@codacy/verity-cli 0.34.0-experimental.421a631 → 0.34.0-experimental.5235853

package/CHANGELOG.md

@@ -64,6 +64,78 @@ installs are untouched.
   which is the ordinary case for someone whose first Verity install *is* the
   plugin.
 
+## [0.34.0] — 2026-09-30
+
+**Formal verification at push: Verity can now prove a bug is real before it
+blocks — and the code map and the knowledge loop tell the reviewer more about
+the code around a change.**
+
+### 🧮 Formal verification, opt-in
+
+A third review at `git push`, next to the one-shot and the agent. It picks the
+riskiest function the push changed, has the Verity service write a small Lean 4
+model of it, checks the model on your machine, and replays any counterexample
+on the real code in an isolated container with the network off. **Only a
+reproduced bug blocks;** a counterexample that does not reproduce on the real
+code is reported, never enforced. Most pushes get no model at all.
+
+- **Off until you say yes.** `verity init` asks once, on a terminal, with "no"
+  as the default, and remembers either answer. `--yes` and headless runs are not
+  asked and never probe for a toolchain. `verity config formal push` turns it on
+  for a checkout, `verity config formal off` turns it off. It needs you to be
+  signed in: ranking, model writing and replay run on the Verity service. The
+  function's source is sent for the replay; no code is stored.
+- **`verity lean install | status | remove`** manages the pinned official Lean 4
+  release under `~/.verity/lean` (≈800 MB download, 2.7 GB on disk). The
+  download is checksum-verified, abandoned after 60 s with nothing received,
+  and refused up front when the disk is short. An elan install is used when it
+  already has the pinned toolchain; Verity never makes elan download one.
+- **On demand:** `verity prove candidates | generate | check | replay | auto`,
+  and the `/verity-prove <worry>` skill, where the words after the command are
+  what you want checked. Under the plugin, `/verity:verity-prove` arrives with
+  the plugin's next release.
+- **A finding holds until the code changes.** Pushing the same bytes again
+  re-blocks without a new model. `verity prove waive <file>` accepts the risk
+  for the file's current bytes, and voids when they change.
+- **Yours, never the repository's.** A `.verity/config.json` that git tracks,
+  or that is reached through a symlink, cannot switch formal verification on —
+  `verity doctor`, `verity config formal` and `verity init` say why it is off.
+  Findings and spend records a repository ships are ignored, and Lean never runs
+  on a `.verity/proofs/` workspace the repository supplies.
+- **Admins can switch it off** per project, organization or globally with the
+  `formal` flag in the dashboard; the push then reports `disabled-by-server`.
+
+### 🗺️ The code map
+
+The CLI now parses TypeScript, TSX, JavaScript, Python, Go and Java with bundled
+tree-sitter grammars (about 6 MB added to the package).
+
+- **The reviewer sees what else touches the same state.** At commit and push,
+  the review's context names the other functions that write the state a change
+  writes, and the agent reviewer can ask for a function's callers and
+  definitions. Formal verification models the exact function, not a guess at
+  its extent.
+- **Reads use the bytes under review:** at a push, the pushed commit; at a
+  commit, the staged files — not whatever is in the working tree.
+- **Paths the project denies are never shown** by the code tools or in the
+  code-map context.
+
+### 🧠 The knowledge loop
+
+- **The reviewer says what it did with each node it was shown** — applied,
+  violated, irrelevant or unclear, each tied to a line in the change — and
+  ranking learns from it which nodes help. One scorer now chooses the nodes for
+  both the review and your agent's prompt.
+- **A known rule said back to the agent.** When a change breaks a rule the
+  project has already learned, Verity can tell the agent which one. This ships
+  in shadow: the decision is made and recorded, and nothing is sent.
+- **Fewer, better nodes.** The extractor's rubric was rewritten from 143
+  human-graded nodes; it no longer records what the code already says, and it
+  checks each new node against the nearest existing ones before adding it.
+- **A failed diff in `verity memory` sync no longer drops a node edit you made.**
+- **A failed knowledge lookup no longer fails a review.** The review runs
+  without knowledge and records that it did.
+
 ### 🎯 `/verity:init` does everything `verity init` does, in the session
 
 Under the plugin, setup used to stop short of the terminal flow: `/verity:init`
@@ -89,6 +161,11 @@ sign-in meant leaving Claude Code for a terminal.
 - **`verity telemetry install|uninstall` update `.verity/setup.json`**, so a
   request deferred until sign-in stops being reported as still to do.
 
+### 🔧 Fixed
+
+- **A swapped `.verity` directory cannot redirect a write.** File writes check
+  the file they opened is the one they meant to write, after opening it.
