@skillstech/thunderlang 0.1.6 → 0.2.0

package/src/codegen.mjs

@@ -2,7 +2,7 @@
 // intent always produces the same code. It generates what the intent fully determines (typed
 // interfaces, and the decision logic, which is already executable) and leaves honest TODO
 // markers where a human must supply the business logic , never a fake implementation. This is
-// the "see how it works, then change it" surface for the playground and `intent gen`.
+// the "see how it works, then change it" surface for the playground and `thunder gen`.
 //
 // Pure and browser-safe so the playground can render it. TypeScript first; the same adapter
 // shape (a type map + a body walk) extends to C# / Java.

package/src/compile.mjs

@@ -30,7 +30,7 @@ export function renderMarkdown(ast) {
 
 /**
  * Render a mission as Markdown documentation for ONE audience, weaving that lens's
- * IntentLens notes inline next to the mission element they annotate. Notes explain
+ * ThunderLens notes inline next to the mission element they annotate. Notes explain
  * meaning; they are never verification, and the doc says so. Pure and browser-safe.
  */
 export function renderLensDoc(ast, lens) {
@@ -40,7 +40,7 @@ export function renderLensDoc(ast, lens) {
   const notesFor = (path) => (ast.notes || []).filter((n) => n.lens === lens && n.targetPath === path);
   const L = [];
   L.push(`# ${m} , for the ${lens} reader`, '');
-  L.push(`> IntentLens \`${lens}\` notes are woven in below. They explain meaning for this`,
+  L.push(`> ThunderLens \`${lens}\` notes are woven in below. They explain meaning for this`,
     `> audience; they are documentation, not verification.`, '');
   for (const nt of notesFor(prefix)) L.push(`_${flat(nt.text)}_`, '');
   if (ast.goal) L.push(`**Goal.** ${ast.goal}`, '');
@@ -93,7 +93,7 @@ export function renderTestplan(ast) {
 }
 
 /**
- * Compile ThunderLang source in memory and return every artifact `intent build`
+ * Compile ThunderLang source in memory and return every artifact `thunder build`
  * would emit, without touching the filesystem.
  */
 export function compileSource(source, { sourceFile = 'playground.intent', generatedAt, origin = 'authored' } = {}) {

package/src/conformance.mjs

@@ -0,0 +1,35 @@
+// Cross-target conformance. ThunderLang can't execute generated TypeScript/Python, so it does
+// the honest thing: the deterministic engine defines the canonical contract (what every target
+// must produce for each test case), and target outputs fed via results are graded against it.
+// A target case that diverges is a CONFORMANCE FAILURE. Same tests, every implementation.
+import { runTests } from './testing.mjs';
+
+export function buildConformance(ast, { targets = [], results = null } = {}) {
+  const sem = runTests(ast);
+  const cases = (sem.results || []).map((r) => ({
+    key: `${r.target} / ${r.case}`, test: r.target, case: r.case,
+    inputs: r.inputs || {}, expected: r.expected, semantic: r.actual, semanticPass: !!r.pass,
+  }));
+  const columns = (targets.length ? targets : (ast.targets || [])).map((t) => String(t).toLowerCase());
+  const rows = cases.map((c) => {
+    const t = {};
+    for (const col of columns) {
+      const tr = results && results[col];
+      if (!tr || !(c.key in tr)) { t[col] = { status: 'declared' }; continue; }
+      const actual = tr[c.key];
+      t[col] = { status: String(actual) === String(c.expected) ? 'pass' : 'fail', actual };
+    }
+    return { ...c, targets: t };
+  });
+  const failures = [];
+  for (const row of rows) for (const col of columns) {
+    const tr = row.targets[col];
+    if (tr.status === 'fail') failures.push({ target: col, case: row.key, expected: row.expected, actual: tr.actual });
+  }
+  return {
+    schema: 'thunder-conformance-v1', mission: ast.mission,
+    total: cases.length, columns,
+    semanticFailures: cases.filter((c) => !c.semanticPass).length,
+    graded: !!results, failures, cases: rows,
+  };
+}

