@nforma.ai/nforma 0.2.1 → 0.29.0

package/bin/quorum-cache.cjs

@@ -0,0 +1,144 @@
+'use strict';
+
+/**
+ * quorum-cache.cjs — Cache infrastructure for quorum results.
+ *
+ * Provides deterministic cache key computation (SHA-256), file-based read/write
+ * with TTL validation, and invalidation logic based on git HEAD and quorum
+ * composition changes.
+ *
+ * Cache files are stored in .planning/.quorum-cache/ (gitignored).
+ * All operations fail-open: errors return null/undefined, never throw.
+ */
+
+const crypto = require('node:crypto');
+const fs     = require('node:fs');
+const path   = require('node:path');
+const { spawnSync } = require('node:child_process');
+
+/**
+ * Compute a deterministic SHA-256 cache key from quorum inputs.
+ *
+ * @param {string} prompt - The user prompt string
+ * @param {string} context - Additional context string
+ * @param {Array<{slot: string}>} slots - Slot objects with .slot property
+ * @param {Array} configQuorumActive - quorum_active array from config
+ * @param {string} gitHead - Current git HEAD hash
+ * @returns {string} Full hex SHA-256 digest
+ */
+function computeCacheKey(prompt, context, slots, configQuorumActive, gitHead) {
+  const sortedSlotNames = (slots || [])
+    .map(s => s.slot)
+    .sort()
+    .join(',');
+
+  const configHash = crypto
+    .createHash('sha256')
+    .update(JSON.stringify(configQuorumActive || []))
+    .digest('hex')
+    .slice(0, 16);
+
+  const payload = [
+    String(prompt || ''),
+    String(context || ''),
+    sortedSlotNames,
+    configHash,
+    String(gitHead || ''),
+  ].join('\x00');
+
+  return crypto.createHash('sha256').update(payload).digest('hex');
+}
+
+/**
+ * Get current git HEAD hash.
+ * Runs `git rev-parse HEAD` with a 3s timeout. Fail-open.
+ *
+ * @returns {string} Trimmed HEAD hash or empty string on failure
+ */
+function getGitHead() {
+  try {
+    const result = spawnSync('git', ['rev-parse', 'HEAD'], {
+      timeout: 3000,
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+    });
+    return (result.stdout || '').trim();
+  } catch (_) {
+    return '';
+  }
+}
+
+/**
+ * Read a cache entry from disk.
+ * Returns parsed entry if valid (version 1, not expired, has completed field).
+ * Fail-open: returns null on any error or invalid state.
+ *
+ * @param {string} cacheKey - The cache key (hex digest)
+ * @param {string} cacheDir - Directory containing cache files
+ * @returns {object|null} Parsed cache entry or null
+ */
+function readCache(cacheKey, cacheDir) {
+  try {
+    const filePath = path.join(cacheDir, `${cacheKey}.json`);
+    const raw = fs.readFileSync(filePath, 'utf8');
+    const entry = JSON.parse(raw);
+
+    // Version check
+    if (entry.version !== 1) return null;
+
+    // Must have completed field (pending entries are cache misses)
+    if (!entry.completed) return null;
+
+    // TTL check
+    const age = Date.now() - new Date(entry.created).getTime();
+    if (age > entry.ttl_ms) return null;
+
+    return entry;
+  } catch (_) {
+    return null;
+  }
+}
+
+/**
+ * Write a cache entry to disk. Creates cacheDir if needed. Fail-open.
+ *
+ * @param {string} cacheKey - The cache key (hex digest)
+ * @param {object} entry - Cache entry object
+ * @param {string} cacheDir - Directory to write cache files
+ */
+function writeCache(cacheKey, entry, cacheDir) {
+  try {
+    fs.mkdirSync(cacheDir, { recursive: true });
+    const filePath = path.join(cacheDir, `${cacheKey}.json`);
+    fs.writeFileSync(filePath, JSON.stringify(entry, null, 2), 'utf8');
+  } catch (_) {
+    // Fail-open: swallow errors
+  }
+}
+
+/**
+ * Validate a cache entry against current state.
+ * Returns false if git HEAD changed, quorum composition changed, or TTL expired.
+ *
+ * @param {object} entry - Cache entry to validate
+ * @param {string} currentGitHead - Current git HEAD hash
+ * @param {Array} currentQuorumActive - Current quorum_active config
+ * @returns {boolean} True if cache entry is still valid
+ */
+function isCacheValid(entry, currentGitHead, currentQuorumActive) {
+  if (!entry) return false;
+
+  // Git HEAD must match
+  if (entry.git_head !== currentGitHead) return false;
+
+  // Quorum composition must match
+  if (JSON.stringify(entry.quorum_active) !== JSON.stringify(currentQuorumActive)) return false;
+
+  // TTL must not be expired
+  const age = Date.now() - new Date(entry.created).getTime();
+  if (age > entry.ttl_ms) return false;
+
+  return true;
+}
+
+module.exports = { computeCacheKey, readCache, writeCache, getGitHead, isCacheValid };

