1\section{The Core Type Theory}
3\label{sect:typechecking}
5High level \Idris{} programs, as described in Section \ref{sect:hll}, are
6\remph{elaborated} to a small core language, \TT{}, then type checked.
7\TT{} is a dependently typed $\lambda$-calculus with inductive families
8and pattern matching definitions similar to UTT~\cite{luo1994}, and building
9on an earlier implementation, \Ivor{}~\cite{Brady2006b}.
11core language is kept as small as is reasonably possible, which has several advantages: it is
12easy to type check, since type checking dependent type theory is well understood
13~\cite{loh2010tutorial}; and it is easy to transform, optimise and compile. Keeping
14the core language small increases confidence that these important components of
15the language are correct. In this section, we describe \TT{} and
18\subsection{\TT{} syntax}
20The syntax of \TT{} expressions is given in Figure \ref{ttsyn}. This defines:
23\item \demph{Terms}, $\vt$, which are variables, bindings, applications or constants.
24\item \demph{Bindings}, $\vb$, which are lambda abstractions, let bindings, or function spaces.
25\item \demph{Constants}, $\vc$, which are integer or string literals, or $\Type_i$, the
26type of types, and may be extended with other primitives.
29The function space $\all{\vx}{\vS}\SC\vT$ may also be written as $(\vx\Hab\vS)\to\vT$,
30or $\vS\to\vT$ if $\vx$ is not free in $\vT$, to make the notation more consistent with
31the high level language. Universe levels on sets ($\Type_i$) may be left implicit and
32inferred by the machine~\cite{pollack1990implicit}.
35\begin{array}{rll@{\hg}rll}
36\vt ::= & \vc & (\mbox{constant}) &
37\hg\vb ::= & \lam{\vx}{\vt} & (\mbox{abstraction}) \\
39 \mid & \vx & (\mbox{variable}) &
40 \mid & \LET\:\vx\defq\vt\Hab\vt & (\mbox{let binding}) \\
42 \mid & \vb\SC\:\vt & (\mbox{binding}) &
43 \mid & \all{\vx}{\vt} & (\mbox{function space}) \\
45 \mid & \vt\;\vt & (\mbox{application}) &
46% \mid & \pat{\vx}{\vt} & (\mbox{pattern variable}) \\
48% \mid & \pty{\vx}{\vt} & (\mbox{pattern type}) \\
50 \vc ::= & \Type_i & (\mbox{type universes}) \\
51 \mid & \vi & (\mbox{integer literal}) \\
52 \mid & \VV{str} & (\mbox{string literal}) \\
55{\TT{} expression syntax}
58A \TT{} program is a collection of \demph{inductive family} definitions (Section
59\ref{sect:inductivefams}) and \demph{pattern matching} function definitions (Section
60\ref{sect:patdefs}), as well as primitive operators on constants.
61Before defining these, let us define the semantics of \TT{}
64\subsection{\TT{} semantics}
66The static and dynamic semantics of \TT{} are defined mutually, since
67evaluation relies on a well-typed term, and type checking relies on
68evaluation. Everything is defined relative
69to a context, $\Gamma$. The empty context
70is valid, as is a context extended with a $\lambda$, $\forall$ or
74\Axiom{\proves\RW{valid}}
76\Rule{\Gamma\proves\RW{valid}}
77{\Gamma;\vb\proves\RW{valid}}
80\subsubsection{Evaluation}
82\label{sect:evaluation}
84Evaluation of \TT{} is defined by contraction schemes, given in Figure
85\ref{ttcontract}. \demph{Contraction}, relative to a context $\Gamma$, is given
86by one of the following schemes:
89\item $\beta$-contraction, which substitutes a value applied to a $\lambda$-binding for
90the bound variable. We define $\beta$-contraction simply by replacing the $\lambda$-binding
92\item $\delta$-contraction, which replaces a $\LET$ bound variable with its value.
96The following contextual closure rule reduces a $\LET$ binding by creating
97a $\delta$-reducible expression:
100\Rule{\Gamma;\LET\:\vx\defq\vs\proves\vt\leadsto\vu}
101{\Gamma\proves\LET\:\vx\defq\vs\Hab\vS\SC\vt\leadsto\vu}
104\demph{Reduction} ($\reduces$) is the structural closure of contraction, and evaluation
105is ($\reducesto$) is the transitive closure of reduction. \demph{Conversion} ($\converts$)
106is the smallest equivalence relation closed under reduction. If $\Gamma\proves\vx\converts\vy$
107then $\vy$ can be obtained from $\vx$ by a finite, possibly empty, sequence of
108contractions and reversed contractions. Terms which are convertible are also said to
109be definitionally equal.
