (k k)-    (aik aik) (tpm tpm) (tpmconf tpmconf))-  (non-orig aik)-  (uniq-orig n v)-  (conf tpmconf)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((recv tpm (cat "token" nonce))-      (send tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce)))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k))))-  (label 23)-  (unrealized (0 0) (1 0) (2 3))-  (preskeleton)-  (origs (v (2 4)) (n (2 1)))-  (comment "Not a skeleton"))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 nonce text) (k aik akey)-    (tpm tpmconf chan))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id-0) (nonce nonce) (k k)-    (aik aik) (tpm tpm) (tpmconf tpmconf))-  (precedes ((2 4) (0 0)) ((2 4) (1 0)))-  (non-orig aik)-  (uniq-orig n v)-  (conf tpmconf)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((recv tpm (cat "token" nonce))-      (send tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce)))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k))))-  (label 24)-  (parent 23)-  (unrealized (0 0) (2 3))-  (origs (v (2 4)) (n (2 1)))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 nonce text) (k aik akey)-    (tpm tpmconf tpm-0 chan))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id-0) (nonce nonce) (k k)-    (aik aik) (tpm tpm) (tpmconf tpmconf))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm-0))-  (precedes ((2 4) (0 0)) ((2 4) (1 0)) ((3 1) (2 3)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (conf tpmconf)-  (auth tpm-0)-  (operation encryption-test (added-strand tpm-create-key 2)-    (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik) (2 3))-  (strand-map 0 1 2)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((recv tpm (cat "token" nonce))-      (send tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce)))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm-0-       (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))))-  (label 25)-  (parent 24)-  (unrealized (0 0) (1 0) (3 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 nonce text) (k aik akey)-    (tpm tpmconf chan))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id-0) (nonce nonce) (k k)-    (aik aik) (tpm tpm) (tpmconf tpmconf))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (precedes ((2 2) (3 0)) ((2 4) (0 0)) ((2 4) (1 0)) ((3 1) (2 3)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (conf tpmconf)-  (auth tpm)-  (operation channel-test (displaced 4 2 alice 3)-    (ch-msg tpm-0-      (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain"))) (3 0))-  (strand-map 0 1 2 3)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((recv tpm (cat "token" nonce))-      (send tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce)))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))))-  (label 26)-  (parent 25)-  (unrealized (0 0) (1 0) (2 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 nonce text) (k aik akey)-    (tpm tpmconf chan))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id-0) (nonce nonce) (k k)-    (aik aik) (tpm tpm) (tpmconf tpmconf))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-extend-enc 1 (nonce nonce) (tpm tpm))-  (precedes ((2 2) (3 0)) ((2 4) (0 0)) ((2 4) (1 0)) ((3 1) (2 3))-    ((4 0) (2 0)))-  (non-orig aik (invk k))-  (uniq-orig n v nonce k)-  (conf tpmconf)-  (auth tpm)-  (operation channel-test (added-strand tpm-extend-enc 1)-    (ch-msg tpm (cat "token" nonce)) (2 0))-  (strand-map 0 1 2 3)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((recv tpm (cat "token" nonce))-      (send tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce)))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((send tpm (cat "token" nonce))))-  (label 27)-  (parent 26)-  (unrealized (0 0) (1 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-  (vars (current-value mesg) (n v data)-    (pcr-id pcr-id-0 nonce pcr-id-1 text) (k aik aik-0 akey) (pt pval)-    (tpm tpmconf tpm-0 chan) (pcr locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id-0) (nonce nonce) (k k)-    (aik aik) (tpm tpm) (tpmconf tpmconf))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-extend-enc 1 (nonce nonce) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v) (current-value current-value)-    (pcr-id pcr-id-1) (k k) (aik aik-0) (tpm tpm-0) (pcr pcr))-  (precedes ((2 2) (3 0)) ((2 4) (0 0)) ((2 4) (5 0)) ((3 1) (2 3))-    ((4 0) (2 0)) ((5 3) (1 0)))-  (non-orig aik aik-0 (invk k))-  (uniq-orig n v nonce k)-  (conf tpmconf)-  (auth tpm)-  (operation nonce-test (added-strand tpm-decrypt 4) v (1 0) (enc v k))-  (strand-map 0 1 2 3 4)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((recv tpm (cat "token" nonce))-      (send tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce)))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((send tpm (cat "token" nonce)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-1 current-value aik-0))-      (load pcr (cat pt current-value)) (send v)))-  (label 28)-  (parent 27)-  (unrealized (0 0) (5 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 nonce text) (k aik akey) (pt pval)-    (tpm tpmconf tpm-0 chan) (pcr locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id-0) (nonce nonce) (k k)-    (aik aik) (tpm tpm) (tpmconf tpmconf))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-extend-enc 1 (nonce nonce) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id-0) (k k)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (precedes ((2 2) (3 0)) ((2 4) (0 0)) ((2 4) (5 0)) ((3 1) (2 3))-    ((4 0) (2 0)) ((5 3) (1 0)))-  (non-orig aik (invk k))-  (uniq-orig n v nonce k)-  (gen-st (hash (hash "0" n) "obtain"))-  (conf tpmconf)-  (auth tpm)-  -  (operation encryption-test (displaced 6 3 tpm-create-key 2)-    (enc "created" k pcr-id-1 current-value aik-0) (5 1))-  (strand-map 0 1 2 3 4 5)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((recv tpm (cat "token" nonce))-      (send tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce)))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((send tpm (cat "token" nonce)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v)))-  (label 29)-  (parent 28)-  (unrealized (0 0) (5 2))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 pcr-id-1 nonce text) (k aik akey)-    (pt pt-0 pval) (tpmconf tpm tpm-0 chan) (pcr locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id-0) (nonce nonce) (k k)-    (aik aik) (tpm tpm-0) (tpmconf tpmconf))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm-0))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id-0) (k k)-    (aik aik) (tpm tpm) (pcr pcr))-  (defstrand tpm-extend-enc 4 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (nonce nonce)-    (tpm tpm-0) (pcr pcr))-  (precedes ((2 2) (3 0)) ((2 4) (0 0)) ((2 4) (4 0)) ((3 1) (2 3))-    ((4 3) (1 0)) ((5 0) (2 0)) ((5 3) (4 2)))-  (non-orig aik (invk k))-  (uniq-orig n v nonce k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain"))-  (conf tpmconf)-  (auth tpm-0)-  (leads-to ((5 3) (4 2)))-  -  (operation channel-test (displaced 4 6 tpm-extend-enc 4)-    (ch-msg pcr (cat pt (hash (hash "0" n) "obtain"))) (5 2))-  (strand-map 0 1 2 3 5 4)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((recv tpm-0 (cat "token" nonce))-      (send tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce)))-      (send tpm-0-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm-0-       (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((send tpm-0 (cat "token" nonce))-      (recv tpm-0-        (cat "extend" pcr-id-1 "obtain" (hash pcr-id-1 "obtain" nonce)))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain")))))-  (label 30)-  (parent 29)-  (unrealized (0 0) (5 1) (5 2))-  (dead)-  (comment "empty cohort"))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 nonce pcr-id-1 nonce-0 text)-    (k aik akey) (pt pt-0 pval) (tpm tpmconf tpm-0 tpm-1 chan)-    (pcr locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id-0) (nonce nonce) (k k)-    (aik aik) (tpm tpm) (tpmconf tpmconf))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-extend-enc 1 (nonce nonce) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id-0) (k k)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 4 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (nonce nonce-0)-    (tpm tpm-1) (pcr pcr))-  (precedes ((2 2) (3 0)) ((2 4) (0 0)) ((2 4) (5 0)) ((3 1) (2 3))-    ((4 0) (2 0)) ((5 3) (1 0)) ((6 3) (5 2)))-  (non-orig aik (invk k))-  (uniq-orig n v nonce nonce-0 k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain"))-  (conf tpmconf)-  (auth tpm)-  (leads-to ((6 3) (5 2)))-  -  (operation channel-test (added-strand tpm-extend-enc 4)-    (ch-msg pcr (cat pt (hash (hash "0" n) "obtain"))) (5 2))-  (strand-map 0 1 2 3 4 5)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((recv tpm (cat "token" nonce))-      (send tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce)))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((send tpm (cat "token" nonce)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((send tpm-1 (cat "token" nonce-0))-      (recv tpm-1-        (cat "extend" pcr-id-1 "obtain"-          (hash pcr-id-1 "obtain" nonce-0)))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain")))))-  (label 31)-  (parent 29)-  (unrealized (0 0) (6 2))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton envelope-  (vars (n v data)-    (pcr-id pcr-id-0 pcr-id-1 nonce pcr-id-2 nonce-0 text) (k aik akey)-    (pt pt-0 pt-1 pval) (tpmconf tpm tpm-0 tpm-1 chan) (pcr locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id-0) (nonce nonce-0) (k k)-    (aik aik) (tpm tpm-1) (tpmconf tpmconf))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm-1))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id-0) (k k)-    (aik aik) (tpm tpm) (pcr pcr))-  (defstrand tpm-extend-enc 4 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (nonce nonce)-    (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 4 (value n) (current-value "0")-    (pcr-id pcr-id-2) (nonce nonce-0) (tpm tpm-1) (pcr pcr))-  (precedes ((2 1) (6 1)) ((2 2) (3 0)) ((2 4) (0 0)) ((2 4) (4 0))-    ((3 1) (2 3)) ((4 3) (1 0)) ((5 3) (4 2)) ((6 0) (2 0))-    ((6 3) (5 2)))-  (non-orig aik (invk k))-  (uniq-orig n v nonce nonce-0 k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain"))-  (conf tpmconf)-  (auth tpm-1)-  (leads-to ((5 3) (4 2)) ((6 3) (5 2)))-  -  (operation channel-test (displaced 4 7 tpm-extend-enc 4)-    (ch-msg pcr (cat pt-0 (hash "0" n))) (6 2))-  (strand-map 0 1 2 3 6 4 5)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((recv tpm-1 (cat "token" nonce-0))-      (send tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce-0)))-      (send tpm-1-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm-1-       (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((send tpm-0 (cat "token" nonce))-      (recv tpm-0-        (cat "extend" pcr-id-1 "obtain" (hash pcr-id-1 "obtain" nonce)))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain"))))-    ((send tpm-1 (cat "token" nonce-0))-      (recv tpm-1 (cat "extend" pcr-id-2 n (hash pcr-id-2 n nonce-0)))-      (load pcr (cat pt-1 "0")) (stor pcr (cat pt-0 (hash "0" n)))))-  (label 32)-  (parent 31)-  (unrealized (0 0) (6 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-  (vars (n v data)-    (pcr-id pcr-id-0 nonce pcr-id-1 nonce-0 pcr-id-2 nonce-1 text)-    (k aik akey) (pt pt-0 pt-1 pval)-    (tpm tpmconf tpm-0 tpm-1 tpm-2 chan) (pcr locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id-0) (nonce nonce) (k k)-    (aik aik) (tpm tpm) (tpmconf tpmconf))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-extend-enc 1 (nonce nonce) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id-0) (k k)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 4 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (nonce nonce-0)-    (tpm tpm-1) (pcr pcr))-  (defstrand tpm-extend-enc 4 (value n) (current-value "0")-    (pcr-id pcr-id-2) (nonce nonce-1) (tpm tpm-2) (pcr pcr))-  (precedes ((2 1) (7 1)) ((2 2) (3 0)) ((2 4) (0 0)) ((2 4) (5 0))-    ((3 1) (2 3)) ((4 0) (2 0)) ((5 3) (1 0)) ((6 3) (5 2))-    ((7 3) (6 2)))-  (non-orig aik (invk k))-  (uniq-orig n v nonce nonce-0 nonce-1 k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain"))-  (conf tpmconf)-  (auth tpm)-  (leads-to ((6 3) (5 2)) ((7 3) (6 2)))-  -  (operation channel-test (added-strand tpm-extend-enc 4)-    (ch-msg pcr (cat pt-0 (hash "0" n))) (6 2))-  (strand-map 0 1 2 3 4 5 6)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((recv tpm (cat "token" nonce))-      (send tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce)))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((send tpm (cat "token" nonce)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((send tpm-1 (cat "token" nonce-0))-      (recv tpm-1-        (cat "extend" pcr-id-1 "obtain"-          (hash pcr-id-1 "obtain" nonce-0)))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain"))))-    ((send tpm-2 (cat "token" nonce-1))-      (recv tpm-2 (cat "extend" pcr-id-2 n (hash pcr-id-2 n nonce-1)))-      (load pcr (cat pt-1 "0")) (stor pcr (cat pt-0 (hash "0" n)))))-  (label 33)-  (parent 31)-  (unrealized (0 0) (7 1))-  (dead)-  (comment "empty cohort"))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 pcr-id-1 nonce nonce-0 text)-    (k aik akey) (pt pt-0 pt-1 pval) (tpmconf tpm tpm-0 chan)-    (pcr locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id-0) (nonce nonce-0) (k k)-    (aik aik) (tpm tpmconf) (tpmconf tpmconf))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpmconf))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id-0) (k k)-    (aik aik) (tpm tpm) (pcr pcr))-  (defstrand tpm-extend-enc 4 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (nonce nonce)-    (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 4 (value n) (current-value "0")-    (pcr-id pcr-id-0) (nonce nonce-0) (tpm tpmconf) (pcr pcr))-  (precedes ((2 1) (6 1)) ((2 2) (3 0)) ((2 4) (0 0)) ((2 4) (4 0))-    ((3 1) (2 3)) ((4 3) (1 0)) ((5 3) (4 2)) ((6 0) (2 0))-    ((6 3) (5 2)))-  (non-orig aik (invk k))-  (uniq-orig n v nonce nonce-0 k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain"))-  (conf tpmconf)-  (auth tpmconf)-  (leads-to ((5 3) (4 2)) ((6 3) (5 2)))-  -  (operation channel-test (displaced 7 2 alice 2)-    (ch-msg tpm-1 (cat "extend" pcr-id-2 n (hash pcr-id-2 n nonce-0)))-    (6 1))-  (strand-map 0 1 2 3 4 5 6)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((recv tpmconf (cat "token" nonce-0))-      (send tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce-0)))-      (send tpmconf-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpmconf-       (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((send tpm-0 (cat "token" nonce))-      (recv tpm-0-        (cat "extend" pcr-id-1 "obtain" (hash pcr-id-1 "obtain" nonce)))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain"))))-    ((send tpmconf (cat "token" nonce-0))-      (recv tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce-0)))-      (load pcr (cat pt-1 "0")) (stor pcr (cat pt-0 (hash "0" n)))))-  (label 34)-  (parent 32)-  (unrealized (0 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 pcr-id-1 nonce nonce-0 text)-    (k aik akey) (pt pt-0 pt-1 pt-2 pval) (tpmconf tpm tpm-0 tpm-1 chan)-    (pcr pcr-0 locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id-0) (nonce nonce-0) (k k)-    (aik aik) (tpm tpmconf) (tpmconf tpmconf))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpmconf))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id-0) (k k)-    (aik aik) (tpm tpm) (pcr pcr))-  (defstrand tpm-extend-enc 4 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (nonce nonce)-    (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 4 (value n) (current-value "0")-    (pcr-id pcr-id-0) (nonce nonce-0) (tpm tpmconf) (pcr pcr))-  (defstrand tpm-quote 3 (nonce (enc v k))-    (current-value (hash (hash "0" n) "refuse")) (pcr-id pcr-id)-    (aik aik) (tpm tpm-1) (pcr pcr-0))-  (precedes ((2 1) (6 1)) ((2 2) (3 0)) ((2 4) (4 0)) ((2 4) (7 0))-    ((3 1) (2 3)) ((4 3) (1 0)) ((5 3) (4 2)) ((6 0) (2 0))-    ((6 3) (5 2)) ((7 2) (0 0)))-  (non-orig aik (invk k))-  (uniq-orig n v nonce nonce-0 k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain")-    (hash (hash "0" n) "refuse"))-  (conf tpmconf)-  (auth tpmconf)-  (leads-to ((5 3) (4 2)) ((6 3) (5 2)))-  -  (operation encryption-test (added-strand tpm-quote 3)-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik)-    (0 0))-  (strand-map 0 1 2 3 4 5 6)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((recv tpmconf (cat "token" nonce-0))-      (send tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce-0)))-      (send tpmconf-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpmconf-       (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((send tpm-0 (cat "token" nonce))-      (recv tpm-0-        (cat "extend" pcr-id-1 "obtain" (hash pcr-id-1 "obtain" nonce)))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain"))))-    ((send tpmconf (cat "token" nonce-0))-      (recv tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce-0)))-      (load pcr (cat pt-1 "0")) (stor pcr (cat pt-0 (hash "0" n))))-    ((recv tpm-1 (cat "quote" pcr-id (enc v k)))-      (load pcr-0 (cat pt-2 (hash (hash "0" n) "refuse")))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))))-  (label 35)-  (parent 34)-  (unrealized (7 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-  (vars (n v data)-    (pcr-id pcr-id-0 pcr-id-1 nonce nonce-0 pcr-id-2 nonce-1 text)-    (k aik akey) (pt pt-0 pt-1 pt-2 pt-3 pval)-    (tpmconf tpm tpm-0 tpm-1 tpm-2 chan) (pcr pcr-0 locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id-0) (nonce nonce-0) (k k)-    (aik aik) (tpm tpmconf) (tpmconf tpmconf))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpmconf))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id-0) (k k)-    (aik aik) (tpm tpm) (pcr pcr))-  (defstrand tpm-extend-enc 4 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (nonce nonce)-    (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 4 (value n) (current-value "0")-    (pcr-id pcr-id-0) (nonce nonce-0) (tpm tpmconf) (pcr pcr))-  (defstrand tpm-quote 3 (nonce (enc v k))-    (current-value (hash (hash "0" n) "refuse")) (pcr-id pcr-id)-    (aik aik) (tpm tpm-1) (pcr pcr-0))-  (defstrand tpm-extend-enc 4 (value "refuse")-    (current-value (hash "0" n)) (pcr-id pcr-id-2) (nonce nonce-1)-    (tpm tpm-2) (pcr pcr-0))-  (precedes ((2 1) (6 1)) ((2 2) (3 0)) ((2 4) (4 0)) ((2 4) (7 0))-    ((3 1) (2 3)) ((4 3) (1 0)) ((5 3) (4 2)) ((6 0) (2 0))-    ((6 3) (5 2)) ((7 2) (0 0)) ((8 3) (7 1)))-  (non-orig aik (invk k))-  (uniq-orig n v nonce nonce-0 nonce-1 k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain")-    (hash (hash "0" n) "refuse"))-  (conf tpmconf)-  (auth tpmconf)-  (leads-to ((5 3) (4 2)) ((6 3) (5 2)) ((8 3) (7 1)))-  -  (operation channel-test (added-strand tpm-extend-enc 4)-    (ch-msg pcr-0 (cat pt-2 (hash (hash "0" n) "refuse"))) (7 1))-  (strand-map 0 1 2 3 4 5 6 7)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((recv tpmconf (cat "token" nonce-0))-      (send tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce-0)))-      (send tpmconf-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpmconf-       (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((send tpm-0 (cat "token" nonce))-      (recv tpm-0-        (cat "extend" pcr-id-1 "obtain" (hash pcr-id-1 "obtain" nonce)))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain"))))-    ((send tpmconf (cat "token" nonce-0))-      (recv tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce-0)))-      (load pcr (cat pt-1 "0")) (stor pcr (cat pt-0 (hash "0" n))))-    ((recv tpm-1 (cat "quote" pcr-id (enc v k)))-      (load pcr-0 (cat pt-2 (hash (hash "0" n) "refuse")))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((send tpm-2 (cat "token" nonce-1))-      (recv tpm-2-        (cat "extend" pcr-id-2 "refuse"-          (hash pcr-id-2 "refuse" nonce-1)))-      (load pcr-0 (cat pt-3 (hash "0" n)))-      (stor pcr-0 (cat pt-2 (hash (hash "0" n) "refuse")))))-  (label 36)-  (parent 35)-  (unrealized (8 2))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-  (vars (n v data)-    (pcr-id pcr-id-0 pcr-id-1 nonce nonce-0 pcr-id-2 nonce-1 pcr-id-3-      nonce-2 text) (k aik akey) (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval)-    (tpmconf tpm tpm-0 tpm-1 tpm-2 tpm-3 chan) (pcr pcr-0 locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id-0) (nonce nonce-0) (k k)-    (aik aik) (tpm tpmconf) (tpmconf tpmconf))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpmconf))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id-0) (k k)-    (aik aik) (tpm tpm) (pcr pcr))-  (defstrand tpm-extend-enc 4 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (nonce nonce)-    (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 4 (value n) (current-value "0")-    (pcr-id pcr-id-0) (nonce nonce-0) (tpm tpmconf) (pcr pcr))-  (defstrand tpm-quote 3 (nonce (enc v k))-    (current-value (hash (hash "0" n) "refuse")) (pcr-id pcr-id)-    (aik aik) (tpm tpm-1) (pcr pcr-0))-  (defstrand tpm-extend-enc 4 (value "refuse")-    (current-value (hash "0" n)) (pcr-id pcr-id-2) (nonce nonce-1)-    (tpm tpm-2) (pcr pcr-0))-  (defstrand tpm-extend-enc 4 (value n) (current-value "0")-    (pcr-id pcr-id-3) (nonce nonce-2) (tpm tpm-3) (pcr pcr-0))-  (precedes ((2 1) (6 1)) ((2 1) (9 1)) ((2 2) (3 0)) ((2 4) (4 0))-    ((2 4) (7 0)) ((3 1) (2 3)) ((4 3) (1 0)) ((5 3) (4 2))-    ((6 0) (2 0)) ((6 3) (5 2)) ((7 2) (0 0)) ((8 3) (7 1))-    ((9 3) (8 2)))-  (non-orig aik (invk k))-  (uniq-orig n v nonce nonce-0 nonce-1 nonce-2 k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain")-    (hash (hash "0" n) "refuse"))-  (conf tpmconf)-  (auth tpmconf)-  (leads-to ((5 3) (4 2)) ((6 3) (5 2)) ((8 3) (7 1)) ((9 3) (8 2)))-  -  (operation channel-test (added-strand tpm-extend-enc 4)-    (ch-msg pcr-0 (cat pt-3 (hash "0" n))) (8 2))-  (strand-map 0 1 2 3 4 5 6 7 8)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((recv tpmconf (cat "token" nonce-0))-      (send tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce-0)))-      (send tpmconf-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpmconf-       (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((send tpm-0 (cat "token" nonce))-      (recv tpm-0-        (cat "extend" pcr-id-1 "obtain" (hash pcr-id-1 "obtain" nonce)))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain"))))-    ((send tpmconf (cat "token" nonce-0))-      (recv tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce-0)))-      (load pcr (cat pt-1 "0")) (stor pcr (cat pt-0 (hash "0" n))))-    ((recv tpm-1 (cat "quote" pcr-id (enc v k)))-      (load pcr-0 (cat pt-2 (hash (hash "0" n) "refuse")))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((send tpm-2 (cat "token" nonce-1))-      (recv tpm-2-        (cat "extend" pcr-id-2 "refuse"-          (hash pcr-id-2 "refuse" nonce-1)))-      (load pcr-0 (cat pt-3 (hash "0" n)))-      (stor pcr-0 (cat pt-2 (hash (hash "0" n) "refuse"))))-    ((send tpm-3 (cat "token" nonce-2))-      (recv tpm-3 (cat "extend" pcr-id-3 n (hash pcr-id-3 n nonce-2)))-      (load pcr-0 (cat pt-4 "0")) (stor pcr-0 (cat pt-3 (hash "0" n)))))-  (label 37)-  (parent 36)-  (unrealized (9 1))-  (dead)-  (comment "empty cohort"))--(comment "Nothing left to do")--(defprotocol envelope basic-  (defrole tpm-power-on-    (vars (current-value mesg) (pcr locn) (tpm chan))-    (trace (recv tpm "power on") (load pcr current-value)-      (stor pcr "0")))-  (defrole tpm-extend-enc-    (vars (value current-value mesg) (pcr-id nonce text) (pcr locn)-      (tpm chan))-    (trace (send tpm (cat "token" nonce))-      (recv tpm (cat "extend" pcr-id value (hash pcr-id value nonce)))-      (load pcr current-value) (stor pcr (hash current-value value))-      (send "ext ok"))-    (uniq-orig nonce))-  (defrole tpm-quote-    (vars (nonce current-value mesg) (pcr-id text) (aik akey) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "quote" pcr-id nonce))-      (load pcr current-value)-      (send (enc "quote" pcr-id current-value nonce aik))))-  (defrole tpm-create-key-    (vars (k aik akey) (pcr-id text) (pcrval mesg) (tpm chan))-    (trace (recv tpm (cat "create-req" pcr-id pcrval))-      (send (enc "created" k pcr-id pcrval aik)))-    (non-orig (invk k))-    (uniq-orig k)-    (auth tpm))-  (defrole tpm-decrypt-    (vars (m current-value mesg) (pcr-id text) (k aik akey) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "decrypt" (enc m k)))-      (recv (enc "created" k pcr-id current-value aik))-      (load pcr current-value) (send m))-    (non-orig aik))-  (defrole alice-    (vars (n v data) (pcr-id nonce text) (k aik akey)-      (tpm tpmconf chan))-    (trace (recv tpm (cat "token" nonce))-      (send tpmconf (cat "extend" pcr-id n (hash pcr-id n nonce)))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    (non-orig aik)-    (uniq-orig n v)-    (conf tpmconf)-    (neq (k aik)))-  (defrule genStV-if-hashed-tpm-power-on-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-power-on" z (idx 2))-          (p "tpm-power-on" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-extend-enc-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-extend-enc" z (idx 3))-          (p "tpm-extend-enc" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-decrypt-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-decrypt" z (idx 3))-          (p "tpm-decrypt" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-quote-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-quote" z (idx 2))-          (p "tpm-quote" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule shearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule invShearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule trRl_tpm-power-on-at-2-    (forall ((z strd))-      (implies (p "tpm-power-on" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_tpm-power-on-at-1-    (forall ((z strd))-      (implies (p "tpm-power-on" z (idx 3)) (trans z (idx 1)))))-  (defgenrule trRl_tpm-extend-enc-at-3-    (forall ((z strd))-      (implies (p "tpm-extend-enc" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_tpm-extend-enc-at-2-    (forall ((z strd))-      (implies (p "tpm-extend-enc" z (idx 4)) (trans z (idx 2))))))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 nonce text) (k aik akey)-    (tpm tpmconf chan))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id-0) (nonce nonce) (k k)-    (aik aik) (tpm tpm) (tpmconf tpmconf))-  (non-orig aik)-  (uniq-orig n v)-  (conf tpmconf)-  -  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((recv tpm (cat "token" nonce))-      (send tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce)))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k))))-  (label 38)-  (unrealized (0 0) (1 0) (2 3))-  (preskeleton)-  (origs (v (2 4)) (n (2 1)))-  (comment "Not a skeleton"))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 nonce text) (k aik akey)-    (tpm tpmconf chan))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id-0) (nonce nonce) (k k)-    (aik aik) (tpm tpm) (tpmconf tpmconf))-  (precedes ((2 4) (0 0)) ((2 4) (1 0)))-  (non-orig aik)-  (uniq-orig n v)-  (conf tpmconf)-  -  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((recv tpm (cat "token" nonce))-      (send tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce)))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k))))-  (label 39)-  (parent 38)-  (unrealized (0 0) (2 3))-  (origs (v (2 4)) (n (2 1)))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 nonce text) (k aik akey)-    (tpm tpmconf tpm-0 chan))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id-0) (nonce nonce) (k k)-    (aik aik) (tpm tpm) (tpmconf tpmconf))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm-0))-  (precedes ((2 4) (0 0)) ((2 4) (1 0)) ((3 1) (2 3)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (conf tpmconf)-  (auth tpm-0)-  -  (operation encryption-test (added-strand tpm-create-key 2)-    (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik) (2 3))-  (strand-map 0 1 2)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((recv tpm (cat "token" nonce))-      (send tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce)))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm-0-       (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))))-  (label 40)-  (parent 39)-  (unrealized (0 0) (1 0) (3 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 nonce text) (k aik akey)-    (tpm tpmconf chan))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id-0) (nonce nonce) (k k)-    (aik aik) (tpm tpm) (tpmconf tpmconf))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (precedes ((2 2) (3 0)) ((2 4) (0 0)) ((2 4) (1 0)) ((3 1) (2 3)))-  (non-orig aik (invk k))-  (uniq-orig n v k)-  (conf tpmconf)-  (auth tpm)-  -  (operation channel-test (displaced 4 2 alice 3)-    (ch-msg tpm-0-      (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain"))) (3 0))-  (strand-map 0 1 2 3)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((recv tpm (cat "token" nonce))-      (send tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce)))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))))-  (label 41)-  (parent 40)-  (unrealized (0 0) (1 0) (2 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 nonce text) (k aik akey)-    (tpm tpmconf chan))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id-0) (nonce nonce) (k k)-    (aik aik) (tpm tpm) (tpmconf tpmconf))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-extend-enc 1 (nonce nonce) (tpm tpm))-  (precedes ((2 2) (3 0)) ((2 4) (0 0)) ((2 4) (1 0)) ((3 1) (2 3))-    ((4 0) (2 0)))-  (non-orig aik (invk k))-  (uniq-orig n v nonce k)-  (conf tpmconf)-  (auth tpm)-  -  (operation channel-test (added-strand tpm-extend-enc 1)-    (ch-msg tpm (cat "token" nonce)) (2 0))-  (strand-map 0 1 2 3)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((recv tpm (cat "token" nonce))-      (send tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce)))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((send tpm (cat "token" nonce))))-  (label 42)-  (parent 41)-  (unrealized (0 0) (1 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-  (vars (current-value mesg) (n v data)-    (pcr-id pcr-id-0 nonce pcr-id-1 text) (k aik aik-0 akey) (pt pval)-    (tpm tpmconf tpm-0 chan) (pcr locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id-0) (nonce nonce) (k k)-    (aik aik) (tpm tpm) (tpmconf tpmconf))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-extend-enc 1 (nonce nonce) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v) (current-value current-value)-    (pcr-id pcr-id-1) (k k) (aik aik-0) (tpm tpm-0) (pcr pcr))-  (precedes ((2 2) (3 0)) ((2 4) (0 0)) ((2 4) (5 0)) ((3 1) (2 3))-    ((4 0) (2 0)) ((5 3) (1 0)))-  (non-orig aik aik-0 (invk k))-  (uniq-orig n v nonce k)-  (conf tpmconf)-  (auth tpm)-  -  (operation nonce-test (added-strand tpm-decrypt 4) v (1 0) (enc v k))-  (strand-map 0 1 2 3 4)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((recv tpm (cat "token" nonce))-      (send tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce)))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((send tpm (cat "token" nonce)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-1 current-value aik-0))-      (load pcr (cat pt current-value)) (send v)))-  (label 43)-  (parent 42)-  (unrealized (0 0) (5 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 nonce text) (k aik akey) (pt pval)-    (tpm tpmconf tpm-0 chan) (pcr locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id-0) (nonce nonce) (k k)-    (aik aik) (tpm tpm) (tpmconf tpmconf))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-extend-enc 1 (nonce nonce) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id-0) (k k)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (precedes ((2 2) (3 0)) ((2 4) (0 0)) ((2 4) (5 0)) ((3 1) (2 3))-    ((4 0) (2 0)) ((5 3) (1 0)))-  (non-orig aik (invk k))-  (uniq-orig n v nonce k)-  (gen-st (hash (hash "0" n) "obtain"))-  (conf tpmconf)-  (auth tpm)-  -  -  (operation encryption-test (displaced 6 3 tpm-create-key 2)-    (enc "created" k pcr-id-1 current-value aik-0) (5 1))-  (strand-map 0 1 2 3 4 5)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((recv tpm (cat "token" nonce))-      (send tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce)))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((send tpm (cat "token" nonce)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v)))-  (label 44)-  (parent 43)-  (unrealized (0 0) (5 2))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 pcr-id-1 nonce text) (k aik akey)-    (pt pt-0 pval) (tpmconf tpm tpm-0 chan) (pcr locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id-0) (nonce nonce) (k k)-    (aik aik) (tpm tpm-0) (tpmconf tpmconf))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm-0))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id-0) (k k)-    (aik aik) (tpm tpm) (pcr pcr))-  (defstrand tpm-extend-enc 4 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (nonce nonce)-    (tpm tpm-0) (pcr pcr))-  (precedes ((2 2) (3 0)) ((2 4) (0 0)) ((2 4) (4 0)) ((3 1) (2 3))-    ((4 3) (1 0)) ((5 0) (2 0)) ((5 3) (4 2)))-  (non-orig aik (invk k))-  (uniq-orig n v nonce k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain"))-  (conf tpmconf)-  (auth tpm-0)-  -  (leads-to ((5 3) (4 2)))-  -  (operation channel-test (displaced 4 6 tpm-extend-enc 4)-    (ch-msg pcr (cat pt (hash (hash "0" n) "obtain"))) (5 2))-  (strand-map 0 1 2 3 5 4)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((recv tpm-0 (cat "token" nonce))-      (send tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce)))-      (send tpm-0-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm-0-       (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((send tpm-0 (cat "token" nonce))-      (recv tpm-0-        (cat "extend" pcr-id-1 "obtain" (hash pcr-id-1 "obtain" nonce)))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain")))))-  (label 45)-  (parent 44)-  (unrealized (0 0) (5 1) (5 2))-  (dead)-  (comment "empty cohort"))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 nonce pcr-id-1 nonce-0 text)-    (k aik akey) (pt pt-0 pval) (tpm tpmconf tpm-0 tpm-1 chan)-    (pcr locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id-0) (nonce nonce) (k k)-    (aik aik) (tpm tpm) (tpmconf tpmconf))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-extend-enc 1 (nonce nonce) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id-0) (k k)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 4 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (nonce nonce-0)-    (tpm tpm-1) (pcr pcr))-  (precedes ((2 2) (3 0)) ((2 4) (0 0)) ((2 4) (5 0)) ((3 1) (2 3))-    ((4 0) (2 0)) ((5 3) (1 0)) ((6 3) (5 2)))-  (non-orig aik (invk k))-  (uniq-orig n v nonce nonce-0 k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain"))-  (conf tpmconf)-  (auth tpm)-  -  (leads-to ((6 3) (5 2)))-  -  (operation channel-test (added-strand tpm-extend-enc 4)-    (ch-msg pcr (cat pt (hash (hash "0" n) "obtain"))) (5 2))-  (strand-map 0 1 2 3 4 5)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((recv tpm (cat "token" nonce))-      (send tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce)))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((send tpm (cat "token" nonce)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((send tpm-1 (cat "token" nonce-0))-      (recv tpm-1-        (cat "extend" pcr-id-1 "obtain"-          (hash pcr-id-1 "obtain" nonce-0)))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain")))))-  (label 46)-  (parent 44)-  (unrealized (0 0) (6 2))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton envelope-  (vars (n v data)-    (pcr-id pcr-id-0 pcr-id-1 nonce pcr-id-2 nonce-0 text) (k aik akey)-    (pt pt-0 pt-1 pval) (tpmconf tpm tpm-0 tpm-1 chan) (pcr locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id-0) (nonce nonce-0) (k k)-    (aik aik) (tpm tpm-1) (tpmconf tpmconf))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm-1))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id-0) (k k)-    (aik aik) (tpm tpm) (pcr pcr))-  (defstrand tpm-extend-enc 4 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (nonce nonce)-    (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 4 (value n) (current-value "0")-    (pcr-id pcr-id-2) (nonce nonce-0) (tpm tpm-1) (pcr pcr))-  (precedes ((2 1) (6 1)) ((2 2) (3 0)) ((2 4) (0 0)) ((2 4) (4 0))-    ((3 1) (2 3)) ((4 3) (1 0)) ((5 3) (4 2)) ((6 0) (2 0))-    ((6 3) (5 2)))-  (non-orig aik (invk k))-  (uniq-orig n v nonce nonce-0 k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain"))-  (conf tpmconf)-  (auth tpm-1)-  -  (leads-to ((5 3) (4 2)) ((6 3) (5 2)))-  -  (operation channel-test (displaced 4 7 tpm-extend-enc 4)-    (ch-msg pcr (cat pt-0 (hash "0" n))) (6 2))-  (strand-map 0 1 2 3 6 4 5)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((recv tpm-1 (cat "token" nonce-0))-      (send tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce-0)))-      (send tpm-1-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm-1-       (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((send tpm-0 (cat "token" nonce))-      (recv tpm-0-        (cat "extend" pcr-id-1 "obtain" (hash pcr-id-1 "obtain" nonce)))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain"))))-    ((send tpm-1 (cat "token" nonce-0))-      (recv tpm-1 (cat "extend" pcr-id-2 n (hash pcr-id-2 n nonce-0)))-      (load pcr (cat pt-1 "0")) (stor pcr (cat pt-0 (hash "0" n)))))-  (label 47)-  (parent 46)-  (unrealized (0 0) (6 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-  (vars (n v data)-    (pcr-id pcr-id-0 nonce pcr-id-1 nonce-0 pcr-id-2 nonce-1 text)-    (k aik akey) (pt pt-0 pt-1 pval)-    (tpm tpmconf tpm-0 tpm-1 tpm-2 chan) (pcr locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id-0) (nonce nonce) (k k)-    (aik aik) (tpm tpm) (tpmconf tpmconf))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpm))-  (defstrand tpm-extend-enc 1 (nonce nonce) (tpm tpm))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id-0) (k k)-    (aik aik) (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 4 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (nonce nonce-0)-    (tpm tpm-1) (pcr pcr))-  (defstrand tpm-extend-enc 4 (value n) (current-value "0")-    (pcr-id pcr-id-2) (nonce nonce-1) (tpm tpm-2) (pcr pcr))-  (precedes ((2 1) (7 1)) ((2 2) (3 0)) ((2 4) (0 0)) ((2 4) (5 0))-    ((3 1) (2 3)) ((4 0) (2 0)) ((5 3) (1 0)) ((6 3) (5 2))-    ((7 3) (6 2)))-  (non-orig aik (invk k))-  (uniq-orig n v nonce nonce-0 nonce-1 k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain"))-  (conf tpmconf)-  (auth tpm)-  -  (leads-to ((6 3) (5 2)) ((7 3) (6 2)))-  -  (operation channel-test (added-strand tpm-extend-enc 4)-    (ch-msg pcr (cat pt-0 (hash "0" n))) (6 2))-  (strand-map 0 1 2 3 4 5 6)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((recv tpm (cat "token" nonce))-      (send tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce)))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpm (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((send tpm (cat "token" nonce)))-    ((recv tpm-0 (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((send tpm-1 (cat "token" nonce-0))-      (recv tpm-1-        (cat "extend" pcr-id-1 "obtain"-          (hash pcr-id-1 "obtain" nonce-0)))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain"))))-    ((send tpm-2 (cat "token" nonce-1))-      (recv tpm-2 (cat "extend" pcr-id-2 n (hash pcr-id-2 n nonce-1)))-      (load pcr (cat pt-1 "0")) (stor pcr (cat pt-0 (hash "0" n)))))-  (label 48)-  (parent 46)-  (unrealized (0 0) (7 1))-  (dead)-  (comment "empty cohort"))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 pcr-id-1 nonce nonce-0 text)-    (k aik akey) (pt pt-0 pt-1 pval) (tpmconf tpm tpm-0 chan)-    (pcr locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id-0) (nonce nonce-0) (k k)-    (aik aik) (tpm tpmconf) (tpmconf tpmconf))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpmconf))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id-0) (k k)-    (aik aik) (tpm tpm) (pcr pcr))-  (defstrand tpm-extend-enc 4 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (nonce nonce)-    (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 4 (value n) (current-value "0")-    (pcr-id pcr-id-0) (nonce nonce-0) (tpm tpmconf) (pcr pcr))-  (precedes ((2 1) (6 1)) ((2 2) (3 0)) ((2 4) (0 0)) ((2 4) (4 0))-    ((3 1) (2 3)) ((4 3) (1 0)) ((5 3) (4 2)) ((6 0) (2 0))-    ((6 3) (5 2)))-  (non-orig aik (invk k))-  (uniq-orig n v nonce nonce-0 k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain"))-  (conf tpmconf)-  (auth tpmconf)-  -  (leads-to ((5 3) (4 2)) ((6 3) (5 2)))-  -  (operation channel-test (displaced 7 2 alice 2)-    (ch-msg tpm-1 (cat "extend" pcr-id-2 n (hash pcr-id-2 n nonce-0)))-    (6 1))-  (strand-map 0 1 2 3 4 5 6)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((recv tpmconf (cat "token" nonce-0))-      (send tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce-0)))-      (send tpmconf-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpmconf-       (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((send tpm-0 (cat "token" nonce))-      (recv tpm-0-        (cat "extend" pcr-id-1 "obtain" (hash pcr-id-1 "obtain" nonce)))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain"))))-    ((send tpmconf (cat "token" nonce-0))-      (recv tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce-0)))-      (load pcr (cat pt-1 "0")) (stor pcr (cat pt-0 (hash "0" n)))))-  (label 49)-  (parent 47)-  (unrealized (0 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 pcr-id-1 nonce nonce-0 text)-    (k aik akey) (pt pt-0 pt-1 pt-2 pval) (tpmconf tpm tpm-0 tpm-1 chan)-    (pcr pcr-0 locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id-0) (nonce nonce-0) (k k)-    (aik aik) (tpm tpmconf) (tpmconf tpmconf))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpmconf))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id-0) (k k)-    (aik aik) (tpm tpm) (pcr pcr))-  (defstrand tpm-extend-enc 4 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (nonce nonce)-    (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 4 (value n) (current-value "0")-    (pcr-id pcr-id-0) (nonce nonce-0) (tpm tpmconf) (pcr pcr))-  (defstrand tpm-quote 3 (nonce (enc v k))-    (current-value (hash (hash "0" n) "refuse")) (pcr-id pcr-id)-    (aik aik) (tpm tpm-1) (pcr pcr-0))-  (precedes ((2 1) (6 1)) ((2 2) (3 0)) ((2 4) (4 0)) ((2 4) (7 0))-    ((3 1) (2 3)) ((4 3) (1 0)) ((5 3) (4 2)) ((6 0) (2 0))-    ((6 3) (5 2)) ((7 2) (0 0)))-  (non-orig aik (invk k))-  (uniq-orig n v nonce nonce-0 k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain")-    (hash (hash "0" n) "refuse"))-  (conf tpmconf)-  (auth tpmconf)-  -  (leads-to ((5 3) (4 2)) ((6 3) (5 2)))-  -  (operation encryption-test (added-strand tpm-quote 3)-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik)-    (0 0))-  (strand-map 0 1 2 3 4 5 6)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((recv tpmconf (cat "token" nonce-0))-      (send tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce-0)))-      (send tpmconf-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpmconf-       (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((send tpm-0 (cat "token" nonce))-      (recv tpm-0-        (cat "extend" pcr-id-1 "obtain" (hash pcr-id-1 "obtain" nonce)))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain"))))-    ((send tpmconf (cat "token" nonce-0))-      (recv tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce-0)))-      (load pcr (cat pt-1 "0")) (stor pcr (cat pt-0 (hash "0" n))))-    ((recv tpm-1 (cat "quote" pcr-id (enc v k)))-      (load pcr-0 (cat pt-2 (hash (hash "0" n) "refuse")))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))))-  (label 50)-  (parent 49)-  (unrealized (7 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-  (vars (n v data)-    (pcr-id pcr-id-0 pcr-id-1 nonce nonce-0 pcr-id-2 nonce-1 text)-    (k aik akey) (pt pt-0 pt-1 pt-2 pt-3 pval)-    (tpmconf tpm tpm-0 tpm-1 tpm-2 chan) (pcr pcr-0 locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id-0) (nonce nonce-0) (k k)-    (aik aik) (tpm tpmconf) (tpmconf tpmconf))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpmconf))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id-0) (k k)-    (aik aik) (tpm tpm) (pcr pcr))-  (defstrand tpm-extend-enc 4 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (nonce nonce)-    (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 4 (value n) (current-value "0")-    (pcr-id pcr-id-0) (nonce nonce-0) (tpm tpmconf) (pcr pcr))-  (defstrand tpm-quote 3 (nonce (enc v k))-    (current-value (hash (hash "0" n) "refuse")) (pcr-id pcr-id)-    (aik aik) (tpm tpm-1) (pcr pcr-0))-  (defstrand tpm-extend-enc 4 (value "refuse")-    (current-value (hash "0" n)) (pcr-id pcr-id-2) (nonce nonce-1)-    (tpm tpm-2) (pcr pcr-0))-  (precedes ((2 1) (6 1)) ((2 2) (3 0)) ((2 4) (4 0)) ((2 4) (7 0))-    ((3 1) (2 3)) ((4 3) (1 0)) ((5 3) (4 2)) ((6 0) (2 0))-    ((6 3) (5 2)) ((7 2) (0 0)) ((8 3) (7 1)))-  (non-orig aik (invk k))-  (uniq-orig n v nonce nonce-0 nonce-1 k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain")-    (hash (hash "0" n) "refuse"))-  (conf tpmconf)-  (auth tpmconf)-  -  (leads-to ((5 3) (4 2)) ((6 3) (5 2)) ((8 3) (7 1)))-  -  (operation channel-test (added-strand tpm-extend-enc 4)-    (ch-msg pcr-0 (cat pt-2 (hash (hash "0" n) "refuse"))) (7 1))-  (strand-map 0 1 2 3 4 5 6 7)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((recv tpmconf (cat "token" nonce-0))-      (send tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce-0)))-      (send tpmconf-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpmconf-       (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((send tpm-0 (cat "token" nonce))-      (recv tpm-0-        (cat "extend" pcr-id-1 "obtain" (hash pcr-id-1 "obtain" nonce)))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain"))))-    ((send tpmconf (cat "token" nonce-0))-      (recv tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce-0)))-      (load pcr (cat pt-1 "0")) (stor pcr (cat pt-0 (hash "0" n))))-    ((recv tpm-1 (cat "quote" pcr-id (enc v k)))-      (load pcr-0 (cat pt-2 (hash (hash "0" n) "refuse")))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((send tpm-2 (cat "token" nonce-1))-      (recv tpm-2-        (cat "extend" pcr-id-2 "refuse"-          (hash pcr-id-2 "refuse" nonce-1)))-      (load pcr-0 (cat pt-3 (hash "0" n)))-      (stor pcr-0 (cat pt-2 (hash (hash "0" n) "refuse")))))-  (label 51)-  (parent 50)-  (unrealized (8 2))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton envelope-  (vars (n v data)-    (pcr-id pcr-id-0 pcr-id-1 nonce nonce-0 pcr-id-2 nonce-1 pcr-id-3-      nonce-2 text) (k aik akey) (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval)-    (tpmconf tpm tpm-0 tpm-1 tpm-2 tpm-3 chan) (pcr pcr-0 locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id-0) (nonce nonce-0) (k k)-    (aik aik) (tpm tpmconf) (tpmconf tpmconf))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpmconf))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id-0) (k k)-    (aik aik) (tpm tpm) (pcr pcr))-  (defstrand tpm-extend-enc 4 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (nonce nonce)-    (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 4 (value n) (current-value "0")-    (pcr-id pcr-id-0) (nonce nonce-0) (tpm tpmconf) (pcr pcr))-  (defstrand tpm-quote 3 (nonce (enc v k))-    (current-value (hash (hash "0" n) "refuse")) (pcr-id pcr-id)-    (aik aik) (tpm tpm-1) (pcr pcr-0))-  (defstrand tpm-extend-enc 4 (value "refuse")-    (current-value (hash "0" n)) (pcr-id pcr-id-2) (nonce nonce-1)-    (tpm tpm-2) (pcr pcr-0))-  (defstrand tpm-extend-enc 4 (value n) (current-value "0")-    (pcr-id pcr-id-3) (nonce nonce-2) (tpm tpm-3) (pcr pcr-0))-  (precedes ((2 1) (6 1)) ((2 1) (9 1)) ((2 2) (3 0)) ((2 4) (4 0))-    ((2 4) (7 0)) ((3 1) (2 3)) ((4 3) (1 0)) ((5 3) (4 2))-    ((6 0) (2 0)) ((6 3) (5 2)) ((7 2) (0 0)) ((8 3) (7 1))-    ((9 3) (8 2)))-  (non-orig aik (invk k))-  (uniq-orig n v nonce nonce-0 nonce-1 nonce-2 k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain")-    (hash (hash "0" n) "refuse"))-  (conf tpmconf)-  (auth tpmconf)-  -  (leads-to ((5 3) (4 2)) ((6 3) (5 2)) ((8 3) (7 1)) ((9 3) (8 2)))-  -  (operation channel-test (added-strand tpm-extend-enc 4)-    (ch-msg pcr-0 (cat pt-3 (hash "0" n))) (8 2))-  (strand-map 0 1 2 3 4 5 6 7 8)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((recv tpmconf (cat "token" nonce-0))-      (send tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce-0)))-      (send tpmconf-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpmconf-       (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((send tpm-0 (cat "token" nonce))-      (recv tpm-0-        (cat "extend" pcr-id-1 "obtain" (hash pcr-id-1 "obtain" nonce)))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain"))))-    ((send tpmconf (cat "token" nonce-0))-      (recv tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce-0)))-      (load pcr (cat pt-1 "0")) (stor pcr (cat pt-0 (hash "0" n))))-    ((recv tpm-1 (cat "quote" pcr-id (enc v k)))-      (load pcr-0 (cat pt-2 (hash (hash "0" n) "refuse")))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((send tpm-2 (cat "token" nonce-1))-      (recv tpm-2-        (cat "extend" pcr-id-2 "refuse"-          (hash pcr-id-2 "refuse" nonce-1)))-      (load pcr-0 (cat pt-3 (hash "0" n)))-      (stor pcr-0 (cat pt-2 (hash (hash "0" n) "refuse"))))-    ((send tpm-3 (cat "token" nonce-2))-      (recv tpm-3 (cat "extend" pcr-id-3 n (hash pcr-id-3 n nonce-2)))-      (load pcr-0 (cat pt-4 "0")) (stor pcr-0 (cat pt-3 (hash "0" n)))))-  (label 52)-  (parent 51)-  (unrealized (9 1))-  (dead)-  (comment "empty cohort"))--(comment "Nothing left to do")
− tst/defact-sync_locn_envelope_shapes.tst 
