fstar

F* refinement types let you embed logical predicates into function signatures to express and prove properties about code. Write a function with a refinement type, and F* uses Z3 to automatically verify your claims match the implementation, catching logical errors before runtime.

Yes. F* extracts verified code to C via Karamel or to OCaml, Low*, Steel, and Pulse DSLs. This lets you prove correctness at the specification level, then compile to efficient native code while preserving your verification guarantees.

F* delegates proof obligations to Z3, an SMT solver that either discharges them automatically or reports why they failed. Understanding SMT errors helps you refine your types or implementation logic when verification doesn't go through.

Use mise to install F* and manage project dependencies. Run `fstar.exe MyModule.fst` to verify a module, or add `--cache_checked_modules` to speed up repeated verification by caching intermediate results.

Dependent types in F* let you express richer type relationships where types depend on values. Refinement types are a specific form that attach logical predicates to existing types, making them practical for proving properties without complex type machinery.

F* is suited when you want to verify algorithms and protocols with automation, extract to production languages, and integrate with native code. Its SMT backing and multi-language extraction make it practical for systems programming where formal guarantees meet real deployment.