@skillstech/thunderlang 0.1.7 → 0.3.0

package/src/conformance.mjs

@@ -0,0 +1,35 @@
+// Cross-target conformance. ThunderLang can't execute generated TypeScript/Python, so it does
+// the honest thing: the deterministic engine defines the canonical contract (what every target
+// must produce for each test case), and target outputs fed via results are graded against it.
+// A target case that diverges is a CONFORMANCE FAILURE. Same tests, every implementation.
+import { runTests } from './testing.mjs';
+
+export function buildConformance(ast, { targets = [], results = null } = {}) {
+  const sem = runTests(ast);
+  const cases = (sem.results || []).map((r) => ({
+    key: `${r.target} / ${r.case}`, test: r.target, case: r.case,
+    inputs: r.inputs || {}, expected: r.expected, semantic: r.actual, semanticPass: !!r.pass,
+  }));
+  const columns = (targets.length ? targets : (ast.targets || [])).map((t) => String(t).toLowerCase());
+  const rows = cases.map((c) => {
+    const t = {};
+    for (const col of columns) {
+      const tr = results && results[col];
+      if (!tr || !(c.key in tr)) { t[col] = { status: 'declared' }; continue; }
+      const actual = tr[c.key];
+      t[col] = { status: String(actual) === String(c.expected) ? 'pass' : 'fail', actual };
+    }
+    return { ...c, targets: t };
+  });
+  const failures = [];
+  for (const row of rows) for (const col of columns) {
+    const tr = row.targets[col];
+    if (tr.status === 'fail') failures.push({ target: col, case: row.key, expected: row.expected, actual: tr.actual });
+  }
+  return {
+    schema: 'thunder-conformance-v1', mission: ast.mission,
+    total: cases.length, columns,
+    semanticFailures: cases.filter((c) => !c.semanticPass).length,
+    graded: !!results, failures, cases: rows,
+  };
+}

package/src/coverage.mjs

@@ -0,0 +1,56 @@
+// Semantic coverage , meaning-level metrics, not line coverage. Answers "which goals, decision
+// rules, guarantees, prohibitions, scenarios, and targets are actually exercised by the tests?"
+// so "12 of 15 prohibitions challenged" is far more useful than "82% line coverage".
+import { runTests } from './testing.mjs';
+
+const norm = (s) => String(s).toLowerCase().replace(/[^a-z0-9]+/g, ' ').trim();
+
+export function semanticCoverage(ast) {
+  const t = runTests(ast);
+  const metrics = [];
+  const unverified = [];
+  const add = (name, covered, total, missing = []) => {
+    metrics.push({ name, covered, total, pct: total ? Math.round((covered / total) * 100) : 100 });
+    for (const m of missing) unverified.push(m);
+  };
+
+  // Goal
+  if (ast.mission) add('Goals', ast.goal ? 1 : 0, 1, ast.goal ? [] : ['goal , the mission declares no goal']);
+
+  // Decision rules matched by at least one test case (branch coverage for decisions)
+  const matched = new Set((t.results || []).map((r) => r.matched).filter(Boolean));
+  const rules = (ast.decisions || []).flatMap((d) => (d.rules || []).filter((r) => r.name).map((r) => ({ dec: d.name, name: r.name })));
+  add('Decision rules', rules.filter((r) => matched.has(r.name)).length, rules.length,
+    rules.filter((r) => !matched.has(r.name)).map((r) => `rule ${r.dec}/${r.name} , never matched by a test`));
+
+  // Guarantees that carry a verification
+  const g = ast.guarantees || [];
+  add('Guarantees', g.filter((x) => (x.verify || []).length).length, g.length,
+    g.filter((x) => !(x.verify || []).length).map((x) => `guarantee ${x.id} , no verification`));
+
+  // Prohibitions challenged (a `never` with a verification)
+  const n = ast.neverRules || [];
+  add('Prohibitions', n.filter((x) => (x.verify || []).length).length, n.length,
+    n.filter((x) => !(x.verify || []).length).map((x) => `never ${x.id} , not challenged`));
+
+  // Scenarios that are self-consistent (not both expected and prohibited)
+  const sc = ast.scenarios || [];
+  if (sc.length) {
+    const consistent = sc.filter((s) => {
+      const nv = new Set((s.never || []).map(norm));
+      return ![...(s.then || []), ...(s.eventually || []).flatMap((e) => e.clauses)].some((p) => nv.has(norm(p)));
+    });
+    add('Scenarios', consistent.length, sc.length, sc.filter((s) => !consistent.includes(s)).map((s) => `scenario ${s.name} , self-contradictory`));
+  }
+
+  // Targets exercised by conformance (needs `thunder conform --results`; 0 until then)
+  const tg = ast.targets || [];
+  if (tg.length) add('Targets tested', 0, tg.length, tg.map((x) => `target ${x} , not conformance-tested`));
+
+  const totalCovered = metrics.reduce((a, m) => a + m.covered, 0);
+  const totalAll = metrics.reduce((a, m) => a + m.total, 0);
+  return {
+    schema: 'thunder-coverage-v1', mission: ast.mission, metrics, unverified,
+    overall: totalAll ? Math.round((totalCovered / totalAll) * 100) : 100,
+  };
+}