package/bin/quorum-consensus-gate.cjs

@@ -154,7 +154,7 @@ function readEarlyEscalationThreshold(configPaths) {
   const DEFAULT = 0.10;
   const paths = configPaths || [
     path.join(process.cwd(), '.planning', 'config.json'),
-    path.join(process.cwd(), '.planning', 'qgsd.json'),
+    path.join(process.cwd(), '.planning', 'nf.json'),
   ];
   for (const cfgPath of paths) {
     try {

package/bin/quorum-preflight.cjs

@@ -0,0 +1,89 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * quorum-preflight.cjs — extract quorum config and team identity from nf.json + providers.json
+ *
+ * Replaces three inline `node -e` snippets in quorum.md that caused shell-escaping
+ * failures (LLMs escaping `!` as `\!` inside node -e strings).
+ *
+ * Usage:
+ *   node quorum-preflight.cjs --quorum-active       # → JSON array of active slot names
+ *   node quorum-preflight.cjs --max-quorum-size      # → integer (default 3)
+ *   node quorum-preflight.cjs --team                  # → JSON { slotName: { model } }
+ *   node quorum-preflight.cjs --all                   # → JSON { quorum_active, max_quorum_size, team }
+ *
+ * All modes read from ~/.claude/nf.json (global) merged with $CWD/.claude/nf.json (project).
+ * --team and --all also read providers.json (same search logic as call-quorum-slot.cjs).
+ *
+ * Exit code: always 0. Output: JSON to stdout.
+ */
+
+const fs   = require('fs');
+const path = require('path');
+const os   = require('os');
+
+// ─── Read merged nf.json config ─────────────────────────────────────────────
+function readConfig() {
+  const globalCfg = path.join(os.homedir(), '.claude', 'nf.json');
+  const projCfg   = path.join(process.cwd(), '.claude', 'nf.json');
+  let cfg = {};
+  for (const f of [globalCfg, projCfg]) {
+    try { Object.assign(cfg, JSON.parse(fs.readFileSync(f, 'utf8'))); } catch (_) {}
+  }
+  return cfg;
+}
+
+// ─── Find providers.json (mirrors call-quorum-slot.cjs / probe-quorum-slots.cjs) ──
+function findProviders() {
+  const searchPaths = [
+    path.join(__dirname, 'providers.json'),
+    path.join(os.homedir(), '.claude', 'nf-bin', 'providers.json'),
+  ];
+  try {
+    const claudeJson = JSON.parse(fs.readFileSync(path.join(os.homedir(), '.claude.json'), 'utf8'));
+    const u1args = claudeJson?.mcpServers?.['unified-1']?.args ?? [];
+    const serverScript = u1args.find(a => typeof a === 'string' && a.endsWith('unified-mcp-server.mjs'));
+    if (serverScript) searchPaths.unshift(path.join(path.dirname(serverScript), 'providers.json'));
+  } catch (_) {}
+  for (const p of searchPaths) {
+    try {
+      if (fs.existsSync(p)) return JSON.parse(fs.readFileSync(p, 'utf8')).providers;
+    } catch (_) {}
+  }
+  return [];
+}
+
+// ─── Build team JSON from providers + config ────────────────────────────────
+function buildTeam(providers, active) {
+  const team = {};
+  for (const p of providers) {
+    if (active.length > 0 && !active.includes(p.name)) continue;
+    team[p.name] = { model: p.model };
+  }
+  return team;
+}
+
+// ─── Main ───────────────────────────────────────────────────────────────────
+const mode = process.argv[2] || '--all';
+const cfg  = readConfig();
+
+if (mode === '--quorum-active') {
+  console.log(JSON.stringify(cfg.quorum_active || []));
+} else if (mode === '--max-quorum-size') {
+  console.log(cfg.max_quorum_size ?? 3);
+} else if (mode === '--team') {
+  const providers = findProviders();
+  const active    = cfg.quorum_active || [];
+  console.log(JSON.stringify(buildTeam(providers, active)));
+} else if (mode === '--all') {
+  const providers    = findProviders();
+  const active       = cfg.quorum_active || [];
+  const team         = buildTeam(providers, active);
+  const maxSize      = cfg.max_quorum_size ?? 3;
+  console.log(JSON.stringify({ quorum_active: active, max_quorum_size: maxSize, team }));
+} else {
+  console.error(`Unknown mode: ${mode}`);
+  console.error('Usage: node quorum-preflight.cjs [--quorum-active|--max-quorum-size|--team|--all]');
+  process.exit(1);
+}

