@codacy/verity-cli 0.33.3-experimental.911f315 → 0.33.3-experimental.aea5331

package/bin/verity.js

@@ -27021,7 +27021,7 @@ function channelSilence(input) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.33.3-experimental.911f315" : "dev";
+    return true ? "0.33.3-experimental.aea5331" : "dev";
   } catch {
     return "dev";
   }
@@ -27856,11 +27856,11 @@ var rootCandidateCache = /* @__PURE__ */ new Map();
 function candidateRoots(repoRoot2) {
   const cached2 = rootCandidateCache.get(repoRoot2);
   if (cached2) return cached2;
-  const norm = repoRoot2.replace(/\\/g, "/").replace(/\/+$/, "");
-  const out2 = [norm];
+  const norm2 = repoRoot2.replace(/\\/g, "/").replace(/\/+$/, "");
+  const out2 = [norm2];
   try {
-    const real = import_node_fs42.realpathSync.native(norm).replace(/\\/g, "/").replace(/\/+$/, "");
-    if (real !== norm) out2.push(real);
+    const real = import_node_fs42.realpathSync.native(norm2).replace(/\\/g, "/").replace(/\/+$/, "");
+    if (real !== norm2) out2.push(real);
   } catch {
   }
   for (const r of [...out2]) {
@@ -33555,6 +33555,47 @@ function collectRiskSignals(root, opts = {}) {
   return out2.slice(0, opts.limit ?? 10);
 }
 
+// src/lib/prove/grounding.ts
+var BASIS_RULES = ["conservation", "once", "no-lost-update", "fail-closed", "progress"];
+var RULE = /^rule:([a-z-]+)$/;
+var LINE = /^(?:([^\s:]+):)?L?(\d{1,6})(?::\s*|\s+)(?:comment\s+)?([\s\S]+)$/;
+var norm = (s) => s.replace(/\s+/g, " ").trim().toLowerCase();
+function basisOf(source2, files) {
+  const s = source2.trim();
+  const r = RULE.exec(s);
+  if (r) return BASIS_RULES.includes(r[1]) ? { ok: true, basis: s } : { ok: false, why: `"rule:${r[1]}" is not one of the rules` };
+  const m = LINE.exec(s);
+  if (!m) return { ok: false, why: s ? `"${s.slice(0, 60)}" is neither L<n>: <words> nor a rule` : "no source" };
+  const path = m[1];
+  const n = Number(m[2]);
+  const quoted = m[3].trim().replace(/^["'`“”]+|["'`“”]+$/g, "");
+  const fragments = quoted.split(/…|\.\.\./).map(norm).filter((f) => f.length >= 4);
+  if (fragments.length === 0) return { ok: false, why: `L${n}: too few words to find on the line` };
+  const pool = path ? [...files].filter(([f]) => f === path || f.endsWith(`/${path}`)).map(([, c]) => c) : [...files.values()];
+  if (path && pool.length === 0) return { ok: false, why: `${path} is not one of the given files` };
+  for (const content of pool) {
+    const line2 = content.split("\n")[n - 1];
+    if (line2 !== void 0 && fragments.every((f) => norm(line2).includes(f))) return { ok: true, basis: `L${n}: ${quoted.slice(0, 120)}` };
+  }
+  return { ok: false, why: `line ${n} does not contain "${quoted.slice(0, 60)}"` };
+}
+var NOT_A_MENTION = "(?<!\\b(?:even|including|also|or) )";
+var UNTIL_FIRST = "(?:(?!\\bor\\b)[^,.;:]){0,60}?";
+var NEEDS_FAILURE = new RegExp(`${NOT_A_MENTION}\\b(?:after|when|if|once|on)\\b${UNTIL_FIRST}\\b(?:fails?|failed|errors?|throws?|times? out|timed out|rejects?|rejected|is unavailable|is down)\\b|${NOT_A_MENTION}\\bon (?:an? )?(?:error|failure|timeout)\\b|\\ba failed\\b`);
+var NEEDS_CRASH = new RegExp(`${NOT_A_MENTION}\\b(?:after|when|if|on)\\b${UNTIL_FIRST}\\bcrash`);
+var HAS_FAILURE = /fail|error|throw|time[sd]?[\s_-]*out|reject|exception|unavailable|\bdown\b|\bis down/i;
+var HAS_CRASH = /crash|die|kill|abort|restart/i;
+function missingTrigger(desc, trace) {
+  const d = desc.toLowerCase();
+  const t = trace.join(" ");
+  if (NEEDS_CRASH.test(d) && !HAS_CRASH.test(t)) return "a crash";
+  if (NEEDS_FAILURE.test(d) && !HAS_FAILURE.test(t)) return "a failure";
+  return null;
+}
+function ungroundedMessage(list2) {
