Functional programming 制定转让证明

从一个赋值中考虑以下代码。这里的目的是证明账户上的交易是可交换的。据我所知，有两个账户e1{cash 10}和e2{cash 20}。因此，如果我在e1上通过给出10进行交易，然后在e2上通过给出10进行交易，然后我按照相反的顺序进行交易，那么在最后，帐户状态是相同的。为此，我必须证明两者之间的帐户状态是等价的。 像帐户状态[e1{10}e2{20}]->[e1{0}e2{20}]->[e1{0}e2{10}]和[e1{10}e2{20}]->[e1{10}e2{10}]->[e1{0}e2{10}]一样，即介于两者之间的状态导致相同的状态。我的想法正确吗？我该如何表述呢？乍一看，这看起来微不足道，但并不是那么容易

module Acc where

open import Data.Nat hiding (_≟_; _+_; _≤_)
open import Data.Integer hiding (_≟_; suc)
open import Data.String
open import Data.Product
open import Relation.Nullary
open import Relation.Nullary.Decidable
open import Relation.Binary.PropositionalEquality

-- Trivial example of an EDSL inspired by
-- http://www.lpenz.org/articles/hedsl-sharedexpenses/

-- We have n people who go on a trip
-- they pay for things
-- they give each other money
-- at the end we want to have the balance on each account

-- Syntax

infixr 10 _•_
infixr 10 _and_
infix 20 _⇒_

data Person : Set where
  P : String → Person

data Exp : Set where
  _⇒_ : Person → ℕ → Exp
  _[_]⇒_ : Person → ℕ → Person → Exp
  _and_ : Exp → Exp → Exp


data Accounts : Set where
  □   : Accounts
  _,_ : (String × ℤ) → Accounts → Accounts

data _∈ᵣ_ : (String × ℤ) → Accounts → Set where
  hereᵣ : ∀ {ρ s v} → (s , v) ∈ᵣ ((s , v) , ρ)
  skipᵣ : ∀ {ρ s v s' v'} →
     {α : False (s ≟ s')} → (s , v) ∈ᵣ ρ → (s , v) ∈ᵣ ((s' , v') , ρ)

update : Accounts → String → ℤ → Accounts
update □ s amount = (s , amount) , □
update ((s₁ , amount₁) , accounts) s₂ amount₂ with (s₁ ≟ s₂)
... | yes _ = (s₁ , (amount₁ + amount₂)) , accounts 
... | no _ = (s₁ , amount₁) , update accounts s₂ amount₂ 

data account : Exp → Accounts → Accounts → Set where
  spend : ∀ {s n σ} → account (P s ⇒ (suc n)) σ (update σ s -[1+ n ])
  give : ∀ {s₁ s₂ n σ} → account (P s₁ [ suc n ]⇒ P s₂) σ
  (update (update σ s₁ -[1+ n ]) s₂ (+ (suc n)))
  _•_ : ∀ {e₁ e₂ σ₁ σ₂ σ₃} →
account e₁ σ₁ σ₂ → account e₂ σ₂ σ₃ → account (e₁ and e₂) σ₁ σ₃

andComm : ∀ {σ σ' σ'' e₁ e₂} → account (e₁ and e₂) σ σ' →
      account (e₂ and e₁) σ σ'' → σ' ≡ σ''
andComm (a₁ • a) (b • b₁) = {!!}