+
 ## [0.33.3] — 2026-09-24
 
 **The knowledge seed runs once per project, not once per checkout.**

package/bin/verity.js

@@ -17221,7 +17221,7 @@ function readConfigFile(path) {
     return {
       git_moments: [...new Set(moments)],
       ...source2 ? { git_moments_source: source2 } : {},
-      ...raw.formal === "push" ? { formal: "push" } : {}
+      ...raw.formal === "push" || raw.formal === "off" ? { formal: raw.formal } : {}
     };
   } catch {
     return DEFAULTS;
@@ -17250,10 +17250,10 @@ function readProjectConfigRaw() {
 function readProjectConfig() {
   const cfg = readProjectConfigRaw();
   if (cfg.formal !== "push" || !cfg.path) return cfg;
-  const refused = formalRefusal(cfg.path);
-  if (!refused) return cfg;
+  const refused2 = formalRefusal(cfg.path);
+  if (!refused2) return cfg;
   const { formal: _dropped, ...rest } = cfg;
-  return { ...rest, formal_refused: refused };
+  return { ...rest, formal_refused: refused2 };
 }
 function formalRefusalMessage(reason) {
   switch (reason) {
@@ -24152,7 +24152,7 @@ function registerConfigCommands(program2) {
   config.command("formal [state]").description('Get or set formal verification at push: "push" or "off" (needs Lean \u2014 verity lean status)').action((state) => {
     if (state === void 0) {
       const cfg = readProjectConfig();
-      process.stdout.write((cfg.formal ?? "off") + "\n");
+      process.stdout.write((cfg.formal === "push" ? "push" : "off") + "\n");
       if (cfg.formal_refused) printWarn(formalRefusalMessage(cfg.formal_refused));
       return;
     }
@@ -24160,10 +24160,10 @@ function registerConfigCommands(program2) {
       printError(`Unrecognised state: ${state}. Use "push" or "off".`);
       process.exit(1);
     }
-    writeProjectConfig({ formal: state === "push" ? "push" : void 0 });
-    const refused = state === "push" ? readProjectConfig().formal_refused : void 0;
-    if (refused) {
-      printWarn(`Formal verification at push: still off \u2014 ${formalRefusalMessage(refused)}`);
+    writeProjectConfig({ formal: state === "push" ? "push" : "off" });
+    const refused2 = state === "push" ? readProjectConfig().formal_refused : void 0;
+    if (refused2) {
+      printWarn(`Formal verification at push: still off \u2014 ${formalRefusalMessage(refused2)}`);
       return;
     }
     printInfo(state === "push" ? "Formal verification at push: on for this checkout (Lean must be installed \u2014 verity lean status)" : "Formal verification at push: off");
@@ -27073,7 +27073,7 @@ function channelSilence(input) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.34.0-experimental.421a631" : "dev";
+    return true ? "0.34.0-experimental.5235853" : "dev";
   } catch {
     return "dev";
   }
@@ -31688,6 +31688,22 @@ async function workingMemory(run4) {
   Object.assign(run4, { incrementReport, memory: memory2, memorySession, reachability });
 }
 
+// src/lib/payload-bounds.ts
+var MAX_WIRE_PATHS = 500;
+function boundPaths(paths, first, max = MAX_WIRE_PATHS) {
+  if (paths.length <= max) return [...paths];
+  const present = new Set(paths);
+  const kept = /* @__PURE__ */ new Set();
+  const out2 = [];
+  for (const p of [...first, ...paths]) {
+    if (out2.length >= max) break;
+    if (!present.has(p) || kept.has(p)) continue;
+    kept.add(p);
+    out2.push(p);
+  }
+  return out2;
+}
+
 // src/lib/note-budget.ts
 var import_node_fs49 = require("node:fs");
 var ADVISORY_BUDGET = { PASS: 1, WARN: 2 };
@@ -31802,6 +31818,7 @@ async function buildRequest(run4) {
     (conversation?.prompts?.length ?? 0) > 0
   );
   const noteConfirmation = peekNoteOutcome();
+  const unobserved = foldResult?.unobserved ?? [];
   const excludedByReason = {};
   for (const e of codeDelta.excluded ?? []) {
     excludedByReason[e.reason] = (excludedByReason[e.reason] ?? 0) + 1;
@@ -31846,7 +31863,9 @@ async function buildRequest(run4) {
     coverage_telemetry: coverageTelemetry,
     static_results: staticResults,
     code_delta: codeDelta,
-    changed_files: allForReview,
+    // Bounded, reviewed paths first — the server applies the same bound. The
+    // full count is `coverage_telemetry.for_review`. VRT-242.
+    changed_files: boundPaths(allForReview, codeDelta.files.map((f) => f.path)),
     standard_version: "latest",
     analysis_mode: analysisMode,
     plan_only: analysisMode === "plan",
@@ -31897,7 +31916,9 @@ async function buildRequest(run4) {
         // `hash_at_last_verdict` is frozen at each verdict and `hash_now` tracks
         // disk, so their inequality IS "changed since we last spoke".
         authored_since_verdict: memorySession ? foldDossier(memorySession.d).authored_all.filter((a) => a.hash_now !== a.hash_at_last_verdict).map((a) => a.path) : [],
-        unobserved: foldResult?.unobserved ?? [],
+        // The server reads only how many; a bulk change sent every path. VRT-242.
