@nforma.ai/nforma 0.2.1

package/bin/run-protocol-tlc.cjs

@@ -0,0 +1,201 @@
+#!/usr/bin/env node
+'use strict';
+// bin/run-protocol-tlc.cjs
+// Invokes TLC model checker for QGSD protocol termination TLA+ specifications.
+// Requirements: GAP-2, GAP-6
+//
+// Usage:
+//   node bin/run-protocol-tlc.cjs MCdeliberation   # R3/R3.6 deliberation protocol (liveness, -workers 1)
+//   node bin/run-protocol-tlc.cjs MCprefilter      # R4 pre-filter protocol (liveness, -workers 1)
+//   node bin/run-protocol-tlc.cjs --config=MCdeliberation
+//
+// Prerequisites:
+//   - Java >=17 (https://adoptium.net/)
+//   - .planning/formal/tla/tla2tools.jar (see .planning/formal/tla/README.md for download command)
+
+const { spawnSync } = require('child_process');
+const JAVA_HEAP_MAX = process.env.QGSD_JAVA_HEAP_MAX || '512m';
+const fs   = require('fs');
+const path = require('path');
+const { writeCheckResult } = require('./write-check-result.cjs');
+const { detectLivenessProperties } = require('./run-tlc.cjs');
+const { getRequirementIds } = require('./requirement-map.cjs');
+
+// ── Resolve project root (--project-root= overrides __dirname-relative) ─────
+let ROOT = path.join(__dirname, '..');
+for (const arg of process.argv) {
+  if (arg.startsWith('--project-root=')) ROOT = path.resolve(arg.slice('--project-root='.length));
+}
+
+const CHECK_ID_MAP = {
+  'MCdeliberation': 'tla:deliberation',
+  'MCprefilter':    'tla:prefilter',
+};
+
+const PROPERTY_MAP = {
+  'MCdeliberation': 'R3 deliberation loop — max 10 rounds + 10 improvement iterations',
+  'MCprefilter':    'R4 pre-filter protocol — max 3 rounds bounded termination',
+};
+
+// ── Parse --config argument ──────────────────────────────────────────────────
+const args       = process.argv.slice(2);
+const configArg  = args.find(a => a.startsWith('--config=')) || null;
+const configName = configArg
+  ? configArg.split('=')[1]
+  : (args.find(a => !a.startsWith('-')) || 'MCdeliberation');
+
+const VALID_CONFIGS = ['MCdeliberation', 'MCprefilter'];
+if (!VALID_CONFIGS.includes(configName)) {
+  process.stderr.write(
+    '[run-protocol-tlc] Unknown config: ' + configName +
+    '. Valid: ' + VALID_CONFIGS.join(', ') + '\n'
+  );
+  const _startMs = Date.now();
+  const _runtimeMs = 0;
+  try { writeCheckResult({ tool: 'run-protocol-tlc', formalism: 'tla', result: 'fail', check_id: CHECK_ID_MAP[configName] || ('tla:' + configName.toLowerCase()), surface: 'tla', property: PROPERTY_MAP[configName] || configName, runtime_ms: _runtimeMs, summary: 'fail: unknown config in ' + _runtimeMs + 'ms', requirement_ids: getRequirementIds(CHECK_ID_MAP[configName] || ('tla:' + configName.toLowerCase())), metadata: { config: configName } }); } catch (e) { process.stderr.write('[run-protocol-tlc] Warning: failed to write check result: ' + e.message + '\n'); }
+  process.exit(1);
+}
+
+// ── 1. Locate Java ───────────────────────────────────────────────────────────
+const JAVA_HOME = process.env.JAVA_HOME;
+let javaExe;
+
+if (JAVA_HOME) {
+  javaExe = path.join(JAVA_HOME, 'bin', 'java');
+  if (!fs.existsSync(javaExe)) {
+    process.stderr.write(
+      '[run-protocol-tlc] JAVA_HOME is set but java binary not found at: ' + javaExe + '\n' +
+      '[run-protocol-tlc] Unset JAVA_HOME or fix the path.\n'
+    );
+    const _startMs = Date.now();
+    const _runtimeMs = 0;
+    try { writeCheckResult({ tool: 'run-protocol-tlc', formalism: 'tla', result: 'fail', check_id: CHECK_ID_MAP[configName] || ('tla:' + configName.toLowerCase()), surface: 'tla', property: PROPERTY_MAP[configName] || configName, runtime_ms: _runtimeMs, summary: 'fail: Java not found in ' + _runtimeMs + 'ms', requirement_ids: getRequirementIds(CHECK_ID_MAP[configName] || ('tla:' + configName.toLowerCase())), metadata: { config: configName } }); } catch (e) { process.stderr.write('[run-protocol-tlc] Warning: failed to write check result: ' + e.message + '\n'); }
+    process.exit(1);
+  }
+} else {
+  // Fall back to PATH lookup
+  const probe = spawnSync('java', ['--version'], { encoding: 'utf8' });
+  if (probe.error || probe.status !== 0) {
+    process.stderr.write(
+      '[run-protocol-tlc] Java not found. Install Java >=17 and set JAVA_HOME.\n' +
+      '[run-protocol-tlc] Download: https://adoptium.net/\n'
+    );
+    const _startMs = Date.now();
+    const _runtimeMs = 0;