+  return `These properties do not say what they rest on \u2014 ${list2}. Set each property's \`source\` to "L<n>: <words copied from that line>" (a line of the numbered source that states the promise) or one rule: ${BASIS_RULES.map((r) => `rule:${r}`).join(", ")}. Drop a property nothing supports; keep the model otherwise the same.`;
+}
+
 // src/lib/prove/ranker.ts
 var STRUCTURAL_CATALOGUE = [
   "idempotence",
@@ -34121,6 +34162,8 @@ var MAX_CONTEXT_EFFECTS = 20;
 var MAX_CO_ACCESSORS = 2;
 var MAX_HELPERS2 = 3;
 var MAX_CONTEXT_LINES = 120;
+var MAX_CALLERS2 = 3;
+var MAX_CALLER_LINES = 9;
 var MAX_HELPER_LINES = 80;
 var MAX_CONTEXT_BYTES = 48 * 1024;
 var LIBRARY_API = `The Verity Lean 4 library (already built; \`import Verity\` is the ONLY import allowed):
@@ -34180,7 +34223,7 @@ def model : Model :=
   { name := "SeedRunner"
     abstracts := [ { file := "cli/src/lib/seed-runner.ts", symbol := "runSeed", sha256 := "<sha256>" } ] }
 
-def P1 : Property := { id := "P1", kind := .structural, desc := "seeding runs at most once: posts never exceed 1" }
+def P1 : Property := { id := "P1", kind := .structural, desc := "seeding runs at most once: posts never exceed 1", source := "rule:once" }
 
 #eval Verity.model model
 #eval Verity.check model P1 sys (fun s => s.posts \u2264 1) { bound := 4 }
@@ -34240,8 +34283,8 @@ def model : Model :=
   { name := "Withdraw"
     abstracts := [ { file := "src/accounts/withdraw.ts", symbol := "withdraw", sha256 := "<sha256>", lines := "5-12" } ] }
 
-def P1 : Property := { id := "no_overdraft_under_concurrent_withdrawals", kind := .structural, desc := "two concurrent withdrawals never pay out more than the balance held: the balance check and the debit act as one step" }
-def P2 : Property := { id := "balance_matches_payouts", kind := .structural, desc := "once both calls are done, the balance plus everything paid out equals the starting balance (no lost update)" }
+def P1 : Property := { id := "no_overdraft_under_concurrent_withdrawals", kind := .structural, desc := "two concurrent withdrawals never pay out more than the balance held: the balance check and the debit act as one step", source := "rule:conservation" }
+def P2 : Property := { id := "balance_matches_payouts", kind := .structural, desc := "once both calls are done, the balance plus everything paid out equals the starting balance (no lost update)", source := "rule:no-lost-update" }
 
 #eval Verity.model model
 #eval Verity.check model P1 sys (fun s => s.paidOut \u2264 10) { bound := 6 }
@@ -34264,7 +34307,7 @@ def model : Model :=
   { name := "Split"
     abstracts := [ { file := "src/payouts/split.ts", symbol := "splitPayout", sha256 := "<sha256>", lines := "4-8" } ] }
 
-def P1 : Property := { id := "parts_sum_to_total", kind := .structural, desc := "the parts of a payout always add up to the total paid out" }
+def P1 : Property := { id := "parts_sum_to_total", kind := .structural, desc := "the parts of a payout always add up to the total paid out", source := "rule:conservation" }
 
 #eval Verity.model model
 #eval Verity.checkData model P1 [(100, [1, 1, 1]), (2, [1, 1, 1]), (10, [1, 2]), (7, [3, 4])] (fun (x : Nat \xD7 List Nat) => (split x.1 x.2).foldl (fun a b => a + b) 0 == x.1)
@@ -34295,6 +34338,8 @@ STEP 3 \u2014 Properties: 2 to 4, in this order of priority:
   A counterexample must run the real function: a trace made only of environment moves (another writer, a clock) says nothing about this code. A promise about the END result (nothing lost, nothing charged twice, totals add up) is checked on states where every invocation has finished or crashed \u2014 guard the \`inv\` with the program counters, as exemplar 2's second property does; a violation that exists only while work is still pending is not a bug.