package/src/coverage.mjs

@@ -0,0 +1,56 @@
+// Semantic coverage , meaning-level metrics, not line coverage. Answers "which goals, decision
+// rules, guarantees, prohibitions, scenarios, and targets are actually exercised by the tests?"
+// so "12 of 15 prohibitions challenged" is far more useful than "82% line coverage".
+import { runTests } from './testing.mjs';
+
+const norm = (s) => String(s).toLowerCase().replace(/[^a-z0-9]+/g, ' ').trim();
+
+export function semanticCoverage(ast) {
+  const t = runTests(ast);
+  const metrics = [];
+  const unverified = [];
+  const add = (name, covered, total, missing = []) => {
+    metrics.push({ name, covered, total, pct: total ? Math.round((covered / total) * 100) : 100 });
+    for (const m of missing) unverified.push(m);
+  };
+
+  // Goal
+  if (ast.mission) add('Goals', ast.goal ? 1 : 0, 1, ast.goal ? [] : ['goal , the mission declares no goal']);
+
+  // Decision rules matched by at least one test case (branch coverage for decisions)
+  const matched = new Set((t.results || []).map((r) => r.matched).filter(Boolean));
+  const rules = (ast.decisions || []).flatMap((d) => (d.rules || []).filter((r) => r.name).map((r) => ({ dec: d.name, name: r.name })));
+  add('Decision rules', rules.filter((r) => matched.has(r.name)).length, rules.length,
+    rules.filter((r) => !matched.has(r.name)).map((r) => `rule ${r.dec}/${r.name} , never matched by a test`));
+
+  // Guarantees that carry a verification
+  const g = ast.guarantees || [];
+  add('Guarantees', g.filter((x) => (x.verify || []).length).length, g.length,
+    g.filter((x) => !(x.verify || []).length).map((x) => `guarantee ${x.id} , no verification`));
+
+  // Prohibitions challenged (a `never` with a verification)
+  const n = ast.neverRules || [];
+  add('Prohibitions', n.filter((x) => (x.verify || []).length).length, n.length,
+    n.filter((x) => !(x.verify || []).length).map((x) => `never ${x.id} , not challenged`));
+
+  // Scenarios that are self-consistent (not both expected and prohibited)
+  const sc = ast.scenarios || [];
+  if (sc.length) {
+    const consistent = sc.filter((s) => {
+      const nv = new Set((s.never || []).map(norm));
+      return ![...(s.then || []), ...(s.eventually || []).flatMap((e) => e.clauses)].some((p) => nv.has(norm(p)));
+    });
+    add('Scenarios', consistent.length, sc.length, sc.filter((s) => !consistent.includes(s)).map((s) => `scenario ${s.name} , self-contradictory`));
+  }
+
+  // Targets exercised by conformance (needs `thunder conform --results`; 0 until then)
+  const tg = ast.targets || [];
+  if (tg.length) add('Targets tested', 0, tg.length, tg.map((x) => `target ${x} , not conformance-tested`));
+
+  const totalCovered = metrics.reduce((a, m) => a + m.covered, 0);
+  const totalAll = metrics.reduce((a, m) => a + m.total, 0);
+  return {
+    schema: 'thunder-coverage-v1', mission: ast.mission, metrics, unverified,
+    overall: totalAll ? Math.round((totalCovered / totalAll) * 100) : 100,
+  };
+}

package/src/drift.mjs

@@ -2,7 +2,7 @@
 // still matches the approved intent. Deterministic, no AI. This is the
 // compiler-side drift check; OpenThunder does the deeper repo-wide version later.
 //
-//   lift code -> .intent draft -> intent approve -> (code changes) -> intent drift
+//   lift code -> .intent draft -> thunder approve -> (code changes) -> intent drift
 
 import { createHash } from 'node:crypto';
 import { parseIntent, slug } from './parse.mjs';
@@ -45,7 +45,7 @@ export function approveIntent(intentText, { approvedBy, approvedAt } = {}) {
     .replace(/^(\s*)reviewed\s+false\b/m, '$1reviewed true')
     .replace(/\s+$/, '');
   // Hash the exact content that gets written (post reviewed-flip), so a later
-  // `intent drift` recomputes the same hash when nothing has changed.
+  // `thunder drift` recomputes the same hash when nothing has changed.
   const hash = sha256(base.trim());
   const lines = ['approval', '  reviewed true'];
   if (approvedBy) lines.push(`  approved_by ${approvedBy}`);
@@ -137,7 +137,7 @@ export function checkDrift(intentText, codeSource, { language = 'typescript' } =
       add('warning', 'INTENT_DRIFT_STALE_PROOF', 'The approved intent was edited after approval (hash mismatch). Re-approve it.');
     }
   } else {
-    add('info', 'INTENT_DRIFT_NOT_APPROVED', 'This intent has no approval block. Approve it first: intent approve <file>.');
+    add('info', 'INTENT_DRIFT_NOT_APPROVED', 'This intent has no approval block. Approve it first: thunder approve <file>.');
   }
 
   const lift = liftSource(codeSource, { language });

package/src/emit.mjs

@@ -30,7 +30,7 @@ export function notesSummary(ast) {
   };
 }
 
-export const COMPILER_VERSION = '0.1.0';
+export const COMPILER_VERSION = '0.2.0';
 export const PROOF_SCHEMA_VERSION = '0.1.0';
 // Identifies which ecosystem product emitted this proof. Consumed by SkillsTech
 // Certified to key cert proofs to the compiler. Stable slug per the coordination bus.
@@ -188,7 +188,7 @@ export function semanticDiagnostics(ast) {
     }
   }
 
-  // ── IntentLens note checks (understanding, never verification) ──
+  // ── ThunderLens note checks (understanding, never verification) ──
   for (const note of ast.notes || []) {
     if (!KNOWN_LENSES.includes(note.lens)) {
       warn('INTENT_NOTE_UNKNOWN_LENS',
@@ -245,7 +245,7 @@ export function semanticDiagnostics(ast) {
   }
 
