@skillstech/thunderlang 0.1.7 → 0.2.0

package/src/conformance.mjs

@@ -0,0 +1,35 @@
+// Cross-target conformance. ThunderLang can't execute generated TypeScript/Python, so it does
+// the honest thing: the deterministic engine defines the canonical contract (what every target
+// must produce for each test case), and target outputs fed via results are graded against it.
+// A target case that diverges is a CONFORMANCE FAILURE. Same tests, every implementation.
+import { runTests } from './testing.mjs';
+
+export function buildConformance(ast, { targets = [], results = null } = {}) {
+  const sem = runTests(ast);
+  const cases = (sem.results || []).map((r) => ({
+    key: `${r.target} / ${r.case}`, test: r.target, case: r.case,
+    inputs: r.inputs || {}, expected: r.expected, semantic: r.actual, semanticPass: !!r.pass,
+  }));
+  const columns = (targets.length ? targets : (ast.targets || [])).map((t) => String(t).toLowerCase());
+  const rows = cases.map((c) => {
+    const t = {};
+    for (const col of columns) {
+      const tr = results && results[col];
+      if (!tr || !(c.key in tr)) { t[col] = { status: 'declared' }; continue; }
+      const actual = tr[c.key];
+      t[col] = { status: String(actual) === String(c.expected) ? 'pass' : 'fail', actual };
+    }
+    return { ...c, targets: t };
+  });
+  const failures = [];
+  for (const row of rows) for (const col of columns) {
+    const tr = row.targets[col];
+    if (tr.status === 'fail') failures.push({ target: col, case: row.key, expected: row.expected, actual: tr.actual });
+  }
+  return {
+    schema: 'thunder-conformance-v1', mission: ast.mission,
+    total: cases.length, columns,
+    semanticFailures: cases.filter((c) => !c.semanticPass).length,
+    graded: !!results, failures, cases: rows,
+  };
+}

package/src/coverage.mjs

@@ -0,0 +1,56 @@
+// Semantic coverage , meaning-level metrics, not line coverage. Answers "which goals, decision
+// rules, guarantees, prohibitions, scenarios, and targets are actually exercised by the tests?"
+// so "12 of 15 prohibitions challenged" is far more useful than "82% line coverage".
+import { runTests } from './testing.mjs';
+
+const norm = (s) => String(s).toLowerCase().replace(/[^a-z0-9]+/g, ' ').trim();
+
+export function semanticCoverage(ast) {
+  const t = runTests(ast);
+  const metrics = [];
+  const unverified = [];
+  const add = (name, covered, total, missing = []) => {
+    metrics.push({ name, covered, total, pct: total ? Math.round((covered / total) * 100) : 100 });
+    for (const m of missing) unverified.push(m);
+  };
+
+  // Goal
+  if (ast.mission) add('Goals', ast.goal ? 1 : 0, 1, ast.goal ? [] : ['goal , the mission declares no goal']);
+
+  // Decision rules matched by at least one test case (branch coverage for decisions)
+  const matched = new Set((t.results || []).map((r) => r.matched).filter(Boolean));
+  const rules = (ast.decisions || []).flatMap((d) => (d.rules || []).filter((r) => r.name).map((r) => ({ dec: d.name, name: r.name })));
+  add('Decision rules', rules.filter((r) => matched.has(r.name)).length, rules.length,
+    rules.filter((r) => !matched.has(r.name)).map((r) => `rule ${r.dec}/${r.name} , never matched by a test`));
+
+  // Guarantees that carry a verification
+  const g = ast.guarantees || [];
+  add('Guarantees', g.filter((x) => (x.verify || []).length).length, g.length,
+    g.filter((x) => !(x.verify || []).length).map((x) => `guarantee ${x.id} , no verification`));
+
+  // Prohibitions challenged (a `never` with a verification)
+  const n = ast.neverRules || [];
+  add('Prohibitions', n.filter((x) => (x.verify || []).length).length, n.length,
+    n.filter((x) => !(x.verify || []).length).map((x) => `never ${x.id} , not challenged`));
+
+  // Scenarios that are self-consistent (not both expected and prohibited)
+  const sc = ast.scenarios || [];
+  if (sc.length) {
+    const consistent = sc.filter((s) => {
+      const nv = new Set((s.never || []).map(norm));
+      return ![...(s.then || []), ...(s.eventually || []).flatMap((e) => e.clauses)].some((p) => nv.has(norm(p)));
+    });
+    add('Scenarios', consistent.length, sc.length, sc.filter((s) => !consistent.includes(s)).map((s) => `scenario ${s.name} , self-contradictory`));
+  }
+
+  // Targets exercised by conformance (needs `thunder conform --results`; 0 until then)
+  const tg = ast.targets || [];
+  if (tg.length) add('Targets tested', 0, tg.length, tg.map((x) => `target ${x} , not conformance-tested`));
+
+  const totalCovered = metrics.reduce((a, m) => a + m.covered, 0);
+  const totalAll = metrics.reduce((a, m) => a + m.total, 0);
+  return {
+    schema: 'thunder-coverage-v1', mission: ast.mission, metrics, unverified,
+    overall: totalAll ? Math.round((totalCovered / totalAll) * 100) : 100,
+  };
+}