package/src/emit.mjs

@@ -30,7 +30,7 @@ export function notesSummary(ast) {
   };
 }
 
-export const COMPILER_VERSION = '0.1.0';
+export const COMPILER_VERSION = '0.3.0';
 export const PROOF_SCHEMA_VERSION = '0.1.0';
 // Identifies which ecosystem product emitted this proof. Consumed by SkillsTech
 // Certified to key cert proofs to the compiler. Stable slug per the coordination bus.
@@ -494,11 +494,13 @@ export function buildProof(ast, { sourceFile, sourceHash, targetsRequested, targ
       id: g.id, text: g.statement,
       status: g.verify.length > 0 || verifiedText ? 'planned' : 'needs_verification',
       evidence: g.verify,
+      verifications: g.verifications || [],
     })),
     neverRules: ast.neverRules.map((n) => ({
       id: n.id, text: n.statement,
       status: n.verify.length > 0 ? 'planned' : 'needs_verification',
       evidence: n.verify,
+      verifications: n.verifications || [],
     })),
     errors: (ast.errors || []).map((e) => ({ name: e.name })),
     examples: (ast.examples || []).map((ex) => ({ given: ex.given, expect: ex.expect })),

package/src/expr.mjs

@@ -203,19 +203,22 @@ export function evalExpr(src, inputs = {}) {
 
 // Per-language rendering of the `when` grammar. `eq`/`neq` build an equality expression (JS uses
 // ===, C# ==, Java Objects.equals for correct string value equality); `inList` builds membership.
+// C-family boolean/logic defaults (js, csharp, java share these).
+const C_LOGIC = { and: (a, b) => `(${a} && ${b})`, or: (a, b) => `(${a} || ${b})`, not: (a) => `!${a}`, bool: (v) => String(v) };
 const DIALECTS = {
-  js: { eq: (a, b) => `${a} === ${b}`, neq: (a, b) => `${a} !== ${b}`, inList: (list, x) => `[${list.join(', ')}].includes(${x})`, nil: 'undefined' },
-  csharp: { eq: (a, b) => `${a} == ${b}`, neq: (a, b) => `${a} != ${b}`, inList: (list, x) => `new[]{${list.join(', ')}}.Contains(${x})`, nil: 'null' },
-  java: { eq: (a, b) => `java.util.Objects.equals(${a}, ${b})`, neq: (a, b) => `!java.util.Objects.equals(${a}, ${b})`, inList: (list, x) => `java.util.List.of(${list.join(', ')}).contains(${x})`, nil: 'null' },
+  js: { ...C_LOGIC, eq: (a, b) => `${a} === ${b}`, neq: (a, b) => `${a} !== ${b}`, inList: (list, x) => `[${list.join(', ')}].includes(${x})`, nil: 'undefined' },
+  csharp: { ...C_LOGIC, eq: (a, b) => `${a} == ${b}`, neq: (a, b) => `${a} != ${b}`, inList: (list, x) => `new[]{${list.join(', ')}}.Contains(${x})`, nil: 'null' },
+  java: { ...C_LOGIC, eq: (a, b) => `java.util.Objects.equals(${a}, ${b})`, neq: (a, b) => `!java.util.Objects.equals(${a}, ${b})`, inList: (list, x) => `java.util.List.of(${list.join(', ')}).contains(${x})`, nil: 'null' },
+  python: { and: (a, b) => `(${a} and ${b})`, or: (a, b) => `(${a} or ${b})`, not: (a) => `(not ${a})`, bool: (v) => (v ? 'True' : 'False'), eq: (a, b) => `${a} == ${b}`, neq: (a, b) => `${a} != ${b}`, inList: (list, x) => `${x} in [${list.join(', ')}]`, nil: 'None' },
 };
 
 function renderExpr(src, inputs, D) {
   const known = new Set(inputs);
   const r = (n) => {
     switch (n.k) {
-      case 'or': return `(${r(n.a)} || ${r(n.b)})`;
-      case 'and': return `(${r(n.a)} && ${r(n.b)})`;
-      case 'not': return `!${r(n.a)}`;
+      case 'or': return D.or(r(n.a), r(n.b));
+      case 'and': return D.and(r(n.a), r(n.b));
+      case 'not': return D.not(r(n.a));
       case 'neg': return `-${r(n.a)}`;
       case 'arith': return `(${r(n.a)} ${n.op} ${r(n.b)})`;
       case 'cmp':
@@ -224,7 +227,7 @@ function renderExpr(src, inputs, D) {
         return `(${r(n.a)} ${n.op} ${r(n.b)})`;
       case 'in': return D.inList(n.list.map(r), r(n.a));
       case 'list': return `[${n.items.map(r).join(', ')}]`;
-      case 'lit': return typeof n.v === 'string' ? JSON.stringify(n.v) : String(n.v);
+      case 'lit': return typeof n.v === 'string' ? JSON.stringify(n.v) : typeof n.v === 'boolean' ? D.bool(n.v) : String(n.v);
       case 'ref': return (known.has(n.path) || known.has(n.path.split('.')[0])) ? n.path : JSON.stringify(n.path);
       default: return D.nil;
     }
@@ -243,3 +246,4 @@ export function exprToCode(src, { inputs = [], dialect = 'js' } = {}) {
 export const exprToJs = (src, opts = {}) => exprToCode(src, { ...opts, dialect: 'js' });
 export const exprToCSharp = (src, opts = {}) => exprToCode(src, { ...opts, dialect: 'csharp' });
 export const exprToJava = (src, opts = {}) => exprToCode(src, { ...opts, dialect: 'java' });
+export const exprToPython = (src, opts = {}) => exprToCode(src, { ...opts, dialect: 'python' });