+    try { writeCheckResult({ tool: 'run-protocol-tlc', formalism: 'tla', result: 'fail', check_id: CHECK_ID_MAP[configName] || ('tla:' + configName.toLowerCase()), surface: 'tla', property: PROPERTY_MAP[configName] || configName, runtime_ms: _runtimeMs, summary: 'fail: Java not found in ' + _runtimeMs + 'ms', requirement_ids: getRequirementIds(CHECK_ID_MAP[configName] || ('tla:' + configName.toLowerCase())), metadata: { config: configName } }); } catch (e) { process.stderr.write('[run-protocol-tlc] Warning: failed to write check result: ' + e.message + '\n'); }
+    process.exit(1);
+  }
+  javaExe = 'java';
+}
+
+// ── 2. Check Java version >=17 ───────────────────────────────────────────────
+const versionResult = spawnSync(javaExe, ['--version'], { encoding: 'utf8' });
+if (versionResult.error || versionResult.status !== 0) {
+  process.stderr.write('[run-protocol-tlc] Failed to run: ' + javaExe + ' --version\n');
+  const _startMs = Date.now();
+  const _runtimeMs = 0;
+  try { writeCheckResult({ tool: 'run-protocol-tlc', formalism: 'tla', result: 'fail', check_id: CHECK_ID_MAP[configName] || ('tla:' + configName.toLowerCase()), surface: 'tla', property: PROPERTY_MAP[configName] || configName, runtime_ms: _runtimeMs, summary: 'fail: Java version check failed in ' + _runtimeMs + 'ms', requirement_ids: getRequirementIds(CHECK_ID_MAP[configName] || ('tla:' + configName.toLowerCase())), metadata: { config: configName } }); } catch (e) { process.stderr.write('[run-protocol-tlc] Warning: failed to write check result: ' + e.message + '\n'); }
+  process.exit(1);
+}
+const versionOutput = versionResult.stdout + versionResult.stderr;
+// Java version string varies: "openjdk 17.0.1 ..." or "java version \"17.0.1\""
+const versionMatch = versionOutput.match(/(?:openjdk\s+|java version\s+[""]?)(\d+)/i);
+const javaMajor    = versionMatch ? parseInt(versionMatch[1], 10) : 0;
+if (javaMajor < 17) {
+  process.stderr.write(
+    '[run-protocol-tlc] Java >=17 required. Found: ' + versionOutput.split('\n')[0] + '\n' +
+    '[run-protocol-tlc] Download Java 17+: https://adoptium.net/\n'
+  );
+  const _startMs = Date.now();
+  const _runtimeMs = 0;
+  try { writeCheckResult({ tool: 'run-protocol-tlc', formalism: 'tla', result: 'fail', check_id: CHECK_ID_MAP[configName] || ('tla:' + configName.toLowerCase()), surface: 'tla', property: PROPERTY_MAP[configName] || configName, runtime_ms: _runtimeMs, summary: 'fail: Java ' + javaMajor + ' < 17 in ' + _runtimeMs + 'ms', requirement_ids: getRequirementIds(CHECK_ID_MAP[configName] || ('tla:' + configName.toLowerCase())), metadata: { config: configName } }); } catch (e) { process.stderr.write('[run-protocol-tlc] Warning: failed to write check result: ' + e.message + '\n'); }
+  process.exit(1);
+}
+
+// ── 3. Locate tla2tools.jar ──────────────────────────────────────────────────
+const jarPath = path.join(ROOT, '.planning', 'formal', 'tla', 'tla2tools.jar');
+if (!fs.existsSync(jarPath)) {
+  process.stderr.write(
+    '[run-protocol-tlc] tla2tools.jar not found at: ' + jarPath + '\n' +
+    '[run-protocol-tlc] Download v1.8.0:\n' +
+    '  curl -L https://github.com/tlaplus/tlaplus/releases/download/v1.8.0/tla2tools.jar \\\n' +
+    '       -o .planning/formal/tla/tla2tools.jar\n'
+  );
+  const _startMs = Date.now();
+  const _runtimeMs = 0;
+  try { writeCheckResult({ tool: 'run-protocol-tlc', formalism: 'tla', result: 'fail', check_id: CHECK_ID_MAP[configName] || ('tla:' + configName.toLowerCase()), surface: 'tla', property: PROPERTY_MAP[configName] || configName, runtime_ms: _runtimeMs, summary: 'fail: tla2tools.jar not found in ' + _runtimeMs + 'ms', requirement_ids: getRequirementIds(CHECK_ID_MAP[configName] || ('tla:' + configName.toLowerCase())), metadata: { config: configName } }); } catch (e) { process.stderr.write('[run-protocol-tlc] Warning: failed to write check result: ' + e.message + '\n'); }
+  process.exit(1);
+}
+
+// ── 4. Resolve spec and config paths ─────────────────────────────────────────
+const specFileName = configName === 'MCdeliberation'
+  ? 'QGSDDeliberation.tla'
+  : 'QGSDPreFilter.tla';
+const specPath = path.join(ROOT, '.planning', 'formal', 'tla', specFileName);
+const cfgPath  = path.join(ROOT, '.planning', 'formal', 'tla', configName + '.cfg');
+
+// Both MCdeliberation and MCprefilter have PROPERTY (liveness) — always use -workers 1.