+        unobserved: unobserved.slice(0, MAX_WIRE_PATHS),
+        ...unobserved.length > MAX_WIRE_PATHS && { unobserved_total: unobserved.length },
         commands: foldResult?.commands ?? [],
         tools: foldResult?.tools ?? [],
         tasks: foldResult?.tasks ?? [],
@@ -32108,8 +32129,10 @@ function buildOfflineFallback(reason, staticResults) {
 }
 
 // src/lib/retry.ts
+var WORKER_RESOURCE_LIMIT = 546;
 function shouldWarmRetryAnalyze(result) {
   if (result.ok) return false;
+  if (result.http_status === WORKER_RESOURCE_LIMIT) return false;
   if (result.category === "network" || result.category === "timeout") return true;
   if (result.category === "http_5xx") return true;
   if (result.category === "invalid_json" && (result.http_status ?? 0) >= 500) return true;
@@ -32119,7 +32142,7 @@ function shouldWarmRetryAnalyze(result) {
 // src/commands/analyze/phases/12-transmit.ts
 async function transmit(run4) {
   const { globals } = run4;
-  const { codeDelta, requestBody, serviceUrl, staticResults, token } = run4;
+  const { requestBody, serviceUrl, staticResults, token } = run4;
   const ANALYZE_TIMEOUT_MS = 1e5;
   let result = await analyzeRequest({
     serviceUrl,
@@ -32156,11 +32179,12 @@ async function transmit(run4) {
   }
   if (!result.ok) {
     cacheRequest(requestBody);
+    const sentKb = () => Math.round(Buffer.byteLength(JSON.stringify(requestBody)) / 1024);
     let message;
     if (result.http_status === 413) {
-      const totalBytes = codeDelta.files.reduce((sum, f) => sum + f.content.length, 0);
-      const kb = Math.round(totalBytes / 1024);
-      message = `Verity: request rejected \u2014 payload too large (${kb}KB over the 190KB cap). Commit or stash pre-existing changes, or run with --mode skip if you didn't intend to submit code this turn.`;
+      message = `Verity: request rejected \u2014 payload too large (${sentKb()} KB sent: ${result.error}). Commit or stash pre-existing changes, or run with --mode skip if you didn't intend to submit code this turn.`;
+    } else if (result.http_status === WORKER_RESOURCE_LIMIT) {
+      message = `Verity: the service ran out of CPU or memory on this request (HTTP 546, ${sentKb()} KB sent). This is not a cold start: the same change fails the same way, so it was not retried. Commit or stash unrelated changes to shrink the request (local analysis this run).`;
     } else if (result.category === "network" || result.category === "timeout") {
       message = `Verity offline \u2014 ${result.error}`;
     } else if (result.error.startsWith("STALE_VERIFICATION")) {
@@ -33869,6 +33893,11 @@ async function rankViaServer(candidates2, ctx, auth2) {
     cmd: "prove-rank"
   });
   if (!res.ok) return { ok: false, ranker: "luna", error: res.error, ranked: fallback };
+  const off = res.data;
+  if (off?.enabled === false) {
+    const why = typeof off.reason === "string" ? off.reason.slice(0, 40) : "disabled";
+    return { ok: false, ranker: "luna", error: `formal is off for this project (${why})`, ranked: fallback, disabled: why };
+  }
   const items = Array.isArray(res.data?.items) ? res.data.items : [];
   return { ok: true, ranker: "luna", ranked: applyAnnotations(candidates2, items), costUsd: typeof res.data?.cost_usd === "number" ? res.data.cost_usd : null };
 }
@@ -34593,6 +34622,8 @@ async function generateModel(target, opts) {
     });
     if (!res.ok) return { ok: false, error: res.error };
     const d = res.data ?? {};
+    const off = d;
+    if (off.enabled === false) return { ok: false, error: `formal is off for this project (${typeof off.reason === "string" ? off.reason.slice(0, 40) : "disabled"})` };
     if (d.error && typeof d.error === "object") return { ok: false, error: `${d.error.code ?? "SERVICE_ERROR"}: ${d.error.message ?? "the service failed"}` };
     const usage2 = d.usage && typeof d.usage === "object" ? { inputTokens: Number(d.usage.inputTokens ?? 0), outputTokens: Number(d.usage.outputTokens ?? 0) } : null;
     return acceptAnswer(d, usage2, typeof d.cost_usd === "number" ? d.cost_usd : null);
@@ -34772,8 +34803,7 @@ Rules:
 5. Write the harness as ONE file and run it in the SAME shell call that writes it (a heredoc followed by the run). TypeScript: node --experimental-strip-types harness.ts (detect runtimes only if that fails: node --version, python3 --version); if strip-types is unavailable, remove type annotations ONLY on lines that are not part of the function under test's logic, and say so. Python: python3 harness.py.
 6. Nothing you run can reach the network. Do not try.
 7. Keep it under about eight shell calls. Output tokens are time.
-8. Answer with the JSON object only: verdict (reproduced | diverged | unreplayable), reason (2-4 sentences: what you ran, what the real code did, and how that compares to the trace's final state), harness_files (every file you wrote: path and its line count \u2014 do NOT paste contents, your shell calls already carry them), executed_output (the last relevant stdout, at most 2000 characters), impact (one word, below).
-9. impact \u2014 AFTER the verdict, and never a reason to change it: what the violation you ran costs a user of this code, the most serious one the run showed. money: a balance, charge, refund, price or stock is wrong. access: someone gets access they should not have, or an auth check is bypassed. data: a user's records are lost, corrupted or wrongly duplicated. external: an effect outside the system happens twice or never (a charge, an email, a shipment, a webhook). count: a counter, metric or statistic is off. cache: a cached or derived value is stale until it refreshes. internal: the program's own bookkeeping is off, with no effect a user would see. none: the verdict is not reproduced.
+8. Answer with the JSON object only: verdict (reproduced | diverged | unreplayable), reason (2-4 sentences: what you ran, what the real code did, and how that compares to the trace's final state), harness_files (every file you wrote: path and its line count \u2014 do NOT paste contents, your shell calls already carry them), executed_output (the last relevant stdout, at most 2000 characters).
