@codacy/verity-cli 0.35.4 → 0.35.5

package/CHANGELOG.md

@@ -64,6 +64,35 @@ installs are untouched.
   which is the ordinary case for someone whose first Verity install *is* the
   plugin.
 
+## [0.35.5] — 2026-11-11
+
+### 🔬 Formal verification at push is on by default
+
+- **Every project gets the formal check at push**, also a project set up
+  before. Until now it ran only where `formal: "push"` was written, and
+  `verity init` wrote that only for a new project. At a push, Verity can check
+  a small Lean model of the riskiest changed function and replay a
+  counterexample on the real code. Only a reproduced bug can block. For the
+  replay, the source of that function goes to the Verity service. Turn it off
+  for a checkout with `verity config formal off`, or for a shell with
+  `VERITY_GIT_MOMENT_FORMAL=off`.
+- **The first session after the upgrade starts the Lean 4 download** (about
+  800 MB, 2.7 GB on disk) on a machine with no install record, and says once
+  per machine that formal is on and how to turn it off. When Lean will not
+  come (`VERITY_NO_LEAN=1`, CI, too little disk, no release for the platform,
+  a failed download), it says why, and that a push skips the formal check.
+  `VERITY_NO_LEAN=1` and CI are checked before any probe for Lean.
+- **An "off" counts only from a file that you control.** An "off" in a
+  `.verity/config.json` that git tracks, or that is a link, is ignored: a
+  repository cannot switch the review off for its clones. `verity config
+  formal`, `verity doctor`, `verity init` and the notice say so, and name
+  `git rm --cached .verity/config.json`. When git cannot tell, the "off" is
+  kept and the push says `formal: skipped (off-unverified: …)`.
+- **Breaking:** `verity config formal` prints `push` when nothing is set
+  (it printed `off`). A re-run of `verity init` starts the Lean download in an
+  existing project. An earlier "off" in a tracked `.verity/config.json` no
+  longer counts.
+
 ## [0.35.4] — 2026-11-10
 
 ### 📐 The Standard file is machine-local

package/README.md

@@ -205,8 +205,9 @@ No re-setup needed: your token, Standard, and run history all carry over.
 | `verity memory untrack` | Stop committing `.verity/memory/` — the graph stays on disk and leaves your diffs |
 | `verity memory track` | Commit the graph on purpose, and record that so nothing offers to change it |
 | **Formal verification** | |
-| `verity config formal push` | Turn it on for this checkout: at push, one risky changed function may get a Lean model, checked and replayed (see below). On by default for a new project |
-| `verity config formal off` | Turn it off |
+| `verity config formal` | Show the setting in force: `push` (the default) or `off` |
+| `verity config formal off` | Turn it off for this checkout. The answer stays: nothing turns it on again |
+| `verity config formal push` | Turn it back on for this checkout: at push, one risky changed function may get a Lean model, checked and replayed (see below) |
 | `verity lean status` / `install` / `remove` | The managed Lean 4 toolchain the models are checked with (≈800 MB download, 2.7 GB on disk) |
 | `verity prove candidates [paths]` | Rank the riskiest code from git history and shape signals, no model |
 | `verity prove auto [files]` | Run the push-time phase by hand on the commits ahead of upstream |
@@ -233,7 +234,7 @@ No re-setup needed: your token, Standard, and run history all carry over.
 | `/verity-reflect` | Capture learnings after a task |
 | `/verity-prove <worry>` | Formal verification on demand: pick a function together, model it in Lean, replay any counterexample on the real code |
 
-## Formal verification (opt-in)
+## Formal verification (on by default)
 
 At `git push`, beside the review, Verity can build a **small Lean 4 model of one
 risky function in the change**, search every interleaving of its actions up to a
@@ -249,13 +250,24 @@ or plain code stops in under a second with a named reason. Counterexamples can
 only be replayed for **TypeScript, JavaScript and Python**; other languages stop
 before any model is paid for.
 
-For a new project, `verity init` turns this on and starts the Lean 4 download
-in the background (≈800 MB, 2.7 GB on disk; `verity lean status` shows the
-progress). Until Lean is ready, a push reports `formal: skipped (no-toolchain:
-Lean installing, 63%)` and the gate decision does not change. Init does not
-start the download in CI (unless `VERITY_LEAN=1`), with `VERITY_NO_LEAN=1`,
-with formal off, or with less than 3.75 GB free. A re-run of init never turns
-formal on.
+Formal verification is on by default in every project, unless someone turned
+it off with `verity config formal off` (or `VERITY_GIT_MOMENT_FORMAL=off`). An
+"off" is an answer and stays. It does not count from a `.verity/config.json`
+that git tracks or that is a link: a repository cannot switch the review off
+for its clones. When git cannot tell, the "off" is kept and the push says
+`formal: skipped (off-unverified: …)`.
+
+The Lean 4 toolchain downloads in the background (≈800 MB, 2.7 GB on disk;
+`verity lean status` shows the progress). `verity init` starts the download,
+and the first Claude Code session after an upgrade starts it on a machine that
+never tried. That session also says once, per machine, that formal is on, how
+to turn it off, and why Lean will not come when it cannot.
+
+Until Lean is ready, a push reports `formal: skipped (no-toolchain: Lean
+installing, 63%)` and the gate decision does not change. The download does not
+start in CI (unless `VERITY_LEAN=1`), with `VERITY_NO_LEAN=1`, with formal off,
+or with less than 3.75 GB free. A failed download is not retried at each
+session start: run `verity lean install`.
 
 ```bash
 verity config formal off      # turn it off for this checkout