   // ── Product / intent-graph diagnostics (intent-graph-v1) ──
-  // Role-aware. Kept at warning/info so `intent check` stays valid; `severity` +
+  // Role-aware. Kept at warning/info so `thunder check` stays valid; `severity` +
   // `blocks` drive phase gates (a valid spec can still be not-ready-to-proceed).
   for (const m of ast.metrics || []) {
     if (!m.window) d.push({
@@ -494,11 +494,13 @@ export function buildProof(ast, { sourceFile, sourceHash, targetsRequested, targ
       id: g.id, text: g.statement,
       status: g.verify.length > 0 || verifiedText ? 'planned' : 'needs_verification',
       evidence: g.verify,
+      verifications: g.verifications || [],
     })),
     neverRules: ast.neverRules.map((n) => ({
       id: n.id, text: n.statement,
       status: n.verify.length > 0 ? 'planned' : 'needs_verification',
       evidence: n.verify,
+      verifications: n.verifications || [],
     })),
     errors: (ast.errors || []).map((e) => ({ name: e.name })),
     examples: (ast.examples || []).map((ex) => ({ given: ex.given, expect: ex.expect })),

package/src/expr.mjs

@@ -203,19 +203,22 @@ export function evalExpr(src, inputs = {}) {
 
 // Per-language rendering of the `when` grammar. `eq`/`neq` build an equality expression (JS uses
 // ===, C# ==, Java Objects.equals for correct string value equality); `inList` builds membership.
+// C-family boolean/logic defaults (js, csharp, java share these).
+const C_LOGIC = { and: (a, b) => `(${a} && ${b})`, or: (a, b) => `(${a} || ${b})`, not: (a) => `!${a}`, bool: (v) => String(v) };
 const DIALECTS = {
-  js: { eq: (a, b) => `${a} === ${b}`, neq: (a, b) => `${a} !== ${b}`, inList: (list, x) => `[${list.join(', ')}].includes(${x})`, nil: 'undefined' },
-  csharp: { eq: (a, b) => `${a} == ${b}`, neq: (a, b) => `${a} != ${b}`, inList: (list, x) => `new[]{${list.join(', ')}}.Contains(${x})`, nil: 'null' },
-  java: { eq: (a, b) => `java.util.Objects.equals(${a}, ${b})`, neq: (a, b) => `!java.util.Objects.equals(${a}, ${b})`, inList: (list, x) => `java.util.List.of(${list.join(', ')}).contains(${x})`, nil: 'null' },
+  js: { ...C_LOGIC, eq: (a, b) => `${a} === ${b}`, neq: (a, b) => `${a} !== ${b}`, inList: (list, x) => `[${list.join(', ')}].includes(${x})`, nil: 'undefined' },
+  csharp: { ...C_LOGIC, eq: (a, b) => `${a} == ${b}`, neq: (a, b) => `${a} != ${b}`, inList: (list, x) => `new[]{${list.join(', ')}}.Contains(${x})`, nil: 'null' },
+  java: { ...C_LOGIC, eq: (a, b) => `java.util.Objects.equals(${a}, ${b})`, neq: (a, b) => `!java.util.Objects.equals(${a}, ${b})`, inList: (list, x) => `java.util.List.of(${list.join(', ')}).contains(${x})`, nil: 'null' },
+  python: { and: (a, b) => `(${a} and ${b})`, or: (a, b) => `(${a} or ${b})`, not: (a) => `(not ${a})`, bool: (v) => (v ? 'True' : 'False'), eq: (a, b) => `${a} == ${b}`, neq: (a, b) => `${a} != ${b}`, inList: (list, x) => `${x} in [${list.join(', ')}]`, nil: 'None' },
 };
 
 function renderExpr(src, inputs, D) {
   const known = new Set(inputs);
   const r = (n) => {
     switch (n.k) {
-      case 'or': return `(${r(n.a)} || ${r(n.b)})`;
-      case 'and': return `(${r(n.a)} && ${r(n.b)})`;
-      case 'not': return `!${r(n.a)}`;
+      case 'or': return D.or(r(n.a), r(n.b));
+      case 'and': return D.and(r(n.a), r(n.b));
+      case 'not': return D.not(r(n.a));
       case 'neg': return `-${r(n.a)}`;
       case 'arith': return `(${r(n.a)} ${n.op} ${r(n.b)})`;
       case 'cmp':
@@ -224,7 +227,7 @@ function renderExpr(src, inputs, D) {
         return `(${r(n.a)} ${n.op} ${r(n.b)})`;
       case 'in': return D.inList(n.list.map(r), r(n.a));
       case 'list': return `[${n.items.map(r).join(', ')}]`;
-      case 'lit': return typeof n.v === 'string' ? JSON.stringify(n.v) : String(n.v);
+      case 'lit': return typeof n.v === 'string' ? JSON.stringify(n.v) : typeof n.v === 'boolean' ? D.bool(n.v) : String(n.v);
       case 'ref': return (known.has(n.path) || known.has(n.path.split('.')[0])) ? n.path : JSON.stringify(n.path);
       default: return D.nil;
     }
@@ -243,3 +246,4 @@ export function exprToCode(src, { inputs = [], dialect = 'js' } = {}) {
 export const exprToJs = (src, opts = {}) => exprToCode(src, { ...opts, dialect: 'js' });
 export const exprToCSharp = (src, opts = {}) => exprToCode(src, { ...opts, dialect: 'csharp' });
 export const exprToJava = (src, opts = {}) => exprToCode(src, { ...opts, dialect: 'java' });
+export const exprToPython = (src, opts = {}) => exprToCode(src, { ...opts, dialect: 'python' });

