Design and Implementation of the Andromeda Proof Assistant

Andromeda [1] is a proof assistant for dependent type theory with equality reflection following the tradition of Edinburgh LCF [3]: (1) there is an abstract datatype of type-theoretic judgments whose values can only be constructed by a small nucleus, and (2) the user interacts with the nucleus by writing programs in a high-level, statically typed Andromeda meta-language (AML). The only part of the system that needs to be trusted is the nucleus, which at present counts around 1800 lines of OCaml code. The underlying type theory of Andromeda has dependent products and equality types (LCF and its descendants implement simple type theory). The rules for products are standard and include function extensionality. The terms are explicitly tagged with typing annotations, which is necessary because we want to avoid various anomalies caused by the equality reflection rule [4]