@vauban-org/agent-sdk 1.0.0 → 1.3.0

package/dist/verify/formal/solver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"solver.d.ts","sourceRoot":"","sources":["../../../src/verify/formal/solver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,8DAA8D;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,OAAO,GAAG,IAAI,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAID;;;;;;;;;;;;GAYG;AACH,wBAAsB,QAAQ,CAC5B,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,aAAkB,GAC1B,OAAO,CAAC,cAAc,CAAC,CAmHzB;AAWD,wBAAsB,aAAa,CAAC,MAAM,SAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CA8BnE;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,IAAI,IAAI,CAEjD"}

package/dist/verify/formal/solver.js

@@ -0,0 +1,184 @@
+/**
+ * src/verify/formal/solver.ts
+ *
+ * Sprint-587 — Z3 SMT solver wrapper.
+ *
+ * Strategy : avoid adding `z3-solver` as a hard npm dependency (heavy WASM
+ * package, ~5MB) by spawning the `z3` binary as a subprocess and piping
+ * SMT-LIB v2 source on stdin. If `z3` is not in PATH, the wrapper degrades
+ * gracefully by returning `{ sat: null }` so callers can map that to the
+ * UNKNOWN state.
+ *
+ * This keeps the SDK lean : consumers that want formal verification install
+ * `z3` system-wide (apt / brew / scoop). Consumers that do not, get UNKNOWN
+ * results and can route them according to their policy.
+ *
+ * @module verify/formal/solver
+ */
+import { spawn } from "node:child_process";
+import { performance } from "node:perf_hooks";
+const DEFAULT_TIMEOUT_MS = 5000;
+/**
+ * Run a single SMT-LIB v2 formula through Z3 and return the satisfiability
+ * outcome.
+ *
+ * Convention : the caller frames the property as a NEGATION (i.e. asserts the
+ * conjunction of preconditions AND the negation of the postcondition). Then :
+ *   - `sat`   → counterexample found → property VIOLATED → UNSAFE
+ *   - `unsat` → no counterexample exists → property HOLDS → SAFE
+ *   - `unknown` / timeout / missing binary → UNKNOWN
+ *
+ * The function never throws : transport errors and missing binaries are
+ * surfaced via `sat: null` with a `reason` string.
+ */
+export async function checkSmt(smtFormula, options = {}) {
+    const timeoutMs = options.timeout_ms ?? DEFAULT_TIMEOUT_MS;
+    const z3Path = options.z3_path ?? "z3";
+    const start = performance.now();
+    return new Promise((resolve) => {
+        let child;
+        try {
+            child = spawn(z3Path, ["-in", `-T:${Math.ceil(timeoutMs / 1000)}`], {
+                stdio: ["pipe", "pipe", "pipe"],
+            });
+        }
+        catch (err) {
+            resolve({
+                sat: null,
+                time_ms: performance.now() - start,
+                reason: `z3 spawn failed : ${err instanceof Error ? err.message : String(err)}`,
+            });
+            return;
+        }
+        let stdout = "";
+        let stderr = "";
+        let settled = false;
+        const settle = (r) => {
+            if (settled)
+                return;
+            settled = true;
+            resolve(r);
+        };
+        const timer = setTimeout(() => {
+            try {
+                child.kill("SIGKILL");
+            }
+            catch {
+                /* ignored */
+            }
+            settle({
+                sat: null,
+                time_ms: performance.now() - start,
+                reason: `z3 timeout after ${timeoutMs}ms`,
+            });
+        }, timeoutMs);
+        child.stdout.on("data", (chunk) => {
+            stdout += chunk.toString();