110The evaluator can also be extended by defining pattern matching functions, which
111will be described in more detail in Section \ref{sect:patdefs}. In principle, pattern
112matching functions can be understood as extending the core language with high level
117\beta\mathrm{-contraction} &
119\Gamma\proves(\lam{\vx}{\vS}\SC\vt)\:\vs\leadsto\LET\:\vx\defq\vs\Hab\vS\SC\vt
121\delta\mathrm{-contraction} &
123\Gamma;\LET\:\vx\defq\vs\Hab\vS;\Gamma'
129{\TT{} contraction schemes}
134\subsubsection{Typing rules}
136\label{sect:typerules}
138The type inference rules for \TT{} expressions are given in Figure \ref{typerules}.
139These rules use the \demph{cumulativity} relation, defined in
140Figure \ref{cumul}. The type of types, $\Type_i$ is parameterised by a universe level,
141to prevent Girard's paradox~\cite{coquand1986analysis}. Cumulativity allows programs at
142lower universe levels to inhabit higher universe levels. In practice, universe levels
143can be left implicit (and will be left implicit in the rest of this paper) ---
144the type checker generates a graph of constraints between universe levels (such
145as that produced by the $\mathsf{Forall}$ typing rule) and checks that there
146are no cycles. Otherwise, the typing rules are standard and type inference can
147be implemented in the usual way~\cite{loh2010tutorial}.
149\FFIG{\begin{array}{c}
151\Rule{\Gamma\proves\RW{valid}}
152{\Gamma\vdash\Type_n\Hab\Type_{n+1}}
155\Rule{\Gamma\proves\RW{valid}}
156{\Gamma\vdash\vi\Hab\TC{Int}}
159\Rule{\Gamma\proves\RW{valid}}
160{\Gamma\vdash\VV{str}\Hab\TC{String}}
163\Rule{\Gamma\proves\RW{valid}}
164{\Gamma\vdash\TC{Int}\Hab\Type_0}
167\Rule{\Gamma\proves\RW{valid}}
168{\Gamma\vdash\TC{String}\Hab\Type_0}
171%\Rule{(\pat{\vx}{\vS})\in\Gamma}
172%{\Gamma\vdash\vx\Hab\vS}
175%\Rule{(\pty{\vx}{\vS})\in\Gamma}
176%{\Gamma\vdash\vx\Hab\vS}
179\Rule{(\lam{\vx}{\vS})\in\Gamma}
180{\Gamma\vdash\vx\Hab\vS}
183\Rule{(\all{\vx}{\vS})\in\Gamma}
184{\Gamma\vdash\vx\Hab\vS}
187\Rule{(\LET\:\vx\Hab\vS\defq\vs)\in\Gamma}
188{\Gamma\vdash\vx\Hab\vS}
191\Rule{\Gamma\vdash\vf\Hab\fbind{\vx}{\vS}{\vT}\hg\Gamma\vdash\vs\Hab\vS}
192{\Gamma\vdash\vf\:\vs\Hab\vT[\vs/\vx]} % \LET\:\vx\Hab\vS\:\defq\:\vs\:\IN\:\vT}
195\Rule{\Gamma;\lam{\vx}{\vS}\vdash\ve\Hab\vT\hg\Gamma\proves\fbind{\vx}{\vS}{\vT}\Hab\Type_n}
196{\Gamma\vdash\lam{\vx}{\vS}.\ve\Hab\fbind{\vx}{\vS}{\vT}}
199\Rule{\Gamma;\all{\vx}{\vS}\vdash\vT\Hab\Type_m\hg\Gamma\vdash\vS\Hab\Type_n}
200{\Gamma\vdash\fbind{\vx}{\vS}{\vT}\Hab\Type_p}
201\:(\exists\vp.\vm\le\vp,\:\vn\le\vp)
204\Rule{\begin{array}{c}\Gamma\proves\ve_1\Hab\vS\hg
205 \Gamma;\LET\:\vx\defq\ve_1\Hab\vS\proves\ve_2\Hab\vT\\
