@codacy/verity-cli 0.33.3-experimental.52f1656 → 0.33.3-experimental.86b5b6f

package/bin/verity.js

@@ -22639,7 +22639,7 @@ function channelSilence(input) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.33.3-experimental.52f1656" : "dev";
+    return true ? "0.33.3-experimental.86b5b6f" : "dev";
   } catch {
     return "dev";
   }
@@ -26843,7 +26843,7 @@ var RISK_PATTERNS = [
 var SOURCE_EXT = /\.(ts|tsx|mts|cts|js|jsx|mjs|cjs|py|go|rs|java|kt|kts|rb|cs|scala|swift|php|ex|exs)$/;
 var EXCLUDED_DIR = /(^|\/)(node_modules|dist|build|bin|out|vendor|coverage|\.verity|\.claude|\.codacy|\.git|__pycache__|target|\.lake)\//;
 var TEST_PATH2 = /(^|\/)(tests?|__tests__|spec|specs|fixtures?|e2e|testdata)\/|\.(test|spec|stories)\.[cm]?[jt]sx?$|_test\.(go|py|rb)$|test_[^/]*\.py$/;
-var GENERATED2 = /\.d\.ts$|\.min\.[jt]s$|\.generated\.|\.pb\.|lock\.json$|\.lock$/;
+var GENERATED2 = /\.d\.ts$|\.min\.[jt]s$|\.generated\.|\.pb\.|lock\.json$|\.lock$|(^|\/)(integrations\/supabase\/types|database\.types|supabase\.types)\.ts$|(^|\/)__generated__\//;
 function isCandidateSource(file) {
   return SOURCE_EXT.test(file) && !EXCLUDED_DIR.test(file) && !TEST_PATH2.test(file) && !GENERATED2.test(file);
 }
@@ -26982,11 +26982,37 @@ var deterministicRanker = {
     return { ok: true, ranker: "deterministic", ranked: deterministicOrder(candidates2) };
   }
 };
-function excerpt(root, file, bytes, readSource) {
+function excerpt(root, file, bytes, readSource, changed) {
   const read = readSource ? readSource(file, EXCERPT_SOURCE_CAP_BYTES) : readRegularFileInRoot(root, file, EXCERPT_SOURCE_CAP_BYTES);
   if (!read.ok) return "";
+  if (changed && changed.length > 0) return changedExcerpt(read.content, changed, bytes);
   return read.content.length > bytes ? read.content.slice(0, bytes) + "\n\u2026 (truncated)" : read.content;
 }
+function changedExcerpt(content, changed, bytes, context = 30) {
+  const lines = content.split("\n");
+  const windows = [...changed].sort((a, b) => a.from - b.from).map((r) => ({ from: Math.max(1, r.from - context), to: Math.min(lines.length, r.to + context) })).reduce((acc, w) => {
+    const last = acc[acc.length - 1];
+    if (last && w.from <= last.to + 1) last.to = Math.max(last.to, w.to);
+    else acc.push({ ...w });
+    return acc;
+  }, []);
+  const isChanged = (n) => changed.some((r) => n >= r.from && n <= r.to);
+  const out = [];
+  let size = 0;
+  for (const w of windows) {
+    if (out.length) out.push("     \u2026");
+    for (let n = w.from; n <= w.to; n++) {
+      const line = `${String(n).padStart(5)}${isChanged(n) ? "*" : " "}| ${lines[n - 1] ?? ""}`;
+      size += line.length + 1;
+      if (size > bytes) {
+        out.push("     \u2026 (truncated)");
+        return out.join("\n");
+      }
+      out.push(line);
+    }
+  }
+  return out.join("\n");
+}
 var EXCERPT_SOURCE_CAP_BYTES = 512 * 1024;
 var LUNA_SCHEMA = {
   type: "object",
@@ -27012,7 +27038,8 @@ var LUNA_SCHEMA = {
 };
 var LUNA_INSTRUCTIONS = `You select SMALL pieces of code worth building a formal model of (a Lean 4 transition system with bounded exploration). The goal is to find bugs, not to model the codebase.
 For each file you are given its git-history signals and an excerpt. Score each 0-1 for "a model of one function here would likely expose a real bug": high for check-then-act guards, retries, caches, dedup keys, locks/leases, status transitions, money, concurrent writes; low for glue, rendering, configuration, or code whose correctness is obvious from reading.
-Name the single symbol (function) most worth modelling, and the applicable properties from the catalogue only. Reasons: at most 3, each a short concrete sentence about THIS code. Return every file you were given, exactly once.`;
+Name the single symbol (function) most worth modelling, and the applicable properties from the catalogue only. Reasons: at most 3, each a short concrete sentence about THIS code. Return every file you were given, exactly once.
+When a file lists \`changed\` lines, this is a review of a push: the excerpt is numbered around the changes (changed lines starred). Name the function that CONTAINS a changed line, and score THAT FUNCTION'S CURRENT CODE as a whole \u2014 how likely a model of it exposes a real bug \u2014 never the edit itself. A one-line change (a log line, a rename, a comment) to a function that checks then acts, retries, dedups, moves money, grants access or changes a status still scores high: the push touched risky code, and a latent bug in it is exactly what this is for. Score low only when the changed function is itself glue, wiring, command registration, rendering, configuration or plainly correct.`;
 var lunaRanker = {
   name: "luna",
   async rank(candidates2, ctx) {
@@ -27025,14 +27052,18 @@ var lunaRanker = {
     if (!apiKey) return { ok: false, ranker: "luna", error: "OPENAI_API_KEY is not set", ranked: fallback };
     const model = env.VERITY_PROVE_MODEL ?? "gpt-6-luna";
     const excerptBytes = ctx.excerptBytes ?? 6 * 1024;
-    const payload = candidates2.map((c) => ({
-      file: c.file,
-      commits: c.commits,
-      fix_commits: c.fixCommits,
-      risk: c.risk,
-      lines: c.lines,
-      excerpt: excerpt(ctx.root, c.file, excerptBytes)
-    }));
+    const payload = candidates2.map((c) => {
+      const changed = ctx.changedLines?.get(c.file);
+      return {
+        file: c.file,
+        commits: c.commits,
+        fix_commits: c.fixCommits,
+        risk: c.risk,
+        lines: c.lines,
+        excerpt: excerpt(ctx.root, c.file, excerptBytes, ctx.readSource, changed),
+        ...changed?.length ? { changed: changed.map((r) => r.from === r.to ? `${r.from}` : `${r.from}-${r.to}`).join(", ") } : {}
+      };
+    });
     const body = {
       model,
       reasoning: { effort: "low" },
@@ -27087,7 +27118,8 @@ async function rankViaServer(candidates2, ctx, auth2) {
         fix_commits: c.fixCommits,
         risk: c.risk,
         lines: c.lines,
-        excerpt: excerpt(ctx.root, c.file, excerptBytes, ctx.readSource)
+        excerpt: excerpt(ctx.root, c.file, excerptBytes, ctx.readSource, ctx.changedLines?.get(c.file)),
+        ...ctx.changedLines?.get(c.file)?.length ? { changed_lines: ctx.changedLines.get(c.file).slice(0, 50) } : {}
       })),
       ...ctx.hint ? { hint: ctx.hint.slice(0, 500) } : {}
     },
@@ -27389,6 +27421,46 @@ function lintModelSource(source) {
   return reasons.length ? { ok: false, reasons: [...new Set(reasons)] } : { ok: true };
 }
 
+// src/lib/prove/lean-format.ts
+function joinBrokenLiterals(source) {
+  const raw = source.split("\n");
+  const tok = tokenizeLean(source).code.split("\n");
+  if (raw.length !== tok.length) return source;
+  const outRaw = [];
+  let depth = 0;
+  let i = 0;
+  while (i < raw.length) {
+    let r = raw[i];
+    let t = tok[i];
+    i++;
+    for (; ; ) {
+      const d = depth + braceDelta(t);
+      const end = t.trimEnd();
+      if (!(d > 0 && end.endsWith(",") && i < raw.length)) break;
+      while (i < raw.length && tok[i].trim() === "") i++;
+      if (i >= raw.length) break;
+      const cut = end.length;
+      const nextRaw = raw[i];
+      const nextTok = tok[i];
+      const lead = nextTok.length - nextTok.trimStart().length;
+      r = r.slice(0, cut) + " " + nextRaw.slice(lead);
+      t = t.slice(0, cut) + " " + nextTok.slice(lead);
+      i++;
+    }
+    depth = Math.max(0, depth + braceDelta(t));
+    outRaw.push(r);
+  }
+  return outRaw.join("\n");
+}
+function braceDelta(code) {
+  let d = 0;
+  for (const ch of code) {
+    if (ch === "{") d++;
+    else if (ch === "}") d--;
+  }
+  return d;
+}
+
 // src/lib/prove/generate.ts
 var LIBRARY_API = `The Verity Lean 4 library (already built; \`import Verity\` is the ONLY import allowed):
 