+// This avoids the TLC multi-worker liveness checking bug for both specs.
+const workers = '1';
+
+// ── 5. Invoke TLC ────────────────────────────────────────────────────────────
+process.stdout.write('[run-protocol-tlc] Config: ' + configName + '  Workers: ' + workers + '\n');
+process.stdout.write('[run-protocol-tlc] Spec:   ' + specPath + '\n');
+process.stdout.write('[run-protocol-tlc] Cfg:    ' + cfgPath + '\n');
+
+const _startMs = Date.now();
+process.stderr.write('[heap] Xms=64m Xmx=' + JAVA_HEAP_MAX + '\n');
+const tlcResult = spawnSync(javaExe, [
+  '-Xms64m', '-Xmx' + JAVA_HEAP_MAX,
+  '-jar', jarPath,
+  '-config', cfgPath,
+  '-workers', workers,
+  specPath,
+], { encoding: 'utf8', stdio: 'inherit' });
+const _runtimeMs = Date.now() - _startMs;
+
+if (tlcResult.error) {
+  process.stderr.write('[run-protocol-tlc] TLC invocation failed: ' + tlcResult.error.message + '\n');
+  const check_id = CHECK_ID_MAP[configName] || ('tla:' + configName.toLowerCase());
+  const property = PROPERTY_MAP[configName] || configName;
+  try { writeCheckResult({ tool: 'run-protocol-tlc', formalism: 'tla', result: 'fail', check_id: check_id, surface: 'tla', property: property, runtime_ms: _runtimeMs, summary: 'fail: TLC invocation failed in ' + _runtimeMs + 'ms', requirement_ids: getRequirementIds(check_id), metadata: { config: configName } }); } catch (e) { process.stderr.write('[run-protocol-tlc] Warning: failed to write check result: ' + e.message + '\n'); }
+  process.exit(1);
+}
+
+const passed = (tlcResult.status || 0) === 0;
+const check_id = CHECK_ID_MAP[configName] || ('tla:' + configName.toLowerCase());
+const property = PROPERTY_MAP[configName] || configName;
+const triage_tags = _runtimeMs > 120000 ? ['timeout-risk'] : [];
+
+if (passed) {
+  const missingDeclarations = detectLivenessProperties(configName, cfgPath);
+  if (missingDeclarations.length > 0) {
+    try {
+      writeCheckResult({
+        tool: 'run-protocol-tlc',
+        formalism: 'tla',
+        result: 'inconclusive',
+        check_id: check_id,
+        surface: 'tla',
+        property: property,
+        runtime_ms: _runtimeMs,
+        summary: 'inconclusive: fairness missing in ' + _runtimeMs + 'ms',
+        triage_tags: ['needs-fairness'],
+        requirement_ids: getRequirementIds(check_id),
+        metadata: {
+          config: configName,
+          reason: 'Fairness declaration missing for: ' + missingDeclarations.join(', '),
+        }
+      });
+    } catch (e) {
+      process.stderr.write('[run-protocol-tlc] Warning: failed to write inconclusive result: ' + e.message + '\n');
+    }
+    process.stdout.write('[run-protocol-tlc] Result: inconclusive — fairness declaration missing for: ' + missingDeclarations.join(', ') + '\n');
+    process.exit(0);
+  }
+  try { writeCheckResult({ tool: 'run-protocol-tlc', formalism: 'tla', result: 'pass', check_id: check_id, surface: 'tla', property: property, runtime_ms: _runtimeMs, summary: 'pass: ' + configName + ' in ' + _runtimeMs + 'ms', triage_tags: triage_tags, requirement_ids: getRequirementIds(check_id), metadata: { config: configName } }); } catch (e) { process.stderr.write('[run-protocol-tlc] Warning: failed to write check result: ' + e.message + '\n'); }
+  process.exit(0);
+} else {
+  try { writeCheckResult({ tool: 'run-protocol-tlc', formalism: 'tla', result: 'fail', check_id: check_id, surface: 'tla', property: property, runtime_ms: _runtimeMs, summary: 'fail: ' + configName + ' in ' + _runtimeMs + 'ms', triage_tags: triage_tags, requirement_ids: getRequirementIds(check_id), metadata: { config: configName } }); } catch (e) { process.stderr.write('[run-protocol-tlc] Warning: failed to write check result: ' + e.message + '\n'); }
+  process.exit(tlcResult.status || 0);
+}

package/bin/run-quorum-composition-alloy.cjs

@@ -0,0 +1,155 @@
+#!/usr/bin/env node
+'use strict';
+// bin/run-quorum-composition-alloy.cjs
+// Invokes Alloy 6 JAR headless for the QGSD quorum composition model.
