@codacy/verity-cli 0.34.0-experimental.7e3f52d → 0.34.0-experimental.8b93a3c

package/CHANGELOG.md

@@ -64,6 +64,78 @@ installs are untouched.
   which is the ordinary case for someone whose first Verity install *is* the
   plugin.
 
+## [0.34.0] — 2026-09-30
+
+**Formal verification at push: Verity can now prove a bug is real before it
+blocks — and the code map and the knowledge loop tell the reviewer more about
+the code around a change.**
+
+### 🧮 Formal verification, opt-in
+
+A third review at `git push`, next to the one-shot and the agent. It picks the
+riskiest function the push changed, has the Verity service write a small Lean 4
+model of it, checks the model on your machine, and replays any counterexample
+on the real code in an isolated container with the network off. **Only a
+reproduced bug blocks;** a counterexample that does not reproduce on the real
+code is reported, never enforced. Most pushes get no model at all.
+
+- **Off until you say yes.** `verity init` asks once, on a terminal, with "no"
+  as the default, and remembers either answer. `--yes` and headless runs are not
+  asked and never probe for a toolchain. `verity config formal push` turns it on
+  for a checkout, `verity config formal off` turns it off. It needs you to be
+  signed in: ranking, model writing and replay run on the Verity service. The
+  function's source is sent for the replay; no code is stored.
+- **`verity lean install | status | remove`** manages the pinned official Lean 4
+  release under `~/.verity/lean` (≈800 MB download, 2.7 GB on disk). The
+  download is checksum-verified, abandoned after 60 s with nothing received,
+  and refused up front when the disk is short. An elan install is used when it
+  already has the pinned toolchain; Verity never makes elan download one.
+- **On demand:** `verity prove candidates | generate | check | replay | auto`,
+  and the `/verity-prove <worry>` skill, where the words after the command are
+  what you want checked. Under the plugin, `/verity:verity-prove` arrives with
+  the plugin's next release.
+- **A finding holds until the code changes.** Pushing the same bytes again
+  re-blocks without a new model. `verity prove waive <file>` accepts the risk
+  for the file's current bytes, and voids when they change.
+- **Yours, never the repository's.** A `.verity/config.json` that git tracks,
+  or that is reached through a symlink, cannot switch formal verification on —
+  `verity doctor`, `verity config formal` and `verity init` say why it is off.
+  Findings and spend records a repository ships are ignored, and Lean never runs
+  on a `.verity/proofs/` workspace the repository supplies.
+- **Admins can switch it off** per project, organization or globally with the
+  `formal` flag in the dashboard; the push then reports `disabled-by-server`.
+
+### 🗺️ The code map
+
+The CLI now parses TypeScript, TSX, JavaScript, Python, Go and Java with bundled
+tree-sitter grammars (about 6 MB added to the package).
+
+- **The reviewer sees what else touches the same state.** At commit and push,
+  the review's context names the other functions that write the state a change
+  writes, and the agent reviewer can ask for a function's callers and
+  definitions. Formal verification models the exact function, not a guess at
+  its extent.
+- **Reads use the bytes under review:** at a push, the pushed commit; at a
+  commit, the staged files — not whatever is in the working tree.
+- **Paths the project denies are never shown** by the code tools or in the
+  code-map context.
+
+### 🧠 The knowledge loop
+
+- **The reviewer says what it did with each node it was shown** — applied,
+  violated, irrelevant or unclear, each tied to a line in the change — and
+  ranking learns from it which nodes help. One scorer now chooses the nodes for
+  both the review and your agent's prompt.
+- **A known rule said back to the agent.** When a change breaks a rule the
+  project has already learned, Verity can tell the agent which one. This ships
+  in shadow: the decision is made and recorded, and nothing is sent.
+- **Fewer, better nodes.** The extractor's rubric was rewritten from 143
+  human-graded nodes; it no longer records what the code already says, and it
+  checks each new node against the nearest existing ones before adding it.
+- **A failed diff in `verity memory` sync no longer drops a node edit you made.**
+- **A failed knowledge lookup no longer fails a review.** The review runs
+  without knowledge and records that it did.
+
 ### 🎯 `/verity:init` does everything `verity init` does, in the session
 
 Under the plugin, setup used to stop short of the terminal flow: `/verity:init`
@@ -89,6 +161,11 @@ sign-in meant leaving Claude Code for a terminal.
 - **`verity telemetry install|uninstall` update `.verity/setup.json`**, so a
   request deferred until sign-in stops being reported as still to do.
 
+### 🔧 Fixed
+
+- **A swapped `.verity` directory cannot redirect a write.** File writes check
+  the file they opened is the one they meant to write, after opening it.
+
 ## [0.33.3] — 2026-09-24
 
 **The knowledge seed runs once per project, not once per checkout.**

package/bin/verity.js

@@ -17940,7 +17940,7 @@ function registerHooksCommands(program2) {
 }
 
 // src/commands/intent.ts
-var import_node_crypto9 = require("node:crypto");
+var import_node_crypto10 = require("node:crypto");
 
 // src/lib/conversation-buffer.ts
 var import_promises5 = require("node:fs/promises");
@@ -20544,7 +20544,7 @@ Body content (\u22648KB). Use [[node-id]] wikilinks for cross-references.
 