@@ -27460,6 +27532,8 @@ var RULES = `Write ONE Lean 4 model of the code below, in the style of the exemp
 - 2 to 4 properties from this catalogue, all \`kind := .structural\`: idempotence, no lost update, status only moves forward, retries terminate, never fails open, bounded size, check-then-act is atomic, no double effect. Each \`inv\` must be a real claim the explorer can refute; no tautologies. Add an \`intent\` property ONLY if a comment in the source states the expectation, and cite its line in \`source\`.
 - The header: \`abstracts := [{ file, symbol, sha256, lines }]\` with the exact values given below (lines "" when none).
 - Exactly one \`#eval Verity.model\` and one \`#eval Verity.check\` per property, \`{ bound := 6 }\` or less. No other \`#eval\`, no \`IO\`, no \`sorry\`, no attributes, no macros, no \`partial\`. Under 120 lines.
+- Write every structure literal on ONE line: the \`abstracts\` entry, each \`{ s with \u2026 }\` update, each \`{ field := \u2026 }\` value. Lean reads a literal split across lines by its indentation and refuses it.
+- A property must be something the function PROMISES. Do not claim idempotence or no double effect for an operation whose job is to apply an effect on every call (a withdrawal, a charge, a send) unless the code dedups it (an idempotency key, a unique insert, an explicit check). When a trace needs a crash between two writes, say so in \`desc\` ("after a crash between X and Y, \u2026").
 - Imports beyond \`Verity\` are refused by a linter; a file that does not elaborate gets ONE more attempt with the compiler's message.
 Answer with JSON only: {"name": "<PascalCase>", "lean_source": "<the whole file>", "summary": "<one sentence: what the model abstracts and which property is most likely to fail>"}.`;
 var SCHEMA = {
@@ -27484,7 +27558,7 @@ function renderGenerateInput(t, previous) {
   parts.push("```");
   if (previous) {
     parts.push("");
-    parts.push("# Your previous attempt did not elaborate. Fix it (same model, same properties):");
+    parts.push("# Your previous attempt was not accepted \u2014 the diagnostics say why. Fix it (same model, same properties):");
     parts.push("```lean");
     parts.push(previous.source);
     parts.push("```");
@@ -27497,7 +27571,7 @@ function renderGenerateInput(t, previous) {
 }
 function acceptAnswer(parsed, usage, costUsd = null) {
   const name = typeof parsed.name === "string" && /^[A-Z][A-Za-z0-9]{1,40}$/.test(parsed.name) ? parsed.name : null;
-  const source = typeof parsed.lean_source === "string" ? parsed.lean_source.replace(/\r\n/g, "\n") : null;
+  const source = typeof parsed.lean_source === "string" ? joinBrokenLiterals(parsed.lean_source.replace(/\r\n/g, "\n")) : null;
   if (!name || !source) return { ok: false, error: "answer lacked a valid name or lean_source", usage, costUsd };
   const lint = lintModelSource(source);
   if (!lint.ok) return { ok: false, error: `linter refused the model: ${lint.reasons.join("; ")}`, usage, costUsd };
@@ -27510,12 +27584,15 @@ async function generateModel(target, opts) {
       path: "/prove/generate",
       serviceUrl: opts.auth.serviceUrl,
       token: opts.auth.token,
-      body: { target, ...opts.previous ? { previous: opts.previous } : {}, ...opts.budgetMs ? { budget_ms: Math.max(2e4, Math.round(opts.budgetMs)) } : {} },
+      // Streamed with a heartbeat so a long generation cannot die idle (decision 53).
+      extraHeaders: { "X-Verity-Keepalive": "1" },
+      body: { target, tier: opts.tier ?? "deep", ...opts.previous ? { previous: opts.previous } : {}, ...opts.budgetMs ? { budget_ms: Math.max(2e4, Math.round(opts.budgetMs)) } : {} },
       timeout: opts.budgetMs ? Math.max(2e4, Math.round(opts.budgetMs)) + 15e3 : opts.timeoutMs ?? 13e4,
       cmd: "prove-generate"
     });
     if (!res.ok) return { ok: false, error: res.error };
     const d = res.data ?? {};
+    if (d.error && typeof d.error === "object") return { ok: false, error: `${d.error.code ?? "SERVICE_ERROR"}: ${d.error.message ?? "the service failed"}` };
     const usage2 = d.usage && typeof d.usage === "object" ? { inputTokens: Number(d.usage.inputTokens ?? 0), outputTokens: Number(d.usage.outputTokens ?? 0) } : null;
     return acceptAnswer(d, usage2, typeof d.cost_usd === "number" ? d.cost_usd : null);
   }
@@ -27525,7 +27602,7 @@ async function generateModel(target, opts) {
   const fetchImpl = opts.fetchImpl ?? fetch;
   const baseUrl = opts.baseUrl ?? "https://api.openai.com/v1";
   const body = {
-    model: opts.model ?? "gpt-5.6-terra",
+    model: opts.model ?? (opts.tier === "fast" ? "gpt-6-luna" : "gpt-5.6-terra"),
     instructions: `${RULES}
 
 ${LIBRARY_API}
@@ -27535,7 +27612,7 @@ ${LIBRARY_API}
 ${EXEMPLAR}
 \`\`\``,
     input: [{ role: "user", content: renderGenerateInput(target, opts.previous) }],
-    reasoning: { effort: "medium" },
+    reasoning: { effort: opts.tier === "fast" ? "low" : "medium" },
     max_output_tokens: 12e3,
     store: false,
     text: { format: { type: "json_schema", name: "lean_model", schema: SCHEMA, strict: true } }
@@ -27963,6 +28040,8 @@ async function runReplayViaServer(brief, auth2, budgetMs = 24e4) {
       budget_ms: budget
     },
     timeout: budget + 15e3,
+    // Streamed with a heartbeat so a long replay cannot die idle (decision 53).
+    extraHeaders: { "X-Verity-Keepalive": "1" },
     cmd: "prove-replay"
   });
   const none = { covered: 0, total: 0, ratio: 0, basis: "none" };
@@ -27970,6 +28049,11 @@ async function runReplayViaServer(brief, auth2, budgetMs = 24e4) {
     return { claimed: null, verdict: "unverified", reason: "", downgrade: res.error, executedCalls: 0, shellCalls: 0, verbatim: none, executedOutput: "", harnessFiles: [], usage: null, durationMs: Date.now() - started, containerId: null, error: res.error };
   }
   const d = res.data ?? {};
+  if (d.error && typeof d.error === "object") {
+    const e = d.error;
+    const msg = `${e.code ?? "SERVICE_ERROR"}: ${e.message ?? "the service failed"}`;
+    return { claimed: null, verdict: "unverified", reason: "", downgrade: msg, executedCalls: 0, shellCalls: 0, verbatim: none, executedOutput: "", harnessFiles: [], usage: null, durationMs: Date.now() - started, containerId: null, error: msg };
+  }
   const verdict = d.verdict;
   const v = typeof d.verbatim === "object" && d.verbatim ? d.verbatim : none;
   return {
@@ -28929,7 +29013,7 @@ function writeResult(root, report) {
 