+        });
+        child.stderr.on("data", (chunk) => {
+            stderr += chunk.toString();
+        });
+        child.on("error", (err) => {
+            clearTimeout(timer);
+            settle({
+                sat: null,
+                time_ms: performance.now() - start,
+                reason: `z3 not available : ${err.message}`,
+            });
+        });
+        child.on("close", (code) => {
+            clearTimeout(timer);
+            const time_ms = performance.now() - start;
+            // z3 exits 0 even on `unsat`; non-zero usually means parse error.
+            const out = stdout.trim();
+            const firstLine = out.split(/\r?\n/)[0]?.trim() ?? "";
+            if (firstLine === "sat") {
+                // Extract model block if present (everything after the first line).
+                const modelStart = out.indexOf("\n");
+                const model = modelStart >= 0 ? out.slice(modelStart + 1).trim() : undefined;
+                settle({ sat: true, model: model || undefined, time_ms });
+                return;
+            }
+            if (firstLine === "unsat") {
+                settle({ sat: false, time_ms });
+                return;
+            }
+            if (firstLine === "unknown") {
+                settle({
+                    sat: null,
+                    time_ms,
+                    reason: "z3 returned unknown (likely timeout or undecidable fragment)",
+                });
+                return;
+            }
+            // Parse error or other failure : surface stderr.
+            settle({
+                sat: null,
+                time_ms,
+                reason: `z3 unexpected output (exit ${code}) : ${(stderr || out).slice(0, 200)}`,
+            });
+        });
+        try {
+            child.stdin.write(smtFormula);
+            child.stdin.end();
+        }
+        catch (err) {
+            clearTimeout(timer);
+            settle({
+                sat: null,
+                time_ms: performance.now() - start,
+                reason: `z3 stdin write failed : ${err instanceof Error ? err.message : String(err)}`,
+            });
+        }
+    });
+}
+/**
+ * Probe : check whether a usable `z3` binary is reachable.
+ * Returns `true` if `z3 --version` exits 0 within 1s.
+ *
+ * Cached for the lifetime of the process — the binary's presence does not
+ * change at runtime.
+ */
+let z3Available;
+export async function isZ3Available(z3Path = "z3") {
+    if (z3Available !== undefined)
+        return z3Available;
+    z3Available = await new Promise((resolve) => {
+        let child;
+        try {
+            child = spawn(z3Path, ["--version"], {
+                stdio: ["ignore", "pipe", "pipe"],
+            });
+        }
+        catch {
+            resolve(false);
+            return;
+        }
+        const t = setTimeout(() => {
+            try {
+                child.kill("SIGKILL");
+            }
+            catch {
+                /* ignored */
+            }
+            resolve(false);
+        }, 1000);
+        child.on("error", () => {
+            clearTimeout(t);
+            resolve(false);
+        });
+        child.on("close", (code) => {
+            clearTimeout(t);
+            resolve(code === 0);
+        });
+    });
+    return z3Available;
+}
+/**
+ * Test-only helper to reset the cached availability probe.
+ * @internal
+ */
+export function __resetZ3AvailabilityCache() {
+    z3Available = undefined;
+}
+//# sourceMappingURL=solver.js.map