package/src/focus.mjs

@@ -33,7 +33,7 @@ function fingerprint(parts) {
 
 /** Build a typed Intent Scope. `createdAt` is supplied by the caller (deterministic/testable). */
 export function makeScope({ type = 'custom', title = null, seeds = [], projectId = null, createdBy = null, createdAt = null, ...rest } = {}) {
-  if (!SCOPE_TYPES.includes(type)) throw new Error(`intent focus: unknown scope type "${type}"`);
+  if (!SCOPE_TYPES.includes(type)) throw new Error(`thunder focus: unknown scope type "${type}"`);
   return {
     schema: FOCUS_SCHEMA,
     scopeId: `scope.${type}.${fingerprint([type, ...seeds].map(String))}`,

package/src/guard.mjs

@@ -65,7 +65,7 @@ export function buildGuard(ast, { denyResults, mask = '[redacted]' } = {}) {
 
   function decide(name, inputs) {
     const d = decisions.get(name);
-    if (!d) throw new Error(`intent guard: no decision "${name}"`);
+    if (!d) throw new Error(`thunder guard: no decision "${name}"`);
     const r = evaluateDecision(d, inputs || {});
     return { ...r, allowed: !isDenied(r.result) };
   }
@@ -73,7 +73,7 @@ export function buildGuard(ast, { denyResults, mask = '[redacted]' } = {}) {
   function assertAllowed(name, inputs) {
     const r = decide(name, inputs);
     if (!r.allowed) {
-      const e = new Error(`intent guard: decision "${name}" denied the action (result: ${r.result})`);
+      const e = new Error(`thunder guard: decision "${name}" denied the action (result: ${r.result})`);
       e.code = 'INTENT_GUARD_DENIED';
       e.decision = name;
       e.result = r.result;
@@ -98,7 +98,7 @@ export function compileGuard(intentText, opts) {
   return buildGuard(parseIntent(String(intentText ?? '')), opts);
 }
 
-/** A JSON-able summary of what a guard would enforce (for `intent guard` / audits). */
+/** A JSON-able summary of what a guard would enforce (for `thunder guard` / audits). */
 export function guardSummary(ast) {
   const g = buildGuard(ast);
   return { schema: GUARD_SCHEMA, redactsFields: g.secretFields, enforcesDecisions: g.decisions, neverRules: g.neverRules };

package/src/intellisense.mjs

@@ -129,7 +129,7 @@ export function getHover(source, position = {}) {
     return {
       hover: {
         target: lens, kind: 'note_lens', title: `note ${lens}`,
-        description: LENS_INFO[lens] || 'An IntentLens reader lens.',
+        description: LENS_INFO[lens] || 'An ThunderLens reader lens.',
         examples: [], relatedSuggestions: [],
       },
     };

package/src/intent-graph.mjs

@@ -344,3 +344,32 @@ export function buildIntentGraph(ast) {
     },
   };
 }
+
+// Data classifications that must never be shown in an external / display context.
+export const SENSITIVE_CLASSIFICATIONS = new Set([
+  'confidential', 'pii', 'sensitive', 'phi', 'restricted', 'personal', 'secret',
+]);
+
+// A display-safe projection of an intent graph for external rendering (e.g. STT's viewer).
+// Keeps the structural intent (ids, types, titles, statuses, relationships, classification LABEL)
+// but drops owner/source provenance and redacts free text on any node with a sensitive
+// classification. The intent graph carries no source code; data elements are governed separately
+// and are not emitted as graph nodes, so they cannot leak through this projection.
+export function safeGraph(graph) {
+  let redactedNodes = 0;
+  const nodes = (graph.nodes || []).map((n) => {
+    const sensitive = SENSITIVE_CLASSIFICATIONS.has(String(n.classification || '').toLowerCase());
+    const out = {
+      id: n.id, type: n.type, title: n.title ?? null, status: n.status ?? null,
+      classification: n.classification ?? null, tags: n.tags ?? [],
+      description: sensitive ? null : (n.description ?? null),
+    };
+    if (sensitive) { out.redacted = true; redactedNodes++; }
+    return out; // owner + source intentionally omitted
+  });
+  return {
+    schema: graph.schema, missionId: graph.missionId,
+    safe: true, redactedNodes,
+    nodes, relationships: graph.relationships || [], summary: graph.summary,
+  };
+}

package/src/intent-schema.mjs

@@ -3,7 +3,7 @@
 // enums / diagnostics (gap-closure program non-negotiable #1). Pure (no Node deps).
 //
 // IL owns + versions this. OT/RM/ST/STW import these enums + the JSON Schema instead
-// of maintaining their own copies. `intent schema` emits the JSON Schema.
+// of maintaining their own copies. `thunder schema` emits the JSON Schema.
 