 // src/lib/prove/auto.ts
 var AUTO_MODELS_DIR = `${MODELS_DIR}/.auto`;
-var DEFAULT_MIN_SCORE = 0.7;
+var DEFAULT_MIN_SCORE = 0.75;
 var LARGE_PUSH_FILES = 25;
 var DAILY_MODEL_CAP = 5;
 var PUSH_COST_CAP_USD = 1;
@@ -29007,7 +29091,11 @@ function bumpLedger(root) {
   const l = readLedger(root);
   writeLedger(root, { ...l, models: l.models + 1 });
 }
-var REPLAY_RESERVE_MS = 75e3;
+var REPLAY_RESERVE_MS = 45e3;
+var MAX_REPLAYS = 3;
+function isNetworkError(message) {
+  return /Network error|fetch failed|ETIMEDOUT|ECONNRESET|ECONNREFUSED|EAI_AGAIN|socket hang up/i.test(message);
+}
 var GENERATE_RESERVE_MS = 4e4;
 function workingTreeReader(root) {
   return (file, maxBytes) => {
@@ -29021,8 +29109,9 @@ function sha256Of(content) {
 function defaultDeps(opts) {
   const env = opts.env ?? process.env;
   return {
-    rank: (candidates2, root) => lunaRanker.rank(candidates2, { root, auth: opts.auth, env, fetchImpl: opts.fetchImpl, readSource: opts.readSource }),
-    generate: (target, previous, budgetMs) => generateModel(target, { auth: opts.auth, apiKey: opts.apiKey, env, fetchImpl: opts.fetchImpl, previous, ...budgetMs ? { budgetMs } : {} }),
+    rank: (candidates2, root, changedLines) => lunaRanker.rank(candidates2, { root, auth: opts.auth, env, fetchImpl: opts.fetchImpl, readSource: opts.readSource, ...changedLines ? { changedLines } : {} }),
+    // The push phase writes with the FAST tier; `prove generate` asks for DEEP (decision 56).
+    generate: (target, previous, budgetMs) => generateModel(target, { auth: opts.auth, apiKey: opts.apiKey, env, fetchImpl: opts.fetchImpl, previous, tier: opts.tier ?? "fast", ...budgetMs ? { budgetMs } : {} }),
     check: (root, modelFile) => checkModelAsync(opts.toolchain, root, modelFile),
     replay: (root, report, property, modelSource, budgetMs) => runReplay(buildReplayBrief(root, report, property, modelSource, opts.readSource), { auth: opts.auth, apiKey: opts.apiKey, env, fetchImpl: opts.fetchImpl, maxRounds: 2, ...budgetMs ? { timeoutMs: budgetMs } : {} }),
     now: () => Date.now(),
@@ -29107,33 +29196,56 @@ async function runFormalPhase(input) {
     const best = signals[0];
     return done({ status: "skipped", skip: "not-eligible", detail: `${best.file}: ${isEligible(best, largePush).why}` });
   }
-  const ranked = await deps.rank(eligible, root);
+  const ranked = await deps.rank(eligible, root, input.changedLines);
   if (ranked.ok) spend(ranked);
   if (cancelled()) return done({ status: "skipped", skip: "deadline", detail: "cut off after ranking" });
-  const top = ranked.ranked.find((c) => c.ai && c.ai.score >= (input.minScore ?? DEFAULT_MIN_SCORE));
-  if (!top || !top.ai) return done({ status: "skipped", skip: "no-candidate", detail: ranked.ok ? `best score ${Math.round((ranked.ranked[0]?.ai?.score ?? 0) * 100)}% of ${eligible.length} eligible` : `rank unavailable: ${ranked.error ?? ""}` });
-  if (!top.ai.symbol) return done({ status: "skipped", skip: "no-symbol", detail: top.file });
-  const read = readSrc(top.file, 96 * 1024);
-  if (!read.ok) return done({ status: "skipped", skip: "read-failed", detail: `${top.file}: ${read.reason}` });
-  const sha256 = sha256Of(read.content);
-  const body = extractSymbolBody(read.content, top.ai.symbol, top.file);
-  let lines;
-  let numbered;
-  if (body) {
-    const from = read.content.split("\n").findIndex((_, i, arr) => arr.slice(i, i + body.split("\n").length).join("\n") === body) + 1;
-    lines = from > 0 ? { from, to: from + body.split("\n").length - 1 } : void 0;
-    numbered = numberLines(body, from > 0 ? from : 1);
-  } else {
-    numbered = numberLines(read.content.slice(0, 24 * 1024));
+  const minScore = input.minScore ?? DEFAULT_MIN_SCORE;
+  const qualified = ranked.ranked.filter((c) => c.ai && c.ai.score >= minScore);
+  if (qualified.length === 0) return done({ status: "skipped", skip: "no-candidate", detail: ranked.ok ? `best score ${Math.round((ranked.ranked[0]?.ai?.score ?? 0) * 100)}% of ${eligible.length} eligible` : `rank unavailable: ${ranked.error ?? ""}` });
+  let chosen = null;
+  let why = null;
+  const note = (skip, detail) => {
+    if (!why) why = { skip, detail };
+  };
+  for (const c of qualified) {
+    if (!c.ai?.symbol) {
+      note("no-symbol", c.file);
+      continue;
+    }
+    const read = readSrc(c.file, 96 * 1024);
+    if (!read.ok) {
+      note("read-failed", `${c.file}: ${read.reason}`);
+      continue;
+    }
+    const d = describeTarget(read.content, c.ai.symbol, c.file);
+    if (input.changedLines) {
+      const changed = input.changedLines.get(c.file) ?? [];
+      if (changed.length === 0) {
+        note("symbol-not-in-push", `${c.file}: no changed lines in this push`);
+        continue;
+      }
+      if (!d.lines) {
+        note("symbol-not-in-push", `${c.ai.symbol}: body not found, cannot tell whether the push touched it`);
+        continue;
+      }
+      if (!intersects(d.lines, changed)) {
+        note("symbol-not-in-push", `${c.ai.symbol} (lines ${d.lines.from}\u2013${d.lines.to}) unchanged by this push`);
+        continue;
+      }
+    }
+    chosen = { top: c, content: read.content, lines: d.lines, numbered: d.numbered };
+    break;
   }
+  if (!chosen || !chosen.top.ai) {
+    const first = qualified[0];
+    const t0 = first.ai?.symbol ? { file: first.file, symbol: first.ai.symbol, score: first.ai.score, reasons: [...first.reasons, ...first.ai.reasons] } : void 0;
+    return done({ status: "skipped", skip: why?.skip ?? "no-symbol", detail: why?.detail ?? first.file, ...t0 ? { target: t0 } : {} });
+  }
+  const top = chosen.top;
+  const sha256 = sha256Of(chosen.content);
+  const { lines, numbered } = chosen;
   const target = { file: top.file, symbol: top.ai.symbol, lines, score: top.ai.score, reasons: [...top.reasons, ...top.ai.reasons] };
   progress.target = target;
-  if (input.changedLines) {
-    const changed = input.changedLines.get(top.file) ?? [];
-    if (changed.length === 0) return done({ status: "skipped", skip: "symbol-not-in-push", detail: `${top.file}: no changed lines in this push`, target });
-    if (!lines) return done({ status: "skipped", skip: "symbol-not-in-push", detail: `${top.ai.symbol}: body not found, cannot tell whether the push touched it`, target });
-    if (!intersects(lines, changed)) return done({ status: "skipped", skip: "symbol-not-in-push", detail: `${top.ai.symbol} (lines ${lines.from}\u2013${lines.to}) unchanged by this push`, target });
-  }
   if (timeLeft() < GENERATE_RESERVE_MS) return done({ status: "skipped", skip: "not-enough-time", detail: `${Math.round(timeLeft() / 1e3)} s left before generation`, target });
   bumpLedger(root);
   const genTarget = { file: top.file, symbol: top.ai.symbol, lines, sha256, numbered, reasons: target.reasons, properties: top.ai.properties };
@@ -29150,8 +29262,11 @@ async function runFormalPhase(input) {
     spend(gen);
     if (cancelled()) return done({ status: "skipped", skip: "deadline", detail: "cut off during generation", target });
     if (!gen.ok) {
-      if (round === 2 || !/linter refused/.test(gen.error)) return done({ status: "skipped", skip: "generation-failed", detail: gen.error, target });
-      previous = { source: "", error: gen.error };
+      const network = isNetworkError(gen.error);