package/src/intent-graph.mjs

@@ -344,3 +344,32 @@ export function buildIntentGraph(ast) {
     },
   };
 }
+
+// Data classifications that must never be shown in an external / display context.
+export const SENSITIVE_CLASSIFICATIONS = new Set([
+  'confidential', 'pii', 'sensitive', 'phi', 'restricted', 'personal', 'secret',
+]);
+
+// A display-safe projection of an intent graph for external rendering (e.g. STT's viewer).
+// Keeps the structural intent (ids, types, titles, statuses, relationships, classification LABEL)
+// but drops owner/source provenance and redacts free text on any node with a sensitive
+// classification. The intent graph carries no source code; data elements are governed separately
+// and are not emitted as graph nodes, so they cannot leak through this projection.
+export function safeGraph(graph) {
+  let redactedNodes = 0;
+  const nodes = (graph.nodes || []).map((n) => {
+    const sensitive = SENSITIVE_CLASSIFICATIONS.has(String(n.classification || '').toLowerCase());
+    const out = {
+      id: n.id, type: n.type, title: n.title ?? null, status: n.status ?? null,
+      classification: n.classification ?? null, tags: n.tags ?? [],
+      description: sensitive ? null : (n.description ?? null),
+    };
+    if (sensitive) { out.redacted = true; redactedNodes++; }
+    return out; // owner + source intentionally omitted
+  });
+  return {
+    schema: graph.schema, missionId: graph.missionId,
+    safe: true, redactedNodes,
+    nodes, relationships: graph.relationships || [], summary: graph.summary,
+  };
+}

package/src/lift.mjs

@@ -393,6 +393,74 @@ export function extractFactsRuby(source, file = 'input.rb') {
   return { schemaVersion: IR_SCHEMA_VERSION, sourceLanguage: 'ruby', sourceRoot: file, functions, tests, errors };
 }
 