 import { CLASSIFICATIONS, CONFIDENCE } from './classification.mjs';
 
@@ -134,7 +134,7 @@ const IL_AUTHOR_RULE_ROWS = [
   { ruleId: 'IL-SEC-002', area: 'security', severity: 'blocker', blocks: ['release'], summary: 'API returns a secret with no auth requirement.' },
   { ruleId: 'IL-TYPE-001', area: 'type', severity: 'info', blocks: [], summary: 'Field uses an unrecognized (likely mistyped) type.' },
   // 12-Factor Agents conformance (twelve-factor-v1). Advisory: an intent's alignment with the
-  // humanlayer/12-factor-agents principles. `intent twelve-factor` scores these.
+  // humanlayer/12-factor-agents principles. `thunder twelve-factor` scores these.
   { ruleId: 'IL-12F-01', area: 'twelve-factor', severity: 'info', blocks: [], summary: 'F1 Natural language to tool calls: model dispatch as a decision/command.' },
   { ruleId: 'IL-12F-02', area: 'twelve-factor', severity: 'info', blocks: [], summary: 'F2 Own your prompts: behavior is an owned, guaranteed contract, not a black box.' },
   { ruleId: 'IL-12F-03', area: 'twelve-factor', severity: 'info', blocks: [], summary: 'F3 Own your context window: declare a scope boundary.' },
@@ -165,8 +165,8 @@ const IL_CORE_RULE_ROWS = [
   { ruleId: 'unknown-block', area: 'core', severity: 'info', blocks: [], summary: 'Unrecognized top-level block.' },
   { ruleId: 'INTENT-ARCH-001', area: 'architecture', severity: 'warning', blocks: [], summary: 'Architecture rule not understood.' },
   { ruleId: 'INTENT-AI-010', area: 'ai', severity: 'warning', blocks: [], summary: 'Unsupported implementation scope.' },
-  { ruleId: 'INTENT_NOTE_UNKNOWN_LENS', area: 'note', severity: 'info', blocks: [], summary: 'IntentLens note uses an unknown lens.' },
-  { ruleId: 'INTENT_NOTE_EMPTY', area: 'note', severity: 'info', blocks: [], summary: 'IntentLens note is empty.' },
+  { ruleId: 'INTENT_NOTE_UNKNOWN_LENS', area: 'note', severity: 'info', blocks: [], summary: 'ThunderLens note uses an unknown lens.' },
+  { ruleId: 'INTENT_NOTE_EMPTY', area: 'note', severity: 'info', blocks: [], summary: 'ThunderLens note is empty.' },
 ];
 
 // ── Rule namespaces: ONE id space across two PHASES ──────────────────────────

package/src/ledger.mjs

@@ -40,7 +40,7 @@ function payloadOf(seq, entry, prev) {
 
 /** Append an entry to the ledger, hash-chained over the previous head. Returns a NEW ledger. */
 export function record(ledger, entry) {
-  if (!entry || !ENTRY_TYPES.includes(entry.type)) throw new Error(`intent ledger: unknown entry type "${entry?.type}"`);
+  if (!entry || !ENTRY_TYPES.includes(entry.type)) throw new Error(`thunder ledger: unknown entry type "${entry?.type}"`);
   const base = ledger && Array.isArray(ledger.entries) ? ledger : emptyLedger();
   const payload = payloadOf(base.entries.length, entry, base.head);
   const hash = sha256(JSON.stringify(payload));

package/src/lift.mjs

@@ -546,7 +546,7 @@ function liftDiagnostics(lift, facts) {
  * Lift a set of source files (a repo) into inferred ThunderLang drafts, one per
  * file that yields a mission. `files` is [{ file, source }] (the CLI reads the
  * filesystem; this core function stays pure). Returns per-mission drafts + a
- * repo-level summary matching the `intent lift --from repo --json` contract.
+ * repo-level summary matching the `thunder lift --from repo --json` contract.
  */
 export function languageForFile(file) {
   if (/\.rs$/i.test(file)) return 'rust';
@@ -651,7 +651,7 @@ const LANG_EXT = {
  * EXACT node ids instead of lift's own function refs, so there is no divergent second reading.
  * Additive: with no seeds the output is byte-identical to before.
  */
-export function liftSource(source, { language = 'typescript', file = '', seeds } = {}) {
+export function liftSource(source, { language = 'typescript', file = '', seeds = undefined } = {}) {
   const key = String(language).toLowerCase();
   const adapter = ADAPTERS[key];
   if (!adapter) {

package/src/lsp.mjs

@@ -1,7 +1,7 @@
 // A minimal Language Server for ThunderLang (LSP over stdio). Wraps the compiler's existing
 // diagnostics + IntelliSense so ANY LSP-capable editor (VS Code, Neovim, Helix, ...) gets
 // live ThunderLang intelligence: diagnostics on open/change, keyword/type completions, and
-// hover docs for semantic types and note lenses. Deterministic; no AI. `intent lsp` starts it.
+// hover docs for semantic types and note lenses. Deterministic; no AI. `thunder lsp` starts it.
 
