tla-audit

Audit TLA+ specifications for structural integrity, property strength, and abstraction fidelity.

Updated Apr 3, 2026

Search Tags:#safety #formal verification #liveness #tla+#model checking #tlc

Ready to run

npx skills add https://github.com/strawgate/agent-skills --skill tla-audit

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: tla-audit
Source: https://github.com/strawgate/agent-skills/tree/main/tla-audit
Command: npx skills add https://github.com/strawgate/agent-skills --skill tla-audit

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the common pitfalls in TLA+ modeling, such as weak invariants, unsound liveness properties, and abstraction gaps that hide critical system bugs.

Core Features & Use Cases

Structural Audit: Validates variable priming, initialization, and completeness of the Next relation to prevent TLC false positives.
Property Strength Analysis: Evaluates safety and liveness properties to ensure they are not vacuously true or overly permissive.
Abstraction Fidelity: Compares model actions against real-world code to identify dangerous simplifications like atomic reads or missing crash recovery logic.

Quick Start

Use the tla-audit skill to perform a comprehensive review of the current specification file and identify potential soundness issues.

Frequently Asked Questions about tla-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit TLA+ specifications for weak invariants and unsound liveness properties?▼

To audit TLA+ specifications for weak invariants and unsound liveness, perform a systematic review of safety and liveness properties. This process evaluates property strength to ensure invariants are not vacuously true or overly permissive, preventing hidden system bugs.

What is abstraction fidelity in TLA+ model checking and why does it matter?▼

Abstraction fidelity in TLA+ model checking compares model actions against real-world code to identify dangerous simplifications. Detecting abstraction gaps like missing crash recovery logic or atomic reads prevents critical system bugs from being hidden by overly simplified specifications.

How do I fix TLC false positives caused by incomplete Next relations in TLA+?▼

Fix TLC false positives from incomplete Next relations by performing a structural audit of your TLA+ specification. This validates variable priming, initialization, and completeness of the Next relation to ensure the model checker evaluates the full state space accurately.

Does formal verification of TLA+ specs require analyzing TLC configurations and state space constants?▼

Formal verification of TLA+ specs requires deep analysis of TLC configurations and state space constants. Evaluating these configurations alongside refinement mappings is necessary to identify potential modeling errors and ensure real-world fidelity.

What are the limitations of relying solely on TLC model checking for TLA+ safety properties?▼

Relying solely on TLC model checking for TLA+ safety properties can mask dangerous simplifications and unsound liveness. Without evaluating abstraction fidelity and property strength, models may produce false positives or hide critical bugs like missing crash recovery logic.