   A property is about an OUTCOME someone would call a bug \u2014 money, stock or records wrong, access granted, work lost or done twice, a job stuck forever \u2014 never about the mechanism's internals (a key's format, two timestamps being distinct, a lease's exact boundary tick). A comment that says HOW the code works ("make each attempt's key unique") is not the promise; the promise is what that mechanism is for.
   A comment that states a SAFE design choice ("a spent token presented again ends every session", "consumers dedupe, so publishing twice is harmless") is the design: never claim the opposite. A comment never makes an UNSAFE outcome safe: granting access on an error, losing or double-counting money, stock or records is a bug whatever the comment says ("don't block people when the permission service is flaky" describes a fail-open bug).
+  Every property says what it rests on, in \`source\`: either \`L<n>: <words copied from that line>\` \u2014 a line of the numbered source above (a comment, docstring, check, error message or name) that states the promise \u2014 or one rule: \`rule:conservation\` (money, stock or counts add up), \`rule:once\` (no double effect: where the code dedups, or where the same input can arrive twice \u2014 a webhook or queue message redelivered, a client or job retry \u2014 even when the code has no dedup at all; a missing dedup is the bug, not a reason to drop the property), \`rule:no-lost-update\`, \`rule:fail-closed\` (an error never grants access or reports success), \`rule:progress\` (nothing stuck forever). A property that neither a line nor one of these rules supports is not a promise: do not state it. A property whose \`source\` is empty, or cites words its line does not contain, sends the model back.
+  When the input lists where the function is called, a caller's guard bounds its inputs: never build a counterexample from an input no caller can pass (an empty list a caller refuses).
   Property ids name the promise in snake_case (refund_total_within_capture) \u2014 never P1. \`desc\` states the promise in the code's own terms and names the move the trace needs ("two concurrent calls \u2026", "after the charge succeeded and the call timed out \u2026").
   A PURE computation (no effect sites) is checked with \`Verity.checkData\` on small concrete inputs, including the edge cases (exemplar 3).
 
@@ -34434,6 +34479,10 @@ ${t.effects.slice(0, MAX_CONTEXT_EFFECTS).map((e) => `  ${e}`).join("\n")}`);
     parts2.push("", "# Helpers it calls (their effects happen at the line that calls them)");
     for (const h of t.helpers.slice(0, MAX_HELPERS2)) parts2.push("", `## ${h.file} \u2014 \`${h.symbol}\` (lines ${h.lines.from}\u2013${h.lines.to})`, "```", h.numbered, "```");
   }
+  if (t.callers?.length) {
+    parts2.push("", "# Where it is called (a caller's guard bounds the inputs it can get)");
+    for (const c of t.callers.slice(0, MAX_CALLERS2)) parts2.push("", `## ${c.file}:${c.line}${c.caller ? ` \u2014 in \`${c.caller}\`` : ""}`, "```", c.numbered, "```");
+  }
   if (previous) {
     parts2.push("", "# Your previous attempt was not accepted \u2014 the diagnostics say why. Fix it (same model, same properties):", "```lean", previous.source.slice(0, 32 * 1024), "```", "Diagnostics:", "```", previous.error.slice(0, 4e3), "```");
   }
@@ -34668,11 +34717,10 @@ Rules:
    - A deadlock or a hang: run under a timeout (asyncio.wait_for, Promise.race with a timer) and treat the timeout as the observation.