package/bin/quorum-slot-dispatch.cjs

@@ -19,7 +19,7 @@
  *     [--cwd <dir>]
  *
  * Builds the Mode A or Mode B prompt from deterministic JS templates matching
- * agents/qgsd-quorum-slot-worker.md Step 2, pipes it to call-quorum-slot.cjs via
+ * agents/nf-quorum-slot-worker.md Step 2, pipes it to call-quorum-slot.cjs via
  * child_process.spawn, parses the output, and emits a structured YAML result block.
  *
  * Exported pure functions (testable without subprocess):
@@ -118,7 +118,7 @@ const PATH_CATEGORY_MAP = new Map([
  *
  * @param {Array} requirements — full requirements array
  * @param {string} question — the question text
- * @param {string|null} artifactPath — optional artifact path (e.g. "hooks/qgsd-stop.js")
+ * @param {string|null} artifactPath — optional artifact path (e.g. "hooks/nf-stop.js")
  * @returns {Array} — filtered requirements (max 20), sorted by score descending
  */
 function matchRequirementsByKeywords(requirements, question, artifactPath) {
@@ -279,7 +279,7 @@ function formatRequirementsSection(requirements) {
 /**
  * buildModeAPrompt — constructs the Mode A question prompt.
  *
- * Matches the EXACT template from agents/qgsd-quorum-slot-worker.md Step 2 Mode A.
+ * Matches the EXACT template from agents/nf-quorum-slot-worker.md Step 2 Mode A.
  *
  * @param {object} opts
  * @param {number}  opts.round
@@ -297,7 +297,7 @@ function buildModeAPrompt({ round, repoDir, question, artifactPath, artifactCont
   const lines = [];
 
   // Header
-  lines.push(`QGSD Quorum — Round ${round}`);
+  lines.push(`nForma Quorum — Round ${round}`);
   lines.push('');
 
   // Repository + question
@@ -422,7 +422,7 @@ function buildModeAPrompt({ round, repoDir, question, artifactPath, artifactCont
 /**
  * buildModeBPrompt — constructs the Mode B execution review prompt.
  *
- * Matches the EXACT template from agents/qgsd-quorum-slot-worker.md Step 2 Mode B.
+ * Matches the EXACT template from agents/nf-quorum-slot-worker.md Step 2 Mode B.
  *
  * @param {object} opts
  * @param {number}  opts.round
@@ -440,7 +440,7 @@ function buildModeBPrompt({ round, repoDir, question, traces, artifactPath, arti
   const lines = [];
 
   // Header
-  lines.push(`QGSD Quorum — Execution Review (Round ${round})`);
+  lines.push(`nForma Quorum — Execution Review (Round ${round})`);
   lines.push('');
 
