--- title: TLA-Verus: LLM agents prove temporal properties of TLA+... description: A NeurIPS'26 workshop paper takes TLA+ specs from GitHub, translates them into the Verus Rust verifier, and has LLM agents prove safety and liveness... canonical: https://daily.dev/posts/tla-verus-llm-agents-prove-temporal-properties-of-tla-specs-scvjlmgmx twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: TLA-Verus: LLM agents prove temporal properties of TLA+ specs | daily.dev og:description: A NeurIPS'26 workshop paper takes TLA+ specs from GitHub, translates them into the Verus Rust verifier, and has LLM agents prove safety and liveness... og:url: https://daily.dev/posts/tla-verus-llm-agents-prove-temporal-properties-of-tla-specs-scvjlmgmx og:image: https://api.daily.dev/og/posts/SCVJLMgMx.png og:image:alt: TLA-Verus: LLM agents prove temporal properties of TLA+ specs og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # TLA-Verus: LLM agents prove temporal properties of TLA+ specs **[Metadata](https://daily.dev/sources/muratbuffalo)** · 8 min read · 1 upvotes · 0 comments ## Summary A NeurIPS'26 workshop paper takes TLA+ specs from GitHub, translates them into the Verus Rust verifier, and has LLM agents prove safety and liveness properties. Of 16,459 (spec, property) pairs across 2,734 modules, TranSpec translated 6,070, 5,160 were well-posed, and the prover closed 3,094, at about $2 per proof. Liveness proofs succeeded only 38% of the time (304 of 809). A separate benchmark of 40 tasks across eleven models found Opus-5 and GPT-5.6-sol-pro solved everything while gpt-oss-120b solved nothing, and DeepSeek-R1 fell from 74.7% on verusbench to 17.5% here. The review notes no code ever compiles to an executable, and no refinement proof ties the Verus spec back to the original TLA+ meaning. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What percentage of liveness properties did the TLA-Verus prover-reviewer pipeline actually close across the full GitHub corpus? About 38%, or 304 of 809 liveness tasks, in the full corpus sweep driven by Opus across 16,459 (spec, property) pairs translated from 2,734 TLA+ modules in 838 GitHub repositories. This was the weakest property category; invariance and TypeOK properties fared much better, together making up 83% of the 5,160 well-posed tasks. _Anyone weighing LLM-assisted formal verification for liveness proofs can track results like these on daily.dev._ ### Does the TLA-Verus pipeline generate executable Rust code from TLA+ specs? No, every task in the paper is written only in Verus's 'spec' and 'proof' code, which is ghost code erased during compilation; there is no 'exec' code anywhere in the corpus. This means nothing compiles to an executable binary, and the paper leaves proving that generated Rust code refines the Verus spec as future work. _Developers evaluating formal methods tooling for distributed systems can follow this gap on daily.dev._ ### Can TLAPS (the TLA+ Proof System) handle temporal and liveness proofs? Yes, writing 'BY PTL' on a TLAPS proof step sends it to LS4, an LTL decision procedure, using a coalescing technique (Doligez, Kriener, Lamport, Libal, Merz) that abstracts first-order parts into propositional atoms. Lamport's temporal proof rules, including WF1 for turning weak fairness into leads-to conclusions, are supported, though TLAPS reasons poorly about ENABLED side conditions. _Engineers writing TLA+ liveness proofs can keep tabs on TLAPS capabilities and comparisons on daily.dev._ ## Similar posts on daily.dev - [Can LLMs model real-world systems in TLA\+?](https://daily.dev/posts/can-llms-model-real-world-systems-in-tla--odidluhme) · Hacker News · 1 upvotes · 0 comments - [Composition and Modular Verification of TLA\+ specs](https://daily.dev/posts/composition-and-modular-verification-of-tla-specs-blsdch5cr) · Metadata · 2 upvotes · 1 comments - [What TLA\+ can and can't check](https://daily.dev/posts/what-tla-can-and-can-t-check-8vrdsoyox) · Computer Things · 0 upvotes · 0 comments --- Tags: [#ai-agents](https://daily.dev/tags/ai-agents), [#rust](https://daily.dev/tags/rust) [View this post on daily.dev](https://daily.dev/posts/tla-verus-llm-agents-prove-temporal-properties-of-tla-specs-scvjlmgmx) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"TLA-Verus: LLM agents prove temporal properties of TLA+ specs","url":"https://daily.dev/posts/tla-verus-llm-agents-prove-temporal-properties-of-tla-specs-scvjlmgmx","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/tla-verus-llm-agents-prove-temporal-properties-of-tla-specs-scvjlmgmx"},"datePublished":"2026-10-27T19:17:15.393Z","dateModified":"2026-10-27T19:35:35.011Z","description":"A NeurIPS'26 workshop paper takes TLA+ specs from GitHub, translates them into the Verus Rust verifier, and has LLM agents prove safety and liveness...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/19bb62f1c09397bc4829e93ed309bccd?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/19bb62f1c09397bc4829e93ed309bccd?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Metadata","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Metadata","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/90c118a936634226b4410f63cfc78371","url":"https://daily.dev/sources/muratbuffalo"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/tla-verus-llm-agents-prove-temporal-properties-of-tla-specs-scvjlmgmx","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ai-agents,rust","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Metadata","item":"https://daily.dev/sources/muratbuffalo"},{"@type":"ListItem","position":3,"name":"TLA-Verus: LLM agents prove temporal properties of TLA+ specs"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/tla-verus-llm-agents-prove-temporal-properties-of-tla-specs-scvjlmgmx#faq","mainEntity":[{"@type":"Question","name":"What percentage of liveness properties did the TLA-Verus prover-reviewer pipeline actually close across the full GitHub corpus?","acceptedAnswer":{"@type":"Answer","text":"About 38%, or 304 of 809 liveness tasks, in the full corpus sweep driven by Opus across 16,459 (spec, property) pairs translated from 2,734 TLA+ modules in 838 GitHub repositories. This was the weakest property category; invariance and TypeOK properties fared much better, together making up 83% of the 5,160 well-posed tasks. Anyone weighing LLM-assisted formal verification for liveness proofs can track results like these on daily.dev."}},{"@type":"Question","name":"Does the TLA-Verus pipeline generate executable Rust code from TLA+ specs?","acceptedAnswer":{"@type":"Answer","text":"No, every task in the paper is written only in Verus's 'spec' and 'proof' code, which is ghost code erased during compilation; there is no 'exec' code anywhere in the corpus. This means nothing compiles to an executable binary, and the paper leaves proving that generated Rust code refines the Verus spec as future work. Developers evaluating formal methods tooling for distributed systems can follow this gap on daily.dev."}},{"@type":"Question","name":"Can TLAPS (the TLA+ Proof System) handle temporal and liveness proofs?","acceptedAnswer":{"@type":"Answer","text":"Yes, writing 'BY PTL' on a TLAPS proof step sends it to LS4, an LTL decision procedure, using a coalescing technique (Doligez, Kriener, Lamport, Libal, Merz) that abstracts first-order parts into propositional atoms. Lamport's temporal proof rules, including WF1 for turning weak fairness into leads-to conclusions, are supported, though TLAPS reasons poorly about ENABLED side conditions. Engineers writing TLA+ liveness proofs can keep tabs on TLAPS capabilities and comparisons on daily.dev."}}]} ```