+// Requirements: SPEC-03
+//
+// Usage:
+//   node bin/run-quorum-composition-alloy.cjs
+//
+// Prerequisites:
+//   - Java >=17 (https://adoptium.net/)
+//   - .planning/formal/alloy/org.alloytools.alloy.dist.jar (see VERIFICATION_TOOLS.md for download)
+
+const { spawnSync } = require('child_process');
+const JAVA_HEAP_MAX = process.env.QGSD_JAVA_HEAP_MAX || '512m';
+const fs   = require('fs');
+const path = require('path');
+const { writeCheckResult } = require('./write-check-result.cjs');
+const { getRequirementIds } = require('./requirement-map.cjs');
+
+// ── Resolve project root (--project-root= overrides __dirname-relative) ─────
+let ROOT = path.join(__dirname, '..');
+for (const arg of process.argv) {
+  if (arg.startsWith('--project-root=')) ROOT = path.resolve(arg.slice('--project-root='.length));
+}
+
+const CHECK_ID = 'alloy:quorum-composition';
+const PROPERTY = 'Quorum composition rules — no empty selection, high-risk full fan-out, solo mode single slot';
+
+// ── 1. Locate Java ───────────────────────────────────────────────────────────
+const JAVA_HOME = process.env.JAVA_HOME;
+let javaExe;
+
+if (JAVA_HOME) {
+  javaExe = path.join(JAVA_HOME, 'bin', 'java');
+  if (!fs.existsSync(javaExe)) {
+    process.stderr.write(
+      '[run-quorum-composition-alloy] JAVA_HOME is set but java binary not found at: ' + javaExe + '\n' +
+      '[run-quorum-composition-alloy] Unset JAVA_HOME or fix the path.\n'
+    );
+    try { writeCheckResult({ tool: 'run-quorum-composition-alloy', formalism: 'alloy', result: 'fail', check_id: CHECK_ID, surface: 'alloy', property: PROPERTY, runtime_ms: 0, summary: 'fail: ' + CHECK_ID + ' (Java not found)', triage_tags: [], requirement_ids: getRequirementIds(CHECK_ID), metadata: {} }); } catch (e) { process.stderr.write('[run-quorum-composition-alloy] Warning: failed to write check result: ' + e.message + '\n'); }
+    process.exit(1);
+  }
+} else {
+  // Fall back to PATH lookup
+  const probe = spawnSync('java', ['--version'], { encoding: 'utf8' });
+  if (probe.error || probe.status !== 0) {
+    process.stderr.write(
+      '[run-quorum-composition-alloy] Java not found. Install Java >=17 and set JAVA_HOME.\n' +
+      '[run-quorum-composition-alloy] Download: https://adoptium.net/\n'
+    );
+    try { writeCheckResult({ tool: 'run-quorum-composition-alloy', formalism: 'alloy', result: 'fail', check_id: CHECK_ID, surface: 'alloy', property: PROPERTY, runtime_ms: 0, summary: 'fail: ' + CHECK_ID + ' (Java not found)', triage_tags: [], requirement_ids: getRequirementIds(CHECK_ID), metadata: {} }); } catch (e) { process.stderr.write('[run-quorum-composition-alloy] Warning: failed to write check result: ' + e.message + '\n'); }
+    process.exit(1);
+  }
+  javaExe = 'java';
+}
+
+// ── 2. Check Java version >=17 ───────────────────────────────────────────────
+const versionResult = spawnSync(javaExe, ['--version'], { encoding: 'utf8' });
+if (versionResult.error || versionResult.status !== 0) {
+  process.stderr.write('[run-quorum-composition-alloy] Failed to run: ' + javaExe + ' --version\n');
+  try { writeCheckResult({ tool: 'run-quorum-composition-alloy', formalism: 'alloy', result: 'fail', check_id: CHECK_ID, surface: 'alloy', property: PROPERTY, runtime_ms: 0, summary: 'fail: ' + CHECK_ID + ' (version check failed)', triage_tags: [], requirement_ids: getRequirementIds(CHECK_ID), metadata: {} }); } catch (e) { process.stderr.write('[run-quorum-composition-alloy] Warning: failed to write check result: ' + e.message + '\n'); }