   // Repository + question

package/bin/requirements-core.cjs

@@ -3,7 +3,7 @@
 /**
  * Pure data functions for requirements management.
  * No blessed dependency — all functions are testable in isolation.
- * Consumers: bin/qgsd.cjs (blessed TUI)
+ * Consumers: bin/nf.cjs (blessed TUI)
  *
  * Data sources (project-relative paths via process.cwd()):
  *   .planning/formal/requirements.json    — 210 requirements in frozen envelope

package/bin/review-mcp-logs.cjs

@@ -192,7 +192,7 @@ const fmtMs = (ms) => {
 };
 
 console.log(`\n${bold('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━')}`);
-console.log(bold(' QGSD ► MCP LOG REVIEW'));
+console.log(bold(' nForma ► MCP LOG REVIEW'));
 console.log(bold('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━'));
 console.log(dim(` Scanned: ${files.length} debug files | Last ${MAX_DAYS} days | ${DEBUG_DIR}`));
 console.log();

package/bin/risk-heatmap.cjs

@@ -0,0 +1,151 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * risk-heatmap.cjs — Ranked risk transition list for Layer 3 (Reasoning).
+ *
+ * Combines FMEA RPN scores with L1/L2 coverage gap data to produce a
+ * prioritized list of highest-risk transitions. Transitions not modeled
+ * in XState receive a 50% risk penalty.
+ *
+ * Requirements: RSN-03
+ *
+ * Usage:
+ *   node bin/risk-heatmap.cjs            # print summary to stdout
+ *   node bin/risk-heatmap.cjs --json     # print full results JSON to stdout
+ */
+
+const fs   = require('fs');
+const path = require('path');
+
+const ROOT = process.env.PROJECT_ROOT || path.join(__dirname, '..');
+const FORMAL = path.join(ROOT, '.planning', 'formal');
+const REASONING_DIR = path.join(FORMAL, 'reasoning');
+const OUT_FILE = path.join(REASONING_DIR, 'risk-heatmap.json');
+
+const JSON_FLAG = process.argv.includes('--json');
+
+// ── Risk tier classification ────────────────────────────────────────────────
+
+function classifyRiskTier(riskScore) {
+  if (riskScore >= 200) return 'critical';
+  if (riskScore >= 100) return 'high';
+  if (riskScore >= 40)  return 'medium';
+  return 'low';
+}
+
+// ── Core computation ────────────────────────────────────────────────────────
+
+/**
+ * Compute composite risk score for a transition.
+ * risk_score = RPN * (1 + coverage_gap_penalty)
+ * coverage_gap_penalty = 0.5 if transition is in missing_in_model, else 0.0
+ */
+function computeRiskScore(rpn, hasCoverageGap) {
+  const penalty = hasCoverageGap ? 0.5 : 0.0;
+  return rpn * (1 + penalty);
+}
+
+function generateRiskHeatmap(hazardModel, observedFsm) {
+  // Build set of missing_in_model transitions
+  const missingInModel = new Set(
+    (observedFsm.model_comparison?.missing_in_model || [])
+      .map(m => `${m.from}-${m.event}`)
+  );
+
+  const transitions = [];
+
+  for (const hazard of (hazardModel?.hazards || [])) {
+    const key = `${hazard.state}-${hazard.event}`;
+    const hasCoverageGap = missingInModel.has(key);
+    const coverageGapPenalty = hasCoverageGap ? 0.5 : 0.0;
+    const riskScore = computeRiskScore(hazard.rpn, hasCoverageGap);