 // src/lib/dossier-session.ts
 var import_node_fs26 = require("node:fs");
-var import_node_crypto8 = require("node:crypto");
+var import_node_crypto9 = require("node:crypto");
 var import_node_path22 = require("node:path");
 
 // src/lib/pending-repeat.ts
@@ -20621,6 +20621,7 @@ function isRepeatOfAny(text, priorFingerprints, threshold = REPEAT_THRESHOLD) {
 }
 
 // src/lib/dossier/bounds.ts
+var import_node_crypto5 = require("node:crypto");
 var MAX_LINE_BYTES = 4096;
 var MAX_GOAL_CHARS = 2e3;
 var GOAL_KEEP = 8;
@@ -20632,10 +20633,17 @@ var NOT_MINE_CAP = 300;
 var STATEMENTS_OPEN_CAP = 40;
 var COMMANDS_CAP = 12;
 var DIVERGENCE_CAP = 10;
-var DIVERGENCE_SEEN_CAP = 300;
+var DIVERGENCE_BULK_AT = 300;
+var DIVERGENCE_KEYS_PER_LINE = 200;
 function divergenceKey(path, hash) {
   return `${path}@${hash ?? "unknown"}`;
 }
+function packedDivergenceDigest(key) {
+  return (0, import_node_crypto5.createHash)("sha256").update(key).digest("hex").slice(0, 12);
+}
+function packedDivergenceKey(digest) {
+  return `#${digest}`;
+}
 var MARKS_CAP = 50;
 var ROTATE_BYTES = 1048576;
 var ROTATE_KEEP = 2;
@@ -20649,7 +20657,7 @@ function statementAnchorKey(file, patternId) {
 }
 
 // src/lib/dossier/log.ts
-var import_node_crypto5 = require("node:crypto");
+var import_node_crypto6 = require("node:crypto");
 var import_node_fs22 = require("node:fs");
 var import_node_path20 = require("node:path");
 var CRC_TABLE = (() => {
@@ -20691,7 +20699,7 @@ function nextSeq() {
 function encodeEvent(ev) {
   const full = {
     v: 1,
-    id: (0, import_node_crypto5.randomBytes)(4).toString("hex"),
+    id: (0, import_node_crypto6.randomBytes)(4).toString("hex"),
     ...ev
   };
   let body2 = JSON.stringify(full);
@@ -20762,7 +20770,7 @@ function rotateIfNeeded2(d) {
 }
 
 // src/lib/dossier/fold-dossier.ts
-var import_node_crypto6 = require("node:crypto");
+var import_node_crypto7 = require("node:crypto");
 var import_node_fs23 = require("node:fs");
 var import_node_path21 = require("node:path");
 var EMPTY_CAPABILITIES = () => ({
@@ -20854,7 +20862,7 @@ function reduce(state, events, now) {
     state.meta.seq = Math.max(state.meta.seq, ev.seq);
     switch (ev.k) {
       case "goal": {
-        const hash = (0, import_node_crypto6.createHash)("sha256").update(ev.text).digest("hex").slice(0, 16);
+        const hash = (0, import_node_crypto7.createHash)("sha256").update(ev.text).digest("hex").slice(0, 16);
         const prev = state.goal[state.goal.length - 1];
         if (prev && prev.hash === hash) {
           prev.repeats = (prev.repeats ?? 0) + 1;
@@ -20982,12 +20990,13 @@ function reduce(state, events, now) {
         break;
       }
       case "divergence": {
-        state.divergence.counts[ev.kind] = (state.divergence.counts[ev.kind] ?? 0) + 1;
         state.divergence.events.push({ kind: ev.kind, path: ev.path, at: ev.at });
-        const key = divergenceKey(ev.path, ev.hash ?? null);
-        if (!seenDivergence.has(key)) {
+        const keys = Array.isArray(ev.keys) ? ev.keys.filter((k) => typeof k === "string").map(packedDivergenceKey) : [divergenceKey(ev.path, ev.hash ?? null)];
+        for (const key of keys) {
+          if (seenDivergence.has(key)) continue;
           seenDivergence.add(key);
-          if (state.divergence.seen.length < DIVERGENCE_SEEN_CAP) state.divergence.seen.push(key);
+          state.divergence.seen.push(key);
+          state.divergence.counts[ev.kind] = (state.divergence.counts[ev.kind] ?? 0) + 1;
         }
         break;
       }
@@ -21294,14 +21303,14 @@ function assessContinuity(i2) {
 }
 
