Definition of the invariant: given two correct validators in the system, their sequences of committed anchor do not fork.
Theorem:
(defthm nonforking-anchors-p-necc (implies (nonforking-anchors-p systate) (implies (and (in val1 (correct-addresses systate)) (in val2 (correct-addresses systate))) (lists-noforkp (committed-anchors (get-validator-state val1 systate)) (committed-anchors (get-validator-state val2 systate))))))
Theorem:
(defthm booleanp-of-nonforking-anchors-p (b* ((yes/no (nonforking-anchors-p systate))) (booleanp yes/no)) :rule-classes :rewrite)
Theorem:
(defthm nonforking-anchors-p-of-system-state-fix-systate (equal (nonforking-anchors-p (system-state-fix systate)) (nonforking-anchors-p systate)))
Theorem:
(defthm nonforking-anchors-p-system-state-equiv-congruence-on-systate (implies (system-state-equiv systate systate-equiv) (equal (nonforking-anchors-p systate) (nonforking-anchors-p systate-equiv))) :rule-classes :congruence)