package/src/emit.mjs

@@ -30,7 +30,7 @@ export function notesSummary(ast) {
   };
 }
 
-export const COMPILER_VERSION = '0.1.0';
+export const COMPILER_VERSION = '0.2.0';
 export const PROOF_SCHEMA_VERSION = '0.1.0';
 // Identifies which ecosystem product emitted this proof. Consumed by SkillsTech
 // Certified to key cert proofs to the compiler. Stable slug per the coordination bus.
@@ -494,11 +494,13 @@ export function buildProof(ast, { sourceFile, sourceHash, targetsRequested, targ
       id: g.id, text: g.statement,
       status: g.verify.length > 0 || verifiedText ? 'planned' : 'needs_verification',
       evidence: g.verify,
+      verifications: g.verifications || [],
     })),
     neverRules: ast.neverRules.map((n) => ({
       id: n.id, text: n.statement,
       status: n.verify.length > 0 ? 'planned' : 'needs_verification',
       evidence: n.verify,
+      verifications: n.verifications || [],
     })),
     errors: (ast.errors || []).map((e) => ({ name: e.name })),
     examples: (ast.examples || []).map((ex) => ({ given: ex.given, expect: ex.expect })),

package/src/expr.mjs

@@ -203,19 +203,22 @@ export function evalExpr(src, inputs = {}) {
 
 // Per-language rendering of the `when` grammar. `eq`/`neq` build an equality expression (JS uses
 // ===, C# ==, Java Objects.equals for correct string value equality); `inList` builds membership.
+// C-family boolean/logic defaults (js, csharp, java share these).
+const C_LOGIC = { and: (a, b) => `(${a} && ${b})`, or: (a, b) => `(${a} || ${b})`, not: (a) => `!${a}`, bool: (v) => String(v) };
 const DIALECTS = {
-  js: { eq: (a, b) => `${a} === ${b}`, neq: (a, b) => `${a} !== ${b}`, inList: (list, x) => `[${list.join(', ')}].includes(${x})`, nil: 'undefined' },
-  csharp: { eq: (a, b) => `${a} == ${b}`, neq: (a, b) => `${a} != ${b}`, inList: (list, x) => `new[]{${list.join(', ')}}.Contains(${x})`, nil: 'null' },
-  java: { eq: (a, b) => `java.util.Objects.equals(${a}, ${b})`, neq: (a, b) => `!java.util.Objects.equals(${a}, ${b})`, inList: (list, x) => `java.util.List.of(${list.join(', ')}).contains(${x})`, nil: 'null' },
+  js: { ...C_LOGIC, eq: (a, b) => `${a} === ${b}`, neq: (a, b) => `${a} !== ${b}`, inList: (list, x) => `[${list.join(', ')}].includes(${x})`, nil: 'undefined' },
+  csharp: { ...C_LOGIC, eq: (a, b) => `${a} == ${b}`, neq: (a, b) => `${a} != ${b}`, inList: (list, x) => `new[]{${list.join(', ')}}.Contains(${x})`, nil: 'null' },
+  java: { ...C_LOGIC, eq: (a, b) => `java.util.Objects.equals(${a}, ${b})`, neq: (a, b) => `!java.util.Objects.equals(${a}, ${b})`, inList: (list, x) => `java.util.List.of(${list.join(', ')}).contains(${x})`, nil: 'null' },
+  python: { and: (a, b) => `(${a} and ${b})`, or: (a, b) => `(${a} or ${b})`, not: (a) => `(not ${a})`, bool: (v) => (v ? 'True' : 'False'), eq: (a, b) => `${a} == ${b}`, neq: (a, b) => `${a} != ${b}`, inList: (list, x) => `${x} in [${list.join(', ')}]`, nil: 'None' },
 };
 