+      if (round === 2 || !(network || /linter refused/.test(gen.error)) || timeLeft() < GENERATE_RESERVE_MS) {
+        return done({ status: "skipped", skip: "generation-failed", detail: gen.error, target });
+      }
+      if (!network) previous = { source: "", error: gen.error };
       continue;
     }
     modelName = gen.name;
@@ -29184,27 +29299,51 @@ async function runFormalPhase(input) {
     writeResult(root, report);
   } catch {
   }
-  let replays = 0;
-  for (const p of report.properties) {
-    if (p.result !== "counterexample") continue;
-    const base = { property: p.id, desc: p.desc, kind: p.kind, trace: p.trace ?? [], file: top.file, symbol: top.ai.symbol };
-    if (replays >= (input.maxReplays ?? 2) || timeLeft() < REPLAY_RESERVE_MS) {
-      findings.push({ ...base, verdict: "model-only" });
-      continue;
-    }
-    if (overCap()) {
-      findings.push({ ...base, verdict: "model-only", reason: `not replayed: $${usage.costUsd.toFixed(2)} spent, cap $${costCap.toFixed(2)}` });
-      continue;
+  const cexes = report.properties.filter((p) => p.result === "counterexample");
+  const baseOf = (p) => ({ property: p.id, desc: p.desc, kind: p.kind, trace: p.trace ?? [], file: top.file, symbol: top.ai.symbol });
+  const maxReplays = input.maxReplays ?? MAX_REPLAYS;
+  let skipWhy = null;
+  if (timeLeft() < REPLAY_RESERVE_MS) skipWhy = `not replayed: ${Math.round(timeLeft() / 1e3)} s left`;
+  else if (overCap()) skipWhy = `not replayed: $${usage.costUsd.toFixed(2)} spent, cap $${costCap.toFixed(2)}`;
+  else if (cancelled()) skipWhy = "not replayed: the phase was cut off";
+  const toReplay = skipWhy ? [] : cexes.slice(0, maxReplays);
+  const budget = Math.max(2e4, timeLeft() - 5e3);
+  const byId = /* @__PURE__ */ new Map();
+  let stoppedEarly = false;
+  await new Promise((resolve8) => {
+    let left = toReplay.length;
+    if (left === 0) return resolve8();
+    const settle = () => {
+      if (--left === 0) resolve8();
+    };
+    for (const p of toReplay) {
+      void (async () => {
+        if (cancelled()) {
+          byId.set(p.id, null);
+          return;
+        }
+        const r = await deps.replay(root, report, p, modelSource.ok ? modelSource.content : "", budget);
+        spend(r);
+        if (!stoppedEarly) byId.set(p.id, r);
+        if (r.verdict === "reproduced" && !stoppedEarly) {
+          stoppedEarly = true;
+          resolve8();
+        }
+      })().catch(() => {
+        byId.set(p.id, null);
+      }).finally(settle);
     }
-    if (cancelled()) {
-      findings.push({ ...base, verdict: "model-only", reason: "not replayed: the phase was cut off" });
+  });
+  const replayedIds = new Set(toReplay.map((p) => p.id));
+  for (const p of cexes) {
+    const r = byId.get(p.id);
+    if (!r) {
+      const reason = skipWhy ?? (replayedIds.has(p.id) && byId.has(p.id) ? "not replayed: the phase was cut off" : replayedIds.has(p.id) ? "not waited for: another counterexample already reproduced" : `not replayed: ${maxReplays} per push`);
+      findings.push({ ...baseOf(p), verdict: "model-only", reason });
       continue;
     }
-    replays++;
-    const r = await deps.replay(root, report, p, modelSource.ok ? modelSource.content : "", Math.max(2e4, timeLeft() - 5e3));
-    spend(r);
     const verdict = r.verdict === "reproduced" ? "reproduced" : r.verdict === "diverged" ? "diverged" : r.verdict === "unreplayable" ? "model-only" : "unverified";
-    findings.push({ ...base, verdict, reason: r.reason || r.downgrade || void 0 });
+    findings.push({ ...baseOf(p), verdict, reason: r.reason || r.downgrade || void 0 });
   }
   const reproduced = findings.filter((f) => f.verdict === "reproduced");
   if (reproduced.length > 0 && !cancelled()) {
@@ -29223,6 +29362,63 @@ async function runFormalPhase(input) {
     findings
   });
 }
+function describeTarget(content, symbol, file, range) {
+  const all = content.split("\n");
+  if (range) {
+    const from2 = Math.max(1, range.from);
+    const to = Math.min(all.length, range.to);
+    return { lines: { from: from2, to }, numbered: numberLines(all.slice(from2 - 1, to).join("\n"), from2) };
+  }
+  const body = extractSymbolBody(content, symbol, file);
+  if (!body) return { numbered: numberLines(content.slice(0, 24 * 1024)) };
+  const n = body.split("\n").length;
+  const from = all.findIndex((_, i) => all.slice(i, i + n).join("\n") === body) + 1;
+  return { lines: from > 0 ? { from, to: from + n - 1 } : void 0, numbered: numberLines(body, from > 0 ? from : 1) };
+}
+async function generateAndCheck(root, req, opts) {
+  const readSrc = opts.deps.readSource ?? workingTreeReader(root);
+  const read = readSrc(req.file, 96 * 1024);
+  if (!read.ok) return { ok: false, error: `${req.file}: ${read.reason}`, rounds: 0, costUsd: 0 };
+  const sha256 = sha256Of(read.content);
+  const { lines, numbered } = describeTarget(read.content, req.symbol, req.file, req.lines);
+  const target = {
+    file: req.file,
+    symbol: req.symbol,
+    lines,
+    sha256,
+    numbered,
+    reasons: req.hint ? [`the user's worry, in their words: ${req.hint.slice(0, 280)}`] : [],
+    properties: []
+  };
+  const dir = opts.modelsDir ?? MODELS_DIR;
+  const maxRounds = opts.maxRounds ?? 3;
+  let previous = req.revise ? { source: req.revise.source, error: `The model elaborated, but its counterexample DIVERGED when replayed on the real code: ${req.revise.note.slice(0, 2e3)}. Revise the model so it matches what the code does; keep the same properties.` } : void 0;
+  let costUsd = 0;
+  let lastError = "no attempt";
+  for (let round = 1; round <= maxRounds; round++) {
+    const gen = await opts.deps.generate(target, previous);
+    if (typeof gen.costUsd === "number") costUsd += gen.costUsd;
+    if (!gen.ok) {
+      lastError = gen.error;
+      const network = isNetworkError(gen.error);
+      if (!network && !/linter refused/.test(gen.error)) return { ok: false, error: gen.error, rounds: round, costUsd };
+      if (!network) previous = { source: "", error: gen.error };
+      continue;
+    }
+    const rel = `${dir}/${gen.name}.lean`;
+    writeFileInRootNoFollow(root, rel, gen.source);
+    const abs = resolveModelFile(root, rel) ?? (0, import_node_path41.join)(root, rel);
+    const report = await opts.deps.check(root, abs);
+    const abstracts = report.header?.abstracts ?? [];
+    const stray = abstracts.find((a) => a.file !== req.file);
+    if (report.ok && report.properties.length > 0 && abstracts.length > 0 && !stray) {
+      return { ok: true, name: gen.name, file: rel, report, rounds: round, costUsd };
+    }
+    lastError = stray ? `the model abstracts ${stray.file}, not ${req.file}` : report.error ?? (report.malformed ? "the model printed malformed VERITY lines" : "the model reported no property");
+    previous = { source: gen.source, error: lastError };
+  }
+  return { ok: false, error: `no model of ${req.symbol} elaborated in ${maxRounds} round(s): ${lastError.slice(0, 300)}`, rounds: maxRounds, costUsd };
+}
 function skippedOutcome(skip, detail) {
   return { status: "skipped", skip, ...detail ? { detail } : {}, findings: [], usage: { inputTokens: 0, outputTokens: 0, costUsd: 0, unpriced: 0 }, durationMs: 0 };
 }
@@ -29283,6 +29479,9 @@ function describeFormalOutcome(o) {
 }
 