 import { parseIntent } from './parse.mjs';
 import { semanticDiagnostics } from './emit.mjs';

package/src/mcp.mjs

@@ -4,7 +4,7 @@
 // check its own output, and , the keystone , verify a proposed code change against the intent
 // before it ships. No AI runs here; every tool is the pure, deterministic compiler.
 //
-// Start it with `intent mcp`. Point an MCP client at that command.
+// Start it with `thunder mcp`. Point an MCP client at that command.
 
 import { parseIntent } from './parse.mjs';
 import { semanticDiagnostics, COMPILER_VERSION } from './emit.mjs';

package/src/mutate.mjs

@@ -0,0 +1,46 @@
+// Mutation testing for ThunderLang decisions. Inject small, deterministic faults into a
+// decision's rules, re-run the in-file tests, and check whether they catch the change. A mutant
+// that no test detects (SURVIVED) marks a weak spot , tests that pass but do not protect the
+// system, exactly the failure mode of AI-authored tests.
+import { runTests } from './testing.mjs';
+
+const FLIP = { '>=': '<', '<=': '>', '>': '<=', '<': '>=', '==': '!=', '!=': '==' };
+const clone = (x) => JSON.parse(JSON.stringify(x));
+const withDecisions = (ast, decisions) => ({ ...ast, decisions });
+const passingSet = (ast) => new Set(runTests(ast).results.filter((x) => x.pass).map((x) => `${x.target}/${x.case}`));
+
+// Generate one mutant per (rule, operator). Each returns a mutated AST plus a description.
+function mutants(ast) {
+  const out = [];
+  const decs = ast.decisions || [];
+  decs.forEach((dec, di) => {
+    (dec.rules || []).forEach((rule, ri) => {
+      const tag = rule.name || `rule ${ri + 1}`;
+      if (rule.when) {
+        const m = rule.when.match(/(>=|<=|==|!=|>|<)/);
+        if (m) { const md = clone(decs); md[di].rules[ri].when = rule.when.replace(m[1], FLIP[m[1]]); out.push({ id: `${dec.name}/${tag}/flip`, describe: `flip ${m[1]} in ${tag} of ${dec.name}`, ast: withDecisions(ast, md) }); }
+        if (/\band\b/.test(rule.when)) { const md = clone(decs); md[di].rules[ri].when = rule.when.replace(/\band\b/, 'or'); out.push({ id: `${dec.name}/${tag}/and-or`, describe: `and -> or in ${tag} of ${dec.name}`, ast: withDecisions(ast, md) }); }
+      }
+      if (rule.result != null && dec.default != null && rule.result !== dec.default) {
+        const md = clone(decs); md[di].rules[ri].result = dec.default;
+        out.push({ id: `${dec.name}/${tag}/swap-return`, describe: `${tag} returns the default instead of ${rule.result}`, ast: withDecisions(ast, md) });
+      }
+      { const md = clone(decs); md[di].rules.splice(ri, 1); out.push({ id: `${dec.name}/${tag}/remove`, describe: `remove ${tag} from ${dec.name}`, ast: withDecisions(ast, md) }); }
+    });
+  });
+  return out;
+}
+
+export function runMutations(ast) {
+  const base = passingSet(ast);
+  if (base.size === 0) return { schema: 'thunder-mutation-v1', total: 0, killed: 0, survived: 0, score: null, note: 'no passing decision tests to mutate against', results: [] };
+  const results = mutants(ast).map((mu) => {
+    const now = passingSet(mu.ast);
+    // Killed if any test that passed on the original now fails on the mutant.
+    const killed = [...base].some((k) => !now.has(k));
+    return { id: mu.id, describe: mu.describe, killed };
+  });
+  const killed = results.filter((r) => r.killed).length;
+  const survived = results.length - killed;
+  return { schema: 'thunder-mutation-v1', total: results.length, killed, survived, score: results.length ? Math.round((killed / results.length) * 100) : null, results };
+}

package/src/parse.mjs

@@ -86,7 +86,7 @@ function buildTree(rows) {
   return root.children;
 }
 
-// Known IntentLens reader lenses. Unknown lenses warn (INTENT_NOTE_UNKNOWN_LENS).
+// Known ThunderLens reader lenses. Unknown lenses warn (INTENT_NOTE_UNKNOWN_LENS).
 export const KNOWN_LENSES = [
   'pm', 'beginner', 'qa', 'risk', 'security', 'support', 'reviewer', 'ops', 'non_goal', 'term',
 ];
@@ -114,7 +114,7 @@ const kvChildren = (node) => {
 const childBlock = (node, kw) => node.children.find((c) => firstWord(c.text) === kw);
 
 function parseFields(node) {
-  // "key: Type" lines. A field may carry indented modifiers and IntentLens notes.
+  // "key: Type" lines. A field may carry indented modifiers and ThunderLens notes.
   return node.children.map((c) => {
     const m = c.text.match(/^([A-Za-z_][\w]*)\s*:\s*(.+)$/);
     const modifiers = [];
@@ -181,6 +181,59 @@ function parseDecision(name, node) {
   return dec;
 }
 