 
 "reproduced" means the real code, driven by the trace, reached the property violation the model describes. "diverged" means it did not \u2014 the model is wrong about the code, which is a useful answer. "unreplayable" means you could not run the real function faithfully; say why.`;
 var REPLAY_SCHEMA = {
@@ -34791,10 +34821,9 @@ var REPLAY_SCHEMA = {
         required: ["path", "lines"]
       }
     },
-    executed_output: { type: "string" },
-    impact: { type: "string", enum: ["money", "access", "data", "external", "count", "cache", "internal", "none"] }
+    executed_output: { type: "string" }
   },
-  required: ["verdict", "reason", "harness_files", "executed_output", "impact"]
+  required: ["verdict", "reason", "harness_files", "executed_output"]
 };
 function renderBriefInput(brief) {
   const p = brief.property;
@@ -34821,8 +34850,6 @@ function renderBriefInput(brief) {
   }
   return parts2.join("\n");
 }
-var IMPACTS = ["money", "access", "data", "external", "count", "cache", "internal", "none"];
-var isImpact = (v) => typeof v === "string" && IMPACTS.includes(v);
 function stringsIn(value, out2 = [], depth = 0) {
   if (depth > 8) return out2;
   if (typeof value === "string") out2.push(value);
@@ -34864,8 +34891,7 @@ function parseReplayOutput(output) {
           verdict,
           reason: typeof o.reason === "string" ? o.reason.slice(0, 2e3) : "",
           harness_files: Array.isArray(o.harness_files) ? o.harness_files.filter((f) => typeof f.path === "string").map((f) => ({ path: String(f.path).slice(0, 200), lines: Number.isInteger(f.lines) ? f.lines : 0 })) : [],
-          executed_output: typeof o.executed_output === "string" ? o.executed_output.slice(0, 2e3) : "",
-          impact: isImpact(o.impact) ? o.impact : "none"
+          executed_output: typeof o.executed_output === "string" ? o.executed_output.slice(0, 2e3) : ""
         };
       }
     } catch {
@@ -34873,10 +34899,10 @@ function parseReplayOutput(output) {
   }
   return { claim, shellCalls, executedCalls, shellTexts, outputTexts };
 }
-var RESULT_LINE = /REPLAY_RESULT=(reproduced|diverged)\b/;
+var RESULT_LINE = /REPLAY_RESULT=(reproduced|diverged)\b/g;
 function printedResult(outputTexts) {
   let last = null;
-  for (const t of outputTexts) for (const m of t.matchAll(new RegExp(RESULT_LINE.source, "g"))) last = m[1];
+  for (const t of outputTexts) for (const m of t.matchAll(RESULT_LINE)) last = m[1];
   return last;
 }
 var RESULT_MISSING = "the harness never printed REPLAY_RESULT=reproduced on its own stdout \u2014 the verdict was the model's word, not the run's";
@@ -35066,7 +35092,6 @@ async function runReplayInContainer(brief, opts) {
       ...judged,
       executedCalls,
       shellCalls,
-      ...judged.verdict === "reproduced" && parsed.claim ? { impact: parsed.claim.impact } : {},
       executedOutput: parsed.claim?.executed_output ?? "",
       harnessFiles: parsed.claim?.harness_files ?? [],
       usage,
@@ -35113,6 +35138,11 @@ async function runReplayViaServer(brief, auth2, budgetMs = 24e4) {
     return { claimed: null, verdict: "unverified", reason: "", downgrade: res.error, executedCalls: 0, shellCalls: 0, verbatim: none, executedOutput: "", harnessFiles: [], usage: null, durationMs: Date.now() - started, containerId: null, error: res.error };
   }
   const d = res.data ?? {};
+  if (d.enabled === false) {
+    const why = d.reason;
+    const msg = `formal is off for this project (${typeof why === "string" ? why.slice(0, 40) : "disabled"})`;
+    return { claimed: null, verdict: "unverified", reason: "", downgrade: msg, executedCalls: 0, shellCalls: 0, verbatim: none, executedOutput: "", harnessFiles: [], usage: null, durationMs: Date.now() - started, containerId: null, error: msg };
+  }
   if (d.error && typeof d.error === "object") {
     const e = d.error;
     const msg = `${e.code ?? "SERVICE_ERROR"}: ${e.message ?? "the service failed"}`;
@@ -35125,7 +35155,6 @@ async function runReplayViaServer(brief, auth2, budgetMs = 24e4) {
     verdict: verdict === "reproduced" || verdict === "diverged" || verdict === "unreplayable" ? verdict : "unverified",
     reason: typeof d.reason === "string" ? d.reason : "",
     downgrade: typeof d.downgrade === "string" ? d.downgrade : null,
-    ...isImpact(d.impact) ? { impact: d.impact } : {},
     executedCalls: Number(d.executed_calls ?? 0),
     shellCalls: Number(d.shell_calls ?? 0),
     verbatim: { covered: Number(v.covered ?? 0), total: Number(v.total ?? 0), ratio: Number(v.ratio ?? 0), basis: v.basis === "symbol" || v.basis === "file" ? v.basis : "none" },
@@ -35910,9 +35939,10 @@ function verityLeanHome(env = process.env) {
 function findToolchain(env = process.env) {
   const managedBin = (0, import_node_path43.join)(verityLeanHome(env), LEAN_TOOLCHAIN.replace(/^leanprover\/lean4:/, ""), "bin");