 // src/lib/prove/merge.ts
+function isCrashTrace(trace) {
+  return trace.some((s) => /\b(crash\w*|kill\w*|restart\w*|interrupt\w*|power|abort\w*|process (dies|exit\w*)|lost (reply|response))\b/i.test(s));
+}
 function mergeFormalFindings(response, outcome, pushedFiles) {
   if (!outcome) return { blocking: 0 };
   const norm = (p) => p.replace(/\\/g, "/");
@@ -29298,7 +29497,11 @@ function mergeFormalFindings(response, outcome, pushedFiles) {
       scope: "change",
       file: f.file,
       line: outcome.target?.lines?.from ?? null,
-      title: `Formal: ${terminalText(f.desc, 300)} \u2014 reproduced on the real code (${terminalText(f.symbol, 128)})`,
+      // Worded as the VIOLATION: the property text is what should hold, and
+      // as a title it read backwards (e2e, 2026-09-26). A trace that needs a
+      // crash between two writes is labelled: reproducing it means injecting
+      // the crash, so it is a crash-consistency finding, not a race.
+      title: `Formal: ${terminalText(f.symbol, 128)} breaks "${terminalText(f.desc, 280)}"${isCrashTrace(f.trace) ? " after a crash (crash consistency)" : ""} \u2014 reproduced on the real code`,
       description: terminalText(f.reason ?? "", 2e3),
       fix: { description: `Trace: ${terminalText(f.trace.join(" \u2192 ") || "(initial state)", 2e3)}. Replay: ${terminalText(f.reason ?? "reproduced in the container", 2e3)}` },
       source: "formal"
@@ -31036,13 +31239,6 @@ async function promptYes(question, opts) {
   const a = answer.toLowerCase();
   return a === "" || a === "y" || a === "yes";
 }
-async function promptYesDefaultNo(question) {
-  if (!interactive()) return false;
-  const answer = await ask(question);
-  if (answer === null) return false;
-  const a = answer.toLowerCase();
-  return a === "y" || a === "yes";
-}
 function printOptions(question, choices) {
   console.log("");
   console.log(`  ${question}`);
@@ -31162,6 +31358,32 @@ async function download(url, dest, onProgress) {
   });
   await (0, import_promises18.pipeline)(stream, (0, import_node_fs60.createWriteStream)(dest));
 }
+function inPlaceProgress(label2, write = (s) => process.stderr.write(s)) {
+  let active = false;
+  let lastAt = 0;
+  let lastPct = -1;
+  const mb = (n) => (n / 1048576).toFixed(0);
+  return {
+    update(seen, total) {
+      const now = Date.now();
+      const pct = total ? Math.min(100, Math.floor(seen / total * 100)) : -1;
+      if (now - lastAt < 100 && pct !== 100 && pct === lastPct) return;
+      lastAt = now;
+      lastPct = pct;
+      active = true;
+      const width = 24;
+      const filled = pct >= 0 ? Math.round(pct / 100 * width) : 0;
+      const bar = "\u2588".repeat(filled) + "\u2591".repeat(width - filled);
+      const tail = total ? `${String(pct).padStart(3)}%  ${mb(seen)}/${mb(total)} MB` : `${mb(seen)} MB`;
+      write(`\r\x1B[2K${GREEN}[verity]${NC}   ${label2}  ${bar}  ${tail}`);
+    },
+    done() {
+      if (!active) return;
+      active = false;
+      write("\n");
+    }
+  };
+}
 async function installLean(opts = {}) {
   const say = opts.onStatus ?? (() => {
   });
@@ -31180,6 +31402,7 @@ async function installLean(opts = {}) {
   let lastPct = -1;
   try {
     await download(url, zip, (seen, total) => {
+      if (opts.onProgress) return opts.onProgress(seen, total);
       const pct = total ? Math.floor(seen / total * 100) : -1;
       if (pct !== lastPct && pct % 10 === 0) {
         lastPct = pct;
@@ -31478,6 +31701,10 @@ var INTENSITY_CHOICES = [
   { id: "balanced", label: "balanced", hint: "security + quality (~8s)", recommended: true },
   { id: "thorough", label: "thorough", hint: "all tools, all rules (~15s)" }
 ];
+var FORMAL_CHOICES = [
+  { id: "yes", label: "yes", hint: "a Lean model of the riskiest changed function; blocks only on a REPRODUCED counterexample", recommended: true },
+  { id: "no", label: "no", hint: "enable later with: verity config formal push" }
+];
 var MOMENT_CHOICES = [
   { id: "stop", label: "On stop", hint: "after every agent turn \u2014 fast feedback while you work", recommended: true },
   { id: "pre-commit", label: "Before commit", hint: "reviews the staged diff, blocks the commit on FAIL" },
@@ -31804,7 +32031,7 @@ async function checkPrerequisites(step) {
   }
   return prereqs.checks.some((c) => c.id === "claude" && c.status === "ok");
 }
-async function scaffoldProject(step, defaultsOnly) {
+async function scaffoldProject(step, defaultsOnly, pluginMode) {
   step("Knowledge base, .gitignore and CLAUDE.md");
   await (0, import_promises20.mkdir)(VERITY_DIR, { recursive: true });
   await ensureMemoryDir();
@@ -31859,9 +32086,9 @@ async function scaffoldProject(step, defaultsOnly) {
   } catch (err) {
     printWarn(`  Could not update CLAUDE.md: ${err.message}`);
   }
-  await offerFormalVerification(defaultsOnly);
+  await offerFormalVerification(defaultsOnly, pluginMode);
 }
-async function offerFormalVerification(defaultsOnly) {
+async function offerFormalVerification(defaultsOnly, pluginMode) {
   const cfg = readProjectConfig();
   const toolchain = findToolchain();
   if (cfg.formal === "push") {
@@ -31869,19 +32096,25 @@ async function offerFormalVerification(defaultsOnly) {
     else printWarn("  Formal verification is on but Lean is missing \u2014 run: verity lean install");
     return;
   }
-  if (defaultsOnly) {
-    printInfo("  Formal verification (Lean models of risky code at push): off \u2014 enable with: verity config formal push");
+  if (defaultsOnly || !interactive()) {
+    printInfo("  Formal verification (a model-based bug finder at push): off \u2014 enable with: verity config formal push");
     return;
   }
-  const wants = await promptYesDefaultNo(
-    `  Enable formal verification at push? Verity writes a Lean model of the riskiest changed code, checks it here, and replays counterexamples on the real code \u2014 the changed function's source is sent to the Verity service and to OpenAI's container for that (uses your Verity login)${toolchain ? "" : `; downloads Lean 4: ${LEAN_DOWNLOAD_SIZE}`} [y/N] `
-  );
-  if (!wants) {
+  console.log("");
+  console.log("  Formal verification review \u2014 a model-based bug finder for your riskiest code.");
+  console.log("    At push, Verity picks the riskiest changed function, checks a small model of");
+  console.log("    it, and replays any counterexample on the real code (its source is sent to");
+  console.log("    Verity for that). Only a reproduced bug can block; most pushes get no model.");
+  console.log(`    Adds /verity-prove <worry> to check any code on demand.${toolchain ? "" : ` Needs to install Lean 4 (${LEAN_DOWNLOAD_SIZE}) on "yes".`}`);
+  console.log("");
+  const wants = await promptChoice("Formal verification at push?", FORMAL_CHOICES, "yes");
+  if (wants === "yes" && pluginMode) printInfo("  Plugin: the push check works now; /verity:verity-prove arrives with the plugin's next release.");
+  if (wants !== "yes") {
     printInfo("  Formal verification: off (enable later with: verity config formal push)");
     return;
   }
   if (!toolchain) {
-    const result = await installLean({ onStatus: (line) => printInfo(`  ${line}`) });
+    const result = await installLeanWithProgress();
     if (!result.ok) {
       printWarn(`  Lean install failed: ${result.error} \u2014 formal verification left off; retry with: verity lean install`);
       return;
@@ -31891,6 +32124,18 @@ async function offerFormalVerification(defaultsOnly) {
   writeProjectConfig({ formal: "push" });
   printInfo("  Formal verification at push \u2713 (this checkout; `verity config formal off` turns it off)");
 }
+async function installLeanWithProgress() {
+  const progress = process.stderr.isTTY ? inPlaceProgress(`downloading ${leanAssetName() ?? "Lean 4"}`) : null;
+  const result = await installLean({
+    onStatus: (line) => {
+      progress?.done();
+      printInfo(`  ${line}`);
+    },
+    ...progress ? { onProgress: progress.update } : {}
+  });
+  progress?.done();
+  return result;
+}
 function registerInitCommand(program2) {
   program2.command("init").alias("setup").description("Set up Verity in the current project (asks the setup questions, then hands off to /verity-setup)").option("--force", "Reinstall the skills even when they are already up to date (hooks are always reconciled)").option("-y, --yes", "Take the recommended answer for every question (no prompts)").option("--no-setup", "Skip the /verity-setup handoff at the end").option(
     "--plugin-mode",
@@ -32001,7 +32246,7 @@ function registerInitCommand(program2) {
     if (defaultsOnly) {
       printInfo(`  intensity: ${intensity} \xB7 moments: ${moments.join(", ") || "none"} (no questions asked)`);
     }
-    await scaffoldProject(step, defaultsOnly);
+    await scaffoldProject(step, defaultsOnly, pluginMode);
     const globalVerityDir = (0, import_node_path46.join)(process.env.HOME ?? "", ".verity");
     await (0, import_promises20.mkdir)(globalVerityDir, { recursive: true });
     console.log("");
@@ -32101,7 +32346,7 @@ function registerInitCommand(program2) {
         ...telemetryChoice ? { telemetry: telemetryChoice } : {},
         init: {
           completed_at: (/* @__PURE__ */ new Date()).toISOString(),
-          cli_version: true ? "0.33.3-experimental.52f1656" : "dev"
+          cli_version: true ? "0.33.3-experimental.86b5b6f" : "dev"
         }
       });
     } catch (err) {
@@ -33026,6 +33271,124 @@ function registerTelemetryCommands(program2) {
 // src/commands/prove.ts
 var import_node_fs66 = require("node:fs");
 var import_node_path49 = require("node:path");
+
+// src/lib/prove/hint-pool.ts
+var STOP2 = /* @__PURE__ */ new Set([
+  "about",
+  "worried",
+  "worry",
+  "worries",
+  "that",
+  "this",
+  "with",
+  "from",
+  "into",
+  "code",
+  "function",
+  "functions",
+  "functionality",
+  "feature",
+  "features",
+  "logic",
+  "module",
+  "file",
+  "files",
+  "when",
+  "what",
+  "does",
+  "could",
+  "should",
+  "would",
+  "have",
+  "been",
+  "being",
+  "will",
+  "just",
+  "like",
+  "also",
+  "very",
+  "really",
+  "make",
+  "sure",
+  "check",
+  "verify",
+  "prove",
+  "test",
+  "tests",
+  "bugs",
+  "issue",
+  "issues",
+  "race",
+  "races",
+  "there",
+  "here",
+  "some",
+  "their",
+  "your",
+  "them",
+  "they",
+  "think",
+  "want",
+  "need",
+  "please",
+  "something",
+  "anything",
+  "part",
+  "around"
+]);
+function hintKeywords(hint) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const raw of hint.toLowerCase().match(/[a-z][a-z0-9_-]{3,}/g) ?? []) {
+    const forms = [raw];
+    if (raw.length > 4 && raw.endsWith("s")) forms.push(raw.slice(0, -1));