    The harness must CALL the real function: a trace replayed on the stubs alone is not a reproduction \u2014 answer unreplayable.
 4. COMPUTE the verdict in the harness: print the observable state after each action; let every timer, promise and retry the trace did not crash or cancel run to completion; then evaluate the property on the final real state AS ITS DESCRIPTION STATES \u2014 the harm it names, including what must happen first ("after X fails", "after a crash", "two concurrent calls"): a run that never does that thing has not violated it. Drive the code only with inputs its own callers in the source can pass. Print exactly one line, REPLAY_RESULT=reproduced when the property is violated or REPLAY_RESULT=diverged when it holds \u2014 chosen by an if/else or a conditional expression in the harness, never a fixed string.
-5. CONTROL: in the same harness, on fresh stub state, run the same calls WITHOUT the trace's hazard \u2014 two concurrent invocations one after the other, in each order; an injected failure, crash, redelivery, retry or time jump left out. Evaluate the same property on each control's final state and print exactly one line, REPLAY_CONTROL=holds when it holds in every control or REPLAY_CONTROL=violated when any control violates it, again from an if/else. When the trace has no such move (a pure computation on an input), print REPLAY_CONTROL=none. A violation the control shows too is the code's ordinary behaviour, not the bug the trace claims.
-6. Write the harness as ONE file and run it in the SAME shell call that writes it (a heredoc followed by the run). TypeScript: node --experimental-strip-types harness.ts (detect runtimes only if that fails: node --version, python3 --version); if strip-types is unavailable, remove type annotations ONLY on lines that are not part of the function under test's logic, and say so. Python: python3 harness.py.
-7. Nothing you run can reach the network. Do not try.
-8. Keep it under about eight shell calls. Output tokens are time.
-9. Answer with the JSON object only: verdict (reproduced | diverged | unreplayable), reason (2-4 sentences: what you ran, what the real code did, and how that compares to the trace's final state), harness_files (every file you wrote: path and its line count \u2014 do NOT paste contents, your shell calls already carry them), executed_output (the last relevant stdout, at most 2000 characters).
+5. Write the harness as ONE file and run it in the SAME shell call that writes it (a heredoc followed by the run). TypeScript: node --experimental-strip-types harness.ts (detect runtimes only if that fails: node --version, python3 --version); if strip-types is unavailable, remove type annotations ONLY on lines that are not part of the function under test's logic, and say so. Python: python3 harness.py.
+6. Nothing you run can reach the network. Do not try.
+7. Keep it under about eight shell calls. Output tokens are time.
+8. Answer with the JSON object only: verdict (reproduced | diverged | unreplayable), reason (2-4 sentences: what you ran, what the real code did, and how that compares to the trace's final state), harness_files (every file you wrote: path and its line count \u2014 do NOT paste contents, your shell calls already carry them), executed_output (the last relevant stdout, at most 2000 characters).