 // src/lib/dossier/reanchor.ts
-var import_node_crypto7 = require("node:crypto");
+var import_node_crypto8 = require("node:crypto");
 var import_node_fs25 = require("node:fs");
 function lineSha(text) {
-  return (0, import_node_crypto7.createHash)("sha256").update(text.trim()).digest("hex").slice(0, HASH_WIDTH);
+  return (0, import_node_crypto8.createHash)("sha256").update(text.trim()).digest("hex").slice(0, HASH_WIDTH);
 }
 function fileHash(path) {
   try {
-    return (0, import_node_crypto7.createHash)("sha256").update((0, import_node_fs25.readFileSync)(path)).digest("hex").slice(0, HASH_WIDTH);
+    return (0, import_node_crypto8.createHash)("sha256").update((0, import_node_fs25.readFileSync)(path)).digest("hex").slice(0, HASH_WIDTH);
   } catch {
     return null;
   }
@@ -21798,7 +21807,7 @@ function recordTurn(d, t) {
       // Identity is the COMMAND, not its category — otherwise `npm test -- a` and
       // `npm test -- b` are one row and the streak counts two different commands
       // as a run of one.
-      cmd_hash: (0, import_node_crypto8.createHash)("sha256").update(c.head || c.class).digest("hex").slice(0, 12),
+      cmd_hash: (0, import_node_crypto9.createHash)("sha256").update(c.head || c.class).digest("hex").slice(0, 12),
       head: c.head || c.class,
       status: toStatus(c.last_status)
     });
@@ -21816,10 +21825,23 @@ function recordTurn(d, t) {
     }
   }
   const seenDivergence = t.known?.divergence ?? /* @__PURE__ */ new Set();
+  const fresh = [];
   for (const u of t.unobserved) {
     const hash = fileHash((0, import_node_path22.join)(root, u.p));
-    if (seenDivergence.has(divergenceKey(u.p, hash))) continue;
-    appendEvent(d, { k: "divergence", kind: "external_mutation", path: u.p, hash });
+    const key = divergenceKey(u.p, hash);
+    const digest = packedDivergenceDigest(key);
+    if (seenDivergence.has(key) || seenDivergence.has(packedDivergenceKey(digest))) continue;
+    fresh.push({ path: u.p, hash, digest });
+  }
+  if (fresh.length > DIVERGENCE_BULK_AT) {
+    for (let i2 = 0; i2 < fresh.length; i2 += DIVERGENCE_KEYS_PER_LINE) {
+      const slice2 = fresh.slice(i2, i2 + DIVERGENCE_KEYS_PER_LINE);
+      appendEvent(d, { k: "divergence", kind: "external_mutation", path: slice2[0].path, keys: slice2.map((f) => f.digest) });
+    }
+  } else {
+    for (const f of fresh) {
+      appendEvent(d, { k: "divergence", kind: "external_mutation", path: f.path, hash: f.hash });
+    }
   }
   const newCompactions = (t.compactions ?? 0) - (t.known?.compactions ?? 0);
   for (let i2 = 0; i2 < newCompactions; i2++) {
@@ -22084,7 +22106,7 @@ async function fireClassify(prompt, sessionId, globals) {
     logEvent("classify_skipped", { reason: "no_service_url", detail: urlResult.error });
     return;
   }
-  const promptHash = (0, import_node_crypto9.createHash)("sha256").update(prompt).digest("hex");
+  const promptHash = (0, import_node_crypto10.createHash)("sha256").update(prompt).digest("hex");
   const result = await apiRequest({
     method: "POST",
     path: "/classify-task",
@@ -22128,7 +22150,7 @@ var import_node_path26 = require("node:path");
 // src/lib/baseline.ts
 var import_node_fs28 = require("node:fs");
 var import_node_path25 = require("node:path");
-var import_node_crypto10 = require("node:crypto");
+var import_node_crypto11 = require("node:crypto");
 
 // src/lib/snapshot.ts
 var import_node_fs27 = require("node:fs");
@@ -22397,7 +22419,7 @@ var MIRROR_MAX_BYTES = 2 * 1024 * 1024;
 var DEFAULT_SESSION_KEY = "_default";
 function sessionKey(sessionId) {
   if (!sessionId) return DEFAULT_SESSION_KEY;
-  return (0, import_node_crypto10.createHash)("sha256").update(sessionId).digest("hex").slice(0, 16);
+  return (0, import_node_crypto11.createHash)("sha256").update(sessionId).digest("hex").slice(0, 16);
 }
 function sessionDir(key) {
   return (0, import_node_path25.join)(projectPath(BASELINE_DIR), key);
@@ -24317,10 +24339,10 @@ var import_node_fs38 = require("node:fs");
 
 // src/lib/debounce.ts
 var import_node_fs37 = require("node:fs");
-var import_node_crypto11 = require("node:crypto");
+var import_node_crypto12 = require("node:crypto");
 function scopedFile(base, sessionId) {
   if (!sessionId) return base;
-  return `${base}.${(0, import_node_crypto11.createHash)("sha1").update(sessionId).digest("hex").slice(0, 12)}`;
+  return `${base}.${(0, import_node_crypto12.createHash)("sha1").update(sessionId).digest("hex").slice(0, 12)}`;
 }
 function checkDebounce(debounceSeconds = DEBOUNCE_SECONDS, sessionId) {
   const file = scopedFile(DEBOUNCE_FILE, sessionId);
@@ -24361,7 +24383,7 @@ function checkMtime(files, bypassForRecentCommits, sessionId) {
   return "No files modified since last analysis";
 }
 function computeContentHash(files) {
-  const hash = (0, import_node_crypto11.createHash)("sha1");
+  const hash = (0, import_node_crypto12.createHash)("sha1");
   const sorted = [...files].sort();
   for (const f of sorted) {
     const resolved = resolveFile(f) ?? f;
@@ -27073,7 +27095,7 @@ function channelSilence(input) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.34.0-experimental.7e3f52d" : "dev";
+    return true ? "0.34.0-experimental.8b93a3c" : "dev";
   } catch {
     return "dev";
   }
@@ -28541,7 +28563,7 @@ async function contextFiles(run4) {
 }
 
 // src/lib/code/index.ts
-var import_node_crypto12 = require("node:crypto");
+var import_node_crypto13 = require("node:crypto");
 
 // src/lib/code/languages.ts
 var JS_LIKE = {
@@ -30319,7 +30341,7 @@ function byPath(fns, name2) {
 function makeCodeMap(rt) {
   const cache = /* @__PURE__ */ new Map();
   const outline = (path, content, deadlineAt = Date.now() + DEFAULT_PARSE_MS) => {
-    const key = `${path}\0${(0, import_node_crypto12.createHash)("sha1").update(content).digest("hex")}`;
+    const key = `${path}\0${(0, import_node_crypto13.createHash)("sha1").update(content).digest("hex")}`;
     const hit = cache.get(key);
     if (hit) return { source: "tree-sitter", value: hit, elapsedMs: 0 };
     let r;
@@ -31688,6 +31710,22 @@ async function workingMemory(run4) {
   Object.assign(run4, { incrementReport, memory: memory2, memorySession, reachability });
 }
 
