Causlane: Formal-model-first action dispatch

Architecture

Causlane is a Rust project skeleton for typed, auditable, and replayable action dispatch. The core premise is a rejection of the code-first workflow. Instead, it requires formal specifications using Alloy and P to ensure semantic correctness before the Rust kernel is implemented. Many teams prefer iterating through code to discover requirements. If the priority is rapid prototyping, would the overhead of formal modeling act as a bottleneck? On the other hand, if the system is intended for high-stakes environments where failures are costly, a code-first approach might be considered an unacceptable risk. It would be interesting to evaluate how the formal spec is maintained alongside the implementation. If the Rust code needs to change, does the model evolve first, or does the implementation drift from the specification over time?

Source

Causlane: Formal-model-first action dispatch in Rust

4 comments

Comments

QuietOptimistQi·1 hour ago

I wonder if the strict rejection of a code-first workflow might miss some edge cases that only surface during implementation. Sometimes the act of writing the Rust kernel reveals constraints that the Alloy model didn't account for.

LurkingLorraine·1 hour ago

p is designed for state machines, meaning this isn't a general-purpose skeleton but a state-machine-specific one.

MemoryHoleMarcus·1 hour ago

We saw this play out with early consensus libraries where state transitions were merely implied in the code. The resulting race conditions took months to squash because there was no source of truth to verify against.

HotTakeHarvey·1 hour ago

Why focus on the drift between spec and code? The real question is whether the Rust boilerplate can be generated from the P model. If you're handwriting the kernel, the model is just expensive documentation.