 
 "reproduced" means the real code, driven by the trace, reached the property violation the model describes. "diverged" means it did not \u2014 the model is wrong about the code, which is a useful answer. "unreplayable" means you could not run the real function faithfully; say why.`;
 var REPLAY_SCHEMA = {
@@ -34775,15 +34823,6 @@ function printedResult(outputTexts) {
   return last;
 }
 var RESULT_MISSING = "the harness never printed REPLAY_RESULT=reproduced on its own stdout \u2014 the verdict was the model's word, not the run's";
-var CONTROL_LINE2 = /REPLAY_CONTROL=(holds|violated|none)\b/g;
-function printedControl(outputTexts) {
-  let last = null;
-  for (const t of outputTexts) for (const m of t.matchAll(CONTROL_LINE2)) last = m[1];
-  return last;
-}
-var CONTROL_MISSING = "the harness never printed REPLAY_CONTROL \u2014 a reproduction counts only beside a control run of the same calls without the hazard";
-var FIXED_CONTROL = 'the harness printed a fixed control line \u2014 it never contains the "violated" outcome, so the control was not computed from a run';
-var CONTROL_VIOLATED = "the property fails in the control run too (the same calls without the trace's hazard): the violation is ordinary behaviour, not the bug the trace claims \u2014 the model misreads the code";
 var FIXED_VERDICT = 'the harness printed a fixed verdict \u2014 it never contains the "diverged" outcome, so the result line was not computed from the real run';
 var CONTAINER_RETRY_BACKOFF_MS = [1e3, 3e3];
 function judgeReplay(brief, parsed) {
@@ -34827,14 +34866,6 @@ function judgeReplay(brief, parsed) {
   if (claimed === "reproduced" && primary && harnessInvokes(texts, primary.symbol, /\.py$/.test(primary.file), copied) === false) {
     return { claimed, verdict: "unverified", reason: parsed.claim.reason, downgrade: NOT_INVOKED, verbatim };
   }
-  if (claimed === "reproduced") {
-    const control = printedControl(parsed.outputTexts);
-    if (control === null) return { claimed, verdict: "unverified", reason: parsed.claim.reason, downgrade: CONTROL_MISSING, verbatim };
-    if (control === "violated") return { claimed, verdict: "diverged", reason: parsed.claim.reason, downgrade: CONTROL_VIOLATED, verbatim };
-    if (control === "holds" && !texts.some((t) => t.split("\n").some((l) => !copied.has(l.trim()) && l.includes("violated")))) {
-      return { claimed, verdict: "unverified", reason: parsed.claim.reason, downgrade: FIXED_CONTROL, verbatim };
-    }
-  }
   return { claimed, verdict: claimed, reason: parsed.claim.reason, downgrade: null, verbatim };
 }
 async function runReplayInContainer(brief, opts) {
@@ -34954,8 +34985,7 @@ async function runReplayInContainer(brief, opts) {
       const v = judged2.verbatim;
       const fixedVerdict = judged2.downgrade === FIXED_VERDICT;
       const notInvoked = judged2.downgrade === NOT_INVOKED;
-      const controlMissing = judged2.downgrade === CONTROL_MISSING || judged2.downgrade === FIXED_CONTROL;
-      const resultMissing = judged2.downgrade === RESULT_MISSING || fixedVerdict || notInvoked || controlMissing;
+      const resultMissing = judged2.downgrade === RESULT_MISSING || fixedVerdict || notInvoked;
       if (!resultMissing && (v.total === 0 || v.ratio >= (v.basis === "symbol" ? VERBATIM_THRESHOLD_SYMBOL : VERBATIM_THRESHOLD_FILE))) break;
       const region = brief.sources[0];
       const what = region ? `\`${region.symbol}\`${region.lines ? ` (lines ${region.lines.from}\u2013${region.lines.to})` : ""} of ${region.file}` : "the function under test";
@@ -34963,8 +34993,6 @@ async function runReplayInContainer(brief, opts) {
 
 ` + renderBriefInput(brief) : fixedVerdict ? `Your previous attempt in this same container was NOT accepted: the harness prints a FIXED verdict \u2014 it never contains the "diverged" outcome, so the result line was not computed from the run. The files you created are still present. Make the harness evaluate the property's condition on the final real state and print REPLAY_RESULT=reproduced or REPLAY_RESULT=diverged from an if/else, run it, and answer with what it printed.
 
-` + renderBriefInput(brief) : controlMissing ? `Your previous attempt in this same container was NOT accepted: ${judged2.downgrade}. The files you created are still present. Add the control run (rule 5): the same calls on fresh stub state without the trace's hazard, printing REPLAY_CONTROL=holds or REPLAY_CONTROL=violated from an if/else (REPLAY_CONTROL=none only for a pure computation). Run it and answer with what it printed.