+    for (const w of forms) {
+      if (STOP2.has(w) || seen.has(w)) continue;
+      seen.add(w);
+      out.push(w);
+    }
+  }
+  return out.slice(0, 8);
+}
+function hintMatches(root, hint, max = 30) {
+  const keywords = hintKeywords(hint);
+  if (keywords.length === 0) return { keywords, files: [] };
+  const ls = runGitSync(root, ["ls-files", "-z", "--", "."], { timeoutMs: 3e4 });
+  const tracked = ls.ok ? ls.stdout.split("\0").filter((f) => f && isCandidateSource(f)) : [];
+  const files = [];
+  const seen = /* @__PURE__ */ new Set();
+  const add = (f) => {
+    if (seen.has(f) || !isCandidateSource(f)) return;
+    seen.add(f);
+    files.push(f);
+  };
+  for (const f of tracked) if (keywords.some((k) => f.toLowerCase().includes(k))) add(f);
+  for (const k of keywords) {
+    if (files.length >= max) break;
+    const res = runGitSync(root, ["grep", "-i", "-l", "-e", k, "--", "."], { timeoutMs: 3e4 });
+    if (!res.ok) continue;
+    for (const f of res.stdout.split("\n")) if (f) add(f);
+  }
+  return { keywords, files: files.slice(0, max) };
+}
+
+// src/lib/prove/pool.ts
+async function mapPool(items, limit, fn) {
+  const out = new Array(items.length);
+  let next = 0;
+  const worker = async () => {
+    while (next < items.length) {
+      const i = next++;
+      out[i] = await fn(items[i]);
+    }
+  };
+  await Promise.all(Array.from({ length: Math.max(1, Math.min(limit, items.length)) }, worker));
+  return out;
+}
+
+// src/commands/prove.ts
+var HINT_POOL_MAX = 20;
+var REPLAY_CONCURRENCY = 3;
 async function proveAuth(program2) {
   const globals = program2.opts();
   const token = await resolveToken(globals.token);
@@ -33043,7 +33406,19 @@ function registerProveCommand(program2) {
       process.exit(2);
     }
     const limit = Math.max(1, Math.min(50, Number(opts.limit) || 10));
-    const signals = collectRiskSignals(root, { since: opts.since, limit, paths: paths.map((p) => (0, import_node_path49.relative)(root, (0, import_node_path49.resolve)(p)) || ".") });
+    let signals = collectRiskSignals(root, { since: opts.since, limit, paths: paths.map((p) => (0, import_node_path49.relative)(root, (0, import_node_path49.resolve)(p)) || ".") });
+    if (opts.hint && paths.length === 0) {
+      const hit = hintMatches(root, opts.hint);
+      if (hit.files.length > 0) {
+        const byFile = new Map(collectRiskSignals(root, { since: opts.since, limit: hit.files.length, paths: hit.files }).map((s) => [s.file, s]));
+        const named = hit.files.map((f) => byFile.get(f)).filter((s) => !!s);
+        const seen = new Set(named.map((s) => s.file));
+        signals = [...named, ...signals.filter((s) => !seen.has(s.file))].slice(0, HINT_POOL_MAX);
+        if (!opts.json) printInfo(`hint: ${hit.keywords.join(", ")} \u2192 ${Math.min(named.length, HINT_POOL_MAX)} file(s) named by path or content lead the pool of ${signals.length}`);
+      } else if (!opts.json && hit.keywords.length > 0) {
+        printInfo(`hint: no file names or contents match ${hit.keywords.join(", ")}; ranking the history pool`);
+      }
+    }
     const outcome = await ranker.rank(signals, { root, hint: opts.hint, auth: await proveAuth(program2) ?? void 0 });
     if (!outcome.ok) printWarn(`${outcome.ranker} ranker unavailable (${outcome.error}); showing the deterministic order`);
     if (opts.json) {
@@ -33179,12 +33554,10 @@ ${report.error ?? ""}`);
       return;
     }
     const modelSource = readRegularFileInRoot(root, (0, import_node_path49.relative)(root, file), 512 * 1024);
-    const outcomes = [];
-    for (const p of targets) {
+    if (!opts.json) printInfo(`replaying ${targets.length} counterexample(s) of ${model} in network-less containers (${Math.min(targets.length, REPLAY_CONCURRENCY)} at a time)\u2026`);
+    const outcomes = await mapPool(targets, REPLAY_CONCURRENCY, async (p) => {
       const brief = buildReplayBrief(root, report, p, modelSource.ok ? modelSource.content : "");
-      if (!opts.json) printInfo(`replaying ${model} ${p.id} (${p.trace?.length ?? 0} steps) in a network-less container\u2026`);
       const outcome = await runReplay(brief, { auth: auth2 ?? void 0, apiKey: process.env.OPENAI_API_KEY, model: opts.modelName, timeoutMs: Math.max(1e4, Number(opts.timeout) || 24e4) });
-      outcomes.push({ property: p.id, outcome });
       if (!opts.json) process.stdout.write(renderReplay(model, p, outcome) + "\n");
       try {
         writeReplayResult(root, report.model, p.id, outcome);
@@ -33192,7 +33565,8 @@ ${report.error ?? ""}`);
         if (!(err instanceof SafeWriteError)) throw err;
         printWarn(`${err.message} \u2014 replay result not saved`);
       }
-    }
+      return { property: p.id, outcome };
+    });
     if (opts.json) printJson({ model, replays: outcomes.map((o) => ({ property: o.property, ...toStoredReplay(o.outcome) })) });
     if (outcomes.some((o) => o.outcome.error)) process.exit(2);
     if (outcomes.some((o) => o.outcome.verdict !== "reproduced")) process.exit(1);
@@ -33228,6 +33602,74 @@ ${f.reason ? `      ${terminalText(f.reason, 2e3)}
     }
     process.exit(outcome.findings.some((f) => f.verdict === "reproduced") ? 1 : 0);
   });
+  prove.command("generate <target>").description("Have the Verity service write a Lean model of one symbol (file#symbol), lint it, and check it here \u2014 up to 3 rounds").option("--lines <a-b>", "Model a region of the file (1-based, inclusive) instead of a named symbol").option("--hint <text>", "The user's worry, in their words (may become an intent property)").option("--revise <model>", "Revise this existing model after a diverged replay (with --note)").option("--note <text>", "What the replay showed was different (with --revise)").option("--json", "Machine-readable output").action(async (targetArg, opts) => {
+    const root = repoRoot();
+    const auth2 = await proveAuth(program2);
+    if (!auth2 && !(process.env.VERITY_PROVE_DIRECT === "1" && process.env.OPENAI_API_KEY)) {
+      printError("Not logged in \u2014 models are written by the Verity service. Run `verity login` first.");
+      process.exit(2);
+    }
+    const tc = findToolchain();
+    if (!tc) {
+      printError(INSTALL_HINT);
+      process.exit(2);
+    }
+    const hash = targetArg.indexOf("#");
+    const file = (hash >= 0 ? targetArg.slice(0, hash) : targetArg).replace(/\\/g, "/");
+    const symbol = hash >= 0 ? targetArg.slice(hash + 1) : "";
+    let lines;
+    if (opts.lines) {
+      const m = /^(\d+)-(\d+)$/.exec(opts.lines);
+      if (!m || Number(m[1]) < 1 || Number(m[2]) < Number(m[1])) {
+        printError("--lines must be a-b with 1 \u2264 a \u2264 b");
+        process.exit(2);
+      }
+      lines = { from: Number(m[1]), to: Number(m[2]) };
+    }
+    if (!file || !symbol && !lines) {
+      printError("Target is file#symbol, or file with --lines a-b");
+      process.exit(2);
+    }
+    let revise;
+    if (opts.revise) {
+      const existing = resolveModelFile(root, opts.revise);
+      const src = existing ? readRegularFileInRoot(root, (0, import_node_path49.relative)(root, existing), 64 * 1024) : null;
+      if (!src || !src.ok || !opts.note) {
+        printError('--revise needs an existing model under Models/ and --note "<what the replay showed>"');
+        process.exit(2);
+      }
+      revise = { source: src.content, note: opts.note };
+    }
+    refreshScaffold(root);
+    const build = buildLibrary(tc, root);
+    if (!build.ok) {
+      printError("Verity library did not build");
+      process.exit(2);
+    }
+    const deps = defaultDeps({ auth: auth2 ?? void 0, apiKey: process.env.VERITY_PROVE_DIRECT === "1" ? process.env.OPENAI_API_KEY : void 0, toolchain: tc, tier: "deep" });
+    if (!opts.json) printInfo(`asking the Verity service for a model of ${symbol || `${file}:${opts.lines}`} \u2026`);
+    const out = await generateAndCheck(root, { file, symbol: symbol || `${file}:${opts.lines}`, lines, hint: opts.hint, revise }, { deps, maxRounds: 3 });
+    if (!out.ok) {
+      if (opts.json) printJson(out);
+      else printError(`${out.error} (${out.rounds} round(s)${out.costUsd ? `, $${out.costUsd.toFixed(2)}` : ""}) \u2014 write the model by hand (Models/README.md) or narrow the target`);
+      process.exit(2);
+    }
+    try {
+      writeResult(root, out.report);
+    } catch (err) {
+      if (!(err instanceof SafeWriteError)) throw err;
+    }
+    if (opts.json) {
+      printJson({ name: out.name, file: out.file, rounds: out.rounds, cost_usd: out.costUsd, report: { ...out.report, passes: reportPasses(out.report), summary: summarize(out.report) } });
+      return;
+    }
+    printInfo(`wrote ${out.file} (${out.rounds} round(s)${out.costUsd ? `, $${out.costUsd.toFixed(2)}` : ""})`);
+    process.stdout.write(renderReport(out.report) + "\n");
+    const s = summarize(out.report);
+    if (s.counterexamples > 0) process.stdout.write(`${DIM}next: verity prove replay ${out.name}${NC}
+`);
+    process.exit(0);
+  });
   prove.command("waive <file>").description("Dismiss the remembered formal finding(s) on a file for its current bytes \u2014 the accepted-risk path for a formal block").requiredOption("--reason <text>", "The human disposition this records (reviewer finding, ADR, \u2026)").action((file, opts) => {
     const root = repoRoot();
     const rel0 = (0, import_node_path49.relative)(root, (0, import_node_path49.isAbsolute)(file) ? file : (0, import_node_path49.join)(root, file)).replace(/\\/g, "/");
@@ -33338,7 +33780,15 @@ function registerLeanCommand(program2) {
         return;
       }
     }
-    const result = await installLean({ onStatus: (line) => printInfo(line) });
+    const progress = process.stderr.isTTY ? inPlaceProgress(`downloading ${asset}`) : null;
+    const result = await installLean({
+      onStatus: (line) => {
+        progress?.done();
+        printInfo(line);
+      },
+      ...progress ? { onProgress: progress.update } : {}
+    });
+    progress?.done();
     if (!result.ok) {
       printError(result.error);
       process.exit(2);
@@ -33358,8 +33808,8 @@ function registerLeanCommand(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.33.3-experimental.52f1656").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
-  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.33.3-experimental.52f1656");
+program.name("verity").description("CLI for Verity quality gate service").version("0.33.3-experimental.86b5b6f").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
+  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.33.3-experimental.86b5b6f");
   setUserNamedServiceUrl(program.opts().serviceUrl);
   try {
     await foldLegacyLocalCredential();