@@ -1,731 +0,0 @@-(comment "CPSA 4.4.5")-(comment "Extracted shapes")--(herald "Envelope Protocol, location-based version" (check-nonces)-  (bound 30) (limit 6000))--(comment "CPSA 4.4.5")--(comment "All input read from tst/sync_locn_envelope.scm")--(comment "Step count limited to 6000")--(comment "Strand count bounded at 30")--(comment "Nonces checked first")--(defprotocol envelope basic-  (defrole tpm-power-on-    (vars (current-value mesg) (pcr locn) (tpm chan))-    (trace (recv tpm "power on") (load pcr current-value)-      (stor pcr "0")))-  (defrole tpm-extend-enc-    (vars (value current-value mesg) (pcr-id nonce text) (pcr locn)-      (tpm chan))-    (trace (send tpm (cat "token" nonce))-      (recv tpm (cat "extend" pcr-id value (hash pcr-id value nonce)))-      (load pcr current-value) (stor pcr (hash current-value value))-      (send "ext ok"))-    (uniq-orig nonce))-  (defrole tpm-quote-    (vars (nonce current-value mesg) (pcr-id text) (aik akey) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "quote" pcr-id nonce))-      (load pcr current-value)-      (send (enc "quote" pcr-id current-value nonce aik))))-  (defrole tpm-create-key-    (vars (k aik akey) (pcr-id text) (pcrval mesg) (tpm chan))-    (trace (recv tpm (cat "create-req" pcr-id pcrval))-      (send (enc "created" k pcr-id pcrval aik)))-    (non-orig (invk k))-    (uniq-orig k)-    (auth tpm))-  (defrole tpm-decrypt-    (vars (m current-value mesg) (pcr-id text) (k aik akey) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "decrypt" (enc m k)))-      (recv (enc "created" k pcr-id current-value aik))-      (load pcr current-value) (send m))-    (non-orig aik))-  (defrole alice-    (vars (n v data) (pcr-id nonce text) (k aik akey)-      (tpm tpmconf chan))-    (trace (recv tpm (cat "token" nonce))-      (send tpmconf (cat "extend" pcr-id n (hash pcr-id n nonce)))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    (non-orig aik)-    (uniq-orig n v)-    (conf tpmconf)-    (neq (k aik)))-  (defrule genStV-if-hashed-tpm-power-on-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-power-on" z (idx 2))-          (p "tpm-power-on" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-extend-enc-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-extend-enc" z (idx 3))-          (p "tpm-extend-enc" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-decrypt-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-decrypt" z (idx 3))-          (p "tpm-decrypt" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-quote-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-quote" z (idx 2))-          (p "tpm-quote" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule shearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule invShearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule trRl_tpm-power-on-at-2-    (forall ((z strd))-      (implies (p "tpm-power-on" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_tpm-power-on-at-1-    (forall ((z strd))-      (implies (p "tpm-power-on" z (idx 3)) (trans z (idx 1)))))-  (defgenrule trRl_tpm-extend-enc-at-3-    (forall ((z strd))-      (implies (p "tpm-extend-enc" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_tpm-extend-enc-at-2-    (forall ((z strd))-      (implies (p "tpm-extend-enc" z (idx 4)) (trans z (idx 2))))))--(defskeleton envelope-  (vars (v n data) (pcr-id nonce text) (k aik akey) (tpm tpmconf chan))-  (deflistener v)-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id) (nonce nonce) (k k)-    (aik aik) (tpm tpm) (tpmconf tpmconf))-  (non-orig aik)-  (uniq-orig v n)-  (conf tpmconf)-  (traces ((recv v) (send v))-    ((recv tpm (cat "token" nonce))-      (send tpmconf (cat "extend" pcr-id n (hash pcr-id n nonce)))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k))))-  (label 0)-  (unrealized (0 0) (1 3))-  (preskeleton)-  (origs (v (1 4)) (n (1 1)))-  (comment "Not a skeleton"))--(defskeleton envelope-  (vars (v n data) (pcr-id pcr-id-0 nonce nonce-0 text) (k aik akey)-    (pt pt-0 pt-1 pval) (tpmconf tpm tpm-0 chan) (pcr locn))-  (deflistener v)-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id) (nonce nonce-0) (k k)-    (aik aik) (tpm tpmconf) (tpmconf tpmconf))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id) (k k) (aik aik) (tpm tpmconf))-  (defstrand tpm-decrypt 4 (m v)-    (current-value (hash (hash "0" n) "obtain")) (pcr-id pcr-id) (k k)-    (aik aik) (tpm tpm) (pcr pcr))-  (defstrand tpm-extend-enc 4 (value "obtain")-    (current-value (hash "0" n)) (pcr-id pcr-id-0) (nonce nonce)-    (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 4 (value n) (current-value "0")-    (pcr-id pcr-id) (nonce nonce-0) (tpm tpmconf) (pcr pcr))-  (precedes ((1 1) (5 1)) ((1 2) (2 0)) ((1 4) (3 0)) ((2 1) (1 3))-    ((3 3) (0 0)) ((4 3) (3 2)) ((5 0) (1 0)) ((5 3) (4 2)))-  (non-orig aik (invk k))-  (uniq-orig v n nonce nonce-0 k)-  (gen-st (hash "0" n) (hash (hash "0" n) "obtain"))-  (conf tpmconf)-  (auth tpmconf)-  (leads-to ((4 3) (3 2)) ((5 3) (4 2)))-  (operation channel-test (displaced 6 1 alice 2)-    (ch-msg tpm-1 (cat "extend" pcr-id-1 n (hash pcr-id-1 n nonce-0)))-    (5 1))-  (strand-map 0 1 2 3 4 5)-  (traces ((recv v) (send v))-    ((recv tpmconf (cat "token" nonce-0))-      (send tpmconf (cat "extend" pcr-id n (hash pcr-id n nonce-0)))-      (send tpmconf-        (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpmconf-       (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (send (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik)))-    ((recv tpm (cat "decrypt" (enc v k)))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (load pcr (cat pt (hash (hash "0" n) "obtain"))) (send v))-    ((send tpm-0 (cat "token" nonce))-      (recv tpm-0-        (cat "extend" pcr-id-0 "obtain" (hash pcr-id-0 "obtain" nonce)))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "obtain"))))-    ((send tpmconf (cat "token" nonce-0))-      (recv tpmconf (cat "extend" pcr-id n (hash pcr-id n nonce-0)))-      (load pcr (cat pt-1 "0")) (stor pcr (cat pt-0 (hash "0" n)))))-  (label 11)-  (parent 0)-  (realized)-  (shape)-  (maps-    ((0 1)-      ((v v) (n n) (pcr-id pcr-id) (nonce nonce-0) (k k) (aik aik)-        (tpm tpmconf) (tpmconf tpmconf))))-  (origs (n (1 1)) (nonce-0 (5 0)) (pt-0 (5 3)) (nonce (4 0)) (pt (4 3))-    (k (2 1)) (v (1 4))))--(comment "Nothing left to do")--(defprotocol envelope basic-  (defrole tpm-power-on-    (vars (current-value mesg) (pcr locn) (tpm chan))-    (trace (recv tpm "power on") (load pcr current-value)-      (stor pcr "0")))-  (defrole tpm-extend-enc-    (vars (value current-value mesg) (pcr-id nonce text) (pcr locn)-      (tpm chan))-    (trace (send tpm (cat "token" nonce))-      (recv tpm (cat "extend" pcr-id value (hash pcr-id value nonce)))-      (load pcr current-value) (stor pcr (hash current-value value))-      (send "ext ok"))-    (uniq-orig nonce))-  (defrole tpm-quote-    (vars (nonce current-value mesg) (pcr-id text) (aik akey) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "quote" pcr-id nonce))-      (load pcr current-value)-      (send (enc "quote" pcr-id current-value nonce aik))))-  (defrole tpm-create-key-    (vars (k aik akey) (pcr-id text) (pcrval mesg) (tpm chan))-    (trace (recv tpm (cat "create-req" pcr-id pcrval))-      (send (enc "created" k pcr-id pcrval aik)))-    (non-orig (invk k))-    (uniq-orig k)-    (auth tpm))-  (defrole tpm-decrypt-    (vars (m current-value mesg) (pcr-id text) (k aik akey) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "decrypt" (enc m k)))-      (recv (enc "created" k pcr-id current-value aik))-      (load pcr current-value) (send m))-    (non-orig aik))-  (defrole alice-    (vars (n v data) (pcr-id nonce text) (k aik akey)-      (tpm tpmconf chan))-    (trace (recv tpm (cat "token" nonce))-      (send tpmconf (cat "extend" pcr-id n (hash pcr-id n nonce)))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    (non-orig aik)-    (uniq-orig n v)-    (conf tpmconf)-    (neq (k aik)))-  (defrule genStV-if-hashed-tpm-power-on-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-power-on" z (idx 2))-          (p "tpm-power-on" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-extend-enc-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-extend-enc" z (idx 3))-          (p "tpm-extend-enc" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-decrypt-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-decrypt" z (idx 3))-          (p "tpm-decrypt" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-quote-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-quote" z (idx 2))-          (p "tpm-quote" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule shearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule invShearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule trRl_tpm-power-on-at-2-    (forall ((z strd))-      (implies (p "tpm-power-on" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_tpm-power-on-at-1-    (forall ((z strd))-      (implies (p "tpm-power-on" z (idx 3)) (trans z (idx 1)))))-  (defgenrule trRl_tpm-extend-enc-at-3-    (forall ((z strd))-      (implies (p "tpm-extend-enc" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_tpm-extend-enc-at-2-    (forall ((z strd))-      (implies (p "tpm-extend-enc" z (idx 4)) (trans z (idx 2))))))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 nonce text) (k aik akey)-    (tpm tpmconf chan))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id-0) (nonce nonce) (k k)-    (aik aik) (tpm tpm) (tpmconf tpmconf))-  (non-orig aik)-  (uniq-orig n v)-  (conf tpmconf)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((recv tpm (cat "token" nonce))-      (send tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce)))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k))))-  (label 12)-  (unrealized (0 0) (1 3))-  (preskeleton)-  (origs (v (1 4)) (n (1 1)))-  (comment "Not a skeleton"))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 pcr-id-1 nonce nonce-0 text)-    (k aik akey) (pt pt-0 pt-1 pval) (tpmconf tpm tpm-0 chan)-    (pcr locn))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id-0) (nonce nonce-0) (k k)-    (aik aik) (tpm tpmconf) (tpmconf tpmconf))-  (defstrand tpm-create-key 2 (pcrval (hash (hash "0" n) "obtain"))-    (pcr-id pcr-id-0) (k k) (aik aik) (tpm tpmconf))-  (defstrand tpm-quote 3 (nonce (enc v k))-    (current-value (hash (hash "0" n) "refuse")) (pcr-id pcr-id)-    (aik aik) (tpm tpm) (pcr pcr))-  (defstrand tpm-extend-enc 4 (value "refuse")-    (current-value (hash "0" n)) (pcr-id pcr-id-1) (nonce nonce)-    (tpm tpm-0) (pcr pcr))-  (defstrand tpm-extend-enc 4 (value n) (current-value "0")-    (pcr-id pcr-id-0) (nonce nonce-0) (tpm tpmconf) (pcr pcr))-  (precedes ((1 1) (5 1)) ((1 2) (2 0)) ((1 4) (3 0)) ((2 1) (1 3))-    ((3 2) (0 0)) ((4 3) (3 1)) ((5 0) (1 0)) ((5 3) (4 2)))-  (non-orig aik (invk k))-  (uniq-orig n v nonce nonce-0 k)-  (gen-st (hash "0" n) (hash (hash "0" n) "refuse"))-  (conf tpmconf)-  (auth tpmconf)-  (leads-to ((4 3) (3 1)) ((5 3) (4 2)))-  (operation channel-test (displaced 6 1 alice 2)-    (ch-msg tpm-1 (cat "extend" pcr-id-2 n (hash pcr-id-2 n nonce-0)))-    (5 1))-  (strand-map 0 1 2 3 4 5)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((recv tpmconf (cat "token" nonce-0))-      (send tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce-0)))-      (send tpmconf-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    ((recv tpmconf-       (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (send-        (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik)))-    ((recv tpm (cat "quote" pcr-id (enc v k)))-      (load pcr (cat pt (hash (hash "0" n) "refuse")))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik)))-    ((send tpm-0 (cat "token" nonce))-      (recv tpm-0-        (cat "extend" pcr-id-1 "refuse" (hash pcr-id-1 "refuse" nonce)))-      (load pcr (cat pt-0 (hash "0" n)))-      (stor pcr (cat pt (hash (hash "0" n) "refuse"))))-    ((send tpmconf (cat "token" nonce-0))-      (recv tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce-0)))-      (load pcr (cat pt-1 "0")) (stor pcr (cat pt-0 (hash "0" n)))))-  (label 22)-  (parent 12)-  (realized)-  (shape)-  (maps-    ((0 1)-      ((n n) (v v) (k k) (aik aik) (pcr-id pcr-id) (pcr-id-0 pcr-id-0)-        (nonce nonce-0) (tpm tpmconf) (tpmconf tpmconf))))-  (origs (n (1 1)) (nonce-0 (5 0)) (pt-0 (5 3)) (nonce (4 0)) (pt (4 3))-    (k (2 1)) (v (1 4))))--(comment "Nothing left to do")--(defprotocol envelope basic-  (defrole tpm-power-on-    (vars (current-value mesg) (pcr locn) (tpm chan))-    (trace (recv tpm "power on") (load pcr current-value)-      (stor pcr "0")))-  (defrole tpm-extend-enc-    (vars (value current-value mesg) (pcr-id nonce text) (pcr locn)-      (tpm chan))-    (trace (send tpm (cat "token" nonce))-      (recv tpm (cat "extend" pcr-id value (hash pcr-id value nonce)))-      (load pcr current-value) (stor pcr (hash current-value value))-      (send "ext ok"))-    (uniq-orig nonce))-  (defrole tpm-quote-    (vars (nonce current-value mesg) (pcr-id text) (aik akey) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "quote" pcr-id nonce))-      (load pcr current-value)-      (send (enc "quote" pcr-id current-value nonce aik))))-  (defrole tpm-create-key-    (vars (k aik akey) (pcr-id text) (pcrval mesg) (tpm chan))-    (trace (recv tpm (cat "create-req" pcr-id pcrval))-      (send (enc "created" k pcr-id pcrval aik)))-    (non-orig (invk k))-    (uniq-orig k)-    (auth tpm))-  (defrole tpm-decrypt-    (vars (m current-value mesg) (pcr-id text) (k aik akey) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "decrypt" (enc m k)))-      (recv (enc "created" k pcr-id current-value aik))-      (load pcr current-value) (send m))-    (non-orig aik))-  (defrole alice-    (vars (n v data) (pcr-id nonce text) (k aik akey)-      (tpm tpmconf chan))-    (trace (recv tpm (cat "token" nonce))-      (send tpmconf (cat "extend" pcr-id n (hash pcr-id n nonce)))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    (non-orig aik)-    (uniq-orig n v)-    (conf tpmconf)-    (neq (k aik)))-  (defrule genStV-if-hashed-tpm-power-on-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-power-on" z (idx 2))-          (p "tpm-power-on" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-extend-enc-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-extend-enc" z (idx 3))-          (p "tpm-extend-enc" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-decrypt-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-decrypt" z (idx 3))-          (p "tpm-decrypt" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-quote-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-quote" z (idx 2))-          (p "tpm-quote" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule shearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule invShearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule trRl_tpm-power-on-at-2-    (forall ((z strd))-      (implies (p "tpm-power-on" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_tpm-power-on-at-1-    (forall ((z strd))-      (implies (p "tpm-power-on" z (idx 3)) (trans z (idx 1)))))-  (defgenrule trRl_tpm-extend-enc-at-3-    (forall ((z strd))-      (implies (p "tpm-extend-enc" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_tpm-extend-enc-at-2-    (forall ((z strd))-      (implies (p "tpm-extend-enc" z (idx 4)) (trans z (idx 2))))))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 nonce text) (k aik akey)-    (tpm tpmconf chan))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id-0) (nonce nonce) (k k)-    (aik aik) (tpm tpm) (tpmconf tpmconf))-  (non-orig aik)-  (uniq-orig n v)-  (conf tpmconf)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((recv tpm (cat "token" nonce))-      (send tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce)))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k))))-  (label 23)-  (unrealized (0 0) (1 0) (2 3))-  (preskeleton)-  (origs (v (2 4)) (n (2 1)))-  (comment "Not a skeleton"))--(comment "Nothing left to do")--(defprotocol envelope basic-  (defrole tpm-power-on-    (vars (current-value mesg) (pcr locn) (tpm chan))-    (trace (recv tpm "power on") (load pcr current-value)-      (stor pcr "0")))-  (defrole tpm-extend-enc-    (vars (value current-value mesg) (pcr-id nonce text) (pcr locn)-      (tpm chan))-    (trace (send tpm (cat "token" nonce))-      (recv tpm (cat "extend" pcr-id value (hash pcr-id value nonce)))-      (load pcr current-value) (stor pcr (hash current-value value))-      (send "ext ok"))-    (uniq-orig nonce))-  (defrole tpm-quote-    (vars (nonce current-value mesg) (pcr-id text) (aik akey) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "quote" pcr-id nonce))-      (load pcr current-value)-      (send (enc "quote" pcr-id current-value nonce aik))))-  (defrole tpm-create-key-    (vars (k aik akey) (pcr-id text) (pcrval mesg) (tpm chan))-    (trace (recv tpm (cat "create-req" pcr-id pcrval))-      (send (enc "created" k pcr-id pcrval aik)))-    (non-orig (invk k))-    (uniq-orig k)-    (auth tpm))-  (defrole tpm-decrypt-    (vars (m current-value mesg) (pcr-id text) (k aik akey) (pcr locn)-      (tpm chan))-    (trace (recv tpm (cat "decrypt" (enc m k)))-      (recv (enc "created" k pcr-id current-value aik))-      (load pcr current-value) (send m))-    (non-orig aik))-  (defrole alice-    (vars (n v data) (pcr-id nonce text) (k aik akey)-      (tpm tpmconf chan))-    (trace (recv tpm (cat "token" nonce))-      (send tpmconf (cat "extend" pcr-id n (hash pcr-id n nonce)))-      (send tpm (cat "create-req" pcr-id (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id (hash (hash "0" n) "obtain") aik))-      (send (enc v k)))-    (non-orig aik)-    (uniq-orig n v)-    (conf tpmconf)-    (neq (k aik)))-  (defrule genStV-if-hashed-tpm-power-on-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-power-on" z (idx 2))-          (p "tpm-power-on" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-extend-enc-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-extend-enc" z (idx 3))-          (p "tpm-extend-enc" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-decrypt-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-decrypt" z (idx 3))-          (p "tpm-decrypt" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defrule genStV-if-hashed-tpm-quote-    (forall ((z strd) (v1 v2 mesg))-      (implies-        (and (p "tpm-quote" z (idx 2))-          (p "tpm-quote" "current-value" z (hash v1 v2)))-        (gen-st (hash v1 v2)))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule shearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule invShearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule trRl_tpm-power-on-at-2-    (forall ((z strd))-      (implies (p "tpm-power-on" z (idx 3)) (trans z (idx 2)))))-  (defgenrule trRl_tpm-power-on-at-1-    (forall ((z strd))-      (implies (p "tpm-power-on" z (idx 3)) (trans z (idx 1)))))-  (defgenrule trRl_tpm-extend-enc-at-3-    (forall ((z strd))-      (implies (p "tpm-extend-enc" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_tpm-extend-enc-at-2-    (forall ((z strd))-      (implies (p "tpm-extend-enc" z (idx 4)) (trans z (idx 2))))))--(defskeleton envelope-  (vars (n v data) (pcr-id pcr-id-0 nonce text) (k aik akey)-    (tpm tpmconf chan))-  (deflistener-    (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-  (deflistener v)-  (defstrand alice 5 (n n) (v v) (pcr-id pcr-id-0) (nonce nonce) (k k)-    (aik aik) (tpm tpm) (tpmconf tpmconf))-  (non-orig aik)-  (uniq-orig n v)-  (conf tpmconf)-  (traces-    ((recv-       (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k) aik))-      (send-        (enc "quote" pcr-id (hash (hash "0" n) "refuse") (enc v k)-          aik))) ((recv v) (send v))-    ((recv tpm (cat "token" nonce))-      (send tpmconf (cat "extend" pcr-id-0 n (hash pcr-id-0 n nonce)))-      (send tpm-        (cat "create-req" pcr-id-0 (hash (hash "0" n) "obtain")))-      (recv (enc "created" k pcr-id-0 (hash (hash "0" n) "obtain") aik))-      (send (enc v k))))-  (label 38)-  (unrealized (0 0) (1 0) (2 3))-  (preskeleton)-  (origs (v (2 4)) (n (2 1)))-  (comment "Not a skeleton"))--(comment "Nothing left to do")
tst/denning-sacco.tst view
@@ -1,6 +1,6 @@ (herald "Denning-Sacco Protocol") -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/denning-sacco.scm")  (defprotocol denning-sacco basic
tst/deorig_contract.tst view
@@ -1,4 +1,4 @@-(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/deorig_contract.scm")  (defprotocol deorig-contract basic
tst/deorig_mesg.tst view
@@ -1,6 +1,6 @@ (herald deorig-mesg) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/deorig_mesg.scm")  (defprotocol deorig-mesg basic
tst/deorig_simple.tst view
@@ -1,6 +1,6 @@ (herald deorig-simple) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/deorig_simple.scm")  (defprotocol deorig-simple basic
tst/dh-ca_hack.tst view
@@ -1,6 +1,6 @@ (herald dhca (algebra basic) (bound 12)) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/dh-ca_hack.scm")  (defprotocol dhca basic
tst/dh_encrypt_hack.tst view
@@ -1,6 +1,6 @@ (herald dhencrypt (algebra basic)) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/dh_encrypt_hack.scm")  (defprotocol dhencrypt basic
tst/dh_group_sig.tst view
@@ -1,7 +1,7 @@ (herald "Signed group DH exchange (improved version)"   (algebra diffie-hellman) (limit 100)) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/dh_group_sig.scm") (comment "Step count limited to 100")
tst/dh_group_sig_auth_failure.tst view
@@ -1,7 +1,7 @@ (herald "Signed group DH exchange (version with auth failure)"   (algebra diffie-hellman) (limit 100)) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/dh_group_sig_auth_failure.scm") (comment "Step count limited to 100")
− tst/dh_mim.lisp 
@@ -1,65 +0,0 @@-(defprotocol dh_mim reduced-diffie-hellman-  (defrole init-    (vars (x expn) (hy base) (n text))-    (trace (send (gen x)) (recv hy) (send (enc n (exp hy x))))-    (uniq-orig n x))-  (defrole resp-    (vars (y expn) (hx base) (n text))-    (trace (recv hx) (send (gen y)) (recv (enc n (exp hx y))))-    (uniq-orig y))-  (comment "Diffie-hellman key exchange followed by an encryption"))--(defskeleton dh_mim-  (vars (n text) (hx hy base) (x y expn))-  (defstrand init 3 (n n) (hy hy) (x x))-  (defstrand resp 3 (n n) (hx hx) (y y))-  (precedes ((0 2) (1 2)))-  (uniq-orig n x y)-  (comment "Agreement on the encrypted text only"))--(defprotocol dh_mim reduced-diffie-hellman-with-penetrator-  (defrole init-    (vars (x expn) (hy base) (n text))-    (trace (send (gen x)) (recv hy) (send (enc n (exp hy x))))-    (uniq-orig n x))-  (defrole resp-    (vars (y expn) (hx base) (n text))-    (trace (recv hx) (send (gen y)) (recv (enc n (exp hx y))))-    (uniq-orig y))-  (defrole pen-exp-    (vars (x expn) (h base))-    (trace (recv x) (recv h) (send (exp h x))))-  (defrole pen-make-    (vars (x expn))-    (trace (send x)))-  (defrole pen-gen-    (vars (x expn))-    (trace (recv x) (send (gen x))))-  (defrole pen-dec-    (vars (x mesg) (h base))-    (trace (recv (enc x h)) (recv h) (send x)))-  (defrole pen-enc-    (vars (x mesg) (h base))-    (trace (recv x) (recv h) (send (enc x h)))))--(defskeleton dh_mim-  (vars (n text) (hx hy base) (x y expn))-  (defstrand init 3 (n n) (hy (gen v)) (x x))-  (defstrand resp 3 (n n) (hx (gen u)) (y y))-  (defstrand pen-make 1 (x u))-  (defstrand pen-make 1 (x v))-  (defstrand pen-gen 2 (x u))-  (defstrand pen-gen 2 (x v))-  (defstrand pen-exp 3 (x v) (h (gen x)))-  (defstrand pen-dec 3 (x n) (h (exp (gen x) v)))-  (defstrand pen-exp 3 (x u) (h (gen y)))-  (defstrand pen-enc 3 (x n) (h (exp (gen y) u)))-  (precedes ((2 0) (4 0)) ((3 0) (5 0))-	    ((4 1) (1 0)) ((5 1) (0 1))-	    ((0 0) (6 1)) ((3 0) (6 0))-	    ((0 2) (7 0)) ((6 2) (7 1))-	    ((7 2) (9 0)) ((9 2) (1 2))-	    ((1 1) (8 1)) ((9 1) (8 2))-	    ((2 0) (8 0)))-  (uniq-orig n x y)-  (comment "Bundle"))
tst/dh_mim_hack.tst view
@@ -1,4 +1,4 @@-(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/dh_mim_hack.scm")  (defprotocol dh_mim basic
− tst/dhke2.lisp 
@@ -1,108 +0,0 @@-(herald "Diffie-Hellman Key Exchange" (algebra diffie-hellman2))--;; The Diffie-Hellman problem is given (exp (gen) x), and (exp (gen)-;; y), compute the value of (exp (exp (gen) x) y) which is also (exp-;; (exp (gen) y) x).--(defprotocol dhke diffie-hellman2-  (defrole init (vars (a b name) (x expn) (h base))-    (trace-     (send (enc "i" (exp (gen) x) (privk a)))-     (recv (cat (enc h (privk b)) (enc a b (exp h x))))-     (send (enc "i" a b (exp h x))))-    (uniq-orig  (exp (gen) x)))-  (defrole resp (vars (a b name) (y expn) (h base))-    (trace-     (recv (enc "i" h (privk a)))-     (send (cat (enc (exp (gen) y) (privk b)) (enc a b (exp h y))))-     (recv (enc "i" a b (exp h y))))-    (uniq-orig (exp (gen) y))))--(defskeleton dhke (vars (a b name) (y expn) (h base))-  (defstrand resp 3 (a a) (b b) (y y) (h h))-  (non-orig (privk a) (privk b))-  (pen-non-orig (exp h y)))-- (defskeleton dhke (vars (a b name))-   (defstrand init 2 (a a) (b b))-   (non-orig (privk a) (privk b)))--(defprotocol dh-mim diffie-hellman2-  (defrole init-    (vars (x expn) (h base) (n text))-    (trace-     (send (exp (gen) x))-     (recv h)-     (send (enc n (exp h x))))-    (uniq-orig n (exp (gen) x)))-  (defrole resp-    (vars (y expn) (h base) (n text))-    (trace-     (recv h)-     (send (exp (gen) y))-     (recv (enc n (exp h y))))-    (uniq-orig (exp (gen) y)))-  (comment "Diffie-Hellman without signatures"-	   "has a man-in-the-middle attack"))--(defskeleton dh-mim-  (vars (n text))-  (defstrand init 3 (n n))-  (deflistener n)-  (uniq-orig n))--;; Protocols using variables of sort base--(comment-(defprotocol dhke-with-base-vars diffie-hellman-  (defrole init (vars (a b name) (g base) (x expn))-    (trace-     (send (enc "i" (exp (gen) x) (privk a)))-     (recv (cat (enc g (privk b)) (enc a b (exp g x))))-     (send (enc "i" a b (exp g x))))-    (uniq-orig  x))-  (defrole resp (vars (a b name) (h base) (y expn))-    (trace-     (recv (enc "i" h (privk a)))-     (send (cat (enc (exp (gen) y) (privk b)) (enc a b (exp h y))))-     (recv (enc "i" a b (exp h y))))-    (uniq-orig y)))--(defskeleton dhke-with-base-vars (vars (a b name))-  (defstrand resp 3 (a a) (b b))-  (non-orig (privk a) (privk b)))-- (defskeleton dhke-with-base-vars (vars (a b name))-   (defstrand init 2 (a a) (b b))-   (non-orig (privk a) (privk b)))--(defprotocol dh-mim-with-base-vars diffie-hellman-  (defrole init-    (vars (x expn) (hy base) (n text))-    (trace-     (send (exp (gen) x))-     (recv hy)-     (send (enc n (exp hy x))))-    (uniq-orig n x))-  (defrole resp-    (vars (y expn) (hx base) (n text))-    (trace-     (recv hx)-     (send (exp (gen) y))-     (recv (enc n (exp hx y))))-    (uniq-orig y))-  (comment "Diffie-Hellman without signatures"-	   "has a man-in-the-middle attack"))--(defskeleton dh-mim-with-base-vars-  (vars (n text))-  (defstrand init 3 (n n))-  (defstrand resp 3 (n n))-  (uniq-orig n))--(defskeleton dh-mim-with-base-vars-  (vars (n text))-  (defstrand init 3 (n n))-  (deflistener n)-  (uniq-orig n))-)
tst/dhnsl_hack.tst view
@@ -1,7 +1,7 @@ (herald "Diffie-Hellman enhanced Needham-Schroeder-Lowe Protocol"   (algebra basic)) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/dhnsl_hack.scm")  (defprotocol dhnsl basic
tst/dhstatic-state.tst view
@@ -1,6 +1,6 @@ (herald dhstatic-state (algebra diffie-hellman) (bound 16)) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/dhstatic-state.scm") (comment "Strand count bounded at 16")
tst/disclosure.tst view
@@ -1,6 +1,6 @@ (herald disclosure) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/disclosure.scm")  (defprotocol disc basic
tst/doorsep.tst view
@@ -1,6 +1,6 @@ (herald doorsep (comment "Door Simple Example Protocol")) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/doorsep.scm")  (defprotocol doorsep basic
tst/doorsep2invk.tst view
@@ -1,6 +1,6 @@ (herald doorsep2invk (comment "Door Simple Example Protocol")) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/doorsep2invk.scm")  (defprotocol doorsep basic
− tst/ds-short.lisp 
@@ -1,33 +0,0 @@-;;; This is something like the Denning Sacco protocol with-;;; public keys as described by Clark and Jacob, but without-;;; timestamps.  Since the whole point of the protocol was to-;;; show how timestamps could be used, this is a funny thing to do!--(defprotocol denning-sacco-with-pk basic-  (defrole init ; A-    (vars (a name) (b name) (ks name) (k skey))-    (trace (send (cat a b))-	   (recv (cat (enc (cat b (pubk b)) (privk ks)) ; certB-		      (enc (cat a (pubk a)) (privk ks)))) ; cert A-	   (send (cat (enc (enc k (privk a)) (pubk b)) ; sign & encr k-		      (enc (cat b (pubk b)) (privk ks))-		      (enc (cat a  (pubk a)) (privk ks))))))-  (defrole resp ; B-    (vars (a name) (b name) (ks name) (k skey))-    (trace (recv (cat (enc (enc k (privk a)) (pubk b))-		      (enc (cat b (pubk b)) (privk ks))-		      (enc (cat a (pubk a)) (privk ks))))))-  (defrole keyserver-    (vars (a name) (b name) (ks name))-    (trace (recv (cat a b))-	   (send (cat (enc (cat b (pubk b)) (privk ks))-		      (enc (cat a (pubk a)) (privk ks)))))))--;;; For the preskeleton, I'd like to require every initiator and-;;; respondent to use the same ks.  How can that be done?--(defskeleton denning-sacco-with-pk-  (vars (a name) (b name) (ks name) (k skey))-  (defstrand resp 1 (a a) (b b) (ks ks) (k k))-  (non-orig (privk b) (privk a) (privk ks))-  (uniq-orig k))
tst/dy.tst view

file too large to diff

tst/encsig.tst view
@@ -1,7 +1,7 @@ (herald "Encrypted Signed Message Example"   (comment "Shows examples of key usage of asymmetric keys")) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/encsig.scm")  (defprotocol mult-keys-enc-sig basic
tst/envelope.tst view
@@ -1,6 +1,6 @@ (herald "Envelope Protocol" (bound 15)) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/envelope.scm") (comment "Strand count bounded at 15")
tst/epmo-hash.tst view
@@ -1,7 +1,7 @@ (herald "Electronic Purchase with Money Order Protocol with Key Hashing"   (comment "Annotated with trust management formulas")) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/epmo-hash.scm")  (defprotocol epmo basic
tst/epmo-key-hash.tst view
@@ -1,7 +1,7 @@ (herald "Electronic Purchase with Money Order Protocol with Key Hashing"   (comment "Annotated with trust management formulas")) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/epmo-key-hash.scm")  (defprotocol epmo basic
tst/epmo.tst view
@@ -1,7 +1,7 @@ (herald "Electronic Purchase with Money Order Protocol"   (comment "Annotated with trust management formulas")) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/epmo.scm")  (defprotocol epmo basic
tst/epmo_acctnum-key-hash.tst view
@@ -2,7 +2,7 @@   "Electronic Purchase with Money Order Protocol Variant with Key Hashing"   (comment "This version includes account numbers in exchanges")) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/epmo_acctnum-key-hash.scm")  (defprotocol epmo_acctnum basic
tst/epmo_acctnum.tst view
@@ -2,7 +2,7 @@   (bound 12) (limit 5000)   (comment "This version includes account numbers in exchanges")) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/epmo_acctnum.lsp") (comment "Step count limited to 5000")
− tst/example.tst 
@@ -1,367 +0,0 @@-(herald example)--(comment "CPSA 4.4.4")-(comment "All input read from tst/example.scm")--(defprotocol version-1 basic-  (defrole init-    (vars (a b name) (m text) (s skey))-    (trace (send (enc s (ltk a b))) (recv (enc m a s))))-  (defrole resp-    (vars (a b name) (m text) (s skey))-    (trace (recv (enc s (ltk a b))) (send (enc m a s))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false)))))--(defskeleton version-1-  (vars (s skey) (m text) (a b name))-  (defstrand init 2 (s s) (m m) (a a) (b b))-  (non-orig (ltk a b))-  (uniq-orig s)-  (traces ((send (enc s (ltk a b))) (recv (enc m a s))))-  (label 0)-  (unrealized (0 1))-  (origs (s (0 0)))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton version-1-  (vars (s skey) (m text) (a b b-0 name))-  (defstrand init 2 (s s) (m m) (a a) (b b))-  (defstrand resp 2 (s s) (m m) (a a) (b b-0))-  (precedes ((0 0) (1 0)) ((1 1) (0 1)))-  (non-orig (ltk a b))-  (uniq-orig s)-  (operation encryption-test (added-strand resp 2) (enc m a s) (0 1))-  (strand-map 0)-  (traces ((send (enc s (ltk a b))) (recv (enc m a s)))-    ((recv (enc s (ltk a b-0))) (send (enc m a s))))-  (label 1)-  (parent 0)-  (unrealized (1 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton version-1-  (vars (s skey) (m text) (a b name))-  (defstrand init 2 (s s) (m m) (a a) (b b))-  (deflistener s)-  (precedes ((0 0) (1 0)) ((1 1) (0 1)))-  (non-orig (ltk a b))-  (uniq-orig s)-  (operation encryption-test (added-listener s) (enc m a s) (0 1))-  (strand-map 0)-  (traces ((send (enc s (ltk a b))) (recv (enc m a s)))-    ((recv s) (send s)))-  (label 2)-  (parent 0)-  (unrealized (1 0))-  (dead)-  (comment "empty cohort"))--(defskeleton version-1-  (vars (s skey) (m text) (a b name))-  (defstrand init 2 (s s) (m m) (a a) (b b))-  (defstrand resp 2 (s s) (m m) (a a) (b b))-  (precedes ((0 0) (1 0)) ((1 1) (0 1)))-  (non-orig (ltk a b))-  (uniq-orig s)-  (operation nonce-test (contracted (b-0 b)) s (1 0) (enc s (ltk a b)))-  (strand-map 0 1)-  (traces ((send (enc s (ltk a b))) (recv (enc m a s)))-    ((recv (enc s (ltk a b))) (send (enc m a s))))-  (label 3)-  (parent 1)-  (realized)-  (shape)-  (maps ((0) ((a a) (b b) (m m) (s s))))-  (origs (s (0 0))))--(comment "Nothing left to do")--(defprotocol version-1 basic-  (defrole init-    (vars (a b name) (m text) (s skey))-    (trace (send (enc s (ltk a b))) (recv (enc m a s))))-  (defrole resp-    (vars (a b name) (m text) (s skey))-    (trace (recv (enc s (ltk a b))) (send (enc m a s))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false)))))--(defskeleton version-1-  (vars (s skey) (m text) (a b name))-  (defstrand resp 2 (s s) (m m) (a a) (b b))-  (non-orig (ltk a b))-  (traces ((recv (enc s (ltk a b))) (send (enc m a s))))-  (label 4)-  (unrealized (0 0))-  (origs)-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton version-1-  (vars (s skey) (m text) (a b name))-  (defstrand resp 2 (s s) (m m) (a a) (b b))-  (defstrand init 1 (s s) (a a) (b b))-  (precedes ((1 0) (0 0)))-  (non-orig (ltk a b))-  (operation encryption-test (added-strand init 1) (enc s (ltk a b))-    (0 0))-  (strand-map 0)-  (traces ((recv (enc s (ltk a b))) (send (enc m a s)))-    ((send (enc s (ltk a b)))))-  (label 5)-  (parent 4)-  (realized)-  (shape)-  (maps ((0) ((a a) (b b) (m m) (s s))))-  (origs))--(comment "Nothing left to do")--(defprotocol version-1 basic-  (defrole init-    (vars (a b name) (m text) (s skey))-    (trace (send (enc s (ltk a b))) (recv (enc m a s))))-  (defrole resp-    (vars (a b name) (m text) (s skey))-    (trace (recv (enc s (ltk a b))) (send (enc m a s))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false)))))--(defskeleton version-1-  (vars (s skey) (m text) (a b name))-  (defstrand resp 2 (s s) (m m) (a a) (b b))-  (defstrand init 1 (s s) (a a) (b b))-  (deflistener m)-  (precedes ((1 0) (0 0)))-  (non-orig (ltk a b))-  (uniq-orig s m)-  (traces ((recv (enc s (ltk a b))) (send (enc m a s)))-    ((send (enc s (ltk a b)))) ((recv m) (send m)))-  (label 6)-  (unrealized (2 0))-  (preskeleton)-  (origs (m (0 1)) (s (1 0)))-  (comment "Not a skeleton"))--(defskeleton version-1-  (vars (s skey) (m text) (a b name))-  (defstrand resp 2 (s s) (m m) (a a) (b b))-  (defstrand init 1 (s s) (a a) (b b))-  (deflistener m)-  (precedes ((0 1) (2 0)) ((1 0) (0 0)))-  (non-orig (ltk a b))-  (uniq-orig s m)-  (traces ((recv (enc s (ltk a b))) (send (enc m a s)))-    ((send (enc s (ltk a b)))) ((recv m) (send m)))-  (label 7)-  (parent 6)-  (unrealized (2 0))-  (origs (m (0 1)) (s (1 0)))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton version-1-  (vars (s skey) (m text) (a b name))-  (defstrand resp 2 (s s) (m m) (a a) (b b))-  (defstrand init 1 (s s) (a a) (b b))-  (deflistener m)-  (deflistener s)-  (precedes ((0 1) (2 0)) ((1 0) (0 0)) ((1 0) (3 0)) ((3 1) (2 0)))-  (non-orig (ltk a b))-  (uniq-orig s m)-  (operation nonce-test (added-listener s) m (2 0) (enc m a s))-  (strand-map 0 1 2)-  (traces ((recv (enc s (ltk a b))) (send (enc m a s)))-    ((send (enc s (ltk a b)))) ((recv m) (send m)) ((recv s) (send s)))-  (label 8)-  (parent 7)-  (unrealized (3 0))-  (dead)-  (comment "empty cohort"))--(comment "Nothing left to do")--(defprotocol version-1 basic-  (defrole init-    (vars (a b name) (m text) (s skey))-    (trace (send (enc s (ltk a b))) (recv (enc m a s))))-  (defrole resp-    (vars (a b name) (m text) (s skey))-    (trace (recv (enc s (ltk a b))) (send (enc m a s))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false)))))--(defskeleton version-1-  (vars (s skey) (m text) (a b name))-  (defstrand resp 2 (s s) (m m) (a a) (b b))-  (defstrand init 1 (s s) (a a) (b b))-  (deflistener m)-  (precedes ((1 0) (0 0)))-  (non-orig (ltk a b))-  (uniq-orig m)-  (traces ((recv (enc s (ltk a b))) (send (enc m a s)))-    ((send (enc s (ltk a b)))) ((recv m) (send m)))-  (label 9)-  (unrealized (2 0))-  (preskeleton)-  (origs (m (0 1)))-  (comment "Not a skeleton"))--(defskeleton version-1-  (vars (s skey) (m text) (a b name))-  (defstrand resp 2 (s s) (m m) (a a) (b b))-  (defstrand init 1 (s s) (a a) (b b))-  (deflistener m)-  (precedes ((0 1) (2 0)) ((1 0) (0 0)))-  (non-orig (ltk a b))-  (uniq-orig m)-  (traces ((recv (enc s (ltk a b))) (send (enc m a s)))-    ((send (enc s (ltk a b)))) ((recv m) (send m)))-  (label 10)-  (parent 9)-  (realized)-  (shape)-  (maps ((0 1 2) ((m m) (a a) (b b) (s s))))-  (origs (m (0 1))))--(comment "Nothing left to do")--(defprotocol version-2 basic-  (defrole init-    (vars (a b name) (m n1 text) (s skey))-    (trace (send (enc s n1 (ltk a b))) (recv (enc m a n1 s))))-  (defrole resp-    (vars (a b name) (m n1 text) (s skey))-    (trace (recv (enc s n1 (ltk a b))) (send (enc m a n1 s))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false)))))--(defskeleton version-2-  (vars (s skey) (m n1 text) (a b name))-  (defstrand init 2 (s s) (m m) (n1 n1) (a a) (b b))-  (non-orig (ltk a b))-  (uniq-orig s)-  (traces ((send (enc s n1 (ltk a b))) (recv (enc m a n1 s))))-  (label 11)-  (unrealized (0 1))-  (origs (s (0 0)))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton version-2-  (vars (s skey) (m n1 text) (a b b-0 name))-  (defstrand init 2 (s s) (m m) (n1 n1) (a a) (b b))-  (defstrand resp 2 (s s) (m m) (n1 n1) (a a) (b b-0))-  (precedes ((0 0) (1 0)) ((1 1) (0 1)))-  (non-orig (ltk a b))-  (uniq-orig s)-  (operation encryption-test (added-strand resp 2) (enc m a n1 s) (0 1))-  (strand-map 0)-  (traces ((send (enc s n1 (ltk a b))) (recv (enc m a n1 s)))-    ((recv (enc s n1 (ltk a b-0))) (send (enc m a n1 s))))-  (label 12)-  (parent 11)-  (unrealized (1 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton version-2-  (vars (s skey) (m n1 text) (a b name))-  (defstrand init 2 (s s) (m m) (n1 n1) (a a) (b b))-  (deflistener s)-  (precedes ((0 0) (1 0)) ((1 1) (0 1)))-  (non-orig (ltk a b))-  (uniq-orig s)-  (operation encryption-test (added-listener s) (enc m a n1 s) (0 1))-  (strand-map 0)-  (traces ((send (enc s n1 (ltk a b))) (recv (enc m a n1 s)))-    ((recv s) (send s)))-  (label 13)-  (parent 11)-  (unrealized (1 0))-  (dead)-  (comment "empty cohort"))--(defskeleton version-2-  (vars (s skey) (m n1 text) (a b name))-  (defstrand init 2 (s s) (m m) (n1 n1) (a a) (b b))-  (defstrand resp 2 (s s) (m m) (n1 n1) (a a) (b b))-  (precedes ((0 0) (1 0)) ((1 1) (0 1)))-  (non-orig (ltk a b))-  (uniq-orig s)-  (operation nonce-test (contracted (b-0 b)) s (1 0)-    (enc s n1 (ltk a b)))-  (strand-map 0 1)-  (traces ((send (enc s n1 (ltk a b))) (recv (enc m a n1 s)))-    ((recv (enc s n1 (ltk a b))) (send (enc m a n1 s))))-  (label 14)-  (parent 12)-  (realized)-  (shape)-  (maps ((0) ((a a) (b b) (m m) (s s) (n1 n1))))-  (origs (s (0 0))))--(comment "Nothing left to do")--(defprotocol version-2 basic-  (defrole init-    (vars (a b name) (m n1 text) (s skey))-    (trace (send (enc s n1 (ltk a b))) (recv (enc m a n1 s))))-  (defrole resp-    (vars (a b name) (m n1 text) (s skey))-    (trace (recv (enc s n1 (ltk a b))) (send (enc m a n1 s))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false)))))--(defskeleton version-2-  (vars (s skey) (m n1 text) (a b name))-  (defstrand resp 2 (s s) (m m) (n1 n1) (a a) (b b))-  (non-orig (ltk a b))-  (uniq-orig n1)-  (traces ((recv (enc s n1 (ltk a b))) (send (enc m a n1 s))))-  (label 15)-  (unrealized (0 0))-  (origs)-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton version-2-  (vars (s skey) (m n1 text) (a b name))-  (defstrand resp 2 (s s) (m m) (n1 n1) (a a) (b b))-  (defstrand init 1 (s s) (n1 n1) (a a) (b b))-  (precedes ((1 0) (0 0)))-  (non-orig (ltk a b))-  (uniq-orig n1)-  (operation encryption-test (added-strand init 1) (enc s n1 (ltk a b))-    (0 0))-  (strand-map 0)-  (traces ((recv (enc s n1 (ltk a b))) (send (enc m a n1 s)))-    ((send (enc s n1 (ltk a b)))))-  (label 16)-  (parent 15)-  (realized)-  (shape)-  (maps ((0) ((a a) (b b) (m m) (n1 n1) (s s))))-  (origs (n1 (1 0))))--(comment "Nothing left to do")
tst/expand.tst view
@@ -1,4 +1,4 @@-(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "Expanded macros")  (herald expand (expand) (comment "test macro expansion"))
tst/facts.tst view
@@ -1,6 +1,6 @@ (herald facts) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/facts.scm")  (defprotocol unilateral basic
tst/factvar.tst view
@@ -1,6 +1,6 @@ (herald factvar) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/factvar.scm")  (defprotocol free-fact-var basic
tst/ffgg.tst view
@@ -1,7 +1,7 @@ (herald "The ffgg Protocol"   (comment "From A Necessarily Parallel Attack by Jon K. Millen")) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/ffgg.scm")  (defprotocol ffgg basic
tst/fluffy_draft03_gske.tst view
@@ -3,7 +3,7 @@   (comment     "Based on the Internet-Draft: https://www.ietf.org/archive/id/draft-hardjono-ace-fluffy-03.txt")) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/fluffy_draft03_gske.scm")  (defprotocol fluffy basic
tst/fragile_pruning.tst view
@@ -1,4 +1,4 @@-(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/fragile_pruning.scm")  (defprotocol fragile_pruning basic
tst/goals.tst view
@@ -1,6 +1,6 @@ (herald goals) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/goals.scm")  (defprotocol ns basic
tst/goalsvar.tst view
@@ -1,6 +1,6 @@ (herald goalsvar) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/goalsvar.scm")  (defprotocol ns basic
tst/hashtest-key-hash.tst view
@@ -1,6 +1,6 @@ (herald "Hashtest") -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/hashtest-key-hash.scm")  (defprotocol hashtest basic
tst/hashtest.tst view
@@ -1,6 +1,6 @@ (herald "Hashtest") -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/hashtest.scm")  (defprotocol hashtest basic
tst/incompleteness_example.tst view
@@ -1,7 +1,7 @@ (herald incompleteness-example   (comment "Shows a shape not found by CPSA")) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/incompleteness_example.scm")  (defprotocol incompleteness-example basic
tst/isoreject-corrected.tst view
@@ -1,6 +1,6 @@ (herald isoreject-corrected) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/isoreject-corrected.scm")  (defprotocol isofix basic
tst/isoreject.tst view
@@ -1,4 +1,4 @@-(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/isoreject.scm")  (defprotocol isoreject basic
− tst/jdg-wonthull.tst 