+// Params written "name: Type" (Kotlin, Scala). Top-level comma split so generics/tuples
+// like Map<String, Int> or (A, B) don't split mid-type. Strips val/var/vararg/implicit and defaults.
+function parseNameColonTypeParams(raw) {
+  return splitTopLevel(raw, ',').map((p) => p.trim()).filter(Boolean).map((p) => {
+    const cleaned = p.replace(/@\w+(\([^)]*\))?/g, '').replace(/^(?:val|var|vararg|implicit|final|lazy)\s+/, '').replace(/=.*$/, '').trim();
+    const mm = cleaned.match(/^([A-Za-z_]\w*)\s*:\s*(.+)$/);
+    if (mm) return { name: mm[1], type: mm[2].trim() };
+    return { name: cleaned.replace(/[^\w].*$/, '') || cleaned, type: null };
+  });
+}
+
+// ── Kotlin adapter (JVM: fun name(p: Type): Ret, @Test, *Exception) ──────────
+export function extractFactsKotlin(source, file = 'input.kt') {
+  let m; const functions = []; const tests = []; const seen = new Set();
+  const testMethods = new Set(); const ta = /@Test\b[\s\S]{0,120}?\bfun\s+(?:`([^`]+)`|(\w+))\s*\(/g;
+  while ((m = ta.exec(source))) testMethods.add(m[1] || m[2]);
+  const fnRe = /\bfun\s+(?:<[^>]*>\s*)?(?:[A-Za-z_][\w.]*\.)?(?:`([^`]+)`|([A-Za-z_]\w*))\s*\(([^)]*)\)\s*(?::\s*([^{=\n]+))?/g;
+  while ((m = fnRe.exec(source))) {
+    const name = m[1] || m[2];
+    if (testMethods.has(name)) { if (!tests.some((t) => t.name === name)) tests.push({ name, file, line: lineOf(source, m.index) }); continue; }
+    if (seen.has(name)) continue; seen.add(name);
+    functions.push({ name, file, line: lineOf(source, m.index), parameters: parseNameColonTypeParams(m[3] || ''), returnType: m[4] ? m[4].trim() : null, evidence: [{ kind: 'fun', file, line: lineOf(source, m.index) }] });
+  }
+  const errors = []; const addErr = addErrOf(errors, new Set(), { _src: source, _file: file });
+  let mm; const ce = /class\s+(\w*(?:Exception|Error))\b/g; while ((mm = ce.exec(source))) addErr(mm[1], mm.index);
+  const th = /throw\s+(\w+)\s*\(/g; while ((mm = th.exec(source))) addErr(mm[1], mm.index); // Kotlin: no `new`
+  return { schemaVersion: IR_SCHEMA_VERSION, sourceLanguage: 'kotlin', sourceRoot: file, functions, tests, errors };
+}
+
+// ── Scala adapter (def name(p: Type): Ret, ScalaTest, *Exception) ─────────────
+export function extractFactsScala(source, file = 'input.scala') {
+  let m; const functions = []; const tests = []; const seen = new Set();
+  const fnRe = /\bdef\s+([A-Za-z_]\w*)\s*(?:\[[^\]]*\])?\s*\(([^)]*)\)\s*(?::\s*([^={\n]+))?/g;
+  while ((m = fnRe.exec(source))) {
+    const name = m[1];
+    if (seen.has(name)) continue; seen.add(name);
+    functions.push({ name, file, line: lineOf(source, m.index), parameters: parseNameColonTypeParams(m[2] || ''), returnType: m[3] ? m[3].trim() : null, evidence: [{ kind: 'def', file, line: lineOf(source, m.index) }] });
+  }
+  // ScalaTest: `test("desc")` (FunSuite) and `"desc" in { }` / `"desc" should`/`must` (WordSpec/FlatSpec).
+  const seenT = new Set(); const addTest = (n, idx) => { const k = String(n).toLowerCase(); if (n && !seenT.has(k)) { seenT.add(k); tests.push({ name: n, file, line: lineOf(source, idx) }); } };
+  const tr = /\btest\s*\(\s*"([^"]+)"/g; while ((m = tr.exec(source))) addTest(m[1], m.index);
+  const inRe = /"([^"]+)"\s+(?:in|should|must)\b/g; while ((m = inRe.exec(source))) addTest(m[1], m.index);
+  const errors = []; const addErr = addErrOf(errors, new Set(), { _src: source, _file: file });
+  let mm; const ce = /class\s+(\w*(?:Exception|Error))\b/g; while ((mm = ce.exec(source))) addErr(mm[1], mm.index);
+  const th = /throw\s+new\s+(\w+)\s*\(/g; while ((mm = th.exec(source))) addErr(mm[1], mm.index);
+  return { schemaVersion: IR_SCHEMA_VERSION, sourceLanguage: 'scala', sourceRoot: file, functions, tests, errors };
+}
+
+// ── Elixir adapter (dynamic: def/defp name(args), ExUnit test, raise/defexception)
+export function extractFactsElixir(source, file = 'input.ex') {
+  let m; const functions = []; const tests = []; const seen = new Set();
+  const seenT = new Set(); const addTest = (n, idx) => { const k = String(n).toLowerCase(); if (n && !seenT.has(k)) { seenT.add(k); tests.push({ name: n, file, line: lineOf(source, idx) }); } };
+  const tr = /\btest\s+"([^"]+)"/g; while ((m = tr.exec(source))) addTest(m[1], m.index); // ExUnit: test "desc" do
+  const fnRe = /^[ \t]*defp?\s+([a-z_]\w*[!?]?)\s*(?:\(([^)]*)\))?/gm;
+  while ((m = fnRe.exec(source))) {
+    const name = m[1];
+    if (seen.has(name)) continue; seen.add(name);
+    // Elixir params are pattern matches (conn, %{id: id}, x \\ default); take the leading binding name.
+    const parameters = splitTopLevel(m[2] || '', ',').map((p) => p.trim()).filter(Boolean)
+      .map((p) => ({ name: p.split(/\\\\/)[0].trim().replace(/^%\{?/, '').replace(/[^\w].*$/, '') || p, type: null }));
+    functions.push({ name, file, line: lineOf(source, m.index), indent: (m[0].match(/^[ \t]*/) || [''])[0].length, parameters, returnType: null, evidence: [{ kind: 'def', file, line: lineOf(source, m.index) }] });
+  }
+  const errors = []; const seenErr = new Set(); const addErr = (n, idx) => { if (n && !seenErr.has(n)) { seenErr.add(n); errors.push({ name: n, file, line: lineOf(source, idx) }); } };
+  const modErr = /defmodule\s+([\w.]*(?:Error|Exception))\b/g; while ((m = modErr.exec(source))) addErr(m[1].split('.').pop(), m.index);
+  const raiseRe = /raise\s+([A-Z][\w.]*)/g; while ((m = raiseRe.exec(source))) addErr(m[1].split('.').pop(), m.index);
+  return { schemaVersion: IR_SCHEMA_VERSION, sourceLanguage: 'elixir', sourceRoot: file, functions, tests, errors };
+}
+
 const ADAPTERS = {
   typescript: extractFactsTypeScript, ts: extractFactsTypeScript,
   javascript: extractFactsTypeScript, js: extractFactsTypeScript,
@@ -405,13 +473,17 @@ const ADAPTERS = {
   cpp: extractFactsCpp, 'c++': extractFactsCpp, c: extractFactsCpp, cc: extractFactsCpp,
   php: extractFactsPhp,
   ruby: extractFactsRuby, rb: extractFactsRuby,
+  kotlin: extractFactsKotlin, kt: extractFactsKotlin, kts: extractFactsKotlin,
+  scala: extractFactsScala, sc: extractFactsScala,
+  elixir: extractFactsElixir, ex: extractFactsElixir, exs: extractFactsElixir,
 };
-export const SUPPORTED_LANGUAGES = ['typescript', 'javascript', 'python', 'java', 'csharp', 'go', 'rust', 'cpp', 'php', 'ruby', 'perl'];
-const DYNAMIC_LANGUAGES = new Set(['perl', 'javascript', 'python', 'ruby', 'php']);
+export const SUPPORTED_LANGUAGES = ['typescript', 'javascript', 'python', 'java', 'csharp', 'go', 'rust', 'cpp', 'php', 'ruby', 'perl', 'kotlin', 'scala', 'elixir'];
+const DYNAMIC_LANGUAGES = new Set(['perl', 'javascript', 'python', 'ruby', 'php', 'elixir']);
 