+
+    transitions.push({
+      state: hazard.state,
+      event: hazard.event,
+      to_state: hazard.to_state,
+      rpn: hazard.rpn,
+      coverage_gap: hasCoverageGap,
+      coverage_gap_penalty: coverageGapPenalty,
+      risk_score: riskScore,
+      risk_tier: classifyRiskTier(riskScore),
+      derived_from: [
+        { layer: 'L3', artifact: 'reasoning/hazard-model.json', ref: `hazards[id=${hazard.id}]` },
+        { layer: 'L2', artifact: 'semantics/observed-fsm.json', ref: `observed_transitions.${hazard.state}.${hazard.event}` },
+      ],
+    });
+  }
+
+  // Sort by risk_score descending
+  transitions.sort((a, b) => b.risk_score - a.risk_score);
+
+  // Summary stats
+  const byRiskTier = { critical: 0, high: 0, medium: 0, low: 0 };
+  let coverageGapCount = 0;
+  for (const t of transitions) {
+    byRiskTier[t.risk_tier] = (byRiskTier[t.risk_tier] || 0) + 1;
+    if (t.coverage_gap) coverageGapCount++;
+  }
+
+  return {
+    schema_version: '1',
+    generated: new Date().toISOString(),
+    formula: 'risk_score = RPN * (1 + coverage_gap_penalty); coverage_gap_penalty = 0.5 if missing_in_model, else 0.0',
+    risk_tiers: {
+      critical: 'risk_score >= 200',
+      high: '100 <= risk_score < 200',
+      medium: '40 <= risk_score < 100',
+      low: 'risk_score < 40',
+    },
+    transitions,
+    summary: {
+      total: transitions.length,
+      by_risk_tier: byRiskTier,
+      coverage_gap_count: coverageGapCount,
+    },
+  };
+}
+
+// ── Entry point ─────────────────────────────────────────────────────────────
+
+function main() {
+  // Load L3 hazard model
+  const hazardPath = path.join(REASONING_DIR, 'hazard-model.json');
+  if (!fs.existsSync(hazardPath)) {
+    console.error('ERROR: hazard-model.json not found at', hazardPath);
+    console.error('Run bin/hazard-model.cjs first.');
+    process.exit(1);
+  }
+  const hazardModel = JSON.parse(fs.readFileSync(hazardPath, 'utf8'));
+
+  // Load L2 observed FSM
+  const fsmPath = path.join(FORMAL, 'semantics', 'observed-fsm.json');
+  if (!fs.existsSync(fsmPath)) {
+    console.error('ERROR: observed-fsm.json not found at', fsmPath);
+    process.exit(1);
+  }
+  const observedFsm = JSON.parse(fs.readFileSync(fsmPath, 'utf8'));
+
+  const output = generateRiskHeatmap(hazardModel, observedFsm);
+
+  // Write output
+  fs.mkdirSync(REASONING_DIR, { recursive: true });
+  fs.writeFileSync(OUT_FILE, JSON.stringify(output, null, 2) + '\n');
+
+  if (JSON_FLAG) {
+    process.stdout.write(JSON.stringify(output));
+  } else {
+    console.log(`Risk Heatmap`);
+    console.log(`  Total transitions: ${output.summary.total}`);
+    console.log(`  By risk tier: ${JSON.stringify(output.summary.by_risk_tier)}`);
+    console.log(`  Coverage gaps: ${output.summary.coverage_gap_count}`);
+    console.log(`  Output: ${OUT_FILE}`);
+  }
+
+  process.exit(0);
+}
+
+if (require.main === module) main();
+
+module.exports = { computeRiskScore, classifyRiskTier, generateRiskHeatmap, main };

