creusot

Formally verify Rust code with Creusot and Pearlite specifications.

Updated Jan 25, 2026

Search Tags:#rust #contracts #formal-verification #creusot #pearlite #loop-invariants #why3

Ready to run

npx skills add https://github.com/patrykgz/rust-devagent-loop-template --skill creusot

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: creusot
Source: https://github.com/patrykgz/rust-devagent-loop-template/tree/main/.claude/skills/creusot-skill
Command: npx skills add https://github.com/patrykgz/rust-devagent-loop-template --skill creusot

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Creusot provides formal verification for Rust by enabling contracts, invariants, and Pearlite specifications so that quality-critical code can be proven correct rather than relied on tests alone.

Core Features & Use Cases

Annotation-based verification: use #[requires], #[ensures], #[invariant], #[variant], and Pearlite to specify and prove function contracts.
Loop reasoning: express loop invariants and termination measures to verify iterative algorithms.
End-to-end verification workflow: integrate with cargo creusot to generate Why3/Coma models and discharge proof obligations.

Quick Start

Annotate your Rust function with Creusot contracts and run cargo creusot prove to verify the function.

Frequently Asked Questions about creusot

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I formally verify Rust code correctness using contracts?▼

You can formally verify Rust code by annotating functions with Creusot contracts like #[requires], #[ensures], and Pearlite specifications, then running cargo creusot prove to discharge proof obligations.

How do I write loop invariants for Rust iterative algorithms?▼

To write loop invariants in Rust, use Creusot's #[invariant] and #[variant] annotations alongside Pearlite logic to express loop properties and termination measures for verifying iterative algorithms.

Can I prove Rust function preconditions and postconditions without writing tests?▼

Yes, you can prove Rust function preconditions and postconditions by specifying them with Creusot's #[requires] and #[ensures] attributes, generating Why3/Coma models to mathematically verify correctness instead of testing.

Does Rust formal verification work with Pearlite ghost and predicate logic?▼

Rust formal verification with Creusot fully supports Pearlite ghost and predicate logic, allowing you to define ghost variables and logical predicates to express complex proof requirements across Rust modules.

What is the workflow for debugging failed Creusot proofs in Rust?▼

Debugging failed Creusot proofs involves inspecting the generated Why3/Coma models and reviewing your Pearlite specifications, loop invariants, and function contracts to identify logical gaps in the verification obligations.

When should I use formal verification instead of standard Rust testing?▼

Use formal verification for quality-critical Rust code where mathematical certainty is required, applying Creusot contracts and Pearlite specifications to prove correctness rather than relying on tests alone.