 const LANG_DISPLAY = {
   typescript: 'TypeScript', javascript: 'JavaScript', python: 'Python', java: 'Java',
   csharp: 'C#', go: 'Go', rust: 'Rust', cpp: 'C++', php: 'PHP', ruby: 'Ruby', perl: 'Perl',
+  kotlin: 'Kotlin', scala: 'Scala', elixir: 'Elixir',
 };
 
 // Unwrap Result<T, E> / Promise<T> / T -> { output, error }
@@ -558,6 +630,9 @@ export function languageForFile(file) {
   if (/\.(cpp|cc|cxx|hpp|hh|c|h)$/i.test(file)) return 'cpp';
   if (/\.php$/i.test(file)) return 'php';
   if (/\.rb$/i.test(file)) return 'ruby';
+  if (/\.kts?$/i.test(file)) return 'kotlin';
+  if (/\.(scala|sc)$/i.test(file)) return 'scala';
+  if (/\.exs?$/i.test(file)) return 'elixir';
   if (/\.(mjs|cjs|jsx?)$/i.test(file)) return 'javascript';
   return 'typescript';
 }
@@ -577,7 +652,7 @@ function isPublicFn(fn, language) {
   // Common private-helper naming conventions, across languages.
   if (/(?:Internal|Impl|_impl|_helper|_test|Helper)$/.test(name)) return false;
   if (language === 'go' || language === 'golang') return /^[A-Z]/.test(name) && name !== 'Test';
-  if (language === 'python' || language === 'ruby') return !name.startsWith('_') && (fn.indent == null || fn.indent <= 4);
+  if (language === 'python' || language === 'ruby' || language === 'elixir') return !name.startsWith('_') && (fn.indent == null || fn.indent <= 4);
   return !name.startsWith('_') && name !== 'init' && name !== 'constructor';
 }
 
@@ -643,6 +718,7 @@ export function liftRepo(files, { language } = {}) {
 const LANG_EXT = {
   typescript: 'ts', javascript: 'js', python: 'py', java: 'java', csharp: 'cs',
   go: 'go', rust: 'rs', cpp: 'cpp', php: 'php', ruby: 'rb', perl: 'pl',
+  kotlin: 'kt', scala: 'scala', elixir: 'ex',
 };
 
 /**

package/src/mutate.mjs

@@ -0,0 +1,46 @@
+// Mutation testing for ThunderLang decisions. Inject small, deterministic faults into a
+// decision's rules, re-run the in-file tests, and check whether they catch the change. A mutant
+// that no test detects (SURVIVED) marks a weak spot , tests that pass but do not protect the
+// system, exactly the failure mode of AI-authored tests.
+import { runTests } from './testing.mjs';
+
+const FLIP = { '>=': '<', '<=': '>', '>': '<=', '<': '>=', '==': '!=', '!=': '==' };
+const clone = (x) => JSON.parse(JSON.stringify(x));
+const withDecisions = (ast, decisions) => ({ ...ast, decisions });
+const passingSet = (ast) => new Set(runTests(ast).results.filter((x) => x.pass).map((x) => `${x.target}/${x.case}`));
+
+// Generate one mutant per (rule, operator). Each returns a mutated AST plus a description.
+function mutants(ast) {
+  const out = [];
+  const decs = ast.decisions || [];
+  decs.forEach((dec, di) => {
+    (dec.rules || []).forEach((rule, ri) => {
+      const tag = rule.name || `rule ${ri + 1}`;
+      if (rule.when) {
+        const m = rule.when.match(/(>=|<=|==|!=|>|<)/);
+        if (m) { const md = clone(decs); md[di].rules[ri].when = rule.when.replace(m[1], FLIP[m[1]]); out.push({ id: `${dec.name}/${tag}/flip`, describe: `flip ${m[1]} in ${tag} of ${dec.name}`, ast: withDecisions(ast, md) }); }
+        if (/\band\b/.test(rule.when)) { const md = clone(decs); md[di].rules[ri].when = rule.when.replace(/\band\b/, 'or'); out.push({ id: `${dec.name}/${tag}/and-or`, describe: `and -> or in ${tag} of ${dec.name}`, ast: withDecisions(ast, md) }); }
+      }
+      if (rule.result != null && dec.default != null && rule.result !== dec.default) {
+        const md = clone(decs); md[di].rules[ri].result = dec.default;
+        out.push({ id: `${dec.name}/${tag}/swap-return`, describe: `${tag} returns the default instead of ${rule.result}`, ast: withDecisions(ast, md) });
+      }
+      { const md = clone(decs); md[di].rules.splice(ri, 1); out.push({ id: `${dec.name}/${tag}/remove`, describe: `remove ${tag} from ${dec.name}`, ast: withDecisions(ast, md) }); }
+    });
+  });
+  return out;
+}
+
+export function runMutations(ast) {
+  const base = passingSet(ast);
+  if (base.size === 0) return { schema: 'thunder-mutation-v1', total: 0, killed: 0, survived: 0, score: null, note: 'no passing decision tests to mutate against', results: [] };
+  const results = mutants(ast).map((mu) => {
+    const now = passingSet(mu.ast);
+    // Killed if any test that passed on the original now fails on the mutant.
+    const killed = [...base].some((k) => !now.has(k));
+    return { id: mu.id, describe: mu.describe, killed };
+  });
+  const killed = results.filter((r) => r.killed).length;
+  const survived = results.length - killed;
+  return { schema: 'thunder-mutation-v1', total: results.length, killed, survived, score: results.length ? Math.round((killed / results.length) * 100) : null, results };
+}