+// src/lib/payload-bounds.ts
+var MAX_WIRE_PATHS = 500;
+function boundPaths(paths, first, max = MAX_WIRE_PATHS) {
+  if (paths.length <= max) return [...paths];
+  const present = new Set(paths);
+  const kept = /* @__PURE__ */ new Set();
+  const out2 = [];
+  for (const p of [...first, ...paths]) {
+    if (out2.length >= max) break;
+    if (!present.has(p) || kept.has(p)) continue;
+    kept.add(p);
+    out2.push(p);
+  }
+  return out2;
+}
+
 // src/lib/note-budget.ts
 var import_node_fs49 = require("node:fs");
 var ADVISORY_BUDGET = { PASS: 1, WARN: 2 };
@@ -31802,6 +31840,7 @@ async function buildRequest(run4) {
     (conversation?.prompts?.length ?? 0) > 0
   );
   const noteConfirmation = peekNoteOutcome();
+  const unobserved = foldResult?.unobserved ?? [];
   const excludedByReason = {};
   for (const e of codeDelta.excluded ?? []) {
     excludedByReason[e.reason] = (excludedByReason[e.reason] ?? 0) + 1;
@@ -31846,7 +31885,9 @@ async function buildRequest(run4) {
     coverage_telemetry: coverageTelemetry,
     static_results: staticResults,
     code_delta: codeDelta,
-    changed_files: allForReview,
+    // Bounded, reviewed paths first — the server applies the same bound. The
+    // full count is `coverage_telemetry.for_review`. VRT-242.
+    changed_files: boundPaths(allForReview, codeDelta.files.map((f) => f.path)),
     standard_version: "latest",
     analysis_mode: analysisMode,
     plan_only: analysisMode === "plan",
@@ -31897,7 +31938,9 @@ async function buildRequest(run4) {
         // `hash_at_last_verdict` is frozen at each verdict and `hash_now` tracks
         // disk, so their inequality IS "changed since we last spoke".
         authored_since_verdict: memorySession ? foldDossier(memorySession.d).authored_all.filter((a) => a.hash_now !== a.hash_at_last_verdict).map((a) => a.path) : [],
-        unobserved: foldResult?.unobserved ?? [],
+        // The server reads only how many; a bulk change sent every path. VRT-242.
+        unobserved: unobserved.slice(0, MAX_WIRE_PATHS),
+        ...unobserved.length > MAX_WIRE_PATHS && { unobserved_total: unobserved.length },
         commands: foldResult?.commands ?? [],
         tools: foldResult?.tools ?? [],
         tasks: foldResult?.tasks ?? [],
@@ -32061,11 +32104,11 @@ async function buildRequest(run4) {
 
 // src/lib/offline.ts
 var import_node_fs50 = require("node:fs");
-var import_node_crypto13 = require("node:crypto");
+var import_node_crypto14 = require("node:crypto");
 function cacheRequest(body2) {
   try {
     (0, import_node_fs50.mkdirSync)(CACHE_DIR, { recursive: true });
-    const suffix = (0, import_node_crypto13.randomBytes)(4).toString("hex");
+    const suffix = (0, import_node_crypto14.randomBytes)(4).toString("hex");
     const filename = `pending-${Math.floor(Date.now() / 1e3)}-${suffix}.json`;
     (0, import_node_fs50.writeFileSync)(`${CACHE_DIR}/${filename}`, JSON.stringify(redactRequest(body2)));
   } catch {
@@ -32108,8 +32151,10 @@ function buildOfflineFallback(reason, staticResults) {
 }
 
 // src/lib/retry.ts
+var WORKER_RESOURCE_LIMIT = 546;
 function shouldWarmRetryAnalyze(result) {
   if (result.ok) return false;
+  if (result.http_status === WORKER_RESOURCE_LIMIT) return false;
   if (result.category === "network" || result.category === "timeout") return true;
   if (result.category === "http_5xx") return true;
   if (result.category === "invalid_json" && (result.http_status ?? 0) >= 500) return true;
@@ -32119,7 +32164,7 @@ function shouldWarmRetryAnalyze(result) {
 // src/commands/analyze/phases/12-transmit.ts
 async function transmit(run4) {
   const { globals } = run4;
-  const { codeDelta, requestBody, serviceUrl, staticResults, token } = run4;
+  const { requestBody, serviceUrl, staticResults, token } = run4;
   const ANALYZE_TIMEOUT_MS = 1e5;
   let result = await analyzeRequest({
     serviceUrl,
@@ -32156,11 +32201,12 @@ async function transmit(run4) {
   }
   if (!result.ok) {
     cacheRequest(requestBody);
+    const sentKb = () => Math.round(Buffer.byteLength(JSON.stringify(requestBody)) / 1024);
     let message;
     if (result.http_status === 413) {
-      const totalBytes = codeDelta.files.reduce((sum, f) => sum + f.content.length, 0);
-      const kb = Math.round(totalBytes / 1024);
-      message = `Verity: request rejected \u2014 payload too large (${kb}KB over the 190KB cap). Commit or stash pre-existing changes, or run with --mode skip if you didn't intend to submit code this turn.`;
+      message = `Verity: request rejected \u2014 payload too large (${sentKb()} KB sent: ${result.error}). Commit or stash pre-existing changes, or run with --mode skip if you didn't intend to submit code this turn.`;
+    } else if (result.http_status === WORKER_RESOURCE_LIMIT) {
+      message = `Verity: the service ran out of CPU or memory on this request (HTTP 546, ${sentKb()} KB sent). This is not a cold start: the same change fails the same way, so it was not retried. Commit or stash unrelated changes to shrink the request (local analysis this run).`;
     } else if (result.category === "network" || result.category === "timeout") {
       message = `Verity offline \u2014 ${result.error}`;
     } else if (result.error.startsWith("STALE_VERIFICATION")) {
@@ -33461,7 +33507,7 @@ async function runAgentReview(options) {
 
 // src/lib/prove/auto.ts
 var import_node_path44 = require("node:path");
-var import_node_crypto18 = require("node:crypto");
+var import_node_crypto19 = require("node:crypto");
 