package/data/skills/verity-prove/SKILL.md

@@ -1,174 +1,135 @@
 ---
 description: >-
-  Formally verify a small, risky piece of code with a Lean 4 model: pick candidates from git
-  history, CONFIRM with the user which code to model, write the model, run it locally with
-  `verity prove check`, and replay any counterexample on the real code before calling it a bug.
-  Use when the user asks to verify, prove, or model-check code, or asks "can this race / double
-  run / fail open?". Anything typed after /verity-prove is the user's hint: the file, function,
-  or worry to check.
+  Formally verify a small, risky piece of code with a Lean 4 model written by the
+  Verity service: rank candidates from git history and the user's hint, CONFIRM with
+  the user which code to model, have the service generate the model, check it locally
+  with `verity prove check`, and replay any counterexample on the real code before
+  calling it a bug. Use when the user asks to verify, prove, or model-check code, or
+  asks "can this race / double run / fail open?". Anything typed after /verity-prove
+  is the user's hint: the file, function, or worry to check.
 ---
 # /verity-prove — Formal verification of small pieces of code
 
 **The words after `/verity-prove` are the hint.** `/verity-prove` alone means "find me
 something worth checking"; `/verity-prove can the Stripe webhook double-charge on a
-redelivered event?` means that is the target and, if it is a worry, the property.
-Carry it through every step below as `$ARGUMENTS`.
+redelivered event?` names the target and the worry. Carry it through every step as
+`$ARGUMENTS`.
 
-Verity keeps **Lean 4 models of the riskiest code**, not of the codebase. A model is
-another tool for finding bugs: a few dozen lines that abstract ONE function and check
-a few properties by exhaustive bounded search. When a property fails you get the
-**shortest sequence of actions** that breaks it — a hypothesis to replay on the real
-code. When it holds you know exactly how far it was checked.
+Verity keeps **Lean 4 models of the riskiest code**, not of the codebase: a few dozen
+lines that abstract ONE function and check a few properties by exhaustive bounded
+search. When a property fails you get the **shortest sequence of actions** that breaks
+it — a hypothesis to replay on the real code.
 
-This skill is the **explicit, user-driven** entry; nothing in it blocks a commit or a
-push. (The push-time phase — `verity config formal push` — is a separate, opt-in path
-that uses the same tools.) Lean runs on this machine because the user asked for it.
+**The service does the work; you orchestrate and present.** Ranking, writing the model
+and replaying its counterexample all run on the Verity service through the CLI. You
+do not search the codebase by hand, read the Lean library, or write Lean yourself
+unless a step below says so. Each step is one command; read its output, decide, move on.
+Lean runs on this machine only because the user asked for it; nothing here blocks a
+commit or a push.
 
 ## The flow
 
-### 1. Find what deserves a model
+### 1. Candidates — one command
 
 ```bash
-verity prove candidates --limit 8            # git history + risk signals
-verity prove candidates --rank luna --json   # + a cheap model re-ranks and names a symbol
-verity prove candidates src/payments         # scoped to a path
+verity prove candidates --hint "$ARGUMENTS" --json    # hint given
+verity prove candidates --limit 8 --json              # no hint
 ```
 
-Each candidate says why: fix commits over commits, check-then-act, retries, caches,
-locks/leases, status transitions, money.
+The hint **widens the pool** (files it names by path or content come first) and the
+service ranks it, naming a symbol and the properties worth checking per file. Do not
+search for the code yourself: if the ranker's list does not contain what the user
+meant, say so and ask them for the file or function. A named file or function in the
+hint skips ranking: go straight to step 2 with it.
 
-**With a hint** (`$ARGUMENTS` non-empty) — a file, a function, or a worry in the user's
-own words ("can the webhook double-charge?", "does the retry ever lose the feedback?"):
+### 2. Confirm with the user — always
 
-```bash
-verity prove candidates --hint "$ARGUMENTS"
-```
+**Do not generate a model until the user has said which code.** Present at most three
+candidates in one short message: file, the symbol the ranker named, the first property
+it suggested, the reason. Ask. Their answer is the scope; do not widen it. If the hint
+is a worry in the user's words, it becomes an `intent` property — that needs no further
+confirmation, they just gave it.
 
-A named file or function skips the ranking entirely: go to step 2 with it. A *worry*
-becomes an `intent` property in step 4, with `source := "user, <date>: <their words>"`;
-it needs no further confirmation, they just gave it. The candidates list is still shown,
-so the user sees what else the history says — but the hint decides.
+A hint that names the code, or a candidate the user saw in an earlier session, is
+**not** a confirmation of the exact symbol and property. Still ask, in one line:
+"I'll model `<file>#<symbol>` for `<property>` — go ahead?" It costs the user one word.
 
-### 2. Confirm with the user — always
+### 3. Set up once per repo
 
-**Do not write a model until the user has said which code.** Present at most three
-candidates in one short message, each as: file, the function you would model, the
-property you would check first, and the reason from the signals. Then ask. The user may
-pick one, name something else, or narrow the property. Their answer is the scope; do not
-widen it.
+```bash
+verity prove init
+```
 
-A model is a claim about what the code *means*. Only the person who owns the code can
-say whether that claim is worth checking.
+If Lean is missing, say what will be installed and where before running
+`verity lean install` (official release, ≈800 MB download, 2.7 GB on disk, into
+`~/.verity/lean`). Everything else needs only `verity login`.
 