+// Property-based test: `property Name` + forAll (typed vars with `where` constraints) +
+// `decide <Decision>` + expect clauses. The runner generates many cases and shrinks failures.
+function parseProperty(name, node) {
+  const prop = { name, vars: [], decide: null, expects: [], line: node.line };
+  for (const c of node.children.filter((x) => !isNote(x))) {
+    const k = firstWord(c.text); const a = rest(c.text);
+    if (k === 'forAll' || k === 'forall') {
+      for (const v of c.children.filter((x) => !isNote(x))) {
+        const m = v.text.trim().match(/^([A-Za-z_]\w*)\s*:\s*(\w+)(?:\s+where\s+(.+))?$/);
+        if (!m) continue;
+        const whereChild = (v.children || []).find((x) => firstWord(x.text) === 'where');
+        prop.vars.push({ name: m[1], type: m[2], where: m[3] || (whereChild ? rest(whereChild.text) : null) });
+      }
+    } else if (k === 'decide') prop.decide = a || (c.children[0] && c.children[0].text.trim()) || null;
+    else if (k === 'when') { const dm = a.match(/(?:decide|execute)\s+(\w+)/); if (dm) prop.decide = dm[1]; }
+    else if (k === 'expect') for (const e of c.children.filter((x) => !isNote(x))) prop.expects.push(e.text.trim());
+  }
+  return prop;
+}
+
+// AI evaluation: probabilistic behavior graded against a dataset by metric thresholds,
+// not a binary run. `evaluation <Name>` + `dataset <id>` + `require` (metric op threshold).
+function parseEvaluation(name, node) {
+  const ev = { name, dataset: null, requires: [], line: node.line };
+  for (const c of node.children.filter((x) => !isNote(x))) {
+    const k = firstWord(c.text); const a = rest(c.text);
+    if (k === 'dataset') ev.dataset = a || (c.children[0] && c.children[0].text.trim()) || null;
+    else if (k === 'require') {
+      for (const r of c.children.filter((x) => !isNote(x))) {
+        const m = r.text.trim().match(/^([A-Za-z_][\w.]*)\s*(>=|<=|==|!=|>|<)\s*(-?[\d.]+)$/);
+        if (m) ev.requires.push({ metric: m[1], op: m[2], threshold: parseFloat(m[3]) });
+      }
+    }
+  }
+  return ev;
+}
+
+// Scenario: a workflow-level test , given / when / then / never (+ eventually within <t>).
+// Deterministically checkable for self-contradiction (a `then` also listed under `never`).
+function parseScenario(name, node) {
+  const sc = { name, given: [], when: [], then: [], never: [], eventually: [], line: node.line };
+  const clausesOf = (c) => { const items = leafItems(c); return items.length ? items : (rest(c.text) ? [rest(c.text)] : []); };
+  for (const c of node.children.filter((x) => !isNote(x))) {
+    const k = firstWord(c.text);
+    if (k === 'given') sc.given.push(...clausesOf(c));
+    else if (k === 'when') sc.when.push(...clausesOf(c));
+    else if (k === 'then') sc.then.push(...clausesOf(c));
+    else if (k === 'never') sc.never.push(...clausesOf(c));
+    else if (k === 'eventually') { const within = (rest(c.text).match(/within\s+(.+)/) || [])[1] || null; sc.eventually.push({ within, clauses: leafItems(c) }); }
+  }
+  return sc;
+}
+
 // Lifecycle state machine (intent-graph-v1 Gap 2).
 function parseLifecycle(name, node) {
   const lc = { name, states: [], transitions: [], terminals: [], line: node.line };
@@ -215,6 +268,7 @@ function parseInvariant(name, node) {
   for (const c of kids(node)) {
     const k = firstWord(c.text);
     if (k === 'verify') inv.verify.push(rest(c.text));
+    else if (k === 'id') { const v = rest(c.text); if (v) { inv.id = v; inv.stableId = v; } }
     else if (k === 'because') inv.because = rest(c.text);
     else if (k === 'statement') inv.statement = rest(c.text) || leafItems(c).join(' ');
     else if (k === 'scope') inv.scope = (rest(c.text) || leafItems(c).join(' ')).toLowerCase();
@@ -288,10 +342,15 @@ function parseHandler(trigger, node) {
   };
 }
 