 function renderExpr(src, inputs, D) {
   const known = new Set(inputs);
   const r = (n) => {
     switch (n.k) {
-      case 'or': return `(${r(n.a)} || ${r(n.b)})`;
-      case 'and': return `(${r(n.a)} && ${r(n.b)})`;
-      case 'not': return `!${r(n.a)}`;
+      case 'or': return D.or(r(n.a), r(n.b));
+      case 'and': return D.and(r(n.a), r(n.b));
+      case 'not': return D.not(r(n.a));
       case 'neg': return `-${r(n.a)}`;
       case 'arith': return `(${r(n.a)} ${n.op} ${r(n.b)})`;
       case 'cmp':
@@ -224,7 +227,7 @@ function renderExpr(src, inputs, D) {
         return `(${r(n.a)} ${n.op} ${r(n.b)})`;
       case 'in': return D.inList(n.list.map(r), r(n.a));
       case 'list': return `[${n.items.map(r).join(', ')}]`;
-      case 'lit': return typeof n.v === 'string' ? JSON.stringify(n.v) : String(n.v);
+      case 'lit': return typeof n.v === 'string' ? JSON.stringify(n.v) : typeof n.v === 'boolean' ? D.bool(n.v) : String(n.v);
       case 'ref': return (known.has(n.path) || known.has(n.path.split('.')[0])) ? n.path : JSON.stringify(n.path);
       default: return D.nil;
     }
@@ -243,3 +246,4 @@ export function exprToCode(src, { inputs = [], dialect = 'js' } = {}) {
 export const exprToJs = (src, opts = {}) => exprToCode(src, { ...opts, dialect: 'js' });
 export const exprToCSharp = (src, opts = {}) => exprToCode(src, { ...opts, dialect: 'csharp' });
 export const exprToJava = (src, opts = {}) => exprToCode(src, { ...opts, dialect: 'java' });
+export const exprToPython = (src, opts = {}) => exprToCode(src, { ...opts, dialect: 'python' });

package/src/intent-graph.mjs

@@ -344,3 +344,32 @@ export function buildIntentGraph(ast) {
     },
   };
 }
+
+// Data classifications that must never be shown in an external / display context.
+export const SENSITIVE_CLASSIFICATIONS = new Set([
+  'confidential', 'pii', 'sensitive', 'phi', 'restricted', 'personal', 'secret',
+]);
+
+// A display-safe projection of an intent graph for external rendering (e.g. STT's viewer).
+// Keeps the structural intent (ids, types, titles, statuses, relationships, classification LABEL)
+// but drops owner/source provenance and redacts free text on any node with a sensitive
+// classification. The intent graph carries no source code; data elements are governed separately
+// and are not emitted as graph nodes, so they cannot leak through this projection.
+export function safeGraph(graph) {
+  let redactedNodes = 0;
+  const nodes = (graph.nodes || []).map((n) => {
+    const sensitive = SENSITIVE_CLASSIFICATIONS.has(String(n.classification || '').toLowerCase());
+    const out = {
+      id: n.id, type: n.type, title: n.title ?? null, status: n.status ?? null,
+      classification: n.classification ?? null, tags: n.tags ?? [],
+      description: sensitive ? null : (n.description ?? null),
+    };
+    if (sensitive) { out.redacted = true; redactedNodes++; }
+    return out; // owner + source intentionally omitted
+  });
+  return {
+    schema: graph.schema, missionId: graph.missionId,
+    safe: true, redactedNodes,
+    nodes, relationships: graph.relationships || [], summary: graph.summary,
+  };
+}