package/dist/verify/formal/solver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"solver.js","sourceRoot":"","sources":["../../../src/verify/formal/solver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAiC9C,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEhC;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,UAAkB,EAClB,UAAyB,EAAE;IAE3B,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,IAAI,kBAAkB,CAAC;IAC3D,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC;IAEvC,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAEhC,OAAO,IAAI,OAAO,CAAiB,CAAC,OAAO,EAAE,EAAE;QAC7C,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YACH,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC,EAAE;gBAClE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;aAChC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC;gBACN,GAAG,EAAE,IAAI;gBACT,OAAO,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;gBAClC,MAAM,EAAE,qBACN,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE;aACH,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,MAAM,MAAM,GAAG,CAAC,CAAiB,EAAQ,EAAE;YACzC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,CAAC,CAAC,CAAC,CAAC;QACb,CAAC,CAAC;QAEF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC;gBACH,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC;gBACP,aAAa;YACf,CAAC;YACD,MAAM,CAAC;gBACL,GAAG,EAAE,IAAI;gBACT,OAAO,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;gBAClC,MAAM,EAAE,oBAAoB,SAAS,IAAI;aAC1C,CAAC,CAAC;QACL,CAAC,EAAE,SAAS,CAAC,CAAC;QAEd,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC7B,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC;gBACL,GAAG,EAAE,IAAI;gBACT,OAAO,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;gBAClC,MAAM,EAAE,sBAAsB,GAAG,CAAC,OAAO,EAAE;aAC5C,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;YAC1C,kEAAkE;YAClE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;YAC1B,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YAEtD,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;gBACxB,oEAAoE;gBACpE,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBACrC,MAAM,KAAK,GACT,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;gBACjE,MAAM,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,IAAI,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC1D,OAAO;YACT,CAAC;YACD,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;gBAC1B,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;gBAChC,OAAO;YACT,CAAC;YACD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAM,CAAC;oBACL,GAAG,EAAE,IAAI;oBACT,OAAO;oBACP,MAAM,EACJ,8DAA8D;iBACjE,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,iDAAiD;YACjD,MAAM,CAAC;gBACL,GAAG,EAAE,IAAI;gBACT,OAAO;gBACP,MAAM,EAAE,8BAA8B,IAAI,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CACpE,CAAC,EACD,GAAG,CACJ,EAAE;aACJ,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAC9B,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC;gBACL,GAAG,EAAE,IAAI;gBACT,OAAO,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;gBAClC,MAAM,EAAE,2BACN,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE;aACH,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,IAAI,WAAgC,CAAC;AAErC,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAM,GAAG,IAAI;IAC/C,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,WAAW,CAAC;IAClD,WAAW,GAAG,MAAM,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,EAAE;QACnD,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YACH,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE;gBACnC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;aAClC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,KAAK,CAAC,CAAC;YACf,OAAO;QACT,CAAC;QACD,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE;YACxB,IAAI,CAAC;gBACH,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC;gBACP,aAAa;YACf,CAAC;YACD,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,EAAE,IAAI,CAAC,CAAC;QACT,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACrB,YAAY,CAAC,CAAC,CAAC,CAAC;YAChB,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,YAAY,CAAC,CAAC,CAAC,CAAC;YAChB,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC;QACtB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B;IACxC,WAAW,GAAG,SAAS,CAAC;AAC1B,CAAC"}