@@ -1,395 +0,0 @@-(herald jdg-wonthull (bound 9))--(comment "CPSA 4.4.4")-(comment "All input read from tst/jdg-wonthull.scm")-(comment "Strand count bounded at 9")--(defprotocol wonthull basic-  (defrole init-    (vars (a name) (x1 x2 x3 x4 text))-    (trace (send (cat (enc x1 x2 (pubk a)) (enc x3 x2 (pubk a))))-      (recv (enc "okay" x3 x4 (pubk a))))-    (non-orig (privk a))-    (uniq-orig x3))-  (defrole resp-    (vars (a name) (y1 y2 y3 text))-    (trace (recv (enc y1 y2 (pubk a)))-      (send (enc "okay" y3 y1 (pubk a)))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false)))))--(defskeleton wonthull-  (vars (x1 x2 x3 x4 text) (a name))-  (defstrand init 2 (x1 x1) (x2 x2) (x3 x3) (x4 x4) (a a))-  (non-orig (privk a))-  (uniq-orig x3)-  (traces-    ((send (cat (enc x1 x2 (pubk a)) (enc x3 x2 (pubk a))))-      (recv (enc "okay" x3 x4 (pubk a)))))-  (label 0)-  (unrealized (0 1))-  (origs (x3 (0 0)))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton wonthull-  (vars (x1 x2 x4 text) (a name))-  (defstrand init 2 (x1 x1) (x2 x2) (x3 x2) (x4 x4) (a a))-  (non-orig (privk a))-  (uniq-orig x2)-  (operation nonce-test (displaced 1 0 init 1) x3 (0 1)-    (enc x3 x2 (pubk a)))-  (strand-map 0)-  (traces-    ((send (cat (enc x1 x2 (pubk a)) (enc x2 x2 (pubk a))))-      (recv (enc "okay" x2 x4 (pubk a)))))-  (label 1)-  (parent 0)-  (unrealized (0 1))-  (origs (x2 (0 0)))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton wonthull-  (vars (x1 x2 x3 x4 y3 text) (a name))-  (defstrand init 2 (x1 x1) (x2 x2) (x3 x3) (x4 x4) (a a))-  (defstrand resp 2 (y1 x3) (y2 x2) (y3 y3) (a a))-  (precedes ((0 0) (1 0)) ((1 1) (0 1)))-  (non-orig (privk a))-  (uniq-orig x3)-  (operation nonce-test (added-strand resp 2) x3 (0 1)-    (enc x3 x2 (pubk a)))-  (strand-map 0)-  (traces-    ((send (cat (enc x1 x2 (pubk a)) (enc x3 x2 (pubk a))))-      (recv (enc "okay" x3 x4 (pubk a))))-    ((recv (enc x3 x2 (pubk a))) (send (enc "okay" y3 x3 (pubk a)))))-  (label 2)-  (parent 0)-  (seen 3)-  (seen-ops-    (3-      (operation nonce-test (displaced 2 0 init 1) x3 (0 1)-        (enc "okay" y3 x3 (pubk a)) (enc x3 x2 (pubk a)))-      (strand-map 0 1)))-  (unrealized (0 1))-  (comment "2 in cohort - 1 not yet seen"))--(defskeleton wonthull-  (vars (x1 x2 x4 y3 text) (a name))-  (defstrand init 2 (x1 x1) (x2 x2) (x3 x2) (x4 x4) (a a))-  (defstrand resp 2 (y1 x2) (y2 x2) (y3 y3) (a a))-  (precedes ((0 0) (1 0)) ((1 1) (0 1)))-  (non-orig (privk a))-  (uniq-orig x2)-  (operation nonce-test (added-strand resp 2) x2 (0 1)-    (enc x1 x2 (pubk a)) (enc x2 x2 (pubk a)))-  (strand-map 0)-  (traces-    ((send (cat (enc x1 x2 (pubk a)) (enc x2 x2 (pubk a))))-      (recv (enc "okay" x2 x4 (pubk a))))-    ((recv (enc x2 x2 (pubk a))) (send (enc "okay" y3 x2 (pubk a)))))-  (label 3)-  (parent 1)-  (unrealized (0 1))-  (comment "3 in cohort - 3 not yet seen"))--(defskeleton wonthull-  (vars (x1 x2 y3 text) (a name))-  (defstrand init 2 (x1 x1) (x2 x2) (x3 y3) (x4 y3) (a a))-  (defstrand resp 2 (y1 y3) (y2 x2) (y3 y3) (a a))-  (precedes ((0 0) (1 0)) ((1 1) (0 1)))-  (non-orig (privk a))-  (uniq-orig y3)-  (operation nonce-test (contracted (x3 y3) (x4 y3)) y3 (0 1)-    (enc "okay" y3 y3 (pubk a)) (enc y3 x2 (pubk a)))-  (strand-map 0 1)-  (traces-    ((send (cat (enc x1 x2 (pubk a)) (enc y3 x2 (pubk a))))-      (recv (enc "okay" y3 y3 (pubk a))))-    ((recv (enc y3 x2 (pubk a))) (send (enc "okay" y3 y3 (pubk a)))))-  (label 4)-  (parent 2)-  (realized)-  (shape)-  (maps ((0) ((a a) (x1 x1) (x2 x2) (x3 y3) (x4 y3))))-  (origs (y3 (0 0))))--(defskeleton wonthull-  (vars (x1 y3 text) (a name))-  (defstrand init 2 (x1 x1) (x2 y3) (x3 y3) (x4 y3) (a a))-  (defstrand resp 2 (y1 y3) (y2 y3) (y3 y3) (a a))-  (precedes ((0 0) (1 0)) ((1 1) (0 1)))-  (non-orig (privk a))-  (uniq-orig y3)-  (operation nonce-test (contracted (x2 y3) (x4 y3)) y3 (0 1)-    (enc "okay" y3 y3 (pubk a)) (enc x1 y3 (pubk a))-    (enc y3 y3 (pubk a)))-  (strand-map 0 1)-  (traces-    ((send (cat (enc x1 y3 (pubk a)) (enc y3 y3 (pubk a))))-      (recv (enc "okay" y3 y3 (pubk a))))-    ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a)))))-  (label 5)-  (parent 3)-  (realized)-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton wonthull-  (vars (x1 x2 x4 y3 text) (a name))-  (defstrand init 2 (x1 x1) (x2 x2) (x3 x2) (x4 x4) (a a))-  (defstrand resp 2 (y1 x2) (y2 x2) (y3 y3) (a a))-  (defstrand resp 2 (y1 x2) (y2 x2) (y3 x2) (a a))-  (precedes ((0 0) (1 0)) ((0 0) (2 0)) ((1 1) (0 1)) ((2 1) (0 1)))-  (non-orig (privk a))-  (uniq-orig x2)-  (operation nonce-test (added-strand resp 2) x2 (0 1)-    (enc "okay" y3 x2 (pubk a)) (enc x1 x2 (pubk a))-    (enc x2 x2 (pubk a)))-  (strand-map 0 1)-  (traces-    ((send (cat (enc x1 x2 (pubk a)) (enc x2 x2 (pubk a))))-      (recv (enc "okay" x2 x4 (pubk a))))-    ((recv (enc x2 x2 (pubk a))) (send (enc "okay" y3 x2 (pubk a))))-    ((recv (enc x2 x2 (pubk a))) (send (enc "okay" x2 x2 (pubk a)))))-  (label 6)-  (parent 3)-  (unrealized (0 1))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton wonthull-  (vars (x1 x2 x4 y3 text) (a name))-  (defstrand init 2 (x1 x1) (x2 x2) (x3 x2) (x4 x4) (a a))-  (defstrand resp 2 (y1 x2) (y2 x2) (y3 y3) (a a))-  (defstrand resp 2 (y1 x2) (y2 x2) (y3 x1) (a a))-  (precedes ((0 0) (1 0)) ((0 0) (2 0)) ((1 1) (0 1)) ((2 1) (0 1)))-  (non-orig (privk a))-  (uniq-orig x2)-  (operation nonce-test (added-strand resp 2) x2 (0 1)-    (enc "okay" y3 x2 (pubk a)) (enc x1 x2 (pubk a))-    (enc x2 x2 (pubk a)))-  (strand-map 0 1)-  (traces-    ((send (cat (enc x1 x2 (pubk a)) (enc x2 x2 (pubk a))))-      (recv (enc "okay" x2 x4 (pubk a))))-    ((recv (enc x2 x2 (pubk a))) (send (enc "okay" y3 x2 (pubk a))))-    ((recv (enc x2 x2 (pubk a))) (send (enc "okay" x1 x2 (pubk a)))))-  (label 7)-  (parent 3)-  (seen 10)-  (seen-ops-    (10-      (operation nonce-test (added-strand resp 2) x2 (0 1)-        (enc "okay" x1 x2 (pubk a)) (enc "okay" y3 x2 (pubk a))-        (enc x1 x2 (pubk a)) (enc x2 x2 (pubk a))) (strand-map 0 1 3)))-  (unrealized (0 1))-  (comment "3 in cohort - 2 not yet seen"))--(defskeleton wonthull-  (vars (x1 y3 y3-0 text) (a name))-  (defstrand init 2 (x1 x1) (x2 y3) (x3 y3-0) (x4 y3-0) (a a))-  (defstrand resp 2 (y1 y3-0) (y2 y3) (y3 y3-0) (a a))-  (precedes ((0 0) (1 0)) ((1 1) (0 1)))-  (non-orig (privk a))-  (uniq-orig y3 y3-0)-  (operation generalization separated y3-0)-  (strand-map 0 1)-  (traces-    ((send (cat (enc x1 y3 (pubk a)) (enc y3-0 y3 (pubk a))))-      (recv (enc "okay" y3-0 y3-0 (pubk a))))-    ((recv (enc y3-0 y3 (pubk a)))-      (send (enc "okay" y3-0 y3-0 (pubk a)))))-  (label 8)-  (parent 5)-  (seen 4)-  (seen-ops (4 (operation generalization forgot y3) (strand-map 0 1)))-  (realized)-  (comment "1 in cohort - 0 not yet seen"))--(defskeleton wonthull-  (vars (x1 x2 y3 text) (a name))-  (defstrand init 2 (x1 x1) (x2 x2) (x3 x2) (x4 x2) (a a))-  (defstrand resp 2 (y1 x2) (y2 x2) (y3 y3) (a a))-  (defstrand resp 2 (y1 x2) (y2 x2) (y3 x2) (a a))-  (precedes ((0 0) (1 0)) ((0 0) (2 0)) ((1 1) (0 1)) ((2 1) (0 1)))-  (non-orig (privk a))-  (uniq-orig x2)-  (operation nonce-test (contracted (x4 x2)) x2 (0 1)-    (enc "okay" x2 x2 (pubk a)) (enc "okay" y3 x2 (pubk a))-    (enc x1 x2 (pubk a)) (enc x2 x2 (pubk a)))-  (strand-map 0 1 2)-  (traces-    ((send (cat (enc x1 x2 (pubk a)) (enc x2 x2 (pubk a))))-      (recv (enc "okay" x2 x2 (pubk a))))-    ((recv (enc x2 x2 (pubk a))) (send (enc "okay" y3 x2 (pubk a))))-    ((recv (enc x2 x2 (pubk a))) (send (enc "okay" x2 x2 (pubk a)))))-  (label 9)-  (parent 6)-  (seen 5)-  (seen-ops-    (5 (operation generalization deleted (1 0)) (strand-map 0 2)))-  (realized)-  (comment "1 in cohort - 0 not yet seen"))--(defskeleton wonthull-  (vars (x1 x2 x4 y3 text) (a name))-  (defstrand init 2 (x1 x1) (x2 x2) (x3 x2) (x4 x4) (a a))-  (defstrand resp 2 (y1 x2) (y2 x2) (y3 y3) (a a))-  (defstrand resp 2 (y1 x2) (y2 x2) (y3 x2) (a a))-  (defstrand resp 2 (y1 x2) (y2 x2) (y3 x1) (a a))-  (precedes ((0 0) (1 0)) ((0 0) (2 0)) ((0 0) (3 0)) ((1 1) (0 1))-    ((2 1) (0 1)) ((3 1) (0 1)))-  (non-orig (privk a))-  (uniq-orig x2)-  (operation nonce-test (added-strand resp 2) x2 (0 1)-    (enc "okay" x2 x2 (pubk a)) (enc "okay" y3 x2 (pubk a))-    (enc x1 x2 (pubk a)) (enc x2 x2 (pubk a)))-  (strand-map 0 1 2)-  (traces-    ((send (cat (enc x1 x2 (pubk a)) (enc x2 x2 (pubk a))))-      (recv (enc "okay" x2 x4 (pubk a))))-    ((recv (enc x2 x2 (pubk a))) (send (enc "okay" y3 x2 (pubk a))))-    ((recv (enc x2 x2 (pubk a))) (send (enc "okay" x2 x2 (pubk a))))-    ((recv (enc x2 x2 (pubk a))) (send (enc "okay" x1 x2 (pubk a)))))-  (label 10)-  (parent 6)-  (unrealized (0 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton wonthull-  (vars (x1 y3 text) (a name))-  (defstrand init 2 (x1 x1) (x2 x1) (x3 x1) (x4 x1) (a a))-  (defstrand resp 2 (y1 x1) (y2 x1) (y3 y3) (a a))-  (defstrand resp 2 (y1 x1) (y2 x1) (y3 x1) (a a))-  (precedes ((0 0) (1 0)) ((0 0) (2 0)) ((1 1) (0 1)) ((2 1) (0 1)))-  (non-orig (privk a))-  (uniq-orig x1)-  (operation nonce-test (contracted (x2 x1) (x4 x1)) x1 (0 1)-    (enc "okay" x1 x1 (pubk a)) (enc "okay" y3 x1 (pubk a))-    (enc x1 x1 (pubk a)))-  (strand-map 0 1 2)-  (traces-    ((send (cat (enc x1 x1 (pubk a)) (enc x1 x1 (pubk a))))-      (recv (enc "okay" x1 x1 (pubk a))))-    ((recv (enc x1 x1 (pubk a))) (send (enc "okay" y3 x1 (pubk a))))-    ((recv (enc x1 x1 (pubk a))) (send (enc "okay" x1 x1 (pubk a)))))-  (label 11)-  (parent 7)-  (realized)-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton wonthull-  (vars (x1 y3 text) (a name))-  (defstrand init 2 (x1 x1) (x2 y3) (x3 y3) (x4 y3) (a a))-  (defstrand resp 2 (y1 y3) (y2 y3) (y3 y3) (a a))-  (defstrand resp 2 (y1 y3) (y2 y3) (y3 x1) (a a))-  (precedes ((0 0) (1 0)) ((0 0) (2 0)) ((1 1) (0 1)) ((2 1) (0 1)))-  (non-orig (privk a))-  (uniq-orig y3)-  (operation nonce-test (contracted (x2 y3) (x4 y3)) y3 (0 1)-    (enc "okay" x1 y3 (pubk a)) (enc "okay" y3 y3 (pubk a))-    (enc x1 y3 (pubk a)) (enc y3 y3 (pubk a)))-  (strand-map 0 1 2)-  (traces-    ((send (cat (enc x1 y3 (pubk a)) (enc y3 y3 (pubk a))))-      (recv (enc "okay" y3 y3 (pubk a))))-    ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))-    ((recv (enc y3 y3 (pubk a))) (send (enc "okay" x1 y3 (pubk a)))))-  (label 12)-  (parent 7)-  (seen 5)-  (seen-ops-    (5 (operation generalization deleted (2 0)) (strand-map 0 1)))-  (realized)-  (comment "1 in cohort - 0 not yet seen"))--(defskeleton wonthull-  (vars (x1 x2 y3 text) (a name))-  (defstrand init 2 (x1 x1) (x2 x2) (x3 x2) (x4 x2) (a a))-  (defstrand resp 2 (y1 x2) (y2 x2) (y3 y3) (a a))-  (defstrand resp 2 (y1 x2) (y2 x2) (y3 x2) (a a))-  (defstrand resp 2 (y1 x2) (y2 x2) (y3 x1) (a a))-  (precedes ((0 0) (1 0)) ((0 0) (2 0)) ((0 0) (3 0)) ((1 1) (0 1))-    ((2 1) (0 1)) ((3 1) (0 1)))-  (non-orig (privk a))-  (uniq-orig x2)-  (operation nonce-test (contracted (x4 x2)) x2 (0 1)-    (enc "okay" x1 x2 (pubk a)) (enc "okay" x2 x2 (pubk a))-    (enc "okay" y3 x2 (pubk a)) (enc x1 x2 (pubk a))-    (enc x2 x2 (pubk a)))-  (strand-map 0 1 2 3)-  (traces-    ((send (cat (enc x1 x2 (pubk a)) (enc x2 x2 (pubk a))))-      (recv (enc "okay" x2 x2 (pubk a))))-    ((recv (enc x2 x2 (pubk a))) (send (enc "okay" y3 x2 (pubk a))))-    ((recv (enc x2 x2 (pubk a))) (send (enc "okay" x2 x2 (pubk a))))-    ((recv (enc x2 x2 (pubk a))) (send (enc "okay" x1 x2 (pubk a)))))-  (label 13)-  (parent 10)-  (seen 12)-  (seen-ops-    (12 (operation generalization deleted (1 0)) (strand-map 0 2 3)))-  (realized)-  (comment "1 in cohort - 0 not yet seen"))--(defskeleton wonthull-  (vars (x1 text) (a name))-  (defstrand init 2 (x1 x1) (x2 x1) (x3 x1) (x4 x1) (a a))-  (defstrand resp 2 (y1 x1) (y2 x1) (y3 x1) (a a))-  (precedes ((0 0) (1 0)) ((1 1) (0 1)))-  (non-orig (privk a))-  (uniq-orig x1)-  (operation generalization deleted (1 0))-  (strand-map 0 2)-  (traces-    ((send (cat (enc x1 x1 (pubk a)) (enc x1 x1 (pubk a))))-      (recv (enc "okay" x1 x1 (pubk a))))-    ((recv (enc x1 x1 (pubk a))) (send (enc "okay" x1 x1 (pubk a)))))-  (label 14)-  (parent 11)-  (seen 5)-  (seen-ops-    (5 (operation generalization separated x1-0) (strand-map 0 1)))-  (realized)-  (comment "1 in cohort - 0 not yet seen"))--(comment "Nothing left to do")--(defprotocol wonthull basic-  (defrole init-    (vars (a name) (x1 x2 x3 x4 text))-    (trace (send (cat (enc x1 x2 (pubk a)) (enc x3 x2 (pubk a))))-      (recv (enc "okay" x3 x4 (pubk a))))-    (non-orig (privk a))-    (uniq-orig x3))-  (defrole resp-    (vars (a name) (y1 y2 y3 text))-    (trace (recv (enc y1 y2 (pubk a)))-      (send (enc "okay" y3 y1 (pubk a)))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false)))))--(defskeleton wonthull-  (vars (x1 x3 text) (a name))-  (defstrand init 2 (x1 x1) (x2 x3) (x3 x3) (x4 x1) (a a))-  (defstrand resp 2 (y1 x1) (y2 x3) (y3 x3) (a a))-  (precedes ((0 0) (1 0)) ((1 1) (0 1)))-  (non-orig (privk a))-  (uniq-orig x3)-  (traces-    ((send (cat (enc x1 x3 (pubk a)) (enc x3 x3 (pubk a))))-      (recv (enc "okay" x3 x1 (pubk a))))-    ((recv (enc x1 x3 (pubk a))) (send (enc "okay" x3 x1 (pubk a)))))-  (label 15)-  (realized)-  (shape)-  (maps ((0 1) ((a a) (x1 x1) (x3 x3))))-  (origs (x3 (0 0))))--(comment "Nothing left to do")
tst/kelly1.tst view
@@ -1,4 +1,4 @@-(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/kelly1.scm")  (defprotocol kelly1 basic
− tst/kelly64.lisp 
@@ -1,127 +0,0 @@-(herald "Kelly's 64-shape protocol" (bound 10))--(defprotocol kelly64 basic-  (defrole client-    (vars (C name) (A name) (S name) (AIKC name) (NC text)-	  (hello text) (Quote text) (mc text) (request text)-	  (response text) (Check text) (P2 text))-    (trace-     (send (cat C A hello))-     (recv (cat A C NC))-     (send (cat C A (enc-		     (cat Quote mc NC-			  (enc-			   (pubk C)-			   (privk C)))-		     (privk AIKC))-		(enc-		 (pubk C)-		 (privk C))))-     (send (cat C S-		(enc (cat request request)-		     (privk C))))-     (recv (cat S C-		(enc response-		     (privk S))))-     (send (cat C A Check (pubk S)))-     (recv (cat A C-		(enc (cat P2 (pubk S))-		     (privk A)))))-    (non-orig (privk C) (privk AIKC) (privk A))-    )-  ;;   non = (privk(C);privk(AIKC);privk(A));-  ;;   uniq = ();--  (defrole appraiser-    (vars (C name) (A name) (S name) (AIKS name) (AIKC name)-	  (NS text) (NC text) (hello text)(Quote text)-	  (ms text)(mc text)(Check text)(P1 text)(P2 text))-    (trace--     (recv (cat S A hello))-     (send (cat A S NS))-     (recv (cat S A-		(enc-		 (cat Quote ms NS-		      (enc (pubk S)-			   (privk S)))-		 (privk AIKS))-		(enc-		 (pubk S)-		 (privk S))))-     (recv (cat C A hello))-     (send (cat A C NC))-     (recv (cat C A (enc-		     (cat Quote mc NC (enc-				       (pubk C)-				       (privk C)))-		     (privk AIKC))-		(enc-		 (pubk C)-		 (privk C))))-     (recv (cat S A  Check (pubk C)))-     (send (cat A S (enc-		     (cat P1 (pubk C))-		     (privk A))))-     (recv (cat C A Check (pubk S)))-     (send (cat A C (enc-		     (cat P2 (pubk S))-		     (privk A))))-     )-    (non-orig (privk A) (privk AIKS) (privk AIKC))-    (uniq-orig NS NC)-    ;;   non = (privk(A);privk(AIKS);privk(AIKC));-    ;;   uniq = (NS;NC);-    )--  (defrole server-    (vars (C name) (A name) (S name) (AIKS name) (NS text)-	  (hello text) (Quote text) (ms text) (request text)-	  (Check text) (P1 text) (response text))-    (trace-     ;;   non = (privk(S);privk(AIKS);privk(A));-     ;;  uniq = ();--     (send (cat S A hello))-     (recv (cat A S NS))-     (send (cat S A (enc-		     (cat Quote ms NS (enc-				       (pubk S)-				       (privk S)))-		     (privk AIKS))-		(enc-		 (pubk S)-		 (privk S))))-     (recv (cat C S (enc-		     (cat request request)-		     (privk C))))-     (send (cat S A Check (pubk C)))-     (recv (cat A S (enc-		     (cat P1 (pubk C))-		     (privk A))))-     (send (cat S C (enc-		     response-		     (privk S))))-     )-    (non-orig (privk S) (privk AIKS) (privk A))-    )--  )--(defskeleton kelly64-  (vars (C name) (A name) (S name) (AIKC name) (NC text)-	  (hello text) (Quote text) (mc text) (request text)-	  (response text) (Check text) (P2 text))-  (defstrand client 7 (C C) (A A) (S S) (AIKC AIKC)-    (NC NC) (hello hello) (Quote Quote) (mc mc)-    (request request) (response response) (Check Check) (P2 P2)))--(defskeleton kelly64-  (vars (C name) (A name) (S name) (AIKC name) (NC text)-	  (hello text) (Quote text) (mc text) (request text)-	  (response text) (Check text) (P1 text))-  (defstrand server 7 ))--(defskeleton kelly64-(vars)-  (defstrand appraiser 10))
− tst/kerb5.lisp 
@@ -1,94 +0,0 @@-;; Kerberos 5 specification, taken from-;; http://www.lsv.ens-cachan.fr/spore/kerberos.html-;;-;; Ku in the original document has become pubk/privk U.-;; Since we cannot confirm with CPSA that T1 is between T1start and T1expire,-;; and since the purpose of T1 is to have a defined relationship with T1start-;; and T1expire, I am replacing T1 with (cat T1start T1expire). Ditto with T2.--(defprotocol kerb5 basic--  ;; U is the client's user (and, approximately, its principal.)-  (defrole client-    (vars (U name) (G name) (L1 text) (N1 text) (C name) (S name)-	  (L2 text) (N2 text) (Kcg skey) (T1start text) (T1expire text)-	  (Kag skey) (Kgs skey) (T2start text) (T2expire text)-	  (Kcs skey))-    (trace-     (send (cat U G L1 N1))-     (recv (cat U-		(enc (cat U C G Kcg T1start T1expire) Kag)-		(enc (cat G Kcg T1start T1expire) (pubk U))))-     (send (cat S-		L2-		N2-		(enc (cat U C G Kcg T1start T1expire) Kag)-		(enc (cat C T1start T1expire) Kcg)))-     (recv (cat U-		(enc (cat U C S Kcs T2start T2expire) Kgs)-		(enc (cat S Kcs T2start T2expire N2) Kcg)))-     (send (cat (enc (cat U C S Kcs T2start T2expire) Kgs)-		(enc (cat C T2start T2expire) Kcs)))-     (recv (enc (cat T2start T2expire) Kcs))-     )-    (uniq-orig N1 N2)-    (non-orig (privk U))-    )--;; A is the key distribution authority's principal; never used explicitly-;; Kag is a long-term shared key between A and G.-;; Kcg is the session key to be shared by C and G, created by A.-  (defrole authority-    (vars (U name) (G name) (C name) (L1 text) (N1 text)-	  (T1start text) (T1expire text) (Kag skey) (Kcg skey))-    (trace-     (recv (cat U G L1 N1))-     (send (cat U-		(enc (cat U C G Kcg T1start T1expire) Kag)-		(enc (cat G Kcg T1start T1expire) (pubk U))))-     )-    (uniq-orig Kcg)-    (non-orig Kag)-    )--;; G is the ticket granting server's principal.-;; Kag is a long-term shared key between A and G.-;; Kgs is a long-term shared key between G and S.-  (defrole granter-       (vars (U name) (G name) (C name) (S name) (L2 text) (N2 text)-	  (Kcg skey) (T1start text) (T1expire text) (Kag skey)-	  (Kgs skey) (T2start text) (T2expire text) (Kcs skey))-       (trace-	(recv (cat S-		   L2-		   N2-		   (enc (cat U C G Kcg T1start T1expire) Kag)-		   (enc (cat C T1start T1expire) Kcg)))-	(send (cat U-		   (enc (cat U C S Kcs T2start T2expire) Kgs)-		   (enc (cat S Kcs T2start T2expire N2) Kcg)))-	)-       (uniq-orig Kcs)-       (non-orig Kgs Kag)-    )--;; S is the principal of the server that C wishes to communicate with-;; Kgs is a long-term shared key between G and S.-  (defrole server-    (vars (U name) (C name) (S name) (Kgs skey) (T2start text)-	  (T2expire text) (Kcs skey))-    (trace-     (recv (cat (enc (cat U C S Kcs T2start T2expire) Kgs)-		(enc (cat C T2start T2expire) Kcs)))-     (send (enc (cat T2start T2expire) Kcs))-     )-    (uniq-orig )-    (non-orig Kgs)-    )--)-- (defskeleton kerb5-    (vars )-    (defstrand server 2)-    )
− tst/kerberos-variant-guar.tst 
@@ -1,502 +0,0 @@-(comment "CPSA 4.4.4")-(comment "All input read from tst/kerberos-variant-guar.scm")--(defprotocol kerberos-variant basic-  (defrole init-    (vars (a b ks name) (t n t-prime l text) (a-ks-lt k skey)-      (ticket mesg))-    (trace (send (cat a b ks))-      (recv (cat (enc t l k a b ks a-ks-lt) ticket))-      (send (cat (enc a t n k) ticket)) (recv (enc n t-prime k))))-  (defrole resp-    (vars (a b ks name) (t n t-prime l text) (b-ks-lt k skey))-    (trace-      (recv (cat (enc a t n k) (enc "ticket" t l k a b ks b-ks-lt)))-      (send (enc n t-prime k))))-  (defrole keyserver-    (vars (a b ks name) (t l text) (a-ks-lt b-ks-lt k skey))-    (trace (recv (cat a b ks))-      (send-        (cat (enc t l k a b ks a-ks-lt)-          (enc "ticket" t l k a b ks b-ks-lt))))-    (uniq-orig k))-  (defrule long-term-key-non-    (forall ((p ks name) (k-lt skey))-      (implies (fact long-term p ks k-lt) (non k-lt))))-  (defrule guar-keyserver-2-    (forall-      ((z strd) (b-ks-lt skey) (b name) (a-ks-lt skey) (ks a name))-      (implies-        (and (p "keyserver" z (idx 2)) (p "keyserver" "a" z a)-          (p "keyserver" "ks" z ks) (p "keyserver" "a-ks-lt" z a-ks-lt)-          (p "keyserver" "b" z b) (p "keyserver" "b-ks-lt" z b-ks-lt))-        (and (fact long-term a ks a-ks-lt)-          (fact long-term b ks b-ks-lt)))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false)))))--(defskeleton kerberos-variant-  (vars (ticket mesg) (a-ks-lt k skey) (n t t-prime l text)-    (a b ks name))-  (defstrand init 4 (ticket ticket) (a-ks-lt a-ks-lt) (k k) (t t) (n n)-    (t-prime t-prime) (l l) (a a) (b b) (ks ks))-  (non-orig a-ks-lt)-  (uniq-orig n)-  (traces-    ((send (cat a b ks)) (recv (cat (enc t l k a b ks a-ks-lt) ticket))-      (send (cat (enc a t n k) ticket)) (recv (enc n t-prime k))))-  (label 0)-  (unrealized (0 1))-  (origs (n (0 2)))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton kerberos-variant-  (vars (ticket mesg) (a-ks-lt k b-ks-lt skey) (n t t-prime l text)-    (a b ks name))-  (defstrand init 4 (ticket ticket) (a-ks-lt a-ks-lt) (k k) (t t) (n n)-    (t-prime t-prime) (l l) (a a) (b b) (ks ks))-  (defstrand keyserver 2 (a-ks-lt a-ks-lt) (b-ks-lt b-ks-lt) (k k) (t t)-    (l l) (a a) (b b) (ks ks))-  (precedes ((1 1) (0 1)))-  (non-orig a-ks-lt b-ks-lt)-  (uniq-orig k n)-  (facts (long-term b ks b-ks-lt) (long-term a ks a-ks-lt))-  (rule guar-keyserver-2 long-term-key-non)-  (operation encryption-test (added-strand keyserver 2)-    (enc t l k a b ks a-ks-lt) (0 1))-  (strand-map 0)-  (traces-    ((send (cat a b ks)) (recv (cat (enc t l k a b ks a-ks-lt) ticket))-      (send (cat (enc a t n k) ticket)) (recv (enc n t-prime k)))-    ((recv (cat a b ks))-      (send-        (cat (enc t l k a b ks a-ks-lt)-          (enc "ticket" t l k a b ks b-ks-lt)))))-  (label 1)-  (parent 0)-  (unrealized (0 3))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton kerberos-variant-  (vars (ticket mesg) (a-ks-lt k b-ks-lt b-ks-lt-0 skey)-    (n t t-prime l t-0 l-0 text) (a b ks a-0 b-0 ks-0 name))-  (defstrand init 4 (ticket ticket) (a-ks-lt a-ks-lt) (k k) (t t) (n n)-    (t-prime t-prime) (l l) (a a) (b b) (ks ks))-  (defstrand keyserver 2 (a-ks-lt a-ks-lt) (b-ks-lt b-ks-lt) (k k) (t t)-    (l l) (a a) (b b) (ks ks))-  (defstrand resp 2 (b-ks-lt b-ks-lt-0) (k k) (t t-0) (n n)-    (t-prime t-prime) (l l-0) (a a-0) (b b-0) (ks ks-0))-  (precedes ((0 2) (2 0)) ((1 1) (0 1)) ((2 1) (0 3)))-  (non-orig a-ks-lt b-ks-lt)-  (uniq-orig k n)-  (facts (long-term b ks b-ks-lt) (long-term a ks a-ks-lt))-  (rule guar-keyserver-2)-  (operation encryption-test (added-strand resp 2) (enc n t-prime k)-    (0 3))-  (strand-map 0 1)-  (traces-    ((send (cat a b ks)) (recv (cat (enc t l k a b ks a-ks-lt) ticket))-      (send (cat (enc a t n k) ticket)) (recv (enc n t-prime k)))-    ((recv (cat a b ks))-      (send-        (cat (enc t l k a b ks a-ks-lt)-          (enc "ticket" t l k a b ks b-ks-lt))))-    ((recv-       (cat (enc a-0 t-0 n k)-         (enc "ticket" t-0 l-0 k a-0 b-0 ks-0 b-ks-lt-0)))-      (send (enc n t-prime k))))-  (label 2)-  (parent 1)-  (unrealized (2 0))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton kerberos-variant-  (vars (ticket mesg) (a-ks-lt k b-ks-lt skey) (n t t-prime l text)-    (a b ks name))-  (defstrand init 4 (ticket ticket) (a-ks-lt a-ks-lt) (k k) (t t) (n n)-    (t-prime t-prime) (l l) (a a) (b b) (ks ks))-  (defstrand keyserver 2 (a-ks-lt a-ks-lt) (b-ks-lt b-ks-lt) (k k) (t t)-    (l l) (a a) (b b) (ks ks))-  (deflistener k)-  (precedes ((1 1) (0 1)) ((1 1) (2 0)) ((2 1) (0 3)))-  (non-orig a-ks-lt b-ks-lt)-  (uniq-orig k n)-  (facts (long-term b ks b-ks-lt) (long-term a ks a-ks-lt))-  (rule guar-keyserver-2)-  (operation encryption-test (added-listener k) (enc n t-prime k) (0 3))-  (strand-map 0 1)-  (traces-    ((send (cat a b ks)) (recv (cat (enc t l k a b ks a-ks-lt) ticket))-      (send (cat (enc a t n k) ticket)) (recv (enc n t-prime k)))-    ((recv (cat a b ks))-      (send-        (cat (enc t l k a b ks a-ks-lt)-          (enc "ticket" t l k a b ks b-ks-lt)))) ((recv k) (send k)))-  (label 3)-  (parent 1)-  (unrealized (2 0))-  (dead)-  (comment "empty cohort"))--(defskeleton kerberos-variant-  (vars (ticket mesg) (a-ks-lt k b-ks-lt b-ks-lt-0 skey)-    (n t t-prime l l-0 text) (a b ks b-0 ks-0 name))-  (defstrand init 4 (ticket ticket) (a-ks-lt a-ks-lt) (k k) (t t) (n n)-    (t-prime t-prime) (l l) (a a) (b b) (ks ks))-  (defstrand keyserver 2 (a-ks-lt a-ks-lt) (b-ks-lt b-ks-lt) (k k) (t t)-    (l l) (a a) (b b) (ks ks))-  (defstrand resp 2 (b-ks-lt b-ks-lt-0) (k k) (t t) (n n)-    (t-prime t-prime) (l l-0) (a a) (b b-0) (ks ks-0))-  (precedes ((0 2) (2 0)) ((1 1) (0 1)) ((2 1) (0 3)))-  (non-orig a-ks-lt b-ks-lt)-  (uniq-orig k n)-  (facts (long-term b ks b-ks-lt) (long-term a ks a-ks-lt))-  (rule guar-keyserver-2)-  (operation encryption-test (displaced 3 0 init 3) (enc a-0 t-0 n k)-    (2 0))-  (strand-map 0 1 2)-  (traces-    ((send (cat a b ks)) (recv (cat (enc t l k a b ks a-ks-lt) ticket))-      (send (cat (enc a t n k) ticket)) (recv (enc n t-prime k)))-    ((recv (cat a b ks))-      (send-        (cat (enc t l k a b ks a-ks-lt)-          (enc "ticket" t l k a b ks b-ks-lt))))-    ((recv-       (cat (enc a t n k) (enc "ticket" t l-0 k a b-0 ks-0 b-ks-lt-0)))-      (send (enc n t-prime k))))-  (label 4)-  (parent 2)-  (unrealized (2 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton kerberos-variant-  (vars (ticket mesg) (a-ks-lt k b-ks-lt b-ks-lt-0 skey)-    (n t t-prime l t-0 l-0 text) (a b ks a-0 b-0 ks-0 name))-  (defstrand init 4 (ticket ticket) (a-ks-lt a-ks-lt) (k k) (t t) (n n)-    (t-prime t-prime) (l l) (a a) (b b) (ks ks))-  (defstrand keyserver 2 (a-ks-lt a-ks-lt) (b-ks-lt b-ks-lt) (k k) (t t)-    (l l) (a a) (b b) (ks ks))-  (defstrand resp 2 (b-ks-lt b-ks-lt-0) (k k) (t t-0) (n n)-    (t-prime t-prime) (l l-0) (a a-0) (b b-0) (ks ks-0))-  (deflistener k)-  (precedes ((0 2) (2 0)) ((1 1) (0 1)) ((1 1) (3 0)) ((2 1) (0 3))-    ((3 1) (2 0)))-  (non-orig a-ks-lt b-ks-lt)-  (uniq-orig k n)-  (facts (long-term b ks b-ks-lt) (long-term a ks a-ks-lt))-  (rule guar-keyserver-2)-  (operation encryption-test (added-listener k) (enc a-0 t-0 n k) (2 0))-  (strand-map 0 1 2)-  (traces-    ((send (cat a b ks)) (recv (cat (enc t l k a b ks a-ks-lt) ticket))-      (send (cat (enc a t n k) ticket)) (recv (enc n t-prime k)))-    ((recv (cat a b ks))-      (send-        (cat (enc t l k a b ks a-ks-lt)-          (enc "ticket" t l k a b ks b-ks-lt))))-    ((recv-       (cat (enc a-0 t-0 n k)-         (enc "ticket" t-0 l-0 k a-0 b-0 ks-0 b-ks-lt-0)))-      (send (enc n t-prime k))) ((recv k) (send k)))-  (label 5)-  (parent 2)-  (unrealized (3 0))-  (dead)-  (comment "empty cohort"))--(defskeleton kerberos-variant-  (vars (ticket mesg) (a-ks-lt k b-ks-lt skey) (n t t-prime l text)-    (a b ks name))-  (defstrand init 4 (ticket ticket) (a-ks-lt a-ks-lt) (k k) (t t) (n n)-    (t-prime t-prime) (l l) (a a) (b b) (ks ks))-  (defstrand keyserver 2 (a-ks-lt a-ks-lt) (b-ks-lt b-ks-lt) (k k) (t t)-    (l l) (a a) (b b) (ks ks))-  (defstrand resp 2 (b-ks-lt b-ks-lt) (k k) (t t) (n n)-    (t-prime t-prime) (l l) (a a) (b b) (ks ks))-  (precedes ((0 2) (2 0)) ((1 1) (0 1)) ((2 1) (0 3)))-  (non-orig a-ks-lt b-ks-lt)-  (uniq-orig k n)-  (facts (long-term b ks b-ks-lt) (long-term a ks a-ks-lt))-  (rule guar-keyserver-2)-  (operation nonce-test-    (contracted (b-0 b) (ks-0 ks) (l-0 l) (b-ks-lt-0 b-ks-lt)) k (2 0)-    (enc "ticket" t l k a b ks b-ks-lt) (enc t l k a b ks a-ks-lt))-  (strand-map 0 1 2)-  (traces-    ((send (cat a b ks)) (recv (cat (enc t l k a b ks a-ks-lt) ticket))-      (send (cat (enc a t n k) ticket)) (recv (enc n t-prime k)))-    ((recv (cat a b ks))-      (send-        (cat (enc t l k a b ks a-ks-lt)-          (enc "ticket" t l k a b ks b-ks-lt))))-    ((recv (cat (enc a t n k) (enc "ticket" t l k a b ks b-ks-lt)))-      (send (enc n t-prime k))))-  (label 6)-  (parent 4)-  (realized)-  (shape)-  (maps-    ((0)-      ((a a) (b b) (ks ks) (n n) (a-ks-lt a-ks-lt) (t t)-        (t-prime t-prime) (l l) (k k) (ticket ticket))))-  (origs (k (1 1)) (n (0 2))))--(comment "Nothing left to do")--(defprotocol kerberos-variant basic-  (defrole init-    (vars (a b ks name) (t n t-prime l text) (a-ks-lt k skey)-      (ticket mesg))-    (trace (send (cat a b ks))-      (recv (cat (enc t l k a b ks a-ks-lt) ticket))-      (send (cat (enc a t n k) ticket)) (recv (enc n t-prime k))))-  (defrole resp-    (vars (a b ks name) (t n t-prime l text) (b-ks-lt k skey))-    (trace-      (recv (cat (enc a t n k) (enc "ticket" t l k a b ks b-ks-lt)))-      (send (enc n t-prime k))))-  (defrole keyserver-    (vars (a b ks name) (t l text) (a-ks-lt b-ks-lt k skey))-    (trace (recv (cat a b ks))-      (send-        (cat (enc t l k a b ks a-ks-lt)-          (enc "ticket" t l k a b ks b-ks-lt))))-    (uniq-orig k))-  (defrule long-term-key-non-    (forall ((p ks name) (k-lt skey))-      (implies (fact long-term p ks k-lt) (non k-lt))))-  (defrule guar-keyserver-2-    (forall-      ((z strd) (b-ks-lt skey) (b name) (a-ks-lt skey) (ks a name))-      (implies-        (and (p "keyserver" z (idx 2)) (p "keyserver" "a" z a)-          (p "keyserver" "ks" z ks) (p "keyserver" "a-ks-lt" z a-ks-lt)-          (p "keyserver" "b" z b) (p "keyserver" "b-ks-lt" z b-ks-lt))-        (and (fact long-term a ks a-ks-lt)-          (fact long-term b ks b-ks-lt)))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false)))))--(defskeleton kerberos-variant-  (vars (b-ks-lt k skey) (t n t-prime l text) (a b ks name))-  (defstrand resp 2 (b-ks-lt b-ks-lt) (k k) (t t) (n n)-    (t-prime t-prime) (l l) (a a) (b b) (ks ks))-  (non-orig b-ks-lt)-  (traces-    ((recv (cat (enc a t n k) (enc "ticket" t l k a b ks b-ks-lt)))-      (send (enc n t-prime k))))-  (label 7)-  (unrealized (0 0))-  (origs)-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton kerberos-variant-  (vars (b-ks-lt k a-ks-lt skey) (t n t-prime l text) (a b ks name))-  (defstrand resp 2 (b-ks-lt b-ks-lt) (k k) (t t) (n n)-    (t-prime t-prime) (l l) (a a) (b b) (ks ks))-  (defstrand keyserver 2 (a-ks-lt a-ks-lt) (b-ks-lt b-ks-lt) (k k) (t t)-    (l l) (a a) (b b) (ks ks))-  (precedes ((1 1) (0 0)))-  (non-orig b-ks-lt a-ks-lt)-  (uniq-orig k)-  (facts (long-term b ks b-ks-lt) (long-term a ks a-ks-lt))-  (rule guar-keyserver-2 long-term-key-non)-  (operation encryption-test (added-strand keyserver 2)-    (enc "ticket" t l k a b ks b-ks-lt) (0 0))-  (strand-map 0)-  (traces-    ((recv (cat (enc a t n k) (enc "ticket" t l k a b ks b-ks-lt)))-      (send (enc n t-prime k)))-    ((recv (cat a b ks))-      (send-        (cat (enc t l k a b ks a-ks-lt)-          (enc "ticket" t l k a b ks b-ks-lt)))))-  (label 8)-  (parent 7)-  (unrealized (0 0))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton kerberos-variant-  (vars (ticket mesg) (b-ks-lt k a-ks-lt a-ks-lt-0 skey)-    (t n t-prime l l-0 text) (a b ks b-0 ks-0 name))-  (defstrand resp 2 (b-ks-lt b-ks-lt) (k k) (t t) (n n)-    (t-prime t-prime) (l l) (a a) (b b) (ks ks))-  (defstrand keyserver 2 (a-ks-lt a-ks-lt) (b-ks-lt b-ks-lt) (k k) (t t)-    (l l) (a a) (b b) (ks ks))-  (defstrand init 3 (ticket ticket) (a-ks-lt a-ks-lt-0) (k k) (t t)-    (n n) (l l-0) (a a) (b b-0) (ks ks-0))-  (precedes ((1 1) (2 1)) ((2 2) (0 0)))-  (non-orig b-ks-lt a-ks-lt)-  (uniq-orig k)-  (facts (long-term b ks b-ks-lt) (long-term a ks a-ks-lt))-  (rule guar-keyserver-2)-  (operation encryption-test (added-strand init 3) (enc a t n k) (0 0))-  (strand-map 0 1)-  (traces-    ((recv (cat (enc a t n k) (enc "ticket" t l k a b ks b-ks-lt)))-      (send (enc n t-prime k)))-    ((recv (cat a b ks))-      (send-        (cat (enc t l k a b ks a-ks-lt)-          (enc "ticket" t l k a b ks b-ks-lt))))-    ((send (cat a b-0 ks-0))-      (recv (cat (enc t l-0 k a b-0 ks-0 a-ks-lt-0) ticket))-      (send (cat (enc a t n k) ticket))))-  (label 9)-  (parent 8)-  (unrealized (2 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton kerberos-variant-  (vars (b-ks-lt k a-ks-lt skey) (t n t-prime l text) (a b ks name))-  (defstrand resp 2 (b-ks-lt b-ks-lt) (k k) (t t) (n n)-    (t-prime t-prime) (l l) (a a) (b b) (ks ks))-  (defstrand keyserver 2 (a-ks-lt a-ks-lt) (b-ks-lt b-ks-lt) (k k) (t t)-    (l l) (a a) (b b) (ks ks))-  (deflistener k)-  (precedes ((1 1) (2 0)) ((2 1) (0 0)))-  (non-orig b-ks-lt a-ks-lt)-  (uniq-orig k)-  (facts (long-term b ks b-ks-lt) (long-term a ks a-ks-lt))-  (rule guar-keyserver-2)-  (operation encryption-test (added-listener k) (enc a t n k) (0 0))-  (strand-map 0 1)-  (traces-    ((recv (cat (enc a t n k) (enc "ticket" t l k a b ks b-ks-lt)))-      (send (enc n t-prime k)))-    ((recv (cat a b ks))-      (send-        (cat (enc t l k a b ks a-ks-lt)-          (enc "ticket" t l k a b ks b-ks-lt)))) ((recv k) (send k)))-  (label 10)-  (parent 8)-  (unrealized (2 0))-  (dead)-  (comment "empty cohort"))--(defskeleton kerberos-variant-  (vars (ticket mesg) (b-ks-lt k a-ks-lt skey) (t n t-prime l text)-    (a b ks name))-  (defstrand resp 2 (b-ks-lt b-ks-lt) (k k) (t t) (n n)-    (t-prime t-prime) (l l) (a a) (b b) (ks ks))-  (defstrand keyserver 2 (a-ks-lt a-ks-lt) (b-ks-lt b-ks-lt) (k k) (t t)-    (l l) (a a) (b b) (ks ks))-  (defstrand init 3 (ticket ticket) (a-ks-lt a-ks-lt) (k k) (t t) (n n)-    (l l) (a a) (b b) (ks ks))-  (precedes ((1 1) (2 1)) ((2 2) (0 0)))-  (non-orig b-ks-lt a-ks-lt)-  (uniq-orig k)-  (facts (long-term b ks b-ks-lt) (long-term a ks a-ks-lt))-  (rule guar-keyserver-2)-  (operation nonce-test-    (contracted (b-0 b) (ks-0 ks) (l-0 l) (a-ks-lt-0 a-ks-lt)) k (2 1)-    (enc "ticket" t l k a b ks b-ks-lt) (enc t l k a b ks a-ks-lt))-  (strand-map 0 1 2)-  (traces-    ((recv (cat (enc a t n k) (enc "ticket" t l k a b ks b-ks-lt)))-      (send (enc n t-prime k)))-    ((recv (cat a b ks))-      (send-        (cat (enc t l k a b ks a-ks-lt)-          (enc "ticket" t l k a b ks b-ks-lt))))-    ((send (cat a b ks)) (recv (cat (enc t l k a b ks a-ks-lt) ticket))-      (send (cat (enc a t n k) ticket))))-  (label 11)-  (parent 9)-  (realized)-  (shape)-  (maps-    ((0)-      ((a a) (b b) (ks ks) (b-ks-lt b-ks-lt) (t t) (n n)-        (t-prime t-prime) (l l) (k k))))-  (origs (k (1 1))))--(comment "Nothing left to do")--(defprotocol kerberos-variant basic-  (defrole init-    (vars (a b ks name) (t n t-prime l text) (a-ks-lt k skey)-      (ticket mesg))-    (trace (send (cat a b ks))-      (recv (cat (enc t l k a b ks a-ks-lt) ticket))-      (send (cat (enc a t n k) ticket)) (recv (enc n t-prime k))))-  (defrole resp-    (vars (a b ks name) (t n t-prime l text) (b-ks-lt k skey))-    (trace-      (recv (cat (enc a t n k) (enc "ticket" t l k a b ks b-ks-lt)))-      (send (enc n t-prime k))))-  (defrole keyserver-    (vars (a b ks name) (t l text) (a-ks-lt b-ks-lt k skey))-    (trace (recv (cat a b ks))-      (send-        (cat (enc t l k a b ks a-ks-lt)-          (enc "ticket" t l k a b ks b-ks-lt))))-    (uniq-orig k))-  (defrule long-term-key-non-    (forall ((p ks name) (k-lt skey))-      (implies (fact long-term p ks k-lt) (non k-lt))))-  (defrule guar-keyserver-2-    (forall-      ((z strd) (b-ks-lt skey) (b name) (a-ks-lt skey) (ks a name))-      (implies-        (and (p "keyserver" z (idx 2)) (p "keyserver" "a" z a)-          (p "keyserver" "ks" z ks) (p "keyserver" "a-ks-lt" z a-ks-lt)-          (p "keyserver" "b" z b) (p "keyserver" "b-ks-lt" z b-ks-lt))-        (and (fact long-term a ks a-ks-lt)-          (fact long-term b ks b-ks-lt)))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false)))))--(defskeleton kerberos-variant-  (vars (a-ks-lt b-ks-lt k skey) (t l text) (a b ks name))-  (defstrand keyserver 2 (a-ks-lt a-ks-lt) (b-ks-lt b-ks-lt) (k k) (t t)-    (l l) (a a) (b b) (ks ks))-  (non-orig a-ks-lt b-ks-lt)-  (uniq-orig k)-  (traces-    ((recv (cat a b ks))-      (send-        (cat (enc t l k a b ks a-ks-lt)-          (enc "ticket" t l k a b ks b-ks-lt)))))-  (label 12)-  (realized)-  (origs (k (0 1)))-  (comment "Not closed under rules"))--(defskeleton kerberos-variant-  (vars (a-ks-lt b-ks-lt k skey) (t l text) (a b ks name))-  (defstrand keyserver 2 (a-ks-lt a-ks-lt) (b-ks-lt b-ks-lt) (k k) (t t)-    (l l) (a a) (b b) (ks ks))-  (non-orig a-ks-lt b-ks-lt)-  (uniq-orig k)-  (facts (long-term b ks b-ks-lt) (long-term a ks a-ks-lt))-  (rule guar-keyserver-2)-  (traces-    ((recv (cat a b ks))-      (send-        (cat (enc t l k a b ks a-ks-lt)-          (enc "ticket" t l k a b ks b-ks-lt)))))-  (label 13)-  (parent 12)-  (realized)-  (shape)-  (maps-    ((0)-      ((a a) (b b) (ks ks) (a-ks-lt a-ks-lt) (b-ks-lt b-ks-lt) (t t)-        (l l) (k k))))-  (origs (k (0 1))))--(comment "Nothing left to do")
tst/kerberos.tst view
@@ -1,4 +1,4 @@-(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/kerberos.scm")  (defprotocol kerberos basic
tst/locn_envelope.tst view
@@ -1,7 +1,7 @@ (herald "Envelope Protocol, location-based version" (bound 30)   (limit 1200)) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/locn_envelope.scm") (comment "Step count limited to 1200") (comment "Strand count bounded at 30")
tst/mass.tst view
@@ -1,6 +1,6 @@ (herald mass (bound 8)) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/mass.lsp") (comment "Strand count bounded at 8")
tst/mass2.tst view
@@ -1,6 +1,6 @@ (herald mass2 (bound 8)) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/mass2.lsp") (comment "Strand count bounded at 8")
tst/missing_contraction.tst view
@@ -1,4 +1,4 @@-(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/missing_contraction.scm")  (defprotocol missing-contraction basic
tst/neq_test.tst view
@@ -2,7 +2,7 @@   (comment "First skeleton should have a shape,"     "second should be dead.")) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/neq_test.scm")  (defprotocol neq-test basic
− tst/neuman-stubblebine-alt.lisp 
@@ -1,36 +0,0 @@-;;; derived from the protocol description in the CPSA tst directory--(defprotocol neuman-stubblebine basic-  (defrole init-    (vars (a name) (b name) (ks name) (ra text) (rb text) (ltk-a-ks skey) (k skey) (tb text))-    (trace (send (cat a ra))-	   (recv (cat (enc (cat b ra k tb) ltk-a-ks) (enc (cat a k tb) (ltk b ks)) rb))-	   (send (cat (enc (cat a k tb) (ltk b ks)) (enc rb k)))))-  (defrole resp-    (vars (a name) (b name) (ks name) (ra text) (rb text) (k skey) (tb text))-    (trace (recv (cat a ra))-	   (send (cat b rb (enc (cat a ra tb) (ltk b ks))))-	   (recv (cat (enc (cat a k tb) (ltk b ks)) (enc rb k)))))-  (defrole keyserver-    (vars (a name) (b name) (ks name) (ra text) (rb text) (k skey) (tb text))-    (trace (recv (cat b rb (enc (cat a ra tb) (ltk b ks))))-	   (send (cat (enc (cat b ra k tb) (ltk a ks)) (enc (cat a k tb) (ltk b ks)) rb)))-    (uniq-orig k)))--(defskeleton neuman-stubblebine-  (vars (a name) (b name) (ks name) (ra text) (rb text))-  (defstrand init 3 (a a) (b b) (ks ks) (ra ra) (rb rb))-  (uniq-orig ra rb)-  (non-orig (ltk a ks) (ltk b ks)))--(defskeleton neuman-stubblebine-  (vars (a name) (b name) (ks name) (ra text) (rb text))-  (defstrand resp 3 (a a) (b b) (ks ks) (ra ra) (rb rb))-  (uniq-orig ra rb)-  (non-orig (ltk a ks) (ltk b ks)))--(defskeleton neuman-stubblebine-  (vars (a name) (b name) (ks name) (ra text) (rb text))-  (defstrand keyserver 2 (a a) (b b) (ks ks) (ra ra) (rb rb))-  (uniq-orig ra rb)-  (non-orig (ltk a ks) (ltk b ks)))
− tst/neuman-stubblebine-reauth-tagged.tst 
@@ -1,1491 +0,0 @@-(herald neuman-stubblebine-reauth (bound 8))--(comment "CPSA 4.4.4")-(comment "All input read from tst/neuman-stubblebine-reauth-tagged.lsp")-(comment "Strand count bounded at 8")--(defprotocol neuman-stubblebine-reauth basic-  (defrole init-    (vars (a b ks name) (ra rb text) (k skey) (tb text))-    (trace (send (cat a ra))-      (recv (cat (enc b ra k tb (ltk a ks)) (enc a k tb (ltk b ks)) rb))-      (send (cat (enc a k tb (ltk b ks)) (enc "one" rb k)))))-  (defrole resp-    (vars (a b ks name) (ra rb text) (k skey) (tb text))-    (trace (recv (cat a ra)) (send (cat b rb (enc a ra tb (ltk b ks))))-      (recv (cat (enc a k tb (ltk b ks)) (enc "one" rb k)))))-  (defrole init-reauth-    (vars (a b ks name) (ra-prime rb-prime text) (k skey) (tb text))-    (trace (recv (enc a k tb (ltk b ks)))-      (send (cat (enc a k tb (ltk b ks)) ra-prime))-      (recv (cat rb-prime (enc "two" ra-prime k)))-      (send (enc "three" rb-prime k))))-  (defrole resp-reauth-    (vars (a b ks name) (ra-prime rb-prime text) (k skey) (tb text))-    (trace (recv (cat (enc a k tb (ltk b ks)) ra-prime))-      (send (cat rb-prime (enc "two" ra-prime k)))-      (recv (enc "three" rb-prime k))))-  (defrole keyserver-    (vars (a b ks name) (ra rb text) (k skey) (tb text))-    (trace (recv (cat b rb (enc a ra tb (ltk b ks))))-      (send-        (cat (enc b ra k tb (ltk a ks)) (enc a k tb (ltk b ks)) rb)))-    (uniq-orig k))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false)))))--(defskeleton neuman-stubblebine-reauth-  (vars (k skey) (ra tb rb ra-prime rb-prime tb-0 text) (a b ks name))-  (defstrand resp 3 (k k) (ra ra) (rb rb) (tb tb) (a a) (b b) (ks ks))-  (defstrand resp-reauth 3 (k k) (ra-prime ra-prime) (rb-prime rb-prime)-    (tb tb-0) (a a) (b b) (ks ks))-  (non-orig (ltk a ks) (ltk b ks))-  (uniq-orig k ra rb ra-prime rb-prime)-  (traces-    ((recv (cat a ra)) (send (cat b rb (enc a ra tb (ltk b ks))))-      (recv (cat (enc a k tb (ltk b ks)) (enc "one" rb k))))-    ((recv (cat (enc a k tb-0 (ltk b ks)) ra-prime))-      (send (cat rb-prime (enc "two" ra-prime k)))-      (recv (enc "three" rb-prime k))))-  (label 0)-  (unrealized (0 2) (1 0))-  (origs (rb (0 1)) (rb-prime (1 1)))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton neuman-stubblebine-reauth-  (vars (k skey) (ra tb rb ra-prime rb-prime tb-0 ra-0 rb-0 text)-    (a b ks name))-  (defstrand resp 3 (k k) (ra ra) (rb rb) (tb tb) (a a) (b b) (ks ks))-  (defstrand resp-reauth 3 (k k) (ra-prime ra-prime) (rb-prime rb-prime)-    (tb tb-0) (a a) (b b) (ks ks))-  (defstrand keyserver 2 (k k) (ra ra-0) (rb rb-0) (tb tb-0) (a a) (b b)-    (ks ks))-  (precedes ((2 1) (0 2)) ((2 1) (1 0)))-  (non-orig (ltk a ks) (ltk b ks))-  (uniq-orig k ra rb ra-prime rb-prime)-  (operation encryption-test (added-strand keyserver 2)-    (enc a k tb-0 (ltk b ks)) (1 0))-  (strand-map 0 1)-  (traces-    ((recv (cat a ra)) (send (cat b rb (enc a ra tb (ltk b ks))))-      (recv (cat (enc a k tb (ltk b ks)) (enc "one" rb k))))-    ((recv (cat (enc a k tb-0 (ltk b ks)) ra-prime))-      (send (cat rb-prime (enc "two" ra-prime k)))-      (recv (enc "three" rb-prime k)))-    ((recv (cat b rb-0 (enc a ra-0 tb-0 (ltk b ks))))-      (send-        (cat (enc b ra-0 k tb-0 (ltk a ks)) (enc a k tb-0 (ltk b ks))-          rb-0))))-  (label 1)-  (parent 0)-  (unrealized (0 2) (1 2) (2 0))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton neuman-stubblebine-reauth-  (vars (k skey) (ra tb rb ra-prime rb-prime rb-0 text) (a b ks name))-  (defstrand resp 3 (k k) (ra ra) (rb rb) (tb tb) (a a) (b b) (ks ks))-  (defstrand resp-reauth 3 (k k) (ra-prime ra-prime) (rb-prime rb-prime)-    (tb tb) (a a) (b b) (ks ks))-  (defstrand keyserver 2 (k k) (ra ra) (rb rb-0) (tb tb) (a a) (b b)-    (ks ks))-  (precedes ((0 1) (2 0)) ((2 1) (0 2)) ((2 1) (1 0)))-  (non-orig (ltk a ks) (ltk b ks))-  (uniq-orig k ra rb ra-prime rb-prime)-  (operation encryption-test (displaced 3 0 resp 2)-    (enc a ra-0 tb-0 (ltk b ks)) (2 0))-  (strand-map 0 1 2)-  (traces-    ((recv (cat a ra)) (send (cat b rb (enc a ra tb (ltk b ks))))-      (recv (cat (enc a k tb (ltk b ks)) (enc "one" rb k))))-    ((recv (cat (enc a k tb (ltk b ks)) ra-prime))-      (send (cat rb-prime (enc "two" ra-prime k)))-      (recv (enc "three" rb-prime k)))-    ((recv (cat b rb-0 (enc a ra tb (ltk b ks))))-      (send-        (cat (enc b ra k tb (ltk a ks)) (enc a k tb (ltk b ks)) rb-0))))-  (label 2)-  (parent 1)-  (unrealized (0 2) (1 2))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton neuman-stubblebine-reauth-  (vars (k skey) (ra tb rb ra-prime rb-prime tb-0 ra-0 rb-0 rb-1 text)-    (a b ks name))-  (defstrand resp 3 (k k) (ra ra) (rb rb) (tb tb) (a a) (b b) (ks ks))-  (defstrand resp-reauth 3 (k k) (ra-prime ra-prime) (rb-prime rb-prime)-    (tb tb-0) (a a) (b b) (ks ks))-  (defstrand keyserver 2 (k k) (ra ra-0) (rb rb-0) (tb tb-0) (a a) (b b)-    (ks ks))-  (defstrand resp 2 (ra ra-0) (rb rb-1) (tb tb-0) (a a) (b b) (ks ks))-  (precedes ((2 1) (0 2)) ((2 1) (1 0)) ((3 1) (2 0)))-  (non-orig (ltk a ks) (ltk b ks))-  (uniq-orig k ra rb ra-prime rb-prime)-  (operation encryption-test (added-strand resp 2)-    (enc a ra-0 tb-0 (ltk b ks)) (2 0))-  (strand-map 0 1 2)-  (traces-    ((recv (cat a ra)) (send (cat b rb (enc a ra tb (ltk b ks))))-      (recv (cat (enc a k tb (ltk b ks)) (enc "one" rb k))))-    ((recv (cat (enc a k tb-0 (ltk b ks)) ra-prime))-      (send (cat rb-prime (enc "two" ra-prime k)))-      (recv (enc "three" rb-prime k)))-    ((recv (cat b rb-0 (enc a ra-0 tb-0 (ltk b ks))))-      (send-        (cat (enc b ra-0 k tb-0 (ltk a ks)) (enc a k tb-0 (ltk b ks))-          rb-0)))-    ((recv (cat a ra-0))-      (send (cat b rb-1 (enc a ra-0 tb-0 (ltk b ks))))))-  (label 3)-  (parent 1)-  (unrealized (0 2) (1 2))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton neuman-stubblebine-reauth-  (vars (k skey) (ra tb rb ra-prime rb-prime rb-0 ra-prime-0 tb-0 text)-    (a b ks a-0 b-0 ks-0 name))-  (defstrand resp 3 (k k) (ra ra) (rb rb) (tb tb) (a a) (b b) (ks ks))-  (defstrand resp-reauth 3 (k k) (ra-prime ra-prime) (rb-prime rb-prime)-    (tb tb) (a a) (b b) (ks ks))-  (defstrand keyserver 2 (k k) (ra ra) (rb rb-0) (tb tb) (a a) (b b)-    (ks ks))-  (defstrand init-reauth 4 (k k) (ra-prime ra-prime-0)-    (rb-prime rb-prime) (tb tb-0) (a a-0) (b b-0) (ks ks-0))-  (precedes ((0 1) (2 0)) ((1 1) (3 2)) ((2 1) (0 2)) ((2 1) (1 0))-    ((2 1) (3 0)) ((3 3) (1 2)))-  (non-orig (ltk a ks) (ltk b ks))-  (uniq-orig k ra rb ra-prime rb-prime)-  (operation encryption-test (added-strand init-reauth 4)-    (enc "three" rb-prime k) (1 2))-  (strand-map 0 1 2)-  (traces-    ((recv (cat a ra)) (send (cat b rb (enc a ra tb (ltk b ks))))-      (recv (cat (enc a k tb (ltk b ks)) (enc "one" rb k))))-    ((recv (cat (enc a k tb (ltk b ks)) ra-prime))-      (send (cat rb-prime (enc "two" ra-prime k)))-      (recv (enc "three" rb-prime k)))-    ((recv (cat b rb-0 (enc a ra tb (ltk b ks))))-      (send-        (cat (enc b ra k tb (ltk a ks)) (enc a k tb (ltk b ks)) rb-0)))-    ((recv (enc a-0 k tb-0 (ltk b-0 ks-0)))-      (send (cat (enc a-0 k tb-0 (ltk b-0 ks-0)) ra-prime-0))-      (recv (cat rb-prime (enc "two" ra-prime-0 k)))-      (send (enc "three" rb-prime k))))-  (label 4)-  (parent 2)-  (unrealized (0 2) (3 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton neuman-stubblebine-reauth-  (vars (k skey) (ra tb rb ra-prime rb-prime rb-0 text) (a b ks name))-  (defstrand resp 3 (k k) (ra ra) (rb rb) (tb tb) (a a) (b b) (ks ks))-  (defstrand resp-reauth 3 (k k) (ra-prime ra-prime) (rb-prime rb-prime)-    (tb tb) (a a) (b b) (ks ks))-  (defstrand keyserver 2 (k k) (ra ra) (rb rb-0) (tb tb) (a a) (b b)-    (ks ks))-  (deflistener k)-  (precedes ((0 1) (2 0)) ((2 1) (0 2)) ((2 1) (1 0)) ((2 1) (3 0))-    ((3 1) (1 2)))-  (non-orig (ltk a ks) (ltk b ks))-  (uniq-orig k ra rb ra-prime rb-prime)-  (operation encryption-test (added-listener k) (enc "three" rb-prime k)-    (1 2))-  (strand-map 0 1 2)-  (traces-    ((recv (cat a ra)) (send (cat b rb (enc a ra tb (ltk b ks))))-      (recv (cat (enc a k tb (ltk b ks)) (enc "one" rb k))))-    ((recv (cat (enc a k tb (ltk b ks)) ra-prime))-      (send (cat rb-prime (enc "two" ra-prime k)))-      (recv (enc "three" rb-prime k)))-    ((recv (cat b rb-0 (enc a ra tb (ltk b ks))))-      (send-        (cat (enc b ra k tb (ltk a ks)) (enc a k tb (ltk b ks)) rb-0)))-    ((recv k) (send k)))-  (label 5)-  (parent 2)-  (unrealized (0 2) (3 0))-  (dead)-  (comment "empty cohort"))--(defskeleton neuman-stubblebine-reauth-  (vars (k skey)-    (ra tb rb ra-prime rb-prime tb-0 ra-0 rb-0 rb-1 ra-prime-0 tb-1-      text) (a b ks a-0 b-0 ks-0 name))-  (defstrand resp 3 (k k) (ra ra) (rb rb) (tb tb) (a a) (b b) (ks ks))-  (defstrand resp-reauth 3 (k k) (ra-prime ra-prime) (rb-prime rb-prime)-    (tb tb-0) (a a) (b b) (ks ks))-  (defstrand keyserver 2 (k k) (ra ra-0) (rb rb-0) (tb tb-0) (a a) (b b)-    (ks ks))-  (defstrand resp 2 (ra ra-0) (rb rb-1) (tb tb-0) (a a) (b b) (ks ks))-  (defstrand init-reauth 4 (k k) (ra-prime ra-prime-0)-    (rb-prime rb-prime) (tb tb-1) (a a-0) (b b-0) (ks ks-0))-  (precedes ((1 1) (4 2)) ((2 1) (0 2)) ((2 1) (1 0)) ((2 1) (4 0))-    ((3 1) (2 0)) ((4 3) (1 2)))-  (non-orig (ltk a ks) (ltk b ks))-  (uniq-orig k ra rb ra-prime rb-prime)-  (operation encryption-test (added-strand init-reauth 4)-    (enc "three" rb-prime k) (1 2))-  (strand-map 0 1 2 3)-  (traces-    ((recv (cat a ra)) (send (cat b rb (enc a ra tb (ltk b ks))))-      (recv (cat (enc a k tb (ltk b ks)) (enc "one" rb k))))-    ((recv (cat (enc a k tb-0 (ltk b ks)) ra-prime))-      (send (cat rb-prime (enc "two" ra-prime k)))-      (recv (enc "three" rb-prime k)))-    ((recv (cat b rb-0 (enc a ra-0 tb-0 (ltk b ks))))-      (send-        (cat (enc b ra-0 k tb-0 (ltk a ks)) (enc a k tb-0 (ltk b ks))-          rb-0)))-    ((recv (cat a ra-0))-      (send (cat b rb-1 (enc a ra-0 tb-0 (ltk b ks)))))-    ((recv (enc a-0 k tb-1 (ltk b-0 ks-0)))-      (send (cat (enc a-0 k tb-1 (ltk b-0 ks-0)) ra-prime-0))-      (recv (cat rb-prime (enc "two" ra-prime-0 k)))-      (send (enc "three" rb-prime k))))-  (label 6)-  (parent 3)-  (unrealized (0 2) (4 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton neuman-stubblebine-reauth-  (vars (k skey) (ra tb rb ra-prime rb-prime tb-0 ra-0 rb-0 rb-1 text)-    (a b ks name))-  (defstrand resp 3 (k k) (ra ra) (rb rb) (tb tb) (a a) (b b) (ks ks))-  (defstrand resp-reauth 3 (k k) (ra-prime ra-prime) (rb-prime rb-prime)-    (tb tb-0) (a a) (b b) (ks ks))-  (defstrand keyserver 2 (k k) (ra ra-0) (rb rb-0) (tb tb-0) (a a) (b b)-    (ks ks))-  (defstrand resp 2 (ra ra-0) (rb rb-1) (tb tb-0) (a a) (b b) (ks ks))-  (deflistener k)-  (precedes ((2 1) (0 2)) ((2 1) (1 0)) ((2 1) (4 0)) ((3 1) (2 0))-    ((4 1) (1 2)))-  (non-orig (ltk a ks) (ltk b ks))-  (uniq-orig k ra rb ra-prime rb-prime)-  (operation encryption-test (added-listener k) (enc "three" rb-prime k)-    (1 2))-  (strand-map 0 1 2 3)-  (traces-    ((recv (cat a ra)) (send (cat b rb (enc a ra tb (ltk b ks))))-      (recv (cat (enc a k tb (ltk b ks)) (enc "one" rb k))))-    ((recv (cat (enc a k tb-0 (ltk b ks)) ra-prime))-      (send (cat rb-prime (enc "two" ra-prime k)))-      (recv (enc "three" rb-prime k)))-    ((recv (cat b rb-0 (enc a ra-0 tb-0 (ltk b ks))))-      (send-        (cat (enc b ra-0 k tb-0 (ltk a ks)) (enc a k tb-0 (ltk b ks))-          rb-0)))-    ((recv (cat a ra-0))-      (send (cat b rb-1 (enc a ra-0 tb-0 (ltk b ks)))))-    ((recv k) (send k)))-  (label 7)-  (parent 3)-  (unrealized (0 2) (4 0))-  (dead)-  (comment "empty cohort"))--(defskeleton neuman-stubblebine-reauth-  (vars (k skey) (ra tb rb ra-prime rb-prime rb-0 ra-prime-0 text)-    (a b ks name))-  (defstrand resp 3 (k k) (ra ra) (rb rb) (tb tb) (a a) (b b) (ks ks))-  (defstrand resp-reauth 3 (k k) (ra-prime ra-prime) (rb-prime rb-prime)-    (tb tb) (a a) (b b) (ks ks))-  (defstrand keyserver 2 (k k) (ra ra) (rb rb-0) (tb tb) (a a) (b b)-    (ks ks))-  (defstrand init-reauth 4 (k k) (ra-prime ra-prime-0)-    (rb-prime rb-prime) (tb tb) (a a) (b b) (ks ks))-  (precedes ((0 1) (2 0)) ((1 1) (3 2)) ((2 1) (0 2)) ((2 1) (1 0))-    ((2 1) (3 0)) ((3 3) (1 2)))-  (non-orig (ltk a ks) (ltk b ks))-  (uniq-orig k ra rb ra-prime rb-prime)-  (operation nonce-test (contracted (a-0 a) (b-0 b) (ks-0 ks) (tb-0 tb))-    k (3 0) (enc a k tb (ltk b ks)) (enc b ra k tb (ltk a ks)))-  (strand-map 0 1 2 3)-  (traces-    ((recv (cat a ra)) (send (cat b rb (enc a ra tb (ltk b ks))))-      (recv (cat (enc a k tb (ltk b ks)) (enc "one" rb k))))-    ((recv (cat (enc a k tb (ltk b ks)) ra-prime))-      (send (cat rb-prime (enc "two" ra-prime k)))-      (recv (enc "three" rb-prime k)))-    ((recv (cat b rb-0 (enc a ra tb (ltk b ks))))-      (send-        (cat (enc b ra k tb (ltk a ks)) (enc a k tb (ltk b ks)) rb-0)))-    ((recv (enc a k tb (ltk b ks)))-      (send (cat (enc a k tb (ltk b ks)) ra-prime-0))-      (recv (cat rb-prime (enc "two" ra-prime-0 k)))-      (send (enc "three" rb-prime k))))-  (label 8)-  (parent 4)-  (unrealized (0 2) (3 2))-  (comment "3 in cohort - 3 not yet seen"))--(defskeleton neuman-stubblebine-reauth-  (vars (k skey)-    (ra tb rb ra-prime rb-prime tb-0 ra-0 rb-0 rb-1 ra-prime-0 text)-    (a b ks name))-  (defstrand resp 3 (k k) (ra ra) (rb rb) (tb tb) (a a) (b b) (ks ks))-  (defstrand resp-reauth 3 (k k) (ra-prime ra-prime) (rb-prime rb-prime)-    (tb tb-0) (a a) (b b) (ks ks))-  (defstrand keyserver 2 (k k) (ra ra-0) (rb rb-0) (tb tb-0) (a a) (b b)-    (ks ks))-  (defstrand resp 2 (ra ra-0) (rb rb-1) (tb tb-0) (a a) (b b) (ks ks))-  (defstrand init-reauth 4 (k k) (ra-prime ra-prime-0)-    (rb-prime rb-prime) (tb tb-0) (a a) (b b) (ks ks))-  (precedes ((1 1) (4 2)) ((2 1) (0 2)) ((2 1) (1 0)) ((2 1) (4 0))-    ((3 1) (2 0)) ((4 3) (1 2)))-  (non-orig (ltk a ks) (ltk b ks))-  (uniq-orig k ra rb ra-prime rb-prime)-  (operation nonce-test-    (contracted (a-0 a) (b-0 b) (ks-0 ks) (tb-1 tb-0)) k (4 0)-    (enc a k tb-0 (ltk b ks)) (enc b ra-0 k tb-0 (ltk a ks)))-  (strand-map 0 1 2 3 4)-  (traces-    ((recv (cat a ra)) (send (cat b rb (enc a ra tb (ltk b ks))))-      (recv (cat (enc a k tb (ltk b ks)) (enc "one" rb k))))-    ((recv (cat (enc a k tb-0 (ltk b ks)) ra-prime))-      (send (cat rb-prime (enc "two" ra-prime k)))-      (recv (enc "three" rb-prime k)))-    ((recv (cat b rb-0 (enc a ra-0 tb-0 (ltk b ks))))-      (send-        (cat (enc b ra-0 k tb-0 (ltk a ks)) (enc a k tb-0 (ltk b ks))-          rb-0)))-    ((recv (cat a ra-0))-      (send (cat b rb-1 (enc a ra-0 tb-0 (ltk b ks)))))-    ((recv (enc a k tb-0 (ltk b ks)))-      (send (cat (enc a k tb-0 (ltk b ks)) ra-prime-0))-      (recv (cat rb-prime (enc "two" ra-prime-0 k)))-      (send (enc "three" rb-prime k))))-  (label 9)-  (parent 6)-  (unrealized (0 2) (4 2))-  (comment "3 in cohort - 3 not yet seen"))--(defskeleton neuman-stubblebine-reauth-  (vars (k skey) (ra tb rb ra-prime rb-prime rb-0 text) (a b ks name))-  (defstrand resp 3 (k k) (ra ra) (rb rb) (tb tb) (a a) (b b) (ks ks))-  (defstrand resp-reauth 3 (k k) (ra-prime ra-prime) (rb-prime rb-prime)-    (tb tb) (a a) (b b) (ks ks))-  (defstrand keyserver 2 (k k) (ra ra) (rb rb-0) (tb tb) (a a) (b b)-    (ks ks))-  (defstrand init-reauth 4 (k k) (ra-prime ra-prime) (rb-prime rb-prime)-    (tb tb) (a a) (b b) (ks ks))-  (precedes ((0 1) (2 0)) ((1 1) (3 2)) ((2 1) (0 2)) ((2 1) (3 0))-    ((3 1) (1 0)) ((3 3) (1 2)))-  (non-orig (ltk a ks) (ltk b ks))-  (uniq-orig k ra rb ra-prime rb-prime)-  (operation encryption-test (displaced 4 1 resp-reauth 2)-    (enc "two" ra-prime-0 k) (3 2))-  (strand-map 0 1 2 3)-  (traces-    ((recv (cat a ra)) (send (cat b rb (enc a ra tb (ltk b ks))))-      (recv (cat (enc a k tb (ltk b ks)) (enc "one" rb k))))-    ((recv (cat (enc a k tb (ltk b ks)) ra-prime))-      (send (cat rb-prime (enc "two" ra-prime k)))-      (recv (enc "three" rb-prime k)))-    ((recv (cat b rb-0 (enc a ra tb (ltk b ks))))-      (send-        (cat (enc b ra k tb (ltk a ks)) (enc a k tb (ltk b ks)) rb-0)))-    ((recv (enc a k tb (ltk b ks)))-      (send (cat (enc a k tb (ltk b ks)) ra-prime))-      (recv (cat rb-prime (enc "two" ra-prime k)))-      (send (enc "three" rb-prime k))))-  (label 10)-  (parent 8)-  (unrealized (0 2))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton neuman-stubblebine-reauth-  (vars (k skey)-    (ra tb rb ra-prime rb-prime rb-0 ra-prime-0 rb-prime-0 tb-0 text)-    (a b ks a-0 b-0 ks-0 name))-  (defstrand resp 3 (k k) (ra ra) (rb rb) (tb tb) (a a) (b b) (ks ks))-  (defstrand resp-reauth 3 (k