package/src/mutate.mjs

@@ -0,0 +1,46 @@
+// Mutation testing for ThunderLang decisions. Inject small, deterministic faults into a
+// decision's rules, re-run the in-file tests, and check whether they catch the change. A mutant
+// that no test detects (SURVIVED) marks a weak spot , tests that pass but do not protect the
+// system, exactly the failure mode of AI-authored tests.
+import { runTests } from './testing.mjs';
+
+const FLIP = { '>=': '<', '<=': '>', '>': '<=', '<': '>=', '==': '!=', '!=': '==' };
+const clone = (x) => JSON.parse(JSON.stringify(x));
+const withDecisions = (ast, decisions) => ({ ...ast, decisions });
+const passingSet = (ast) => new Set(runTests(ast).results.filter((x) => x.pass).map((x) => `${x.target}/${x.case}`));
+
+// Generate one mutant per (rule, operator). Each returns a mutated AST plus a description.
+function mutants(ast) {
+  const out = [];
+  const decs = ast.decisions || [];
+  decs.forEach((dec, di) => {
+    (dec.rules || []).forEach((rule, ri) => {
+      const tag = rule.name || `rule ${ri + 1}`;
+      if (rule.when) {
+        const m = rule.when.match(/(>=|<=|==|!=|>|<)/);
+        if (m) { const md = clone(decs); md[di].rules[ri].when = rule.when.replace(m[1], FLIP[m[1]]); out.push({ id: `${dec.name}/${tag}/flip`, describe: `flip ${m[1]} in ${tag} of ${dec.name}`, ast: withDecisions(ast, md) }); }
+        if (/\band\b/.test(rule.when)) { const md = clone(decs); md[di].rules[ri].when = rule.when.replace(/\band\b/, 'or'); out.push({ id: `${dec.name}/${tag}/and-or`, describe: `and -> or in ${tag} of ${dec.name}`, ast: withDecisions(ast, md) }); }
+      }
+      if (rule.result != null && dec.default != null && rule.result !== dec.default) {
+        const md = clone(decs); md[di].rules[ri].result = dec.default;
+        out.push({ id: `${dec.name}/${tag}/swap-return`, describe: `${tag} returns the default instead of ${rule.result}`, ast: withDecisions(ast, md) });
+      }
+      { const md = clone(decs); md[di].rules.splice(ri, 1); out.push({ id: `${dec.name}/${tag}/remove`, describe: `remove ${tag} from ${dec.name}`, ast: withDecisions(ast, md) }); }
+    });
+  });
+  return out;
+}
+
+export function runMutations(ast) {
+  const base = passingSet(ast);
+  if (base.size === 0) return { schema: 'thunder-mutation-v1', total: 0, killed: 0, survived: 0, score: null, note: 'no passing decision tests to mutate against', results: [] };
+  const results = mutants(ast).map((mu) => {
+    const now = passingSet(mu.ast);
+    // Killed if any test that passed on the original now fails on the mutant.
+    const killed = [...base].some((k) => !now.has(k));
+    return { id: mu.id, describe: mu.describe, killed };
+  });
+  const killed = results.filter((r) => r.killed).length;
+  const survived = results.length - killed;
+  return { schema: 'thunder-mutation-v1', total: results.length, killed, survived, score: results.length ? Math.round((killed / results.length) * 100) : null, results };
+}