+// How a claim is verified (the six kinds of verification). Assertion = executable check;
+// static = types/deps/architecture; runtime = logs/events/traces; evidence = recorded proof;
+// tool = external scanner/CI; approval = human judgment; formal = mathematical proof.
+export const VERIFY_KINDS = new Set(['assertion', 'static', 'runtime', 'evidence', 'tool', 'approval', 'formal']);
+
 function upsertRule(list, statement, line) {
   const id = slug(statement);
   let r = list.find((x) => x.id === id);
-  if (!r) { r = { id, statement, because: null, verify: [], notes: [], line }; list.push(r); }
+  if (!r) { r = { id, statement, because: null, verify: [], verifications: [], notes: [], line }; list.push(r); }
   return r;
 }
 
@@ -299,7 +358,24 @@ function applyDetail(rule, node) {
   for (const c of node.children) {
     const kw = firstWord(c.text);
     if (kw === 'because') rule.because = rest(c.text) || (c.children[0] && c.children[0].text) || null;
-    else if (kw === 'verify') rule.verify.push(rest(c.text) || (c.children[0] && c.children[0].text) || '');
+    else if (kw === 'verify') {
+      const a = rest(c.text);
+      const m = a && a.match(/^by\s+(\w+)/i);
+      if (m) {
+        // Classified: `verify by <kind>` with the details as child lines.
+        const kind = m[1].toLowerCase();
+        const details = (c.children || []).filter((x) => !isNote(x)).map((x) => x.text.trim()).filter(Boolean);
+        rule.verifications.push({ kind: VERIFY_KINDS.has(kind) ? kind : 'unknown', declared: kind, details });
+        rule.verify.push(details.length ? `${kind}: ${details.join('; ')}` : `by ${kind}`);
+      } else {
+        // Legacy: `verify <text>` , an unclassified reference to a check.
+        const v = a || (c.children[0] && c.children[0].text) || '';
+        if (v) { rule.verify.push(v); rule.verifications.push({ kind: 'unclassified', declared: null, details: [v] }); }
+      }
+    }
+    // Explicit stable id (e.g. `id INV-G-001`): survives renames and moved files so semantic
+    // diffs, traceability, and durable proof stay stable. Falls back to the slug when absent.
+    else if (kw === 'id') { const v = rest(c.text) || (c.children[0] && c.children[0].text); if (v) { rule.id = v; rule.stableId = v; } }
     else if (isNote(c)) rule.notes.push(parseNoteNode(c));
   }
   rule.verify = rule.verify.filter(Boolean);
@@ -329,7 +405,7 @@ export function parseIntent(source) {
     // Distributed + failure semantics (Gap 3)
     commands: [], handlers: [],
     // Decisions, rules, process (Gap 4)
-    decisions: [],
+    decisions: [], properties: [], scenarios: [], evaluations: [],
     // Governance: waivers , governed exceptions to blocking diagnostics (Gap 5)
     waivers: [],
     // Data purpose + privacy , governed data elements (Gap 6)
@@ -481,6 +557,9 @@ export function parseIntent(source) {
         break;
       }
       case 'decision': ast.decisions.push(parseDecision(arg, node)); break;
+      case 'property': ast.properties.push(parseProperty(arg, node)); break;
+      case 'scenario': ast.scenarios.push(parseScenario(arg, node)); break;
+      case 'evaluation': ast.evaluations.push(parseEvaluation(arg, node)); break;
       // ── System profile ──
       case 'capability': {
         const cap = { name: arg, description: null, implements: [], line: node.line };
@@ -712,7 +791,7 @@ export function parseIntent(source) {
     }
   }
 
-  // ── Assemble IntentLens notes with stable ids, target kinds, paths, spans ──
+  // ── Assemble ThunderLens notes with stable ids, target kinds, paths, spans ──
   const mprefix = `mission.${ast.mission || 'unnamed'}`;
   const pushNote = (raw, targetKind, targetPath) => {
     if (!raw) return;

package/src/proof-schema.mjs

@@ -1,5 +1,5 @@
 // Canonical proof envelope schema (intent-proof-v1) , the shape of a `.intent-proof.json`
-// document. IL owns this: it is what the compiler emits (`buildProof`), what `intent verify`
+// document. IL owns this: it is what the compiler emits (`buildProof`), what `thunder verify`
 // re-derives against, and the "shared envelope" siblings sign (STW) and re-verify (RM/OT)
 // rather than each re-describing the proof shape. Pure ESM, ZERO Node deps , browser-safe so
 // a signing service or a cert renderer can validate an envelope without a Node build.
@@ -41,7 +41,7 @@ export function intentProofJsonSchema() {
       sourceProduct: { type: 'string' },
       missionName: { type: ['string', 'null'] },
       sourceFile: { type: 'string' },
-      // sha256:<hex> , the source fingerprint `intent verify` re-checks for drift/tampering.
+      // sha256:<hex> , the source fingerprint `thunder verify` re-checks for drift/tampering.
       sourceHash: { type: 'string', pattern: '^sha256:[0-9a-f]{64}$' },
       compilerVersion: { type: 'string' },
       generatedAt: { type: ['string', 'null'] },