 // src/lib/prove/signals.ts
 var DEFAULT_SINCE = "180 days ago";
@@ -33869,6 +33915,11 @@ async function rankViaServer(candidates2, ctx, auth2) {
     cmd: "prove-rank"
   });
   if (!res.ok) return { ok: false, ranker: "luna", error: res.error, ranked: fallback };
+  const off = res.data;
+  if (off?.enabled === false) {
+    const why = typeof off.reason === "string" ? off.reason.slice(0, 40) : "disabled";
+    return { ok: false, ranker: "luna", error: `formal is off for this project (${why})`, ranked: fallback, disabled: why };
+  }
   const items = Array.isArray(res.data?.items) ? res.data.items : [];
   return { ok: true, ranker: "luna", ranked: applyAnnotations(candidates2, items), costUsd: typeof res.data?.cost_usd === "number" ? res.data.cost_usd : null };
 }
@@ -34593,6 +34644,8 @@ async function generateModel(target, opts) {
     });
     if (!res.ok) return { ok: false, error: res.error };
     const d = res.data ?? {};
+    const off = d;
+    if (off.enabled === false) return { ok: false, error: `formal is off for this project (${typeof off.reason === "string" ? off.reason.slice(0, 40) : "disabled"})` };
     if (d.error && typeof d.error === "object") return { ok: false, error: `${d.error.code ?? "SERVICE_ERROR"}: ${d.error.message ?? "the service failed"}` };
     const usage2 = d.usage && typeof d.usage === "object" ? { inputTokens: Number(d.usage.inputTokens ?? 0), outputTokens: Number(d.usage.outputTokens ?? 0) } : null;
     return acceptAnswer(d, usage2, typeof d.cost_usd === "number" ? d.cost_usd : null);
@@ -34772,8 +34825,7 @@ Rules:
 5. Write the harness as ONE file and run it in the SAME shell call that writes it (a heredoc followed by the run). TypeScript: node --experimental-strip-types harness.ts (detect runtimes only if that fails: node --version, python3 --version); if strip-types is unavailable, remove type annotations ONLY on lines that are not part of the function under test's logic, and say so. Python: python3 harness.py.
 6. Nothing you run can reach the network. Do not try.
 7. Keep it under about eight shell calls. Output tokens are time.
-8. Answer with the JSON object only: verdict (reproduced | diverged | unreplayable), reason (2-4 sentences: what you ran, what the real code did, and how that compares to the trace's final state), harness_files (every file you wrote: path and its line count \u2014 do NOT paste contents, your shell calls already carry them), executed_output (the last relevant stdout, at most 2000 characters), impact (one word, below).
-9. impact \u2014 AFTER the verdict, and never a reason to change it: what the violation you ran costs a user of this code, the most serious one the run showed. money: a balance, charge, refund, price or stock is wrong. access: someone gets access they should not have, or an auth check is bypassed. data: a user's records are lost, corrupted or wrongly duplicated. external: an effect outside the system happens twice or never (a charge, an email, a shipment, a webhook). count: a counter, metric or statistic is off. cache: a cached or derived value is stale until it refreshes. internal: the program's own bookkeeping is off, with no effect a user would see. none: the verdict is not reproduced.
+8. Answer with the JSON object only: verdict (reproduced | diverged | unreplayable), reason (2-4 sentences: what you ran, what the real code did, and how that compares to the trace's final state), harness_files (every file you wrote: path and its line count \u2014 do NOT paste contents, your shell calls already carry them), executed_output (the last relevant stdout, at most 2000 characters).
 
 "reproduced" means the real code, driven by the trace, reached the property violation the model describes. "diverged" means it did not \u2014 the model is wrong about the code, which is a useful answer. "unreplayable" means you could not run the real function faithfully; say why.`;
 var REPLAY_SCHEMA = {
@@ -34791,10 +34843,9 @@ var REPLAY_SCHEMA = {
         required: ["path", "lines"]
       }
     },
-    executed_output: { type: "string" },
-    impact: { type: "string", enum: ["money", "access", "data", "external", "count", "cache", "internal", "none"] }
+    executed_output: { type: "string" }
   },
-  required: ["verdict", "reason", "harness_files", "executed_output", "impact"]
+  required: ["verdict", "reason", "harness_files", "executed_output"]
 };
 function renderBriefInput(brief) {
   const p = brief.property;
@@ -34821,8 +34872,6 @@ function renderBriefInput(brief) {
   }
   return parts2.join("\n");
 }
-var IMPACTS = ["money", "access", "data", "external", "count", "cache", "internal", "none"];
-var isImpact = (v) => typeof v === "string" && IMPACTS.includes(v);
 function stringsIn(value, out2 = [], depth = 0) {
   if (depth > 8) return out2;
   if (typeof value === "string") out2.push(value);
@@ -34864,8 +34913,7 @@ function parseReplayOutput(output) {
           verdict,
           reason: typeof o.reason === "string" ? o.reason.slice(0, 2e3) : "",
           harness_files: Array.isArray(o.harness_files) ? o.harness_files.filter((f) => typeof f.path === "string").map((f) => ({ path: String(f.path).slice(0, 200), lines: Number.isInteger(f.lines) ? f.lines : 0 })) : [],
-          executed_output: typeof o.executed_output === "string" ? o.executed_output.slice(0, 2e3) : "",
-          impact: isImpact(o.impact) ? o.impact : "none"
+          executed_output: typeof o.executed_output === "string" ? o.executed_output.slice(0, 2e3) : ""
         };
       }
     } catch {
@@ -35066,7 +35114,6 @@ async function runReplayInContainer(brief, opts) {
       ...judged,
       executedCalls,
       shellCalls,
-      ...judged.verdict === "reproduced" && parsed.claim ? { impact: parsed.claim.impact } : {},
       executedOutput: parsed.claim?.executed_output ?? "",
       harnessFiles: parsed.claim?.harness_files ?? [],
       usage,
@@ -35113,6 +35160,11 @@ async function runReplayViaServer(brief, auth2, budgetMs = 24e4) {
     return { claimed: null, verdict: "unverified", reason: "", downgrade: res.error, executedCalls: 0, shellCalls: 0, verbatim: none, executedOutput: "", harnessFiles: [], usage: null, durationMs: Date.now() - started, containerId: null, error: res.error };
   }
   const d = res.data ?? {};
+  if (d.enabled === false) {
+    const why = d.reason;
+    const msg = `formal is off for this project (${typeof why === "string" ? why.slice(0, 40) : "disabled"})`;
+    return { claimed: null, verdict: "unverified", reason: "", downgrade: msg, executedCalls: 0, shellCalls: 0, verbatim: none, executedOutput: "", harnessFiles: [], usage: null, durationMs: Date.now() - started, containerId: null, error: msg };
+  }
   if (d.error && typeof d.error === "object") {
     const e = d.error;
     const msg = `${e.code ?? "SERVICE_ERROR"}: ${e.message ?? "the service failed"}`;
@@ -35125,7 +35177,6 @@ async function runReplayViaServer(brief, auth2, budgetMs = 24e4) {
     verdict: verdict === "reproduced" || verdict === "diverged" || verdict === "unreplayable" ? verdict : "unverified",
     reason: typeof d.reason === "string" ? d.reason : "",
     downgrade: typeof d.downgrade === "string" ? d.downgrade : null,
-    ...isImpact(d.impact) ? { impact: d.impact } : {},
     executedCalls: Number(d.executed_calls ?? 0),
     shellCalls: Number(d.shell_calls ?? 0),
     verbatim: { covered: Number(v.covered ?? 0), total: Number(v.total ?? 0), ratio: Number(v.ratio ?? 0), basis: v.basis === "symbol" || v.basis === "file" ? v.basis : "none" },
@@ -35192,7 +35243,7 @@ var import_node_path42 = require("node:path");
 
