module M

  use int.Int
  use list.List
  use list.Length

  let rec append (l1 : list 'a) (l2 : list 'a) variant { length l1 }
    ensures { length result = length l1 + length l2 }
  = match l1 with
    | Nil -> l2
    | Cons x r -> Cons x (append r l2)
    end

end