package/bin/run-account-manager-tlc.cjs

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 'use strict';
 // bin/run-account-manager-tlc.cjs
-// Invokes TLC model checker for the QGSD account manager TLA+ specification.
-// Source spec: .planning/formal/tla/QGSDAccountManager.tla
+// Invokes TLC model checker for the nForma account manager TLA+ specification.
+// Source spec: .planning/formal/tla/NFAccountManager.tla
 // Source impl: bin/account-manager.cjs
 //
 // Checks:
@@ -23,7 +23,7 @@
 //   - .planning/formal/tla/tla2tools.jar (see .planning/formal/tla/README.md for download command)
 
 const { spawnSync } = require('child_process');
-const JAVA_HEAP_MAX = process.env.QGSD_JAVA_HEAP_MAX || '512m';
+const JAVA_HEAP_MAX = process.env.NF_JAVA_HEAP_MAX || '512m';
 const fs   = require('fs');
 const path = require('path');
 const { writeCheckResult } = require('./write-check-result.cjs');
@@ -125,7 +125,7 @@ if (!fs.existsSync(jarPath)) {
 }
 
 // ── 4. Invoke TLC ────────────────────────────────────────────────────────────
-const specPath = path.join(ROOT, '.planning', 'formal', 'tla', 'QGSDAccountManager.tla');
+const specPath = path.join(ROOT, '.planning', 'formal', 'tla', 'NFAccountManager.tla');
 const cfgPath  = path.join(ROOT, '.planning', 'formal', 'tla', configName + '.cfg');
 // Use workers=1 for liveness (IdleReachable) — avoids multi-worker liveness bugs in TLC
 const workers  = '1';

package/bin/run-account-pool-alloy.cjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 'use strict';
 // bin/run-account-pool-alloy.cjs
-// Invokes Alloy 6 JAR headless for the QGSD account pool structure spec.
+// Invokes Alloy 6 JAR headless for the nForma account pool structure spec.
 // Requirements: ALY-AM-01
 //
 // Usage:
@@ -19,7 +19,7 @@
 //   - .planning/formal/alloy/org.alloytools.alloy.dist.jar (see VERIFICATION_TOOLS.md for download)
 
 const { spawnSync } = require('child_process');
-const JAVA_HEAP_MAX = process.env.QGSD_JAVA_HEAP_MAX || '512m';
+const JAVA_HEAP_MAX = process.env.NF_JAVA_HEAP_MAX || '512m';
 const fs   = require('fs');
 const path = require('path');
 const { writeCheckResult } = require('./write-check-result.cjs');

package/bin/run-alloy.cjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 'use strict';
 // bin/run-alloy.cjs
-// Invokes Alloy 6 JAR headless for the QGSD vote-counting model.
+// Invokes Alloy 6 JAR headless for the nForma vote-counting model.
 // Requirements: ALY-02
 //
 // Usage:
@@ -12,7 +12,7 @@
 //   - .planning/formal/alloy/org.alloytools.alloy.dist.jar (see VERIFICATION_TOOLS.md for download)
 
 const { spawnSync } = require('child_process');
-const JAVA_HEAP_MAX = process.env.QGSD_JAVA_HEAP_MAX || '512m';
+const JAVA_HEAP_MAX = process.env.NF_JAVA_HEAP_MAX || '512m';
 const fs   = require('fs');
 const path = require('path');
 const { writeCheckResult } = require('./write-check-result.cjs');

package/bin/run-audit-alloy.cjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 'use strict';
 // bin/run-audit-alloy.cjs
-// Invokes Alloy 6 JAR headless for QGSD audit trail specs (GAP-3, GAP-9).
+// Invokes Alloy 6 JAR headless for nForma audit trail specs (GAP-3, GAP-9).
 // Requirements: GAP-3, GAP-9
 //
 // Usage:
@@ -16,7 +16,7 @@
 //   - .planning/formal/alloy/org.alloytools.alloy.dist.jar (see VERIFICATION_TOOLS.md for download)
 
 const { spawnSync } = require('child_process');
-const JAVA_HEAP_MAX = process.env.QGSD_JAVA_HEAP_MAX || '512m';
+const JAVA_HEAP_MAX = process.env.NF_JAVA_HEAP_MAX || '512m';
 const fs   = require('fs');
 const path = require('path');
 const { writeCheckResult } = require('./write-check-result.cjs');

package/bin/run-breaker-tlc.cjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 'use strict';
 // bin/run-breaker-tlc.cjs
-// Invokes TLC model checker for the QGSD circuit breaker TLA+ specification.
+// Invokes TLC model checker for the nForma circuit breaker TLA+ specification.
 // Requirements: QT-105
 //
 // Usage:
@@ -13,7 +13,7 @@
 //   - .planning/formal/tla/tla2tools.jar (see .planning/formal/tla/README.md for download command)
 
 const { spawnSync } = require('child_process');
-const JAVA_HEAP_MAX = process.env.QGSD_JAVA_HEAP_MAX || '512m';
+const JAVA_HEAP_MAX = process.env.NF_JAVA_HEAP_MAX || '512m';
 const fs   = require('fs');
 const path = require('path');
 const { writeCheckResult } = require('./write-check-result.cjs');
@@ -117,7 +117,7 @@ if (!fs.existsSync(jarPath)) {
 }
 
 // ── 4. Invoke TLC ────────────────────────────────────────────────────────────
-const specPath = path.join(ROOT, '.planning', 'formal', 'tla', 'QGSDCircuitBreaker.tla');
+const specPath = path.join(ROOT, '.planning', 'formal', 'tla', 'NFCircuitBreaker.tla');
 const cfgPath  = path.join(ROOT, '.planning', 'formal', 'tla', configName + '.cfg');
 // Always use 'auto' workers — MCbreaker has a small state space and liveness
 // can safely run with multiple workers (no known multi-worker liveness bugs at this scale).