k) (ra-prime ra-prime) (rb-prime rb-prime)-    (tb tb) (a a) (b b) (ks ks))-  (defstrand keyserver 2 (k k) (ra ra) (rb rb-0) (tb tb) (a a) (b b)-    (ks ks))-  (defstrand init-reauth 4 (k k) (ra-prime ra-prime-0)-    (rb-prime rb-prime) (tb tb) (a a) (b b) (ks ks))-  (defstrand resp-reauth 2 (k k) (ra-prime ra-prime-0)-    (rb-prime rb-prime-0) (tb tb-0) (a a-0) (b b-0) (ks ks-0))-  (precedes ((0 1) (2 0)) ((1 1) (3 2)) ((2 1) (0 2)) ((2 1) (1 0))-    ((2 1) (3 0)) ((2 1) (4 0)) ((3 3) (1 2)) ((4 1) (3 2)))-  (non-orig (ltk a ks) (ltk b ks))-  (uniq-orig k ra rb ra-prime rb-prime)-  (operation encryption-test (added-strand resp-reauth 2)-    (enc "two" ra-prime-0 k) (3 2))-  (strand-map 0 1 2 3)-  (traces-    ((recv (cat a ra)) (send (cat b rb (enc a ra tb (ltk b ks))))-      (recv (cat (enc a k tb (ltk b ks)) (enc "one" rb k))))-    ((recv (cat (enc a k tb (ltk b ks)) ra-prime))-      (send (cat rb-prime (enc "two" ra-prime k)))-      (recv (enc "three" rb-prime k)))-    ((recv (cat b rb-0 (enc a ra tb (ltk b ks))))-      (send-        (cat (enc b ra k tb (ltk a ks)) (enc a k tb (ltk b ks)) rb-0)))-    ((recv (enc a k tb (ltk b ks)))-      (send (cat (enc a k tb (ltk b ks)) ra-prime-0))-      (recv (cat rb-prime (enc "two" ra-prime-0 k)))-      (send (enc "three" rb-prime k)))-    ((recv (cat (enc a-0 k tb-0 (ltk b-0 ks-0)) ra-prime-0))-      (send (cat rb-prime-0 (enc "two" ra-prime-0 k)))))-  (label 11)-  (parent 8)-  (unrealized (0 2) (4 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton neuman-stubblebine-reauth-  (vars (k skey) (ra tb rb ra-prime rb-prime rb-0 ra-prime-0 text)-    (a b ks name))-  (defstrand resp 3 (k k) (ra ra) (rb rb) (tb tb) (a a) (b b) (ks ks))-  (defstrand resp-reauth 3 (k k) (ra-prime ra-prime) (rb-prime rb-prime)-    (tb tb) (a a) (b b) (ks ks))-  (defstrand keyserver 2 (k k) (ra ra) (rb rb-0) (tb tb) (a a) (b b)-    (ks ks))-  (defstrand init-reauth 4 (k k) (ra-prime ra-prime-0)-    (rb-prime rb-prime) (tb tb) (a a) (b b) (ks ks))-  (deflistener k)-  (precedes ((0 1) (2 0)) ((1 1) (3 2)) ((2 1) (0 2)) ((2 1) (1 0))-    ((2 1) (3 0)) ((2 1) (4 0)) ((3 3) (1 2)) ((4 1) (3 2)))-  (non-orig (ltk a ks) (ltk b ks))-  (uniq-orig k ra rb ra-prime rb-prime)-  (operation encryption-test (added-listener k) (enc "two" ra-prime-0 k)-    (3 2))-  (strand-map 0 1 2 3)-  (traces-    ((recv (cat a ra)) (send (cat b rb (enc a ra tb (ltk b ks))))-      (recv (cat (enc a k tb (ltk b ks)) (enc "one" rb k))))-    ((recv (cat (enc a k tb (ltk b ks)) ra-prime))-      (send (cat rb-prime (enc "two" ra-prime k)))-      (recv (enc "three" rb-prime k)))-    ((recv (cat b rb-0 (enc a ra tb (ltk b ks))))-      (send-        (cat (enc b ra k tb (ltk a ks)) (enc a k tb (ltk b ks)) rb-0)))-    ((recv (enc a k tb (ltk b ks)))-      (send (cat (enc a k tb (ltk b ks)) ra-prime-0))-      (recv (cat rb-prime (enc "two" ra-prime-0 k)))-      (send (enc "three" rb-prime k))) ((recv k) (send k)))-  (label 12)-  (parent 8)-  (unrealized (0 2) (4 0))-  (dead)-  (comment "empty cohort"))--(defskeleton neuman-stubblebine-reauth-  (vars (k skey) (ra tb rb ra-prime rb-prime tb-0 ra-0 rb-0 rb-1 text)-    (a b ks name))-  (defstrand resp 3 (k k) (ra ra) (rb rb) (tb tb) (a a) (b b) (ks ks))-  (defstrand resp-reauth 3 (k k) (ra-prime ra-prime) (rb-prime rb-prime)-    (tb tb-0) (a a) (b b) (ks ks))-  (defstrand keyserver 2 (k k) (ra ra-0) (rb rb-0) (tb tb-0) (a a) (b b)-    (ks ks))-  (defstrand resp 2 (ra ra-0) (rb rb-1) (tb tb-0) (a a) (b b) (ks ks))-  (defstrand init-reauth 4 (k k) (ra-prime ra-prime) (rb-prime rb-prime)-    (tb tb-0) (a a) (b b) (ks ks))-  (precedes ((1 1) (4 2)) ((2 1) (0 2)) ((2 1) (4 0)) ((3 1) (2 0))-    ((4 1) (1 0)) ((4 3) (1 2)))-  (non-orig (ltk a ks) (ltk b ks))-  (uniq-orig k ra rb ra-prime rb-prime)-  (operation encryption-test (displaced 5 1 resp-reauth 2)-    (enc "two" ra-prime-0 k) (4 2))-  (strand-map 0 1 2 3 4)-  (traces-    ((recv (cat a ra)) (send (cat b rb (enc a ra tb (ltk b ks))))-      (recv (cat (enc a k tb (ltk b ks)) (enc "one" rb k))))-    ((recv (cat (enc a k tb-0 (ltk b ks)) ra-prime))-      (send (cat rb-prime (enc "two" ra-prime k)))-      (recv (enc "three" rb-prime k)))-    ((recv (cat b rb-0 (enc a ra-0 tb-0 (ltk b ks))))-      (send-        (cat (enc b ra-0 k tb-0 (ltk a ks)) (enc a k tb-0 (ltk b ks))-          rb-0)))-    ((recv (cat a ra-0))-      (send (cat b rb-1 (enc a ra-0 tb-0 (ltk b ks)))))-    ((recv (enc a k tb-0 (ltk b ks)))-      (send (cat (enc a k tb-0 (ltk b ks)) ra-prime))-      (recv (cat rb-prime (enc "two" ra-prime k)))-      (send (enc "three" rb-prime k))))-  (label 13)-  (parent 9)-  (unrealized (0 2))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton neuman-stubblebine-reauth-  (vars (k skey)-    (ra tb rb ra-prime rb-prime tb-0 ra-0 rb-0 rb-1 ra-prime-0-      rb-prime-0 tb-1 text) (a b ks a-0 b-0 ks-0 name))-  (defstrand resp 3 (k k) (ra ra) (rb rb) (tb tb) (a a) (b b) (ks ks))-  (defstrand resp-reauth 3 (k k) (ra-prime ra-prime) (rb-prime rb-prime)-    (tb tb-0) (a a) (b b) (ks ks))-  (defstrand keyserver 2 (k k) (ra ra-0) (rb rb-0) (tb tb-0) (a a) (b b)-    (ks ks))-  (defstrand resp 2 (ra ra-0) (rb rb-1) (tb tb-0) (a a) (b b) (ks ks))-  (defstrand init-reauth 4 (k k) (ra-prime ra-prime-0)-    (rb-prime rb-prime) (tb tb-0) (a a) (b b) (ks ks))-  (defstrand resp-reauth 2 (k k) (ra-prime ra-prime-0)-    (rb-prime rb-prime-0) (tb tb-1) (a a-0) (b b-0) (ks ks-0))-  (precedes ((1 1) (4 2)) ((2 1) (0 2)) ((2 1) (1 0)) ((2 1) (4 0))-    ((2 1) (5 0)) ((3 1) (2 0)) ((4 3) (1 2)) ((5 1) (4 2)))-  (non-orig (ltk a ks) (ltk b ks))-  (uniq-orig k ra rb ra-prime rb-prime)-  (operation encryption-test (added-strand resp-reauth 2)-    (enc "two" ra-prime-0 k) (4 2))-  (strand-map 0 1 2 3 4)-  (traces-    ((recv (cat a ra)) (send (cat b rb (enc a ra tb (ltk b ks))))-      (recv (cat (enc a k tb (ltk b ks)) (enc "one" rb k))))-    ((recv (cat (enc a k tb-0 (ltk b ks)) ra-prime))-      (send (cat rb-prime (enc "two" ra-prime k)))-      (recv (enc "three" rb-prime k)))-    ((recv (cat b rb-0 (enc a ra-0 tb-0 (ltk b ks))))-      (send-        (cat (enc b ra-0 k tb-0 (ltk a ks)) (enc a k tb-0 (ltk b ks))-          rb-0)))-    ((recv (cat a ra-0))-      (send (cat b rb-1 (enc a ra-0 tb-0 (ltk b ks)))))-    ((recv (enc a k tb-0 (ltk b ks)))-      (send (cat (enc a k tb-0 (ltk b ks)) ra-prime-0))-      (recv (cat rb-prime (enc "two" ra-prime-0 k)))-      (send (enc "three" rb-prime k)))-    ((recv (cat (enc a-0 k tb-1 (ltk b-0 ks-0)) ra-prime-0))-      (send (cat rb-prime-0 (enc "two" ra-prime-0 k)))))-  (label 14)-  (parent 9)-  (unrealized (0 2) (5 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton neuman-stubblebine-reauth-  (vars (k skey)-    (ra tb rb ra-prime rb-prime tb-0 ra-0 rb-0 rb-1 ra-prime-0 text)-    (a b ks name))-  (defstrand resp 3 (k k) (ra ra) (rb rb) (tb tb) (a a) (b b) (ks ks))-  (defstrand resp-reauth 3 (k k) (ra-prime ra-prime) (rb-prime rb-prime)-    (tb tb-0) (a a) (b b) (ks ks))-  (defstrand keyserver 2 (k k) (ra ra-0) (rb rb-0) (tb tb-0) (a a) (b b)-    (ks ks))-  (defstrand resp 2 (ra ra-0) (rb rb-1) (tb tb-0) (a a) (b b) (ks ks))-  (defstrand init-reauth 4 (k k) (ra-prime ra-prime-0)-    (rb-prime rb-prime) (tb tb-0) (a a) (b b) (ks ks))-  (deflistener k)-  (precedes ((1 1) (4 2)) ((2 1) (0 2)) ((2 1) (1 0)) ((2 1) (4 0))-    ((2 1) (5 0)) ((3 1) (2 0)) ((4 3) (1 2)) ((5 1) (4 2)))-  (non-orig (ltk a ks) (ltk b ks))-  (uniq-orig k ra rb ra-prime rb-prime)-  (operation encryption-test (added-listener k) (enc "two" ra-prime-0 k)-    (4 2))-  (strand-map 0 1 2 3 4)-  (traces-    ((recv (cat a ra)) (send (cat b rb (enc a ra tb (ltk b ks))))-      (recv (cat (enc a k tb (ltk b ks)) (enc "one" rb k))))-    ((recv (cat (enc a k tb-0 (ltk b ks)) ra-prime))-      (send (cat rb-prime (enc "two" ra-prime k)))-      (recv (enc "three" rb-prime k)))-    ((recv (cat b rb-0 (enc a ra-0 tb-0 (ltk b ks))))-      (send-        (cat (enc b ra-0 k tb-0 (ltk a ks)) (enc a k tb-0 (ltk b ks))-          rb-0)))-    ((recv (cat a ra-0))-      (send (cat b rb-1 (enc a ra-0 tb-0 (ltk b ks)))))-    ((recv (enc a k tb-0 (ltk b ks)))-      (send (cat (enc a k tb-0 (ltk b ks)) ra-prime-0))-      (recv (cat rb-prime (enc "two" ra-prime-0 k)))-      (send (enc "three" rb-prime k))) ((recv k) (send k)))-  (label 15)-  (parent 9)-  (unrealized (0 2) (5 0))-  (dead)-  (comment "empty cohort"))--(defskeleton neuman-stubblebine-reauth-  (vars (k skey) (ra tb rb ra-prime rb-prime rb-0 ra-0 tb-0 text)-    (a b ks a-0 b-0 ks-0 name))-  (defstrand resp 3 (k k) (ra ra) (rb rb) (tb tb) (a a) (b b) (ks ks))-  (defstrand resp-reauth 3 (k k) (ra-prime ra-prime) (rb-prime rb-prime)-    (tb tb) (a a) (b b) (ks ks))-  (defstrand keyserver 2 (k k) (ra ra) (rb rb-0) (tb tb) (a a) (b b)-    (ks ks))-  (defstrand init-reauth 4 (k k) (ra-prime ra-prime) (rb-prime rb-prime)-    (tb tb) (a a) (b b) (ks ks))-  (defstrand init 3 (k k) (ra ra-0) (rb rb) (tb tb-0) (a a-0) (b b-0)-    (ks ks-0))-  (precedes ((0 1) (2 0)) ((1 1) (3 2)) ((2 1) (3 0)) ((2 1) (4 1))-    ((3 1) (1 0)) ((3 3) (1 2)) ((4 2) (0 2)))-  (non-orig (ltk a ks) (ltk b ks))-  (uniq-orig k ra rb ra-prime rb-prime)-  (operation encryption-test (added-strand init 3) (enc "one" rb k)-    (0 2))-  (strand-map 0 1 2 3)-  (traces-    ((recv (cat a ra)) (send (cat b rb (enc a ra tb (ltk b ks))))-      (recv (cat (enc a k tb (ltk b ks)) (enc "one" rb k))))-    ((recv (cat (enc a k tb (ltk b ks)) ra-prime))-      (send (cat rb-prime (enc "two" ra-prime k)))-      (recv (enc "three" rb-prime k)))-    ((recv (cat b rb-0 (enc a ra tb (ltk b ks))))-      (send-        (cat (enc b ra k tb (ltk a ks)) (enc a k tb (ltk b ks)) rb-0)))-    ((recv (enc a k tb (ltk b ks)))-      (send (cat (enc a k tb (ltk b ks)) ra-prime))-      (recv (cat rb-prime (enc "two" ra-prime k)))-      (send (enc "three" rb-prime k)))-    ((send (cat a-0 ra-0))-      (recv-        (cat (enc b-0 ra-0 k tb-0 (ltk a-0 ks-0))-          (enc a-0 k tb-0 (ltk b-0 ks-0)) rb))-      (send (cat (enc a-0 k tb-0 (ltk b-0 ks-0)) (enc "one" rb k)))))-  (label 16)-  (parent 10)-  (unrealized (4 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton neuman-stubblebine-reauth-  (vars (k skey) (ra tb rb ra-prime rb-prime rb-0 text) (a b ks name))-  (defstrand resp 3 (k k) (ra ra) (rb rb) (tb tb) (a a) (b b) (ks ks))-  (defstrand resp-reauth 3 (k k) (ra-prime ra-prime) (rb-prime rb-prime)-    (tb tb) (a a) (b b) (ks ks))-  (defstrand keyserver 2 (k k) (ra ra) (rb rb-0) (tb tb) (a a) (b b)-    (ks ks))-  (defstrand init-reauth 4 (k k) (ra-prime ra-prime) (rb-prime rb-prime)-    (tb tb) (a a) (b b) (ks ks))-  (deflistener k)-  (precedes ((0 1) (2 0)) ((1 1) (3 2)) ((2 1) (3 0)) ((2 1) (4 0))-    ((3 1) (1 0)) ((3 3) (1 2)) ((4 1) (0 2)))-  (non-orig (ltk a ks) (ltk b ks))-  (uniq-orig k ra rb ra-prime rb-prime)-  (operation encryption-test (added-listener k) (enc "one" rb k) (0 2))-  (strand-map 0 1 2 3)-  (traces-    ((recv (cat a ra)) (send (cat b rb (enc a ra tb (ltk b ks))))-      (recv (cat (enc a k tb (ltk b ks)) (enc "one" rb k))))-    ((recv (cat (enc a k tb (ltk b ks)) ra-prime))-      (send (cat rb-prime (enc "two" ra-prime k)))-      (recv (enc "three" rb-prime k)))-    ((recv (cat b rb-0 (enc a ra tb (ltk b ks))))-      (send-        (cat (enc b ra k tb (ltk a ks)) (enc a k tb (ltk b ks)) rb-0)))-    ((recv (enc a k tb (ltk b ks)))-      (send (cat (enc a k tb (ltk b ks)) ra-prime))-      (recv (cat rb-prime (enc "two" ra-prime k)))-      (send (enc "three" rb-prime k))) ((recv k) (send k)))-  (label 17)-  (parent 10)-  (unrealized (4 0))-  (dead)-  (comment "empty cohort"))--(defskeleton neuman-stubblebine-reauth-  (vars (k skey)-    (ra tb rb ra-prime rb-prime rb-0 ra-prime-0 rb-prime-0 text)-    (a b ks name))-  (defstrand resp 3 (k k) (ra ra) (rb rb) (tb tb) (a a) (b b) (ks ks))-  (defstrand resp-reauth 3 (k k) (ra-prime ra-prime) (rb-prime rb-prime)-    (tb tb) (a a) (b b) (ks ks))-  (defstrand keyserver 2 (k k) (ra ra) (rb rb-0) (tb tb) (a a) (b b)-    (ks ks))-  (defstrand init-reauth 4 (k k) (ra-prime ra-prime-0)-    (rb-prime rb-prime) (tb tb) (a a) (b b) (ks ks))-  (defstrand resp-reauth 2 (k k) (ra-prime ra-prime-0)-    (rb-prime rb-prime-0) (tb tb) (a a) (b b) (ks ks))-  (precedes ((0 1) (2 0)) ((1 1) (3 2)) ((2 1) (0 2)) ((2 1) (1 0))-    ((2 1) (3 0)) ((2 1) (4 0)) ((3 3) (1 2)) ((4 1) (3 2)))-  (non-orig (ltk a ks) (ltk b ks))-  (uniq-orig k ra rb ra-prime rb-prime)-  (operation nonce-test (contracted (a-0 a) (b-0 b) (ks-0 ks) (tb-0 tb))-    k (4 0) (enc a k tb (ltk b ks)) (enc b ra k tb (ltk a ks)))-  (strand-map 0 1 2 3 4)-  (traces-    ((recv (cat a ra)) (send (cat b rb (enc a ra tb (ltk b ks))))-      (recv (cat (enc a k tb (ltk b ks)) (enc "one" rb k))))-    ((recv (cat (enc a k tb (ltk b ks)) ra-prime))-      (send (cat rb-prime (enc "two" ra-prime k)))-      (recv (enc "three" rb-prime k)))-    ((recv (cat b rb-0 (enc a ra tb (ltk b ks))))-      (send-        (cat (enc b ra k tb (ltk a ks)) (enc a k tb (ltk b ks)) rb-0)))-    ((recv (enc a k tb (ltk b ks)))-      (send (cat (enc a k tb (ltk b ks)) ra-prime-0))-      (recv (cat rb-prime (enc "two" ra-prime-0 k)))-      (send (enc "three" rb-prime k)))-    ((recv (cat (enc a k tb (ltk b ks)) ra-prime-0))-      (send (cat rb-prime-0 (enc "two" ra-prime-0 k)))))-  (label 18)-  (parent 11)-  (unrealized (0 2))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton neuman-stubblebine-reauth-  (vars (k skey) (ra rb ra-prime rb-prime tb ra-0 rb-0 rb-1 text)-    (a b ks name))-  (defstrand resp 3 (k k) (ra ra) (rb rb) (tb tb) (a a) (b b) (ks ks))-  (defstrand resp-reauth 3 (k k) (ra-prime ra-prime) (rb-prime rb-prime)-    (tb tb) (a a) (b b) (ks ks))-  (defstrand keyserver 2 (k k) (ra ra-0) (rb rb-0) (tb tb) (a a) (b b)-    (ks ks))-  (defstrand resp 2 (ra ra-0) (rb rb-1) (tb tb) (a a) (b b) (ks ks))-  (defstrand init-reauth 4 (k k) (ra-prime ra-prime) (rb-prime rb-prime)-    (tb tb) (a a) (b b) (ks ks))-  (precedes ((1 1) (4 2)) ((2 1) (0 2)) ((2 1) (4 0)) ((3 1) (2 0))-    ((4 1) (1 0)) ((4 3) (1 2)))-  (non-orig (ltk a ks) (ltk b ks))-  (uniq-orig k ra rb ra-prime rb-prime)-  (operation encryption-test (displaced 5 2 keyserver 2)-    (enc a k tb-0 (ltk b ks)) (0 2))-  (strand-map 0 1 2 3 4)-  (traces-    ((recv (cat a ra)) (send (cat b rb (enc a ra tb (ltk b ks))))-      (recv (cat (enc a k tb (ltk b ks)) (enc "one" rb k))))-    ((recv (cat (enc a k tb (ltk b ks)) ra-prime))-      (send (cat rb-prime (enc "two" ra-prime k)))-      (recv (enc "three" rb-prime k)))-    ((recv (cat b rb-0 (enc a ra-0 tb (ltk b ks))))-      (send-        (cat (enc b ra-0 k tb (ltk a ks)) (enc a k tb (ltk b ks))-          rb-0)))-    ((recv (cat a ra-0)) (send (cat b rb-1 (enc a ra-0 tb (ltk b ks)))))-    ((recv (enc a k tb (ltk b ks)))-      (send (cat (enc a k tb (ltk b ks)) ra-prime))-      (recv (cat rb-prime (enc "two" ra-prime k)))-      (send (enc "three" rb-prime k))))-  (label 19)-  (parent 13)-  (unrealized (0 2))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton neuman-stubblebine-reauth-  (vars (k skey)-    (ra tb rb ra-prime rb-prime tb-0 ra-0 rb-0 rb-1 ra-prime-0-      rb-prime-0 text) (a b ks name))-  (defstrand resp 3 (k k) (ra ra) (rb rb) (tb tb) (a a) (b b) (ks ks))-  (defstrand resp-reauth 3 (k k) (ra-prime ra-prime) (rb-prime rb-prime)-    (tb tb-0) (a a) (b b) (ks ks))-  (defstrand keyserver 2 (k k) (ra ra-0) (rb rb-0) (tb tb-0) (a a) (b b)-    (ks ks))-  (defstrand resp 2 (ra ra-0) (rb rb-1) (tb tb-0) (a a) (b b) (ks ks))-  (defstrand init-reauth 4 (k k) (ra-prime ra-prime-0)-    (rb-prime rb-prime) (tb tb-0) (a a) (b b) (ks ks))-  (defstrand resp-reauth 2 (k k) (ra-prime ra-prime-0)-    (rb-prime rb-prime-0) (tb tb-0) (a a) (b b) (ks ks))-  (precedes ((1 1) (4 2)) ((2 1) (0 2)) ((2 1) (1 0)) ((2 1) (4 0))-    ((2 1) (5 0)) ((3 1) (2 0)) ((4 3) (1 2)) ((5 1) (4 2)))-  (non-orig (ltk a ks) (ltk b ks))-  (uniq-orig k ra rb ra-prime rb-prime)-  (operation nonce-test-    (contracted (a-0 a) (b-0 b) (ks-0 ks) (tb-1 tb-0)) k (5 0)-    (enc a k tb-0 (ltk b ks)) (enc b ra-0 k tb-0 (ltk a ks)))-  (strand-map 0 1 2 3 4 5)-  (traces-    ((recv (cat a ra)) (send (cat b rb (enc a ra tb (ltk b ks))))-      (recv (cat (enc a k tb (ltk b ks)) (enc "one" rb k))))-    ((recv (cat (enc a k tb-0 (ltk b ks)) ra-prime))-      (send (cat rb-prime (enc "two" ra-prime k)))-      (recv (enc "three" rb-prime k)))-    ((recv (cat b rb-0 (enc a ra-0 tb-0 (ltk b ks))))-      (send-        (cat (enc b ra-0 k tb-0 (ltk a ks)) (enc a k tb-0 (ltk b ks))-          rb-0)))-    ((recv (cat a ra-0))-      (send (cat b rb-1 (enc a ra-0 tb-0 (ltk b ks)))))-    ((recv (enc a k tb-0 (ltk b ks)))-      (send (cat (enc a k tb-0 (ltk b ks)) ra-prime-0))-      (recv (cat rb-prime (enc "two" ra-prime-0 k)))-      (send (enc "three" rb-prime k)))-    ((recv (cat (enc a k tb-0 (ltk b ks)) ra-prime-0))-      (send (cat rb-prime-0 (enc "two" ra-prime-0 k)))))-  (label 20)-  (parent 14)-  (unrealized (0 2))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton neuman-stubblebine-reauth-  (vars (k skey) (ra tb rb ra-prime rb-prime rb-0 ra-0 text)-    (a b ks name))-  (defstrand resp 3 (k k) (ra ra) (rb rb) (tb tb) (a a) (b b) (ks ks))-  (defstrand resp-reauth 3 (k k) (ra-prime ra-prime) (rb-prime rb-prime)-    (tb tb) (a a) (b b) (ks ks))-  (defstrand keyserver 2 (k k) (ra ra) (rb rb-0) (tb tb) (a a) (b b)-    (ks ks))-  (defstrand init-reauth 4 (k k) (ra-prime ra-prime) (rb-prime rb-prime)-    (tb tb) (a a) (b b) (ks ks))-  (defstrand init 3 (k k) (ra ra-0) (rb rb) (tb tb) (a a) (b b) (ks ks))-  (precedes ((0 1) (2 0)) ((1 1) (3 2)) ((2 1) (3 0)) ((2 1) (4 1))-    ((3 1) (1 0)) ((3 3) (1 2)) ((4 2) (0 2)))-  (non-orig (ltk a ks) (ltk b ks))-  (uniq-orig k ra rb ra-prime rb-prime)-  (operation nonce-test (contracted (a-0 a) (b-0 b) (ks-0 ks) (tb-0 tb))-    k (4 1) (enc a k tb (ltk b ks)) (enc b ra k tb (ltk a ks)))-  (strand-map 0 1 2 3 4)-  (traces-    ((recv (cat a ra)) (send (cat b rb (enc a ra tb (ltk b ks))))-      (recv (cat (enc a k tb (ltk b ks)) (enc "one" rb k))))-    ((recv (cat (enc a k tb (ltk b ks)) ra-prime))-      (send (cat rb-prime (enc "two" ra-prime k)))-      (recv (enc "three" rb-prime k)))-    ((recv (cat b rb-0 (enc a ra tb (ltk b ks))))-      (send-        (cat (enc b ra k tb (ltk a ks)) (enc a k tb (ltk b ks)) rb-0)))-    ((recv (enc a k tb (ltk b ks)))-      (send (cat (enc a k tb (ltk b ks)) ra-prime))-      (recv (cat rb-prime (enc "two" ra-prime k)))-      (send (enc "three" rb-prime k)))-    ((send (cat a ra-0))-      (recv-        (cat (enc b ra-0 k tb (ltk a ks)) (enc a k tb (ltk b ks)) rb))-      (send (cat (enc a k tb (ltk b ks)) (enc "one" rb k)))))-  (label 21)-  (parent 16)-  (unrealized (4 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton neuman-stubblebine-reauth-  (vars (k skey)-    (ra tb rb ra-prime rb-prime rb-0 ra-prime-0 rb-prime-0 ra-0 tb-0-      text) (a b ks a-0 b-0 ks-0 name))-  (defstrand resp 3 (k k) (ra ra) (rb rb) (tb tb) (a a) (b b) (ks ks))-  (defstrand resp-reauth 3 (k k) (ra-prime ra-prime) (rb-prime rb-prime)-    (tb tb) (a a) (b b) (ks ks))-  (defstrand keyserver 2 (k k) (ra ra) (rb rb-0) (tb tb) (a a) (b b)-    (ks ks))-  (defstrand init-reauth 4 (k k) (ra-prime ra-prime-0)-    (rb-prime rb-prime) (tb tb) (a a) (b b) (ks ks))-  (defstrand resp-reauth 2 (k k) (ra-prime ra-prime-0)-    (rb-prime rb-prime-0) (tb tb) (a a) (b b) (ks ks))-  (defstrand init 3 (k k) (ra ra-0) (rb rb) (tb tb-0) (a a-0) (b b-0)-    (ks ks-0))-  (precedes ((0 1) (2 0)) ((1 1) (3 2)) ((2 1) (1 0)) ((2 1) (3 0))-    ((2 1) (4 0)) ((2 1) (5 1)) ((3 3) (1 2)) ((4 1) (3 2))-    ((5 2) (0 2)))-  (non-orig (ltk a ks) (ltk b ks))-  (uniq-orig k ra rb ra-prime rb-prime)-  (operation encryption-test (added-strand init 3) (enc "one" rb k)-    (0 2))-  (strand-map 0 1 2 3 4)-  (traces-    ((recv (cat a ra)) (send (cat b rb (enc a ra tb (ltk b ks))))-      (recv (cat (enc a k tb (ltk b ks)) (enc "one" rb k))))-    ((recv (cat (enc a k tb (ltk b ks)) ra-prime))-      (send (cat rb-prime (enc "two" ra-prime k)))-      (recv (enc "three" rb-prime k)))-    ((recv (cat b rb-0 (enc a ra tb (ltk b ks))))-      (send-        (cat (enc b ra k tb (ltk a ks)) (enc a k tb (ltk b ks)) rb-0)))-    ((recv (enc a k tb (ltk b ks)))-      (send (cat (enc a k tb (ltk b ks)) ra-prime-0))-      (recv (cat rb-prime (enc "two" ra-prime-0 k)))-      (send (enc "three" rb-prime k)))-    ((recv (cat (enc a k tb (ltk b ks)) ra-prime-0))-      (send (cat rb-prime-0 (enc "two" ra-prime-0 k))))-    ((send (cat a-0 ra-0))-      (recv-        (cat (enc b-0 ra-0 k tb-0 (ltk a-0 ks-0))-          (enc a-0 k tb-0 (ltk b-0 ks-0)) rb))-      (send (cat (enc a-0 k tb-0 (ltk b-0 ks-0)) (enc "one" rb k)))))-  (label 22)-  (parent 18)-  (unrealized (5 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton neuman-stubblebine-reauth-  (vars (k skey)-    (ra tb rb ra-prime rb-prime rb-0 ra-prime-0 rb-prime-0 text)-    (a b ks name))-  (defstrand resp 3 (k k) (ra ra) (rb rb) (tb tb) (a a) (b b) (ks ks))-  (defstrand resp-reauth 3 (k k) (ra-prime ra-prime) (rb-prime rb-prime)-    (tb tb) (a a) (b b) (ks ks))-  (defstrand keyserver 2 (k k) (ra ra) (rb rb-0) (tb tb) (a a) (b b)-    (ks ks))-  (defstrand init-reauth 4 (k k) (ra-prime ra-prime-0)-    (rb-prime rb-prime) (tb tb) (a a) (b b) (ks ks))-  (defstrand resp-reauth 2 (k k) (ra-prime ra-prime-0)-    (rb-prime rb-prime-0) (tb tb) (a a) (b b) (ks ks))-  (deflistener k)-  (precedes ((0 1) (2 0)) ((1 1) (3 2)) ((2 1) (1 0)) ((2 1) (3 0))-    ((2 1) (4 0)) ((2 1) (5 0)) ((3 3) (1 2)) ((4 1) (3 2))-    ((5 1) (0 2)))-  (non-orig (ltk a ks) (ltk b ks))-  (uniq-orig k ra rb ra-prime rb-prime)-  (operation encryption-test (added-listener k) (enc "one" rb k) (0 2))-  (strand-map 0 1 2 3 4)-  (traces-    ((recv (cat a ra)) (send (cat b rb (enc a ra tb (ltk b ks))))-      (recv (cat (enc a k tb (ltk b ks)) (enc "one" rb k))))-    ((recv (cat (enc a k tb (ltk b ks)) ra-prime))-      (send (cat rb-prime (enc "two" ra-prime k)))-      (recv (enc "three" rb-prime k)))-    ((recv (cat b rb-0 (enc a ra tb (ltk b ks))))-      (send-        (cat (enc b ra k tb (ltk a ks)) (enc a k tb (ltk b ks)) rb-0)))-    ((recv (enc a k tb (ltk b ks)))-      (send (cat (enc a k tb (ltk b ks)) ra-prime-0))-      (recv (cat rb-prime (enc "two" ra-prime-0 k)))-      (send (enc "three" rb-prime k)))-    ((recv (cat (enc a k tb (ltk b ks)) ra-prime-0))-      (send (cat rb-prime-0 (enc "two" ra-prime-0 k))))-    ((recv k) (send k)))-  (label 23)-  (parent 18)-  (unrealized (5 0))-  (dead)-  (comment "empty cohort"))--(defskeleton neuman-stubblebine-reauth-  (vars (k skey)-    (ra rb ra-prime rb-prime tb ra-0 rb-0 rb-1 ra-1 tb-0 text)-    (a b ks a-0 b-0 ks-0 name))-  (defstrand resp 3 (k k) (ra ra) (rb rb) (tb tb) (a a) (b b) (ks ks))-  (defstrand resp-reauth 3 (k k) (ra-prime ra-prime) (rb-prime rb-prime)-    (tb tb) (a a) (b b) (ks ks))-  (defstrand keyserver 2 (k k) (ra ra-0) (rb rb-0) (tb tb) (a a) (b b)-    (ks ks))-  (defstrand resp 2 (ra ra-0) (rb rb-1) (tb tb) (a a) (b b) (ks ks))-  (defstrand init-reauth 4 (k k) (ra-prime ra-prime) (rb-prime rb-prime)-    (tb tb) (a a) (b b) (ks ks))-  (defstrand init 3 (k k) (ra ra-1) (rb rb) (tb tb-0) (a a-0) (b b-0)-    (ks ks-0))-  (precedes ((0 1) (5 1)) ((1 1) (4 2)) ((2 1) (4 0)) ((2 1) (5 1))-    ((3 1) (2 0)) ((4 1) (1 0)) ((4 3) (1 2)) ((5 2) (0 2)))-  (non-orig (ltk a ks) (ltk b ks))-  (uniq-orig k ra rb ra-prime rb-prime)-  (operation encryption-test (added-strand init 3) (enc "one" rb k)-    (0 2))-  (strand-map 0 1 2 3 4)-  (traces-    ((recv (cat a ra)) (send (cat b rb (enc a ra tb (ltk b ks))))-      (recv (cat (enc a k tb (ltk b ks)) (enc "one" rb k))))-    ((recv (cat (enc a k tb (ltk b ks)) ra-prime))-      (send (cat rb-prime (enc "two" ra-prime k)))-      (recv (enc "three" rb-prime k)))-    ((recv (cat b rb-0 (enc a ra-0 tb (ltk b ks))))-      (send-        (cat (enc b ra-0 k tb (ltk a ks)) (enc a k tb (ltk b ks))-          rb-0)))-    ((recv (cat a ra-0)) (send (cat b rb-1 (enc a ra-0 tb (ltk b ks)))))-    ((recv (enc a k tb (ltk b ks)))-      (send (cat (enc a k tb (ltk b ks)) ra-prime))-      (recv (cat rb-prime (enc "two" ra-prime k)))-      (send (enc "three" rb-prime k)))-    ((send (cat a-0 ra-1))-      (recv-        (cat (enc b-0 ra-1 k tb-0 (ltk a-0 ks-0))-          (enc a-0 k tb-0 (ltk b-0 ks-0)) rb))-      (send (cat (enc a-0 k tb-0 (ltk b-0 ks-0)) (enc "one" rb k)))))-  (label 24)-  (parent 19)-  (unrealized (5 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton neuman-stubblebine-reauth-  (vars (k skey) (ra rb ra-prime rb-prime tb ra-0 rb-0 rb-1 text)-    (a b ks name))-  (defstrand resp 3 (k k) (ra ra) (rb rb) (tb tb) (a a) (b b) (ks ks))-  (defstrand resp-reauth 3 (k k) (ra-prime ra-prime) (rb-prime rb-prime)-    (tb tb) (a a) (b b) (ks ks))-  (defstrand keyserver 2 (k k) (ra ra-0) (rb rb-0) (tb tb) (a a) (b b)-    (ks ks))-  (defstrand resp 2 (ra ra-0) (rb rb-1) (tb tb) (a a) (b b) (ks ks))-  (defstrand init-reauth 4 (k k) (ra-prime ra-prime) (rb-prime rb-prime)-    (tb tb) (a a) (b b) (ks ks))-  (deflistener k)-  (precedes ((1 1) (4 2)) ((2 1) (4 0)) ((2 1) (5 0)) ((3 1) (2 0))-    ((4 1) (1 0)) ((4 3) (1 2)) ((5 1) (0 2)))-  (non-orig (ltk a ks) (ltk b ks))-  (uniq-orig k ra rb ra-prime rb-prime)-  (operation encryption-test (added-listener k) (enc "one" rb k) (0 2))-  (strand-map 0 1 2 3 4)-  (traces-    ((recv (cat a ra)) (send (cat b rb (enc a ra tb (ltk b ks))))-      (recv (cat (enc a k tb (ltk b ks)) (enc "one" rb k))))-    ((recv (cat (enc a k tb (ltk b ks)) ra-prime))-      (send (cat rb-prime (enc "two" ra-prime k)))-      (recv (enc "three" rb-prime k)))-    ((recv (cat b rb-0 (enc a ra-0 tb (ltk b ks))))-      (send-        (cat (enc b ra-0 k tb (ltk a ks)) (enc a k tb (ltk b ks))-          rb-0)))-    ((recv (cat a ra-0)) (send (cat b rb-1 (enc a ra-0 tb (ltk b ks)))))-    ((recv (enc a k tb (ltk b ks)))-      (send (cat (enc a k tb (ltk b ks)) ra-prime))-      (recv (cat rb-prime (enc "two" ra-prime k)))-      (send (enc "three" rb-prime k))) ((recv k) (send k)))-  (label 25)-  (parent 19)-  (unrealized (5 0))-  (dead)-  (comment "empty cohort"))--(defskeleton neuman-stubblebine-reauth-  (vars (k skey)-    (ra rb ra-prime rb-prime tb ra-0 rb-0 rb-1 ra-prime-0 rb-prime-0-      text) (a b ks name))-  (defstrand resp 3 (k k) (ra ra) (rb rb) (tb tb) (a a) (b b) (ks ks))-  (defstrand resp-reauth 3 (k k) (ra-prime ra-prime) (rb-prime rb-prime)-    (tb tb) (a a) (b b) (ks ks))-  (defstrand keyserver 2 (k k) (ra ra-0) (rb rb-0) (tb tb) (a a) (b b)-    (ks ks))-  (defstrand resp 2 (ra ra-0) (rb rb-1) (tb tb) (a a) (b b) (ks ks))-  (defstrand init-reauth 4 (k k) (ra-prime ra-prime-0)-    (rb-prime rb-prime) (tb tb) (a a) (b b) (ks ks))-  (defstrand resp-reauth 2 (k k) (ra-prime ra-prime-0)-    (rb-prime rb-prime-0) (tb tb) (a a) (b b) (ks ks))-  (precedes ((1 1) (4 2)) ((2 1) (0 2)) ((2 1) (1 0)) ((2 1) (4 0))-    ((2 1) (5 0)) ((3 1) (2 0)) ((4 3) (1 2)) ((5 1) (4 2)))-  (non-orig (ltk a ks) (ltk b ks))-  (uniq-orig k ra rb ra-prime rb-prime)-  (operation encryption-test (displaced 6 2 keyserver 2)-    (enc a k tb-0 (ltk b ks)) (0 2))-  (strand-map 0 1 2 3 4 5)-  (traces-    ((recv (cat a ra)) (send (cat b rb (enc a ra tb (ltk b ks))))-      (recv (cat (enc a k tb (ltk b ks)) (enc "one" rb k))))-    ((recv (cat (enc a k tb (ltk b ks)) ra-prime))-      (send (cat rb-prime (enc "two" ra-prime k)))-      (recv (enc "three" rb-prime k)))-    ((recv (cat b rb-0 (enc a ra-0 tb (ltk b ks))))-      (send-        (cat (enc b ra-0 k tb (ltk a ks)) (enc a k tb (ltk b ks))-          rb-0)))-    ((recv (cat a ra-0)) (send (cat b rb-1 (enc a ra-0 tb (ltk b ks)))))-    ((recv (enc a k tb (ltk b ks)))-      (send (cat (enc a k tb (ltk b ks)) ra-prime-0))-      (recv (cat rb-prime (enc "two" ra-prime-0 k)))-      (send (enc "three" rb-prime k)))-    ((recv (cat (enc a k tb (ltk b ks)) ra-prime-0))-      (send (cat rb-prime-0 (enc "two" ra-prime-0 k)))))-  (label 26)-  (parent 20)-  (unrealized (0 2))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton neuman-stubblebine-reauth-  (vars (k skey) (ra tb rb ra-prime rb-prime rb-0 text) (a b ks name))-  (defstrand resp 3 (k k) (ra ra) (rb rb) (tb tb) (a a) (b b) (ks ks))-  (defstrand resp-reauth 3 (k k) (ra-prime ra-prime) (rb-prime rb-prime)-    (tb tb) (a a) (b b) (ks ks))-  (defstrand keyserver 2 (k k) (ra ra) (rb rb-0) (tb tb) (a a) (b b)-    (ks ks))-  (defstrand init-reauth 4 (k k) (ra-prime ra-prime) (rb-prime rb-prime)-    (tb tb) (a a) (b b) (ks ks))-  (defstrand init 3 (k k) (ra ra) (rb rb) (tb tb) (a a) (b b) (ks ks))-  (precedes ((0 1) (2 0)) ((1 1) (3 2)) ((2 1) (3 0)) ((2 1) (4 1))-    ((3 1) (1 0)) ((3 3) (1 2)) ((4 0) (0 0)) ((4 2) (0 2)))-  (non-orig (ltk a ks) (ltk b ks))-  (uniq-orig k ra rb ra-prime rb-prime)-  (operation encryption-test (displaced 5 2 keyserver 2)-    (enc b ra-0 k tb (ltk a ks)) (4 1))-  (strand-map 0 1 2 3 4)-  (traces-    ((recv (cat a ra)) (send (cat b rb (enc a ra tb (ltk b ks))))-      (recv (cat (enc a k tb (ltk b ks)) (enc "one" rb k))))-    ((recv (cat (enc a k tb (ltk b ks)) ra-prime))-      (send (cat rb-prime (enc "two" ra-prime k)))-      (recv (enc "three" rb-prime k)))-    ((recv (cat b rb-0 (enc a ra tb (ltk b ks))))-      (send-        (cat (enc b ra k tb (ltk a ks)) (enc a k tb (ltk b ks)) rb-0)))-    ((recv (enc a k tb (ltk b ks)))-      (send (cat (enc a k tb (ltk b ks)) ra-prime))-      (recv (cat rb-prime (enc "two" ra-prime k)))-      (send (enc "three" rb-prime k)))-    ((send (cat a ra))-      (recv (cat (enc b ra k tb (ltk a ks)) (enc a k tb (ltk b ks)) rb))-      (send (cat (enc a k tb (ltk b ks)) (enc "one" rb k)))))-  (label 27)-  (parent 21)-  (realized)-  (shape)-  (maps-    ((0 1)-      ((ra ra) (tb tb) (rb rb) (a a) (b b) (ks ks) (k k)-        (ra-prime ra-prime) (rb-prime rb-prime) (tb-0 tb))))-  (origs (k (2 1)) (ra (4 0)) (rb (0 1)) (ra-prime (3 1))-    (rb-prime (1 1))))--(defskeleton neuman-stubblebine-reauth-  (vars (k skey)-    (ra tb rb ra-prime rb-prime rb-0 ra-prime-0 rb-prime-0 ra-0 text)-    (a b ks name))-  (defstrand resp 3 (k k) (ra ra) (rb rb) (tb tb) (a a) (b b) (ks ks))-  (defstrand resp-reauth 3 (k k) (ra-prime ra-prime) (rb-prime rb-prime)-    (tb tb) (a a) (b b) (ks ks))-  (defstrand keyserver 2 (k k) (ra ra) (rb rb-0) (tb tb) (a a) (b b)-    (ks ks))-  (defstrand init-reauth 4 (k k) (ra-prime ra-prime-0)-    (rb-prime rb-prime) (tb tb) (a a) (b b) (ks ks))-  (defstrand resp-reauth 2 (k k) (ra-prime ra-prime-0)-    (rb-prime rb-prime-0) (tb tb) (a a) (b b) (ks ks))-  (defstrand init 3 (k k) (ra ra-0) (rb rb) (tb tb) (a a) (b b) (ks ks))-  (precedes ((0 1) (2 0)) ((1 1) (3 2)) ((2 1) (1 0)) ((2 1) (3 0))-    ((2 1) (4 0)) ((2 1) (5 1)) ((3 3) (1 2)) ((4 1) (3 2))-    ((5 2) (0 2)))-  (non-orig (ltk a ks) (ltk b ks))-  (uniq-orig k ra rb ra-prime rb-prime)-  (operation nonce-test (contracted (a-0 a) (b-0 b) (ks-0 ks) (tb-0 tb))-    k (5 1) (enc a k tb (ltk b ks)) (enc b ra k tb (ltk a ks)))-  (strand-map 0 1 2 3 4 5)-  (traces-    ((recv (cat a ra)) (send (cat b rb (enc a ra tb (ltk b ks))))-      (recv (cat (enc a k tb (ltk b ks)) (enc "one" rb k))))-    ((recv (cat (enc a k tb (ltk b ks)) ra-prime))-      (send (cat rb-prime (enc "two" ra-prime k)))-      (recv (enc "three" rb-prime k)))-    ((recv (cat b rb-0 (enc a ra tb (ltk b ks))))-      (send-        (cat (enc b ra k tb (ltk a ks)) (enc a k tb (ltk b ks)) rb-0)))-    ((recv (enc a k tb (ltk b ks)))-      (send (cat (enc a k tb (ltk b ks)) ra-prime-0))-      (recv (cat rb-prime (enc "two" ra-prime-0 k)))-      (send (enc "three" rb-prime k)))-    ((recv (cat (enc a k tb (ltk b ks)) ra-prime-0))-      (send (cat rb-prime-0 (enc "two" ra-prime-0 k))))-    ((send (cat a ra-0))-      (recv-        (cat (enc b ra-0 k tb (ltk a ks)) (enc a k tb (ltk b ks)) rb))-      (send (cat (enc a k tb (ltk b ks)) (enc "one" rb k)))))-  (label 28)-  (parent 22)-  (unrealized (5 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton neuman-stubblebine-reauth-  (vars (k skey) (ra rb ra-prime rb-prime tb ra-0 rb-0 rb-1 ra-1 text)-    (a b ks name))-  (defstrand resp 3 (k k) (ra ra) (rb rb) (tb tb) (a a) (b b) (ks ks))-  (defstrand resp-reauth 3 (k k) (ra-prime ra-prime) (rb-prime rb-prime)-    (tb tb) (a a) (b b) (ks ks))-  (defstrand keyserver 2 (k k) (ra ra-0) (rb rb-0) (tb tb) (a a) (b b)-    (ks ks))-  (defstrand resp 2 (ra ra-0) (rb rb-1) (tb tb) (a a) (b b) (ks ks))-  (defstrand init-reauth 4 (k k) (ra-prime ra-prime) (rb-prime rb-prime)-    (tb tb) (a a) (b b) (ks ks))-  (defstrand init 3 (k k) (ra ra-1) (rb rb) (tb tb) (a a) (b b) (ks ks))-  (precedes ((0 1) (5 1)) ((1 1) (4 2)) ((2 1) (4 0)) ((2 1) (5 1))-    ((3 1) (2 0)) ((4 1) (1 0)) ((4 3) (1 2)) ((5 2) (0 2)))-  (non-orig (ltk a ks) (ltk b ks))-  (uniq-orig k ra rb ra-prime rb-prime)-  (operation nonce-test (contracted (a-0 a) (b-0 b) (ks-0 ks) (tb-0 tb))-    k (5 1) (enc a k tb (ltk b ks)) (enc b ra-0 k tb (ltk a ks)))-  (strand-map 0 1 2 3 4 5)-  (traces-    ((recv (cat a ra)) (send (cat b rb (enc a ra tb (ltk b ks))))-      (recv (cat (enc a k tb (ltk b ks)) (enc "one" rb k))))-    ((recv (cat (enc a k tb (ltk b ks)) ra-prime))-      (send (cat rb-prime (enc "two" ra-prime k)))-      (recv (enc "three" rb-prime k)))-    ((recv (cat b rb-0 (enc a ra-0 tb (ltk b ks))))-      (send-        (cat (enc b ra-0 k tb (ltk a ks)) (enc a k tb (ltk b ks))-          rb-0)))-    ((recv (cat a ra-0)) (send (cat b rb-1 (enc a ra-0 tb (ltk b ks)))))-    ((recv (enc a k tb (ltk b ks)))-      (send (cat (enc a k tb (ltk b ks)) ra-prime))-      (recv (cat rb-prime (enc "two" ra-prime k)))-      (send (enc "three" rb-prime k)))-    ((send (cat a ra-1))-      (recv-        (cat (enc b ra-1 k tb (ltk a ks)) (enc a k tb (ltk b ks)) rb))-      (send (cat (enc a k tb (ltk b ks)) (enc "one" rb k)))))-  (label 29)-  (parent 24)-  (unrealized (5 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton neuman-stubblebine-reauth-  (vars (k skey)-    (ra rb ra-prime rb-prime tb ra-0 rb-0 rb-1 ra-prime-0 rb-prime-0-      ra-1 tb-0 text) (a b ks a-0 b-0 ks-0 name))-  (defstrand resp 3 (k k) (ra ra) (rb rb) (tb tb) (a a) (b b) (ks ks))-  (defstrand resp-reauth 3 (k k) (ra-prime ra-prime) (rb-prime rb-prime)-    (tb tb) (a a) (b b) (ks ks))-  (defstrand keyserver 2 (k k) (ra ra-0) (rb rb-0) (tb tb) (a a) (b b)-    (ks ks))-  (defstrand resp 2 (ra ra-0) (rb rb-1) (tb tb) (a a) (b b) (ks ks))-  (defstrand init-reauth 4 (k k) (ra-prime ra-prime-0)-    (rb-prime rb-prime) (tb tb) (a a) (b b) (ks ks))-  (defstrand resp-reauth 2 (k k) (ra-prime ra-prime-0)-    (rb-prime rb-prime-0) (tb tb) (a a) (b b) (ks ks))-  (defstrand init 3 (k k) (ra ra-1) (rb rb) (tb tb-0) (a a-0) (b b-0)-    (ks ks-0))-  (precedes ((0 1) (6 1)) ((1 1) (4 2)) ((2 1) (1 0)) ((2 1) (4 0))-    ((2 1) (5 0)) ((2 1) (6 1)) ((3 1) (2 0)) ((4 3) (1 2))-    ((5 1) (4 2)) ((6 2) (0 2)))-  (non-orig (ltk a ks) (ltk b ks))-  (uniq-orig k ra rb ra-prime rb-prime)-  (operation encryption-test (added-strand init 3) (enc "one" rb k)-    (0 2))-  (strand-map 0 1 2 3 4 5)-  (traces-    ((recv (cat a ra)) (send (cat b rb (enc a ra tb (ltk b ks))))-      (recv (cat (enc a k tb (ltk b ks)) (enc "one" rb k))))-    ((recv (cat (enc a k tb (ltk b ks)) ra-prime))-      (send (cat rb-prime (enc "two" ra-prime k)))-      (recv (enc "three" rb-prime k)))-    ((recv (cat b rb-0 (enc a ra-0 tb (ltk b ks))))-      (send-        (cat (enc b ra-0 k tb (ltk a ks)) (enc a k tb (ltk b ks))-          rb-0)))-    ((recv (cat a ra-0)) (send (cat b rb-1 (enc a ra-0 tb (ltk b ks)))))-    ((recv (enc a k tb (ltk b ks)))-      (send (cat (enc a k tb (ltk b ks)) ra-prime-0))-      (recv (cat rb-prime (enc "two" ra-prime-0 k)))-      (send (enc "three" rb-prime k)))-    ((recv (cat (enc a k tb (ltk b ks)) ra-prime-0))-      (send (cat rb-prime-0 (enc "two" ra-prime-0 k))))-    ((send (cat a-0 ra-1))-      (recv-        (cat (enc b-0 ra-1 k tb-0 (ltk a-0 ks-0))-          (enc a-0 k tb-0 (ltk b-0 ks-0)) rb))-      (send (cat (enc a-0 k tb-0 (ltk b-0 ks-0)) (enc "one" rb k)))))-  (label 30)-  (parent 26)-  (unrealized (6 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton neuman-stubblebine-reauth-  (vars (k skey)-    (ra rb ra-prime rb-prime tb ra-0 rb-0 rb-1 ra-prime-0 rb-prime-0-      text) (a b ks name))-  (defstrand resp 3 (k k) (ra ra) (rb rb) (tb tb) (a a) (b b) (ks ks))-  (defstrand resp-reauth 3 (k k) (ra-prime ra-prime) (rb-prime rb-prime)-    (tb tb) (a a) (b b) (ks ks))-  (defstrand keyserver 2 (k k) (ra ra-0) (rb rb-0) (tb tb) (a a) (b b)-    (ks ks))-  (defstrand resp 2 (ra ra-0) (rb rb-1) (tb tb) (a a) (b b) (ks ks))-  (defstrand init-reauth 4 (k k) (ra-prime ra-prime-0)-    (rb-prime rb-prime) (tb tb) (a a) (b b) (ks ks))-  (defstrand resp-reauth 2 (k k) (ra-prime ra-prime-0)-    (rb-prime rb-prime-0) (tb tb) (a a) (b b) (ks ks))-  (deflistener k)-  (precedes ((1 1) (4 2)) ((2 1) (1 0)) ((2 1) (4 0)) ((2 1) (5 0))-    ((2 1) (6 0)) ((3 1) (2 0)) ((4 3) (1 2)) ((5 1) (4 2))-    ((6 1) (0 2)))-  (non-orig (ltk a ks) (ltk b ks))-  (uniq-orig k ra rb ra-prime rb-prime)-  (operation encryption-test (added-listener k) (enc "one" rb k) (0 2))-  (strand-map 0 1 2 3 4 5)-  (traces-    ((recv (cat a ra)) (send (cat b rb (enc a ra tb (ltk b ks))))-      (recv (cat (enc a k tb (ltk b ks)) (enc "one" rb k))))-    ((recv (cat (enc a k tb (ltk b ks)) ra-prime))-      (send (cat rb-prime (enc "two" ra-prime k)))-      (recv (enc "three" rb-prime k)))-    ((recv (cat b rb-0 (enc a ra-0 tb (ltk b ks))))-      (send-        (cat (enc b ra-0 k tb (ltk a ks)) (enc a k tb (ltk b ks))-          rb-0)))-    ((recv (cat a ra-0)) (send (cat b rb-1 (enc a ra-0 tb (ltk b ks)))))-    ((recv (enc a k tb (ltk b ks)))-      (send (cat (enc a k tb (ltk b ks)) ra-prime-0))-      (recv (cat rb-prime (enc "two" ra-prime-0 k)))-      (send (enc "three" rb-prime k)))-    ((recv (cat (enc a k tb (ltk b ks)) ra-prime-0))-      (send (cat rb-prime-0 (enc "two" ra-prime-0 k))))-    ((recv k) (send k)))-  (label 31)-  (parent 26)-  (unrealized (6 0))-  (dead)-  (comment "empty cohort"))--(defskeleton neuman-stubblebine-reauth-  (vars (k skey)-    (ra tb rb ra-prime rb-prime rb-0 ra-prime-0 rb-prime-0 text)-    (a b ks name))-  (defstrand resp 3 (k k) (ra ra) (rb rb) (tb tb) (a a) (b b) (ks ks))-  (defstrand resp-reauth 3 (k k) (ra-prime ra-prime) (rb-prime rb-prime)-    (tb tb) (a a) (b b) (ks ks))-  (defstrand keyserver 2 (k k) (ra ra) (rb rb-0) (tb tb) (a a) (b b)-    (ks ks))-  (defstrand init-reauth 4 (k k) (ra-prime ra-prime-0)-    (rb-prime rb-prime) (tb tb) (a a) (b b) (ks ks))-  (defstrand resp-reauth 2 (k k) (ra-prime ra-prime-0)-    (rb-prime rb-prime-0) (tb tb) (a a) (b b) (ks ks))-  (defstrand init 3 (k k) (ra ra) (rb rb) (tb tb) (a a) (b b) (ks ks))-  (precedes ((0 1) (2 0)) ((1 1) (3 2)) ((2 1) (1 0)) ((2 1) (3 0))-    ((2 1) (4 0)) ((2 1) (5 1)) ((3 3) (1 2)) ((4 1) (3 2))-    ((5 0) (0 0)) ((5 2) (0 2)))-  (non-orig (ltk a ks) (ltk b ks))-  (uniq-orig k ra rb ra-prime rb-prime)-  (operation encryption-test (displaced 6 2 keyserver 2)-    (enc b ra-0 k tb (ltk a ks)) (5 1))-  (strand-map 0 1 2 3 4 5)-  (traces-    ((recv (cat a ra)) (send (cat b rb (enc a ra tb (ltk b ks))))-      (recv (cat (enc a k tb (ltk b ks)) (enc "one" rb k))))-    ((recv (cat (enc a k tb (ltk b ks)) ra-prime))-      (send (cat rb-prime (enc "two" ra-prime k)))-      (recv (enc "three" rb-prime k)))-    ((recv (cat b rb-0 (enc a ra tb (ltk b ks))))-      (send-        (cat (enc b ra k tb (ltk a ks)) (enc a k tb (ltk b ks)) rb-0)))-    ((recv (enc a k tb (ltk b ks)))-      (send (cat (enc a k tb (ltk b ks)) ra-prime-0))-      (recv (cat rb-prime (enc "two" ra-prime-0 k)))-      (send (enc "three" rb-prime k)))-    ((recv (cat (enc a k tb (ltk b ks)) ra-prime-0))-      (send (cat rb-prime-0 (enc "two" ra-prime-0 k))))-    ((send (cat a ra))-      (recv (cat (enc b ra k tb (ltk a ks)) (enc a k tb (ltk b ks)) rb))-      (send (cat (enc a k tb (ltk b ks)) (enc "one" rb k)))))-  (label 32)-  (parent 28)-  (realized)-  (shape)-  (maps-    ((0 1)-      ((ra ra) (tb tb) (rb rb) (a a) (b b) (ks ks) (k k)-        (ra-prime ra-prime) (rb-prime rb-prime) (tb-0 tb))))-  (origs (k (2 1)) (ra (5 0)) (rb (0 1)) (rb-prime (1 1))))--(defskeleton neuman-stubblebine-reauth-  (vars (k skey) (ra rb ra-prime rb-prime tb ra-0 rb-0 rb-1 text)-    (a b ks name))-  (defstrand resp 3 (k k) (ra ra) (rb rb) (tb tb) (a a) (b b) (ks ks))-  (defstrand resp-reauth 3 (k k) (ra-prime ra-prime) (rb-prime rb-prime)-    (tb tb) (a a) (b b) (ks ks))-  (defstrand keyserver 2 (k k) (ra ra-0) (rb rb-0) (tb tb) (a a) (b b)-    (ks ks))-  (defstrand resp 2 (ra ra-0) (rb rb-1) (tb tb) (a a) (b b) (ks ks))-  (defstrand init-reauth 4 (k k) (ra-prime ra-prime) (rb-prime rb-prime)-    (tb tb) (a a) (b b) (ks ks))-  (defstrand init 3 (k k) (ra ra-0) (rb rb) (tb tb) (a a) (b b) (ks ks))-  (precedes ((0 1) (5 1)) ((1 1) (4 2)) ((2 1) (4 0)) ((2 1) (5 1))-    ((3 1) (2 0)) ((4 1) (1 0)) ((4 3) (1 2)) ((5 2) (0 2)))-  (non-orig (ltk a ks) (ltk b ks))-  (uniq-orig k ra rb ra-prime rb-prime)-  (operation encryption-test (displaced 6 2 keyserver 2)-    (enc b ra-1 k tb (ltk a ks)) (5 1))-  (strand-map 0 1 2 3 4 5)-  (traces-    ((recv (cat a ra)) (send (cat b rb (enc a ra tb (ltk b ks))))-      (recv (cat (enc a k tb (ltk b ks)) (enc "one" rb k))))-    ((recv (cat (enc a k tb (ltk b ks)) ra-prime))-      (send (cat rb-prime (enc "two" ra-prime k)))-      (recv (enc "three" rb-prime k)))-    ((recv (cat b rb-0 (enc a ra-0 tb (ltk b ks))))-      (send-        (cat (enc b ra-0 k tb (ltk a ks)) (enc a k tb (ltk b ks))-          rb-0)))-    ((recv (cat a ra-0)) (send (cat b rb-1 (enc a ra-0 tb (ltk b ks)))))-    ((recv (enc a k tb (ltk b ks)))-      (send (cat (enc a k tb (ltk b ks)) ra-prime))-      (recv (cat rb-prime (enc "two" ra-prime k)))-      (send (enc "three" rb-prime k)))-    ((send (cat a ra-0))-      (recv-        (cat (enc b ra-0 k tb (ltk a ks)) (enc a k tb (ltk b ks)) rb))-      (send (cat (enc a k tb (ltk b ks)) (enc "one" rb k)))))-  (label 33)-  (parent 29)-  (realized)-  (shape)-  (maps-    ((0 1)-      ((ra ra) (tb tb) (rb rb) (a a) (b b) (ks ks) (k k)-        (ra-prime ra-prime) (rb-prime rb-prime) (tb-0 tb))))-  (origs (k (2 1)) (rb (0 1)) (ra-prime (4 1)) (rb-prime (1 1))))--(defskeleton neuman-stubblebine-reauth-  (vars (k skey)-    (ra rb ra-prime rb-prime tb ra-0 rb-0 rb-1 ra-prime-0 rb-prime-0-      ra-1 text) (a b ks name))-  (defstrand resp 3 (k k) (ra ra) (rb rb) (tb tb) (a a) (b b) (ks ks))-  (defstrand resp-reauth 3 (k k) (ra-prime ra-prime) (rb-prime rb-prime)-    (tb tb) (a a) (b b) (ks ks))-  (defstrand keyserver 2 (k k) (ra ra-0) (rb rb-0) (tb tb) (a a) (b b)-    (ks ks))-  (defstrand resp 2 (ra ra-0) (rb rb-1) (tb tb) (a a) (b b) (ks ks))-  (defstrand init-reauth 4 (k k) (ra-prime ra-prime-0)-    (rb-prime rb-prime) (tb tb) (a a) (b b) (ks ks))-  (defstrand resp-reauth 2 (k k) (ra-prime ra-prime-0)-    (rb-prime rb-prime-0) (tb tb) (a a) (b b) (ks ks))-  (defstrand init 3 (k k) (ra ra-1) (rb rb) (tb tb) (a a) (b b) (ks ks))-  (precedes ((0 1) (6 1)) ((1 1) (4 2)) ((2 1) (1 0)) ((2 1) (4 0))-    ((2 1) (5 0)) ((2 1) (6 1)) ((3 1) (2 0)) ((4 3) (1 2))-    ((5 1) (4 2)) ((6 2) (0 2)))-  (non-orig (ltk a ks) (ltk b ks))-  (uniq-orig k ra rb ra-prime rb-prime)-  (operation nonce-test (contracted (a-0 a) (b-0 b) (ks-0 ks) (tb-0 tb))-    k (6 1) (enc a k tb (ltk b ks)) (enc b ra-0 k tb (ltk a ks)))-  (strand-map 0 1 2 3 4 5 6)-  (traces-    ((recv (cat a ra)) (send (cat b rb (enc a ra tb (ltk b ks))))-      (recv (cat (enc a k tb (ltk b ks)) (enc "one" rb k))))-    ((recv (cat (enc a k tb (ltk b ks)) ra-prime))-      (send (cat rb-prime (enc "two" ra-prime k)))-      (recv (enc "three" rb-prime k)))-    ((recv (cat b rb-0 (enc a ra-0 tb (ltk b ks))))-      (send-        (cat (enc b ra-0 k tb (ltk a ks)) (enc a k tb (ltk b ks))-          rb-0)))-    ((recv (cat a ra-0)) (send (cat b rb-1 (enc a ra-0 tb (ltk b ks)))))-    ((recv (enc a k tb (ltk b ks)))-      (send (cat (enc a k tb (ltk b ks)) ra-prime-0))-      (recv (cat rb-prime (enc "two" ra-prime-0 k)))-      (send (enc "three" rb-prime k)))-    ((recv (cat (enc a k tb (ltk b ks)) ra-prime-0))-      (send (cat rb-prime-0 (enc "two" ra-prime-0 k))))-    ((send (cat a ra-1))-      (recv-        (cat (enc b ra-1 k tb (ltk a ks)) (enc a k tb (ltk b ks)) rb))-      (send (cat (enc a k tb (ltk b ks)) (enc "one" rb k)))))-  (label 34)-  (parent 30)-  (unrealized (6 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton neuman-stubblebine-reauth-  (vars (k skey)-    (ra rb ra-prime rb-prime tb ra-0 rb-0 rb-1 ra-prime-0 rb-prime-0-      text) (a b ks name))-  (defstrand resp 3 (k k) (ra ra) (rb rb) (tb tb) (a a) (b b) (ks ks))-  (defstrand resp-reauth 3 (k k) (ra-prime ra-prime) (rb-prime rb-prime)-    (tb tb) (a a) (b b) (ks ks))-  (defstrand keyserver 2 (k k) (ra ra-0) (rb rb-0) (tb tb) (a a) (b b)-    (ks ks))-  (defstrand resp 2 (ra ra-0) (rb rb-1) (tb tb) (a a) (b b) (ks ks))-  (defstrand init-reauth 4 (k k) (ra-prime ra-prime-0)-    (rb-prime rb-prime) (tb tb) (a a) (b b) (ks ks))-  (defstrand resp-reauth 2 (k k) (ra-prime ra-prime-0)-    (rb-prime rb-prime-0) (tb tb) (a a) (b b) (ks ks))-  (defstrand init 3 (k k) (ra ra-0) (rb rb) (tb tb) (a a) (b b) (ks ks))-  (precedes ((0 1) (6 1)) ((1 1) (4 2)) ((2 1) (1 0)) ((2 1) (4 0))-    ((2 1) (5 0)) ((2 1) (6 1)) ((3 1) (2 0)) ((4 3) (1 2))-    ((5 1) (4 2)) ((6 2) (0 2)))-  (non-orig (ltk a ks) (ltk b ks))-  (uniq-orig k ra rb ra-prime rb-prime)-  (operation encryption-test (displaced 7 2 keyserver 2)-    (enc b ra-1 k tb (ltk a ks)) (6 1))-  (strand-map 0 1 2 3 4 5 6)-  (traces-    ((recv (cat a ra)) (send (cat b rb (enc a ra tb (ltk b ks))))-      (recv (cat (enc a k tb (ltk b ks)) (enc "one" rb k))))-    ((recv (cat (enc a k tb (ltk b ks)) ra-prime))-      (send (cat rb-prime (enc "two" ra-prime k)))-      (recv (enc "three" rb-prime k)))-    ((recv (cat b rb-0 (enc a ra-0 tb (ltk b ks))))-      (send-        (cat (enc b ra-0 k tb (ltk a ks)) (enc a k tb (ltk b ks))-          rb-0)))-    ((recv (cat a ra-0)) (send (cat b rb-1 (enc a ra-0 tb (ltk b ks)))))-    ((recv (enc a k tb (ltk b ks)))-      (send (cat (enc a k tb (ltk b ks)) ra-prime-0))-      (recv (cat rb-prime (enc "two" ra-prime-0 k)))-      (send (enc "three" rb-prime k)))-    ((recv (cat (enc a k tb (ltk b ks)) ra-prime-0))-      (send (cat rb-prime-0 (enc "two" ra-prime-0 k))))-    ((send (cat a ra-0))-      (recv-        (cat (enc b ra-0 k tb (ltk a ks)) (enc a k tb (ltk b ks)) rb))-      (send (cat (enc a k tb (ltk b ks)) (enc "one" rb k)))))-  (label 35)-  (parent 34)-  (realized)-  (shape)-  (maps-    ((0 1)-      ((ra ra) (tb tb) (rb rb) (a a) (b b) (ks ks) (k k)-        (ra-prime ra-prime) (rb-prime rb-prime) (tb-0 tb))))-  (origs (k (2 1)) (rb (0 1)) (rb-prime (1 1))))--(comment "Nothing left to do")
− tst/neuman-stubblebine-reauth.lisp 
@@ -1,42 +0,0 @@-(defprotocol neuman-stubblebine basic-  (defrole init-    (vars (a name) (b name) (ks name) (ra text) (ra-prime text) (rb text) (rb-prime text) (k skey) (tb text))-    (trace (send (cat a ra))-	   (recv (cat (enc (cat b ra k tb) (ltk a ks)) (enc (cat a k tb) (ltk b ks)) rb))-	   (send (cat (enc (cat a k tb) (ltk b ks)) (enc rb k)))-	   (send (cat (enc (cat a k tb) (ltk b ks)) ra-prime))-	   (recv (cat rb-prime (enc ra-prime k)))-	   (send (enc rb-prime k))))-  (defrole resp-    (vars (a name) (b name) (ks name) (ra text) (ra-prime text) (rb text) (rb-prime text) (k skey) (tb text))-    (trace (recv (cat a ra))-	   (send (cat b rb (enc (cat a ra tb) (ltk b ks))))-	   (recv (cat (enc (cat a k tb) (ltk b ks)) (enc rb k)))-	   (recv (cat (enc (cat a k tb) (ltk b ks)) ra-prime))-	   (send (cat rb-prime (enc ra-prime k)))-	   (recv (enc rb-prime k))))-  (defrole keyserver-    (vars (a name) (b name) (ks name) (ra text) (rb text) (k skey) (tb text))-    (trace (recv (cat b rb (enc (cat a ra tb) (ltk b ks))))-	   (send (cat (enc (cat b ra k tb) (ltk a ks)) (enc (cat a k tb) (ltk b ks)) rb)))-    (uniq-orig k)))--;(defskeleton neuman-stubblebine-;  (vars (a name) (b name) (k skey) (ks name) (ra text) (rb text))-;  (defstrand init 6 (a a) (b b) (ks ks) (ra ra) (rb rb))-;  (deflistener k)-;  (uniq-orig ra rb)-;  (non-orig (ltk a ks) (ltk b ks)))--(defskeleton neuman-stubblebine-  (vars (a name) (b name) (ks name) (ra text) (rb text) (k skey))-  (defstrand resp 6 (a a) (b b) (ks ks) (ra ra) (rb rb) (k k))- ; (deflistener k)-  (uniq-orig ra rb)-  (non-orig (ltk a ks) (ltk b ks)))--;(defskeleton neuman-stubblebine-;  (vars (a name) (b name) (ks name) (ra text) (rb text))-;  (defstrand keyserver 2 (a a) (b b) (ks ks) (ra ra) (rb rb))-;  (uniq-orig ra rb)-;  (non-orig (ltk a ks) (ltk b ks)))
tst/neuman-stubblebine-reauth.tst view
@@ -1,6 +1,6 @@ (herald neuman-stubblebine-reauth (bound 8)) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/neuman-stubblebine-reauth.lsp") (comment "Strand count bounded at 8")
tst/neuman-stubblebine.tst view
@@ -1,4 +1,4 @@-(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/neuman-stubblebine.scm")  (defprotocol neuman-stubblebine basic
tst/no_contraction.tst view
@@ -1,4 +1,4 @@-(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/no_contraction.scm")  (defprotocol no-contraction basic
tst/non_transforming.tst view
@@ -1,4 +1,4 @@-(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/non_transforming.scm")  (defprotocol non_transforming basic
tst/nonaug-prune.tst view
@@ -1,4 +1,4 @@-(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/nonaug-prune.scm")  (defprotocol nonaug-prune basic
tst/ns-l.tst view
@@ -1,7 +1,7 @@ (herald "Needham-Schroeder-Low Public-Key Protocol"   (comment "With deflistener's")) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/ns-l.scm")  (defprotocol ns basic
tst/ns-rebinding.tst view
@@ -1,6 +1,6 @@ (herald "ALternate Needham-Schroeder Public-Key Protocol Variants") -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/ns-rebinding.scm")  (defprotocol ns basic
− tst/ns-unrebinding.scm 