-
 ` + renderBriefInput(brief) : resultMissing ? `Your previous attempt in this same container was NOT accepted: you answered "reproduced" but no shell output contained the line REPLAY_RESULT=reproduced. The files you created are still present. Run the harness again so that it prints REPLAY_RESULT=reproduced or REPLAY_RESULT=diverged as the last line of its own stdout, then answer with what it printed.
 
 ` + renderBriefInput(brief) : `Your previous attempt in this same container was NOT accepted: only ${v.covered} of the ${v.total} significant lines of the real ${v.basis} appeared verbatim in what you wrote` + (last.parsed.claim ? ` (you answered "${last.parsed.claim.verdict}")` : "") + `. The files you created are still present. Rewrite the harness so that ${what} is copied in FULL, line for line from the numbered source below, with helpers, imports and variables it needs stubbed OUTSIDE the copied lines. Then run it again and answer.
@@ -35995,9 +36023,9 @@ function isCrashTrace(trace) {
 }
 function mergeFormalFindings(response, outcome, pushedFiles) {
   if (!outcome) return { blocking: 0 };
-  const norm = (p) => p.replace(/\\/g, "/");
-  const pushed = new Set(pushedFiles.map(norm));
-  const blocking = outcome.findings.filter((f) => f.verdict === "reproduced" && !f.waived && pushed.has(norm(f.file)));
+  const norm2 = (p) => p.replace(/\\/g, "/");
+  const pushed = new Set(pushedFiles.map(norm2));
+  const blocking = outcome.findings.filter((f) => f.verdict === "reproduced" && !f.waived && pushed.has(norm2(f.file)));
   if (blocking.length === 0) return { blocking: 0 };
   const existing = Array.isArray(response.findings) ? response.findings : [];
   response.findings = [
@@ -36079,6 +36107,7 @@ function recordVerified(root, rec, now = Date.now()) {
 var import_node_crypto17 = require("node:crypto");
 var CONTEXT_BUDGET_MS = 2e3;
 var sha256 = (s) => (0, import_node_crypto17.createHash)("sha256").update(s).digest("hex");
+var TEST_PATH4 = /(^|\/)(tests?|__tests__|spec)\/|\.(test|spec)\.[a-z]+$/;
 function slice(content, f, maxLines) {
   const all = content.split("\n");
   const from = f.start.line;
@@ -36116,12 +36145,37 @@ function targetContext(opts) {
     budget -= s.numbered.length;
     helpers.push({ file: opts.file, symbol: h.qualified, lines: s.lines, sha256: sha256(opts.content), numbered: s.numbered, touches: [] });
   }
+  const callers = [];
+  if (opts.codeSource) {
+    const hits = opts.codeMap.callers(fn.value.name, { definedIn: opts.file, source: opts.codeSource, deadlineAt: Date.now() + 800, limit: 8 });
+    const found = hits.source === "tree-sitter" ? hits.value.callers : [];
+    const ranked = [...found.filter((c) => c.provenance !== "name"), ...found.filter((c) => c.provenance === "name")];
+    for (const c of ranked) {
+      if (callers.length >= MAX_CALLERS2) break;
+      if (TEST_PATH4.test(c.path) || c.path === opts.file && c.line >= fn.value.start.line && c.line <= fn.value.end.line) continue;
+      let content = contents.get(c.path);
+      if (content === void 0) {
+        const read2 = opts.codeSource.read(c.path, 512 * 1024);
+        if (!read2.ok) continue;
+        content = read2.content;
+        contents.set(c.path, content);
+      }
+      const all = content.split("\n");
+      const half = Math.floor(MAX_CALLER_LINES / 2);
+      const from = Math.max(1, c.line - half);
+      const numbered2 = numberLines(all.slice(from - 1, Math.min(all.length, from + MAX_CALLER_LINES - 1)).join("\n"), from);
+      if (numbered2.length > budget) continue;
+      budget -= numbered2.length;
+      callers.push({ file: c.path, line: c.line, caller: c.caller, numbered: numbered2 });
+    }
+  }
   const effects = a.effects.slice(0, MAX_CONTEXT_EFFECTS).map(renderEffect);
   return {
     fields: {
       ...effects.length ? { effects } : {},
       ...coAccessors.length ? { coAccessors } : {},