206 \Gamma\proves\vS\Hab\Type_n\hg
207 \Gamma;\LET\:\vx\defq\ve_1\Hab\vS\proves\vT\Hab\Type_n\end{array}
209{\Gamma\vdash\LET\:\vx\defq\ve_1\Hab\vS\SC\:\ve_2\Hab
211%\Let\:\vx\Hab\vS\defq\ve_1\:\IN\:\vT}
215\Rule{\Gamma\proves\vx\Hab\vA\hg\Gamma\proves\vA'\Hab\Type_n\hg
216 \Gamma\proves\vA\cumul\vA'}
217 {\Gamma\proves\vx\Hab\vA'}
220{Typing rules for \TT{}}
225\Rule{\Gamma\proves\vS\converts\vT}
226{\Gamma\proves\vS\cumul\vT}
228\Axiom{\Gamma\proves\Type_n\cumul\Type_{n+1}}
230\Rule{\Gamma\proves\vR\cumul\vS\hg\Gamma\proves\vS\cumul\vT}
231{\Gamma\proves\vR\cumul\vT}
233\Rule{\Gamma\proves\vS_1\converts\vS_2\hg\Gamma;\vx\Hab\vS_1\proves\vT_1\cumul\vT_2}
234{\Gamma\proves\all{\vx}{\vS_1}\SC\vT_1\cumul\all{\vx}{\vS_2}{\vT_2}}
240\subsection{Inductive Families}
242\label{sect:inductivefams}
244Inductive families \cite{dybjer1994inductive} are a form of simultaneously
245defined collection of algebraic data types which can be parameterised over
246\remph{values} as well as types. An inductive family is declared
247in a similar style to a Haskell GADT declaration~\cite{pj2006gadts}
249follows, using vector notation, $\tx$, to indicate a
250sequence of zero or more $\vx$ (i.e., $\vx_1,\vx_2,\ldots,\vx_n$):
254\Data\hg\TC{T}\:(\tx\Hab\ttt)\Hab\vt\hg\Where\hg
255\DC{c}_1\Hab\vt\:\mid\:\ldots\:\mid\:\DC{c}_n\Hab\vt
259Constructors may take recursive arguments in the family
260$\TC{T}$. Furthermore these arguments may themselves be indexed by another type ---
261if such indices do not involve $\TC{T}$ then the constructor is
262\demph{strictly positive}, which ensures that recursive arguments of the
263constructor are structurally smaller than the value itself.
265For example, the \Idris{} data type \tTC{Nat} would be declared in \TT{} as follows:
268\Data\hg\Nat\Hab\Type\hg\Where\hg\Z\Hab\Nat\:\mid\:\suc\Hab\fbind{\vk}{\Nat}{\Nat}
271A data type may have zero or more parameters (which are invariant
272across a structure) and a number of indices, given by the type. For
273example, the \TT{} equivalent of \tTC{List} is parameterised over its element type:
277\Data\hg\List\:(\va\Hab\Type)\Hab\Type\hg\Where
279& \nil\Hab\List\:\va\\
280\mid & (\cons)\Hab\fbind{\vx}{\va}{\fbind{\vxs}{\List\:\va}{\List\:\va}}
286parameterised over values. Using this, we can declare the type of
287vectors (lists with length), where the empty list is statically known
288to have length zero, and the non empty list is statically known to
289have a non zero length. The \TT{} equivalent of \tTC{Vect} is parameterised over its element type,
290like $\List$, but \remph{indexed} over its length. Note also that the length
291index $\vk$ is given \remph{explicitly}.