@@ -1,81 +0,0 @@---(herald "ALternate Needham-Schroeder Public-Key Protocol Variants")--(defprotocol ns basic-  (defrole init-    (vars (a b name) (n1 n2 text))-    (trace-     (send (enc n1 a (pubk b)))-     (recv (enc n1 n2 b (pubk a)))-     (send (enc n2 (pubk b))))-  )-  (defrole resp-    (vars (b a name) (n2 n1 text))-    (trace-     (recv (enc n1 a (pubk b)))-     (send (enc n1 n2 b (pubk a)))-     (recv (enc n2 (pubk b)))))--  --  (comment "Needham-Schroeder with no role origination assumptions"))--;;; The initiator point-of-view-(defskeleton ns-  (vars (a b name) (n1 text))-  (defstrand init 3 (a a) (b b) (n1 n1))-  (non-orig (privk b) (privk a))-  (uniq-orig n1)-  (comment "Initiator point-of-view"))--(defskeleton ns-  (vars (a b name) (n1 text))-  (defstrand init 3 (a a) (b b) (n1 n1))-  (non-orig (privk b) (privk a))-  (uniq-orig n1)-  (facts (rel n1 n1))-  (comment "Initiator point-of-view"))--(defskeleton ns-  (vars (a b name) (n1 text))-  (defstrand init 3 (a a) (b b) (n1 n1))-  (non-orig (privk b))-  (uniq-orig n1)-  (comment "Initiator point-of-view"))--(defskeleton ns-  (vars (a b name) (n1 text))-  (defstrand init 3 (a a) (b b) (n1 n1))-  (deflistener n1)-  (non-orig (privk b) (privk a))-  (uniq-orig n1)-  (comment "Initiator point-of-view"))--;;; Double initiator point-of-view-(defskeleton ns-  (vars (a b name) (n1 n1-0 text))-  (defstrand init 3 (a a) (b b) (n1 n1))-  (defstrand init 3 (a a) (b b) (n1 n1-0))-  (non-orig (privk b) (privk a))-  (uniq-orig n1 n1-0)-  (comment "Double initiator point-of-view"))--;;; Double initiator point-of-view, same nonce-(defskeleton ns-  (vars (a b name) (n1 text))-  (defstrand init 3 (a a) (b b) (n1 n1))-  (defstrand init 3 (a a) (b b) (n1 n1))-  (non-orig (privk b) (privk a))-  (uniq-orig n1)-  (comment "Double initiator point-of-view, same nonce"))--;;; The responder point-of-view-(defskeleton ns-  (vars (a name) (n2 text))-  (defstrand resp 3 (a a) (n2 n2))-  (non-orig (privk a))-  (uniq-orig n2)-  (comment "Responder point-of-view"))--
− tst/ns-unrebinding.tst 
@@ -1,694 +0,0 @@-(herald "ALternate Needham-Schroeder Public-Key Protocol Variants")--(comment "CPSA 4.4.7")-(comment "All input read from tst/ns-unrebinding.scm")--(defprotocol ns basic-  (defrole init-    (vars (a b name) (n1 n2 text))-    (trace (send (enc n1 a (pubk b))) (recv (enc n1 n2 b (pubk a)))-      (send (enc n2 (pubk b)))))-  (defrole resp-    (vars (b a name) (n2 n1 text))-    (trace (recv (enc n1 a (pubk b))) (send (enc n1 n2 b (pubk a)))-      (recv (enc n2 (pubk b)))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (comment "Needham-Schroeder with no role origination assumptions"))--(defskeleton ns-  (vars (n1 n2 text) (a b name))-  (defstrand init 3 (n1 n1) (n2 n2) (a a) (b b))-  (non-orig (privk a) (privk b))-  (uniq-orig n1)-  (comment "Initiator point-of-view")-  (traces-    ((send (enc n1 a (pubk b))) (recv (enc n1 n2 b (pubk a)))-      (send (enc n2 (pubk b)))))-  (label 0)-  (unrealized (0 1))-  (maps ((0) ((a a) (b b) (n1 n1) (n2 n2))))-  (origs (n1 (0 0)))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton ns-  (vars (n1 n2 n2-0 text) (a b name))-  (defstrand init 3 (n1 n1) (n2 n2) (a a) (b b))-  (defstrand resp 2 (n2 n2-0) (n1 n1) (b b) (a a))-  (precedes ((0 0) (1 0)) ((1 1) (0 1)))-  (non-orig (privk a) (privk b))-  (uniq-orig n1)-  (comment "Initiator point-of-view")-  (operation nonce-test (added-strand resp 2) n1 (0 1)-    (enc n1 a (pubk b)))-  (strand-map 0)-  (traces-    ((send (enc n1 a (pubk b))) (recv (enc n1 n2 b (pubk a)))-      (send (enc n2 (pubk b))))-    ((recv (enc n1 a (pubk b))) (send (enc n1 n2-0 b (pubk a)))))-  (label 1)-  (parent 0)-  (unrealized (0 1))-  (maps ((0) ((a a) (b b) (n1 n1) (n2 n2))))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton ns-  (vars (n1 n2 text) (a b name))-  (defstrand init 3 (n1 n1) (n2 n2) (a a) (b b))-  (defstrand resp 2 (n2 n2) (n1 n1) (b b) (a a))-  (precedes ((0 0) (1 0)) ((1 1) (0 1)))-  (non-orig (privk a) (privk b))-  (uniq-orig n1)-  (comment "Initiator point-of-view")-  (operation nonce-test (contracted (n2-0 n2)) n1 (0 1)-    (enc n1 a (pubk b)) (enc n1 n2 b (pubk a)))-  (strand-map 0 1)-  (traces-    ((send (enc n1 a (pubk b))) (recv (enc n1 n2 b (pubk a)))-      (send (enc n2 (pubk b))))-    ((recv (enc n1 a (pubk b))) (send (enc n1 n2 b (pubk a)))))-  (label 2)-  (parent 1)-  (realized)-  (shape)-  (maps ((0) ((a a) (b b) (n1 n1) (n2 n2))))-  (origs (n1 (0 0))))--(comment "Nothing left to do")--(defprotocol ns basic-  (defrole init-    (vars (a b name) (n1 n2 text))-    (trace (send (enc n1 a (pubk b))) (recv (enc n1 n2 b (pubk a)))-      (send (enc n2 (pubk b)))))-  (defrole resp-    (vars (b a name) (n2 n1 text))-    (trace (recv (enc n1 a (pubk b))) (send (enc n1 n2 b (pubk a)))-      (recv (enc n2 (pubk b)))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (comment "Needham-Schroeder with no role origination assumptions"))--(defskeleton ns-  (vars (n1 n2 text) (a b name))-  (defstrand init 3 (n1 n1) (n2 n2) (a a) (b b))-  (non-orig (privk a) (privk b))-  (uniq-orig n1)-  (facts (rel n1 n1))-  (comment "Initiator point-of-view")-  (traces-    ((send (enc n1 a (pubk b))) (recv (enc n1 n2 b (pubk a)))-      (send (enc n2 (pubk b)))))-  (label 3)-  (unrealized (0 1))-  (maps ((0) ((a a) (b b) (n1 n1) (n2 n2))))-  (origs (n1 (0 0)))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton ns-  (vars (n1 n2 n2-0 text) (a b name))-  (defstrand init 3 (n1 n1) (n2 n2) (a a) (b b))-  (defstrand resp 2 (n2 n2-0) (n1 n1) (b b) (a a))-  (precedes ((0 0) (1 0)) ((1 1) (0 1)))-  (non-orig (privk a) (privk b))-  (uniq-orig n1)-  (facts (rel n1 n1))-  (comment "Initiator point-of-view")-  (operation nonce-test (added-strand resp 2) n1 (0 1)-    (enc n1 a (pubk b)))-  (strand-map 0)-  (traces-    ((send (enc n1 a (pubk b))) (recv (enc n1 n2 b (pubk a)))-      (send (enc n2 (pubk b))))-    ((recv (enc n1 a (pubk b))) (send (enc n1 n2-0 b (pubk a)))))-  (label 4)-  (parent 3)-  (unrealized (0 1))-  (maps ((0) ((a a) (b b) (n1 n1) (n2 n2))))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton ns-  (vars (n1 n2 text) (a b name))-  (defstrand init 3 (n1 n1) (n2 n2) (a a) (b b))-  (defstrand resp 2 (n2 n2) (n1 n1) (b b) (a a))-  (precedes ((0 0) (1 0)) ((1 1) (0 1)))-  (non-orig (privk a) (privk b))-  (uniq-orig n1)-  (facts (rel n1 n1))-  (comment "Initiator point-of-view")-  (operation nonce-test (contracted (n2-0 n2)) n1 (0 1)-    (enc n1 a (pubk b)) (enc n1 n2 b (pubk a)))-  (strand-map 0 1)-  (traces-    ((send (enc n1 a (pubk b))) (recv (enc n1 n2 b (pubk a)))-      (send (enc n2 (pubk b))))-    ((recv (enc n1 a (pubk b))) (send (enc n1 n2 b (pubk a)))))-  (label 5)-  (parent 4)-  (realized)-  (shape)-  (maps ((0) ((a a) (b b) (n1 n1) (n2 n2))))-  (origs (n1 (0 0))))--(comment "Nothing left to do")--(defprotocol ns basic-  (defrole init-    (vars (a b name) (n1 n2 text))-    (trace (send (enc n1 a (pubk b))) (recv (enc n1 n2 b (pubk a)))-      (send (enc n2 (pubk b)))))-  (defrole resp-    (vars (b a name) (n2 n1 text))-    (trace (recv (enc n1 a (pubk b))) (send (enc n1 n2 b (pubk a)))-      (recv (enc n2 (pubk b)))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (comment "Needham-Schroeder with no role origination assumptions"))--(defskeleton ns-  (vars (n1 n2 text) (a b name))-  (defstrand init 3 (n1 n1) (n2 n2) (a a) (b b))-  (non-orig (privk b))-  (uniq-orig n1)-  (comment "Initiator point-of-view")-  (traces-    ((send (enc n1 a (pubk b))) (recv (enc n1 n2 b (pubk a)))-      (send (enc n2 (pubk b)))))-  (label 6)-  (unrealized (0 1))-  (maps ((0) ((a a) (b b) (n1 n1) (n2 n2))))-  (origs (n1 (0 0)))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton ns-  (vars (n1 n2 n2-0 text) (a b name))-  (defstrand init 3 (n1 n1) (n2 n2) (a a) (b b))-  (defstrand resp 2 (n2 n2-0) (n1 n1) (b b) (a a))-  (precedes ((0 0) (1 0)) ((1 1) (0 1)))-  (non-orig (privk b))-  (uniq-orig n1)-  (comment "Initiator point-of-view")-  (operation nonce-test (added-strand resp 2) n1 (0 1)-    (enc n1 a (pubk b)))-  (strand-map 0)-  (traces-    ((send (enc n1 a (pubk b))) (recv (enc n1 n2 b (pubk a)))-      (send (enc n2 (pubk b))))-    ((recv (enc n1 a (pubk b))) (send (enc n1 n2-0 b (pubk a)))))-  (label 7)-  (parent 6)-  (realized)-  (shape)-  (maps ((0) ((a a) (b b) (n1 n1) (n2 n2))))-  (origs (n1 (0 0))))--(comment "Nothing left to do")--(defprotocol ns basic-  (defrole init-    (vars (a b name) (n1 n2 text))-    (trace (send (enc n1 a (pubk b))) (recv (enc n1 n2 b (pubk a)))-      (send (enc n2 (pubk b)))))-  (defrole resp-    (vars (b a name) (n2 n1 text))-    (trace (recv (enc n1 a (pubk b))) (send (enc n1 n2 b (pubk a)))-      (recv (enc n2 (pubk b)))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (comment "Needham-Schroeder with no role origination assumptions"))--(defskeleton ns-  (vars (n1 n2 text) (a b name))-  (defstrand init 3 (n1 n1) (n2 n2) (a a) (b b))-  (deflistener n1)-  (non-orig (privk a) (privk b))-  (uniq-orig n1)-  (comment "Initiator point-of-view")-  (traces-    ((send (enc n1 a (pubk b))) (recv (enc n1 n2 b (pubk a)))-      (send (enc n2 (pubk b)))) ((recv n1) (send n1)))-  (label 8)-  (unrealized (0 1) (1 0))-  (preskeleton)-  (maps ((0 1) ((a a) (b b) (n1 n1) (n2 n2))))-  (origs (n1 (0 0)))-  (comment "Not a skeleton"))--(defskeleton ns-  (vars (n1 n2 text) (a b name))-  (defstrand init 3 (n1 n1) (n2 n2) (a a) (b b))-  (deflistener n1)-  (precedes ((0 0) (1 0)))-  (non-orig (privk a) (privk b))-  (uniq-orig n1)-  (comment "Initiator point-of-view")-  (traces-    ((send (enc n1 a (pubk b))) (recv (enc n1 n2 b (pubk a)))-      (send (enc n2 (pubk b)))) ((recv n1) (send n1)))-  (label 9)-  (parent 8)-  (unrealized (0 1) (1 0))-  (maps ((0 1) ((a a) (b b) (n1 n1) (n2 n2))))-  (origs (n1 (0 0)))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton ns-  (vars (n1 n2 n2-0 text) (a b name))-  (defstrand init 3 (n1 n1) (n2 n2) (a a) (b b))-  (deflistener n1)-  (defstrand resp 2 (n2 n2-0) (n1 n1) (b b) (a a))-  (precedes ((0 0) (2 0)) ((2 1) (1 0)))-  (non-orig (privk a) (privk b))-  (uniq-orig n1)-  (comment "Initiator point-of-view")-  (operation nonce-test (added-strand resp 2) n1 (1 0)-    (enc n1 a (pubk b)))-  (strand-map 0 1)-  (traces-    ((send (enc n1 a (pubk b))) (recv (enc n1 n2 b (pubk a)))-      (send (enc n2 (pubk b)))) ((recv n1) (send n1))-    ((recv (enc n1 a (pubk b))) (send (enc n1 n2-0 b (pubk a)))))-  (label 10)-  (parent 9)-  (unrealized (0 1) (1 0))-  (maps ((0 1) ((a a) (b b) (n1 n1) (n2 n2))))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton ns-  (vars (n2 text) (a b name))-  (defstrand init 3 (n1 n2) (n2 n2) (a a) (b b))-  (deflistener n2)-  (defstrand resp 2 (n2 n2) (n1 n2) (b b) (a a))-  (precedes ((0 0) (2 0)) ((0 2) (1 0)) ((2 1) (1 0)))-  (non-orig (privk a) (privk b))-  (uniq-orig n2)-  (comment "Initiator point-of-view")-  (operation nonce-test (displaced 3 0 init 3) n2-0 (1 0)-    (enc n2-0 a (pubk b)) (enc n2-0 n2-0 b (pubk a)))-  (strand-map 0 1 2)-  (traces-    ((send (enc n2 a (pubk b))) (recv (enc n2 n2 b (pubk a)))-      (send (enc n2 (pubk b)))) ((recv n2) (send n2))-    ((recv (enc n2 a (pubk b))) (send (enc n2 n2 b (pubk a)))))-  (label 11)-  (parent 10)-  (unrealized (0 1) (1 0))-  (maps ((0 1) ((a a) (b b) (n1 n2) (n2 n2))))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton ns-  (vars (n2 n2-0 text) (a b name))-  (defstrand init 3 (n1 n2) (n2 n2) (a a) (b b))-  (deflistener n2)-  (defstrand resp 2 (n2 n2) (n1 n2) (b b) (a a))-  (defstrand resp 2 (n2 n2-0) (n1 n2) (b b) (a a))-  (precedes ((0 0) (2 0)) ((0 0) (3 0)) ((0 2) (1 0)) ((2 1) (1 0))-    ((3 1) (1 0)))-  (non-orig (privk a) (privk b))-  (uniq-orig n2)-  (comment "Initiator point-of-view")-  (operation nonce-test (added-strand resp 2) n2 (1 0) (enc n2 (pubk b))-    (enc n2 a (pubk b)) (enc n2 n2 b (pubk a)))-  (strand-map 0 1 2)-  (traces-    ((send (enc n2 a (pubk b))) (recv (enc n2 n2 b (pubk a)))-      (send (enc n2 (pubk b)))) ((recv n2) (send n2))-    ((recv (enc n2 a (pubk b))) (send (enc n2 n2 b (pubk a))))-    ((recv (enc n2 a (pubk b))) (send (enc n2 n2-0 b (pubk a)))))-  (label 12)-  (parent 11)-  (unrealized (0 1) (1 0))-  (dead)-  (maps ((0 1) ((a a) (b b) (n1 n2) (n2 n2))))-  (comment "empty cohort"))--(comment "Nothing left to do")--(defprotocol ns basic-  (defrole init-    (vars (a b name) (n1 n2 text))-    (trace (send (enc n1 a (pubk b))) (recv (enc n1 n2 b (pubk a)))-      (send (enc n2 (pubk b)))))-  (defrole resp-    (vars (b a name) (n2 n1 text))-    (trace (recv (enc n1 a (pubk b))) (send (enc n1 n2 b (pubk a)))-      (recv (enc n2 (pubk b)))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (comment "Needham-Schroeder with no role origination assumptions"))--(defskeleton ns-  (vars (n1 n1-0 n2 n2-0 text) (a b name))-  (defstrand init 3 (n1 n1) (n2 n2) (a a) (b b))-  (defstrand init 3 (n1 n1-0) (n2 n2-0) (a a) (b b))-  (non-orig (privk a) (privk b))-  (uniq-orig n1 n1-0)-  (comment "Double initiator point-of-view")-  (traces-    ((send (enc n1 a (pubk b))) (recv (enc n1 n2 b (pubk a)))-      (send (enc n2 (pubk b))))-    ((send (enc n1-0 a (pubk b))) (recv (enc n1-0 n2-0 b (pubk a)))-      (send (enc n2-0 (pubk b)))))-  (label 13)-  (unrealized (0 1) (1 1))-  (maps ((0 1) ((a a) (b b) (n1 n1) (n1-0 n1-0) (n2 n2) (n2-0 n2-0))))-  (origs (n1 (0 0)) (n1-0 (1 0)))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton ns-  (vars (n1 n2 text) (a b name))-  (defstrand init 3 (n1 n1) (n2 n2) (a a) (b b))-  (non-orig (privk a) (privk b))-  (uniq-orig n1)-  (comment "Double initiator point-of-view")-  (operation collapsed 1 0)-  (strand-map 0 0)-  (traces-    ((send (enc n1 a (pubk b))) (recv (enc n1 n2 b (pubk a)))-      (send (enc n2 (pubk b)))))-  (label 14)-  (parent 13)-  (unrealized (0 1))-  (maps ((0 0) ((a a) (b b) (n1 n1) (n1-0 n1) (n2 n2) (n2-0 n2))))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton ns-  (vars (n1 n1-0 n2 n2-0 n2-1 text) (a b name))-  (defstrand init 3 (n1 n1) (n2 n2) (a a) (b b))-  (defstrand init 3 (n1 n1-0) (n2 n2-0) (a a) (b b))-  (defstrand resp 2 (n2 n2-1) (n1 n1-0) (b b) (a a))-  (precedes ((1 0) (2 0)) ((2 1) (1 1)))-  (non-orig (privk a) (privk b))-  (uniq-orig n1 n1-0)-  (comment "Double initiator point-of-view")-  (operation nonce-test (added-strand resp 2) n1-0 (1 1)-    (enc n1-0 a (pubk b)))-  (strand-map 0 1)-  (traces-    ((send (enc n1 a (pubk b))) (recv (enc n1 n2 b (pubk a)))-      (send (enc n2 (pubk b))))-    ((send (enc n1-0 a (pubk b))) (recv (enc n1-0 n2-0 b (pubk a)))-      (send (enc n2-0 (pubk b))))-    ((recv (enc n1-0 a (pubk b))) (send (enc n1-0 n2-1 b (pubk a)))))-  (label 15)-  (parent 13)-  (unrealized (0 1) (1 1))-  (maps ((0 1) ((a a) (b b) (n1 n1) (n1-0 n1-0) (n2 n2) (n2-0 n2-0))))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton ns-  (vars (n1 n2 n2-0 text) (a b name))-  (defstrand init 3 (n1 n1) (n2 n2) (a a) (b b))-  (defstrand resp 2 (n2 n2-0) (n1 n1) (b b) (a a))-  (precedes ((0 0) (1 0)) ((1 1) (0 1)))-  (non-orig (privk a) (privk b))-  (uniq-orig n1)-  (comment "Double initiator point-of-view")-  (operation nonce-test (added-strand resp 2) n1 (0 1)-    (enc n1 a (pubk b)))-  (strand-map 0)-  (traces-    ((send (enc n1 a (pubk b))) (recv (enc n1 n2 b (pubk a)))-      (send (enc n2 (pubk b))))-    ((recv (enc n1 a (pubk b))) (send (enc n1 n2-0 b (pubk a)))))-  (label 16)-  (parent 14)-  (unrealized (0 1))-  (maps ((0 0) ((a a) (b b) (n1 n1) (n1-0 n1) (n2 n2) (n2-0 n2))))-  (origs (n1 (0 0)))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton ns-  (vars (n1 n1-0 n2 n2-0 text) (a b name))-  (defstrand init 3 (n1 n1) (n2 n2) (a a) (b b))-  (defstrand init 3 (n1 n1-0) (n2 n2-0) (a a) (b b))-  (defstrand resp 2 (n2 n2-0) (n1 n1-0) (b b) (a a))-  (precedes ((1 0) (2 0)) ((2 1) (1 1)))-  (non-orig (privk a) (privk b))-  (uniq-orig n1 n1-0)-  (comment "Double initiator point-of-view")-  (operation nonce-test (contracted (n2-1 n2-0)) n1-0 (1 1)-    (enc n1-0 a (pubk b)) (enc n1-0 n2-0 b (pubk a)))-  (strand-map 0 1 2)-  (traces-    ((send (enc n1 a (pubk b))) (recv (enc n1 n2 b (pubk a)))-      (send (enc n2 (pubk b))))-    ((send (enc n1-0 a (pubk b))) (recv (enc n1-0 n2-0 b (pubk a)))-      (send (enc n2-0 (pubk b))))-    ((recv (enc n1-0 a (pubk b))) (send (enc n1-0 n2-0 b (pubk a)))))-  (label 17)-  (parent 15)-  (unrealized (0 1))-  (maps ((0 1) ((a a) (b b) (n1 n1) (n1-0 n1-0) (n2 n2) (n2-0 n2-0))))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton ns-  (vars (n1 n2 text) (a b name))-  (defstrand init 3 (n1 n1) (n2 n2) (a a) (b b))-  (defstrand resp 2 (n2 n2) (n1 n1) (b b) (a a))-  (precedes ((0 0) (1 0)) ((1 1) (0 1)))-  (non-orig (privk a) (privk b))-  (uniq-orig n1)-  (comment "Double initiator point-of-view")-  (operation nonce-test (contracted (n2-0 n2)) n1 (0 1)-    (enc n1 a (pubk b)) (enc n1 n2 b (pubk a)))-  (strand-map 0 1)-  (traces-    ((send (enc n1 a (pubk b))) (recv (enc n1 n2 b (pubk a)))-      (send (enc n2 (pubk b))))-    ((recv (enc n1 a (pubk b))) (send (enc n1 n2 b (pubk a)))))-  (label 18)-  (parent 16)-  (realized)-  (shape)-  (maps ((0 0) ((a a) (b b) (n1 n1) (n1-0 n1) (n2 n2) (n2-0 n2))))-  (origs (n1 (0 0))))--(defskeleton ns-  (vars (n1 n1-0 n2 n2-0 n2-1 text) (a b name))-  (defstrand init 3 (n1 n1) (n2 n2) (a a) (b b))-  (defstrand init 3 (n1 n1-0) (n2 n2-0) (a a) (b b))-  (defstrand resp 2 (n2 n2-0) (n1 n1-0) (b b) (a a))-  (defstrand resp 2 (n2 n2-1) (n1 n1) (b b) (a a))-  (precedes ((0 0) (3 0)) ((1 0) (2 0)) ((2 1) (1 1)) ((3 1) (0 1)))-  (non-orig (privk a) (privk b))-  (uniq-orig n1 n1-0)-  (comment "Double initiator point-of-view")-  (operation nonce-test (added-strand resp 2) n1 (0 1)-    (enc n1 a (pubk b)))-  (strand-map 0 1 2)-  (traces-    ((send (enc n1 a (pubk b))) (recv (enc n1 n2 b (pubk a)))-      (send (enc n2 (pubk b))))-    ((send (enc n1-0 a (pubk b))) (recv (enc n1-0 n2-0 b (pubk a)))-      (send (enc n2-0 (pubk b))))-    ((recv (enc n1-0 a (pubk b))) (send (enc n1-0 n2-0 b (pubk a))))-    ((recv (enc n1 a (pubk b))) (send (enc n1 n2-1 b (pubk a)))))-  (label 19)-  (parent 17)-  (unrealized (0 1))-  (maps ((0 1) ((a a) (b b) (n1 n1) (n1-0 n1-0) (n2 n2) (n2-0 n2-0))))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton ns-  (vars (n1 n1-0 n2 n2-0 text) (a b name))-  (defstrand init 3 (n1 n1) (n2 n2-0) (a a) (b b))-  (defstrand init 3 (n1 n1-0) (n2 n2) (a a) (b b))-  (defstrand resp 2 (n2 n2) (n1 n1-0) (b b) (a a))-  (defstrand resp 2 (n2 n2-0) (n1 n1) (b b) (a a))-  (precedes ((0 0) (3 0)) ((1 0) (2 0)) ((2 1) (1 1)) ((3 1) (0 1)))-  (non-orig (privk a) (privk b))-  (uniq-orig n1 n1-0)-  (comment "Double initiator point-of-view")-  (operation nonce-test (contracted (n2-1 n2-0)) n1 (0 1)-    (enc n1 a (pubk b)) (enc n1 n2-0 b (pubk a)))-  (strand-map 0 1 2 3)-  (traces-    ((send (enc n1 a (pubk b))) (recv (enc n1 n2-0 b (pubk a)))-      (send (enc n2-0 (pubk b))))-    ((send (enc n1-0 a (pubk b))) (recv (enc n1-0 n2 b (pubk a)))-      (send (enc n2 (pubk b))))-    ((recv (enc n1-0 a (pubk b))) (send (enc n1-0 n2 b (pubk a))))-    ((recv (enc n1 a (pubk b))) (send (enc n1 n2-0 b (pubk a)))))-  (label 20)-  (parent 19)-  (realized)-  (shape)-  (maps ((0 1) ((a a) (b b) (n1 n1) (n1-0 n1-0) (n2 n2-0) (n2-0 n2))))-  (origs (n1 (0 0)) (n1-0 (1 0))))--(comment "Nothing left to do")--(defprotocol ns basic-  (defrole init-    (vars (a b name) (n1 n2 text))-    (trace (send (enc n1 a (pubk b))) (recv (enc n1 n2 b (pubk a)))-      (send (enc n2 (pubk b)))))-  (defrole resp-    (vars (b a name) (n2 n1 text))-    (trace (recv (enc n1 a (pubk b))) (send (enc n1 n2 b (pubk a)))-      (recv (enc n2 (pubk b)))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (comment "Needham-Schroeder with no role origination assumptions"))--(defskeleton ns-  (vars (n1 n2 n2-0 text) (a b name))-  (defstrand init 3 (n1 n1) (n2 n2) (a a) (b b))-  (defstrand init 3 (n1 n1) (n2 n2-0) (a a) (b b))-  (non-orig (privk a) (privk b))-  (uniq-orig n1)-  (comment "Double initiator point-of-view, same nonce")-  (traces-    ((send (enc n1 a (pubk b))) (recv (enc n1 n2 b (pubk a)))-      (send (enc n2 (pubk b))))-    ((send (enc n1 a (pubk b))) (recv (enc n1 n2-0 b (pubk a)))-      (send (enc n2-0 (pubk b)))))-  (label 21)-  (realized)-  (preskeleton)-  (maps ((0 1) ((a a) (b b) (n1 n1) (n2 n2) (n2-0 n2-0))))-  (origs (n1 (1 0)) (n1 (0 0)))-  (comment "Not a skeleton"))--(defskeleton ns-  (vars (n1 n2 text) (a b name))-  (defstrand init 3 (n1 n1) (n2 n2) (a a) (b b))-  (non-orig (privk a) (privk b))-  (uniq-orig n1)-  (comment "Double initiator point-of-view, same nonce")-  (traces-    ((send (enc n1 a (pubk b))) (recv (enc n1 n2 b (pubk a)))-      (send (enc n2 (pubk b)))))-  (label 22)-  (parent 21)-  (unrealized (0 1))-  (maps ((0 0) ((a a) (b b) (n1 n1) (n2 n2) (n2-0 n2))))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton ns-  (vars (n1 n2 n2-0 text) (a b name))-  (defstrand init 3 (n1 n1) (n2 n2) (a a) (b b))-  (defstrand resp 2 (n2 n2-0) (n1 n1) (b b) (a a))-  (precedes ((0 0) (1 0)) ((1 1) (0 1)))-  (non-orig (privk a) (privk b))-  (uniq-orig n1)-  (comment "Double initiator point-of-view, same nonce")-  (operation nonce-test (added-strand resp 2) n1 (0 1)-    (enc n1 a (pubk b)))-  (strand-map 0)-  (traces-    ((send (enc n1 a (pubk b))) (recv (enc n1 n2 b (pubk a)))-      (send (enc n2 (pubk b))))-    ((recv (enc n1 a (pubk b))) (send (enc n1 n2-0 b (pubk a)))))-  (label 23)-  (parent 22)-  (unrealized (0 1))-  (maps ((0 0) ((a a) (b b) (n1 n1) (n2 n2) (n2-0 n2))))-  (origs (n1 (0 0)))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton ns-  (vars (n1 n2 text) (a b name))-  (defstrand init 3 (n1 n1) (n2 n2) (a a) (b b))-  (defstrand resp 2 (n2 n2) (n1 n1) (b b) (a a))-  (precedes ((0 0) (1 0)) ((1 1) (0 1)))-  (non-orig (privk a) (privk b))-  (uniq-orig n1)-  (comment "Double initiator point-of-view, same nonce")-  (operation nonce-test (contracted (n2-0 n2)) n1 (0 1)-    (enc n1 a (pubk b)) (enc n1 n2 b (pubk a)))-  (strand-map 0 1)-  (traces-    ((send (enc n1 a (pubk b))) (recv (enc n1 n2 b (pubk a)))-      (send (enc n2 (pubk b))))-    ((recv (enc n1 a (pubk b))) (send (enc n1 n2 b (pubk a)))))-  (label 24)-  (parent 23)-  (realized)-  (shape)-  (maps ((0 0) ((a a) (b b) (n1 n1) (n2 n2) (n2-0 n2))))-  (origs (n1 (0 0))))--(comment "Nothing left to do")--(defprotocol ns basic-  (defrole init-    (vars (a b name) (n1 n2 text))-    (trace (send (enc n1 a (pubk b))) (recv (enc n1 n2 b (pubk a)))-      (send (enc n2 (pubk b)))))-  (defrole resp-    (vars (b a name) (n2 n1 text))-    (trace (recv (enc n1 a (pubk b))) (send (enc n1 n2 b (pubk a)))-      (recv (enc n2 (pubk b)))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (comment "Needham-Schroeder with no role origination assumptions"))--(defskeleton ns-  (vars (n2 n1 text) (a b name))-  (defstrand resp 3 (n2 n2) (n1 n1) (b b) (a a))-  (non-orig (privk a))-  (uniq-orig n2)-  (comment "Responder point-of-view")-  (traces-    ((recv (enc n1 a (pubk b))) (send (enc n1 n2 b (pubk a)))-      (recv (enc n2 (pubk b)))))-  (label 25)-  (unrealized (0 2))-  (maps ((0) ((a a) (n2 n2) (b b) (n1 n1))))-  (origs (n2 (0 1)))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton ns-  (vars (n2 n1 text) (a b name))-  (defstrand resp 3 (n2 n2) (n1 n1) (b b) (a a))-  (defstrand init 3 (n1 n1) (n2 n2) (a a) (b b))-  (precedes ((0 1) (1 1)) ((1 2) (0 2)))-  (non-orig (privk a))-  (uniq-orig n2)-  (comment "Responder point-of-view")-  (operation nonce-test (added-strand init 3) n2 (0 2)-    (enc n1 n2 b (pubk a)))-  (strand-map 0)-  (traces-    ((recv (enc n1 a (pubk b))) (send (enc n1 n2 b (pubk a)))-      (recv (enc n2 (pubk b))))-    ((send (enc n1 a (pubk b))) (recv (enc n1 n2 b (pubk a)))-      (send (enc n2 (pubk b)))))-  (label 26)-  (parent 25)-  (realized)-  (shape)-  (maps ((0) ((a a) (n2 n2) (b b) (n1 n1))))-  (origs (n2 (0 1))))--(comment "Nothing left to do")
tst/ns.tst view
@@ -1,6 +1,6 @@ (herald "Needham-Schroeder Public-Key Protocol Variants") -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/ns.scm")  (defprotocol ns basic
tst/nsl3.tst view
@@ -1,6 +1,6 @@ (herald "Three Party Needham-Schroeder-Lowe Protocol") -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/nsl3.scm")  (defprotocol nsl3 basic
− tst/nsl4.lisp 
@@ -1,85 +0,0 @@-(defprotocol nsl4 basic-  (defrole init-    (vars (a b c d name)-      (na0 na1 na2 nb0 nb1 nb2 nc0 nc1 nc2 nd0 nd1 nd2 text))-    (trace-      (send-        (enc na0 a c d (enc na1 a b d (pubk c)) (enc na2 a b c (pubk d))-          (pubk b)))-      (recv-        (enc na2 nd0 d b c (enc na0 nb2 b c d (pubk a))-          (enc na1 nc1 c b d (pubk a)) (enc nb0 nc2 c d a (pubk b))-          (enc nb1 nd1 d a c (pubk b)) (enc nc0 nd2 d a b (pubk c))-          (pubk a)))-      (send-        (enc nb2 (enc nb0 nc2 c d a (pubk b))-          (enc nb1 nd1 d a c (pubk b)) (enc nc0 nd2 d a b (pubk c))-          (enc nc1 (pubk c)) (enc nd0 (pubk d)) (pubk b))))-    (uniq-orig na0 na1 na2))-  (defrole resp1-    (vars (a b c d name)-      (na0 na1 na2 nb0 nb1 nb2 nc0 nc1 nc2 nd0 nd1 nd2 text))-    (trace-      (recv-        (enc na0 a c d (enc na1 a b d (pubk c)) (enc na2 a b c (pubk d))-          (pubk b)))-      (send-        (enc nb0 b d a (enc na1 a b d (pubk c)) (enc na2 a b c (pubk d))-          (enc nb1 b c a (pubk d)) (enc na0 nb2 b c d (pubk a))-          (pubk c)))-      (recv-        (enc nb2 (enc nb0 nc2 c d a (pubk b))-          (enc nb1 nd1 d a c (pubk b)) (enc nc0 nd2 d a b (pubk c))-          (enc nc1 (pubk c)) (enc nd0 (pubk d)) (pubk b)))-      (send-        (enc nc2 (enc nc0 nd2 d a b (pubk c)) (enc nc1 (pubk c))-          (enc nd0 (pubk d)) (enc nd1 (pubk d)) (pubk c))))-    (uniq-orig nb0 nb1 nb2))-  (defrole resp2-    (vars (a b c d name)-      (na0 na1 na2 nb0 nb1 nb2 nc0 nc1 nc2 nd0 nd1 nd2 text))-    (trace-      (recv-        (enc nb0 b d a (enc na1 a b d (pubk c)) (enc na2 a b c (pubk d))-          (enc nb1 b c a (pubk d)) (enc na0 nb2 b c d (pubk a))-          (pubk c)))-      (send-        (enc nc0 c a b (enc na2 a b c (pubk d)) (enc nb1 b c a (pubk d))-          (enc na0 nb2 b c d (pubk a)) (enc na1 nc1 c b d (pubk a))-          (enc nb0 nc2 c d a (pubk b)) (pubk d)))-      (recv-        (enc nc2 (enc nc0 nd2 d a b (pubk c)) (enc nc1 (pubk c))-          (enc nd0 (pubk d)) (enc nd1 (pubk d)) (pubk c)))-      (send (enc nd2 (enc nd0 (pubk d)) (enc nd1 (pubk d)) (pubk d))))-    (uniq-orig nc0 nc1 nc2))-  (defrole resp3-    (vars (a b c d name)-      (na0 na1 na2 nb0 nb1 nb2 nc0 nc1 nc2 nd0 nd1 nd2 text))-    (trace-      (recv-        (enc nc0 c a b (enc na2 a b c (pubk d)) (enc nb1 b c a (pubk d))-          (enc na0 nb2 b c d (pubk a)) (enc na1 nc1 c b d (pubk a))-          (enc nb0 nc2 c d a (pubk b)) (pubk d)))-      (send-        (enc na2 nd0 d b c (enc na0 nb2 b c d (pubk a))-          (enc na1 nc1 c b d (pubk a)) (enc nb0 nc2 c d a (pubk b))-          (enc nb1 nd1 d a c (pubk b)) (enc nc0 nd2 d a b (pubk c))-          (pubk a)))-      (recv (enc nd2 (enc nd0 (pubk d)) (enc nd1 (pubk d)) (pubk d))))-    (uniq-orig nd0 nd1 nd2)))--(defskeleton nsl4 (vars (a b c d name))-  (defstrand init 3 (a a) (b b) (c c) (d d))-  (non-orig (privk a) (privk b) (privk c) (privk d)))--(defskeleton nsl4 (vars (a b c d name))-  (defstrand resp1 4 (a a) (b b) (c c) (d d))-  (non-orig (privk a) (privk b) (privk c) (privk d)))--(defskeleton nsl4 (vars (a b c d name))-  (defstrand resp2 4 (a a) (b b) (c c) (d d))-  (non-orig (privk a) (privk b) (privk c) (privk d)))--(defskeleton nsl4 (vars (a b c d name))-  (defstrand resp3 3 (a a) (b b) (c c) (d d))-  (non-orig (privk a) (privk b) (privk c) (privk d)))
− tst/nsl4cm1.lisp 
@@ -1,49 +0,0 @@-(herald "Four Party Needham-Schroeder-Lowe Protocol")--(defprotocol nsl4cm basic-   (defrole init-      (vars (a b c d name) (na nb nc nd text))-      (trace-         (send (enc a c d na (pubk b)))-	 (recv (enc b c d na nb nc nd (pubk a)))-	 (send (enc nb nc nd (pubk b)))))-   (defrole resp1-      (vars (a b c d name) (na nb nc nd text))-      (trace-         (recv (enc a c d na (pubk b)))-	 (send (enc a b d na nb (pubk c)))-	 (recv (enc nb nc nd (pubk b)))-	 (send (enc nc nd (pubk c)))))-   (defrole resp2-      (vars (a b c d name) (na nb nc nd text))-      (trace-         (recv (enc a b d na nb (pubk c)))-	 (send (enc a b c na nb nc (pubk d)))-	 (recv (enc nc nd (pubk c)))-	 (send (enc nd (pubk d)))))-   (defrole resp3-      (vars (a b c d name) (na nb nc nd text))-      (trace-         (recv (enc a b c na nb nc (pubk d)))-	 (send (enc b c d na nb nc nd (pubk a)))-	 (recv (enc nd (pubk d))))))--(defskeleton nsl4cm (vars (a b c d name) (na text))-  (defstrand init 3 (a a) (b b) (c c) (d d) (na na))-   (non-orig (privk a) (privk b) (privk c) (privk d))-   (uniq-orig na))--(comment (defskeleton nsl4cm (vars (a b c d name) (nb text))-   (defstrand resp1 4 (a a) (b b) (c c) (d d) (nb nb))-   (non-orig (privk a) (privk b) (privk c) (privk d))-   (uniq-orig nb))--(defskeleton nsl4cm (vars (a b c d name) (nc text))-   (defstrand resp2 4 (a a) (b b) (c c) (d d) (nc nc))-   (non-orig (privk a) (privk b) (privk c) (privk d))-   (uniq-orig nc))--(defskeleton nsl4cm (vars (a b c d name) (nd text))-   (defstrand resp3 3 (a a) (b b) (c c) (d d) (nd nd))-   (non-orig (privk a) (privk b) (privk c) (privk d))-   (uniq-orig nd)))
− tst/nsl4init.lisp 
@@ -1,73 +0,0 @@-(defprotocol nsl4 basic-  (defrole init-    (vars (a b c d name)-      (na0 na1 na2 nb0 nb1 nb2 nc0 nc1 nc2 nd0 nd1 nd2 text))-    (trace-      (send-        (enc na0 a c d (enc na1 a b d (pubk c)) (enc na2 a b c (pubk d))-          (pubk b)))-      (recv-        (enc na2 nd0 d b c (enc na0 nb2 b c d (pubk a))-          (enc na1 nc1 c b d (pubk a)) (enc nb0 nc2 c d a (pubk b))-          (enc nb1 nd1 d a c (pubk b)) (enc nc0 nd2 d a b (pubk c))-          (pubk a)))-      (send-        (enc nb2 (enc nb0 nc2 c d a (pubk b))-          (enc nb1 nd1 d a c (pubk b)) (enc nc0 nd2 d a b (pubk c))-          (enc nc1 (pubk c)) (enc nd0 (pubk d)) (pubk b))))-    (uniq-orig na0 na1 na2))-  (defrole resp1-    (vars (a b c d name)-      (na0 na1 na2 nb0 nb1 nb2 nc0 nc1 nc2 nd0 nd1 nd2 text))-    (trace-      (recv-        (enc na0 a c d (enc na1 a b d (pubk c)) (enc na2 a b c (pubk d))-          (pubk b)))-      (send-        (enc nb0 b d a (enc na1 a b d (pubk c)) (enc na2 a b c (pubk d))-          (enc nb1 b c a (pubk d)) (enc na0 nb2 b c d (pubk a))-          (pubk c)))-      (recv-        (enc nb2 (enc nb0 nc2 c d a (pubk b))-          (enc nb1 nd1 d a c (pubk b)) (enc nc0 nd2 d a b (pubk c))-          (enc nc1 (pubk c)) (enc nd0 (pubk d)) (pubk b)))-      (send-        (enc nc2 (enc nc0 nd2 d a b (pubk c)) (enc nc1 (pubk c))-          (enc nd0 (pubk d)) (enc nd1 (pubk d)) (pubk c))))-    (uniq-orig nb0 nb1 nb2))-  (defrole resp2-    (vars (a b c d name)-      (na0 na1 na2 nb0 nb1 nb2 nc0 nc1 nc2 nd0 nd1 nd2 text))-    (trace-      (recv-        (enc nb0 b d a (enc na1 a b d (pubk c)) (enc na2 a b c (pubk d))-          (enc nb1 b c a (pubk d)) (enc na0 nb2 b c d (pubk a))-          (pubk c)))-      (send-        (enc nc0 c a b (enc na2 a b c (pubk d)) (enc nb1 b c a (pubk d))-          (enc na0 nb2 b c d (pubk a)) (enc na1 nc1 c b d (pubk a))-          (enc nb0 nc2 c d a (pubk b)) (pubk d)))-      (recv-        (enc nc2 (enc nc0 nd2 d a b (pubk c)) (enc nc1 (pubk c))-          (enc nd0 (pubk d)) (enc nd1 (pubk d)) (pubk c)))-      (send (enc nd2 (enc nd0 (pubk d)) (enc nd1 (pubk d)) (pubk d))))-    (uniq-orig nc0 nc1 nc2))-  (defrole resp3-    (vars (a b c d name)-      (na0 na1 na2 nb0 nb1 nb2 nc0 nc1 nc2 nd0 nd1 nd2 text))-    (trace-      (recv-        (enc nc0 c a b (enc na2 a b c (pubk d)) (enc nb1 b c a (pubk d))-          (enc na0 nb2 b c d (pubk a)) (enc na1 nc1 c b d (pubk a))-          (enc nb0 nc2 c d a (pubk b)) (pubk d)))-      (send-        (enc na2 nd0 d b c (enc na0 nb2 b c d (pubk a))-          (enc na1 nc1 c b d (pubk a)) (enc nb0 nc2 c d a (pubk b))-          (enc nb1 nd1 d a c (pubk b)) (enc nc0 nd2 d a b (pubk c))-          (pubk a)))-      (recv (enc nd2 (enc nd0 (pubk d)) (enc nd1 (pubk d)) (pubk d))))-    (uniq-orig nd0 nd1 nd2)))--(defskeleton nsl4 (vars (a b c d name))-  (defstrand init 3 (a a) (b b) (c c) (d d))-  (non-orig (privk a) (privk b) (privk c) (privk d)))
− tst/nsl4resp1.lisp 
@@ -1,73 +0,0 @@-(defprotocol nsl4 basic-  (defrole init-    (vars (a b c d name)-      (na0 na1 na2 nb0 nb1 nb2 nc0 nc1 nc2 nd0 nd1 nd2 text))-    (trace-      (send-        (enc na0 a c d (enc na1 a b d (pubk c)) (enc na2 a b c (pubk d))-          (pubk b)))-      (recv-        (enc na2 nd0 d b c (enc na0 nb2 b c d (pubk a))-          (enc na1 nc1 c b d (pubk a)) (enc nb0 nc2 c d a (pubk b))-          (enc nb1 nd1 d a c (pubk b)) (enc nc0 nd2 d a b (pubk c))-          (pubk a)))-      (send-        (enc nb2 (enc nb0 nc2 c d a (pubk b))-          (enc nb1 nd1 d a c (pubk b)) (enc nc0 nd2 d a b (pubk c))-          (enc nc1 (pubk c)) (enc nd0 (pubk d)) (pubk b))))-    (uniq-orig na0 na1 na2))-  (defrole resp1-    (vars (a b c d name)-      (na0 na1 na2 nb0 nb1 nb2 nc0 nc1 nc2 nd0 nd1 nd2 text))-    (trace-      (recv-        (enc na0 a c d (enc na1 a b d (pubk c)) (enc na2 a b c (pubk d))-          (pubk b)))-      (send-        (enc nb0 b d a (enc na1 a b d (pubk c)) (enc na2 a b c (pubk d))-          (enc nb1 b c a (pubk d)) (enc na0 nb2 b c d (pubk a))-          (pubk c)))-      (recv-        (enc nb2 (enc nb0 nc2 c d a (pubk b))-          (enc nb1 nd1 d a c (pubk b)) (enc nc0 nd2 d a b (pubk c))-          (enc nc1 (pubk c)) (enc nd0 (pubk d)) (pubk b)))-      (send-        (enc nc2 (enc nc0 nd2 d a b (pubk c)) (enc nc1 (pubk c))-          (enc nd0 (pubk d)) (enc nd1 (pubk d)) (pubk c))))-    (uniq-orig nb0 nb1 nb2))-  (defrole resp2-    (vars (a b c d name)-      (na0 na1 na2 nb0 nb1 nb2 nc0 nc1 nc2 nd0 nd1 nd2 text))-    (trace-      (recv-        (enc nb0 b d a (enc na1 a b d (pubk c)) (enc na2 a b c (pubk d))-          (enc nb1 b c a (pubk d)) (enc na0 nb2 b c d (pubk a))-          (pubk c)))-      (send-        (enc nc0 c a b (enc na2 a b c (pubk d)) (enc nb1 b c a (pubk d))-          (enc na0 nb2 b c d (pubk a)) (enc na1 nc1 c b d (pubk a))-          (enc nb0 nc2 c d a (pubk b)) (pubk d)))-      (recv-        (enc nc2 (enc nc0 nd2 d a b (pubk c)) (enc nc1 (pubk c))-          (enc nd0 (pubk d)) (enc nd1 (pubk d)) (pubk c)))-      (send (enc nd2 (enc nd0 (pubk d)) (enc nd1 (pubk d)) (pubk d))))-    (uniq-orig nc0 nc1 nc2))-  (defrole resp3-    (vars (a b c d name)-      (na0 na1 na2 nb0 nb1 nb2 nc0 nc1 nc2 nd0 nd1 nd2 text))-    (trace-      (recv-        (enc nc0 c a b (enc na2 a b c (pubk d)) (enc nb1 b c a (pubk d))-          (enc na0 nb2 b c d (pubk a)) (enc na1 nc1 c b d (pubk a))-          (enc nb0 nc2 c d a (pubk b)) (pubk d)))-      (send-        (enc na2 nd0 d b c (enc na0 nb2 b c d (pubk a))-          (enc na1 nc1 c b d (pubk a)) (enc nb0 nc2 c d a (pubk b))-          (enc nb1 nd1 d a c (pubk b)) (enc nc0 nd2 d a b (pubk c))-          (pubk a)))-      (recv (enc nd2 (enc nd0 (pubk d)) (enc nd1 (pubk d)) (pubk d))))-    (uniq-orig nd0 nd1 nd2)))--(defskeleton nsl4 (vars (a b c d name))-  (defstrand resp1 4 (a a) (b b) (c c) (d d))-  (non-orig (privk a) (privk b) (privk c) (privk d)))
− tst/nsl4resp2.lisp 
@@ -1,73 +0,0 @@-(defprotocol nsl4 basic-  (defrole init-    (vars (a b c d name)-      (na0 na1 na2 nb0 nb1 nb2 nc0 nc1 nc2 nd0 nd1 nd2 text))-    (trace-      (send-        (enc na0 a c d (enc na1 a b d (pubk c)) (enc na2 a b c (pubk d))-          (pubk b)))-      (recv-        (enc na2 nd0 d b c (enc na0 nb2 b c d (pubk a))-          (enc na1 nc1 c b d (pubk a)) (enc nb0 nc2 c d a (pubk b))-          (enc nb1 nd1 d a c (pubk b)) (enc nc0 nd2 d a b (pubk c))-          (pubk a)))-      (send-        (enc nb2 (enc nb0 nc2 c d a (pubk b))-          (enc nb1 nd1 d a c (pubk b)) (enc nc0 nd2 d a b (pubk c))-          (enc nc1 (pubk c)) (enc nd0 (pubk d)) (pubk b))))-    (uniq-orig na0 na1 na2))-  (defrole resp1-    (vars (a b c d name)-      (na0 na1 na2 nb0 nb1 nb2 nc0 nc1 nc2 nd0 nd1 nd2 text))-    (trace-      (recv-        (enc na0 a c d (enc na1 a b d (pubk c)) (enc na2 a b c (pubk d))-          (pubk b)))-      (send-        (enc nb0 b d a (enc na1 a b d (pubk c)) (enc na2 a b c (pubk d))-          (enc nb1 b c a (pubk d)) (enc na0 nb2 b c d (pubk a))-          (pubk c)))-      (recv-        (enc nb2 (enc nb0 nc2 c d a (pubk b))-          (enc nb1 nd1 d a c (pubk b)) (enc nc0 nd2 d a b (pubk c))-          (enc nc1 (pubk c)) (enc nd0 (pubk d)) (pubk b)))-      (send-        (enc nc2 (enc nc0 nd2 d a b (pubk c)) (enc nc1 (pubk c))-          (enc nd0 (pubk d)) (enc nd1 (pubk d)) (pubk c))))-    (uniq-orig nb0 nb1 nb2))-  (defrole resp2-    (vars (a b c d name)-      (na0 na1 na2 nb0 nb1 nb2 nc0 nc1 nc2 nd0 nd1 nd2 text))-    (trace-      (recv-        (enc nb0 b d a (enc na1 a b d (pubk c)) (enc na2 a b c (pubk d))-          (enc nb1 b c a (pubk d)) (enc na0 nb2 b c d (pubk a))-          (pubk c)))-      (send-        (enc nc0 c a b (enc na2 a b c (pubk d)) (enc nb1 b c a (pubk d))-          (enc na0 nb2 b c d (pubk a)) (enc na1 nc1 c b d (pubk a))-          (enc nb0 nc2 c d a (pubk b)) (pubk d)))-      (recv-        (enc nc2 (enc nc0 nd2 d a b (pubk c)) (enc nc1 (pubk c))-          (enc nd0 (pubk d)) (enc nd1 (pubk d)) (pubk c)))-      (send (enc nd2 (enc nd0 (pubk d)) (enc nd1 (pubk d)) (pubk d))))-    (uniq-orig nc0 nc1 nc2))-  (defrole resp3-    (vars (a b c d name)-      (na0 na1 na2 nb0 nb1 nb2 nc0 nc1 nc2 nd0 nd1 nd2 text))-    (trace-      (recv-        (enc nc0 c a b (enc na2 a b c (pubk d)) (enc nb1 b c a (pubk d))-          (enc na0 nb2 b c d (pubk a)) (enc na1 nc1 c b d (pubk a))-          (enc nb0 nc2 c d a (pubk b)) (pubk d)))-      (send-        (enc na2 nd0 d b c (enc na0 nb2 b c d (pubk a))-          (enc na1 nc1 c b d (pubk a)) (enc nb0 nc2 c d a (pubk b))-          (enc nb1 nd1 d a c (pubk b)) (enc nc0 nd2 d a b (pubk c))-          (pubk a)))-      (recv (enc nd2 (enc nd0 (pubk d)) (enc nd1 (pubk d)) (pubk d))))-    (uniq-orig nd0 nd1 nd2)))--(defskeleton nsl4 (vars (a b c d name))-  (defstrand resp2 4 (a a) (b b) (c c) (d d))-  (non-orig (privk a) (privk b) (privk c) (privk d)))
− tst/nsl4resp3.lisp 
@@ -1,73 +0,0 @@-(defprotocol nsl4 basic-  (defrole init-    (vars (a b c d name)-      (na0 na1 na2 nb0 nb1 nb2 nc0 nc1 nc2 nd0 nd1 nd2 text))-    (trace-      (send-        (enc na0 a c d (enc na1 a b d (pubk c)) (enc na2 a b c (pubk d))-          (pubk b)))-      (recv-        (enc na2 nd0 d b c (enc na0 nb2 b c d (pubk a))-          (enc na1 nc1 c b d (pubk a)) (enc nb0 nc2 c d a (pubk b))-          (enc nb1 nd1 d a c (pubk b)) (enc nc0 nd2 d a b (pubk c))-          (pubk a)))-      (send-        (enc nb2 (enc nb0 nc2 c d a (pubk b))-          (enc nb1 nd1 d a c (pubk b)) (enc nc0 nd2 d a b (pubk c))-          (enc nc1 (pubk c)) (enc nd0 (pubk d)) (pubk b))))-    (uniq-orig na0 na1 na2))-  (defrole resp1-    (vars (a b c d name)-      (na0 na1 na2 nb0 nb1 nb2 nc0 nc1 nc2 nd0 nd1 nd2 text))-    (trace-      (recv-        (enc na0 a c d (enc na1 a b d (pubk c)) (enc na2 a b c (pubk d))-          (pubk b)))-      (send-        (enc nb0 b d a (enc na1 a b d (pubk c)) (enc na2 a b c (pubk d))-          (enc nb1 b c a (pubk d)) (enc na0 nb2 b c d (pubk a))-          (pubk c)))-      (recv-        (enc nb2 (enc nb0 nc2 c d a (pubk b))-          (enc nb1 nd1 d a c (pubk b)) (enc nc0 nd2 d a b (pubk c))-          (enc nc1 (pubk c)) (enc nd0 (pubk d)) (pubk b)))-      (send-        (enc nc2 (enc nc0 nd2 d a b (pubk c)) (enc nc1 (pubk c))-          (enc nd0 (pubk d)) (enc nd1 (pubk d)) (pubk c))))-    (uniq-orig nb0 nb1 nb2))-  (defrole resp2-    (vars (a b c d name)-      (na0 na1 na2 nb0 nb1 nb2 nc0 nc1 nc2 nd0 nd1 nd2 text))-    (trace-      (recv-        (enc nb0 b d a (enc na1 a b d (pubk c)) (enc na2 a b c (pubk d))-          (enc nb1 b c a (pubk d)) (enc na0 nb2 b c d (pubk a))-          (pubk c)))-      (send-        (enc nc0 c a b (enc na2 a b c (pubk d)) (enc nb1 b c a (pubk d))-          (enc na0 nb2 b c d (pubk a)) (enc na1 nc1 c b d (pubk a))-          (enc nb0 nc2 c d a (pubk b)) (pubk d)))-      (recv-        (enc nc2 (enc nc0 nd2 d a b (pubk c)) (enc nc1 (pubk c))-          (enc nd0 (pubk d)) (enc nd1 (pubk d)) (pubk c)))-      (send (enc nd2 (enc nd0 (pubk d)) (enc nd1 (pubk d)) (pubk d))))-    (uniq-orig nc0 nc1 nc2))-  (defrole resp3-    (vars (a b c d name)-      (na0 na1 na2 nb0 nb1 nb2 nc0 nc1 nc2 nd0 nd1 nd2 text))-    (trace-      (recv-        (enc nc0 c a b (enc na2 a b c (pubk d)) (enc nb1 b c a (pubk d))-          (enc na0 nb2 b c d (pubk a)) (enc na1 nc1 c b d (pubk a))-          (enc nb0 nc2 c d a (pubk b)) (pubk d)))-      (send-        (enc na2 nd0 d b c (enc na0 nb2 b c d (pubk a))-          (enc na1 nc1 c b d (pubk a)) (enc nb0 nc2 c d a (pubk b))-          (enc nb1 nd1 d a c (pubk b)) (enc nc0 nd2 d a b (pubk c))-          (pubk a)))-      (recv (enc nd2 (enc nd0 (pubk d)) (enc nd1 (pubk d)) (pubk d))))-    (uniq-orig nd0 nd1 nd2)))--(defskeleton nsl4 (vars (a b c d name))-  (defstrand resp3 3 (a a) (b b) (c c) (d d))-  (non-orig (privk a) (privk b) (privk c) (privk d)))
− tst/nsl5.lisp 
@@ -1,149 +0,0 @@-(herald nsl5 (bound 10))--(defprotocol nsl5 basic-  (defrole init-    (vars (a b c d e name)-      (na0 na1 na2 na3 nb0 nb1 nb2 nb3 nc0 nc1 nc2 nc3 nd0 nd1 nd2 nd3-        ne0 ne1 ne2 ne3 text))-    (trace-      (send-        (enc na0 a c d e (enc na1 a b d e (pubk c))-          (enc na2 a b c e (pubk d)) (enc na3 a b c d (pubk e))-          (pubk b)))-      (recv-        (enc na3 ne0 e b c d (enc na0 nb3 b c d e (pubk a))-          (enc na1 nc2 c b d e (pubk a)) (enc na2 nd1 d e b c (pubk a))-          (enc nb0 nc3 c d e a (pubk b)) (enc nb1 nd2 d c e a (pubk b))-          (enc nb2 ne1 e a c d (pubk b)) (enc nc0 nd3 d e a b (pubk c))-          (enc nc1 ne2 e a b d (pubk c)) (enc nd0 ne3 e a b c (pubk d))-          (pubk a)))-      (send-        (enc nb3 (enc nb0 nc3 c d e a (pubk b))-          (enc nb1 nd2 d c e a (pubk b)) (enc nb2 ne1 e a c d (pubk b))-          (enc nc0 nd3 d e a b (pubk c)) (enc nc1 ne2 e a b d (pubk c))-          (enc nc2 (pubk c)) (enc nd0 ne3 e a b c (pubk d))-          (enc nd1 (pubk d)) (enc ne0 (pubk e)) (pubk b))))-    (uniq-orig na0 na1 na2 na3))-  (defrole resp1-    (vars (a b c d e name)-      (na0 na1 na2 na3 nb0 nb1 nb2 nb3 nc0 nc1 nc2 nc3 nd0 nd1 nd2 nd3-        ne0 ne1 ne2 ne3 text))-    (trace-      (recv-        (enc na0 a c d e (enc na1 a b d e (pubk c))-          (enc na2 a b c e (pubk d)) (enc na3 a b c d (pubk e))-          (pubk b)))-      (send-        (enc nb0 b d e a (enc na1 a b d e (pubk c))-          (enc na2 a b c e (pubk d)) (enc nb1 b c e a (pubk d))-          (enc na3 a b c d (pubk e)) (enc nb2 b c d a (pubk e))-          (enc na0 nb3 b c d e (pubk a)) (pubk c)))-      (recv-        (enc nb3 (enc nb0 nc3 c d e a (pubk b))-          (enc nb1 nd2 d c e a (pubk b)) (enc nb2 ne1 e a c d (pubk b))-          (enc nc0 nd3 d e a b (pubk c)) (enc nc1 ne2 e a b d (pubk c))-          (enc nc2 (pubk c)) (enc nd0 ne3 e a b c (pubk d))-          (enc nd1 (pubk d)) (enc ne0 (pubk e)) (pubk b)))-      (send-        (enc nc3 (enc nc0 nd3 d e a b (pubk c))-          (enc nc1 ne2 e a b d (pubk c)) (enc nc2 (pubk c))-          (enc nd0 ne3 e a b c (pubk d)) (enc nd1 (pubk d))-          (enc nd2 (pubk d)) (enc ne0 (pubk e)) (enc ne1 (pubk e))-          (pubk c))))-    (uniq-orig nb0 nb1 nb2 nb3))-  (defrole resp2-    (vars (a b c d e name)-      (na0 na1 na2 na3 nb0 nb1 nb2 nb3 nc0 nc1 nc2 nc3 nd0 nd1 nd2 nd3-        ne0 ne1 ne2 ne3 text))-    (trace-      (recv-        (enc nb0 b d e a (enc na1 a b d e (pubk c))-          (enc na2 a b c e (pubk d)) (enc nb1 b c e a (pubk d))-          (enc na3 a b c d (pubk e)) (enc nb2 b c d a (pubk e))-          (enc na0 nb3 b c d e (pubk a)) (pubk c)))-      (send-        (enc nc0 c e a b (enc na2 a b c e (pubk d))-          (enc nb1 b c e a (pubk d)) (enc na3 a b c d (pubk e))-          (enc nb2 b c d a (pubk e)) (enc nc1 c d a b (pubk e))-          (enc na0 nb3 b c d e (pubk a)) (enc na1 nc2 c b d e (pubk a))-          (enc nb0 nc3 c d e a (pubk b)) (pubk d)))-      (recv-        (enc nc3 (enc nc0 nd3 d e a b (pubk c))-          (enc nc1 ne2 e a b d (pubk c)) (enc nc2 (pubk c))-          (enc nd0 ne3 e a b c (pubk d)) (enc nd1 (pubk d))-          (enc nd2 (pubk d)) (enc ne0 (pubk e)) (enc ne1 (pubk e))-          (pubk c)))-      (send-        (enc nd3 (enc nd0 ne3 e a b c (pubk d)) (enc nd1 (pubk d))-          (enc nd2 (pubk d)) (enc ne0 (pubk e)) (enc ne1 (pubk e))-          (enc ne2 (pubk e)) (pubk d))))-    (uniq-orig nc0 nc1 nc2 nc3))-  (defrole resp3-    (vars (a b c d e name)-      (na0 na1 na2 na3 nb0 nb1 nb2 nb3 nc0 nc1 nc2 nc3 nd0 nd1 nd2 nd3-        ne0 ne1 ne2 ne3 text))-    (trace-      (recv-        (enc nc0 c e a b (enc na2 a b c e (pubk d))-          (enc nb1 b c e a (pubk d)) (enc na3 a b c d (pubk e))-          (enc nb2 b c d a (pubk e)) (enc nc1 c d a b (pubk e))-          (enc na0 nb3 b c d e (pubk a)) (enc na1 nc2 c b d e (pubk a))-          (enc nb0 nc3 c d e a (pubk b)) (pubk d)))-      (send-        (enc nd0 d a b c (enc na3 a b c d (pubk e))-          (enc nb2 b c d a (pubk e)) (enc nc1 c d a b (pubk e))-          (enc na0 nb3 b c d e (pubk a)) (enc na1 nc2 c b d e (pubk a))-          (enc na2 nd1 d e b c (pubk a)) (enc nb0 nc3 c d e a (pubk b))-          (enc nb1 nd2 d c e a (pubk b)) (enc nc0 nd3 d e a b (pubk c))-          (pubk e)))-      (recv-        (enc nd3 (enc nd0 ne3 e a b c (pubk d)) (enc nd1 (pubk d))-          (enc nd2 (pubk d)) (enc ne0 (pubk e)) (enc ne1 (pubk e))-          (enc ne2 (pubk e)) (pubk d)))-      (send-        (enc ne3 (enc ne0 (pubk e)) (enc ne1 (pubk e))-          (enc ne2 (pubk e)) (pubk e))))-    (uniq-orig nd0 nd1 nd2 nd3))-  (defrole resp4-    (vars (a b c d e name)-      (na0 na1 na2 na3 nb0 nb1 nb2 nb3 nc0 nc1 nc2 nc3 nd0 nd1 nd2 nd3-        ne0 ne1 ne2 ne3 text))-    (trace-      (recv-        (enc nd0 d a b c (enc na3 a b c d (pubk e))-          (enc nb2 b c d a (pubk e)) (enc nc1 c d a b (pubk e))-          (enc na0 nb3 b c d e (pubk a)) (enc na1 nc2 c b d e (pubk a))-          (enc na2 nd1 d e b c (pubk a)) (enc nb0 nc3 c d e a (pubk b))-          (enc nb1 nd2 d c e a (pubk b)) (enc nc0 nd3 d e a b (pubk c))-          (pubk e)))-      (send-        (enc na3 ne0 e b c d (enc na0 nb3 b c d e (pubk a))-          (enc na1 nc2 c b d e (pubk a)) (enc na2 nd1 d e b c (pubk a))-          (enc nb0 nc3 c d e a (pubk b)) (enc nb1 nd2 d c e a (pubk b))-          (enc nb2 ne1 e a c d (pubk b)) (enc nc0 nd3 d e a b (pubk c))-          (enc nc1 ne2 e a b d (pubk c)) (enc nd0 ne3 e a b c (pubk d))-          (pubk a)))-      (recv-        (enc ne3 (enc ne0 (pubk e)) (enc ne1 (pubk e))-          (enc ne2 (pubk e)) (pubk e))))-    (uniq-orig ne0 ne1 ne2 ne3)))--(defskeleton nsl5 (vars (a b c d e name))-  (defstrand init 3 (a a) (b b) (c c) (d d) (e e))-  (non-orig (privk a) (privk b) (privk c) (privk d) (privk e)))--(defskeleton nsl5 (vars (a b c d e name))-  (defstrand resp1 4 (a a) (b b) (c c) (d d) (e e))-  (non-orig (privk a) (privk b) (privk c) (privk d) (privk e)))--(defskeleton nsl5 (vars (a b c d e name))-  (defstrand resp2 4 (a a) (b b) (c c) (d d) (e e))-  (non-orig (privk a) (privk b) (privk c) (privk d) (privk e)))--(defskeleton nsl5 (vars (a b c d e name))-  (defstrand resp3 4 (a a) (b b) (c c) (d d) (e e))-  (non-orig (privk a) (privk b) (privk c) (privk d) (privk e)))--(defskeleton nsl5 (vars (a b c d e name))-  (defstrand resp4 3 (a a) (b b) (c c) (d d) (e e))-  (non-orig (privk a) (privk b) (privk c) (privk d) (privk e)))
− tst/nsl5i.lisp 
@@ -1,64 +0,0 @@-(defprotocol nsl5i basic-  (defrole init-    (vars (a name) (b name) (c name) (d name) (e name) (na text) (nb text) (nc text) (nd text) (ne text))-    (trace-      (send (enc (cat a b c d e (enc (enc (enc na (pubk e)) (pubk d)) (pubk c))) (pubk b)))-      (recv (enc (cat a b c d e na (enc nb (pubk a)) (enc (enc nc (pubk b)) (pubk a)) (enc (enc (enc nd (pubk c)) (pubk b)) (pubk a)) (enc (enc (enc ne (pubk d)) (pubk c)) (pubk b))) (pubk a)))-      (send (enc (cat nb (enc nc (pubk b)) (enc (enc nd (pubk c)) (pubk b)) (enc (enc (enc ne (pubk d)) (pubk c)) (pubk b))) (pubk b))))-      (uniq-orig na))-  (defrole resp1-    (vars (a name) (b name) (c name) (d name) (e name) (na text) (nb text) (nc text) (nd text) (ne text))-    (trace-      (recv (enc (cat a b c d e (enc (enc (enc na (pubk e)) (pubk d)) (pubk c))) (pubk b)))-      (send (enc (cat a b c d e (enc (enc (enc na (pubk e)) (pubk d)) (pubk c)) (enc (enc (enc nb (pubk a)) (pubk e)) (pubk d))) (pubk c)))-      (recv (enc (cat nb (enc nc (pubk b)) (enc (enc nd (pubk c)) (pubk b)) (enc (enc (enc ne (pubk d)) (pubk c)) (pubk b))) (pubk b)))-      (send (enc (cat nc (enc nd (pubk c)) (enc (enc ne (pubk d)) (pubk c))) (pubk c))))-      (uniq-orig nb))-  (defrole resp2-    (vars (a name) (b name) (c name) (d name) (e name) (na text) (nb text) (nc text) (nd text) (ne text))-    (trace-      (recv (enc (cat a b c d e (enc (enc (enc na (pubk e)) (pubk d)) (pubk c)) (enc (enc (enc nb (pubk a)) (pubk e)) (pubk d))) (pubk c)))-      (send (enc (cat a b c d e (enc (enc na (pubk e)) (pubk d)) (enc (enc (enc nb (pubk a)) (pubk e)) (pubk d)) (enc (enc (enc nc (pubk b)) (pubk a)) (pubk e))) (pubk d)))-      (recv (enc (cat nc (enc nd (pubk c)) (enc (enc ne (pubk d)) (pubk c))) (pubk c)))-      (send (enc (cat nd (enc ne (pubk d))) (pubk d))))-      (uniq-orig nc))-  (defrole resp3-    (vars (a name) (b name) (c name) (d name) (e name) (na text) (nb text) (nc text) (nd text) (ne text))-    (trace-      (recv (enc (cat a b c d e (enc (enc na (pubk e)) (pubk d)) (enc (enc (enc nb (pubk a)) (pubk e)) (pubk d)) (enc (enc (enc nc (pubk b)) (pubk a)) (pubk e))) (pubk d)))-      (send (enc (cat a b c d e (enc na (pubk e)) (enc (enc nb (pubk a)) (pubk e)) (enc (enc (enc nc (pubk b)) (pubk a)) (pubk e)) (enc (enc (enc nd (pubk c)) (pubk b)) (pubk a))) (pubk e)))-      (recv (enc (cat nd (enc ne (pubk d))) (pubk d)))-      (send (enc ne (pubk e))))-      (uniq-orig nd))-  (defrole resp4-    (vars (a name) (b name) (c name) (d name) (e name) (na text) (nb text) (nc text) (nd text) (ne text))-    (trace-      (recv (enc (cat a b c d e (enc na (pubk e)) (enc (enc nb (pubk a)) (pubk e)) (enc (enc (enc nc (pubk b)) (pubk a)) (pubk e)) (enc (enc (enc nd (pubk c)) (pubk b)) (pubk a))) (pubk e)))-      (send (enc (cat a b c d e na (enc nb (pubk a)) (enc (enc nc (pubk b)) (pubk a)) (enc (enc (enc nd (pubk c)) (pubk b)) (pubk a)) (enc (enc (enc ne (pubk d)) (pubk c)) (pubk b))) (pubk a)))-      (recv (enc ne (pubk e))))-      (uniq-orig ne)))--(defskeleton nsl5i-  (vars (a name) (b name) (c name) (d name) (e name) (na text) (nb text) (nc text) (nd text) (ne text))-  (defstrand init 3 (a a) (b b) (c c) (d d) (e e))-  (non-orig (privk a) (privk b) (privk c) (privk d) (privk e)))--(defskeleton nsl5i-  (vars (a name) (b name) (c name) (d name) (e name) (na text) (nb text) (nc text) (nd text) (ne text))-  (defstrand resp1 4 (a a) (b b) (c c) (d d) (e e))-  (non-orig (privk a) (privk b) (privk c) (privk d) (privk e)))--(defskeleton nsl5i-  (vars (a name) (b name) (c name) (d name) (e name) (na text) (nb text) (nc text) (nd text) (ne text))-  (defstrand resp2 4 (a a) (b b) (c c) (d d) (e e))-  (non-orig (privk a) (privk b) (privk c) (privk d) (privk e)))--(defskeleton nsl5i-  (vars (a name) (b name) (c name) (d name) (e name) (na text) (nb text) (nc text) (nd text) (ne text))-  (defstrand resp3 4 (a a) (b b) (c c) (d d) (e e))-  (non-orig (privk a) (privk b) (privk c) (privk d) (privk e)))--(defskeleton nsl5i-  (vars (a name) (b name) (c name) (d name) (e name) (na text) (nb text) (nc text) (nd text) (ne text))-  (defstrand resp4 3 (a a) (b b) (c c) (d d) (e e))-  (non-orig (privk a) (privk b) (privk c) (privk d) (privk e)))