-      ...helpers.length ? { helpers } : {}
+      ...helpers.length ? { helpers } : {},
+      ...callers.length ? { callers } : {}
     },
     files: [...new Set(coAccessors.map((c) => c.file))],
     signals: a.signals,
@@ -36254,9 +36308,11 @@ async function runFormalPhase(input) {
   progress.usage = usage;
   progress.step = "select";
   let candidates2;
+  const grounding = { sentBack: 0, dropped: [], triggerMissing: [] };
   const done = (partial) => ({
     findings: [],
     ...candidates2 ? { candidates: candidates2 } : {},
+    ...grounding.sentBack || grounding.dropped.length || grounding.triggerMissing.length ? { grounding } : {},
     ...partial,
     usage,
     durationMs: deps.now() - started
@@ -36447,6 +36503,7 @@ async function runFormalPhase(input) {
   }
   const top = chosen.top;
   const sha2562 = sha256Of(chosen.content);
+  const chosenContent = chosen.content;
   const { lines, numbered: numbered2 } = chosen;
   const target = { file: top.file, symbol: top.ai.symbol, lines, score: top.ai.score, reasons: [...top.reasons, ...top.ai.reasons], extent: chosen.extent, ...chosen.context ? { context: chosen.context.stats } : {}, ...floor ? { floor: true } : {} };
   progress.target = target;
@@ -36488,6 +36545,27 @@ async function runFormalPhase(input) {
       if (abstracts.length === 0 || stray || abstracts[0].file !== top.file) {
         return done({ status: "skipped", skip: "model-header-mismatch", detail: `model abstracts ${stray?.file ?? "nothing"}, target was ${top.file}`, target, model: { name: gen.name, file: rel, rounds: round } });
       }
+      const files2 = /* @__PURE__ */ new Map([[top.file, chosenContent]]);
+      for (const f of headerFiles) if (!files2.has(f)) {
+        const r = readSrc(f, 512 * 1024);
+        if (r.ok) files2.set(f, r.content);
+      }
+      const bad = report.properties.flatMap((p) => {
+        const g = basisOf(p.source, files2);
+        return g.ok ? [] : [`${p.id}: ${g.why}`];
+      });
+      if (bad.length > 0) {
+        if (round < 2 && timeLeft() >= GENERATE_RESERVE_MS / 2) {
+          grounding.sentBack++;
+          previous = { source: gen.source, error: ungroundedMessage(bad.join("; ")) };
+          report = null;
+          continue;
+        }
+        const grounded = report.properties.filter((p) => basisOf(p.source, files2).ok);
+        grounding.dropped = report.properties.filter((p) => !grounded.includes(p)).map((p) => p.id);
+        if (grounded.length === 0) return done({ status: "skipped", skip: "model-did-not-elaborate", detail: `no property says what it rests on: ${bad.join("; ").slice(0, 240)}`, target, model: { name: gen.name, file: rel, rounds: round } });
+        report = { ...report, properties: grounded };
+      }
       break;
     }
     previous = { source: gen.source, error: report.error ?? (report.malformed ? "the model printed malformed VERITY lines" : "the model reported no property") };
@@ -36506,6 +36584,7 @@ async function runFormalPhase(input) {
   } catch {
   }
   const isCrash = (p) => isCrashTrace(p.trace ?? []) || /\bcrash/i.test(p.desc);
+  grounding.triggerMissing = report.properties.filter((p) => p.result === "counterexample" && missingTrigger(p.desc, p.trace ?? [])).map((p) => p.id);
   const cexes = report.properties.filter((p) => p.result === "counterexample").map((p, i2) => ({ p, i: i2 })).sort((a, b) => Number(isCrash(a.p)) - Number(isCrash(b.p)) || a.i - b.i).map(({ p }) => p);
   const baseOf = (p) => ({ property: p.id, desc: p.desc, kind: p.kind, trace: p.trace ?? [], file: top.file, symbol: top.ai.symbol });
   const maxReplays = input.maxReplays ?? MAX_REPLAYS;
@@ -36646,7 +36725,24 @@ async function generateAndCheck(root, req, opts) {
     const abstracts = report.header?.abstracts ?? [];