 // src/lib/prove/safe-write.ts
 var import_node_fs56 = require("node:fs");
-var import_node_crypto14 = require("node:crypto");
+var import_node_crypto15 = require("node:crypto");
 var import_node_path41 = require("node:path");
 var SafeWriteError = class extends Error {
   constructor(reason, path) {
@@ -35253,7 +35304,7 @@ function writeFileInRootNoFollow(root, rel, content) {
   } catch {
     throw new SafeWriteError("unwritable", root);
   }
-  const tmp = (0, import_node_path41.join)(dir, `.${(0, import_node_path41.basename)(dest)}.${(0, import_node_crypto14.randomBytes)(6).toString("hex")}.tmp`);
+  const tmp = (0, import_node_path41.join)(dir, `.${(0, import_node_path41.basename)(dest)}.${(0, import_node_crypto15.randomBytes)(6).toString("hex")}.tmp`);
   let fd;
   try {
     fd = (0, import_node_fs56.openSync)(tmp, import_node_fs56.constants.O_WRONLY | import_node_fs56.constants.O_CREAT | import_node_fs56.constants.O_EXCL | NOFOLLOW2, 420);
@@ -35655,7 +35706,7 @@ function existsNoFollow(abs) {
 }
 
 // src/lib/prove/report.ts
-var import_node_crypto15 = require("node:crypto");
+var import_node_crypto16 = require("node:crypto");
 var IDENT2 = /^[A-Za-z0-9_][A-Za-z0-9_.-]{0,63}$/;
 var SHA256 = /^(sha256:)?[0-9a-f]{64}$/;
 var KINDS2 = /* @__PURE__ */ new Set(["structural", "intent"]);
@@ -35803,7 +35854,7 @@ function sha256InRoot(root, file) {
   const opened = openRegularInRoot(root, file);
   if (!opened.ok) return null;
   try {
-    return (0, import_node_crypto15.createHash)("sha256").update(readOpened(opened.fd, opened.size)).digest("hex");
+    return (0, import_node_crypto16.createHash)("sha256").update(readOpened(opened.fd, opened.size)).digest("hex");
   } catch {
     return null;
   }
@@ -36108,33 +36159,18 @@ function writeResult(root, report) {
 function isCrashTrace(trace) {
   return trace.some((s) => /\b(crash\w*|kill\w*|restart\w*|interrupt\w*|power|abort\w*|process (dies|exit\w*)|lost (reply|response))\b/i.test(s));
 }
-var SEVERITY_BY_IMPACT = {
-  money: "high",
-  access: "high",
-  data: "high",
-  external: "high",
-  count: "medium",
-  cache: "medium",
-  internal: "medium",
-  // A reproduced finding always has a real code; 'none' here is a malformed answer, so it blocks.
-  none: "high"
-};
-function formalSeverity(f) {
-  return f.impact && SEVERITY_BY_IMPACT[f.impact] || "high";
-}
 function mergeFormalFindings(response, outcome, pushedFiles) {
-  if (!outcome) return { blocking: 0, warning: 0 };
+  if (!outcome) return { blocking: 0 };
   const norm2 = (p) => p.replace(/\\/g, "/");
   const pushed = new Set(pushedFiles.map(norm2));
-  const reproduced = outcome.findings.filter((f) => f.verdict === "reproduced" && !f.waived && pushed.has(norm2(f.file)));
-  if (reproduced.length === 0) return { blocking: 0, warning: 0 };
-  const blocking = reproduced.filter((f) => formalSeverity(f) === "high");
+  const blocking = outcome.findings.filter((f) => f.verdict === "reproduced" && !f.waived && pushed.has(norm2(f.file)));
+  if (blocking.length === 0) return { blocking: 0 };
   const existing = Array.isArray(response.findings) ? response.findings : [];
   response.findings = [
     ...existing,
-    ...reproduced.map((f) => ({
+    ...blocking.map((f) => ({
       pattern_id: "formal-counterexample",
-      severity: formalSeverity(f),
+      severity: "high",
       scope: "change",
       file: f.file,
       line: outcome.target?.lines?.from ?? null,
@@ -36142,19 +36178,18 @@ function mergeFormalFindings(response, outcome, pushedFiles) {
       // as a title it read backwards (e2e, 2026-09-26). A trace that needs a
       // crash between two writes is labelled: reproducing it means injecting
       // the crash, so it is a crash-consistency finding, not a race.
-      title: `Formal: ${terminalText(f.symbol, 128)} breaks "${terminalText(f.desc, 280)}"${isCrashTrace(f.trace) ? " after a crash (crash consistency)" : ""} \u2014 reproduced on the real code${f.impact && f.impact !== "none" ? ` (impact: ${f.impact})` : ""}`,
+      title: `Formal: ${terminalText(f.symbol, 128)} breaks "${terminalText(f.desc, 280)}"${isCrashTrace(f.trace) ? " after a crash (crash consistency)" : ""} \u2014 reproduced on the real code`,
       description: terminalText(f.reason ?? "", 2e3),
       fix: { description: `Trace: ${terminalText(f.trace.join(" \u2192 ") || "(initial state)", 2e3)}. Replay: ${terminalText(f.reason ?? "reproduced in the container", 2e3)}` },
       source: "formal"
     }))
   ];
-  if (blocking.length > 0) response.gate_decision = "FAIL";
-  else if (response.gate_decision === "PASS" || response.gate_decision == null) response.gate_decision = "WARN";
-  return { blocking: blocking.length, warning: reproduced.length - blocking.length };
+  if (response.gate_decision !== "FAIL") response.gate_decision = "FAIL";
+  return { blocking: blocking.length };
 }
 