-### 3. Set up the project (once per repo)
+### 4. Generate the model — one command
 
 ```bash
-verity prove init
+verity prove generate src/pay.ts#charge --hint "$ARGUMENTS"
+verity prove generate src/handler.ts --lines 120-180 --hint "$ARGUMENTS"   # a region
 ```
 
-Creates `.verity/proofs/` — a Lake project with Verity's library (`Verity.System`,
-`Verity.check`, a bounded explorer). Re-running refreshes the library and never touches
-`Models/`. If Lean is missing, install it only after telling the user what will be
-installed and where: `verity lean install` (official release, ≈800 MB download, 2.7 GB
-on disk, into `~/.verity/lean`). Ranking (`--hint`, `--rank luna`) and `verity prove
-replay` run on the Verity service with the user's login (`verity login`); without a
-login, ranking is deterministic and replay is by hand (step 6.2).
-
-### 4. Write the model — `Models/<Name>.lean`
-
-Rules that keep models small and honest:
-
-- **One symbol.** The header names it: `Verity.model { name, abstracts := [{ file, symbol, sha256 }] }`.
-  Get the hash with `verity prove hash <file>`. `verity prove check` reports drift when the file changes.
-  When the code is a *region* rather than a named function (a branch inside a large
-  handler), add `lines := "a-b"` (1-based, inclusive) — `verity prove replay` needs it
-  to know which real lines must run.
-- **State = only what the property reads.** Actions = the operations that can interleave
-  (a retry, a second call, a concurrent writer). Steps = what the code does, not what it should.
-- **Properties are tagged.** `kind := .structural` for the catalogue (idempotence, no lost
-  update, status only moves forward, retries terminate, never fails open, bounded size,
-  check-then-act is atomic, no double effect). `kind := .intent` **only** when a human
-  wrote the expectation down — a doc comment, an ADR, a ticket, a Standard rule — and
-  `source :=` cites it. Never invent intent.
-- **End with the checks.** `#eval Verity.model …` then one `#eval Verity.check …` per
-  property (bounded exploration), `Verity.checkData` for input properties, `Verity.proved`
-  only beside a real theorem. `sorry` fails the run.
-- Keep it under ~120 lines. If it wants more, the scope is wrong — go back to step 2.
-
-`Models/README.md` has the skeleton; `cli/tests/fixtures/proofs/SeedRunner.lean` in
-Verity's own repo is a worked example (the VRT-243 seed-duplication bug).
-
-### 5. Check it
+The service writes the model, the linter fences it, this machine elaborates it, with
+up to **3** rounds on compiler errors — all inside the command. It prints the check:
+per property `✓ holds to bound k`, `✗ COUNTEREXAMPLE` with the trace, or `? inconclusive`.
+Only if it ends with "no model elaborated" do you write one by hand from
+`.verity/proofs/Models/README.md` (one symbol, ≤ ~120 lines, `#eval Verity.model …`
+header, one `#eval Verity.check …` per property, tagged `.structural` or `.intent` with
+`source :=`); check it with `verity prove check <Name>`.
+
+### 5. Replay before you call it a bug — one command
 
 ```bash
-verity prove check <Name>          # one model
-verity prove check                 # every model
-verity prove check <Name> --json   # for scripts
+verity prove replay <Name>                 # every counterexample
+verity prove replay <Name> --property P2   # one
 ```
 
-Per property: `✓ holds to bound k`, `✓ proved`, `✗ COUNTEREXAMPLE` with the trace and
-the state after each step, or `? inconclusive` (state cap).
-
-**Hard caps — never loop:**
-- elaboration errors: at most **3** fix rounds, then stop and say the model could not be
-  built;
-- a counterexample that **diverges** on replay (the model was wrong about the code): at
-  most **2** model revisions, each naming what the replay showed was different; after
-  that, stop and report "no faithful model found for `<symbol>`" — that is a valid result;
-- never weaken or delete a property to make it pass; never add a property to make
-  something fail.
-
-A wrong model is expected some of the time. It costs a replay and is discarded; it never
-costs a false bug, because only a *reproduced* counterexample is reported (step 6).
-
-### 6. Replay before you call it a bug
-
-A counterexample is a fact about the **model**. Before reporting a bug:
-
-1. Run the replay in OpenAI's disposable container (network off, deleted afterwards):
-
-   ```bash
-   verity prove replay <Name>                 # every counterexample
-   verity prove replay <Name> --property P2   # one
-   ```
-
-   It hands a model the trace, the Lean file and the real source — the abstracted
-   file's content leaves the machine for the Verity service and OpenAI's container;
-   only git-tracked files are ever read — and requires three things before accepting
-   its answer: code actually ran (a shell call with output), the real function's lines
-   appear verbatim in what it wrote, and the harness itself printed
-   `REPLAY_RESULT=reproduced`. `REPRODUCED` → the
-   real code does this. `DIVERGED` → the model is wrong about the code. `UNVERIFIED` →
-   not evidence either way. `UNREPLAYABLE` → it could not run the function faithfully.
-   Read its reason: the stubs it chose are where a false reproduction hides.
-2. When the replay is unverified or unreplayable — or the code needs a runtime the
-   container lacks (Deno edge functions, a real database) — replay by hand: read the
-   real function again, map every trace action to a real call, and reproduce it with a
-   throwaway harness in a scratch directory that loads the real module and stubs only
-   I/O boundaries. **Never edit the user's source files to do this.**
-3. Reproduced → report it as a bug, with the trace and the reproduction. Not reproduced
-   → the model is wrong (`model-divergence`): say so, fix the model, do not report a bug.
-
-This is the rule Verity applies everywhere (memory: *replay formal counterexamples
-against changed code before blocking*). A model that finds a bug in itself is noise.
-
-### 7. Report, in a few lines
-
-State what was modelled, what was checked to what bound, what was refuted and whether
-it replayed, and what remains `intent` awaiting the user's confirmation. **Never offer
-to commit the model** — `.verity/proofs/` is machine-local and ignores itself; models
-would only confuse reviewers. What reaches the team is the bug report and, when asked,
-the fix. Then record the outcome:
+The service replays the trace on the real code in a network-less container and accepts
+an answer only when code ran, the real function's lines appear verbatim in the harness,
+and the harness itself printed `REPLAY_RESULT=reproduced`. A model's counterexamples
+replay in parallel, so the command takes about as long as one replay (~30 s). **Run it
+in the foreground and wait for it**: do not background it, do other work, or report
+before every verdict is in. Read the verdict:
+
+- **REPRODUCED** — the real code does this. **This is final: do not replay by hand
+  as well.** Report it as a bug (step 6).
+- **DIVERGED** — the model is wrong about the code. Revise it **at most twice**, each
+  time saying what the replay showed:
+  `verity prove generate <target> --revise <Name> --note "<what the replay showed>"`,
+  then replay again. After two divergences, report "no faithful model found for
+  `<symbol>`" — that is a valid result, not a bug.
+- **UNVERIFIED / UNREPLAYABLE** — not evidence either way. Only now replay by hand:
+  a throwaway harness in a scratch directory that loads the real module and stubs only
+  I/O boundaries **in memory**. Never edit the user's source files, and never read from
+  or write to the user's databases, services or local stacks to do this — ask first if
+  a stub cannot be faithful.
+
+Never weaken or delete a property to get green; never add one to make something fail.
+
+### 6. Report, in a few lines
+
+What was modelled, what was checked to what bound, what was refuted and whether it
+replayed, and what remains `intent` awaiting the user's confirmation. **Never offer to
+commit the model** — `.verity/proofs/` is machine-local and ignores itself. What reaches
+the team is the bug report and, when asked, the fix. Then record the outcome:
 
 ```bash
 verity reflect --user-input "Modelled runSeed (cli/src/lib/seed-runner.ts): P1 at-most-once refuted in 2 steps, replayed — guard checks a path the server never writes." --kind gotcha
 ```
 
+The abstracted file's content leaves the machine for the Verity service and its
+replay container; only git-tracked files are ever read.
+
 ## Do not
 
+- Search the codebase yourself before the ranker has answered, or instead of asking the user.
 - Model code the user did not confirm.
-- Present a model-only counterexample as a bug.
-- Put `sorry` in a model, or weaken a property to get green.
-- Touch source files, run Lean from a hook, or install anything silently.
+- Write Lean by hand while `verity prove generate` can still try.
+- Replay by hand after a REPRODUCED verdict, or present a model-only counterexample as a bug.
+- Background `verity prove replay`, or report before its verdicts are in.
+- Write to the user's databases or local services, even throwaway rows.
+- Put `sorry` in a model, weaken a property to get green, or touch source files.
+- Run Lean from a hook, or install anything silently.
 - Commit, stage, or un-ignore anything under `.verity/proofs/`.
-- Model a whole module. If the state has more than ~6 fields, narrow it.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/verity-cli",
-  "version": "0.33.3-experimental.52f1656",
+  "version": "0.33.3-experimental.86b5b6f",
   "description": "CLI for Verity quality gate service",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://verity.md",