295\Data\hg\Vect\:(\va\Hab\Type)\Hab\Nat\to\Type\hg\Where \\
297& \nil\Hab\Vect\:\va\:\Z\\
298\mid & (\cons)\Hab\fbind{\vk}{\Nat}{
299\fbind{\vx}{\va}{\fbind{\vxs}{\Vect\:\va\:\vk}{\Vect\:\va\:(\suc\:\vk)}}
305\subsection{Pattern matching definitions}
309\subsubsection{Syntax}
311A pattern matching definition for a function named $\FN{f}$ takes the following form,
312consisting of a type declaration followed by one or more pattern clauses:
317\pat{\tx_1}{\ttt_1}\SC\FN{f}\:\ttt_1\:=\:\vt_1\\
319\pat{\tx_n}{\ttt_n}\SC\FN{f}\:\ttt_n\:=\:\vt_n\\
323A pattern clause consists of a list of pattern variable bindings, introduced by
325and a left and right hand side, both of which
326are \TT{} expressions. Each side is type checked relative to the variable bindings,
327and the types of each side must be convertible. Additionally, the
328left hand side must take the form of $\FN{f}$ applied to a number of \TT{} expressions,
329and the number of arguments must be the same in each clause. The right hand
330sides may include applications of $\FN{f}$, i.e. pattern matching definitions may
331be recursive. Termination analysis is implemented separately. The validity of a pattern
332clause is defined by the following rule:
336\Gamma;\lam{\tx}{\tU}\proves\FN{f}\:\tts\Hab\vS\hg
337\Gamma;\lam{\tx}{\tU}\proves\ve\Hab\vT\hg
338\Gamma\proves\vS\converts\vT}
340\Gamma\proves\pat{\tx}{\tU}\SC\FN{f}\:\tts\:=\:\ve\:\RW{valid}
344A valid pattern matching definition effectively extends \TT{} with a new constant,
345with the given type (extending the initial typing rules given in Section \ref{sect:typerules})
346and reduction behaviour (extending the initial reduction rules given in Section
347\ref{sect:evaluation}).
349\subsubsection{Semantics}
351Matching on an expression proceeds by comparing the expression to
352each match clause in order, resulting in either:
355\item \demph{Success}, with pattern variables mapping to expressions
356\item \demph{Failure}, with matching continuing by proceeding to the next match clause
357\item Matching being \demph{blocked}, for example by attempting to match a variable
358against a constructor pattern. In this case, no reduction occurs, because instantiating
359the variable may provide enough information for the clause to match.
362% Pat(x args) => x (Pat' args)
366In order to implement pattern matching, we must separate the \remph{accessible} and
367\remph{inaccessible} patterns. A pattern is \demph{accessible} (that is, it is possible
368to match against it) if it is constructor headed, or a variable. Inaccessible patterns
369are converted to ``match anything'' patterns. Clauses are converted to matchable pattern
370clauses with the $\MO{Clause}$ operation, given in Figure \ref{mkclause}.
371We extend the vector notation to meta-operations: the notation $\vec{\MO{Pat}}$ lifts the
372$\MO{Pat}$ operation across a list of arguments.
377& \MO{Clause} & (\pat{\tx}{\tU}\SC\FN{f}\:\tts\:=\:\ve)
378 & \MoRet{\FN{f}\:(\vec{\MO{Pat}}\:\tts)\:=\:\ve}
382& \MO{Pat} & (\vx\:\tts) & \MoRet{\vx\:(\vec{\MO{Pat}}\:\tts)
383 \hg\mbox{(if $\MO{Con}\:\vx$ and $\MO{Arity}\:\vx = \MO{Length}\:\tts$)}} \\
384& \MO{Pat} & \vx & \MoRet{\vx} \hg\mbox(if $\vx$ is a pattern variable)\\
385& \MO{Pat} & \cdot & \MoRet{\_} \hg\mbox(in all other cases)\\
389{Building matchable pattern clauses}
393% Match (c args, c args') => Match' (args, args')
394% Match (c args, x) => Blocked
395% Match (x, t) => Success (x => t)
396% Match (_, t) => Success ()
398\newcommand{\Blocked}{\mathsf{Blocked}}
399\newcommand{\Success}{\mathsf{Success}}
400\newcommand{\Failure}{\mathsf{Failure}}
402Pattern matching is invoked by the evaluator on encountering a function with
403a pattern matching definition applied to some arguments. If successful, pattern
404matching returns a new expression, which can then be reduced further.