 // src/lib/prove/scalpel.ts
-var import_node_crypto16 = require("node:crypto");
+var import_node_crypto17 = require("node:crypto");
 var ARITHMETIC = /Math\.(?:round|floor|ceil|trunc)\(|\bround\(|\bdivmod\(|[\w)\]]\s*(?:\*|\/(?!\/)|%)\s*[\w(]/;
 function functionHazard(numbered2) {
   const sites = effectSites(numbered2);
@@ -36184,7 +36219,7 @@ function semanticFingerprint(numbered2) {
     if (LOG_LINE.test(t)) continue;
     kept.push(t.replace(/\s+/g, " "));
   }
-  return (0, import_node_crypto16.createHash)("sha256").update(kept.join("\n")).digest("hex");
+  return (0, import_node_crypto17.createHash)("sha256").update(kept.join("\n")).digest("hex");
 }
 function readVerified(root, now = Date.now()) {
   const read2 = readRegularFileInRoot(root, VERIFIED_FILE, 256 * 1024);
@@ -36207,9 +36242,9 @@ function recordVerified(root, rec, now = Date.now()) {
 }
 
 // src/lib/prove/context.ts
-var import_node_crypto17 = require("node:crypto");
+var import_node_crypto18 = require("node:crypto");
 var CONTEXT_BUDGET_MS = 2e3;
-var sha256 = (s) => (0, import_node_crypto17.createHash)("sha256").update(s).digest("hex");
+var sha256 = (s) => (0, import_node_crypto18.createHash)("sha256").update(s).digest("hex");
 var TEST_PATH4 = /(^|\/)(tests?|__tests__|spec)\/|\.(test|spec)\.[a-z]+$/;
 function slice(content, f, maxLines) {
   const all = content.split("\n");
@@ -36398,7 +36433,7 @@ function workingTreeReader(root) {
   };
 }
 function sha256Of(content) {
-  return (0, import_node_crypto18.createHash)("sha256").update(content).digest("hex");
+  return (0, import_node_crypto19.createHash)("sha256").update(content).digest("hex");
 }
 function defaultDeps(opts) {
   const env = opts.env ?? process.env;
@@ -36469,9 +36504,7 @@ async function runFormalPhase(input) {
         symbol: f.symbol,
         verdict: "reproduced",
         reason: f.waived ? `waived ${f.waived.at.slice(0, 10)}: ${f.waived.reason} (standing since ${f.at.slice(0, 10)}; the file has not changed)` : `${f.reason ?? "reproduced on the real code"} (standing since ${f.at.slice(0, 10)}; the file has not changed)`,
-        ...f.waived ? { waived: true } : {},
-        // A hand-edited file cannot invent a code: unknown values read as absent (HIGH).
-        ...isImpact(f.impact) ? { impact: f.impact } : {}
+        ...f.waived ? { waived: true } : {}
       });
     }
   }
@@ -36510,6 +36543,7 @@ async function runFormalPhase(input) {
     return done({ status: "skipped", skip: "not-eligible", detail: `${best.file}: ${isEligible(best, largePush).why}` });
   }
   const ranked = await deps.rank(eligible, root, input.changedLines);
+  if (!ranked.ok && ranked.disabled) return done({ status: "skipped", skip: "disabled-by-server", detail: ranked.error });
   if (ranked.ok) spend(ranked);
   candidates2 = ranked.ranked.slice(0, 5).map((c) => ({ file: c.file, symbol: c.ai?.symbol ?? null, score: c.ai?.score ?? null, criteria: c.ai?.criteria ?? null, reasked: !!c.ai?.reasked, reasons: (c.ai?.reasons ?? []).map((r) => r.slice(0, 200)) }));
   if (cancelled()) return done({ status: "skipped", skip: "deadline", detail: "cut off after ranking" });
@@ -36744,7 +36778,7 @@ async function runFormalPhase(input) {
       continue;
     }
     const verdict = r.verdict === "reproduced" ? "reproduced" : r.verdict === "diverged" ? "diverged" : r.verdict === "unreplayable" ? "model-only" : "unverified";
-    findings.push({ ...baseOf(p), verdict, reason: r.reason || r.downgrade || void 0, ...verdict === "reproduced" && r.impact ? { impact: r.impact } : {} });
+    findings.push({ ...baseOf(p), verdict, reason: r.reason || r.downgrade || void 0 });
   }
   const reproduced = findings.filter((f) => f.verdict === "reproduced");
   if (reproduced.length > 0 && !cancelled()) {
@@ -36752,7 +36786,7 @@ async function runFormalPhase(input) {
     const others = readPersistedFindings(root).filter((f) => f.file !== top.file);
     writePersistedFindings(root, [
       ...others,
-      ...reproduced.map((f) => ({ file: f.file, symbol: f.symbol, sha256: sha2562, property: f.property, desc: f.desc, kind: f.kind, trace: f.trace, model: modelName, reason: f.reason, ...f.impact ? { impact: f.impact } : {}, ...lines ? { lines } : {}, at: now }))
+      ...reproduced.map((f) => ({ file: f.file, symbol: f.symbol, sha256: sha2562, property: f.property, desc: f.desc, kind: f.kind, trace: f.trace, model: modelName, reason: f.reason, ...lines ? { lines } : {}, at: now }))
     ]);
   }
   const clean2 = findings.every((f) => f.verdict === "diverged");
@@ -37492,8 +37526,6 @@ async function runGuard(opts, globals) {
       rounds: formalOutcome.model?.rounds ?? null,
       properties: formalOutcome.properties?.map((p) => `${p.id}:${p.result}`) ?? [],
       findings: formalOutcome.findings.map((f) => `${f.property}:${f.verdict}`),
-      // Decision 82: the replay's impact code per reproduced finding; count/cache/internal warn, the rest block.
-      impacts: formalOutcome.findings.filter((f) => f.impact).map((f) => `${f.property}:${f.impact}`),
       // Decision 81: what each property rests on (a rule, or "line"), what was
       // sent back or dropped as ungrounded, and which counterexamples lack their
       // property's trigger (shadow). Ids and rule names only, never code.
@@ -37734,7 +37766,7 @@ function registerIgnoreCommand(program2) {
 }
 