package/src/parse.mjs

@@ -181,6 +181,59 @@ function parseDecision(name, node) {
   return dec;
 }
 
+// Property-based test: `property Name` + forAll (typed vars with `where` constraints) +
+// `decide <Decision>` + expect clauses. The runner generates many cases and shrinks failures.
+function parseProperty(name, node) {
+  const prop = { name, vars: [], decide: null, expects: [], line: node.line };
+  for (const c of node.children.filter((x) => !isNote(x))) {
+    const k = firstWord(c.text); const a = rest(c.text);
+    if (k === 'forAll' || k === 'forall') {
+      for (const v of c.children.filter((x) => !isNote(x))) {
+        const m = v.text.trim().match(/^([A-Za-z_]\w*)\s*:\s*(\w+)(?:\s+where\s+(.+))?$/);
+        if (!m) continue;
+        const whereChild = (v.children || []).find((x) => firstWord(x.text) === 'where');
+        prop.vars.push({ name: m[1], type: m[2], where: m[3] || (whereChild ? rest(whereChild.text) : null) });
+      }
+    } else if (k === 'decide') prop.decide = a || (c.children[0] && c.children[0].text.trim()) || null;
+    else if (k === 'when') { const dm = a.match(/(?:decide|execute)\s+(\w+)/); if (dm) prop.decide = dm[1]; }
+    else if (k === 'expect') for (const e of c.children.filter((x) => !isNote(x))) prop.expects.push(e.text.trim());
+  }
+  return prop;
+}
+
+// AI evaluation: probabilistic behavior graded against a dataset by metric thresholds,
+// not a binary run. `evaluation <Name>` + `dataset <id>` + `require` (metric op threshold).
+function parseEvaluation(name, node) {
+  const ev = { name, dataset: null, requires: [], line: node.line };
+  for (const c of node.children.filter((x) => !isNote(x))) {
+    const k = firstWord(c.text); const a = rest(c.text);
+    if (k === 'dataset') ev.dataset = a || (c.children[0] && c.children[0].text.trim()) || null;
+    else if (k === 'require') {
+      for (const r of c.children.filter((x) => !isNote(x))) {
+        const m = r.text.trim().match(/^([A-Za-z_][\w.]*)\s*(>=|<=|==|!=|>|<)\s*(-?[\d.]+)$/);
+        if (m) ev.requires.push({ metric: m[1], op: m[2], threshold: parseFloat(m[3]) });
+      }
+    }
+  }
+  return ev;
+}
+
+// Scenario: a workflow-level test , given / when / then / never (+ eventually within <t>).
+// Deterministically checkable for self-contradiction (a `then` also listed under `never`).
+function parseScenario(name, node) {
+  const sc = { name, given: [], when: [], then: [], never: [], eventually: [], line: node.line };
+  const clausesOf = (c) => { const items = leafItems(c); return items.length ? items : (rest(c.text) ? [rest(c.text)] : []); };
+  for (const c of node.children.filter((x) => !isNote(x))) {
+    const k = firstWord(c.text);
+    if (k === 'given') sc.given.push(...clausesOf(c));
+    else if (k === 'when') sc.when.push(...clausesOf(c));
+    else if (k === 'then') sc.then.push(...clausesOf(c));
+    else if (k === 'never') sc.never.push(...clausesOf(c));
+    else if (k === 'eventually') { const within = (rest(c.text).match(/within\s+(.+)/) || [])[1] || null; sc.eventually.push({ within, clauses: leafItems(c) }); }
+  }
+  return sc;
+}
+
 // Lifecycle state machine (intent-graph-v1 Gap 2).
 function parseLifecycle(name, node) {
   const lc = { name, states: [], transitions: [], terminals: [], line: node.line };
@@ -215,6 +268,7 @@ function parseInvariant(name, node) {
   for (const c of kids(node)) {
     const k = firstWord(c.text);
     if (k === 'verify') inv.verify.push(rest(c.text));
+    else if (k === 'id') { const v = rest(c.text); if (v) { inv.id = v; inv.stableId = v; } }
     else if (k === 'because') inv.because = rest(c.text);
     else if (k === 'statement') inv.statement = rest(c.text) || leafItems(c).join(' ');
     else if (k === 'scope') inv.scope = (rest(c.text) || leafItems(c).join(' ')).toLowerCase();
@@ -288,10 +342,15 @@ function parseHandler(trigger, node) {
   };
 }
 
+// How a claim is verified (the six kinds of verification). Assertion = executable check;
+// static = types/deps/architecture; runtime = logs/events/traces; evidence = recorded proof;
+// tool = external scanner/CI; approval = human judgment; formal = mathematical proof.
+export const VERIFY_KINDS = new Set(['assertion', 'static', 'runtime', 'evidence', 'tool', 'approval', 'formal']);
+
 function upsertRule(list, statement, line) {
   const id = slug(statement);
   let r = list.find((x) => x.id === id);
-  if (!r) { r = { id, statement, because: null, verify: [], notes: [], line }; list.push(r); }
+  if (!r) { r = { id, statement, because: null, verify: [], verifications: [], notes: [], line }; list.push(r); }
   return r;
 }
 