package/bin/run-formal-check.cjs

@@ -31,7 +31,7 @@ const MODULE_CHECKS = {
       cmd: [
         'java', '-cp', '.planning/formal/tla/tla2tools.jar', 'tlc2.TLC',
         '-config', '.planning/formal/tla/MCliveness.cfg',
-        '.planning/formal/tla/QGSDQuorum.tla',
+        '.planning/formal/tla/NFQuorum.tla',
         '-workers', '1'
       ]
     },
@@ -67,7 +67,7 @@ const MODULE_CHECKS = {
       cmd: [
         'java', '-cp', '.planning/formal/tla/tla2tools.jar', 'tlc2.TLC',
         '-config', '.planning/formal/tla/MCbreaker.cfg',
-        '.planning/formal/tla/QGSDCircuitBreaker.tla',
+        '.planning/formal/tla/NFCircuitBreaker.tla',
         '-workers', '1'
       ]
     }
@@ -78,7 +78,7 @@ const MODULE_CHECKS = {
       cmd: [
         'java', '-cp', '.planning/formal/tla/tla2tools.jar', 'tlc2.TLC',
         '-config', '.planning/formal/tla/MCdeliberation.cfg',
-        '.planning/formal/tla/QGSDDeliberation.tla',
+        '.planning/formal/tla/NFDeliberation.tla',
         '-workers', '1'
       ]
     }
@@ -89,7 +89,7 @@ const MODULE_CHECKS = {
       cmd: [
         'java', '-cp', '.planning/formal/tla/tla2tools.jar', 'tlc2.TLC',
         '-config', '.planning/formal/tla/MCoscillation.cfg',
-        '.planning/formal/tla/QGSDOscillation.tla',
+        '.planning/formal/tla/NFOscillation.tla',
         '-workers', '1'
       ]
     }
@@ -100,7 +100,7 @@ const MODULE_CHECKS = {
       cmd: [
         'java', '-cp', '.planning/formal/tla/tla2tools.jar', 'tlc2.TLC',
         '-config', '.planning/formal/tla/MCconvergence.cfg',
-        '.planning/formal/tla/QGSDConvergence.tla',
+        '.planning/formal/tla/NFConvergence.tla',
         '-workers', '1'
       ]
     }
@@ -111,7 +111,7 @@ const MODULE_CHECKS = {
       cmd: [
         'java', '-cp', '.planning/formal/tla/tla2tools.jar', 'tlc2.TLC',
         '-config', '.planning/formal/tla/MCprefilter.cfg',
-        '.planning/formal/tla/QGSDPreFilter.tla',
+        '.planning/formal/tla/NFPreFilter.tla',
         '-workers', '1'
       ]
     }
@@ -122,7 +122,7 @@ const MODULE_CHECKS = {
       cmd: [
         'java', '-cp', '.planning/formal/tla/tla2tools.jar', 'tlc2.TLC',
         '-config', '.planning/formal/tla/MCrecruiting-safety.cfg',
-        '.planning/formal/tla/QGSDRecruiting.tla',
+        '.planning/formal/tla/NFRecruiting.tla',
         '-workers', '1'
       ]
     }
@@ -133,7 +133,7 @@ const MODULE_CHECKS = {
       cmd: [
         'java', '-cp', '.planning/formal/tla/tla2tools.jar', 'tlc2.TLC',
         '-config', '.planning/formal/tla/MCaccount-manager.cfg',
-        '.planning/formal/tla/QGSDAccountManager.tla',
+        '.planning/formal/tla/NFAccountManager.tla',
         '-workers', '1'
       ]
     }
@@ -144,7 +144,7 @@ const MODULE_CHECKS = {
       cmd: [
         'java', '-cp', '.planning/formal/tla/tla2tools.jar', 'tlc2.TLC',
         '-config', '.planning/formal/tla/MCMCPEnv.cfg',
-        '.planning/formal/tla/QGSDMCPEnv.tla',
+        '.planning/formal/tla/NFMCPEnv.tla',
         '-workers', '1'
       ]
     }