 // src/commands/waive.ts
-var import_node_crypto19 = require("node:crypto");
+var import_node_crypto20 = require("node:crypto");
 var import_node_fs60 = require("node:fs");
 function registerWaiveCommand(program2) {
   program2.command("waive <pattern-id>").description("Record an accepted-risk disposition for an open finding (voids when the file changes)").option("--file <path>", "File the finding is anchored to, REPO-RELATIVE (recommended \u2014 narrows the waive)").requiredOption("--reason <text>", "The human disposition this records (reviewer finding, ADR, \u2026)").action(async (patternId, opts) => {
@@ -37764,7 +37796,7 @@ function registerWaiveCommand(program2) {
     if (opts.file) {
       body2.file = opts.file;
       try {
-        body2.file_sha256 = (0, import_node_crypto19.createHash)("sha256").update((0, import_node_fs60.readFileSync)(opts.file)).digest("hex");
+        body2.file_sha256 = (0, import_node_crypto20.createHash)("sha256").update((0, import_node_fs60.readFileSync)(opts.file)).digest("hex");
       } catch {
         printError(`Cannot read ${opts.file} \u2014 run from the repo root, or omit --file to waive by pattern.`);
         process.exit(1);
@@ -38795,7 +38827,7 @@ async function promptMultiSelect(question, choices, fallback) {
 
 // src/lib/prove/lean-install.ts
 var import_node_fs63 = require("node:fs");
-var import_node_crypto20 = require("node:crypto");
+var import_node_crypto21 = require("node:crypto");
 var import_node_child_process18 = require("node:child_process");
 var import_node_os10 = require("node:os");
 var import_node_path47 = require("node:path");
@@ -38833,7 +38865,7 @@ function expectedSha256(asset, version = pinnedVersion()) {
 }
 function sha256File(path) {
   return new Promise((resolve8, reject) => {
-    const hash = (0, import_node_crypto20.createHash)("sha256");
+    const hash = (0, import_node_crypto21.createHash)("sha256");
     (0, import_node_fs63.createReadStream)(path).on("data", (chunk) => hash.update(chunk)).on("end", () => resolve8(hash.digest("hex"))).on("error", reject);
   });
 }
@@ -39946,7 +39978,7 @@ function registerInitCommand(program2) {
         ...telemetryChoice ? { telemetry: telemetryChoice } : {},
         init: {
           completed_at: (/* @__PURE__ */ new Date()).toISOString(),
-          cli_version: true ? "0.34.0-experimental.7e3f52d" : "dev"
+          cli_version: true ? "0.34.0-experimental.8b93a3c" : "dev"
         }
       });
     } catch (err2) {
@@ -41419,8 +41451,8 @@ function registerLeanCommand(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.34.0-experimental.7e3f52d").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
-  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.34.0-experimental.7e3f52d");
+program.name("verity").description("CLI for Verity quality gate service").version("0.34.0-experimental.8b93a3c").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
+  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.34.0-experimental.8b93a3c");
   setUserNamedServiceUrl(program.opts().serviceUrl);
   try {
     await foldLegacyLocalCredential();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/verity-cli",
-  "version": "0.34.0-experimental.7e3f52d",
+  "version": "0.34.0-experimental.8b93a3c",
   "description": "CLI for Verity quality gate service",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://verity.md",