   const elanBin = (0, import_node_path43.join)(env.HOME ?? (0, import_node_os9.homedir)(), ".elan", "bin");
-  const path = [managedBin, elanBin, env.PATH ?? ""].filter(Boolean).join(import_node_path43.delimiter);
-  const merged = { ...env, PATH: path, ELAN_TOOLCHAIN: env.ELAN_TOOLCHAIN ?? LEAN_TOOLCHAIN };
   const elanHas = (0, import_node_fs58.existsSync)((0, import_node_path43.join)(env.HOME ?? (0, import_node_os9.homedir)(), ".elan", "toolchains", LEAN_TOOLCHAIN.replace("/", "--").replace(":", "---")));
+  const userPath = (env.PATH ?? "").split(import_node_path43.delimiter).filter((d) => d && (elanHas || (0, import_node_path43.resolve)(d) !== (0, import_node_path43.resolve)(elanBin)));
+  const path = [managedBin, ...elanHas ? [elanBin] : [], ...userPath].join(import_node_path43.delimiter);
+  const merged = { ...env, PATH: path, ELAN_TOOLCHAIN: env.ELAN_TOOLCHAIN ?? LEAN_TOOLCHAIN };
   const exe = process.platform === "win32" ? "lake.exe" : "lake";
   const candidates2 = [(0, import_node_path43.join)(managedBin, exe), ...elanHas ? [(0, import_node_path43.join)(elanBin, exe)] : [], exe];
   for (const candidate of candidates2) {
@@ -35989,10 +36019,35 @@ function runAsync(tc, cwd, args2, timeoutMs) {
 }
 var DEFAULT_BUILD_TIMEOUT_MS = 10 * 6e4;
 var DEFAULT_CHECK_TIMEOUT_MS = 12e4;
+function proofsWorkspaceProblem(root) {
+  for (const rel of [".verity", PROOFS_DIR, `${PROOFS_DIR}/.lake`]) {
+    let st;
+    try {
+      st = (0, import_node_fs58.lstatSync)((0, import_node_path43.join)(root, rel));
+    } catch {
+      break;
+    }
+    if (st.isSymbolicLink()) return `${rel} is a symlink; Lean is not run through it`;
+  }
+  const r = runGitSync(root, ["ls-files", "-z", "--", PROOFS_DIR], { timeoutMs: 5e3 });
+  if (!r.ok) return `could not confirm with git that ${PROOFS_DIR} holds no committed files; Lean is not run`;
+  const tracked = r.stdout.split("\0").filter(Boolean);
+  if (tracked.length > 0) {
+    return `${tracked.length} file(s) under ${PROOFS_DIR} are tracked in git (e.g. ${tracked[0]}); Lean is not run on a workspace the repository supplies \u2014 untrack them with: git rm -r --cached ${PROOFS_DIR}`;
+  }
+  return null;
+}
+function refused(problem) {
+  return { ok: false, stdout: "", stderr: problem, durationMs: 0, timedOut: false };
+}
 function buildLibrary(tc, root, timeoutMs = DEFAULT_BUILD_TIMEOUT_MS) {
+  const problem = proofsWorkspaceProblem(root);
+  if (problem) return refused(problem);
   return run2(tc, (0, import_node_path43.join)(root, PROOFS_DIR), ["build"], timeoutMs);
 }
-function buildLibraryAsync(tc, root, timeoutMs = DEFAULT_BUILD_TIMEOUT_MS) {
+async function buildLibraryAsync(tc, root, timeoutMs = DEFAULT_BUILD_TIMEOUT_MS) {
+  const problem = proofsWorkspaceProblem(root);
+  if (problem) return refused(problem);
   return runAsync(tc, (0, import_node_path43.join)(root, PROOFS_DIR), ["build"], timeoutMs);
 }
 function isModelInRoot(modelsAbs, rel) {
@@ -36019,13 +36074,15 @@ function trimDiagnostics(text) {
 function checkModel(tc, root, modelFile, opts = {}) {
   const proofsAbs = (0, import_node_path43.join)(root, PROOFS_DIR);
   const rel = (0, import_node_path43.relative)(proofsAbs, modelFile);
-  const res = run2(tc, proofsAbs, ["env", "lean", rel], opts.timeoutMs ?? DEFAULT_CHECK_TIMEOUT_MS);
+  const problem = proofsWorkspaceProblem(root);
+  const res = problem ? refused(problem) : run2(tc, proofsAbs, ["env", "lean", rel], opts.timeoutMs ?? DEFAULT_CHECK_TIMEOUT_MS);
   return toReport(res, root, modelFile, opts.timeoutMs ?? DEFAULT_CHECK_TIMEOUT_MS);
 }
 async function checkModelAsync(tc, root, modelFile, opts = {}) {
   const proofsAbs = (0, import_node_path43.join)(root, PROOFS_DIR);
   const rel = (0, import_node_path43.relative)(proofsAbs, modelFile);
-  const res = await runAsync(tc, proofsAbs, ["env", "lean", rel], opts.timeoutMs ?? DEFAULT_CHECK_TIMEOUT_MS);
+  const problem = proofsWorkspaceProblem(root);
+  const res = problem ? refused(problem) : await runAsync(tc, proofsAbs, ["env", "lean", rel], opts.timeoutMs ?? DEFAULT_CHECK_TIMEOUT_MS);
   return toReport(res, root, modelFile, opts.timeoutMs ?? DEFAULT_CHECK_TIMEOUT_MS);
 }
 function toReport(res, root, modelFile, timeoutMs) {
@@ -36080,33 +36137,18 @@ function writeResult(root, report) {
 function isCrashTrace(trace) {
   return trace.some((s) => /\b(crash\w*|kill\w*|restart\w*|interrupt\w*|power|abort\w*|process (dies|exit\w*)|lost (reply|response))\b/i.test(s));
 }
-var SEVERITY_BY_IMPACT = {
-  money: "high",
-  access: "high",
-  data: "high",
-  external: "high",
-  count: "medium",
-  cache: "medium",
-  internal: "medium",
-  // A reproduced finding always has a real code; 'none' here is a malformed answer, so it blocks.
