How dangerous is trust?

Question

Here is what I understand about Relation.Binary.PropositionalEquality.TrustMe.trustMe: it accepts arbitrary xand yand:

• if xand yreally equal, it becomesrefl
• If it is not, he behaves like postulate lie : x ≡ y.

Now, in the latter case, this can easily make Agda inconsistent, but this in itself is not so much a problem: it simply means that any evidence using trustMeis evidence of appeal to the authorities. Moreover, although you can use such things for recording coerce : {A B : Set} -> A -> B, it turns out that it coerce {ℕ} {Bool} 0does not reduce (at least not according to Cc Cn), therefore it is really not similar, say, to Haskell's semantic stomp unsafeCoerce.

So what should I be afraid of trustMe? On the other hand, is there ever a reason to use it outside of the implementation of primitives?

Answer 1

Indeed, an attempt to match patterns on trustMe, which is not evaluated using refl, leads to a stuck term. May educate (part of) the code that defines the primitive operations for trustMe, primTrustMe:

(u', v') <- normalise (u, v)
if (u' == v') then redReturn (refl $ unArg u) else
  return (NoReduction $ map notReduced [a, t, u, v])

Here uand vrepresent the members xand, yrespectively. The rest of the code can be found in the module Agda.TypeChecking.Primitive.

, x y , primTrustMe ( trustMe) , . , Agda Haskell. Agda.Compiler.MAlonzo.Primitives, :

("primTrustMe"       , Right <$> do
       refl <- primRefl
       flip runReaderT 0 $
         term $ lam "a" (lam "A" (lam "x" (lam "y" refl))))

: refl , x y. :

module DontTrustMe where

open import Data.Nat
open import Data.String
open import Function
open import IO
open import Relation.Binary.PropositionalEquality
open import Relation.Binary.PropositionalEquality.TrustMe

postulate
  trustMe′ : ∀ {a} {A : Set a} {x y : A} → x ≡ y

transport : ℕ → String
transport = subst id (trustMe {x = ℕ} {y = String})

main = run ∘ putStrLn $ transport 42

trustMe transport, (C-c C-x C-c) , ... , - segfault.

, :

DontTrustMe.exe: MAlonzo Runtime Error:
    postulate evaluated: DontTrustMe.trustMe′

---

( , MAlonzo), ( , typecheck , ).

: ( ) . trustMe : Name (Reflection), String (Data.String) Char (Data.Char).

, , , trustMe, . - :

open import Data.Bool
open import Relation.Binary
open import Relation.Binary.PropositionalEquality
open import Relation.Nullary

data X : Set where
  a b : X

eq : X → X → Bool
eq a a = true
eq b b = true
eq _ _ = false

dec-eq : Decidable {A = X} _≡_
dec-eq x y with eq x y
... | true  = yes trustMe
... | false = no whatever
  where postulate whatever : _

, eq, .