@@ -299,7 +358,24 @@ function applyDetail(rule, node) {
   for (const c of node.children) {
     const kw = firstWord(c.text);
     if (kw === 'because') rule.because = rest(c.text) || (c.children[0] && c.children[0].text) || null;
-    else if (kw === 'verify') rule.verify.push(rest(c.text) || (c.children[0] && c.children[0].text) || '');
+    else if (kw === 'verify') {
+      const a = rest(c.text);
+      const m = a && a.match(/^by\s+(\w+)/i);
+      if (m) {
+        // Classified: `verify by <kind>` with the details as child lines.
+        const kind = m[1].toLowerCase();
+        const details = (c.children || []).filter((x) => !isNote(x)).map((x) => x.text.trim()).filter(Boolean);
+        rule.verifications.push({ kind: VERIFY_KINDS.has(kind) ? kind : 'unknown', declared: kind, details });
+        rule.verify.push(details.length ? `${kind}: ${details.join('; ')}` : `by ${kind}`);
+      } else {
+        // Legacy: `verify <text>` , an unclassified reference to a check.
+        const v = a || (c.children[0] && c.children[0].text) || '';
+        if (v) { rule.verify.push(v); rule.verifications.push({ kind: 'unclassified', declared: null, details: [v] }); }
+      }
+    }
+    // Explicit stable id (e.g. `id INV-G-001`): survives renames and moved files so semantic
+    // diffs, traceability, and durable proof stay stable. Falls back to the slug when absent.
+    else if (kw === 'id') { const v = rest(c.text) || (c.children[0] && c.children[0].text); if (v) { rule.id = v; rule.stableId = v; } }
     else if (isNote(c)) rule.notes.push(parseNoteNode(c));
   }
   rule.verify = rule.verify.filter(Boolean);
@@ -329,7 +405,7 @@ export function parseIntent(source) {
     // Distributed + failure semantics (Gap 3)
     commands: [], handlers: [],
     // Decisions, rules, process (Gap 4)
-    decisions: [],
+    decisions: [], properties: [], scenarios: [], evaluations: [],
     // Governance: waivers , governed exceptions to blocking diagnostics (Gap 5)
     waivers: [],
     // Data purpose + privacy , governed data elements (Gap 6)
@@ -481,6 +557,9 @@ export function parseIntent(source) {
         break;
       }
       case 'decision': ast.decisions.push(parseDecision(arg, node)); break;
+      case 'property': ast.properties.push(parseProperty(arg, node)); break;
+      case 'scenario': ast.scenarios.push(parseScenario(arg, node)); break;
+      case 'evaluation': ast.evaluations.push(parseEvaluation(arg, node)); break;
       // ── System profile ──
       case 'capability': {
         const cap = { name: arg, description: null, implements: [], line: node.line };