− tst/nsl5resp3.lisp 
@@ -1,131 +0,0 @@-(defprotocol nsl5 basic-  (defrole init-    (vars (a b c d e name)-      (na0 na1 na2 na3 nb0 nb1 nb2 nb3 nc0 nc1 nc2 nc3 nd0 nd1 nd2 nd3-        ne0 ne1 ne2 ne3 text))-    (trace-      (send-        (enc na0 a c d e (enc na1 a b d e (pubk c))-          (enc na2 a b c e (pubk d)) (enc na3 a b c d (pubk e))-          (pubk b)))-      (recv-        (enc na3 ne0 e b c d (enc na0 nb3 b c d e (pubk a))-          (enc na1 nc2 c b d e (pubk a)) (enc na2 nd1 d e b c (pubk a))-          (enc nb0 nc3 c d e a (pubk b)) (enc nb1 nd2 d c e a (pubk b))-          (enc nb2 ne1 e a c d (pubk b)) (enc nc0 nd3 d e a b (pubk c))-          (enc nc1 ne2 e a b d (pubk c)) (enc nd0 ne3 e a b c (pubk d))-          (pubk a)))-      (send-        (enc nb3 (enc nb0 nc3 c d e a (pubk b))-          (enc nb1 nd2 d c e a (pubk b)) (enc nb2 ne1 e a c d (pubk b))-          (enc nc0 nd3 d e a b (pubk c)) (enc nc1 ne2 e a b d (pubk c))-          (enc nc2 (pubk c)) (enc nd0 ne3 e a b c (pubk d))-          (enc nd1 (pubk d)) (enc ne0 (pubk e)) (pubk b))))-    (uniq-orig na0 na1 na2 na3))-  (defrole resp1-    (vars (a b c d e name)-      (na0 na1 na2 na3 nb0 nb1 nb2 nb3 nc0 nc1 nc2 nc3 nd0 nd1 nd2 nd3-        ne0 ne1 ne2 ne3 text))-    (trace-      (recv-        (enc na0 a c d e (enc na1 a b d e (pubk c))-          (enc na2 a b c e (pubk d)) (enc na3 a b c d (pubk e))-          (pubk b)))-      (send-        (enc nb0 b d e a (enc na1 a b d e (pubk c))-          (enc na2 a b c e (pubk d)) (enc nb1 b c e a (pubk d))-          (enc na3 a b c d (pubk e)) (enc nb2 b c d a (pubk e))-          (enc na0 nb3 b c d e (pubk a)) (pubk c)))-      (recv-        (enc nb3 (enc nb0 nc3 c d e a (pubk b))-          (enc nb1 nd2 d c e a (pubk b)) (enc nb2 ne1 e a c d (pubk b))-          (enc nc0 nd3 d e a b (pubk c)) (enc nc1 ne2 e a b d (pubk c))-          (enc nc2 (pubk c)) (enc nd0 ne3 e a b c (pubk d))-          (enc nd1 (pubk d)) (enc ne0 (pubk e)) (pubk b)))-      (send-        (enc nc3 (enc nc0 nd3 d e a b (pubk c))-          (enc nc1 ne2 e a b d (pubk c)) (enc nc2 (pubk c))-          (enc nd0 ne3 e a b c (pubk d)) (enc nd1 (pubk d))-          (enc nd2 (pubk d)) (enc ne0 (pubk e)) (enc ne1 (pubk e))-          (pubk c))))-    (uniq-orig nb0 nb1 nb2 nb3))-  (defrole resp2-    (vars (a b c d e name)-      (na0 na1 na2 na3 nb0 nb1 nb2 nb3 nc0 nc1 nc2 nc3 nd0 nd1 nd2 nd3-        ne0 ne1 ne2 ne3 text))-    (trace-      (recv-        (enc nb0 b d e a (enc na1 a b d e (pubk c))-          (enc na2 a b c e (pubk d)) (enc nb1 b c e a (pubk d))-          (enc na3 a b c d (pubk e)) (enc nb2 b c d a (pubk e))-          (enc na0 nb3 b c d e (pubk a)) (pubk c)))-      (send-        (enc nc0 c e a b (enc na2 a b c e (pubk d))-          (enc nb1 b c e a (pubk d)) (enc na3 a b c d (pubk e))-          (enc nb2 b c d a (pubk e)) (enc nc1 c d a b (pubk e))-          (enc na0 nb3 b c d e (pubk a)) (enc na1 nc2 c b d e (pubk a))-          (enc nb0 nc3 c d e a (pubk b)) (pubk d)))-      (recv-        (enc nc3 (enc nc0 nd3 d e a b (pubk c))-          (enc nc1 ne2 e a b d (pubk c)) (enc nc2 (pubk c))-          (enc nd0 ne3 e a b c (pubk d)) (enc nd1 (pubk d))-          (enc nd2 (pubk d)) (enc ne0 (pubk e)) (enc ne1 (pubk e))-          (pubk c)))-      (send-        (enc nd3 (enc nd0 ne3 e a b c (pubk d)) (enc nd1 (pubk d))-          (enc nd2 (pubk d)) (enc ne0 (pubk e)) (enc ne1 (pubk e))-          (enc ne2 (pubk e)) (pubk d))))-    (uniq-orig nc0 nc1 nc2 nc3))-  (defrole resp3-    (vars (a b c d e name)-      (na0 na1 na2 na3 nb0 nb1 nb2 nb3 nc0 nc1 nc2 nc3 nd0 nd1 nd2 nd3-        ne0 ne1 ne2 ne3 text))-    (trace-      (recv-        (enc nc0 c e a b (enc na2 a b c e (pubk d))-          (enc nb1 b c e a (pubk d)) (enc na3 a b c d (pubk e))-          (enc nb2 b c d a (pubk e)) (enc nc1 c d a b (pubk e))-          (enc na0 nb3 b c d e (pubk a)) (enc na1 nc2 c b d e (pubk a))-          (enc nb0 nc3 c d e a (pubk b)) (pubk d)))-      (send-        (enc nd0 d a b c (enc na3 a b c d (pubk e))-          (enc nb2 b c d a (pubk e)) (enc nc1 c d a b (pubk e))-          (enc na0 nb3 b c d e (pubk a)) (enc na1 nc2 c b d e (pubk a))-          (enc na2 nd1 d e b c (pubk a)) (enc nb0 nc3 c d e a (pubk b))-          (enc nb1 nd2 d c e a (pubk b)) (enc nc0 nd3 d e a b (pubk c))-          (pubk e)))-      (recv-        (enc nd3 (enc nd0 ne3 e a b c (pubk d)) (enc nd1 (pubk d))-          (enc nd2 (pubk d)) (enc ne0 (pubk e)) (enc ne1 (pubk e))-          (enc ne2 (pubk e)) (pubk d)))-      (send-        (enc ne3 (enc ne0 (pubk e)) (enc ne1 (pubk e))-          (enc ne2 (pubk e)) (pubk e))))-    (uniq-orig nd0 nd1 nd2 nd3))-  (defrole resp4-    (vars (a b c d e name)-      (na0 na1 na2 na3 nb0 nb1 nb2 nb3 nc0 nc1 nc2 nc3 nd0 nd1 nd2 nd3-        ne0 ne1 ne2 ne3 text))-    (trace-      (recv-        (enc nd0 d a b c (enc na3 a b c d (pubk e))-          (enc nb2 b c d a (pubk e)) (enc nc1 c d a b (pubk e))-          (enc na0 nb3 b c d e (pubk a)) (enc na1 nc2 c b d e (pubk a))-          (enc na2 nd1 d e b c (pubk a)) (enc nb0 nc3 c d e a (pubk b))-          (enc nb1 nd2 d c e a (pubk b)) (enc nc0 nd3 d e a b (pubk c))-          (pubk e)))-      (send-        (enc na3 ne0 e b c d (enc na0 nb3 b c d e (pubk a))-          (enc na1 nc2 c b d e (pubk a)) (enc na2 nd1 d e b c (pubk a))-          (enc nb0 nc3 c d e a (pubk b)) (enc nb1 nd2 d c e a (pubk b))-          (enc nb2 ne1 e a c d (pubk b)) (enc nc0 nd3 d e a b (pubk c))-          (enc nc1 ne2 e a b d (pubk c)) (enc nd0 ne3 e a b c (pubk d))-          (pubk a)))-      (recv-        (enc ne3 (enc ne0 (pubk e)) (enc ne1 (pubk e))-          (enc ne2 (pubk e)) (pubk e))))-    (uniq-orig ne0 ne1 ne2 ne3)))--(defskeleton nsl5 (vars (a b c d e name))-  (defstrand resp3 4 (a a) (b b) (c c) (d d) (e e))-  (non-orig (privk a) (privk b) (privk c) (privk d) (privk e)))
tst/nslsk.tst view
@@ -1,6 +1,6 @@ (herald "Needham-Schroeder-Lowe Protocol with symmetric encryption") -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/nslsk.scm")  (defprotocol nslsk basic
tst/open-closed-multiloc.tst view
@@ -1,6 +1,6 @@ (herald open-closed (bound 44)) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/open-closed-multiloc.scm") (comment "Strand count bounded at 44")
tst/open-closed-tag.tst view
@@ -1,6 +1,6 @@ (herald open-closed (bound 44)) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/open-closed-tag.scm") (comment "Strand count bounded at 44")
tst/open-closed.tst view
@@ -1,6 +1,6 @@ (herald open-closed (bound 44)) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/open-closed.scm") (comment "Strand count bounded at 44")
tst/or.tst view
@@ -1,7 +1,7 @@ (herald "Otway-Rees Protocol"   (comment "Standard version using variables of sort mesg")) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/or.scm")  (defprotocol or basic
tst/ordered.tst view
@@ -1,6 +1,6 @@ (herald ordered) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/ordered.scm")  (defprotocol ordered basic
tst/orderedvar.tst view
@@ -1,6 +1,6 @@ (herald ordered) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/orderedvar.scm")  (defprotocol ordered basic
tst/pca.tst view
@@ -1,7 +1,7 @@ (herald "Privacy Certificate Authority" (bound 15)   (comment "Generation of an Attestation Identity Certificate")) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/pca.scm") (comment "Strand count bounded at 15")
tst/pen-non-orig-test.tst view
@@ -1,6 +1,6 @@ (herald "pen-non-orig test") -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/pen-non-orig-test.scm")  (defprotocol pennonorigtest basic
tst/pfs-via-pubkey.tst view
@@ -1,6 +1,6 @@ (herald pfs-via-pubkey) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/pfs-via-pubkey.scm")  (defprotocol pfs-easy basic
tst/pkinit.tst view
@@ -1,6 +1,6 @@ (herald "Kerberos PK init") -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/pkinit.scm")  (defprotocol pkinit basic
tst/preprocess.tst view
@@ -1,6 +1,6 @@ (herald "Pre-processing test example: modified NS with two responders") -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/preprocess.scm")  (defprotocol ns basic
tst/print.tst view
@@ -1,7 +1,7 @@ (herald "Print Test"   (comment "See if read forms look like printed ones")) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/print.scm")  (defprotocol print-test basic
tst/prottrans.tst view
@@ -1,6 +1,6 @@ (herald "Protocol Transformations With Rules") -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/prottrans.scm")  (defprotocol ns basic
tst/pruning1.tst view
@@ -1,4 +1,4 @@-(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/pruning1.scm")  (defprotocol prune basic
tst/puzzle_example.tst view
@@ -1,6 +1,6 @@ (herald puzzle_example) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/puzzle_example.scm")  (defprotocol puzzle basic
tst/reflect.tst view
@@ -1,6 +1,6 @@ (herald reflect) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/reflect.scm")  (defprotocol reflect basic
tst/renamings.tst view
@@ -2,7 +2,7 @@   (comment "There is a flaw in this protocol by design")   (comment "It also shows how variable renaming works")) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/renamings.scm")  (defprotocol blanchet basic
tst/role_uniq.tst view
@@ -1,6 +1,6 @@ (herald "Role Unique Origination") -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/role_uniq.scm")  (defprotocol blanchet basic
tst/rule-node.tst view
@@ -1,6 +1,6 @@ (herald rule-node) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/rule-node.scm")  (defprotocol rule-order basic
tst/rule-order.tst view
@@ -1,6 +1,6 @@ (herald rule-order) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/rule-order.scm")  (defprotocol rule-order basic
− tst/sa.tst 
@@ -1,915 +0,0 @@-(comment "CPSA 4.4.4")-(comment "All input read from tst/sa.scm")--(defprotocol subatomic-open-closed basic-  (defrole dev-up-    (vars (k skey) (d o name) (old old1 mesg) (start-ch chan)-      (lk ls locn))-    (trace (recv start-ch (cat "power-up" d o k)) (load lk old)-      (load ls old1) (stor lk (cat "st-k" d o k))-      (stor ls (cat "st" d o)) (send (enc "up" k)))-    (auth start-ch)-    (critical-sections (1 4))-    (facts (same-dev ls lk)))-  (defrole owner-power-dev-    (vars (k skey) (d o name) (start-ch chan))-    (trace (send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    (conf start-ch))-  (defrole owner-open-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "open" d o n k)) (recv n)))-  (defrole owner-close-    (vars (k skey) (n text) (d o name))-    (trace (send (enc "close" d o n k)) (recv n)))-  (defrole dev-open-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (recv (enc "open" d o n k)) (load ls (cat "st" d any))-      (load lk (cat "st-k" d o k)) (stor ls (cat "st" d o o)) (send n))-    (critical-sections (1 3))-    (gen-st (cat "st-k" d o k) (cat "st" d (cat o o)))-    (facts (same-dev ls lk)))-  (defrole dev-close-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (recv (enc "close" d o n k)) (load lk (cat "st-k" d o k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d o)) (send n))-    (gen-st (cat "st-k" d o k))-    (critical-sections (1 3))-    (facts (same-dev ls lk)))-  (defrole dev-pass-    (vars (k skey) (n text) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (load ls (cat "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    (uniq-orig n)-    (gen-st (cat "st-k" d o k) (cat "st" d (cat o o)))-    (critical-sections (0 1))-    (facts (same-dev ls lk)))-  (defrole user-pass-    (vars (k skey))-    (trace (send (enc "may I pass" k)) (recv (enc "you may pass" k))))-  (defrule power-deliver-once-    (forall ((z1 z2 strd) (k skey))-      (implies-        (and (p "dev-up" z1 (idx 2)) (p "dev-up" z2 (idx 2))-          (p "dev-up" "k" z1 k) (p "dev-up" "k" z2 k))-        (= z1 z2))))-  (defrule same-dev-ls-lk-    (forall ((ls lk lk-0 locn))-      (implies-        (and (fact same-dev ls lk) (fact same-dev ls lk-0))-        (= lk lk-0))))-  (defrule same-dev-lk-ls-    (forall ((lk ls ls-0 locn))-      (implies-        (and (fact same-dev ls lk) (fact same-dev ls-0 lk))-        (= ls ls-0))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule shearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule invShearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule fact-dev-up-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-up" z (idx 3)) (p "dev-up" "ls" z ls)-          (p "dev-up" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule fact-dev-open-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-open" z (idx 3)) (p "dev-open" "ls" z ls)-          (p "dev-open" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule fact-dev-close-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-close" z (idx 3)) (p "dev-close" "ls" z ls)-          (p "dev-close" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule fact-dev-pass-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-pass" z (idx 2)) (p "dev-pass" "ls" z ls)-          (p "dev-pass" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule trRl_dev-up-at-4-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 4)))))-  (defgenrule trRl_dev-up-at-3-    (forall ((z strd))-      (implies (p "dev-up" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-up-at-2-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 2)))))-  (defgenrule trRl_dev-up-at-1-    (forall ((z strd))-      (implies (p "dev-up" z (idx 4)) (trans z (idx 1)))))-  (defgenrule trRl_dev-open-at-3-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-open-at-1-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 1)))))-  (defgenrule trRl_dev-close-at-3-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-close-at-2-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 2)))))-  (defgenrule eff-dev-up-3-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-up" z (idx 4)) (prec z (idx 3) z1 i))-        (or (= z z1)-          (and (p "dev-up" z (idx 5)) (prec z (idx 4) z1 i))))))-  (defgenrule cau-dev-up-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-up" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1))))))-  (defgenrule cau-dev-open-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-open" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1))))))-  (defgenrule cau-dev-close-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-close" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1))))))-  (defgenrule cau-dev-pass-1-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-pass" z (idx 2)) (prec z1 i z (idx 1)))-        (or (= z z1) (prec z1 i z (idx 0))))))-  (defgenrule gen-st-dev-open-1-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-open" z (idx 1)) (p "dev-open" "k" z k)-          (p "dev-open" "o" z o) (p "dev-open" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule gen-st-dev-open-0-    (forall ((z strd) (d o name))-      (implies-        (and (p "dev-open" z (idx 1)) (p "dev-open" "o" z o)-          (p "dev-open" "d" z d)) (gen-st (cat "st" d o o)))))-  (defgenrule gen-st-dev-close-0-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-close" z (idx 1)) (p "dev-close" "k" z k)-          (p "dev-close" "o" z o) (p "dev-close" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule gen-st-dev-pass-1-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "k" z k)-          (p "dev-pass" "o" z o) (p "dev-pass" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule gen-st-dev-pass-0-    (forall ((z strd) (d o name))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "o" z o)-          (p "dev-pass" "d" z d)) (gen-st (cat "st" d o o)))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule shearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule invShearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule fact-dev-up-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-up" z (idx 3)) (p "dev-up" "lk" z lk)-          (p "dev-up" "ls" z ls)) (fact same-dev ls lk))))-  (defgenrule fact-dev-open-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-open" z (idx 3)) (p "dev-open" "lk" z lk)-          (p "dev-open" "ls" z ls)) (fact same-dev ls lk))))-  (defgenrule fact-dev-close-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-close" z (idx 3)) (p "dev-close" "lk" z lk)-          (p "dev-close" "ls" z ls)) (fact same-dev ls lk))))-  (defgenrule fact-dev-pass-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-pass" z (idx 2)) (p "dev-pass" "lk" z lk)-          (p "dev-pass" "ls" z ls)) (fact same-dev ls lk))))-  (defgenrule trRl_dev-up-at-4-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 4)))))-  (defgenrule trRl_dev-up-at-3-    (forall ((z strd))-      (implies (p "dev-up" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-up-at-2-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 2)))))-  (defgenrule trRl_dev-up-at-1-    (forall ((z strd))-      (implies (p "dev-up" z (idx 4)) (trans z (idx 1)))))-  (defgenrule trRl_dev-open-at-3-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-open-at-1-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 1)))))-  (defgenrule trRl_dev-close-at-3-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-close-at-2-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 2)))))-  (defgenrule eff-dev-up-3-    (forall ((z z1 strd) (i indx))-      (implies (and (p "dev-up" z (idx 4)) (prec z (idx 3) z1 i))-        (or (= z z1)-          (and (p "dev-up" z (idx 5)) (prec z (idx 4) z1 i))))))-  (defgenrule cau-dev-up-2-    (forall ((z z1 strd) (i indx))-      (implies (and (p "dev-up" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1))))))-  (defgenrule cau-dev-open-2-    (forall ((z z1 strd) (i indx))-      (implies (and (p "dev-open" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1))))))-  (defgenrule cau-dev-close-2-    (forall ((z z1 strd) (i indx))-      (implies (and (p "dev-close" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1))))))-  (defgenrule cau-dev-pass-1-    (forall ((z z1 strd) (i indx))-      (implies (and (p "dev-pass" z (idx 2)) (prec z1 i z (idx 1)))-        (or (= z z1) (prec z1 i z (idx 0))))))-  (defgenrule gen-st-dev-open-1-    (forall ((z strd) (k skey) (o d name))-      (implies-        (and (p "dev-open" z (idx 1)) (p "dev-open" "k" z k)-          (p "dev-open" "o" z o) (p "dev-open" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule gen-st-dev-open-0-    (forall ((z strd) (o d name))-      (implies-        (and (p "dev-open" z (idx 1)) (p "dev-open" "o" z o)-          (p "dev-open" "d" z d)) (gen-st (cat "st" d o o)))))-  (defgenrule gen-st-dev-close-0-    (forall ((z strd) (k skey) (o d name))-      (implies-        (and (p "dev-close" z (idx 1)) (p "dev-close" "k" z k)-          (p "dev-close" "o" z o) (p "dev-close" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule gen-st-dev-pass-1-    (forall ((z strd) (k skey) (o d name))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "k" z k)-          (p "dev-pass" "o" z o) (p "dev-pass" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule gen-st-dev-pass-0-    (forall ((z strd) (o d name))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "o" z o)-          (p "dev-pass" "d" z d)) (gen-st (cat "st" d o o))))))--(defskeleton subatomic-open-closed-  (vars (k skey) (n text) (d o d-0 o-0 name) (pt pt-0 pval)-    (start-ch chan) (lk ls locn))-  (defstrand dev-pass 4 (k k) (n n) (d d-0) (o o-0) (lk lk) (ls ls))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (uniq-orig k n)-  (conf start-ch)-  (facts (no-state-split))-  (goals-    (forall-      ((k skey) (n text) (d o d-0 o-0 name) (start-ch chan) (lk ls locn)-        (z z-0 strd))-      (implies-        (and (p "owner-power-dev" z 2) (p "dev-pass" z-0 4)-          (p "owner-power-dev" "k" z k) (p "owner-power-dev" "d" z d)-          (p "owner-power-dev" "o" z o)-          (p "owner-power-dev" "start-ch" z start-ch)-          (p "dev-pass" "k" z-0 k) (p "dev-pass" "n" z-0 n)-          (p "dev-pass" "d" z-0 d-0) (p "dev-pass" "o" z-0 o-0)-          (p "dev-pass" "lk" z-0 lk) (p "dev-pass" "ls" z-0 ls)-          (uniq-at n z-0 3) (uniq-at k z 0) (conf start-ch)-          (fact no-state-split))-        (exists ((any old old1 mesg) (n-0 text) (z-1 z-2 z-3 z-4 strd))-          (and (= d-0 d) (= o-0 o) (p "dev-open" z-1 4)-            (p "owner-open" z-2 1) (p "user-pass" z-3 1)-            (p "dev-up" z-4 6) (p "dev-pass" "d" z-0 d)-            (p "dev-pass" "o" z-0 o) (p "dev-open" "any" z-1 any)-            (p "dev-open" "k" z-1 k) (p "dev-open" "n" z-1 n-0)-            (p "dev-open" "d" z-1 d) (p "dev-open" "o" z-1 o)-            (p "dev-open" "lk" z-1 lk) (p "dev-open" "ls" z-1 ls)-            (p "owner-open" "k" z-2 k) (p "owner-open" "n" z-2 n-0)-            (p "owner-open" "d" z-2 d) (p "owner-open" "o" z-2 o)-            (p "user-pass" "k" z-3 k) (p "dev-up" "old" z-4 old)-            (p "dev-up" "old1" z-4 old1) (p "dev-up" "k" z-4 k)-            (p "dev-up" "d" z-4 d) (p "dev-up" "o" z-4 o)-            (p "dev-up" "start-ch" z-4 start-ch)-            (p "dev-up" "lk" z-4 lk) (p "dev-up" "ls" z-4 ls)-            (prec z 0 z-4 0) (prec z-1 3 z-0 0) (prec z-2 0 z-1 0)-            (prec z-3 0 z-0 2) (prec z-4 4 z-1 1) (prec z-4 5 z 1)-            (gen-st (cat "st" d o o)) (gen-st (cat "st-k" d o k))-            (leads-to z-1 3 z-0 1) (leads-to z-4 3 z-0 0)-            (leads-to z-4 3 z-1 2) (auth start-ch)-            (fact same-dev ls lk))))))-  (traces-    ((load lk (cat pt "st-k" d-0 o-0 k))-      (load ls (cat pt-0 "st" d-0 o-0 o-0)) (recv (enc "may I pass" k))-      (send (enc "you may pass" n k)))-    ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k))))-  (label 0)-  (unrealized (0 0) (0 2) (1 1))-  (preskeleton)-  (origs (n (0 3)) (k (1 0)))-  (comment "Not a skeleton"))--(defskeleton subatomic-open-closed-  (vars (k skey) (n text) (d o d-0 o-0 name) (pt pt-0 pval)-    (start-ch chan) (lk ls locn))-  (defstrand dev-pass 4 (k k) (n n) (d d-0) (o o-0) (lk lk) (ls ls))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (precedes ((1 0) (0 0)))-  (uniq-orig k n)-  (conf start-ch)-  (facts (no-state-split))-  (traces-    ((load lk (cat pt "st-k" d-0 o-0 k))-      (load ls (cat pt-0 "st" d-0 o-0 o-0)) (recv (enc "may I pass" k))-      (send (enc "you may pass" n k)))-    ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k))))-  (label 1)-  (parent 0)-  (unrealized (0 0) (0 2) (1 1))-  (origs (n (0 3)) (k (1 0)))-  (comment "Not closed under rules"))--(defskeleton subatomic-open-closed-  (vars (k skey) (n text) (d o d-0 o-0 name) (pt pt-0 pval)-    (start-ch chan) (lk ls locn))-  (defstrand dev-pass 4 (k k) (n n) (d d-0) (o o-0) (lk lk) (ls ls))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (precedes ((1 0) (0 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d-0 o-0 o-0) (cat "st-k" d-0 o-0 k))-  (conf start-ch)-  (facts (same-dev ls lk) (no-state-split))-  (rule fact-dev-pass-same-dev0 gen-st-dev-pass-0 gen-st-dev-pass-1)-  (traces-    ((load lk (cat pt "st-k" d-0 o-0 k))-      (load ls (cat pt-0 "st" d-0 o-0 o-0)) (recv (enc "may I pass" k))-      (send (enc "you may pass" n k)))-    ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k))))-  (label 2)-  (parent 1)-  (unrealized (0 0) (0 1) (0 2) (1 1))-  (origs (n (0 3)) (k (1 0)))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 mesg) (k skey) (n text) (d o d-0 o-0 d-1 o-1 name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (start-ch start-ch-0 chan)-    (lk ls lk-0 ls-0 locn))-  (defstrand dev-pass 4 (k k) (n n) (d d-0) (o o-0) (lk lk) (ls ls))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-up 6 (old old) (old1 old1) (k k) (d d-1) (o o-1)-    (start-ch start-ch-0) (lk lk-0) (ls ls-0))-  (precedes ((1 0) (0 0)) ((1 0) (2 0)) ((2 5) (1 1)))-  (uniq-orig k n)-  (gen-st (cat "st" d-0 o-0 o-0) (cat "st-k" d-0 o-0 k))-  (conf start-ch)-  (auth start-ch-0)-  (facts (same-dev ls-0 lk-0) (same-dev ls lk) (no-state-split))-  (rule fact-dev-pass-same-dev0 fact-dev-up-same-dev0 trRl_dev-up-at-1-    trRl_dev-up-at-2 trRl_dev-up-at-3 trRl_dev-up-at-4)-  (operation encryption-test (added-strand dev-up 6) (enc "up" k) (1 1))-  (strand-map 0 1)-  (traces-    ((load lk (cat pt "st-k" d-0 o-0 k))-      (load ls (cat pt-0 "st" d-0 o-0 o-0)) (recv (enc "may I pass" k))-      (send (enc "you may pass" n k)))-    ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv start-ch-0 (cat "power-up" d-1 o-1 k))-      (load lk-0 (cat pt-1 old)) (load ls-0 (cat pt-2 old1))-      (stor lk-0 (cat pt-3 "st-k" d-1 o-1 k))-      (stor ls-0 (cat pt-4 "st" d-1 o-1)) (send (enc "up" k))))-  (label 3)-  (parent 2)-  (unrealized (0 0) (0 1) (0 2) (2 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (k skey) (n text) (d o d-0 o-0 name) (pt pt-0 pval)-    (start-ch chan) (lk ls locn))-  (defstrand dev-pass 4 (k k) (n n) (d d-0) (o o-0) (lk lk) (ls ls))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (deflistener k)-  (precedes ((1 0) (0 0)) ((1 0) (2 0)) ((2 1) (1 1)))-  (uniq-orig k n)-  (gen-st (cat "st" d-0 o-0 o-0) (cat "st-k" d-0 o-0 k))-  (conf start-ch)-  (facts (same-dev ls lk) (no-state-split))-  (rule fact-dev-pass-same-dev0)-  (operation encryption-test (added-listener k) (enc "up" k) (1 1))-  (strand-map 0 1)-  (traces-    ((load lk (cat pt "st-k" d-0 o-0 k))-      (load ls (cat pt-0 "st" d-0 o-0 o-0)) (recv (enc "may I pass" k))-      (send (enc "you may pass" n k)))-    ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv k) (send k)))-  (label 4)-  (parent 2)-  (unrealized (0 0) (0 1) (0 2) (2 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 mesg) (k skey) (n text) (d o d-0 o-0 name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (start-ch chan)-    (lk ls lk-0 ls-0 locn))-  (defstrand dev-pass 4 (k k) (n n) (d d-0) (o o-0) (lk lk) (ls ls))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-up 6 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk-0) (ls ls-0))-  (precedes ((1 0) (0 0)) ((1 0) (2 0)) ((2 5) (1 1)))-  (uniq-orig k n)-  (gen-st (cat "st" d-0 o-0 o-0) (cat "st-k" d-0 o-0 k))-  (conf start-ch)-  (auth start-ch)-  (facts (same-dev ls-0 lk-0) (same-dev ls lk) (no-state-split))-  (rule fact-dev-pass-same-dev0 fact-dev-up-same-dev0 trRl_dev-up-at-1-    trRl_dev-up-at-2 trRl_dev-up-at-3 trRl_dev-up-at-4)-  (operation channel-test (displaced 3 1 owner-power-dev 1)-    (ch-msg start-ch-0 (cat "power-up" d-1 o-1 k)) (2 0))-  (strand-map 0 1 2)-  (traces-    ((load lk (cat pt "st-k" d-0 o-0 k))-      (load ls (cat pt-0 "st" d-0 o-0 o-0)) (recv (enc "may I pass" k))-      (send (enc "you may pass" n k)))-    ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk-0 (cat pt-1 old))-      (load ls-0 (cat pt-2 old1)) (stor lk-0 (cat pt-3 "st-k" d o k))-      (stor ls-0 (cat pt-4 "st" d o)) (send (enc "up" k))))-  (label 5)-  (parent 3)-  (seen 7)-  (seen-ops-    (7-      (operation channel-test (added-strand dev-up 4)-        (ch-msg lk (cat pt-2 "st-k" d o k)) (0 0)) (strand-map 0 1 2)))-  (unrealized (0 0) (0 1) (0 2))-  (comment "2 in cohort - 1 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 mesg) (k skey) (n text) (d o d-0 o-0 name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (start-ch chan)-    (lk ls lk-0 ls-0 locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand owner-power-dev 2 (k k) (d d-0) (o o-0)-    (start-ch start-ch))-  (deflistener k)-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d-0) (o o-0)-    (start-ch start-ch) (lk lk-0) (ls ls-0))-  (precedes ((1 0) (0 0)) ((1 0) (3 0)) ((2 1) (1 1)) ((3 4) (2 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  (facts (same-dev ls-0 lk-0) (same-dev ls lk) (no-state-split))-  (rule eff-dev-up-3 fact-dev-pass-same-dev0 fact-dev-up-same-dev0-    trRl_dev-up-at-1 trRl_dev-up-at-2 trRl_dev-up-at-3 trRl_dev-up-at-4)-  (operation nonce-test (added-strand dev-up 4) k (2 0)-    (ch-msg start-ch (cat "power-up" d-0 o-0 k)))-  (strand-map 0 1 2)-  (traces-    ((load lk (cat pt "st-k" d o k)) (load ls (cat pt-0 "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((send start-ch (cat "power-up" d-0 o-0 k)) (recv (enc "up" k)))-    ((recv k) (send k))-    ((recv start-ch (cat "power-up" d-0 o-0 k))-      (load lk-0 (cat pt-1 old)) (load ls-0 (cat pt-2 old1))-      (stor lk-0 (cat pt-3 "st-k" d-0 o-0 k))-      (stor ls-0 (cat pt-4 "st" d-0 o-0))))-  (label 6)-  (parent 4)-  (unrealized (0 0) (0 1) (0 2) (2 0))-  (dead)-  (comment "empty cohort"))--(defskeleton subatomic-open-closed-  (vars (old old1 mesg) (k skey) (n text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pval) (start-ch chan) (lk ls locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-up 6 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (precedes ((1 0) (2 0)) ((2 4) (0 0)) ((2 5) (1 1)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  (facts (same-dev ls lk) (no-state-split))-  (leads-to ((2 3) (0 0)))-  (rule eff-dev-up-3 fact-dev-pass-same-dev0 fact-dev-up-same-dev0-    same-dev-lk-ls trRl_dev-up-at-1 trRl_dev-up-at-2 trRl_dev-up-at-3-    trRl_dev-up-at-4)-  (operation channel-test (displaced 3 2 dev-up 4)-    (ch-msg lk-0 (cat pt-4 "st-k" d-0 o-0 k)) (0 0))-  (strand-map 0 1 2)-  (traces-    ((load lk (cat pt-2 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (load ls (cat pt-1 old1)) (stor lk (cat pt-2 "st-k" d o k))-      (stor ls (cat pt-3 "st" d o)) (send (enc "up" k))))-  (label 7)-  (parent 5)-  (unrealized (0 1) (0 2))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 any mesg) (k k-0 skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pt-5 pval) (start-ch chan)-    (ls lk locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-up 6 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k-0) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (precedes ((1 0) (2 0)) ((2 4) (3 1)) ((2 5) (1 1)) ((3 3) (0 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k) (cat "st-k" d o k-0))-  (conf start-ch)-  (auth start-ch)-  (facts (same-dev ls lk) (no-state-split))-  (leads-to ((2 3) (0 0)) ((3 3) (0 1)))-  (rule cau-dev-open-2 cau-dev-pass-1 eff-dev-up-3-    fact-dev-open-same-dev0 fact-dev-pass-same-dev0 gen-st-dev-open-1-    invShearsRule same-dev-ls-lk trRl_dev-open-at-1 trRl_dev-open-at-3-    trRl_dev-up-at-1 trRl_dev-up-at-2 trRl_dev-up-at-3 trRl_dev-up-at-4)-  (operation channel-test (added-strand dev-open 4)-    (ch-msg ls (cat pt "st" d o o)) (0 1))-  (strand-map 0 1 2)-  (traces-    ((load lk (cat pt-2 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (load ls (cat pt-1 old1)) (stor lk (cat pt-2 "st-k" d o k))-      (stor ls (cat pt-3 "st" d o)) (send (enc "up" k)))-    ((recv (enc "open" d o n-0 k-0)) (load ls (cat pt-4 "st" d any))-      (load lk (cat pt-5 "st-k" d o k-0))-      (stor ls (cat pt "st" d o o))))-  (label 8)-  (parent 7)-  (seen 9)-  (seen-ops-    (9-      (operation channel-test (added-strand dev-up 4)-        (ch-msg lk (cat pt-2 "st-k" d o k)) (3 2))-      (strand-map 0 1 2 3)))-  (unrealized (0 2) (3 2))-  (comment "2 in cohort - 1 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 any mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (start-ch chan) (ls lk locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-up 6 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (precedes ((1 0) (2 0)) ((2 4) (3 1)) ((2 5) (1 1)) ((3 3) (0 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  (facts (same-dev ls lk) (no-state-split))-  (leads-to ((2 3) (0 0)) ((2 3) (3 2)) ((3 3) (0 1)))-  (rule fact-dev-pass-same-dev0 trRl_dev-open-at-1 trRl_dev-open-at-3-    trRl_dev-up-at-1 trRl_dev-up-at-2 trRl_dev-up-at-3 trRl_dev-up-at-4)-  (operation channel-test (displaced 4 2 dev-up 4)-    (ch-msg lk (cat pt-5 "st-k" d o k-0)) (3 2))-  (strand-map 0 1 2 3)-  (traces-    ((load lk (cat pt-2 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (load ls (cat pt-1 old1)) (stor lk (cat pt-2 "st-k" d o k))-      (stor ls (cat pt-3 "st" d o)) (send (enc "up" k)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-4 "st" d any))-      (load lk (cat pt-2 "st-k" d o k)) (stor ls (cat pt "st" d o o))))-  (label 9)-  (parent 8)-  (unrealized (0 2) (3 0))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 any mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (start-ch chan) (ls lk locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-up 6 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand owner-open 1 (k k) (n n-0) (d d) (o o))-  (precedes ((1 0) (2 0)) ((2 4) (3 1)) ((2 5) (1 1)) ((3 3) (0 0))-    ((4 0) (3 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  (facts (same-dev ls lk) (no-state-split))-  (leads-to ((2 3) (0 0)) ((2 3) (3 2)) ((3 3) (0 1)))-  (rule fact-dev-pass-same-dev0 trRl_dev-open-at-1 trRl_dev-open-at-3-    trRl_dev-up-at-1 trRl_dev-up-at-2 trRl_dev-up-at-3 trRl_dev-up-at-4)-  (operation encryption-test (added-strand owner-open 1)-    (enc "open" d o n-0 k) (3 0))-  (strand-map 0 1 2 3)-  (traces-    ((load lk (cat pt-2 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (load ls (cat pt-1 old1)) (stor lk (cat pt-2 "st-k" d o k))-      (stor ls (cat pt-3 "st" d o)) (send (enc "up" k)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-4 "st" d any))-      (load lk (cat pt-2 "st-k" d o k)) (stor ls (cat pt "st" d o o)))-    ((send (enc "open" d o n-0 k))))-  (label 10)-  (parent 9)-  (unrealized (0 2))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 any mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (start-ch chan) (ls lk locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-up 6 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (deflistener k)-  (precedes ((1 0) (2 0)) ((1 0) (4 0)) ((2 4) (3 1)) ((2 5) (1 1))-    ((3 3) (0 0)) ((4 1) (3 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  (facts (same-dev ls lk) (no-state-split))-  (leads-to ((2 3) (0 0)) ((2 3) (3 2)) ((3 3) (0 1)))-  (rule fact-dev-pass-same-dev0 trRl_dev-open-at-1 trRl_dev-open-at-3-    trRl_dev-up-at-1 trRl_dev-up-at-2 trRl_dev-up-at-3 trRl_dev-up-at-4)-  (operation encryption-test (added-listener k) (enc "open" d o n-0 k)-    (3 0))-  (strand-map 0 1 2 3)-  (traces-    ((load lk (cat pt-2 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (load ls (cat pt-1 old1)) (stor lk (cat pt-2 "st-k" d o k))-      (stor ls (cat pt-3 "st" d o)) (send (enc "up" k)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-4 "st" d any))-      (load lk (cat pt-2 "st-k" d o k)) (stor ls (cat pt "st" d o o)))-    ((recv k) (send k)))-  (label 11)-  (parent 9)-  (seen 14)-  (seen-ops-    (14-      (operation nonce-test (added-strand dev-up 4) k (4 0)-        (ch-msg start-ch (cat "power-up" d o k)))-      (strand-map 0 1 2 3 4)))-  (unrealized (4 0))-  (comment "2 in cohort - 1 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 any mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (start-ch chan) (ls lk locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-up 6 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand owner-open 1 (k k) (n n-0) (d d) (o o))-  (defstrand user-pass 1 (k k))-  (precedes ((1 0) (2 0)) ((2 4) (3 1)) ((2 5) (1 1)) ((3 3) (0 0))-    ((4 0) (3 0)) ((5 0) (0 2)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  (facts (same-dev ls lk) (no-state-split))-  (leads-to ((2 3) (0 0)) ((2 3) (3 2)) ((3 3) (0 1)))-  (rule fact-dev-pass-same-dev0 trRl_dev-open-at-1 trRl_dev-open-at-3-    trRl_dev-up-at-1 trRl_dev-up-at-2 trRl_dev-up-at-3 trRl_dev-up-at-4)-  (operation encryption-test (added-strand user-pass 1)-    (enc "may I pass" k) (0 2))-  (strand-map 0 1 2 3 4)-  (traces-    ((load lk (cat pt-2 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (load ls (cat pt-1 old1)) (stor lk (cat pt-2 "st-k" d o k))-      (stor ls (cat pt-3 "st" d o)) (send (enc "up" k)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-4 "st" d any))-      (load lk (cat pt-2 "st-k" d o k)) (stor ls (cat pt "st" d o o)))-    ((send (enc "open" d o n-0 k))) ((send (enc "may I pass" k))))-  (label 12)-  (parent 10)-  (realized)-  (shape)-  (satisfies yes)-  (maps-    ((0 1)-      ((k k) (n n) (d d) (o o) (d-0 d) (o-0 o) (start-ch start-ch)-        (lk lk) (ls ls))))-  (origs (pt-2 (2 3)) (pt-3 (2 4)) (pt (3 3)) (n (0 3)) (k (1 0))))--(defskeleton subatomic-open-closed-  (vars (old old1 any mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (start-ch chan) (ls lk locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-up 6 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand owner-open 1 (k k) (n n-0) (d d) (o o))-  (deflistener k)-  (precedes ((1 0) (2 0)) ((1 0) (5 0)) ((2 4) (3 1)) ((2 5) (1 1))-    ((3 3) (0 0)) ((4 0) (3 0)) ((5 1) (0 2)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  (facts (same-dev ls lk) (no-state-split))-  (leads-to ((2 3) (0 0)) ((2 3) (3 2)) ((3 3) (0 1)))-  (rule fact-dev-pass-same-dev0 trRl_dev-open-at-1 trRl_dev-open-at-3-    trRl_dev-up-at-1 trRl_dev-up-at-2 trRl_dev-up-at-3 trRl_dev-up-at-4)-  (operation encryption-test (added-listener k) (enc "may I pass" k)-    (0 2))-  (strand-map 0 1 2 3 4)-  (traces-    ((load lk (cat pt-2 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (load ls (cat pt-1 old1)) (stor lk (cat pt-2 "st-k" d o k))-      (stor ls (cat pt-3 "st" d o)) (send (enc "up" k)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-4 "st" d any))-      (load lk (cat pt-2 "st-k" d o k)) (stor ls (cat pt "st" d o o)))-    ((send (enc "open" d o n-0 k))) ((recv k) (send k)))-  (label 13)-  (parent 10)-  (seen 15)-  (seen-ops-    (15-      (operation nonce-test (added-strand dev-up 4) k (5 0)-        (ch-msg start-ch (cat "power-up" d o k)))-      (strand-map 0 1 2 3 4 5)))-  (unrealized (5 0))-  (comment "2 in cohort - 1 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 any mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (start-ch chan) (ls lk locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-up 6 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (deflistener k)-  (precedes ((1 0) (2 0)) ((2 4) (4 0)) ((2 5) (1 1)) ((3 3) (0 0))-    ((4 1) (3 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  (facts (same-dev ls lk) (no-state-split))-  (leads-to ((2 3) (0 0)) ((2 3) (3 2)) ((3 3) (0 1)))-  (rule eff-dev-up-3 fact-dev-pass-same-dev0 trRl_dev-open-at-1-    trRl_dev-open-at-3 trRl_dev-up-at-1 trRl_dev-up-at-2-    trRl_dev-up-at-3 trRl_dev-up-at-4)-  (operation nonce-test (displaced 5 2 dev-up 4) k (4 0)-    (ch-msg start-ch (cat "power-up" d o k)))-  (strand-map 0 1 2 3 4)-  (traces-    ((load lk (cat pt-2 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (load ls (cat pt-1 old1)) (stor lk (cat pt-2 "st-k" d o k))-      (stor ls (cat pt-3 "st" d o)) (send (enc "up" k)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-4 "st" d any))-      (load lk (cat pt-2 "st-k" d o k)) (stor ls (cat pt "st" d o o)))-    ((recv k) (send k)))-  (label 14)-  (parent 11)-  (unrealized (4 0))-  (dead)-  (comment "empty cohort"))--(defskeleton subatomic-open-closed-  (vars (old old1 any mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (start-ch chan) (ls lk locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-up 6 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand owner-open 1 (k k) (n n-0) (d d) (o o))-  (deflistener k)-  (precedes ((1 0) (2 0)) ((2 4) (3 1)) ((2 4) (5 0)) ((2 5) (1 1))-    ((3 3) (0 0)) ((4 0) (3 0)) ((5 1) (0 2)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  (facts (same-dev ls lk) (no-state-split))-  (leads-to ((2 3) (0 0)) ((2 3) (3 2)) ((3 3) (0 1)))-  (rule eff-dev-up-3 fact-dev-pass-same-dev0 trRl_dev-open-at-1-    trRl_dev-open-at-3 trRl_dev-up-at-1 trRl_dev-up-at-2-    trRl_dev-up-at-3 trRl_dev-up-at-4)-  (operation nonce-test (displaced 6 2 dev-up 4) k (5 0)-    (ch-msg start-ch (cat "power-up" d o k)))-  (strand-map 0 1 2 3 4 5)-  (traces-    ((load lk (cat pt-2 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (load ls (cat pt-1 old1)) (stor lk (cat pt-2 "st-k" d o k))-      (stor ls (cat pt-3 "st" d o)) (send (enc "up" k)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-4 "st" d any))-      (load lk (cat pt-2 "st-k" d o k)) (stor ls (cat pt "st" d o o)))-    ((send (enc "open" d o n-0 k))) ((recv k) (send k)))-  (label 15)-  (parent 13)-  (unrealized (5 0))-  (dead)-  (comment "empty cohort"))--(comment "Nothing left to do")
tst/sigenc.tst view
@@ -1,7 +1,7 @@ (herald "Signed Encrypted Message Example"   (comment "Shows examples of key usage of asymmetric keys")) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/sigenc.scm")  (defprotocol mult-keys-sig-enc basic
tst/sorted_epmo_acctnum.tst view
@@ -4,7 +4,7 @@     "This version uses sorts to avoid confusion"     "between a nonce and other data")) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/sorted_epmo_acctnum.scm")  (defprotocol sorted_epmo_acctnum basic
tst/sts.tst view
@@ -1,7 +1,7 @@ (herald "Station-to-station protocol" (bound 20)   (algebra diffie-hellman)) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/sts.scm") (comment "Strand count bounded at 20")
tst/sts_non_role.tst view
@@ -1,7 +1,7 @@ (herald "Station-to-station protocol:  Weakened version" (bound 20)   (algebra diffie-hellman)) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/sts_non_role.scm") (comment "Strand count bounded at 20")
tst/sts_weakened_reflect.tst view
@@ -1,7 +1,7 @@ (herald "station-to-station-reflect protocol" (bound 20)   (algebra diffie-hellman)) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/sts_weakened_reflect.scm") (comment "Strand count bounded at 20")
− tst/subatomic-open-closed-dist.tst 