405Figure \ref{pmatch} gives the semantics of pattern matching a collection of
407$\tc$ against an expression $\ve$. $\MO{Match}$ attempts to match each clause in
408turn against $\ve$. If matching a clause returns $\Success$ or $\Blocked$, then
409matching terminates. If matching a clause returns $\Failure$, then matching proceeds
410with the next clause. The algorithm uses the following meta-operations:
413\item $\MO{Con}\:\vx$, which returns true if $\vx$ is a constructor name
414\item $\MO{Arity}\:\vx$, which, if $\vx$ is a constructor name, returns the number of arguments
416\item $\MO{Length}\:\tts$, which returns the length of the vector $\tts$
423& \MO{MatchArg} & (\vx\:\tts) & (\vx\:\tts')
424 & \MoRet{\vec{\MO{MatchArg}}\:\tts\:\tts'\hg\mbox{(if $\MO{Con}\:\vx$)}}\\
425& \MO{MatchArg} & (\vx\:\tts) & \vx & \MoRet{\Blocked} \\
426& \MO{MatchArg} & \vx & \vt & \MoRet{\Success\:(\vx\mapsto\vt)} \\
427& \MO{MatchArg} & \_ & \vt & \MoRet{\Success\:()} \\
428& \MO{MatchArg} & \cdot & \cdot & \MoRet{\Failure}
432& \MO{MatchClause} & (\vf\:\tp = \ve) & (\vf\:\tts) &
435 \Success\:\ve[\tx/\tv]\hg\mbox{(if $\vec{\MO{MatchArg}}\:\tp\:\tts \mq \Success\:(\tx,\tv)$)}\\
436 \Blocked\;\;\;\hg\hg\mbox{(if $\vec{\MO{MatchArg}}\:\tp\:\tts \mq \Blocked$)}\\
437 \Failure\;\;\;\;\;\hg\hg\mbox{(if $\vec{\MO{MatchArg}}\:\tp\:\tts \mq \Failure$)}\\
440& \MO{MatchClause} & (\vf\:\tp = \ve) & \cdot & \MoRet{\Failure} \\
444& \MO{Match} & (\vc ; \tc) & \ve &
447 \Success\;\vx\;\;\hg\mbox{(if $\MO{MatchClause}\:\vc\:\ve \mq \Success\:\vx)$} \\
448 \Blocked\hg\;\;\;\;\mbox{(if $\MO{MatchClause}\:\vc\:\ve \mq \Blocked)$} \\
449 \MO{Match}\:\tc\:\ve\hg\mbox{(otherwise)}
452& \MO{Match} & \cdot & \ve & \MoRet{\Failure}
456{Pattern matching semantics}
459By convention, we write the application of a meta-operation $\MO{Op}$
460across a vector $\tx$ as $\vec{\MO{Op}}\:\tx$.
461In practice, for efficiency, pattern matching is implemented by compiling the match clauses to
462a tree of case expressions~\cite{Augustsson1985}.
464\subsection{Totality checking}
466In order to ensure termination of type checking
467we must distinguish terms for which evaluation definitely terminates, and
468those which may diverge. \TT{} takes a simple but pragmatic and
469effective approach to termination
470checking: any functions which do not satisfy a syntactic constraint on recursive
471calls are marked as \emph{partial}. Additionally, any function which calls a partial
472function or uses a data type which is not strictly positive is also marked as
473partial. The syntactic constraint we use is that a recursive call in a pattern
474clause must have an argument which is structurally smaller than an input argument
475in the same position. \TT{} also marks functions which do not cover all possible
476inputs as partial. This totality checking is independent of the rest of the type
477theory, and can be extended.
479This approach, separating the termination requirement from the type theory, means that
480an \Idris{} programmer makes the decision about the importance of totality for each
481function rather than having the totality requirement imposed by the type theory.
483\subsection{From \Idris{} to \TT{}}
485\TT{} is a very small language, consisting only of data declarations and pattern matching
486function definitions. There is no significant innovation in the design of \TT{}, and this
487is a deliberate choice --- it is a combination of small, well-understood components.
488The kernel of the \TT{} implementation, consisting of a type checker, evaluator and
489pattern match compiler, is less than 1000 lines of Haskell code. If we are confident
490in the correctness of the kernel of \TT{}, and any higher level language feature
491can be translated into \TT{}, we can be more confident of the correctness of the high
492level language implementation than if it were implemented directly.
494The process of elaborating a high level language into a core type theory like \TT{} is,
495however, less well understood, and presents several challenges depending on the
496features of the high level language.
497%Elaboration has been implemented in various different ways,
498%for example in Agda~\cite{norell2007thesis} and Epigram~\cite{McBride2004a}.
500\subsubsection{Example Elaboration}
502Recall the following \Idris{} function:
508this to \TT{}, we must resolve the implicit arguments, and make the type class explicit.