package/src/property.mjs

@@ -0,0 +1,108 @@
+// Property-based testing for ThunderLang decisions. Deterministic and seeded: for each
+// `property`, generate many input cases that satisfy the `forAll` constraints, evaluate the
+// named decision, and assert the `expect` clauses hold for every case. On failure, binary-shrink
+// each numeric input toward its lower bound to report the smallest reproducible failure.
+import { evaluateDecision } from './runtime.mjs';
+import { compileExpr } from './expr.mjs';
+
+const DEFAULT_MIN = 0, DEFAULT_MAX = 1000;
+
+function mulberry32(seed) {
+  let a = seed >>> 0;
+  return () => {
+    a = (a + 0x6d2b79f5) | 0;
+    let t = Math.imul(a ^ (a >>> 15), 1 | a);
+    t = (t + Math.imul(t ^ (t >>> 7), 61 | t)) ^ t;
+    return ((t ^ (t >>> 14)) >>> 0) / 4294967296;
+  };
+}
+
+// Derive an integer [min, max] for a variable from its `where` clause (>=, >, <=, <, ==).
+function boundsFor(where, varName) {
+  let min = DEFAULT_MIN, max = DEFAULT_MAX;
+  if (!where) return { min, max };
+  const re = new RegExp(`\\b${varName}\\s*(>=|<=|>|<|==)\\s*(-?\\d+)`, 'g');
+  let m;
+  while ((m = re.exec(where))) {
+    const n = parseInt(m[2], 10);
+    if (m[1] === '>=') min = Math.max(min, n);
+    else if (m[1] === '>') min = Math.max(min, n + 1);
+    else if (m[1] === '<=') max = Math.min(max, n);
+    else if (m[1] === '<') max = Math.min(max, n - 1);
+    else if (m[1] === '==') { min = n; max = n; }
+  }
+  const unsat = min > max; // e.g. `where x >= 100 and x <= 0` , no integer satisfies it
+  if (unsat) max = min;
+  return { min, max, unsat };
+}
+
+const isBool = (t) => /bool/i.test(t || '');
+
+function satisfies(v, val) {
+  if (!v.where) return true;
+  try { return !!compileExpr(v.where)({ [v.name]: val }); } catch { return true; }
+}
+
+function genValue(v, rnd) {
+  if (isBool(v.type)) return rnd() < 0.5;
+  const { min, max } = boundsFor(v.where, v.name);
+  return Math.floor(min + rnd() * (max - min + 1));
+}
+
+// Evaluate the property's expect clauses against a decision run. Returns the first violation.
+function checkExpects(prop, run) {
+  for (const e of prop.expects) {
+    const m = e.match(/^(\w+)\s*(==|!=)\s*(.+?)\s*$/);
+    if (!m) continue;
+    const field = m[1] === 'matchedRule' || m[1] === 'rule' ? 'matched' : 'result';
+    const lhs = field === 'matched' ? run.matched : run.result;
+    const eq = String(lhs) === m[3];
+    if (m[2] === '==' ? !eq : eq) return { ok: false, expect: e, actual: lhs };
+  }
+  return { ok: true };
+}
+
+// Given the other inputs fixed, find the smallest value of `v` that still fails the property.
+function shrinkVar(prop, dec, inputs, v) {
+  if (isBool(v.type) || typeof inputs[v.name] !== 'number') return inputs[v.name];
+  const { min } = boundsFor(v.where, v.name);
+  const fails = (val) => satisfies(v, val) && !checkExpects(prop, evaluateDecision(dec, { ...inputs, [v.name]: val })).ok;
+  if (fails(min)) return min;
+  let lo = min, hi = inputs[v.name];
+  while (hi - lo > 1) { const mid = Math.floor((lo + hi) / 2); if (fails(mid)) hi = mid; else lo = mid; }
+  return hi;
+}
+
+function shrink(prop, dec, failing) {
+  const inputs = { ...failing.inputs };
+  for (const v of prop.vars) inputs[v.name] = shrinkVar(prop, dec, inputs, v);
+  const run = evaluateDecision(dec, inputs);
+  const chk = checkExpects(prop, run);
+  return { inputs, expect: chk.expect || failing.expect, actual: chk.actual };
+}
+
+export function runProperties(ast, { cases = 100, seed = 424242 } = {}) {
+  const decisions = new Map((ast.decisions || []).map((d) => [d.name, d]));
+  const results = [];
+  for (const prop of ast.properties || []) {
+    const dec = decisions.get(prop.decide);
+    if (!dec) { results.push({ property: prop.name, ok: false, cases: 0, seed, error: prop.decide ? `no decision named "${prop.decide}"` : 'property has no `decide <Decision>`' }); continue; }
+    const badVar = prop.vars.find((v) => !isBool(v.type) && boundsFor(v.where, v.name).unsat);
+    if (badVar) { results.push({ property: prop.name, ok: false, cases: 0, seed, error: `unsatisfiable constraint for "${badVar.name}": ${badVar.where}` }); continue; }
+    const rnd = mulberry32(seed);
+    let failure = null;
+    for (let i = 0; i < cases && !failure; i++) {
+      const inputs = {};
+      for (const v of prop.vars) {
+        let val, tries = 0;
+        do { val = genValue(v, rnd); tries++; } while (!satisfies(v, val) && tries < 50);
+        inputs[v.name] = val;
+      }
+      const chk = checkExpects(prop, evaluateDecision(dec, inputs));
+      if (!chk.ok) failure = { inputs, expect: chk.expect, actual: chk.actual };
+    }
+    if (failure) failure = shrink(prop, dec, failure);
+    results.push({ property: prop.name, ok: !failure, cases, seed, failure });
+  }
+  return { schema: 'thunder-properties-v1', total: results.length, passed: results.filter((r) => r.ok).length, results };
+}

