Definition of the invariant: given two correct validators in the system, their blockchains do not fork.
Theorem:
(defthm nonforking-blockchains-p-necc (implies (nonforking-blockchains-p systate) (implies (and (in val1 (correct-addresses systate)) (in val2 (correct-addresses systate))) (lists-noforkp (validator-state->blockchain (get-validator-state val1 systate)) (validator-state->blockchain (get-validator-state val2 systate))))))
Theorem:
(defthm booleanp-of-nonforking-blockchains-p (b* ((yes/no (nonforking-blockchains-p systate))) (booleanp yes/no)) :rule-classes :rewrite)
Theorem:
(defthm nonforking-blockchains-p-of-system-state-fix-systate (equal (nonforking-blockchains-p (system-state-fix systate)) (nonforking-blockchains-p systate)))
Theorem:
(defthm nonforking-blockchains-p-system-state-equiv-congruence-on-systate (implies (system-state-equiv systate systate-equiv) (equal (nonforking-blockchains-p systate) (nonforking-blockchains-p systate-equiv))) :rule-classes :congruence)