-  none: "high"
-};
-function formalSeverity(f) {
-  return f.impact && SEVERITY_BY_IMPACT[f.impact] || "high";
-}
 function mergeFormalFindings(response, outcome, pushedFiles) {
-  if (!outcome) return { blocking: 0, warning: 0 };
+  if (!outcome) return { blocking: 0 };
   const norm2 = (p) => p.replace(/\\/g, "/");
   const pushed = new Set(pushedFiles.map(norm2));
-  const reproduced = outcome.findings.filter((f) => f.verdict === "reproduced" && !f.waived && pushed.has(norm2(f.file)));
-  if (reproduced.length === 0) return { blocking: 0, warning: 0 };
-  const blocking = reproduced.filter((f) => formalSeverity(f) === "high");
+  const blocking = outcome.findings.filter((f) => f.verdict === "reproduced" && !f.waived && pushed.has(norm2(f.file)));
+  if (blocking.length === 0) return { blocking: 0 };
   const existing = Array.isArray(response.findings) ? response.findings : [];
   response.findings = [
     ...existing,
-    ...reproduced.map((f) => ({
+    ...blocking.map((f) => ({
       pattern_id: "formal-counterexample",
-      severity: formalSeverity(f),
+      severity: "high",
       scope: "change",
       file: f.file,
       line: outcome.target?.lines?.from ?? null,
@@ -36114,15 +36156,14 @@ function mergeFormalFindings(response, outcome, pushedFiles) {
       // as a title it read backwards (e2e, 2026-09-26). A trace that needs a
       // crash between two writes is labelled: reproducing it means injecting
       // the crash, so it is a crash-consistency finding, not a race.
-      title: `Formal: ${terminalText(f.symbol, 128)} breaks "${terminalText(f.desc, 280)}"${isCrashTrace(f.trace) ? " after a crash (crash consistency)" : ""} \u2014 reproduced on the real code${f.impact && f.impact !== "none" ? ` (impact: ${f.impact})` : ""}`,
+      title: `Formal: ${terminalText(f.symbol, 128)} breaks "${terminalText(f.desc, 280)}"${isCrashTrace(f.trace) ? " after a crash (crash consistency)" : ""} \u2014 reproduced on the real code`,
       description: terminalText(f.reason ?? "", 2e3),
       fix: { description: `Trace: ${terminalText(f.trace.join(" \u2192 ") || "(initial state)", 2e3)}. Replay: ${terminalText(f.reason ?? "reproduced in the container", 2e3)}` },
       source: "formal"
     }))
   ];
-  if (blocking.length > 0) response.gate_decision = "FAIL";
-  else if (response.gate_decision === "PASS" || response.gate_decision == null) response.gate_decision = "WARN";
-  return { blocking: blocking.length, warning: reproduced.length - blocking.length };
+  if (response.gate_decision !== "FAIL") response.gate_decision = "FAIL";
+  return { blocking: blocking.length };
 }
 
 // src/lib/prove/scalpel.ts
@@ -36441,9 +36482,7 @@ async function runFormalPhase(input) {
         symbol: f.symbol,
         verdict: "reproduced",
         reason: f.waived ? `waived ${f.waived.at.slice(0, 10)}: ${f.waived.reason} (standing since ${f.at.slice(0, 10)}; the file has not changed)` : `${f.reason ?? "reproduced on the real code"} (standing since ${f.at.slice(0, 10)}; the file has not changed)`,
-        ...f.waived ? { waived: true } : {},
-        // A hand-edited file cannot invent a code: unknown values read as absent (HIGH).