package/src/target-cs.mjs

@@ -0,0 +1,98 @@
+// C# target adapter. Emits a self-contained Program.cs that defines each decision as a typed
+// static method (using the same exprToCSharp translator the codegen uses), calls every test case
+// with typed literal arguments, and prints the results as one JSON line. It runs through a
+// throwaway `dotnet` console project (scaffold + `dotnet run`), so a live C# run grades real
+// compiled + executed code. Returns null (skip cleanly) when no usable .NET SDK exists.
+import { spawnSync } from 'node:child_process';
+import { mkdtempSync, writeFileSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { exprToCSharp } from './expr.mjs';
+import { inputNames, inferInputTypes, buildCases, parseLastJsonObject, cachedSmoke, strLit, litFor } from './target-util.mjs';
+
+const CS_TYPE = { number: 'double', bool: 'bool', string: 'string' };
+
+// Scaffold a bare console project in `dir`, overwrite Program.cs with `source`, and run it.
+// Returns stdout, or null on any failure. A bare console app has no external packages, so the
+// implicit restore is offline.
+function dotnetRun(dir, source) {
+  const proj = join(dir, 'app');
+  const env = { ...process.env, DOTNET_CLI_TELEMETRY_OPTOUT: '1', DOTNET_NOLOGO: '1', DOTNET_SKIP_FIRST_TIME_EXPERIENCE: '1' };
+  const mk = spawnSync('dotnet', ['new', 'console', '-o', proj], { encoding: 'utf8', timeout: 120000, env });
+  if (mk.status !== 0) return null;
+  writeFileSync(join(proj, 'Program.cs'), source);
+  const run = spawnSync('dotnet', ['run', '--project', proj, '-c', 'Release'], { encoding: 'utf8', timeout: 240000, env });
+  if (run.status !== 0) return null;
+  return run.stdout;
+}
+
+// The emitted C# source (also usable for display / `gen`-parity).
+export function emitCSharpModule(ast, cases = buildCases(ast)) {
+  const L = [
+    'using System;',
+    'using System.Collections.Generic;',
+    'using System.Linq;',
+    'using System.Text;',
+    'class ThunderTarget {',
+  ];
+  const typesByDec = {};
+  for (const d of ast.decisions || []) {
+    const names = inputNames(d);
+    const types = inferInputTypes(ast, d);
+    typesByDec[d.name] = types;
+    const params = names.map((n) => `${CS_TYPE[types[n]] || 'string'} ${n}`).join(', ');
+    L.push(`  static string ${d.name}(${params}) {`);
+    for (const r of d.rules || []) {
+      let cond; try { cond = exprToCSharp(r.when, { inputs: names }); } catch { cond = 'false'; }
+      L.push(`    if (${cond}) return ${strLit(r.result)};`);
+    }
+    L.push(`    return ${d.default == null ? 'null' : strLit(d.default)};`, '  }');
+  }
+  L.push('  static string J(string s) {');
+  L.push('    if (s == null) return "null";');
+  L.push('    var b = new StringBuilder("\\"");');
+  L.push('    foreach (char c in s) {');
+  L.push('      if (c == \'\\\\\' || c == \'"\') b.Append(\'\\\\\').Append(c);');
+  L.push('      else if (c == \'\\n\') b.Append("\\\\n"); else b.Append(c); }');
+  L.push('    return b.Append(\'"\').ToString(); }');
+  L.push('  static void Main() {');
+  L.push('    var outp = new List<KeyValuePair<string,string>>();');
+  for (const c of cases) {
+    const dec = (ast.decisions || []).find((d) => d.name === c.fn);
+    if (!dec) continue;
+    const types = typesByDec[c.fn];
+    const argList = inputNames(dec).map((n) => litFor(types[n], c.given[n])).join(', ');
+    L.push(`    outp.Add(new KeyValuePair<string,string>(${strLit(c.key)}, ${c.fn}(${argList})));`);
+  }
+  L.push('    var sb = new StringBuilder("{"); bool first = true;');
+  L.push('    foreach (var e in outp) {');
+  L.push('      if (!first) sb.Append(","); first = false;');
+  L.push('      sb.Append(J(e.Key)).Append(":").Append(J(e.Value)); }');
+  L.push('    Console.WriteLine(sb.Append("}").ToString());');
+  L.push('  }');
+  L.push('}');
+  return L.join('\n');
+}
+
+export function csharpAvailable() {
+  return cachedSmoke('csharp', () => {
+    const dir = mkdtempSync(join(tmpdir(), 'tl-cs-smoke-'));
+    try {
+      const src = 'using System; class ThunderTarget { static void Main(){ Console.WriteLine("{\\"ok\\":\\"1\\"}"); } }';
+      const out = dotnetRun(dir, src);
+      return !!out && /"ok"/.test(out);
+    } finally { try { rmSync(dir, { recursive: true, force: true }); } catch { /* best effort */ } }
+  });
+}
+
+// Run every decision test case through generated, compiled C#. Returns { "Test / case": actual }
+// or null when no usable .NET SDK is present.
+export function runCSharpTarget(ast) {
+  if (!csharpAvailable()) return null;
+  const cases = buildCases(ast);
+  const dir = mkdtempSync(join(tmpdir(), 'tl-cs-'));
+  try {
+    const out = dotnetRun(dir, emitCSharpModule(ast, cases));
+    return out == null ? null : parseLastJsonObject(out);
+  } finally { try { rmSync(dir, { recursive: true, force: true }); } catch { /* best effort */ } }
+}