+  process.exit(1);
+}
+const versionOutput = versionResult.stdout + versionResult.stderr;
+const versionMatch = versionOutput.match(/(?:openjdk\s+|java version\s+[""]?)(\d+)/i);
+const javaMajor    = versionMatch ? parseInt(versionMatch[1], 10) : 0;
+if (javaMajor < 17) {
+  process.stderr.write(
+    '[run-quorum-composition-alloy] Java >=17 required. Found: ' + versionOutput.split('\n')[0] + '\n' +
+    '[run-quorum-composition-alloy] Download Java 17+: https://adoptium.net/\n'
+  );
+  try { writeCheckResult({ tool: 'run-quorum-composition-alloy', formalism: 'alloy', result: 'fail', check_id: CHECK_ID, surface: 'alloy', property: PROPERTY, runtime_ms: 0, summary: 'fail: ' + CHECK_ID + ' (Java < 17)', triage_tags: [], requirement_ids: getRequirementIds(CHECK_ID), metadata: {} }); } catch (e) { process.stderr.write('[run-quorum-composition-alloy] Warning: failed to write check result: ' + e.message + '\n'); }
+  process.exit(1);
+}
+
+// ── 3. Locate org.alloytools.alloy.dist.jar ──────────────────────────────────
+const jarPath = path.join(ROOT, '.planning', 'formal', 'alloy', 'org.alloytools.alloy.dist.jar');
+if (!fs.existsSync(jarPath)) {
+  process.stderr.write(
+    '[run-quorum-composition-alloy] org.alloytools.alloy.dist.jar not found at: ' + jarPath + '\n' +
+    '[run-quorum-composition-alloy] Download Alloy 6.2.0:\n' +
+    '  curl -L https://github.com/AlloyTools/org.alloytools.alloy/releases/download/v6.2.0/org.alloytools.alloy.dist.jar \\\n' +
+    '       -o .planning/formal/alloy/org.alloytools.alloy.dist.jar\n'
+  );
+  try { writeCheckResult({ tool: 'run-quorum-composition-alloy', formalism: 'alloy', result: 'fail', check_id: CHECK_ID, surface: 'alloy', property: PROPERTY, runtime_ms: 0, summary: 'fail: ' + CHECK_ID + ' (JAR not found)', triage_tags: [], requirement_ids: getRequirementIds(CHECK_ID), metadata: {} }); } catch (e) { process.stderr.write('[run-quorum-composition-alloy] Warning: failed to write check result: ' + e.message + '\n'); }
+  process.exit(1);
+}
+
+// ── 4. Locate .planning/formal/alloy/quorum-composition.als ────────────────────────────
+const alsPath = path.join(ROOT, '.planning', 'formal', 'alloy', 'quorum-composition.als');
+if (!fs.existsSync(alsPath)) {
+  process.stderr.write(
+    '[run-quorum-composition-alloy] quorum-composition.als not found at: ' + alsPath + '\n' +
+    '[run-quorum-composition-alloy] This file should exist in the repository. Check your git status.\n'
+  );
+  try { writeCheckResult({ tool: 'run-quorum-composition-alloy', formalism: 'alloy', result: 'fail', check_id: CHECK_ID, surface: 'alloy', property: PROPERTY, runtime_ms: 0, summary: 'fail: ' + CHECK_ID + ' (ALS not found)', triage_tags: [], requirement_ids: getRequirementIds(CHECK_ID), metadata: {} }); } catch (e) { process.stderr.write('[run-quorum-composition-alloy] Warning: failed to write check result: ' + e.message + '\n'); }
+  process.exit(1);
+}
+
+// ── 5. Invoke Alloy 6 ────────────────────────────────────────────────────────
+process.stdout.write('[run-quorum-composition-alloy] ALS: ' + alsPath + '\n');
+process.stdout.write('[run-quorum-composition-alloy] JAR: ' + jarPath + '\n');
+
+const _startMs = Date.now();
+
+// Use stdio: 'pipe' so we can scan stdout for counterexamples (Alloy exits 0 even on CEX)
+process.stderr.write('[heap] Xms=64m Xmx=' + JAVA_HEAP_MAX + '\n');
+const alloyResult = spawnSync(javaExe, [
+  '-Djava.awt.headless=true',
+  '-Xms64m', '-Xmx' + JAVA_HEAP_MAX,
+  '-jar', jarPath,
+  'exec',
+  '--output', '-',
+  '--type', 'text',