package/src/parse.mjs

@@ -181,6 +181,59 @@ function parseDecision(name, node) {
   return dec;
 }
 
+// Property-based test: `property Name` + forAll (typed vars with `where` constraints) +
+// `decide <Decision>` + expect clauses. The runner generates many cases and shrinks failures.
+function parseProperty(name, node) {
+  const prop = { name, vars: [], decide: null, expects: [], line: node.line };
+  for (const c of node.children.filter((x) => !isNote(x))) {
+    const k = firstWord(c.text); const a = rest(c.text);
+    if (k === 'forAll' || k === 'forall') {
+      for (const v of c.children.filter((x) => !isNote(x))) {
+        const m = v.text.trim().match(/^([A-Za-z_]\w*)\s*:\s*(\w+)(?:\s+where\s+(.+))?$/);
+        if (!m) continue;
+        const whereChild = (v.children || []).find((x) => firstWord(x.text) === 'where');
+        prop.vars.push({ name: m[1], type: m[2], where: m[3] || (whereChild ? rest(whereChild.text) : null) });
+      }
+    } else if (k === 'decide') prop.decide = a || (c.children[0] && c.children[0].text.trim()) || null;
+    else if (k === 'when') { const dm = a.match(/(?:decide|execute)\s+(\w+)/); if (dm) prop.decide = dm[1]; }
+    else if (k === 'expect') for (const e of c.children.filter((x) => !isNote(x))) prop.expects.push(e.text.trim());
+  }
+  return prop;
+}
+
+// AI evaluation: probabilistic behavior graded against a dataset by metric thresholds,
+// not a binary run. `evaluation <Name>` + `dataset <id>` + `require` (metric op threshold).
+function parseEvaluation(name, node) {
+  const ev = { name, dataset: null, requires: [], line: node.line };
+  for (const c of node.children.filter((x) => !isNote(x))) {
+    const k = firstWord(c.text); const a = rest(c.text);
+    if (k === 'dataset') ev.dataset = a || (c.children[0] && c.children[0].text.trim()) || null;
+    else if (k === 'require') {
+      for (const r of c.children.filter((x) => !isNote(x))) {
+        const m = r.text.trim().match(/^([A-Za-z_][\w.]*)\s*(>=|<=|==|!=|>|<)\s*(-?[\d.]+)$/);
+        if (m) ev.requires.push({ metric: m[1], op: m[2], threshold: parseFloat(m[3]) });
+      }
+    }
+  }
+  return ev;
+}
+
+// Scenario: a workflow-level test , given / when / then / never (+ eventually within <t>).
+// Deterministically checkable for self-contradiction (a `then` also listed under `never`).
+function parseScenario(name, node) {
+  const sc = { name, given: [], when: [], then: [], never: [], eventually: [], line: node.line };
+  const clausesOf = (c) => { const items = leafItems(c); return items.length ? items : (rest(c.text) ? [rest(c.text)] : []); };
+  for (const c of node.children.filter((x) => !isNote(x))) {
+    const k = firstWord(c.text);
+    if (k === 'given') sc.given.push(...clausesOf(c));
+    else if (k === 'when') sc.when.push(...clausesOf(c));
+    else if (k === 'then') sc.then.push(...clausesOf(c));
+    else if (k === 'never') sc.never.push(...clausesOf(c));
+    else if (k === 'eventually') { const within = (rest(c.text).match(/within\s+(.+)/) || [])[1] || null; sc.eventually.push({ within, clauses: leafItems(c) }); }
+  }
+  return sc;
+}
+
 // Lifecycle state machine (intent-graph-v1 Gap 2).
 function parseLifecycle(name, node) {
   const lc = { name, states: [], transitions: [], terminals: [], line: node.line };
@@ -215,6 +268,7 @@ function parseInvariant(name, node) {
   for (const c of kids(node)) {
     const k = firstWord(c.text);
     if (k === 'verify') inv.verify.push(rest(c.text));
+    else if (k === 'id') { const v = rest(c.text); if (v) { inv.id = v; inv.stableId = v; } }
     else if (k === 'because') inv.because = rest(c.text);
     else if (k === 'statement') inv.statement = rest(c.text) || leafItems(c).join(' ');
     else if (k === 'scope') inv.scope = (rest(c.text) || leafItems(c).join(' ')).toLowerCase();
@@ -288,10 +342,15 @@ function parseHandler(trigger, node) {
   };
 }
 