-        ...isImpact(f.impact) ? { impact: f.impact } : {}
+        ...f.waived ? { waived: true } : {}
       });
     }
   }
@@ -36482,6 +36521,7 @@ async function runFormalPhase(input) {
     return done({ status: "skipped", skip: "not-eligible", detail: `${best.file}: ${isEligible(best, largePush).why}` });
   }
   const ranked = await deps.rank(eligible, root, input.changedLines);
+  if (!ranked.ok && ranked.disabled) return done({ status: "skipped", skip: "disabled-by-server", detail: ranked.error });
   if (ranked.ok) spend(ranked);
   candidates2 = ranked.ranked.slice(0, 5).map((c) => ({ file: c.file, symbol: c.ai?.symbol ?? null, score: c.ai?.score ?? null, criteria: c.ai?.criteria ?? null, reasked: !!c.ai?.reasked, reasons: (c.ai?.reasons ?? []).map((r) => r.slice(0, 200)) }));
   if (cancelled()) return done({ status: "skipped", skip: "deadline", detail: "cut off after ranking" });
@@ -36716,7 +36756,7 @@ async function runFormalPhase(input) {
       continue;
     }
     const verdict = r.verdict === "reproduced" ? "reproduced" : r.verdict === "diverged" ? "diverged" : r.verdict === "unreplayable" ? "model-only" : "unverified";
-    findings.push({ ...baseOf(p), verdict, reason: r.reason || r.downgrade || void 0, ...verdict === "reproduced" && r.impact ? { impact: r.impact } : {} });
+    findings.push({ ...baseOf(p), verdict, reason: r.reason || r.downgrade || void 0 });
   }
   const reproduced = findings.filter((f) => f.verdict === "reproduced");
   if (reproduced.length > 0 && !cancelled()) {
@@ -36724,7 +36764,7 @@ async function runFormalPhase(input) {
     const others = readPersistedFindings(root).filter((f) => f.file !== top.file);
     writePersistedFindings(root, [
       ...others,
-      ...reproduced.map((f) => ({ file: f.file, symbol: f.symbol, sha256: sha2562, property: f.property, desc: f.desc, kind: f.kind, trace: f.trace, model: modelName, reason: f.reason, ...f.impact ? { impact: f.impact } : {}, ...lines ? { lines } : {}, at: now }))
+      ...reproduced.map((f) => ({ file: f.file, symbol: f.symbol, sha256: sha2562, property: f.property, desc: f.desc, kind: f.kind, trace: f.trace, model: modelName, reason: f.reason, ...lines ? { lines } : {}, at: now }))
     ]);
   }
   const clean2 = findings.every((f) => f.verdict === "diverged");
@@ -36845,6 +36885,8 @@ async function prepareFormalPhase(root, env = process.env, auth2, readSource, co
   const apiKey = direct ? env.OPENAI_API_KEY : void 0;
   const toolchain = findToolchain(env);
   if (!toolchain) return { ok: false, skip: "no-toolchain" };
+  const untrusted = proofsWorkspaceProblem(root);
+  if (untrusted) return { ok: false, skip: "workspace-untrusted", detail: untrusted.slice(0, 200) };
   try {
     scaffoldProofs(root);
   } catch (err2) {
@@ -37462,8 +37504,6 @@ async function runGuard(opts, globals) {
       rounds: formalOutcome.model?.rounds ?? null,
       properties: formalOutcome.properties?.map((p) => `${p.id}:${p.result}`) ?? [],
       findings: formalOutcome.findings.map((f) => `${f.property}:${f.verdict}`),
-      // Decision 82: the replay's impact code per reproduced finding; count/cache/internal warn, the rest block.
-      impacts: formalOutcome.findings.filter((f) => f.impact).map((f) => `${f.property}:${f.impact}`),
       // Decision 81: what each property rests on (a rule, or "line"), what was
       // sent back or dropped as ungrounded, and which counterexamples lack their
       // property's trigger (shadow). Ids and rule names only, never code.
@@ -38773,6 +38813,22 @@ var import_promises18 = require("node:stream/promises");
 var import_node_stream = require("node:stream");
 var RELEASES = "https://releases.lean-lang.org/lean4";
 var LEAN_DOWNLOAD_SIZE = "\u2248800 MB download, 2.7 GB on disk";
+var DOWNLOAD_STALL_MS = 6e4;
+var LEAN_DISK_NEEDED_BYTES = 3.75 * 1024 ** 3;
+function freeBytes(dir) {
+  let d = dir;
+  for (let i2 = 0; i2 < 64; i2++) {
+    try {
+      const st = (0, import_node_fs63.statfsSync)(d);
+      return Number(st.bavail) * Number(st.bsize);
+    } catch {
+      const up = (0, import_node_path47.join)(d, "..");
+      if (up === d) return null;
+      d = up;
+    }
+  }
+  return null;
+}
 var LEAN_ASSET_SHA256 = {
   "v4.34.0": {
     "lean-4.34.0-darwin.zip": "75a2a4b8e3d35680e8f51fae5a42c79702f463dd73ee1520fb61e5a9143e336c",
@@ -38831,17 +38887,32 @@ function unzip(zip, dest) {
   }
   return { ok: false, error: errors.join("; ") };
 }
-async function download(url, dest, onProgress) {
-  const res = await fetch(url, { redirect: "follow" });
-  if (!res.ok || !res.body) throw new Error(`download failed: HTTP ${res.status}`);
-  const total = Number(res.headers.get("content-length")) || null;
-  let seen = 0;
-  const stream = import_node_stream.Readable.fromWeb(res.body);
-  stream.on("data", (chunk) => {
-    seen += chunk.length;
-    onProgress(seen, total);
-  });
-  await (0, import_promises18.pipeline)(stream, (0, import_node_fs63.createWriteStream)(dest));
+async function download(url, dest, onProgress, stallMs = DOWNLOAD_STALL_MS) {
+  const ctrl = new AbortController();
+  let timer;
+  const arm = () => {
+    clearTimeout(timer);
+    timer = setTimeout(() => ctrl.abort(), stallMs);
+  };
+  arm();
+  try {
+    const res = await fetch(url, { redirect: "follow", signal: ctrl.signal });
+    if (!res.ok || !res.body) throw new Error(`download failed: HTTP ${res.status}`);
+    const total = Number(res.headers.get("content-length")) || null;
+    let seen = 0;