+  '--quiet',
+  alsPath,
+], { encoding: 'utf8', stdio: 'pipe' });
+
+if (alloyResult.error) {
+  process.stderr.write('[run-quorum-composition-alloy] Alloy invocation failed: ' + alloyResult.error.message + '\n');
+  const _runtimeMs = Date.now() - _startMs;
+  try { writeCheckResult({ tool: 'run-quorum-composition-alloy', formalism: 'alloy', result: 'fail', check_id: CHECK_ID, surface: 'alloy', property: PROPERTY, runtime_ms: _runtimeMs, summary: 'fail: ' + CHECK_ID + ' in ' + _runtimeMs + 'ms', triage_tags: _runtimeMs > 60000 ? ['timeout-risk'] : [], requirement_ids: getRequirementIds(CHECK_ID), metadata: {} }); } catch (e) { process.stderr.write('[run-quorum-composition-alloy] Warning: failed to write check result: ' + e.message + '\n'); }
+  process.exit(1);
+}
+
+// ── 6. Scan stdout for counterexamples ───────────────────────────────────────
+// Alloy 6 exits 0 even when counterexamples are found. Scan stdout to detect them.
+const stdout = alloyResult.stdout || '';
+const stderr = alloyResult.stderr || '';
+
+// Write stdout to process.stdout (mirrors stdio: 'inherit' output)
+if (stdout) { process.stdout.write(stdout); }
+if (stderr) { process.stderr.write(stderr); }
+
+if (/Counterexample/i.test(stdout)) {
+  process.stderr.write(
+    '[run-quorum-composition-alloy] WARNING: Counterexample found in quorum-composition.als assertions\n' +
+    '[run-quorum-composition-alloy] (NoEmptySelection / HighRiskFullFanOut / SoloModeSingleSlot / AllRulesHold).\n' +
+    '[run-quorum-composition-alloy] This indicates a spec violation — review quorum-composition.als.\n'
+  );
+  const _runtimeMs = Date.now() - _startMs;
+  try { writeCheckResult({ tool: 'run-quorum-composition-alloy', formalism: 'alloy', result: 'fail', check_id: CHECK_ID, surface: 'alloy', property: PROPERTY, runtime_ms: _runtimeMs, summary: 'fail: ' + CHECK_ID + ' in ' + _runtimeMs + 'ms', triage_tags: _runtimeMs > 60000 ? ['timeout-risk'] : [], requirement_ids: getRequirementIds(CHECK_ID), metadata: {} }); } catch (e) { process.stderr.write('[run-quorum-composition-alloy] Warning: failed to write check result: ' + e.message + '\n'); }
+  process.exit(1);
+}
+
+if (alloyResult.status !== 0) {
+  const _runtimeMs = Date.now() - _startMs;
+  try { writeCheckResult({ tool: 'run-quorum-composition-alloy', formalism: 'alloy', result: 'fail', check_id: CHECK_ID, surface: 'alloy', property: PROPERTY, runtime_ms: _runtimeMs, summary: 'fail: ' + CHECK_ID + ' in ' + _runtimeMs + 'ms', triage_tags: _runtimeMs > 60000 ? ['timeout-risk'] : [], requirement_ids: getRequirementIds(CHECK_ID), metadata: {} }); } catch (e) { process.stderr.write('[run-quorum-composition-alloy] Warning: failed to write check result: ' + e.message + '\n'); }
+  process.exit(alloyResult.status || 1);
+}
+
+const _runtimeMs = Date.now() - _startMs;
+try { writeCheckResult({ tool: 'run-quorum-composition-alloy', formalism: 'alloy', result: 'pass', check_id: CHECK_ID, surface: 'alloy', property: PROPERTY, runtime_ms: _runtimeMs, summary: 'pass: ' + CHECK_ID + ' in ' + _runtimeMs + 'ms', triage_tags: _runtimeMs > 60000 ? ['timeout-risk'] : [], requirement_ids: getRequirementIds(CHECK_ID), metadata: {} }); } catch (e) { process.stderr.write('[run-quorum-composition-alloy] Warning: failed to write check result: ' + e.message + '\n'); }
+process.exit(0);

package/bin/run-sensitivity-sweep.cjs

@@ -0,0 +1,231 @@
+#!/usr/bin/env node
+'use strict';
+// bin/run-sensitivity-sweep.cjs
+// Sensitivity sweep: varies key model parameters and records outcome deltas.