@@ -1,1972 +0,0 @@-(herald subatomic-open-closed (bound 40))--(comment "CPSA 4.4.4")-(comment "All input read from tst/subatomic-open-closed-dist.scm")-(comment "Strand count bounded at 40")--(defprotocol subatomic-open-closed basic-  (defrole dev-up-    (vars (k skey) (d o name) (old old1 mesg) (start-ch chan)-      (lk ls locn))-    (trace (recv start-ch (cat "power-up" d o k)) (load lk old)-      (load ls old1) (stor lk (cat "st-k" d o k))-      (stor ls (cat "st" d o)) (send (enc "up" k)))-    (auth start-ch)-    (critical-sections (1 4))-    (facts (same-dev ls lk)))-  (defrole owner-power-dev-    (vars (k skey) (d o name) (start-ch dist-ch chan))-    (trace (send start-ch (cat "power-up" d o k)) (recv (enc "up" k))-      (send dist-ch (enc "dist" d o k)))-    (conf start-ch dist-ch))-  (defrole owner-open-    (vars (k skey) (n text) (d o name) (dist-ch chan))-    (trace (recv dist-ch (enc "dist" d o k)) (send (enc "open" d o n k))-      (recv n)))-  (defrole owner-close-    (vars (k skey) (n text) (d o name) (dist-ch chan))-    (trace (recv dist-ch (enc "dist" d o k))-      (send (enc "close" d o n k)) (recv n)))-  (defrole dev-open-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (recv (enc "open" d o n k)) (load ls (cat "st" d any))-      (load lk (cat "st-k" d o k)) (stor ls (cat "st" d o o)) (send n))-    (critical-sections (1 3))-    (gen-st (cat "st-k" d o k) (cat "st" d (cat o o)))-    (facts (same-dev ls lk)))-  (defrole dev-close-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (recv (enc "close" d o n k)) (load lk (cat "st-k" d o k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d o)) (send n))-    (gen-st (cat "st-k" d o k))-    (critical-sections (1 3))-    (facts (same-dev ls lk)))-  (defrole dev-pass-    (vars (k skey) (n text) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (load ls (cat "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    (uniq-orig n)-    (gen-st (cat "st-k" d o k) (cat "st" d (cat o o)))-    (critical-sections (0 1))-    (facts (same-dev ls lk)))-  (defrole user-pass-    (vars (k skey) (d o name) (dist-ch chan))-    (trace (recv dist-ch (enc "dist" d o k)) (send (enc "may I pass" k))-      (recv (enc "you may pass" k))))-  (defrule power-deliver-once-    (forall ((z1 z2 strd) (k skey))-      (implies-        (and (p "dev-up" z1 (idx 2)) (p "dev-up" z2 (idx 2))-          (p "dev-up" "k" z1 k) (p "dev-up" "k" z2 k))-        (= z1 z2))))-  (defrule same-dev-ls-lk-    (forall ((ls lk lk-0 locn))-      (implies-        (and (fact same-dev ls lk) (fact same-dev ls lk-0))-        (= lk lk-0))))-  (defrule same-dev-lk-ls-    (forall ((lk ls ls-0 locn))-      (implies-        (and (fact same-dev ls lk) (fact same-dev ls-0 lk))-        (= ls ls-0))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule shearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule invShearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule fact-dev-up-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-up" z (idx 3)) (p "dev-up" "ls" z ls)-          (p "dev-up" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule fact-dev-open-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-open" z (idx 3)) (p "dev-open" "ls" z ls)-          (p "dev-open" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule fact-dev-close-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-close" z (idx 3)) (p "dev-close" "ls" z ls)-          (p "dev-close" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule fact-dev-pass-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-pass" z (idx 2)) (p "dev-pass" "ls" z ls)-          (p "dev-pass" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule trRl_dev-up-at-4-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 4)))))-  (defgenrule trRl_dev-up-at-3-    (forall ((z strd))-      (implies (p "dev-up" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-up-at-2-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 2)))))-  (defgenrule trRl_dev-up-at-1-    (forall ((z strd))-      (implies (p "dev-up" z (idx 4)) (trans z (idx 1)))))-  (defgenrule trRl_dev-open-at-3-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-open-at-1-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 1)))))-  (defgenrule trRl_dev-close-at-3-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-close-at-2-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 2)))))-  (defgenrule eff-dev-up-3-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-up" z (idx 4)) (prec z (idx 3) z1 i))-        (or (= z z1)-          (and (p "dev-up" z (idx 5)) (prec z (idx 4) z1 i))))))-  (defgenrule cau-dev-up-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-up" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1))))))-  (defgenrule cau-dev-open-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-open" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1))))))-  (defgenrule cau-dev-close-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-close" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1))))))-  (defgenrule cau-dev-pass-1-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-pass" z (idx 2)) (prec z1 i z (idx 1)))-        (or (= z z1) (prec z1 i z (idx 0))))))-  (defgenrule gen-st-dev-open-1-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-open" z (idx 1)) (p "dev-open" "k" z k)-          (p "dev-open" "o" z o) (p "dev-open" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule gen-st-dev-open-0-    (forall ((z strd) (d o name))-      (implies-        (and (p "dev-open" z (idx 1)) (p "dev-open" "o" z o)-          (p "dev-open" "d" z d)) (gen-st (cat "st" d o o)))))-  (defgenrule gen-st-dev-close-0-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-close" z (idx 1)) (p "dev-close" "k" z k)-          (p "dev-close" "o" z o) (p "dev-close" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule gen-st-dev-pass-1-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "k" z k)-          (p "dev-pass" "o" z o) (p "dev-pass" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule gen-st-dev-pass-0-    (forall ((z strd) (d o name))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "o" z o)-          (p "dev-pass" "d" z d)) (gen-st (cat "st" d o o))))))--(defskeleton subatomic-open-closed-  (vars (k skey) (d o name) (start-ch chan))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (deflistener k)-  (uniq-orig k)-  (conf start-ch)-  (facts (no-state-split))-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv k) (send k)))-  (label 0)-  (unrealized (0 1) (1 0))-  (preskeleton)-  (origs (k (0 0)))-  (comment "Not a skeleton"))--(defskeleton subatomic-open-closed-  (vars (k skey) (d o name) (start-ch chan))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (deflistener k)-  (precedes ((0 0) (1 0)))-  (uniq-orig k)-  (conf start-ch)-  (facts (no-state-split))-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv k) (send k)))-  (label 1)-  (parent 0)-  (unrealized (0 1) (1 0))-  (origs (k (0 0)))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 mesg) (k skey) (d o name) (pt pt-0 pt-1 pt-2 pval)-    (start-ch chan) (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (deflistener k)-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (precedes ((0 0) (2 0)) ((2 4) (1 0)))-  (uniq-orig k)-  (conf start-ch)-  (auth start-ch)-  (facts (same-dev ls lk) (no-state-split))-  (rule eff-dev-up-3 fact-dev-up-same-dev0 trRl_dev-up-at-1-    trRl_dev-up-at-2 trRl_dev-up-at-3 trRl_dev-up-at-4)-  (operation nonce-test (added-strand dev-up 4) k (1 0)-    (ch-msg start-ch (cat "power-up" d o k)))-  (strand-map 0 1)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((recv k) (send k))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt old))-      (load ls (cat pt-0 old1)) (stor lk (cat pt-1 "st-k" d o k))-      (stor ls (cat pt-2 "st" d o))))-  (label 2)-  (parent 1)-  (unrealized (0 1) (1 0))-  (dead)-  (comment "empty cohort"))--(comment "Nothing left to do")--(defprotocol subatomic-open-closed basic-  (defrole dev-up-    (vars (k skey) (d o name) (old old1 mesg) (start-ch chan)-      (lk ls locn))-    (trace (recv start-ch (cat "power-up" d o k)) (load lk old)-      (load ls old1) (stor lk (cat "st-k" d o k))-      (stor ls (cat "st" d o)) (send (enc "up" k)))-    (auth start-ch)-    (critical-sections (1 4))-    (facts (same-dev ls lk)))-  (defrole owner-power-dev-    (vars (k skey) (d o name) (start-ch dist-ch chan))-    (trace (send start-ch (cat "power-up" d o k)) (recv (enc "up" k))-      (send dist-ch (enc "dist" d o k)))-    (conf start-ch dist-ch))-  (defrole owner-open-    (vars (k skey) (n text) (d o name) (dist-ch chan))-    (trace (recv dist-ch (enc "dist" d o k)) (send (enc "open" d o n k))-      (recv n)))-  (defrole owner-close-    (vars (k skey) (n text) (d o name) (dist-ch chan))-    (trace (recv dist-ch (enc "dist" d o k))-      (send (enc "close" d o n k)) (recv n)))-  (defrole dev-open-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (recv (enc "open" d o n k)) (load ls (cat "st" d any))-      (load lk (cat "st-k" d o k)) (stor ls (cat "st" d o o)) (send n))-    (critical-sections (1 3))-    (gen-st (cat "st-k" d o k) (cat "st" d (cat o o)))-    (facts (same-dev ls lk)))-  (defrole dev-close-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (recv (enc "close" d o n k)) (load lk (cat "st-k" d o k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d o)) (send n))-    (gen-st (cat "st-k" d o k))-    (critical-sections (1 3))-    (facts (same-dev ls lk)))-  (defrole dev-pass-    (vars (k skey) (n text) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (load ls (cat "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    (uniq-orig n)-    (gen-st (cat "st-k" d o k) (cat "st" d (cat o o)))-    (critical-sections (0 1))-    (facts (same-dev ls lk)))-  (defrole user-pass-    (vars (k skey) (d o name) (dist-ch chan))-    (trace (recv dist-ch (enc "dist" d o k)) (send (enc "may I pass" k))-      (recv (enc "you may pass" k))))-  (defrule power-deliver-once-    (forall ((z1 z2 strd) (k skey))-      (implies-        (and (p "dev-up" z1 (idx 2)) (p "dev-up" z2 (idx 2))-          (p "dev-up" "k" z1 k) (p "dev-up" "k" z2 k))-        (= z1 z2))))-  (defrule same-dev-ls-lk-    (forall ((ls lk lk-0 locn))-      (implies-        (and (fact same-dev ls lk) (fact same-dev ls lk-0))-        (= lk lk-0))))-  (defrule same-dev-lk-ls-    (forall ((lk ls ls-0 locn))-      (implies-        (and (fact same-dev ls lk) (fact same-dev ls-0 lk))-        (= ls ls-0))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule shearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule invShearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule fact-dev-up-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-up" z (idx 3)) (p "dev-up" "ls" z ls)-          (p "dev-up" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule fact-dev-open-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-open" z (idx 3)) (p "dev-open" "ls" z ls)-          (p "dev-open" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule fact-dev-close-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-close" z (idx 3)) (p "dev-close" "ls" z ls)-          (p "dev-close" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule fact-dev-pass-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-pass" z (idx 2)) (p "dev-pass" "ls" z ls)-          (p "dev-pass" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule trRl_dev-up-at-4-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 4)))))-  (defgenrule trRl_dev-up-at-3-    (forall ((z strd))-      (implies (p "dev-up" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-up-at-2-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 2)))))-  (defgenrule trRl_dev-up-at-1-    (forall ((z strd))-      (implies (p "dev-up" z (idx 4)) (trans z (idx 1)))))-  (defgenrule trRl_dev-open-at-3-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-open-at-1-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 1)))))-  (defgenrule trRl_dev-close-at-3-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-close-at-2-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 2)))))-  (defgenrule eff-dev-up-3-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-up" z (idx 4)) (prec z (idx 3) z1 i))-        (or (= z z1)-          (and (p "dev-up" z (idx 5)) (prec z (idx 4) z1 i))))))-  (defgenrule cau-dev-up-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-up" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1))))))-  (defgenrule cau-dev-open-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-open" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1))))))-  (defgenrule cau-dev-close-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-close" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1))))))-  (defgenrule cau-dev-pass-1-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-pass" z (idx 2)) (prec z1 i z (idx 1)))-        (or (= z z1) (prec z1 i z (idx 0))))))-  (defgenrule gen-st-dev-open-1-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-open" z (idx 1)) (p "dev-open" "k" z k)-          (p "dev-open" "o" z o) (p "dev-open" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule gen-st-dev-open-0-    (forall ((z strd) (d o name))-      (implies-        (and (p "dev-open" z (idx 1)) (p "dev-open" "o" z o)-          (p "dev-open" "d" z d)) (gen-st (cat "st" d o o)))))-  (defgenrule gen-st-dev-close-0-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-close" z (idx 1)) (p "dev-close" "k" z k)-          (p "dev-close" "o" z o) (p "dev-close" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule gen-st-dev-pass-1-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "k" z k)-          (p "dev-pass" "o" z o) (p "dev-pass" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule gen-st-dev-pass-0-    (forall ((z strd) (d o name))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "o" z o)-          (p "dev-pass" "d" z d)) (gen-st (cat "st" d o o))))))--(defskeleton subatomic-open-closed-  (vars (k skey) (n text) (d o name) (pt pt-0 pval) (lk ls locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (uniq-orig n)-  (facts (no-state-split))-  (traces-    ((load lk (cat pt "st-k" d o k)) (load ls (cat pt-0 "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k))))-  (label 3)-  (realized)-  (origs (n (0 3)))-  (comment "Not closed under rules"))--(defskeleton subatomic-open-closed-  (vars (k skey) (n text) (d o name) (pt pt-0 pval) (lk ls locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (uniq-orig n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (facts (same-dev ls lk) (no-state-split))-  (rule fact-dev-pass-same-dev0 gen-st-dev-pass-0 gen-st-dev-pass-1)-  (traces-    ((load lk (cat pt "st-k" d o k)) (load ls (cat pt-0 "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k))))-  (label 4)-  (parent 3)-  (unrealized (0 0) (0 1))-  (origs (n (0 3)))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 mesg) (k skey) (n text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pval) (start-ch chan) (lk ls locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (precedes ((1 4) (0 0)))-  (uniq-orig n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (auth start-ch)-  (facts (same-dev ls lk) (no-state-split))-  (leads-to ((1 3) (0 0)))-  (rule eff-dev-up-3 fact-dev-pass-same-dev0 fact-dev-up-same-dev0-    same-dev-lk-ls trRl_dev-up-at-1 trRl_dev-up-at-2 trRl_dev-up-at-3-    trRl_dev-up-at-4)-  (operation channel-test (added-strand dev-up 4)-    (ch-msg lk (cat pt-2 "st-k" d o k)) (0 0))-  (strand-map 0)-  (traces-    ((load lk (cat pt-2 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (load ls (cat pt-1 old1)) (stor lk (cat pt-2 "st-k" d o k))-      (stor ls (cat pt-3 "st" d o))))-  (label 5)-  (parent 4)-  (unrealized (0 1) (1 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 mesg) (k skey) (n text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pval) (start-ch chan) (lk ls locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand owner-power-dev 1 (k k) (d d) (o o) (start-ch start-ch))-  (precedes ((1 4) (0 0)) ((2 0) (1 0)))-  (uniq-orig n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  (facts (same-dev ls lk) (no-state-split))-  (leads-to ((1 3) (0 0)))-  (rule fact-dev-pass-same-dev0 trRl_dev-up-at-1 trRl_dev-up-at-2-    trRl_dev-up-at-3 trRl_dev-up-at-4)-  (operation channel-test (added-strand owner-power-dev 1)-    (ch-msg start-ch (cat "power-up" d o k)) (1 0))-  (strand-map 0 1)-  (traces-    ((load lk (cat pt-2 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (load ls (cat pt-1 old1)) (stor lk (cat pt-2 "st-k" d o k))-      (stor ls (cat pt-3 "st" d o)))-    ((send start-ch (cat "power-up" d o k))))-  (label 6)-  (parent 5)-  (unrealized (0 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 any mesg) (k k-0 skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pt-5 pval) (start-ch chan)-    (ls lk locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand owner-power-dev 1 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-open 4 (any any) (k k-0) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (precedes ((1 4) (3 1)) ((2 0) (1 0)) ((3 3) (0 0)))-  (uniq-orig n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k) (cat "st-k" d o k-0))-  (conf start-ch)-  (auth start-ch)-  (facts (same-dev ls lk) (no-state-split))-  (leads-to ((1 3) (0 0)) ((3 3) (0 1)))-  (rule cau-dev-open-2 cau-dev-pass-1 eff-dev-up-3-    fact-dev-open-same-dev0 fact-dev-pass-same-dev0 gen-st-dev-open-1-    invShearsRule same-dev-ls-lk trRl_dev-open-at-1 trRl_dev-open-at-3-    trRl_dev-up-at-1 trRl_dev-up-at-2 trRl_dev-up-at-3 trRl_dev-up-at-4)-  (operation channel-test (added-strand dev-open 4)-    (ch-msg ls (cat pt "st" d o o)) (0 1))-  (strand-map 0 1 2)-  (traces-    ((load lk (cat pt-2 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (load ls (cat pt-1 old1)) (stor lk (cat pt-2 "st-k" d o k))-      (stor ls (cat pt-3 "st" d o)))-    ((send start-ch (cat "power-up" d o k)))-    ((recv (enc "open" d o n-0 k-0)) (load ls (cat pt-4 "st" d any))-      (load lk (cat pt-5 "st-k" d o k-0))-      (stor ls (cat pt "st" d o o))))-  (label 7)-  (parent 6)-  (seen 8)-  (seen-ops-    (8-      (operation channel-test (added-strand dev-up 4)-        (ch-msg lk (cat pt-3 "st-k" d o k)) (3 2))-      (strand-map 0 1 2 3)))-  (unrealized (3 2))-  (comment "2 in cohort - 1 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 any mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (start-ch chan) (ls lk locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand owner-power-dev 1 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (precedes ((1 4) (3 1)) ((2 0) (1 0)) ((3 3) (0 0)))-  (uniq-orig n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  (facts (same-dev ls lk) (no-state-split))-  (leads-to ((1 3) (0 0)) ((1 3) (3 2)) ((3 3) (0 1)))-  (rule fact-dev-pass-same-dev0 trRl_dev-open-at-1 trRl_dev-open-at-3-    trRl_dev-up-at-1 trRl_dev-up-at-2 trRl_dev-up-at-3 trRl_dev-up-at-4)-  (operation channel-test (displaced 4 1 dev-up 4)-    (ch-msg lk (cat pt-5 "st-k" d o k-0)) (3 2))-  (strand-map 0 1 2 3)-  (traces-    ((load lk (cat pt-2 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (load ls (cat pt-1 old1)) (stor lk (cat pt-2 "st-k" d o k))-      (stor ls (cat pt-3 "st" d o)))-    ((send start-ch (cat "power-up" d o k)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-4 "st" d any))-      (load lk (cat pt-2 "st-k" d o k)) (stor ls (cat pt "st" d o o))))-  (label 8)-  (parent 7)-  (realized)-  (shape)-  (maps ((0) ((k k) (n n) (d d) (o o) (lk lk) (ls ls))))-  (origs (pt-2 (1 3)) (pt-3 (1 4)) (pt (3 3)) (n (0 3))))--(comment "Nothing left to do")--(defprotocol subatomic-open-closed basic-  (defrole dev-up-    (vars (k skey) (d o name) (old old1 mesg) (start-ch chan)-      (lk ls locn))-    (trace (recv start-ch (cat "power-up" d o k)) (load lk old)-      (load ls old1) (stor lk (cat "st-k" d o k))-      (stor ls (cat "st" d o)) (send (enc "up" k)))-    (auth start-ch)-    (critical-sections (1 4))-    (facts (same-dev ls lk)))-  (defrole owner-power-dev-    (vars (k skey) (d o name) (start-ch dist-ch chan))-    (trace (send start-ch (cat "power-up" d o k)) (recv (enc "up" k))-      (send dist-ch (enc "dist" d o k)))-    (conf start-ch dist-ch))-  (defrole owner-open-    (vars (k skey) (n text) (d o name) (dist-ch chan))-    (trace (recv dist-ch (enc "dist" d o k)) (send (enc "open" d o n k))-      (recv n)))-  (defrole owner-close-    (vars (k skey) (n text) (d o name) (dist-ch chan))-    (trace (recv dist-ch (enc "dist" d o k))-      (send (enc "close" d o n k)) (recv n)))-  (defrole dev-open-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (recv (enc "open" d o n k)) (load ls (cat "st" d any))-      (load lk (cat "st-k" d o k)) (stor ls (cat "st" d o o)) (send n))-    (critical-sections (1 3))-    (gen-st (cat "st-k" d o k) (cat "st" d (cat o o)))-    (facts (same-dev ls lk)))-  (defrole dev-close-    (vars (k skey) (n text) (any mesg) (d o name) (lk ls locn))-    (trace (recv (enc "close" d o n k)) (load lk (cat "st-k" d o k))-      (load ls (cat "st" d any)) (stor ls (cat "st" d o)) (send n))-    (gen-st (cat "st-k" d o k))-    (critical-sections (1 3))-    (facts (same-dev ls lk)))-  (defrole dev-pass-    (vars (k skey) (n text) (d o name) (lk ls locn))-    (trace (load lk (cat "st-k" d o k)) (load ls (cat "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    (uniq-orig n)-    (gen-st (cat "st-k" d o k) (cat "st" d (cat o o)))-    (critical-sections (0 1))-    (facts (same-dev ls lk)))-  (defrole user-pass-    (vars (k skey) (d o name) (dist-ch chan))-    (trace (recv dist-ch (enc "dist" d o k)) (send (enc "may I pass" k))-      (recv (enc "you may pass" k))))-  (defrule power-deliver-once-    (forall ((z1 z2 strd) (k skey))-      (implies-        (and (p "dev-up" z1 (idx 2)) (p "dev-up" z2 (idx 2))-          (p "dev-up" "k" z1 k) (p "dev-up" "k" z2 k))-        (= z1 z2))))-  (defrule same-dev-ls-lk-    (forall ((ls lk lk-0 locn))-      (implies-        (and (fact same-dev ls lk) (fact same-dev ls lk-0))-        (= lk lk-0))))-  (defrule same-dev-lk-ls-    (forall ((lk ls ls-0 locn))-      (implies-        (and (fact same-dev ls lk) (fact same-dev ls-0 lk))-        (= ls ls-0))))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false))))-  (defgenrule scissorsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (leads-to z0 i0 z2 i2))-        (and (= z1 z2) (= i1 i2)))))-  (defgenrule cakeRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (leads-to z0 i0 z1 i1)-          (leads-to z0 i0 z2 i2) (prec z1 i1 z2 i2)) (false))))-  (defgenrule no-interruption-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (leads-to z0 i0 z2 i2) (trans z1 i1)-          (same-locn z0 i0 z1 i1) (prec z0 i0 z1 i1) (prec z1 i1 z2 i2))-        (false))))-  (defgenrule shearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (trans z2 i2)-          (leads-to z0 i0 z1 i1) (same-locn z0 i0 z2 i2)-          (prec z0 i0 z2 i2))-        (or (and (= z1 z2) (= i1 i2)) (prec z1 i1 z2 i2)))))-  (defgenrule invShearsRule-    (forall ((z0 z1 z2 strd) (i0 i1 i2 indx))-      (implies-        (and (trans z0 i0) (trans z1 i1) (same-locn z0 i0 z1 i1)-          (leads-to z1 i1 z2 i2) (prec z0 i0 z2 i2))-        (or (and (= z0 z1) (= i0 i1)) (prec z0 i0 z1 i1)))))-  (defgenrule fact-dev-up-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-up" z (idx 3)) (p "dev-up" "ls" z ls)-          (p "dev-up" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule fact-dev-open-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-open" z (idx 3)) (p "dev-open" "ls" z ls)-          (p "dev-open" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule fact-dev-close-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-close" z (idx 3)) (p "dev-close" "ls" z ls)-          (p "dev-close" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule fact-dev-pass-same-dev0-    (forall ((z strd) (lk ls locn))-      (implies-        (and (p "dev-pass" z (idx 2)) (p "dev-pass" "ls" z ls)-          (p "dev-pass" "lk" z lk)) (fact same-dev ls lk))))-  (defgenrule trRl_dev-up-at-4-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 4)))))-  (defgenrule trRl_dev-up-at-3-    (forall ((z strd))-      (implies (p "dev-up" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-up-at-2-    (forall ((z strd))-      (implies (p "dev-up" z (idx 5)) (trans z (idx 2)))))-  (defgenrule trRl_dev-up-at-1-    (forall ((z strd))-      (implies (p "dev-up" z (idx 4)) (trans z (idx 1)))))-  (defgenrule trRl_dev-open-at-3-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-open-at-1-    (forall ((z strd))-      (implies (p "dev-open" z (idx 4)) (trans z (idx 1)))))-  (defgenrule trRl_dev-close-at-3-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 3)))))-  (defgenrule trRl_dev-close-at-2-    (forall ((z strd))-      (implies (p "dev-close" z (idx 4)) (trans z (idx 2)))))-  (defgenrule eff-dev-up-3-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-up" z (idx 4)) (prec z (idx 3) z1 i))-        (or (= z z1)-          (and (p "dev-up" z (idx 5)) (prec z (idx 4) z1 i))))))-  (defgenrule cau-dev-up-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-up" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1))))))-  (defgenrule cau-dev-open-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-open" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1))))))-  (defgenrule cau-dev-close-2-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-close" z (idx 3)) (prec z1 i z (idx 2)))-        (or (= z z1) (prec z1 i z (idx 1))))))-  (defgenrule cau-dev-pass-1-    (forall ((i indx) (z1 z strd))-      (implies (and (p "dev-pass" z (idx 2)) (prec z1 i z (idx 1)))-        (or (= z z1) (prec z1 i z (idx 0))))))-  (defgenrule gen-st-dev-open-1-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-open" z (idx 1)) (p "dev-open" "k" z k)-          (p "dev-open" "o" z o) (p "dev-open" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule gen-st-dev-open-0-    (forall ((z strd) (d o name))-      (implies-        (and (p "dev-open" z (idx 1)) (p "dev-open" "o" z o)-          (p "dev-open" "d" z d)) (gen-st (cat "st" d o o)))))-  (defgenrule gen-st-dev-close-0-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-close" z (idx 1)) (p "dev-close" "k" z k)-          (p "dev-close" "o" z o) (p "dev-close" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule gen-st-dev-pass-1-    (forall ((z strd) (d o name) (k skey))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "k" z k)-          (p "dev-pass" "o" z o) (p "dev-pass" "d" z d))-        (gen-st (cat "st-k" d o k)))))-  (defgenrule gen-st-dev-pass-0-    (forall ((z strd) (d o name))-      (implies-        (and (p "dev-pass" z (idx 1)) (p "dev-pass" "o" z o)-          (p "dev-pass" "d" z d)) (gen-st (cat "st" d o o))))))--(defskeleton subatomic-open-closed-  (vars (k skey) (n text) (d o d-0 o-0 name) (pt pt-0 pval)-    (start-ch chan) (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d-0) (o o-0) (lk lk) (ls ls))-  (uniq-orig k n)-  (conf start-ch)-  (facts (no-state-split))-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt "st-k" d-0 o-0 k))-      (load ls (cat pt-0 "st" d-0 o-0 o-0)) (recv (enc "may I pass" k))-      (send (enc "you may pass" n k))))-  (label 9)-  (unrealized (0 1) (1 0) (1 2))-  (preskeleton)-  (origs (n (1 3)) (k (0 0)))-  (comment "Not a skeleton"))--(defskeleton subatomic-open-closed-  (vars (k skey) (n text) (d o d-0 o-0 name) (pt pt-0 pval)-    (start-ch chan) (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d-0) (o o-0) (lk lk) (ls ls))-  (precedes ((0 0) (1 0)))-  (uniq-orig k n)-  (conf start-ch)-  (facts (no-state-split))-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt "st-k" d-0 o-0 k))-      (load ls (cat pt-0 "st" d-0 o-0 o-0)) (recv (enc "may I pass" k))-      (send (enc "you may pass" n k))))-  (label 10)-  (parent 9)-  (unrealized (0 1) (1 0) (1 2))-  (origs (n (1 3)) (k (0 0)))-  (comment "Not closed under rules"))--(defskeleton subatomic-open-closed-  (vars (k skey) (n text) (d o d-0 o-0 name) (pt pt-0 pval)-    (start-ch chan) (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d-0) (o o-0) (lk lk) (ls ls))-  (precedes ((0 0) (1 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d-0 o-0 o-0) (cat "st-k" d-0 o-0 k))-  (conf start-ch)-  (facts (same-dev ls lk) (no-state-split))-  (rule fact-dev-pass-same-dev0 gen-st-dev-pass-0 gen-st-dev-pass-1)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt "st-k" d-0 o-0 k))-      (load ls (cat pt-0 "st" d-0 o-0 o-0)) (recv (enc "may I pass" k))-      (send (enc "you may pass" n k))))-  (label 11)-  (parent 10)-  (unrealized (0 1) (1 0) (1 1) (1 2))-  (origs (n (1 3)) (k (0 0)))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 mesg) (k skey) (n text) (d o d-0 o-0 name)-    (pt pt-0 pt-1 pt-2 pt-3 pval) (start-ch start-ch-0 chan)-    (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d-0) (o o-0) (lk lk) (ls ls))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d-0) (o o-0)-    (start-ch start-ch-0) (lk lk) (ls ls))-  (precedes ((0 0) (2 0)) ((2 4) (1 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d-0 o-0 o-0) (cat "st-k" d-0 o-0 k))-  (conf start-ch)-  (auth start-ch-0)-  (facts (same-dev ls lk) (no-state-split))-  (leads-to ((2 3) (1 0)))-  (rule eff-dev-up-3 fact-dev-pass-same-dev0 fact-dev-up-same-dev0-    same-dev-lk-ls trRl_dev-up-at-1 trRl_dev-up-at-2 trRl_dev-up-at-3-    trRl_dev-up-at-4)-  (operation channel-test (added-strand dev-up 4)-    (ch-msg lk (cat pt-2 "st-k" d-0 o-0 k)) (1 0))-  (strand-map 0 1)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt-2 "st-k" d-0 o-0 k))-      (load ls (cat pt "st" d-0 o-0 o-0)) (recv (enc "may I pass" k))-      (send (enc "you may pass" n k)))-    ((recv start-ch-0 (cat "power-up" d-0 o-0 k))-      (load lk (cat pt-0 old)) (load ls (cat pt-1 old1))-      (stor lk (cat pt-2 "st-k" d-0 o-0 k))-      (stor ls (cat pt-3 "st" d-0 o-0))))-  (label 12)-  (parent 11)-  (unrealized (0 1) (1 1) (1 2) (2 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 mesg) (k skey) (n text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pval) (start-ch chan) (lk ls locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (precedes ((0 0) (2 0)) ((2 4) (1 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  (facts (same-dev ls lk) (no-state-split))-  (leads-to ((2 3) (1 0)))-  (rule fact-dev-pass-same-dev0 trRl_dev-up-at-1 trRl_dev-up-at-2-    trRl_dev-up-at-3 trRl_dev-up-at-4)-  (operation channel-test (displaced 3 0 owner-power-dev 1)-    (ch-msg start-ch-0 (cat "power-up" d-0 o-0 k)) (2 0))-  (strand-map 0 1 2)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt-2 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (load ls (cat pt-1 old1)) (stor lk (cat pt-2 "st-k" d o k))-      (stor ls (cat pt-3 "st" d o))))-  (label 13)-  (parent 12)-  (unrealized (0 1) (1 1) (1 2))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 any mesg) (k k-0 skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pt-5 pval) (start-ch chan)-    (ls lk locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k-0) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (precedes ((0 0) (2 0)) ((2 4) (3 1)) ((3 3) (1 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k) (cat "st-k" d o k-0))-  (conf start-ch)-  (auth start-ch)-  (facts (same-dev ls lk) (no-state-split))-  (leads-to ((2 3) (1 0)) ((3 3) (1 1)))-  (rule cau-dev-open-2 cau-dev-pass-1 eff-dev-up-3-    fact-dev-open-same-dev0 fact-dev-pass-same-dev0 gen-st-dev-open-1-    invShearsRule same-dev-ls-lk trRl_dev-open-at-1 trRl_dev-open-at-3-    trRl_dev-up-at-1 trRl_dev-up-at-2 trRl_dev-up-at-3 trRl_dev-up-at-4)-  (operation channel-test (added-strand dev-open 4)-    (ch-msg ls (cat pt "st" d o o)) (1 1))-  (strand-map 0 1 2)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt-2 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (load ls (cat pt-1 old1)) (stor lk (cat pt-2 "st-k" d o k))-      (stor ls (cat pt-3 "st" d o)))-    ((recv (enc "open" d o n-0 k-0)) (load ls (cat pt-4 "st" d any))-      (load lk (cat pt-5 "st-k" d o k-0))-      (stor ls (cat pt "st" d o o))))-  (label 14)-  (parent 13)-  (seen 15)-  (seen-ops-    (15-      (operation channel-test (added-strand dev-up 4)-        (ch-msg lk (cat pt-3 "st-k" d o k)) (3 2))-      (strand-map 0 1 2 3)))-  (unrealized (0 1) (1 2) (3 2))-  (comment "2 in cohort - 1 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 any mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (start-ch chan) (ls lk locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (precedes ((0 0) (2 0)) ((2 4) (3 1)) ((3 3) (1 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  (facts (same-dev ls lk) (no-state-split))-  (leads-to ((2 3) (1 0)) ((2 3) (3 2)) ((3 3) (1 1)))-  (rule fact-dev-pass-same-dev0 trRl_dev-open-at-1 trRl_dev-open-at-3-    trRl_dev-up-at-1 trRl_dev-up-at-2 trRl_dev-up-at-3 trRl_dev-up-at-4)-  (operation channel-test (displaced 4 2 dev-up 4)-    (ch-msg lk (cat pt-5 "st-k" d o k-0)) (3 2))-  (strand-map 0 1 2 3)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt-2 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (load ls (cat pt-1 old1)) (stor lk (cat pt-2 "st-k" d o k))-      (stor ls (cat pt-3 "st" d o)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-4 "st" d any))-      (load lk (cat pt-2 "st-k" d o k)) (stor ls (cat pt "st" d o o))))-  (label 15)-  (parent 14)-  (unrealized (0 1) (1 2) (3 0))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 any mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (start-ch dist-ch chan)-    (ls lk locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand owner-open 2 (k k) (n n-0) (d d) (o o) (dist-ch dist-ch))-  (precedes ((0 0) (2 0)) ((2 4) (3 1)) ((3 3) (1 0)) ((4 1) (3 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  (facts (same-dev ls lk) (no-state-split))-  (leads-to ((2 3) (1 0)) ((2 3) (3 2)) ((3 3) (1 1)))-  (rule fact-dev-pass-same-dev0 trRl_dev-open-at-1 trRl_dev-open-at-3-    trRl_dev-up-at-1 trRl_dev-up-at-2 trRl_dev-up-at-3 trRl_dev-up-at-4)-  (operation encryption-test (added-strand owner-open 2)-    (enc "open" d o n-0 k) (3 0))-  (strand-map 0 1 2 3)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt-2 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (load ls (cat pt-1 old1)) (stor lk (cat pt-2 "st-k" d o k))-      (stor ls (cat pt-3 "st" d o)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-4 "st" d any))-      (load lk (cat pt-2 "st-k" d o k)) (stor ls (cat pt "st" d o o)))-    ((recv dist-ch (enc "dist" d o k)) (send (enc "open" d o n-0 k))))-  (label 16)-  (parent 15)-  (unrealized (0 1) (1 2) (4 0))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 any mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (start-ch chan) (ls lk locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (deflistener k)-  (precedes ((0 0) (2 0)) ((0 0) (4 0)) ((2 4) (3 1)) ((3 3) (1 0))-    ((4 1) (3 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  (facts (same-dev ls lk) (no-state-split))-  (leads-to ((2 3) (1 0)) ((2 3) (3 2)) ((3 3) (1 1)))-  (rule fact-dev-pass-same-dev0 trRl_dev-open-at-1 trRl_dev-open-at-3-    trRl_dev-up-at-1 trRl_dev-up-at-2 trRl_dev-up-at-3 trRl_dev-up-at-4)-  (operation encryption-test (added-listener k) (enc "open" d o n-0 k)-    (3 0))-  (strand-map 0 1 2 3)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt-2 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (load ls (cat pt-1 old1)) (stor lk (cat pt-2 "st-k" d o k))-      (stor ls (cat pt-3 "st" d o)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-4 "st" d any))-      (load lk (cat pt-2 "st-k" d o k)) (stor ls (cat pt "st" d o o)))-    ((recv k) (send k)))-  (label 17)-  (parent 15)-  (seen 20)-  (seen-ops-    (20-      (operation nonce-test (added-strand dev-up 4) k (4 0)-        (ch-msg start-ch (cat "power-up" d o k)))-      (strand-map 0 1 2 3 4)))-  (unrealized (0 1) (4 0))-  (comment "2 in cohort - 1 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 any mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (dist-ch start-ch dist-ch-0 chan)-    (ls lk locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand owner-open 2 (k k) (n n-0) (d d) (o o) (dist-ch dist-ch))-  (defstrand owner-power-dev 3 (k k) (d d) (o o) (start-ch start-ch)-    (dist-ch dist-ch-0))-  (precedes ((1 4) (2 1)) ((2 3) (0 0)) ((3 1) (2 0)) ((4 0) (1 0))-    ((4 2) (3 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch dist-ch-0)-  (auth start-ch)-  (facts (same-dev ls lk) (no-state-split))-  (leads-to ((1 3) (0 0)) ((1 3) (2 2)) ((2 3) (0 1)))-  (rule fact-dev-pass-same-dev0 trRl_dev-open-at-1 trRl_dev-open-at-3-    trRl_dev-up-at-1 trRl_dev-up-at-2 trRl_dev-up-at-3 trRl_dev-up-at-4)-  (operation encryption-test (displaced 0 5 owner-power-dev 3)-    (enc "dist" d o k) (4 0))-  (strand-map 4 0 1 2 3)-  (traces-    ((load lk (cat pt-2 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (load ls (cat pt-1 old1)) (stor lk (cat pt-2 "st-k" d o k))-      (stor ls (cat pt-3 "st" d o)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-4 "st" d any))-      (load lk (cat pt-2 "st-k" d o k)) (stor ls (cat pt "st" d o o)))-    ((recv dist-ch (enc "dist" d o k)) (send (enc "open" d o n-0 k)))-    ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k))-      (send dist-ch-0 (enc "dist" d o k))))-  (label 18)-  (parent 16)-  (seen 21)-  (seen-ops-    (21-      (operation encryption-test (added-strand dev-up 6) (enc "up" k)-        (4 1)) (strand-map 0 4 1 2 3)))-  (unrealized (0 2) (3 0) (4 1))-  (comment "3 in cohort - 2 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 any mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (start-ch dist-ch chan)-    (ls lk locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand owner-open 2 (k k) (n n-0) (d d) (o o) (dist-ch dist-ch))-  (deflistener k)-  (precedes ((0 0) (2 0)) ((0 0) (5 0)) ((2 4) (3 1)) ((3 3) (1 0))-    ((4 1) (3 0)) ((5 1) (4 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  (facts (same-dev ls lk) (no-state-split))-  (leads-to ((2 3) (1 0)) ((2 3) (3 2)) ((3 3) (1 1)))-  (rule fact-dev-pass-same-dev0 trRl_dev-open-at-1 trRl_dev-open-at-3-    trRl_dev-up-at-1 trRl_dev-up-at-2 trRl_dev-up-at-3 trRl_dev-up-at-4)-  (operation encryption-test (added-listener k) (enc "dist" d o k)-    (4 0))-  (strand-map 0 1 2 3 4)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt-2 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (load ls (cat pt-1 old1)) (stor lk (cat pt-2 "st-k" d o k))-      (stor ls (cat pt-3 "st" d o)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-4 "st" d any))-      (load lk (cat pt-2 "st-k" d o k)) (stor ls (cat pt "st" d o o)))-    ((recv dist-ch (enc "dist" d o k)) (send (enc "open" d o n-0 k)))-    ((recv k) (send k)))-  (label 19)-  (parent 16)-  (seen 23)-  (seen-ops-    (23-      (operation nonce-test (added-strand dev-up 4) k (5 0)-        (ch-msg start-ch (cat "power-up" d o k)))-      (strand-map 0 1 2 3 4 5)))-  (unrealized (0 1) (5 0))-  (comment "2 in cohort - 1 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 any mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (start-ch chan) (ls lk locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (deflistener k)-  (precedes ((0 0) (2 0)) ((2 4) (4 0)) ((3 3) (1 0)) ((4 1) (3 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  (facts (same-dev ls lk) (no-state-split))-  (leads-to ((2 3) (1 0)) ((2 3) (3 2)) ((3 3) (1 1)))-  (rule eff-dev-up-3 fact-dev-pass-same-dev0 trRl_dev-open-at-1-    trRl_dev-open-at-3 trRl_dev-up-at-1 trRl_dev-up-at-2-    trRl_dev-up-at-3 trRl_dev-up-at-4)-  (operation nonce-test (displaced 5 2 dev-up 4) k (4 0)-    (ch-msg start-ch (cat "power-up" d o k)))-  (strand-map 0 1 2 3 4)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt-2 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (load ls (cat pt-1 old1)) (stor lk (cat pt-2 "st-k" d o k))-      (stor ls (cat pt-3 "st" d o)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-4 "st" d any))-      (load lk (cat pt-2 "st-k" d o k)) (stor ls (cat pt "st" d o o)))-    ((recv k) (send k)))-  (label 20)-  (parent 17)-  (unrealized (0 1) (4 0))-  (dead)-  (comment "empty cohort"))--(defskeleton subatomic-open-closed-  (vars (any old old1 mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (dist-ch dist-ch-0 start-ch chan)-    (lk ls locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand owner-open 2 (k k) (n n-0) (d d) (o o) (dist-ch dist-ch))-  (defstrand owner-power-dev 3 (k k) (d d) (o o) (start-ch start-ch)-    (dist-ch dist-ch-0))-  (defstrand dev-up 6 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (precedes ((1 3) (0 0)) ((2 1) (1 0)) ((3 0) (4 0)) ((3 2) (2 0))-    ((4 5) (3 1)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf dist-ch-0 start-ch)-  (auth start-ch)-  (facts (same-dev ls lk) (no-state-split))-  (leads-to ((1 3) (0 1)) ((4 3) (0 0)) ((4 3) (1 2)))-  (rule fact-dev-pass-same-dev0 trRl_dev-open-at-1 trRl_dev-open-at-3-    trRl_dev-up-at-1 trRl_dev-up-at-2 trRl_dev-up-at-3 trRl_dev-up-at-4)-  (operation encryption-test (displaced 1 5 dev-up 6) (enc "up" k)-    (4 1))-  (strand-map 0 4 1 2 3)-  (traces-    ((load lk (cat pt-3 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-0 "st" d any))-      (load lk (cat pt-3 "st-k" d o k)) (stor ls (cat pt "st" d o o)))-    ((recv dist-ch (enc "dist" d o k)) (send (enc "open" d o n-0 k)))-    ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k))-      (send dist-ch-0 (enc "dist" d o k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-1 old))-      (load ls (cat pt-2 old1)) (stor lk (cat pt-3 "st-k" d o k))-      (stor ls (cat pt-4 "st" d o)) (send (enc "up" k))))-  (label 21)-  (parent 18)-  (unrealized (0 2) (2 0))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 any mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (dist-ch start-ch dist-ch-0 chan)-    (ls lk locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand owner-open 2 (k k) (n n-0) (d d) (o o) (dist-ch dist-ch))-  (defstrand owner-power-dev 3 (k k) (d d) (o o) (start-ch start-ch)-    (dist-ch dist-ch-0))-  (deflistener k)-  (precedes ((1 4) (2 1)) ((2 3) (0 0)) ((3 1) (2 0)) ((4 0) (1 0))-    ((4 0) (5 0)) ((4 2) (3 0)) ((5 1) (4 1)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch dist-ch-0)-  (auth start-ch)-  (facts (same-dev ls lk) (no-state-split))-  (leads-to ((1 3) (0 0)) ((1 3) (2 2)) ((2 3) (0 1)))-  (rule fact-dev-pass-same-dev0 trRl_dev-open-at-1 trRl_dev-open-at-3-    trRl_dev-up-at-1 trRl_dev-up-at-2 trRl_dev-up-at-3 trRl_dev-up-at-4)-  (operation encryption-test (added-listener k) (enc "up" k) (4 1))-  (strand-map 0 1 2 3 4)-  (traces-    ((load lk (cat pt-2 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (load ls (cat pt-1 old1)) (stor lk (cat pt-2 "st-k" d o k))-      (stor ls (cat pt-3 "st" d o)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-4 "st" d any))-      (load lk (cat pt-2 "st-k" d o k)) (stor ls (cat pt "st" d o o)))-    ((recv dist-ch (enc "dist" d o k)) (send (enc "open" d o n-0 k)))-    ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k))-      (send dist-ch-0 (enc "dist" d o k))) ((recv k) (send k)))-  (label 22)-  (parent 18)-  (seen 26)-  (seen-ops-    (26-      (operation nonce-test (added-strand dev-up 4) k (5 0)-        (ch-msg start-ch (cat "power-up" d o k)))-      (strand-map 0 1 2 3 4 5)))-  (unrealized (5 0))-  (comment "2 in cohort - 1 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 any mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (start-ch dist-ch chan)-    (ls lk locn))-  (defstrand owner-power-dev 2 (k k) (d d) (o o) (start-ch start-ch))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand owner-open 2 (k k) (n n-0) (d d) (o o) (dist-ch dist-ch))-  (deflistener k)-  (precedes ((0 0) (2 0)) ((2 4) (5 0)) ((3 3) (1 0)) ((4 1) (3 0))-    ((5 1) (4 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch)-  (auth start-ch)-  (facts (same-dev ls lk) (no-state-split))-  (leads-to ((2 3) (1 0)) ((2 3) (3 2)) ((3 3) (1 1)))-  (rule eff-dev-up-3 fact-dev-pass-same-dev0 trRl_dev-open-at-1-    trRl_dev-open-at-3 trRl_dev-up-at-1 trRl_dev-up-at-2-    trRl_dev-up-at-3 trRl_dev-up-at-4)-  (operation nonce-test (displaced 6 2 dev-up 4) k (5 0)-    (ch-msg start-ch (cat "power-up" d o k)))-  (strand-map 0 1 2 3 4 5)-  (traces ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k)))-    ((load lk (cat pt-2 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (load ls (cat pt-1 old1)) (stor lk (cat pt-2 "st-k" d o k))-      (stor ls (cat pt-3 "st" d o)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-4 "st" d any))-      (load lk (cat pt-2 "st-k" d o k)) (stor ls (cat pt "st" d o o)))-    ((recv dist-ch (enc "dist" d o k)) (send (enc "open" d o n-0 k)))-    ((recv k) (send k)))-  (label 23)-  (parent 19)-  (unrealized (0 1) (5 0))-  (dead)-  (comment "empty cohort"))--(defskeleton subatomic-open-closed-  (vars (any old old1 mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (dist-ch start-ch chan)-    (lk ls locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand owner-open 2 (k k) (n n-0) (d d) (o o) (dist-ch dist-ch))-  (defstrand owner-power-dev 3 (k k) (d d) (o o) (start-ch start-ch)-    (dist-ch dist-ch))-  (defstrand dev-up 6 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (precedes ((1 3) (0 0)) ((2 1) (1 0)) ((3 0) (4 0)) ((3 2) (2 0))-    ((4 5) (3 1)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf dist-ch start-ch)-  (auth start-ch)-  (facts (same-dev ls lk) (no-state-split))-  (leads-to ((1 3) (0 1)) ((4 3) (0 0)) ((4 3) (1 2)))-  (rule fact-dev-pass-same-dev0 trRl_dev-open-at-1 trRl_dev-open-at-3-    trRl_dev-up-at-1 trRl_dev-up-at-2 trRl_dev-up-at-3 trRl_dev-up-at-4)-  (operation encryption-test (contracted (dist-ch-0 dist-ch))-    (enc "dist" d o k) (2 0) (ch-msg dist-ch (enc "dist" d o k)))-  (strand-map 0 1 2 3 4)-  (traces-    ((load lk (cat pt-3 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-0 "st" d any))-      (load lk (cat pt-3 "st-k" d o k)) (stor ls (cat pt "st" d o o)))-    ((recv dist-ch (enc "dist" d o k)) (send (enc "open" d o n-0 k)))-    ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k))-      (send dist-ch (enc "dist" d o k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-1 old))-      (load ls (cat pt-2 old1)) (stor lk (cat pt-3 "st-k" d o k))-      (stor ls (cat pt-4 "st" d o)) (send (enc "up" k))))-  (label 24)-  (parent 21)-  (unrealized (0 2))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (any old old1 mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (dist-ch dist-ch-0 start-ch chan)-    (lk ls locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand owner-open 2 (k k) (n n-0) (d d) (o o) (dist-ch dist-ch))-  (defstrand owner-power-dev 3 (k k) (d d) (o o) (start-ch start-ch)-    (dist-ch dist-ch-0))-  (defstrand dev-up 6 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (deflistener k)-  (precedes ((1 3) (0 0)) ((2 1) (1 0)) ((3 0) (4 0)) ((3 0) (5 0))-    ((3 2) (2 0)) ((4 5) (3 1)) ((5 1) (2 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf dist-ch-0 start-ch)-  (auth start-ch)-  (facts (same-dev ls lk) (no-state-split))-  (leads-to ((1 3) (0 1)) ((4 3) (0 0)) ((4 3) (1 2)))-  (rule fact-dev-pass-same-dev0 trRl_dev-open-at-1 trRl_dev-open-at-3-    trRl_dev-up-at-1 trRl_dev-up-at-2 trRl_dev-up-at-3 trRl_dev-up-at-4)-  (operation encryption-test (added-listener k) (enc "dist" d o k) (2 0)-    (ch-msg dist-ch-0 (enc "dist" d o k)))-  (strand-map 0 1 2 3 4)-  (traces-    ((load lk (cat pt-3 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-0 "st" d any))-      (load lk (cat pt-3 "st-k" d o k)) (stor ls (cat pt "st" d o o)))-    ((recv dist-ch (enc "dist" d o k)) (send (enc "open" d o n-0 k)))-    ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k))-      (send dist-ch-0 (enc "dist" d o k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-1 old))-      (load ls (cat pt-2 old1)) (stor lk (cat pt-3 "st-k" d o k))-      (stor ls (cat pt-4 "st" d o)) (send (enc "up" k)))-    ((recv k) (send k)))-  (label 25)-  (parent 21)-  (seen 29)-  (seen-ops-    (29-      (operation nonce-test (added-strand dev-up 4) k (5 0)-        (ch-msg start-ch (cat "power-up" d o k)))-      (strand-map 0 1 2 3 4 5)))-  (unrealized (5 0))-  (comment "2 in cohort - 1 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (old old1 any mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (dist-ch start-ch dist-ch-0 chan)-    (ls lk locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-up 5 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand owner-open 2 (k k) (n n-0) (d d) (o o) (dist-ch dist-ch))-  (defstrand owner-power-dev 3 (k k) (d d) (o o) (start-ch start-ch)-    (dist-ch dist-ch-0))-  (deflistener k)-  (precedes ((1 4) (5 0)) ((2 3) (0 0)) ((3 1) (2 0)) ((4 0) (1 0))-    ((4 2) (3 0)) ((5 1) (4 1)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf start-ch dist-ch-0)-  (auth start-ch)-  (facts (same-dev ls lk) (no-state-split))-  (leads-to ((1 3) (0 0)) ((1 3) (2 2)) ((2 3) (0 1)))-  (rule eff-dev-up-3 fact-dev-pass-same-dev0 trRl_dev-open-at-1-    trRl_dev-open-at-3 trRl_dev-up-at-1 trRl_dev-up-at-2-    trRl_dev-up-at-3 trRl_dev-up-at-4)-  (operation nonce-test (displaced 6 1 dev-up 4) k (5 0)-    (ch-msg start-ch (cat "power-up" d o k)))-  (strand-map 0 1 2 3 4 5)-  (traces-    ((load lk (cat pt-2 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-0 old))-      (load ls (cat pt-1 old1)) (stor lk (cat pt-2 "st-k" d o k))-      (stor ls (cat pt-3 "st" d o)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-4 "st" d any))-      (load lk (cat pt-2 "st-k" d o k)) (stor ls (cat pt "st" d o o)))-    ((recv dist-ch (enc "dist" d o k)) (send (enc "open" d o n-0 k)))-    ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k))-      (send dist-ch-0 (enc "dist" d o k))) ((recv k) (send k)))-  (label 26)-  (parent 22)-  (unrealized (5 0))-  (dead)-  (comment "empty cohort"))--(defskeleton subatomic-open-closed-  (vars (any old old1 mesg) (k skey) (n n-0 text) (d o d-0 o-0 name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (dist-ch start-ch dist-ch-0 chan)-    (lk ls locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand owner-open 2 (k k) (n n-0) (d d) (o o) (dist-ch dist-ch))-  (defstrand owner-power-dev 3 (k k) (d d) (o o) (start-ch start-ch)-    (dist-ch dist-ch))-  (defstrand dev-up 6 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand user-pass 2 (k k) (d d-0) (o o-0) (dist-ch dist-ch-0))-  (precedes ((1 3) (0 0)) ((2 1) (1 0)) ((3 0) (4 0)) ((3 2) (2 0))-    ((4 5) (3 1)) ((5 1) (0 2)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf dist-ch start-ch)-  (auth start-ch)-  (facts (same-dev ls lk) (no-state-split))-  (leads-to ((1 3) (0 1)) ((4 3) (0 0)) ((4 3) (1 2)))-  (rule fact-dev-pass-same-dev0 trRl_dev-open-at-1 trRl_dev-open-at-3-    trRl_dev-up-at-1 trRl_dev-up-at-2 trRl_dev-up-at-3 trRl_dev-up-at-4)-  (operation encryption-test (added-strand user-pass 2)-    (enc "may I pass" k) (0 2))-  (strand-map 0 1 2 3 4)-  (traces-    ((load lk (cat pt-3 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-0 "st" d any))-      (load lk (cat pt-3 "st-k" d o k)) (stor ls (cat pt "st" d o o)))-    ((recv dist-ch (enc "dist" d o k)) (send (enc "open" d o n-0 k)))-    ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k))-      (send dist-ch (enc "dist" d o k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-1 old))-      (load ls (cat pt-2 old1)) (stor lk (cat pt-3 "st-k" d o k))-      (stor ls (cat pt-4 "st" d o)) (send (enc "up" k)))-    ((recv dist-ch-0 (enc "dist" d-0 o-0 k))-      (send (enc "may I pass" k))))-  (label 27)-  (parent 24)-  (unrealized (5 0))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (any old old1 mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (dist-ch start-ch chan)-    (lk ls locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand owner-open 2 (k k) (n n-0) (d d) (o o) (dist-ch dist-ch))-  (defstrand owner-power-dev 3 (k k) (d d) (o o) (start-ch start-ch)-    (dist-ch dist-ch))-  (defstrand dev-up 6 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (deflistener k)-  (precedes ((1 3) (0 0)) ((2 1) (1 0)) ((3 0) (4 0)) ((3 0) (5 0))-    ((3 2) (2 0)) ((4 5) (3 1)) ((5 1) (0 2)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf dist-ch start-ch)-  (auth start-ch)-  (facts (same-dev ls lk) (no-state-split))-  (leads-to ((1 3) (0 1)) ((4 3) (0 0)) ((4 3) (1 2)))-  (rule fact-dev-pass-same-dev0 trRl_dev-open-at-1 trRl_dev-open-at-3-    trRl_dev-up-at-1 trRl_dev-up-at-2 trRl_dev-up-at-3 trRl_dev-up-at-4)-  (operation encryption-test (added-listener k) (enc "may I pass" k)-    (0 2))-  (strand-map 0 1 2 3 4)-  (traces-    ((load lk (cat pt-3 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-0 "st" d any))-      (load lk (cat pt-3 "st-k" d o k)) (stor ls (cat pt "st" d o o)))-    ((recv dist-ch (enc "dist" d o k)) (send (enc "open" d o n-0 k)))-    ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k))-      (send dist-ch (enc "dist" d o k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-1 old))-      (load ls (cat pt-2 old1)) (stor lk (cat pt-3 "st-k" d o k))-      (stor ls (cat pt-4 "st" d o)) (send (enc "up" k)))-    ((recv k) (send k)))-  (label 28)-  (parent 24)-  (seen 32)-  (seen-ops-    (32-      (operation nonce-test (added-strand dev-up 4) k (5 0)-        (ch-msg start-ch (cat "power-up" d o k)))-      (strand-map 0 1 2 3 4 5)))-  (unrealized (5 0))-  (comment "2 in cohort - 1 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (any old old1 mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (dist-ch dist-ch-0 start-ch chan)-    (lk ls locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand owner-open 2 (k k) (n n-0) (d d) (o o) (dist-ch dist-ch))-  (defstrand owner-power-dev 3 (k k) (d d) (o o) (start-ch start-ch)-    (dist-ch dist-ch-0))-  (defstrand dev-up 6 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (deflistener k)-  (precedes ((1 3) (0 0)) ((2 1) (1 0)) ((3 0) (4 0)) ((3 2) (2 0))-    ((4 4) (5 0)) ((4 5) (3 1)) ((5 1) (2 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf dist-ch-0 start-ch)-  (auth start-ch)-  (facts (same-dev ls lk) (no-state-split))-  (leads-to ((1 3) (0 1)) ((4 3) (0 0)) ((4 3) (1 2)))-  (rule eff-dev-up-3 fact-dev-pass-same-dev0 trRl_dev-open-at-1-    trRl_dev-open-at-3 trRl_dev-up-at-1 trRl_dev-up-at-2-    trRl_dev-up-at-3 trRl_dev-up-at-4)-  (operation nonce-test (displaced 6 4 dev-up 4) k (5 0)-    (ch-msg start-ch (cat "power-up" d o k)))-  (strand-map 0 1 2 3 4 5)-  (traces-    ((load lk (cat pt-3 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-0 "st" d any))-      (load lk (cat pt-3 "st-k" d o k)) (stor ls (cat pt "st" d o o)))-    ((recv dist-ch (enc "dist" d o k)) (send (enc "open" d o n-0 k)))-    ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k))-      (send dist-ch-0 (enc "dist" d o k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-1 old))-      (load ls (cat pt-2 old1)) (stor lk (cat pt-3 "st-k" d o k))-      (stor ls (cat pt-4 "st" d o)) (send (enc "up" k)))-    ((recv k) (send k)))-  (label 29)-  (parent 25)-  (unrealized (5 0))-  (dead)-  (comment "empty cohort"))--(defskeleton subatomic-open-closed-  (vars (any old old1 mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (dist-ch start-ch dist-ch-0 chan)-    (lk ls locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand owner-open 2 (k k) (n n-0) (d d) (o o) (dist-ch dist-ch))-  (defstrand owner-power-dev 3 (k k) (d d) (o o) (start-ch start-ch)-    (dist-ch dist-ch))-  (defstrand dev-up 6 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand user-pass 2 (k k) (d d) (o o) (dist-ch dist-ch-0))-  (precedes ((1 3) (0 0)) ((2 1) (1 0)) ((3 0) (4 0)) ((3 2) (2 0))-    ((3 2) (5 0)) ((4 5) (3 1)) ((5 1) (0 2)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf dist-ch start-ch)-  (auth start-ch)-  (facts (same-dev ls lk) (no-state-split))-  (leads-to ((1 3) (0 1)) ((4 3) (0 0)) ((4 3) (1 2)))-  (rule fact-dev-pass-same-dev0 trRl_dev-open-at-1 trRl_dev-open-at-3-    trRl_dev-up-at-1 trRl_dev-up-at-2 trRl_dev-up-at-3 trRl_dev-up-at-4)-  (operation encryption-test (displaced 6 3 owner-power-dev 3)-    (enc "dist" d-0 o-0 k) (5 0))-  (strand-map 0 1 2 3 4 5)-  (traces-    ((load lk (cat pt-3 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-0 "st" d any))-      (load lk (cat pt-3 "st-k" d o k)) (stor ls (cat pt "st" d o o)))-    ((recv dist-ch (enc "dist" d o k)) (send (enc "open" d o n-0 k)))-    ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k))-      (send dist-ch (enc "dist" d o k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-1 old))-      (load ls (cat pt-2 old1)) (stor lk (cat pt-3 "st-k" d o k))-      (stor ls (cat pt-4 "st" d o)) (send (enc "up" k)))-    ((recv dist-ch-0 (enc "dist" d o k)) (send (enc "may I pass" k))))-  (label 30)-  (parent 27)-  (unrealized (5 0))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (any old old1 mesg) (k skey) (n n-0 text) (d o d-0 o-0 name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (dist-ch