+    const stream = import_node_stream.Readable.fromWeb(res.body);
+    stream.on("data", (chunk) => {
+      arm();
+      seen += chunk.length;
+      onProgress(seen, total);
+    });
+    await (0, import_promises18.pipeline)(stream, (0, import_node_fs63.createWriteStream)(dest), { signal: ctrl.signal });
+  } catch (err2) {
+    if (ctrl.signal.aborted) throw new Error(`download stalled: nothing received for ${Math.round(stallMs / 1e3)} s`);
+    throw err2;
+  } finally {
+    clearTimeout(timer);
+  }
 }
 function inPlaceProgress(label2, write = (s) => process.stderr.write(s)) {
   let active = false;
@@ -38879,6 +38950,12 @@ async function installLean(opts = {}) {
   const dir = pinnedVersionDir(env);
   const url = `${RELEASES}/${pinnedVersion()}/${asset}`;
   const home = verityLeanHome(env);
+  const free = freeBytes(home);
+  const needed = opts.minFreeBytes ?? LEAN_DISK_NEEDED_BYTES;
+  if (free !== null && free < needed) {
+    const gb = (n) => (n / 1024 ** 3).toFixed(1);
+    return { ok: false, error: `not enough disk space for Lean: ${gb(free)} GB free where ${home} lives, needs about ${gb(needed)} GB` };
+  }
   const tmp = (0, import_node_path47.join)(home, ".tmp");
   (0, import_node_fs63.rmSync)(tmp, { recursive: true, force: true });
   (0, import_node_fs63.mkdirSync)(tmp, { recursive: true });
@@ -39187,8 +39264,10 @@ var INTENSITY_CHOICES = [
   { id: "thorough", label: "thorough", hint: "all tools, all rules (~15s)" }
 ];
 var FORMAL_CHOICES = [
-  { id: "yes", label: "yes", hint: "a Lean model of the riskiest changed function; blocks only on a REPRODUCED counterexample", recommended: true },
-  { id: "no", label: "no", hint: "enable later with: verity config formal push" }
+  { id: "yes", label: "yes", hint: "a Lean model of the riskiest changed function; blocks only on a REPRODUCED counterexample" },
+  // No is the default (review of #255): "yes" downloads ≈800 MB and unpacks
+  // 2.7 GB, and a bare Enter must never do that.
+  { id: "no", label: "no", hint: "enable later with: verity config formal push", recommended: true }
 ];
 var MOMENT_CHOICES = [
   { id: "stop", label: "On stop", hint: "after every agent turn \u2014 fast feedback while you work", recommended: true },
@@ -39594,16 +39673,20 @@ async function offerFormalVerification(defaultsOnly, pluginMode) {
     printWarn(`  Formal verification: off \u2014 ${formalRefusalMessage(cfg.formal_refused)}`);
     return;
   }
-  const toolchain = findToolchain();
   if (cfg.formal === "push") {
-    if (toolchain) printInfo("  Formal verification at push \u2713");
+    if (findToolchain()) printInfo("  Formal verification at push \u2713");
     else printWarn("  Formal verification is on but Lean is missing \u2014 run: verity lean install");
     return;
   }
+  if (cfg.formal === "off") {
+    printInfo("  Formal verification: off (enable with: verity config formal push)");
+    return;
+  }
   if (defaultsOnly || !interactive()) {
     printInfo("  Formal verification (a model-based bug finder at push): off \u2014 enable with: verity config formal push");
     return;
   }
+  const toolchain = findToolchain();
   console.log("");
   console.log("  Formal verification review \u2014 a model-based bug finder for your riskiest code.");
   console.log("    At push, Verity picks the riskiest changed function, checks a small model of");
@@ -39611,9 +39694,10 @@ async function offerFormalVerification(defaultsOnly, pluginMode) {
   console.log("    Verity for that). Only a reproduced bug can block; most pushes get no model.");
   console.log(`    Adds /verity-prove <worry> to check any code on demand.${toolchain ? "" : ` Needs to install Lean 4 (${LEAN_DOWNLOAD_SIZE}) on "yes".`}`);
   console.log("");
-  const wants = await promptChoice("Formal verification at push?", FORMAL_CHOICES, "yes");
+  const wants = await promptChoice("Formal verification at push?", FORMAL_CHOICES, "no");
   if (wants === "yes" && pluginMode) printInfo("  Plugin: the push check works now; /verity:verity-prove arrives with the plugin's next release.");
   if (wants !== "yes") {
+    writeProjectConfig({ formal: "off" });
     printInfo("  Formal verification: off (enable later with: verity config formal push)");
     return;
   }
@@ -39872,7 +39956,7 @@ function registerInitCommand(program2) {
         ...telemetryChoice ? { telemetry: telemetryChoice } : {},
         init: {
           completed_at: (/* @__PURE__ */ new Date()).toISOString(),
-          cli_version: true ? "0.34.0-experimental.421a631" : "dev"
+          cli_version: true ? "0.34.0-experimental.5235853" : "dev"
         }
       });
     } catch (err2) {
@@ -41345,8 +41429,8 @@ function registerLeanCommand(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.34.0-experimental.421a631").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
-  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.34.0-experimental.421a631");
+program.name("verity").description("CLI for Verity quality gate service").version("0.34.0-experimental.5235853").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
+  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.34.0-experimental.5235853");
   setUserNamedServiceUrl(program.opts().serviceUrl);
   try {
     await foldLegacyLocalCredential();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/verity-cli",
-  "version": "0.34.0-experimental.421a631",
+  "version": "0.34.0-experimental.5235853",
   "description": "CLI for Verity quality gate service",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://verity.md",