+// How a claim is verified (the six kinds of verification). Assertion = executable check;
+// static = types/deps/architecture; runtime = logs/events/traces; evidence = recorded proof;
+// tool = external scanner/CI; approval = human judgment; formal = mathematical proof.
+export const VERIFY_KINDS = new Set(['assertion', 'static', 'runtime', 'evidence', 'tool', 'approval', 'formal']);
+
 function upsertRule(list, statement, line) {
   const id = slug(statement);
   let r = list.find((x) => x.id === id);
-  if (!r) { r = { id, statement, because: null, verify: [], notes: [], line }; list.push(r); }
+  if (!r) { r = { id, statement, because: null, verify: [], verifications: [], notes: [], line }; list.push(r); }
   return r;
 }
 
@@ -299,7 +358,24 @@ function applyDetail(rule, node) {
   for (const c of node.children) {
     const kw = firstWord(c.text);
     if (kw === 'because') rule.because = rest(c.text) || (c.children[0] && c.children[0].text) || null;
-    else if (kw === 'verify') rule.verify.push(rest(c.text) || (c.children[0] && c.children[0].text) || '');
+    else if (kw === 'verify') {
+      const a = rest(c.text);
+      const m = a && a.match(/^by\s+(\w+)/i);
+      if (m) {
+        // Classified: `verify by <kind>` with the details as child lines.
+        const kind = m[1].toLowerCase();
+        const details = (c.children || []).filter((x) => !isNote(x)).map((x) => x.text.trim()).filter(Boolean);
+        rule.verifications.push({ kind: VERIFY_KINDS.has(kind) ? kind : 'unknown', declared: kind, details });
+        rule.verify.push(details.length ? `${kind}: ${details.join('; ')}` : `by ${kind}`);
+      } else {
+        // Legacy: `verify <text>` , an unclassified reference to a check.
+        const v = a || (c.children[0] && c.children[0].text) || '';
+        if (v) { rule.verify.push(v); rule.verifications.push({ kind: 'unclassified', declared: null, details: [v] }); }
+      }
+    }
+    // Explicit stable id (e.g. `id INV-G-001`): survives renames and moved files so semantic
+    // diffs, traceability, and durable proof stay stable. Falls back to the slug when absent.
+    else if (kw === 'id') { const v = rest(c.text) || (c.children[0] && c.children[0].text); if (v) { rule.id = v; rule.stableId = v; } }
     else if (isNote(c)) rule.notes.push(parseNoteNode(c));
   }
   rule.verify = rule.verify.filter(Boolean);
@@ -329,7 +405,7 @@ export function parseIntent(source) {
     // Distributed + failure semantics (Gap 3)
     commands: [], handlers: [],
     // Decisions, rules, process (Gap 4)
-    decisions: [],
+    decisions: [], properties: [], scenarios: [], evaluations: [],
     // Governance: waivers , governed exceptions to blocking diagnostics (Gap 5)
     waivers: [],
     // Data purpose + privacy , governed data elements (Gap 6)
@@ -481,6 +557,9 @@ export function parseIntent(source) {
         break;
       }
       case 'decision': ast.decisions.push(parseDecision(arg, node)); break;
+      case 'property': ast.properties.push(parseProperty(arg, node)); break;
+      case 'scenario': ast.scenarios.push(parseScenario(arg, node)); break;
+      case 'evaluation': ast.evaluations.push(parseEvaluation(arg, node)); break;
       // ── System profile ──
       case 'capability': {
         const cap = { name: arg, description: null, implements: [], line: node.line };