start-ch dist-ch-0 chan)-    (lk ls locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand owner-open 2 (k k) (n n-0) (d d) (o o) (dist-ch dist-ch))-  (defstrand owner-power-dev 3 (k k) (d d) (o o) (start-ch start-ch)-    (dist-ch dist-ch))-  (defstrand dev-up 6 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand user-pass 2 (k k) (d d-0) (o o-0) (dist-ch dist-ch-0))-  (deflistener k)-  (precedes ((1 3) (0 0)) ((2 1) (1 0)) ((3 0) (4 0)) ((3 0) (6 0))-    ((3 2) (2 0)) ((4 5) (3 1)) ((5 1) (0 2)) ((6 1) (5 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf dist-ch start-ch)-  (auth start-ch)-  (facts (same-dev ls lk) (no-state-split))-  (leads-to ((1 3) (0 1)) ((4 3) (0 0)) ((4 3) (1 2)))-  (rule fact-dev-pass-same-dev0 trRl_dev-open-at-1 trRl_dev-open-at-3-    trRl_dev-up-at-1 trRl_dev-up-at-2 trRl_dev-up-at-3 trRl_dev-up-at-4)-  (operation encryption-test (added-listener k) (enc "dist" d-0 o-0 k)-    (5 0))-  (strand-map 0 1 2 3 4 5)-  (traces-    ((load lk (cat pt-3 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-0 "st" d any))-      (load lk (cat pt-3 "st-k" d o k)) (stor ls (cat pt "st" d o o)))-    ((recv dist-ch (enc "dist" d o k)) (send (enc "open" d o n-0 k)))-    ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k))-      (send dist-ch (enc "dist" d o k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-1 old))-      (load ls (cat pt-2 old1)) (stor lk (cat pt-3 "st-k" d o k))-      (stor ls (cat pt-4 "st" d o)) (send (enc "up" k)))-    ((recv dist-ch-0 (enc "dist" d-0 o-0 k))-      (send (enc "may I pass" k))) ((recv k) (send k)))-  (label 31)-  (parent 27)-  (seen 35)-  (seen-ops-    (35-      (operation nonce-test (added-strand dev-up 4) k (6 0)-        (ch-msg start-ch (cat "power-up" d o k)))-      (strand-map 0 1 2 3 4 5 6)))-  (unrealized (6 0))-  (comment "2 in cohort - 1 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (any old old1 mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (dist-ch start-ch chan)-    (lk ls locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand owner-open 2 (k k) (n n-0) (d d) (o o) (dist-ch dist-ch))-  (defstrand owner-power-dev 3 (k k) (d d) (o o) (start-ch start-ch)-    (dist-ch dist-ch))-  (defstrand dev-up 6 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (deflistener k)-  (precedes ((1 3) (0 0)) ((2 1) (1 0)) ((3 0) (4 0)) ((3 2) (2 0))-    ((4 4) (5 0)) ((4 5) (3 1)) ((5 1) (0 2)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf dist-ch start-ch)-  (auth start-ch)-  (facts (same-dev ls lk) (no-state-split))-  (leads-to ((1 3) (0 1)) ((4 3) (0 0)) ((4 3) (1 2)))-  (rule eff-dev-up-3 fact-dev-pass-same-dev0 trRl_dev-open-at-1-    trRl_dev-open-at-3 trRl_dev-up-at-1 trRl_dev-up-at-2-    trRl_dev-up-at-3 trRl_dev-up-at-4)-  (operation nonce-test (displaced 6 4 dev-up 4) k (5 0)-    (ch-msg start-ch (cat "power-up" d o k)))-  (strand-map 0 1 2 3 4 5)-  (traces-    ((load lk (cat pt-3 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-0 "st" d any))-      (load lk (cat pt-3 "st-k" d o k)) (stor ls (cat pt "st" d o o)))-    ((recv dist-ch (enc "dist" d o k)) (send (enc "open" d o n-0 k)))-    ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k))-      (send dist-ch (enc "dist" d o k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-1 old))-      (load ls (cat pt-2 old1)) (stor lk (cat pt-3 "st-k" d o k))-      (stor ls (cat pt-4 "st" d o)) (send (enc "up" k)))-    ((recv k) (send k)))-  (label 32)-  (parent 28)-  (unrealized (5 0))-  (dead)-  (comment "empty cohort"))--(defskeleton subatomic-open-closed-  (vars (any old old1 mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (dist-ch start-ch chan)-    (lk ls locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand owner-open 2 (k k) (n n-0) (d d) (o o) (dist-ch dist-ch))-  (defstrand owner-power-dev 3 (k k) (d d) (o o) (start-ch start-ch)-    (dist-ch dist-ch))-  (defstrand dev-up 6 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand user-pass 2 (k k) (d d) (o o) (dist-ch dist-ch))-  (precedes ((1 3) (0 0)) ((2 1) (1 0)) ((3 0) (4 0)) ((3 2) (2 0))-    ((3 2) (5 0)) ((4 5) (3 1)) ((5 1) (0 2)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf dist-ch start-ch)-  (auth start-ch)-  (facts (same-dev ls lk) (no-state-split))-  (leads-to ((1 3) (0 1)) ((4 3) (0 0)) ((4 3) (1 2)))-  (rule fact-dev-pass-same-dev0 trRl_dev-open-at-1 trRl_dev-open-at-3-    trRl_dev-up-at-1 trRl_dev-up-at-2 trRl_dev-up-at-3 trRl_dev-up-at-4)-  (operation encryption-test (contracted (dist-ch-0 dist-ch))-    (enc "dist" d o k) (5 0) (ch-msg dist-ch (enc "dist" d o k)))-  (strand-map 0 1 2 3 4 5)-  (traces-    ((load lk (cat pt-3 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-0 "st" d any))-      (load lk (cat pt-3 "st-k" d o k)) (stor ls (cat pt "st" d o o)))-    ((recv dist-ch (enc "dist" d o k)) (send (enc "open" d o n-0 k)))-    ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k))-      (send dist-ch (enc "dist" d o k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-1 old))-      (load ls (cat pt-2 old1)) (stor lk (cat pt-3 "st-k" d o k))-      (stor ls (cat pt-4 "st" d o)) (send (enc "up" k)))-    ((recv dist-ch (enc "dist" d o k)) (send (enc "may I pass" k))))-  (label 33)-  (parent 30)-  (realized)-  (shape)-  (maps-    ((3 0)-      ((k k) (d d) (o o) (start-ch start-ch) (n n) (d-0 d) (o-0 o)-        (lk lk) (ls ls))))-  (origs (pt-3 (4 3)) (pt-4 (4 4)) (pt (1 3)) (n (0 3)) (k (3 0))))--(defskeleton subatomic-open-closed-  (vars (any old old1 mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (dist-ch start-ch dist-ch-0 chan)-    (lk ls locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand owner-open 2 (k k) (n n-0) (d d) (o o) (dist-ch dist-ch))-  (defstrand owner-power-dev 3 (k k) (d d) (o o) (start-ch start-ch)-    (dist-ch dist-ch))-  (defstrand dev-up 6 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand user-pass 2 (k k) (d d) (o o) (dist-ch dist-ch-0))-  (deflistener k)-  (precedes ((1 3) (0 0)) ((2 1) (1 0)) ((3 0) (4 0)) ((3 0) (6 0))-    ((3 2) (2 0)) ((3 2) (5 0)) ((4 5) (3 1)) ((5 1) (0 2))-    ((6 1) (5 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf dist-ch start-ch)-  (auth start-ch)-  (facts (same-dev ls lk) (no-state-split))-  (leads-to ((1 3) (0 1)) ((4 3) (0 0)) ((4 3) (1 2)))-  (rule fact-dev-pass-same-dev0 trRl_dev-open-at-1 trRl_dev-open-at-3-    trRl_dev-up-at-1 trRl_dev-up-at-2 trRl_dev-up-at-3 trRl_dev-up-at-4)-  (operation encryption-test (added-listener k) (enc "dist" d o k) (5 0)-    (ch-msg dist-ch (enc "dist" d o k)))-  (strand-map 0 1 2 3 4 5)-  (traces-    ((load lk (cat pt-3 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-0 "st" d any))-      (load lk (cat pt-3 "st-k" d o k)) (stor ls (cat pt "st" d o o)))-    ((recv dist-ch (enc "dist" d o k)) (send (enc "open" d o n-0 k)))-    ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k))-      (send dist-ch (enc "dist" d o k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-1 old))-      (load ls (cat pt-2 old1)) (stor lk (cat pt-3 "st-k" d o k))-      (stor ls (cat pt-4 "st" d o)) (send (enc "up" k)))-    ((recv dist-ch-0 (enc "dist" d o k)) (send (enc "may I pass" k)))-    ((recv k) (send k)))-  (label 34)-  (parent 30)-  (seen 36)-  (seen-ops-    (36-      (operation nonce-test (added-strand dev-up 4) k (6 0)-        (ch-msg start-ch (cat "power-up" d o k)))-      (strand-map 0 1 2 3 4 5 6)))-  (unrealized (6 0))-  (comment "2 in cohort - 1 not yet seen"))--(defskeleton subatomic-open-closed-  (vars (any old old1 mesg) (k skey) (n n-0 text) (d o d-0 o-0 name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (dist-ch start-ch dist-ch-0 chan)-    (lk ls locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand owner-open 2 (k k) (n n-0) (d d) (o o) (dist-ch dist-ch))-  (defstrand owner-power-dev 3 (k k) (d d) (o o) (start-ch start-ch)-    (dist-ch dist-ch))-  (defstrand dev-up 6 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand user-pass 2 (k k) (d d-0) (o o-0) (dist-ch dist-ch-0))-  (deflistener k)-  (precedes ((1 3) (0 0)) ((2 1) (1 0)) ((3 0) (4 0)) ((3 2) (2 0))-    ((4 4) (6 0)) ((4 5) (3 1)) ((5 1) (0 2)) ((6 1) (5 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf dist-ch start-ch)-  (auth start-ch)-  (facts (same-dev ls lk) (no-state-split))-  (leads-to ((1 3) (0 1)) ((4 3) (0 0)) ((4 3) (1 2)))-  (rule eff-dev-up-3 fact-dev-pass-same-dev0 trRl_dev-open-at-1-    trRl_dev-open-at-3 trRl_dev-up-at-1 trRl_dev-up-at-2-    trRl_dev-up-at-3 trRl_dev-up-at-4)-  (operation nonce-test (displaced 7 4 dev-up 4) k (6 0)-    (ch-msg start-ch (cat "power-up" d o k)))-  (strand-map 0 1 2 3 4 5 6)-  (traces-    ((load lk (cat pt-3 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-0 "st" d any))-      (load lk (cat pt-3 "st-k" d o k)) (stor ls (cat pt "st" d o o)))-    ((recv dist-ch (enc "dist" d o k)) (send (enc "open" d o n-0 k)))-    ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k))-      (send dist-ch (enc "dist" d o k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-1 old))-      (load ls (cat pt-2 old1)) (stor lk (cat pt-3 "st-k" d o k))-      (stor ls (cat pt-4 "st" d o)) (send (enc "up" k)))-    ((recv dist-ch-0 (enc "dist" d-0 o-0 k))-      (send (enc "may I pass" k))) ((recv k) (send k)))-  (label 35)-  (parent 31)-  (unrealized (6 0))-  (dead)-  (comment "empty cohort"))--(defskeleton subatomic-open-closed-  (vars (any old old1 mesg) (k skey) (n n-0 text) (d o name)-    (pt pt-0 pt-1 pt-2 pt-3 pt-4 pval) (dist-ch start-ch dist-ch-0 chan)-    (lk ls locn))-  (defstrand dev-pass 4 (k k) (n n) (d d) (o o) (lk lk) (ls ls))-  (defstrand dev-open 4 (any any) (k k) (n n-0) (d d) (o o) (lk lk)-    (ls ls))-  (defstrand owner-open 2 (k k) (n n-0) (d d) (o o) (dist-ch dist-ch))-  (defstrand owner-power-dev 3 (k k) (d d) (o o) (start-ch start-ch)-    (dist-ch dist-ch))-  (defstrand dev-up 6 (old old) (old1 old1) (k k) (d d) (o o)-    (start-ch start-ch) (lk lk) (ls ls))-  (defstrand user-pass 2 (k k) (d d) (o o) (dist-ch dist-ch-0))-  (deflistener k)-  (precedes ((1 3) (0 0)) ((2 1) (1 0)) ((3 0) (4 0)) ((3 2) (2 0))-    ((3 2) (5 0)) ((4 4) (6 0)) ((4 5) (3 1)) ((5 1) (0 2))-    ((6 1) (5 0)))-  (uniq-orig k n)-  (gen-st (cat "st" d o o) (cat "st-k" d o k))-  (conf dist-ch start-ch)-  (auth start-ch)-  (facts (same-dev ls lk) (no-state-split))-  (leads-to ((1 3) (0 1)) ((4 3) (0 0)) ((4 3) (1 2)))-  (rule eff-dev-up-3 fact-dev-pass-same-dev0 trRl_dev-open-at-1-    trRl_dev-open-at-3 trRl_dev-up-at-1 trRl_dev-up-at-2-    trRl_dev-up-at-3 trRl_dev-up-at-4)-  (operation nonce-test (displaced 7 4 dev-up 4) k (6 0)-    (ch-msg start-ch (cat "power-up" d o k)))-  (strand-map 0 1 2 3 4 5 6)-  (traces-    ((load lk (cat pt-3 "st-k" d o k)) (load ls (cat pt "st" d o o))-      (recv (enc "may I pass" k)) (send (enc "you may pass" n k)))-    ((recv (enc "open" d o n-0 k)) (load ls (cat pt-0 "st" d any))-      (load lk (cat pt-3 "st-k" d o k)) (stor ls (cat pt "st" d o o)))-    ((recv dist-ch (enc "dist" d o k)) (send (enc "open" d o n-0 k)))-    ((send start-ch (cat "power-up" d o k)) (recv (enc "up" k))-      (send dist-ch (enc "dist" d o k)))-    ((recv start-ch (cat "power-up" d o k)) (load lk (cat pt-1 old))-      (load ls (cat pt-2 old1)) (stor lk (cat pt-3 "st-k" d o k))-      (stor ls (cat pt-4 "st" d o)) (send (enc "up" k)))-    ((recv dist-ch-0 (enc "dist" d o k)) (send (enc "may I pass" k)))-    ((recv k) (send k)))-  (label 36)-  (parent 34)-  (unrealized (6 0))-  (dead)-  (comment "empty cohort"))--(comment "Nothing left to do")
tst/subatomic-open-closed-test-genrule.tst view
@@ -1,6 +1,6 @@ (herald subatomic-open-closed-test-genrule (bound 40)) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment   "All input read from tst/subatomic-open-closed-test-genrule.scm") (comment "Strand count bounded at 40")
tst/subatomic-open-closed.tst view
@@ -1,6 +1,6 @@ (herald subatomic-open-closed (bound 40)) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/subatomic-open-closed.scm") (comment "Strand count bounded at 40")
tst/sync_locn_envelope.tst view
@@ -1,7 +1,7 @@ (herald "Envelope Protocol, location-based version" (check-nonces)   (bound 30) (limit 6000)) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/sync_locn_envelope.scm") (comment "Step count limited to 6000") (comment "Strand count bounded at 30")
tst/targetterms1.tst view
@@ -1,4 +1,4 @@-(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/targetterms1.scm")  (defprotocol targetterms basic
tst/targetterms2.tst view
@@ -1,4 +1,4 @@-(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/targetterms2.scm")  (defprotocol targetterms2 basic
tst/targetterms6.tst view
@@ -1,4 +1,4 @@-(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/targetterms6.scm")  (defprotocol targetterms6 basic
tst/targetterms8.tst view
@@ -1,4 +1,4 @@-(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/targetterms8.scm")  (defprotocol targetterms8 basic
tst/thisthat.tst view
@@ -1,6 +1,6 @@ (herald "Needham-Schroeder Public-Key Protocol This-That Variant") -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/thisthat.scm")  (defprotocol thisthat basic
tst/tickle-unique.tst view
@@ -1,6 +1,6 @@ (herald tickle-unique) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/tickle-unique.scm")  (defprotocol tickle basic
tst/timestamping.tst view
@@ -1,6 +1,6 @@ (herald timestamping-service) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/timestamping.scm")  (defprotocol timestamping-service basic
− tst/tmp-yahalom.tst 
@@ -1,362 +0,0 @@-(herald "Yahalom Protocol Without Forwarding" (bound 15))--(comment "CPSA 4.4.6")-(comment "All input read from tst/tmp-yahalom.scm")-(comment "Strand count bounded at 15")--(defprotocol yahalom basic-  (defrole init-    (vars (a b c name) (n-a n-b text) (k skey))-    (trace (send (cat a n-a)) (recv (enc b k n-a n-b (ltk a c)))-      (send (enc n-b k))))-  (defrole resp-    (vars (b a c name) (n-a n-b text) (k skey))-    (trace (recv (cat a n-a)) (send (cat b (enc a n-a n-b (ltk b c))))-      (recv (enc a k (ltk b c))) (recv (enc n-b k))))-  (defrole serv-    (vars (c a b name) (n-a n-b text) (k skey))-    (trace (recv (cat b (enc a n-a n-b (ltk b c))))-      (send (enc b k n-a n-b (ltk a c))) (send (enc a k (ltk b c))))-    (uniq-orig k))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false)))))--(defskeleton yahalom-  (vars (k skey) (n-a n-b text) (c a b name))-  (defstrand serv 3 (k k) (n-a n-a) (n-b n-b) (c c) (a a) (b b))-  (non-orig (ltk a c) (ltk b c))-  (uniq-orig k)-  (traces-    ((recv (cat b (enc a n-a n-b (ltk b c))))-      (send (enc b k n-a n-b (ltk a c))) (send (enc a k (ltk b c)))))-  (label 0)-  (unrealized (0 0))-  (origs (k (0 1)))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton yahalom-  (vars (k skey) (n-a n-b text) (c a b name))-  (defstrand serv 3 (k k) (n-a n-a) (n-b n-b) (c c) (a a) (b b))-  (defstrand resp 2 (n-a n-a) (n-b n-b) (b b) (a a) (c c))-  (precedes ((1 1) (0 0)))-  (non-orig (ltk a c) (ltk b c))-  (uniq-orig k)-  (operation encryption-test (added-strand resp 2)-    (enc a n-a n-b (ltk b c)) (0 0))-  (strand-map 0)-  (traces-    ((recv (cat b (enc a n-a n-b (ltk b c))))-      (send (enc b k n-a n-b (ltk a c))) (send (enc a k (ltk b c))))-    ((recv (cat a n-a)) (send (cat b (enc a n-a n-b (ltk b c))))))-  (label 1)-  (parent 0)-  (realized)-  (shape)-  (maps ((0) ((c c) (a a) (b b) (k k) (n-a n-a) (n-b n-b))))-  (origs (k (0 1))))--(comment "Nothing left to do")--(defprotocol yahalom basic-  (defrole init-    (vars (a b c name) (n-a n-b text) (k skey))-    (trace (send (cat a n-a)) (recv (enc b k n-a n-b (ltk a c)))-      (send (enc n-b k))))-  (defrole resp-    (vars (b a c name) (n-a n-b text) (k skey))-    (trace (recv (cat a n-a)) (send (cat b (enc a n-a n-b (ltk b c))))-      (recv (enc a k (ltk b c))) (recv (enc n-b k))))-  (defrole serv-    (vars (c a b name) (n-a n-b text) (k skey))-    (trace (recv (cat b (enc a n-a n-b (ltk b c))))-      (send (enc b k n-a n-b (ltk a c))) (send (enc a k (ltk b c))))-    (uniq-orig k))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false)))))--(defskeleton yahalom-  (vars (k skey) (n-a n-b text) (b a c name))-  (defstrand resp 4 (k k) (n-a n-a) (n-b n-b) (b b) (a a) (c c))-  (deflistener k)-  (non-orig (ltk b c) (ltk a c))-  (uniq-orig k)-  (traces-    ((recv (cat a n-a)) (send (cat b (enc a n-a n-b (ltk b c))))-      (recv (enc a k (ltk b c))) (recv (enc n-b k)))-    ((recv k) (send k)))-  (label 2)-  (unrealized (0 2))-  (origs)-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton yahalom-  (vars (k skey) (n-a n-b n-a-0 n-b-0 text) (b a c name))-  (defstrand resp 4 (k k) (n-a n-a) (n-b n-b) (b b) (a a) (c c))-  (deflistener k)-  (defstrand serv 3 (k k) (n-a n-a-0) (n-b n-b-0) (c c) (a a) (b b))-  (precedes ((2 1) (1 0)) ((2 2) (0 2)))-  (non-orig (ltk b c) (ltk a c))-  (uniq-orig k)-  (operation encryption-test (added-strand serv 3) (enc a k (ltk b c))-    (0 2))-  (strand-map 0 1)-  (traces-    ((recv (cat a n-a)) (send (cat b (enc a n-a n-b (ltk b c))))-      (recv (enc a k (ltk b c))) (recv (enc n-b k))) ((recv k) (send k))-    ((recv (cat b (enc a n-a-0 n-b-0 (ltk b c))))-      (send (enc b k n-a-0 n-b-0 (ltk a c)))-      (send (enc a k (ltk b c)))))-  (label 3)-  (parent 2)-  (unrealized (0 3) (1 0) (2 0))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton yahalom-  (vars (k skey) (n-a n-b text) (b a c name))-  (defstrand resp 4 (k k) (n-a n-a) (n-b n-b) (b b) (a a) (c c))-  (deflistener k)-  (defstrand serv 3 (k k) (n-a n-a) (n-b n-b) (c c) (a a) (b b))-  (precedes ((0 1) (2 0)) ((2 1) (1 0)) ((2 2) (0 2)))-  (non-orig (ltk b c) (ltk a c))-  (uniq-orig k)-  (operation encryption-test (displaced 3 0 resp 2)-    (enc a n-a-0 n-b-0 (ltk b c)) (2 0))-  (strand-map 0 1 2)-  (traces-    ((recv (cat a n-a)) (send (cat b (enc a n-a n-b (ltk b c))))-      (recv (enc a k (ltk b c))) (recv (enc n-b k))) ((recv k) (send k))-    ((recv (cat b (enc a n-a n-b (ltk b c))))-      (send (enc b k n-a n-b (ltk a c))) (send (enc a k (ltk b c)))))-  (label 4)-  (parent 3)-  (unrealized (0 3) (1 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton yahalom-  (vars (k skey) (n-a n-b n-a-0 n-b-0 text) (b a c name))-  (defstrand resp 4 (k k) (n-a n-a) (n-b n-b) (b b) (a a) (c c))-  (deflistener k)-  (defstrand serv 3 (k k) (n-a n-a-0) (n-b n-b-0) (c c) (a a) (b b))-  (defstrand resp 2 (n-a n-a-0) (n-b n-b-0) (b b) (a a) (c c))-  (precedes ((2 1) (1 0)) ((2 2) (0 2)) ((3 1) (2 0)))-  (non-orig (ltk b c) (ltk a c))-  (uniq-orig k)-  (operation encryption-test (added-strand resp 2)-    (enc a n-a-0 n-b-0 (ltk b c)) (2 0))-  (strand-map 0 1 2)-  (traces-    ((recv (cat a n-a)) (send (cat b (enc a n-a n-b (ltk b c))))-      (recv (enc a k (ltk b c))) (recv (enc n-b k))) ((recv k) (send k))-    ((recv (cat b (enc a n-a-0 n-b-0 (ltk b c))))-      (send (enc b k n-a-0 n-b-0 (ltk a c))) (send (enc a k (ltk b c))))-    ((recv (cat a n-a-0)) (send (cat b (enc a n-a-0 n-b-0 (ltk b c))))))-  (label 5)-  (parent 3)-  (unrealized (0 3) (1 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton yahalom-  (vars (k skey) (n-a n-b text) (b a c name))-  (defstrand resp 4 (k k) (n-a n-a) (n-b n-b) (b b) (a a) (c c))-  (deflistener k)-  (defstrand serv 3 (k k) (n-a n-a) (n-b n-b) (c c) (a a) (b b))-  (precedes ((0 1) (2 0)) ((2 2) (0 2)) ((2 2) (1 0)))-  (non-orig (ltk b c) (ltk a c))-  (uniq-orig k)-  (operation nonce-test (displaced 3 2 serv 3) k (1 0)-    (enc b k n-a n-b (ltk a c)))-  (strand-map 0 1 2)-  (traces-    ((recv (cat a n-a)) (send (cat b (enc a n-a n-b (ltk b c))))-      (recv (enc a k (ltk b c))) (recv (enc n-b k))) ((recv k) (send k))-    ((recv (cat b (enc a n-a n-b (ltk b c))))-      (send (enc b k n-a n-b (ltk a c))) (send (enc a k (ltk b c)))))-  (label 6)-  (parent 4)-  (unrealized (0 3) (1 0))-  (dead)-  (comment "empty cohort"))--(defskeleton yahalom-  (vars (k skey) (n-a n-b n-a-0 n-b-0 text) (b a c name))-  (defstrand resp 4 (k k) (n-a n-a) (n-b n-b) (b b) (a a) (c c))-  (deflistener k)-  (defstrand serv 3 (k k) (n-a n-a-0) (n-b n-b-0) (c c) (a a) (b b))-  (defstrand resp 2 (n-a n-a-0) (n-b n-b-0) (b b) (a a) (c c))-  (precedes ((2 2) (0 2)) ((2 2) (1 0)) ((3 1) (2 0)))-  (non-orig (ltk b c) (ltk a c))-  (uniq-orig k)-  (operation nonce-test (displaced 4 2 serv 3) k (1 0)-    (enc b k n-a-0 n-b-0 (ltk a c)))-  (strand-map 0 1 2 3)-  (traces-    ((recv (cat a n-a)) (send (cat b (enc a n-a n-b (ltk b c))))-      (recv (enc a k (ltk b c))) (recv (enc n-b k))) ((recv k) (send k))-    ((recv (cat b (enc a n-a-0 n-b-0 (ltk b c))))-      (send (enc b k n-a-0 n-b-0 (ltk a c))) (send (enc a k (ltk b c))))-    ((recv (cat a n-a-0)) (send (cat b (enc a n-a-0 n-b-0 (ltk b c))))))-  (label 7)-  (parent 5)-  (unrealized (0 3) (1 0))-  (dead)-  (comment "empty cohort"))--(comment "Nothing left to do")--(defprotocol yahalom basic-  (defrole init-    (vars (a b c name) (n-a n-b text) (k skey))-    (trace (send (cat a n-a)) (recv (enc b k n-a n-b (ltk a c)))-      (send (enc n-b k))))-  (defrole resp-    (vars (b a c name) (n-a n-b text) (k skey))-    (trace (recv (cat a n-a)) (send (cat b (enc a n-a n-b (ltk b c))))-      (recv (enc a k (ltk b c))) (recv (enc n-b k))))-  (defrole serv-    (vars (c a b name) (n-a n-b text) (k skey))-    (trace (recv (cat b (enc a n-a n-b (ltk b c))))-      (send (enc b k n-a n-b (ltk a c))) (send (enc a k (ltk b c))))-    (uniq-orig k))-  (defgenrule neqRl_indx-    (forall ((x indx)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_strd-    (forall ((x strd)) (implies (fact neq x x) (false))))-  (defgenrule neqRl_mesg-    (forall ((x mesg)) (implies (fact neq x x) (false)))))--(defskeleton yahalom-  (vars (k skey) (n-a n-b text) (b a c name))-  (defstrand resp 4 (k k) (n-a n-a) (n-b n-b) (b b) (a a) (c c))-  (deflistener k)-  (non-orig (ltk b c) (ltk a c))-  (uniq-orig k)-  (traces-    ((recv (cat a n-a)) (send (cat b (enc a n-a n-b (ltk b c))))-      (recv (enc a k (ltk b c))) (recv (enc n-b k)))-    ((recv k) (send k)))-  (label 8)-  (unrealized (0 2))-  (origs)-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton yahalom-  (vars (k skey) (n-a n-b n-a-0 n-b-0 text) (b a c name))-  (defstrand resp 4 (k k) (n-a n-a) (n-b n-b) (b b) (a a) (c c))-  (deflistener k)-  (defstrand serv 3 (k k) (n-a n-a-0) (n-b n-b-0) (c c) (a a) (b b))-  (precedes ((2 1) (1 0)) ((2 2) (0 2)))-  (non-orig (ltk b c) (ltk a c))-  (uniq-orig k)-  (operation encryption-test (added-strand serv 3) (enc a k (ltk b c))-    (0 2))-  (strand-map 0 1)-  (traces-    ((recv (cat a n-a)) (send (cat b (enc a n-a n-b (ltk b c))))-      (recv (enc a k (ltk b c))) (recv (enc n-b k))) ((recv k) (send k))-    ((recv (cat b (enc a n-a-0 n-b-0 (ltk b c))))-      (send (enc b k n-a-0 n-b-0 (ltk a c)))-      (send (enc a k (ltk b c)))))-  (label 9)-  (parent 8)-  (unrealized (0 3) (1 0) (2 0))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton yahalom-  (vars (k skey) (n-a n-b text) (b a c name))-  (defstrand resp 4 (k k) (n-a n-a) (n-b n-b) (b b) (a a) (c c))-  (deflistener k)-  (defstrand serv 3 (k k) (n-a n-a) (n-b n-b) (c c) (a a) (b b))-  (precedes ((0 1) (2 0)) ((2 1) (1 0)) ((2 2) (0 2)))-  (non-orig (ltk b c) (ltk a c))-  (uniq-orig k)-  (operation encryption-test (displaced 3 0 resp 2)-    (enc a n-a-0 n-b-0 (ltk b c)) (2 0))-  (strand-map 0 1 2)-  (traces-    ((recv (cat a n-a)) (send (cat b (enc a n-a n-b (ltk b c))))-      (recv (enc a k (ltk b c))) (recv (enc n-b k))) ((recv k) (send k))-    ((recv (cat b (enc a n-a n-b (ltk b c))))-      (send (enc b k n-a n-b (ltk a c))) (send (enc a k (ltk b c)))))-  (label 10)-  (parent 9)-  (unrealized (0 3) (1 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton yahalom-  (vars (k skey) (n-a n-b n-a-0 n-b-0 text) (b a c name))-  (defstrand resp 4 (k k) (n-a n-a) (n-b n-b) (b b) (a a) (c c))-  (deflistener k)-  (defstrand serv 3 (k k) (n-a n-a-0) (n-b n-b-0) (c c) (a a) (b b))-  (defstrand resp 2 (n-a n-a-0) (n-b n-b-0) (b b) (a a) (c c))-  (precedes ((2 1) (1 0)) ((2 2) (0 2)) ((3 1) (2 0)))-  (non-orig (ltk b c) (ltk a c))-  (uniq-orig k)-  (operation encryption-test (added-strand resp 2)-    (enc a n-a-0 n-b-0 (ltk b c)) (2 0))-  (strand-map 0 1 2)-  (traces-    ((recv (cat a n-a)) (send (cat b (enc a n-a n-b (ltk b c))))-      (recv (enc a k (ltk b c))) (recv (enc n-b k))) ((recv k) (send k))-    ((recv (cat b (enc a n-a-0 n-b-0 (ltk b c))))-      (send (enc b k n-a-0 n-b-0 (ltk a c))) (send (enc a k (ltk b c))))-    ((recv (cat a n-a-0)) (send (cat b (enc a n-a-0 n-b-0 (ltk b c))))))-  (label 11)-  (parent 9)-  (unrealized (0 3) (1 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton yahalom-  (vars (k skey) (n-a n-b text) (b a c name))-  (defstrand resp 4 (k k) (n-a n-a) (n-b n-b) (b b) (a a) (c c))-  (deflistener k)-  (defstrand serv 3 (k k) (n-a n-a) (n-b n-b) (c c) (a a) (b b))-  (precedes ((0 1) (2 0)) ((2 2) (0 2)) ((2 2) (1 0)))-  (non-orig (ltk b c) (ltk a c))-  (uniq-orig k)-  (operation nonce-test (displaced 3 2 serv 3) k (1 0)-    (enc b k n-a n-b (ltk a c)))-  (strand-map 0 1 2)-  (traces-    ((recv (cat a n-a)) (send (cat b (enc a n-a n-b (ltk b c))))-      (recv (enc a k (ltk b c))) (recv (enc n-b k))) ((recv k) (send k))-    ((recv (cat b (enc a n-a n-b (ltk b c))))-      (send (enc b k n-a n-b (ltk a c))) (send (enc a k (ltk b c)))))-  (label 12)-  (parent 10)-  (unrealized (0 3) (1 0))-  (dead)-  (comment "empty cohort"))--(defskeleton yahalom-  (vars (k skey) (n-a n-b n-a-0 n-b-0 text) (b a c name))-  (defstrand resp 4 (k k) (n-a n-a) (n-b n-b) (b b) (a a) (c c))-  (deflistener k)-  (defstrand serv 3 (k k) (n-a n-a-0) (n-b n-b-0) (c c) (a a) (b b))-  (defstrand resp 2 (n-a n-a-0) (n-b n-b-0) (b b) (a a) (c c))-  (precedes ((2 2) (0 2)) ((2 2) (1 0)) ((3 1) (2 0)))-  (non-orig (ltk b c) (ltk a c))-  (uniq-orig k)-  (operation nonce-test (displaced 4 2 serv 3) k (1 0)-    (enc b k n-a-0 n-b-0 (ltk a c)))-  (strand-map 0 1 2 3)-  (traces-    ((recv (cat a n-a)) (send (cat b (enc a n-a n-b (ltk b c))))-      (recv (enc a k (ltk b c))) (recv (enc n-b k))) ((recv k) (send k))-    ((recv (cat b (enc a n-a-0 n-b-0 (ltk b c))))-      (send (enc b k n-a-0 n-b-0 (ltk a c))) (send (enc a k (ltk b c))))-    ((recv (cat a n-a-0)) (send (cat b (enc a n-a-0 n-b-0 (ltk b c))))))-  (label 13)-  (parent 11)-  (unrealized (0 3) (1 0))-  (dead)-  (comment "empty cohort"))--(comment "Nothing left to do")
− tst/tnsl5.lisp 
@@ -1,168 +0,0 @@-(defprotocol tnsl5 basic-  (defrole init-    (vars (a b c d e name)-      (na0 na1 na2 na3 nb0 nb1 nb2 nb3 nc0 nc1 nc2 nc3 nd0 nd1 nd2 nd3-        ne0 ne1 ne2 ne3 text))-    (trace-      (send-        (enc na0 a c d e (enc "unitac" na1 a b d e (pubk c))-          (enc "unitad" na2 a b c e (pubk d))-          (enc "unitae" na3 a b c d (pubk e)) (pubk b)))-      (recv-        (enc na3 ne0 e b c d (enc "repba" na0 nb3 b c d e (pubk a))-          (enc "repca" na1 nc2 c b d e (pubk a))-          (enc "repda" na2 nd1 d e b c (pubk a))-          (enc "repcb" nb0 nc3 c d e a (pubk b))-          (enc "repdb" nb1 nd2 d c e a (pubk b))-          (enc "repeb" nb2 ne1 e a c d (pubk b))-          (enc "repdc" nc0 nd3 d e a b (pubk c))-          (enc "repec" nc1 ne2 e a b d (pubk c))-          (enc "reped" nd0 ne3 e a b c (pubk d)) (pubk a)))-      (send-        (enc nb3 (enc "repcb" nb0 nc3 c d e a (pubk b))-          (enc "repdb" nb1 nd2 d c e a (pubk b))-          (enc "repeb" nb2 ne1 e a c d (pubk b))-          (enc "repdc" nc0 nd3 d e a b (pubk c))-          (enc "repec" nc1 ne2 e a b d (pubk c))-          (enc "confac" nc2 (pubk c))-          (enc "reped" nd0 ne3 e a b c (pubk d))-          (enc "confad" nd1 (pubk d)) (enc "confae" ne0 (pubk e))-          (pubk b))))-    (uniq-orig na0 na1 na2 na3))-  (defrole resp1-    (vars (a b c d e name)-      (na0 na1 na2 na3 nb0 nb1 nb2 nb3 nc0 nc1 nc2 nc3 nd0 nd1 nd2 nd3-        ne0 ne1 ne2 ne3 text))-    (trace-      (recv-        (enc na0 a c d e (enc "unitac" na1 a b d e (pubk c))-          (enc "unitad" na2 a b c e (pubk d))-          (enc "unitae" na3 a b c d (pubk e)) (pubk b)))-      (send-        (enc nb0 b d e a (enc "unitac" na1 a b d e (pubk c))-          (enc "unitad" na2 a b c e (pubk d))-          (enc "unitbd" nb1 b c e a (pubk d))-          (enc "unitae" na3 a b c d (pubk e))-          (enc "unitbe" nb2 b c d a (pubk e))-          (enc "repba" na0 nb3 b c d e (pubk a)) (pubk c)))-      (recv-        (enc nb3 (enc "repcb" nb0 nc3 c d e a (pubk b))-          (enc "repdb" nb1 nd2 d c e a (pubk b))-          (enc "repeb" nb2 ne1 e a c d (pubk b))-          (enc "repdc" nc0 nd3 d e a b (pubk c))-          (enc "repec" nc1 ne2 e a b d (pubk c))-          (enc "confac" nc2 (pubk c))-          (enc "reped" nd0 ne3 e a b c (pubk d))-          (enc "confad" nd1 (pubk d)) (enc "confae" ne0 (pubk e))-          (pubk b)))-      (send-        (enc nc3 (enc "repdc" nc0 nd3 d e a b (pubk c))-          (enc "repec" nc1 ne2 e a b d (pubk c))-          (enc "confac" nc2 (pubk c))-          (enc "reped" nd0 ne3 e a b c (pubk d))-          (enc "confad" nd1 (pubk d)) (enc "confbd" nd2 (pubk d))-          (enc "confae" ne0 (pubk e)) (enc "confbe" ne1 (pubk e))-          (pubk c))))-    (uniq-orig nb0 nb1 nb2 nb3))-  (defrole resp2-    (vars (a b c d e name)-      (na0 na1 na2 na3 nb0 nb1 nb2 nb3 nc0 nc1 nc2 nc3 nd0 nd1 nd2 nd3-        ne0 ne1 ne2 ne3 text))-    (trace-      (recv-        (enc nb0 b d e a (enc "unitac" na1 a b d e (pubk c))-          (enc "unitad" na2 a b c e (pubk d))-          (enc "unitbd" nb1 b c e a (pubk d))-          (enc "unitae" na3 a b c d (pubk e))-          (enc "unitbe" nb2 b c d a (pubk e))-          (enc "repba" na0 nb3 b c d e (pubk a)) (pubk c)))-      (send-        (enc nc0 c e a b (enc "unitad" na2 a b c e (pubk d))-          (enc "unitbd" nb1 b c e a (pubk d))-          (enc "unitae" na3 a b c d (pubk e))-          (enc "unitbe" nb2 b c d a (pubk e))-          (enc "unitce" nc1 c d a b (pubk e))-          (enc "repba" na0 nb3 b c d e (pubk a))-          (enc "repca" na1 nc2 c b d e (pubk a))-          (enc "repcb" nb0 nc3 c d e a (pubk b)) (pubk d)))-      (recv-        (enc nc3 (enc "repdc" nc0 nd3 d e a b (pubk c))-          (enc "repec" nc1 ne2 e a b d (pubk c))-          (enc "confac" nc2 (pubk c))-          (enc "reped" nd0 ne3 e a b c (pubk d))-          (enc "confad" nd1 (pubk d)) (enc "confbd" nd2 (pubk d))-          (enc "confae" ne0 (pubk e)) (enc "confbe" ne1 (pubk e))-          (pubk c)))-      (send-        (enc nd3 (enc "reped" nd0 ne3 e a b c (pubk d))-          (enc "confad" nd1 (pubk d)) (enc "confbd" nd2 (pubk d))-          (enc "confae" ne0 (pubk e)) (enc "confbe" ne1 (pubk e))-          (enc "confce" ne2 (pubk e)) (pubk d))))-    (uniq-orig nc0 nc1 nc2 nc3))-  (defrole resp3-    (vars (a b c d e name)-      (na0 na1 na2 na3 nb0 nb1 nb2 nb3 nc0 nc1 nc2 nc3 nd0 nd1 nd2 nd3-        ne0 ne1 ne2 ne3 text))-    (trace-      (recv-        (enc nc0 c e a b (enc "unitad" na2 a b c e (pubk d))-          (enc "unitbd" nb1 b c e a (pubk d))-          (enc "unitae" na3 a b c d (pubk e))-          (enc "unitbe" nb2 b c d a (pubk e))-          (enc "unitce" nc1 c d a b (pubk e))-          (enc "repba" na0 nb3 b c d e (pubk a))-          (enc "repca" na1 nc2 c b d e (pubk a))-          (enc "repcb" nb0 nc3 c d e a (pubk b)) (pubk d)))-      (send-        (enc nd0 d a b c (enc "unitae" na3 a b c d (pubk e))-          (enc "unitbe" nb2 b c d a (pubk e))-          (enc "unitce" nc1 c d a b (pubk e))-          (enc "repba" na0 nb3 b c d e (pubk a))-          (enc "repca" na1 nc2 c b d e (pubk a))-          (enc "repda" na2 nd1 d e b c (pubk a))-          (enc "repcb" nb0 nc3 c d e a (pubk b))-          (enc "repdb" nb1 nd2 d c e a (pubk b))-          (enc "repde" nc0 nd3 d e a b (pubk c)) (pubk e)))-      (recv-        (enc nd3 (enc "reped" nd0 ne3 e a b c (pubk d))-          (enc "confad" nd1 (pubk d)) (enc "confbd" nd2 (pubk d))-          (enc "confae" ne0 (pubk e)) (enc "confbe" ne1 (pubk e))-          (enc "confce" ne2 (pubk e)) (pubk d)))-      (send-        (enc ne3 (enc "confae" ne0 (pubk e)) (enc "confbe" ne1 (pubk e))-          (enc "confce" ne2 (pubk e)) (pubk e))))-    (uniq-orig nd0 nd1 nd2 nd3))-  (defrole resp4-    (vars (a b c d e name)-      (na0 na1 na2 na3 nb0 nb1 nb2 nb3 nc0 nc1 nc2 nc3 nd0 nd1 nd2 nd3-        ne0 ne1 ne2 ne3 text))-    (trace-      (recv-        (enc nd0 d a b c (enc "unitae" na3 a b c d (pubk e))-          (enc "unitbe" nb2 b c d a (pubk e))-          (enc "unitce" nc1 c d a b (pubk e))-          (enc "repba" na0 nb3 b c d e (pubk a))-          (enc "repca" na1 nc2 c b d e (pubk a))-          (enc "repda" na2 nd1 d e b c (pubk a))-          (enc "repcb" nb0 nc3 c d e a (pubk b))-          (enc "repdb" nb1 nd2 d c e a (pubk b))-          (enc "repde" nc0 nd3 d e a b (pubk c)) (pubk e)))-      (send-        (enc na3 ne0 e b c d (enc "repba" na0 nb3 b c d e (pubk a))-          (enc "repca" na1 nc2 c b d e (pubk a))-          (enc "repda" na2 nd1 d e b c (pubk a))-          (enc "repcb" nb0 nc3 c d e a (pubk b))-          (enc "repdb" nb1 nd2 d c e a (pubk b))-          (enc "repeb" nb2 ne1 e a c d (pubk b))-          (enc "repdc" nc0 nd3 d e a b (pubk c))-          (enc "repec" nc1 ne2 e a b d (pubk c))-          (enc "reped" nd0 ne3 e a b c (pubk d)) (pubk a)))-      (recv-        (enc ne3 (enc "confae" ne0 (pubk e)) (enc "confbe" ne1 (pubk e))-          (enc "confce" ne2 (pubk e)) (pubk e))))-    (uniq-orig ne0 ne1 ne2 ne3)))--(defskeleton tnsl5-  (vars (a b c d e name))-  (defstrand init 3 (a a) (b b) (c c) (d d) (e e))-  (non-orig (privk a) (privk b) (privk c) (privk d) (privk e)))
tst/trust-anchor.tst view
@@ -1,7 +1,7 @@ (herald trust-anchor   (comment "Tests rule application on initial skeleton")) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/trust-anchor.scm")  (defprotocol trust-anchor basic
tst/ugen-at.tst view
@@ -1,6 +1,6 @@ (herald uniq-at) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/ugen-at.scm")  (defprotocol yahalom-plus-uniq-at basic
tst/ugo.tst view
@@ -1,7 +1,7 @@ (herald uniq-gen-and-orig-example   (comment "Non-executable role examples")) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/ugo.scm")  (defprotocol uniq-gen-example basic
tst/uncarried_keys.tst view
@@ -1,4 +1,4 @@-(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/uncarried_keys.scm")  (defprotocol uncarried-keys basic
tst/unilateral.tst view
@@ -1,6 +1,6 @@ (herald unilateral) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/unilateral.scm")  (defprotocol unilateral basic
tst/uniq-at.tst view
@@ -1,6 +1,6 @@ (herald uniq-at) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/uniq-at.scm")  (defprotocol yahalom-plus-uniq-at basic
tst/uniq-gen-test.tst view
@@ -1,7 +1,7 @@ (herald "Unique generation test protocols."   (comment "Skeletons 2, 4, and 7 should have no shapes.")) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/uniq-gen-test.scm")  (defprotocol uniqgentest basic
tst/uo.tst view
@@ -1,4 +1,4 @@-(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/uo.scm")  (defprotocol uniq-orig basic
tst/wang-hash.tst view
@@ -1,6 +1,6 @@ (herald "Wang's Fair Exchange Protocol" (bound 10)) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/wang-hash.scm") (comment "Strand count bounded at 10")
tst/wang-key-hash.tst view
@@ -1,6 +1,6 @@ (herald "Wang's Fair Exchange Protocol" (bound 10)) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/wang-key-hash.scm") (comment "Strand count bounded at 10")
− tst/wang.lisp 
@@ -1,434 +0,0 @@-(herald "Wang's Fair Exchange Protocol" (bound 10))--;; CPSA input file to represent-;; Wang's Fair Exchange Protocol--;; This macro implements the CPSA-;; convention of regarding a hash as-;; an asymmetric encryption.  The-;; decryption key inverse to (pubk-;; hash) is assumed non-originating-;; in roles using hashing.--(defmacro (hash x)-  (enc x (pubk hash_id)))--;; Wang's encrypted format for the-;; message payload.  Observe that m,-;; k get their values from the-;; like-named messages in the context-;; where the macro is expanded.--(defmacro (em)-  (enc m k))--;; The session label L as a fn of-;; the values that *should be* the-;; hashes of the encrypted message EM-;; and the session key K.--(defmacro (l-prime y x)-  (cat a b t y x))--;; The recipient can check that a-;; session label has an l-prime where-;; y is the hash of another parameter.-;; Hence recipient roles use l-star.--(defmacro (l-star e1 x)-  (l-prime (hash e1) x))--;; The Evidence of Origin is checked-;; to be this fn of other parameters-;; available to the recipient.--(defmacro (eoo-star x e1 e2)-  (enc (cat "eootag"-	    (hash (l-star e1 x)) e2)-       (privk "sign" a)))--;; The Evidence of Receipt is computed-;; as this fn of other parameters-;; available to the recipient.--(defmacro (eor-star x e1 e2)-  (enc (cat "eortag"-	    (hash (l-star e1 x)) e2)-       (privk "sign" b)))--;; The Recovery Request as computed by-;; the recipient.--(defmacro (rr-star x e1 e2)-  (cat (l-star e1 x) e2-       (eoo-star x e1 e2)-       (eor-star x e1 e2)-       (enc (cat "rcrq" (l-star e1 x) e2)-            (privk "sign" b))))--;; The Abort Token is checked-;; to be this fn of other parameters-;; available to the recipient.--(defmacro (at-star e1 x)-  (enc (enc "abrq" (l-star e1 x)-            (privk "sign" a))-       (privk "sign" t)))--;; How the initiator computes the-;; encrypted key package:--(defmacro (ek l)-  (enc (cat "keytag" (hash l) k r)-       (pubk "encr" t)))--;; The Initiator's computed-;; version of L.--(defmacro (l)-  (l-prime (hash (enc m k)) (hash k)))--;; The TTP can check that the session-;; label L is this fn of other-;; parameters available to the TTP.--(defmacro (l-prime-prime y)-  (cat a b t y (hash k)))--;; The TTP can check that the EOO-;; is this fn of other parameters-;; available to the TTP.--(defmacro (eoo-prime-prime y)-  (enc (cat "eootag"-            (hash (l-prime-prime y))-	    (ek (l-prime-prime y)))-       (privk "sign" a)))--;; The TTP can check that the EOR-;; is this fn of other parameters-;; available to the TTP.--(defmacro (eor-prime-prime y)-  (enc (cat "eortag"-	    (hash (l-prime-prime y))-	    (ek (l-prime-prime y)))-       (privk "sign" b)))--;; The TTP can check that the RR-;; is this fn of other parameters-;; available to the TTP.--(defmacro (rr-prime-prime y)-  (cat (l-prime-prime y)-       (ek (l-prime-prime y))-       (eoo-prime-prime y)-       (eor-prime-prime y)-       (enc "rcrq" (l-prime-prime y)-	    (ek (l-prime-prime y))-            (privk "sign" b))))--;; The TTP can check that the Confirmation-;; Request is this fn of other parameters-;; available to the TTP.--(defmacro (cf-prime-prime y)-  (cat (l-prime-prime y) (ek (l-prime-prime y))-       (eoo-prime-prime y) (eor-prime-prime y)-       (enc "cfrq" (l-prime-prime y)-	    (ek (l-prime-prime y))-            (privk "sign" b))))--;; Defn of Wang's Fair Exchange Protocol.-;; Closely follows the presentation in the-;; figures in Section 3.  In the TTP roles,-;; we have put a dummy send or receive in place-;; of the state synchronization event to keep-;; the indices matching the spec.--(defprotocol wang basic--  ;; Successful initiator run with no TTP involvement--  (defrole init1-    (vars (a b t hash_id name) (m data) (r text) (k skey))-    (trace-     (send (cat (l) (enc m k) (ek (l))-                (eoo-star (hash k) (enc m k) (ek (l)))))-     (recv (eor-star (hash k) (enc m k) (ek (l))))-     (send (cat k r)))-    (non-orig (privk hash_id)))--  ;; Aborted initiator run--  (defrole init2-    (vars (a b t hash_id name) (m data) (r text) (k skey))-    (trace-     (send (cat (l) (enc m k) (ek (l))-                (eoo-star (hash k) (enc m k) (ek (l)))))-     (send (enc "abrq" (l) (privk "sign" a)))-     (recv (enc "abcf"-                (enc "abrq" (l) (privk "sign" a))-                (privk "sign" t))))-    (non-orig (privk hash_id)))--  ;; Initiator run with abort request and forced recovery--  (defrole init3-    (vars (a b t hash_id name) (m data) (r text) (k skey))-    (trace-     (send (cat (l) (enc m k) (ek (l))-                (eoo-star (hash k) (enc m k) (ek (l)))))-     (send (enc "abrq" (l) (privk "sign" a)))-     (recv (eor-star (hash k) (enc m k) (ek (l)))))-    (non-orig (privk hash_id)))--  ;; Aborted initiator run, but with EOR received--  (defrole init4-    (vars (a b t hash_id name) (m data) (r text) (k skey))-    (trace-     (send (cat (l) (enc m k) (ek (l))-                (eoo-star (hash k) (enc m k) (ek (l)))))-     (recv (eor-star (hash k) (enc m k) (ek (l))))-     (send (enc "abrq" (l) (privk "sign" a)))-     (recv (enc "abcf"-                (enc "abrq" (l) (privk "sign" a))-                (privk "sign" t))))-    (non-orig (privk hash_id)))--  ;; Initiator run with abort requested after EOR received,-  ;; but recovery forced--  (defrole init5-    (vars (a b t hash_id name) (m data) (r text) (k skey))-    (trace-     (send (cat (l) (enc m k) (ek (l))-                (eoo-star (hash k) (enc m k) (ek (l)))))-     (recv (eor-star (hash k) (enc m k) (ek (l))))-     (send (enc "abrq" (l) (privk "sign" a)))-     (recv (eor-star (hash k) (enc m k) (ek (l)))))-    (non-orig (privk hash_id)))--  ;; Successful responder run with no TTP involvement--  (defrole resp1-    (vars (a b t hash_id name) (m data) (r text) (k skey))-    (trace-     (recv (cat (l) (enc m k) (ek (l))-                (eoo-star (hash k) (enc m k) (ek (l)))))-     (send (eor-star (hash k) (enc m k) (ek (l))))-     (recv (cat k r)))-    (non-orig (privk hash_id)))--  ;;Responder run with recovery via TTP--  (defrole resp2-    (vars (a b t hash_id name) (m data) (r text) (k skey))-    (trace-     (recv (cat (l) (enc m k) (ek (l))-                (eoo-star (hash k) (enc m k) (ek (l)))))-     (send (cat (l) (ek (l)) (eoo-star (hash k) (enc m k) (ek (l)))-                (eor-star (hash k) (enc m k) (ek (l)))))-     (send (cat (l) (ek (l)) (eoo-star (hash k) (enc m k) (ek (l)))-                (eor-star (hash k) (enc m k) (ek (l)))-                (enc "rcrq" (l) (ek (l)) (privk "sign" b))))-     (recv (cat k r)))-    (non-orig (privk hash_id)))--  ;; Responder run with recovery request and forced abort--  (defrole resp3-    (vars (a b t hash_id name) (e1 e2 x mesg))-    (trace-     (recv (cat (l-star e1 x) e1 e2 (eoo-star x e1 e2)))-     (send (cat (l-star e1 x) e2 (eoo-star x e1 e2) (eor-star x e1 e2)))-     (send (cat (l-star e1 x) e2 (eoo-star x e1 e2) (eor-star x e1 e2)-                (enc "rcrq" (l-star e1 x) e2 (privk "sign" b))))-     (recv (enc "abcf"-                (enc "abrq" (l-star e1 x) (privk "sign" a))-                (privk "sign" t))))-    (non-orig (privk hash_id)))--  ;; TTP handles an abort--  (defrole ttp-ab1-    (vars (a b t hash_id name) (y x mesg))-    (trace-     (recv (enc "abrq" (l-prime y x) (privk "sign" a)))-     (send (cat "sync-abrq"-                (enc "abrq" (l-prime y x) (privk "sign" a))))-     (send (enc "abcf"-                (enc "abrq" (l-prime y x) (privk "sign" a))-                (privk "sign" t))))-    (non-orig (privk hash_id)))--  ;; TTP forces recovery in response to an abort request--  (defrole ttp-ab2-    (vars (a b t hash_id name) (y x e mesg))-    (trace-     (recv (enc "abrq" (l-prime y x) (privk "sign" a)))-     (recv (cat "sync-abrq"-                (enc "eortag" (hash (l-prime y x)) e-                     (privk "sign" b))))-     (send (enc "eortag" (hash (l-prime y x)) e-                (privk "sign" b))))-    (non-orig (privk hash_id)))--  ;; TTP handles a recovery--  (defrole ttp-rc1-    (vars (a b t hash_id name) (r text) (k skey) (y mesg))-    (trace-     (recv (rr-prime-prime y))-     (send (cat "sync-rc-req"-                (rr-prime-prime y)))-     (send (cat k r)))-    (non-orig (privk hash_id)))--  ;; TTP forces abort in response to a recovery request--  (defrole ttp-rc2-    (vars (a b t hash_id name) (r text) (k skey) (y mesg))-    (trace-     (recv (rr-prime-prime y))-     (recv (cat "sync-rc-req"-		(enc "abrq" (l-prime-prime y) (privk "sign" a))))-     (send (enc "abcf"-                (enc "abrq" (l-prime-prime y) (privk "sign" a))-                (privk "sign" t))))-    (non-orig (privk hash_id)))--  ;; TTP handles a confirm request--  (defrole ttp-cf1-    (vars (a b t hash_id name) (r text) (k skey) (y mesg))-    (trace-     (recv (cf-prime-prime y))-     (send (cat "sync-cf-req"-                (cf-prime-prime y)))-     (send (enc (cf-prime-prime y) (privk "sign" t))))-    (non-orig (privk hash_id)))--  ;; TTP replies with abort token given confirm request--  (defrole ttp-cf2-    (vars (a b t hash_id name) (r text) (k skey) (y mesg))-    (trace-     (recv (cf-prime-prime y))-     (recv (cat "sync-cf-req"-                (enc "abrq"(l-prime-prime y) (privk "sign" a))))-     (send (enc "abcf"-                (enc "abrq"(l-prime-prime y) (privk "sign" a))-                (privk "sign" t))))-    (non-orig (privk hash_id))))--;; End of Wang's protocol defn.--;; Two experiments to prove Lemma 4.1--(defskeleton wang-  (vars (a b t hash_id name) (m data) (r text) (k skey))-  (defstrand init1 1 (b b) (t t) (m m) (r r) (k k))-  (deflistener m)-  (non-orig-   (privk "encr" t))-  (uniq-orig m k)-  (comment "Experiment 1 to prove Lemma 4.1."))--(defskeleton wang-  (vars (a b t hash_id name) (m data) (r text) (k skey))-  (defstrand init1 1 (b b) (t t) (m m) (r r) (k k))-  (deflistener k)-  (non-orig-   (privk "encr" t))-  (uniq-orig m k)-  (comment "Experiment 2 to prove Lemma 4.1."))--;; We now have three experiments-;; to prove Lemma 4.2, clause 1.--(defskeleton wang-  (vars (a b t hash_id name) (m data) (r text) (k skey))-  (defstrand init1 3 (b b) (t t) (m m) (r r) (k k))-  (non-orig-   (privk "sign" b))-  (comment "First of three experiments to prove Lemma 4.2, clause 1."))--(defskeleton wang-  (vars (a b t hash_id name) (m data) (r text) (k skey))-  (defstrand init3 3 (b b) (t t) (m m) (r r) (k k))-  (non-orig-   (privk "sign" b))-  (comment "Second of three experiments to prove Lemma 4.2, clause 1."))--(defskeleton wang-  (vars (a b t hash_id name) (m data) (r text) (k skey))-  (defstrand init5 4 (b b) (t t) (m m) (r r) (k k))-  (non-orig-   (privk "sign" b))-  (comment "Third of three experiments to prove Lemma 4.2, clause 1."))--;; Two experiments to prove 4.2, Clause 2.--(defskeleton wang-  (vars (a b t hash_id name) (m data) (r text) (k skey))-  (defstrand resp1 3 (a a) (t t) (m m) (r r) (k k))-  (non-orig-   (privk "sign" a))-  (comment-   "First of two experiments to prove Lemma 4.2, clause 2."))--(defskeleton wang-  (vars (a b t hash_id name) (m data) (r text) (k skey))-  (defstrand resp2 4 (a a) (t t) (m m) (r r) (k k))-  (non-orig-   (privk "sign" a))-  (comment-   "Second of two experiments to prove Lemma 4.2, clause 2."))--;; Experiment to prove Lemma 4.2, clause 3.--(defskeleton wang-  (vars (a b t hash_id name) (e1 e2 x mesg))-  (defstrand resp3 4 (a a) (t t))-  (non-orig-   (privk "sign" a))-  (comment-   "Experiments to prove Lemma 4.2, clause 3."))--;; One experiment to prove Lemma 4.3, Clause 1.--(defskeleton wang-  (vars (a b t hash_id name) (y x mesg))-  (deflistener-    (enc "abcf" (enc "abrq" (l-prime y x) (privk "sign" a))-	 (privk "sign" t)))-  (non-orig-   (privk "sign" t))-  (comment-   "Experiments to prove Lemma 4.3, clause 1."))--;; Three experiments to prove Lemma 4.3, Clause 2.--(defskeleton wang-  (vars (y x mesg) (a b t name))-  (defstrand ttp-ab1 3 (y y) (x x) (a a) (b b) (t t))-  (non-orig (privk "sign" a)  (privk "encr" t))-  (comment-   "Experiment 1 to prove Lemma 4.3, clause 2."))--(defskeleton wang-  (vars (a b t hash_id name) (r text) (k skey) (y mesg))-  (defstrand ttp-rc2 3 (a a) (b b) (t t))-  (non-orig (privk "sign" a)  (privk "encr" t))-  (comment-   "Experiment 2 to prove Lemma 4.3, clause 2."))--(defskeleton wang-  (vars (a b t hash_id name) (r text) (k skey) (y mesg))-  (defstrand ttp-cf2 3 (a a) (b b) (t t))-  (non-orig (privk "sign" a)  (privk "encr" t))-  (comment-   "Experiment 3 to prove Lemma 4.3, clause 2."))
tst/weird.tst view
@@ -1,4 +1,4 @@-(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/weird.scm")  (defprotocol weird basic
tst/wide-mouth-frog-scyther.tst view
@@ -1,7 +1,7 @@ (herald "Wide-Mouth Frog Protocol from Scyther" (bound 8)   (comment "This protocol has an infinite number of shapes")) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/wide-mouth-frog-scyther.lsp") (comment "Strand count bounded at 8")
tst/wide-mouth-frog.tst view
@@ -1,7 +1,7 @@ (herald "Wide-Mouth Frog Protocol"   (comment "This protocol has an infinite number of shapes") (bound 8)) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/wide-mouth-frog.lsp") (comment "Strand count bounded at 8")
tst/wonthull.tst view
@@ -1,6 +1,6 @@ (herald wonthull (bound 9)) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/wonthull.scm") (comment "Strand count bounded at 9")
tst/wonthull2.tst view
@@ -1,6 +1,6 @@ (herald wonthull2 (bound 9)) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/wonthull2.scm") (comment "Strand count bounded at 9")
tst/wonthull3.tst view
@@ -1,4 +1,4 @@-(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/wonthull3.scm")  (defprotocol wonthull3 basic
tst/woolam.tst view
@@ -1,6 +1,6 @@ (herald "Woo-Lam Protocol") -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/woolam.scm")  (defprotocol woolam basic
tst/yahalom-6.3.6.tst view
@@ -5,7 +5,7 @@   (url "http://www.eecs.umich.edu/acal/swerve/docs/49-1.pdf")   (bound 15)) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/yahalom-6.3.6.scm") (comment "Strand count bounded at 15")
tst/yahalom-forward.tst view
@@ -1,6 +1,6 @@ (herald "Yahalom Protocol With Forwarding" (bound 15)) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/yahalom-forward.scm") (comment "Strand count bounded at 15")
tst/yahalom.tst view
@@ -1,6 +1,6 @@ (herald "Yahalom Protocol Without Forwarding" (bound 15)) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/yahalom.scm") (comment "Strand count bounded at 15")
tst/yes-or-no.tst view
@@ -1,6 +1,6 @@ (herald yes-or-no) -(comment "CPSA 4.4.7")+(comment "CPSA 4.4.8") (comment "All input read from tst/yes-or-no.scm")  (defprotocol yes-or-no basic