509The first step is to make the implicit arguments explicit, using a placeholder
510to stand for the arguments we have not yet resolved. The type class argument is
511also treated as an implicit argument, to which we give the name \texttt{c}:
513\begin{SaveVerbatim}{vAddImp}
515vAdd : (a : _) -> (n : _) -> Num a -> Vect a n -> Vect a n -> Vect a n
516vAdd _ _ c (Nil _) (Nil _) = (Nil _)
517vAdd _ _ c ((::) _ _ x xs) ((::) _ _ y ys)
518 = (::) _ _ ((+) _ x y) (vAdd _ _ _ xs ys)
523Next, we resolve the implicit arguments. Each implicit argument can only take
524one value for this program to be type correct --- these are solved by a unification
527\begin{SaveVerbatim}{vAddImpSolve}
529vAdd : (a : Set) -> (n : Nat) -> Num a -> Vect a n -> Vect a n -> Vect a n
530vAdd a O c (Nil a) (Nil a) = Nil a
531vAdd a (S k) c ((::) a k x xs) ((::) a k y ys)
532 = (::) a k ((+) c x y) (vAdd a k c xs ys)
535\useverb{vAddImpSolve}
537Finally, to build the \TT{} definition, we need to find the type of each pattern variable
538and state it explicitly. This leads to the \TT{} definition in Figure \ref{ttvadd},
539switching to \TT{} notation from the ASCII \Idris{} syntax.
544\FN{vAdd} & \Hab(\va\Hab\Set)\to(\vn\Hab\Nat)\to\TC{Num}\:\va\to
545 \Vect\:\va\:\vn\to\Vect\:\va\:\vn\to\Vect\:\va\:\vn\\
548\begin{array}{lccccccc}
550\RW{var}\:\va\Hab\Set,\:\vc\Hab\TC{Num}\;\va\SC}\\
551\hg\FN{vAdd} & \va & \Z & \vc & (\DC{Nil}\;\va) & (\DC{Nil}\;\va) & \Ret{\DC{Nil}\;\va} \\
554\va\Hab\Set,\:\vk\Hab\Nat,\;\vc\Hab\TC{Num}\;\va,\\
555\vx\Hab\va,\;\vxs\Hab\Vect\;\va\;\vk,\;
556\vy\Hab\va,\;\vys\Hab\Vect\;\va\;\vk
560\hg\FN{vAdd} & \va & (\suc\;\vk) & \vc
561 & ((\DC{::})\;\va\;\vk\;\vx\;\vxs)
562 & ((\DC{::})\;\va\;\vk\;\vy\;\vys)
564 & & \MRet{5}{((\DC{::})\;\va\;\vk\;((+)\;\vc\;\vx\;\vy)\; (\FN{vAdd}\;\va\;\vk\;\vc\;\vxs\;\vys))}
568{Pairwise addition of vectors in \TT{}}
571\subsubsection{An observation}
573\Idris{} programs may contain several high level constructs not present in \TT{}, such
574as implicit arguments, type classes, \texttt{where} clauses, pattern matching \texttt{let}
575and \texttt{case} constructs. We would like the high level language to be as expressive
576as possible, while remaining possible to translate to \TT{}.
578Before considering how to achieve this, we make an observation about the distinction between
579programming and theorem proving with dependent types, and appropriate mechanisms for
580constructing programs and theorems:
583\item \remph{Pattern matching} is a convenient abstraction for humans to write programs,
584in that it allows a programmer to express exactly the computational behaviour of a function.
585\item \remph{Tactics}, such as those used in the Coq theorem prover~\cite{Bertot2004},
586are a convenient abstraction for building proofs and programs by \remph{refinement}.
589The idea behind the \Idris{} elaborator, therefore, is to use the high level program
590to direct \demph{tactics} to build \TT{} programs by refinement. The
591elaborator is implemented as an Embedded Domain Specific Language (EDSL) in Haskell.
593of this paper describes the EDSL and demonstrates how it is used to implement
594all of the high level features of \Idris{}.
keysesc to close
- j k
- move down, up
- enter
- open
- esc
- back, or up a level
- 1 2 3 4
- readme, files, commits, refs
- /
- filter
- y
- copy the clone command
- c
- compare the chosen commit with another (or shift-click both)
- ?
- show or hide this list