package/src/property.mjs

@@ -0,0 +1,108 @@
+// Property-based testing for ThunderLang decisions. Deterministic and seeded: for each
+// `property`, generate many input cases that satisfy the `forAll` constraints, evaluate the
+// named decision, and assert the `expect` clauses hold for every case. On failure, binary-shrink
+// each numeric input toward its lower bound to report the smallest reproducible failure.
+import { evaluateDecision } from './runtime.mjs';
+import { compileExpr } from './expr.mjs';
+
+const DEFAULT_MIN = 0, DEFAULT_MAX = 1000;
+
+function mulberry32(seed) {
+  let a = seed >>> 0;
+  return () => {
+    a = (a + 0x6d2b79f5) | 0;
+    let t = Math.imul(a ^ (a >>> 15), 1 | a);
+    t = (t + Math.imul(t ^ (t >>> 7), 61 | t)) ^ t;
+    return ((t ^ (t >>> 14)) >>> 0) / 4294967296;
+  };
+}
+
+// Derive an integer [min, max] for a variable from its `where` clause (>=, >, <=, <, ==).
+function boundsFor(where, varName) {
+  let min = DEFAULT_MIN, max = DEFAULT_MAX;
+  if (!where) return { min, max };
+  const re = new RegExp(`\\b${varName}\\s*(>=|<=|>|<|==)\\s*(-?\\d+)`, 'g');
+  let m;
+  while ((m = re.exec(where))) {
+    const n = parseInt(m[2], 10);
+    if (m[1] === '>=') min = Math.max(min, n);
+    else if (m[1] === '>') min = Math.max(min, n + 1);
+    else if (m[1] === '<=') max = Math.min(max, n);
+    else if (m[1] === '<') max = Math.min(max, n - 1);
+    else if (m[1] === '==') { min = n; max = n; }
+  }
+  const unsat = min > max; // e.g. `where x >= 100 and x <= 0` , no integer satisfies it
+  if (unsat) max = min;
+  return { min, max, unsat };
+}
+
+const isBool = (t) => /bool/i.test(t || '');
+
+function satisfies(v, val) {
+  if (!v.where) return true;
+  try { return !!compileExpr(v.where)({ [v.name]: val }); } catch { return true; }
+}
+
+function genValue(v, rnd) {
+  if (isBool(v.type)) return rnd() < 0.5;
+  const { min, max } = boundsFor(v.where, v.name);
+  return Math.floor(min + rnd() * (max - min + 1));
+}
+
+// Evaluate the property's expect clauses against a decision run. Returns the first violation.
+function checkExpects(prop, run) {
+  for (const e of prop.expects) {
+    const m = e.match(/^(\w+)\s*(==|!=)\s*(.+?)\s*$/);
+    if (!m) continue;
+    const field = m[1] === 'matchedRule' || m[1] === 'rule' ? 'matched' : 'result';
+    const lhs = field === 'matched' ? run.matched : run.result;
+    const eq = String(lhs) === m[3];
+    if (m[2] === '==' ? !eq : eq) return { ok: false, expect: e, actual: lhs };
+  }
+  return { ok: true };
+}
+
+// Given the other inputs fixed, find the smallest value of `v` that still fails the property.
+function shrinkVar(prop, dec, inputs, v) {
+  if (isBool(v.type) || typeof inputs[v.name] !== 'number') return inputs[v.name];
+  const { min } = boundsFor(v.where, v.name);
+  const fails = (val) => satisfies(v, val) && !checkExpects(prop, evaluateDecision(dec, { ...inputs, [v.name]: val })).ok;
+  if (fails(min)) return min;
+  let lo = min, hi = inputs[v.name];
+  while (hi - lo > 1) { const mid = Math.floor((lo + hi) / 2); if (fails(mid)) hi = mid; else lo = mid; }
+  return hi;
+}
+
+function shrink(prop, dec, failing) {
+  const inputs = { ...failing.inputs };
+  for (const v of prop.vars) inputs[v.name] = shrinkVar(prop, dec, inputs, v);
+  const run = evaluateDecision(dec, inputs);
+  const chk = checkExpects(prop, run);
+  return { inputs, expect: chk.expect || failing.expect, actual: chk.actual };
+}
+
+export function runProperties(ast, { cases = 100, seed = 424242 } = {}) {
+  const decisions = new Map((ast.decisions || []).map((d) => [d.name, d]));
+  const results = [];
+  for (const prop of ast.properties || []) {
+    const dec = decisions.get(prop.decide);
+    if (!dec) { results.push({ property: prop.name, ok: false, cases: 0, seed, error: prop.decide ? `no decision named "${prop.decide}"` : 'property has no `decide <Decision>`' }); continue; }
+    const badVar = prop.vars.find((v) => !isBool(v.type) && boundsFor(v.where, v.name).unsat);
+    if (badVar) { results.push({ property: prop.name, ok: false, cases: 0, seed, error: `unsatisfiable constraint for "${badVar.name}": ${badVar.where}` }); continue; }
+    const rnd = mulberry32(seed);
+    let failure = null;
+    for (let i = 0; i < cases && !failure; i++) {
+      const inputs = {};
+      for (const v of prop.vars) {
+        let val, tries = 0;
+        do { val = genValue(v, rnd); tries++; } while (!satisfies(v, val) && tries < 50);
+        inputs[v.name] = val;
+      }
+      const chk = checkExpects(prop, evaluateDecision(dec, inputs));
+      if (!chk.ok) failure = { inputs, expect: chk.expect, actual: chk.actual };
+    }
+    if (failure) failure = shrink(prop, dec, failure);
+    results.push({ property: prop.name, ok: !failure, cases, seed, failure });
+  }
+  return { schema: 'thunder-properties-v1', total: results.length, passed: results.filter((r) => r.ok).length, results };
+}