@fairfox/polly 0.83.0 → 0.84.0

package/dist/tools/verify/src/cli.js

@@ -3356,6 +3356,8 @@ var init_witness = __esm(() => {
 // tools/verify/src/codegen/witness.ts
 var exports_witness2 = {};
 __export(exports_witness2, {
+  witnessVerdict: () => witnessVerdict,
+  witnessPolarity: () => witnessPolarity,
   routeWitness: () => routeWitness,
   buildWitnessModule: () => buildWitnessModule,
   buildWitnessInvariant: () => buildWitnessInvariant,
@@ -3364,6 +3366,23 @@ __export(exports_witness2, {
   WitnessTranslationError: () => WitnessTranslationError,
   WITNESS_INVARIANT: () => WITNESS_INVARIANT
 });
+function witnessPolarity(tags) {
+  return tags.includes("forbidden") ? "forbidden" : "positive";
+}
+function witnessVerdict(polarity, reachable) {
+  if (polarity === "forbidden") {
+    return reachable ? {
+      status: "violated",
+      ok: false,
+      message: "the forbidden state is REACHABLE — a defect; the counterexample is the path to it"
+    } : { status: "excluded", ok: true, message: "the model proves this state unreachable" };
+  }
+  return reachable ? { status: "reachable", ok: true, message: "the model reaches this outcome" } : {
+    status: "unreachable",
+    ok: false,
+    message: "the model proves this outcome impossible (the scenario lies)"
+  };
+}
 function flattenField(path3) {
   return path3.split(".").join("_");
 }
@@ -8783,6 +8802,8 @@ async function runWitnessVerification(config) {
     buildWitnessCfg: buildWitnessCfg2,
     buildWitnessModule: buildWitnessModule2,
     routeWitness: routeWitness2,
+    witnessPolarity: witnessPolarity2,
+    witnessVerdict: witnessVerdict2,
     WITNESS_INVARIANT: WITNESS_INVARIANT2
   } = await Promise.resolve().then(() => (init_witness2(), exports_witness2));
   const subsystems = config.subsystems;
@@ -8795,8 +8816,14 @@ async function runWitnessVerification(config) {
   let idx = 0;
   for (const w of witnesses) {
     const id = `${w.feature} › ${w.scenario}`;
+    const polarity = witnessPolarity2(w.tags);
     if (!w.predicate) {
-      results.push({ id, status: "skipped", note: "no state-observable Then to witness" });
+      results.push({
+        id,
+        status: "skipped",
+        ok: true,
+        note: "no state-observable Then to witness"
+      });
       continue;
     }
     const subsystem = routeWitness2(w.fields, subsystems);
@@ -8804,6 +8831,7 @@ async function runWitnessVerification(config) {
       results.push({
         id,
         status: "skipped",
+        ok: true,
         note: `fields [${w.fields.join(", ")}] not owned by a single subsystem`
       });
       continue;
@@ -8814,6 +8842,7 @@ async function runWitnessVerification(config) {
       results.push({
         id,
         status: "error",
+        ok: false,
         subsystem,
         note: `subsystem spec missing: ${subsystem}`
       });
@@ -8826,6 +8855,7 @@ async function runWitnessVerification(config) {
       results.push({
         id,
         status: "error",
+        ok: false,
         subsystem,
         note: err instanceof Error ? err.message : String(err)
       });
@@ -8835,58 +8865,66 @@ async function runWitnessVerification(config) {
     const witnessTla = path4.join(specDir, `${moduleName}.tla`);
     fs4.writeFileSync(witnessTla, buildWitnessModule2(moduleName, `UserApp_${subsystem}`, tlaPredicate));
     fs4.writeFileSync(path4.join(specDir, `${moduleName}.cfg`), buildWitnessCfg2(fs4.readFileSync(subsystemCfg, "utf8")));
-    console.log(color(`⚙️  ${id}`, COLORS.blue));
+    const polarityTag = polarity === "forbidden" ? color("  [forbidden — must be unreachable]", COLORS.gray) : "";
+    console.log(color(`⚙️  ${id}`, COLORS.blue) + polarityTag);
     console.log(color(`     ${subsystem} ⊨ ${w.predicate}`, COLORS.gray));
     let tlc;
     try {
       tlc = await docker.runTLC(witnessTla, { workers, timeout });
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
-      results.push({ id, status: "inconclusive", subsystem, predicate: w.predicate, note: msg });
-      console.log(color("     ⚠ inconclusive — TLC did not finish (raise the config timeout)", COLORS.yellow));
-      continue;
-    }
-    if (!tlc.success && tlc.violation?.name === WITNESS_INVARIANT2) {
-      results.push({ id, status: "reachable", subsystem, predicate: w.predicate });