+// Requirements: SENS-01
+//
+// Usage:
+//   node bin/run-sensitivity-sweep.cjs
+//   SENSITIVITY_REPORT_PATH=/path/to/file.ndjson node bin/run-sensitivity-sweep.cjs
+//
+// Outputs to .planning/formal/sensitivity-report.ndjson (separate from check-results.ndjson).
+// Graceful degradation: if TLC/PRISM not found, records inconclusive results.
+// Always exits 0.
+
+const { spawnSync } = require('child_process');
+const JAVA_HEAP_MAX = process.env.QGSD_JAVA_HEAP_MAX || '512m';
+const fs   = require('fs');
+const path = require('path');
+const os   = require('os');
+
+const TAG = '[run-sensitivity-sweep]';
+
+const REPORT_PATH = process.env.SENSITIVITY_REPORT_PATH ||
+  path.join(__dirname, '..', '.planning', 'formal', 'sensitivity-report.ndjson');
+
+// ── Tool location helpers ────────────────────────────────────────────────────
+
+function locateTLC() {
+  const jar = path.join(__dirname, '..', '.planning', 'formal', 'tla', 'tla2tools.jar');
+  return fs.existsSync(jar) ? jar : null;
+}
+
+function locatePRISM() {
+  const envBin = process.env.PRISM_BIN;
+  if (envBin) return fs.existsSync(envBin) ? envBin : null;
+  const which = spawnSync('which', ['prism'], { encoding: 'utf8' });
+  return (which.status === 0 && which.stdout.trim()) ? which.stdout.trim() : null;
+}
+
+// ── Sweep runners ────────────────────────────────────────────────────────────
+
+function runTLCSweep(maxSize) {
+  const startMs = Date.now();
+  const tlcJar = locateTLC();
+  if (!tlcJar) {
+    return {
+      result: 'inconclusive',
+      runtime_ms: Date.now() - startMs,
+      summary: 'inconclusive: tla2tools.jar not found — install TLC to run sweep',
+      triage_tags: ['no-tlc'],
+    };
+  }
+
+  // Write temp cfg with MaxSize override
+  const baseCfgPath = path.join(__dirname, '..', '.planning', 'formal', 'tla', 'MCsafety.cfg');
+  if (!fs.existsSync(baseCfgPath)) {
+    return {
+      result: 'inconclusive',
+      runtime_ms: Date.now() - startMs,
+      summary: 'inconclusive: MCsafety.cfg not found',
+      triage_tags: ['missing-cfg'],
+    };
+  }
+
+  const tmpCfg = path.join(os.tmpdir(), 'sens-mcsafety-' + maxSize + '-' + Date.now() + '.cfg');
+  const baseCfg = fs.readFileSync(baseCfgPath, 'utf8');
+  const overrideCfg = baseCfg.replace(/MaxSize\s*=\s*\d+/, 'MaxSize = ' + maxSize);
+  fs.writeFileSync(tmpCfg, overrideCfg, 'utf8');
+
+  const tlaFile = path.join(__dirname, '..', '.planning', 'formal', 'tla', 'QGSDQuorum.tla');
+  process.stderr.write('[heap] Xms=64m Xmx=' + JAVA_HEAP_MAX + '\n');
+  const javaResult = spawnSync('java', [
+    '-Xms64m', '-Xmx' + JAVA_HEAP_MAX,
+    '-jar', tlcJar,
+    '-config', tmpCfg,
+    tlaFile,
+  ], { encoding: 'utf8', timeout: 120000 });
+
+  try { fs.unlinkSync(tmpCfg); } catch (_) {}
+
+  const runtimeMs = Date.now() - startMs;
+
+  if (javaResult.error) {
+    return {
+      result: 'inconclusive',
+      runtime_ms: runtimeMs,
+      summary: 'inconclusive: TLC launch error — ' + javaResult.error.message,
+      triage_tags: ['tlc-error'],
+    };
+  }
+
+  const passed = javaResult.status === 0;
+  return {
+    result: passed ? 'pass' : 'fail',
+    runtime_ms: runtimeMs,
+    summary: (passed ? 'pass' : 'fail') + ': TLA+ MCsafety MaxSize=' + maxSize + ' in ' + runtimeMs + 'ms',
+    triage_tags: [],
+  };
+}
+
+function runPRISMSweep(tpRate) {
+  const startMs = Date.now();
+  const prismBin = locatePRISM();
+  if (!prismBin) {
+    return {
+      result: 'inconclusive',
+      runtime_ms: Date.now() - startMs,
+      summary: 'inconclusive: prism binary not found — install PRISM to run sweep',
+      triage_tags: ['no-prism'],
