Certificate-Carrying Transformation of Event-Driven Block Programs

2026-07-01

AI Summary

This work addresses the challenge of semantic errors introduced by optimizations in event-driven block-based programming languages such as Scratch. The authors propose a behavior-preserving, verifiable optimization framework that transforms optimizations into source-to-source rewrites accompanied by formal certificates. By leveraging parameterized observational lenses and a cooperative frame refinement theorem—both formally verified in Lean—the framework supports diverse rewrite rules within a small trusted computing base. Evaluation on 300 real-world Scratch projects demonstrates that 94.3% of valid rewrites are correctly accepted, with certification times under 0.1 seconds per project. Crucially, adversarial testing reveals no false acceptances, and ablation studies confirm that the proposed semantic conditions are essential to the framework’s correctness.

Abstract

Block-based end-user languages such as Scratch run tens of millions of programs. Existing tools establish behavior preservation through program analysis and testing without a checked guarantee. We turn optimization into certificate-carrying source-to-source rewriting. An untrusted optimizer proposes a rewrite; a trusted, fail-closed checker accepts it only after recomputing every side condition that the rewrite's behavior preservation depends on under an explicit observation lens. The checker is the sole authority: given a correct checker and a small, explicitly stated set of model-to-VM assumptions, an optimizer bug cannot mint an unsound acceptance. The observation lens is a parameter, and the central soundness argument is a cooperative-frame refinement theorem: a write overwritten before any thread observes it, within a window in which no thread yields, can be removed. We mechanize this theorem in Lean and show that one parametric statement covers two concrete rewrite families instantiated to variable state and renderer state. We build a checker for six rewrite families and evaluate it on 300 real Scratch projects. The checker accepts a behavior-preserving rewrite on 94.3% of projects (283 of 300); certification costs under one tenth of a second per project; and a cross-family adversarial campaign of 4,278 perturbed rewrites produces zero false accepts. An audit found eight false accepts the per-family test suites missed; each is now rejected. An ablation that strips the semantic side conditions, leaving analysis and testing alone, ships rewrites the virtual machine confirms change behavior; the full checker rejects every one. The result shows how to provide behavior-preservation guarantees for a concurrent, event-driven, end-user language. The checker recomputes every required condition instead of trusting optimizer claims, keeping the trusted base small.

Problem

• behavior preservation
• certificate-carrying code
• event-driven programming
• block-based languages
• program rewriting

Innovation

• certificate-carrying code
• behavior preservation
• event-driven concurrency
• formal verification
• source-to-source rewriting