-      console.log(color("     ✓ reachable — the model reaches this outcome", COLORS.green));
-    } else if (tlc.success) {
       results.push({
         id,
-        status: "unreachable",
+        status: "inconclusive",
+        ok: true,
         subsystem,
         predicate: w.predicate,
-        note: `${tlc.stats?.distinctStates ?? 0} distinct states, no path`
+        note: msg
       });
-      console.log(color("     ✗ UNREACHABLE — the model proves this outcome impossible (the scenario lies)", COLORS.red));
-      fs4.writeFileSync(path4.join(specDir, `${moduleName}.tlc-output.log`), tlc.output);
-    } else {
+      console.log(color("     ⚠ inconclusive — TLC did not finish (raise the config timeout)", COLORS.yellow));
+      continue;
+    }
+    const reachable = !tlc.success && tlc.violation?.name === WITNESS_INVARIANT2;
+    if (!tlc.success && !reachable) {
       results.push({
         id,
         status: "error",
+        ok: false,
         subsystem,
         predicate: w.predicate,
         note: tlc.error ?? tlc.violation?.name ?? "TLC error"
       });
       console.log(color(`     ! error — ${tlc.error ?? "see log"}`, COLORS.yellow));
       fs4.writeFileSync(path4.join(specDir, `${moduleName}.tlc-output.log`), tlc.output);
+      continue;
     }
+    const verdict = witnessVerdict2(polarity, reachable);
+    const note = reachable ? undefined : `${tlc.stats?.distinctStates ?? 0} distinct states explored`;
+    results.push({
+      id,
+      status: verdict.status,
+      ok: verdict.ok,
+      subsystem,
+      predicate: w.predicate,
+      note
+    });
+    console.log(color(`     ${verdict.ok ? "✓" : "✗"} ${verdict.status} — ${verdict.message}`, verdict.ok ? COLORS.green : COLORS.red));
+    if (!verdict.ok)
+      fs4.writeFileSync(path4.join(specDir, `${moduleName}.tlc-output.log`), tlc.output);
   }
   displayWitnessReport(results);
 }
 function displayWitnessReport(results) {
   const count = (s) => results.filter((r) => r.status === s).length;
-  const reachable = count("reachable");
-  const unreachable = count("unreachable");
-  const inconclusive = count("inconclusive");
-  const errors = count("error");
-  const skipped = count("skipped");
   console.log();
   console.log(color(`Witness results:
 `, COLORS.blue));
   for (const r of results) {
     const mark = {
       reachable: color("✓", COLORS.green),
+      excluded: color("✓", COLORS.green),
       unreachable: color("✗", COLORS.red),
+      violated: color("✗", COLORS.red),
       inconclusive: color("⚠", COLORS.yellow),
       error: color("!", COLORS.yellow),
       skipped: color("·", COLORS.gray)
@@ -8894,17 +8932,27 @@ function displayWitnessReport(results) {
     const note = r.note ? color(`  (${r.note})`, COLORS.gray) : "";
     console.log(`  ${mark} ${r.status.padEnd(12)} ${r.id}${note}`);
   }
+  const tally = [
+    "reachable",
+    "excluded",
+    "unreachable",
+    "violated",
+    "inconclusive",
+    "error",
+    "skipped"
+  ].map((s) => `${count(s)} ${s}`).join(", ");
   console.log();
-  console.log(color(`  ${reachable} reachable, ${unreachable} unreachable, ${inconclusive} inconclusive, ${errors} error, ${skipped} skipped`, COLORS.gray));
+  console.log(color(`  ${tally}`, COLORS.gray));
   console.log();
-  if (unreachable > 0 || errors > 0) {
+  const failures = results.filter((r) => !r.ok);
+  if (failures.length > 0) {
     console.log(color("Witness result: ✗ FAIL", COLORS.red));
-    console.log(color("  A scenario the exhaustive model cannot reach describes an impossible outcome.", COLORS.gray));
+    console.log(color("  An outcome a scenario claims is unreachable, or a forbidden state the model can reach.", COLORS.gray));
     console.log();
     process.exit(1);
   }
   console.log(color("Witness result: ✓ PASS", COLORS.green));
-  console.log(color("  Every witnessable scenario's outcome is reachable in the model.", COLORS.gray));
+  console.log(color("  Every claimed outcome is reachable; every forbidden state is proven unreachable.", COLORS.gray));
   console.log();
 }
 function displayEnsuresSummary(results) {
@@ -9213,4 +9261,4 @@ main().catch((error) => {
   process.exit(1);
 });
 
-//# debugId=006B6ED4C6E5114F64756E2164756E21
+//# debugId=F9E0214A7A9A110B64756E2164756E21