+    };
+  }
+
+  const modelPath = path.join(__dirname, '..', '.planning', 'formal', 'prism', 'quorum.pm');
+  if (!fs.existsSync(modelPath)) {
+    return {
+      result: 'inconclusive',
+      runtime_ms: Date.now() - startMs,
+      summary: 'inconclusive: .planning/formal/prism/quorum.pm not found',
+      triage_tags: ['missing-model'],
+    };
+  }
+
+  const prismResult = spawnSync(prismBin, [
+    modelPath, '-pf', 'P=? [ F s=1 ]',
+    '-const', 'tp_rate=' + tpRate,
+  ], { encoding: 'utf8', timeout: 60000 });
+
+  const runtimeMs = Date.now() - startMs;
+
+  if (prismResult.error) {
+    return {
+      result: 'inconclusive',
+      runtime_ms: runtimeMs,
+      summary: 'inconclusive: PRISM launch error — ' + prismResult.error.message,
+      triage_tags: ['prism-error'],
+    };
+  }
+
+  const passed = prismResult.status === 0;
+  return {
+    result: passed ? 'pass' : 'fail',
+    runtime_ms: runtimeMs,
+    summary: (passed ? 'pass' : 'fail') + ': PRISM quorum tp_rate=' + tpRate + ' in ' + runtimeMs + 'ms',
+    triage_tags: [],
+  };
+}
+
+// ── Parameter sweep definitions (SENS-01: ≥2 parameters, ≥3 values each) ────
+
+const SWEEP_PARAMS = [
+  {
+    name: 'MaxSize',
+    description: 'TLA+ quorum size (N slots required for consensus)',
+    model: 'tla',
+    values: [1, 2, 3],
+    baseline: 3,
+    run: runTLCSweep,
+  },
+  {
+    name: 'tp_rate',
+    description: 'PRISM slot approval probability (P(slot votes APPROVE | available))',
+    model: 'prism',
+    values: [0.5, 0.75, 0.95],
+    baseline: 0.85,
+    run: runPRISMSweep,
+  },
+];
+
+// ── Record writer ─────────────────────────────────────────────────────────────
+
+function writeRecord(record) {
+  fs.appendFileSync(REPORT_PATH, JSON.stringify(record) + '\n', 'utf8');
+}
+
+// ── Main ──────────────────────────────────────────────────────────────────────
+
+function main() {
+  // Ensure output directory exists
+  fs.mkdirSync(path.dirname(REPORT_PATH), { recursive: true });
+
+  for (const param of SWEEP_PARAMS) {
+    process.stderr.write(TAG + ' Sweeping ' + param.name + ': ' + param.values.join(', ') + '\n');
+
+    // Run baseline first (if it's in the values list) to set baseline_result
+    let baselineResult = null;
+
+    for (const value of param.values) {
+      const outcome = param.run(value);
+
+      // Set baseline_result when we hit the baseline value
+      if (value === param.baseline) {
+        baselineResult = outcome.result;
+      }
+
+      const delta = baselineResult === null
+        ? 'unknown'
+        : outcome.result === baselineResult
+          ? 'stable'
+          : 'flip-to-' + outcome.result;
+
+      const record = {
+        tool: 'run-sensitivity-sweep',
+        formalism: param.model,
+        result: outcome.result,
+        timestamp: new Date().toISOString(),
+        check_id: 'sens:' + param.model + '-' + param.name.toLowerCase().replace(/_/g, '-'),
+        surface: 'sensitivity',
+        property: param.description + ' sweep',
+        runtime_ms: outcome.runtime_ms,
+        summary: outcome.summary,
+        triage_tags: outcome.triage_tags || [],
+        metadata: {
+          parameter: param.name,
+          value: value,
+          baseline: param.baseline,
+          baseline_result: baselineResult,
+          delta: delta,
+        },
+      };
+
+      writeRecord(record);
+      process.stderr.write(
+        TAG + '  ' + param.name + '=' + value + ' → ' + outcome.result + ' (' + delta + ')\n'
+      );
+    }
+  }
+
+  process.stderr.write(TAG + ' Sweep complete. Written to: ' + REPORT_PATH + '\n');
+}
+
+main();