     const stray = abstracts.find((a) => !headerFiles.has(a.file)) ?? (abstracts[0] && abstracts[0].file !== req.file ? abstracts[0] : void 0);
     if (report.ok && report.properties.length > 0 && abstracts.length > 0 && !stray) {
-      return { ok: true, name: gen.name, file: rel, report, rounds: round, costUsd };
+      const files = /* @__PURE__ */ new Map([[req.file, read2.content]]);
+      for (const f of headerFiles) if (!files.has(f)) {
+        const r = readSrc(f, 512 * 1024);
+        if (r.ok) files.set(f, r.content);
+      }
+      const bad = report.properties.flatMap((p) => {
+        const g = basisOf(p.source, files);
+        return g.ok ? [] : [`${p.id}: ${g.why}`];
+      });
+      if (bad.length === 0) return { ok: true, name: gen.name, file: rel, report, rounds: round, costUsd };
+      lastError = ungroundedMessage(bad.join("; "));
+      if (round < maxRounds) {
+        previous = { source: gen.source, error: lastError };
+        continue;
+      }
+      const grounded = report.properties.filter((p) => basisOf(p.source, files).ok);
+      if (grounded.length > 0) return { ok: true, name: gen.name, file: rel, report: { ...report, properties: grounded }, rounds: round, costUsd };
+      break;
     }
     lastError = stray ? `the model abstracts ${stray.file}, not ${req.file}` : report.error ?? (report.malformed ? "the model printed malformed VERITY lines" : "the model reported no property");
     previous = { source: gen.source, error: lastError };
@@ -37279,6 +37375,16 @@ async function runGuard(opts, globals) {
       rounds: formalOutcome.model?.rounds ?? null,
       properties: formalOutcome.properties?.map((p) => `${p.id}:${p.result}`) ?? [],
       findings: formalOutcome.findings.map((f) => `${f.property}:${f.verdict}`),
+      // Decision 81: what each property rests on (a rule, or "line"), what was
+      // sent back or dropped as ungrounded, and which counterexamples lack their
+      // property's trigger (shadow). Ids and rule names only, never code.
+      grounding: {
+        sources: (formalOutcome.properties ?? []).map((p) => /^rule:[a-z-]+$/.test(p.source) ? p.source : p.source ? "line" : "none"),
+        sent_back: formalOutcome.grounding?.sentBack ?? 0,
+        dropped: formalOutcome.grounding?.dropped ?? [],
+        // Shadow: counterexamples whose trace lacks the move their property names. Replayed anyway.
+        trigger_missing: formalOutcome.grounding?.triggerMissing ?? []
+      },
       input_tokens: formalOutcome.usage.inputTokens,
       output_tokens: formalOutcome.usage.outputTokens,
       cost_usd: formalOutcome.usage.costUsd,
@@ -39671,7 +39777,7 @@ function registerInitCommand(program2) {
         ...telemetryChoice ? { telemetry: telemetryChoice } : {},
         init: {
           completed_at: (/* @__PURE__ */ new Date()).toISOString(),
-          cli_version: true ? "0.33.3-experimental.911f315" : "dev"
+          cli_version: true ? "0.33.3-experimental.aea5331" : "dev"
         }
       });
     } catch (err2) {
@@ -41144,8 +41250,8 @@ function registerLeanCommand(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.33.3-experimental.911f315").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
-  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.33.3-experimental.911f315");
+program.name("verity").description("CLI for Verity quality gate service").version("0.33.3-experimental.aea5331").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
+  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.33.3-experimental.aea5331");
   setUserNamedServiceUrl(program.opts().serviceUrl);
   try {
     await foldLegacyLocalCredential();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/verity-cli",
-  "version": "0.33.3-experimental.911f315",
+  "version": "0.33.3-experimental.aea5331",
   "description": "CLI for Verity quality gate service",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://verity.md",