package/dist/verify/formal/spec-language.d.ts

@@ -0,0 +1,80 @@
+/**
+ * src/verify/formal/spec-language.ts
+ *
+ * Sprint-587 — DSL for axiom specifications, compiled to SMT-LIB v2.
+ *
+ * Design philosophy (inspired by FormalJudge, arXiv:2602.11136) : agent-cycle
+ * properties are expressed as small, typed pre/post-condition tuples. Each
+ * condition is mapped to an SMT-LIB fragment by {@link compileToSmt}, which
+ * frames the property as a NEGATION of the post-conditions under the
+ * pre-conditions. This way, Z3 returning `sat` means a counterexample exists
+ * (= UNSAFE) and `unsat` means the post-conditions hold (= SAFE).
+ *
+ * Bound types : Reals for budgets and ratios, Bools for binary properties,
+ * Sets-as-symbols for scope subset checks.
+ *
+ * @module verify/formal/spec-language
+ */
+/**
+ * One verifiable axiom-level property.
+ */
+export interface AxiomSpec {
+    /** Human-readable axiom label (e.g. "Robuste", "Profitable"). */
+    axiom: string;
+    /** Conditions that must hold for the spec to be meaningful. */
+    preconditions: Condition[];
+    /** Conditions whose conjunction defines the post-state to verify. */
+    postconditions: Condition[];
+    /** Solver timeout in ms — see {@link DEFAULT_POLICIES}. */
+    timeout_ms?: number;
+}
+/**
+ * Tagged union of all supported condition kinds.
+ *
+ * `custom_smt` is the escape hatch : the consumer supplies a raw SMT-LIB
+ * fragment that will be inlined under an `(assert ...)`. Use sparingly —
+ * mistakes here are silent semantic bugs.
+ */
+export type Condition = {
+    type: "budget_constraint";
+    child_max_fraction: number;
+} | {
+    type: "scope_subset";
+    parent_scope: string[];
+    child_scope: string[];
+} | {
+    type: "no_pii_in_output";
+    pii_count_var?: string;
+} | {
+    type: "cost_positive_roi";
+    min_roi_ratio: number;
+} | {
+    type: "response_time";
+    max_ms: number;
+} | {
+    type: "custom_smt";
+    smt_fragment: string;
+};
+/**
+ * Compile an {@link AxiomSpec} into an SMT-LIB v2 program string.
+ *
+ * Pattern : preconditions are asserted as-is ; postconditions are joined by
+ * conjunction and asserted NEGATED. A counterexample (z3 returns `sat`)
+ * therefore means : "pre-conditions hold AND at least one post-condition
+ * fails" — i.e. an UNSAFE outcome.
+ *
+ * Includes `(check-sat)` and `(get-model)` as terminating commands.
+ */
+export declare function compileToSmt(spec: AxiomSpec): string;
+/**
+ * Default per-axiom AxiomSpec presets. Consumers can override the timeout
+ * or augment with additional conditions before passing to `formalVerify`.
+ *
+ * Robuste        : 5s — engineering robustness, may need richer checks
+ * Institutionnel : 10s — strongest spec, PII + scope-subset + budget
+ * SOTA           : 2s  — lightweight (single ROI check on cost)
+ * AntiFragile    : 1s  — response-time bound only
+ * Profitable     : 1s  — cost-vs-value ROI check
+ */
+export declare const AXIOM_SPECS: Record<string, AxiomSpec>;
+//# sourceMappingURL=spec-language.d.ts.map

package/dist/verify/formal/spec-language.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec-language.d.ts","sourceRoot":"","sources":["../../../src/verify/formal/spec-language.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,iEAAiE;IACjE,KAAK,EAAE,MAAM,CAAC;IACd,+DAA+D;IAC/D,aAAa,EAAE,SAAS,EAAE,CAAC;IAC3B,qEAAqE;IACrE,cAAc,EAAE,SAAS,EAAE,CAAC;IAC5B,2DAA2D;IAC3D,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,SAAS,GACjB;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,MAAM,EAAE,CAAA;CAAE,GACvE;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC;AAiGjD;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,CAoEpD;AAMD;;;;;;;;;GASG;AACH,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAqCjD,CAAC"}

package/dist/verify/formal/spec-language.js

@@ -0,0 +1,219 @@
+/**
+ * src/verify/formal/spec-language.ts
+ *
+ * Sprint-587 — DSL for axiom specifications, compiled to SMT-LIB v2.
+ *
+ * Design philosophy (inspired by FormalJudge, arXiv:2602.11136) : agent-cycle
+ * properties are expressed as small, typed pre/post-condition tuples. Each
+ * condition is mapped to an SMT-LIB fragment by {@link compileToSmt}, which
+ * frames the property as a NEGATION of the post-conditions under the
+ * pre-conditions. This way, Z3 returning `sat` means a counterexample exists
+ * (= UNSAFE) and `unsat` means the post-conditions hold (= SAFE).
+ *
+ * Bound types : Reals for budgets and ratios, Bools for binary properties,
+ * Sets-as-symbols for scope subset checks.
+ *
+ * @module verify/formal/spec-language
+ */
+function ensureDecl(ctx, decl, name) {
+    if (ctx.declared.has(name))
+        return;
+    ctx.declared.add(name);
+    ctx.declarations.push(decl);
+}
+/**
+ * Lower a single Condition into SMT-LIB assertions appended to `ctx`.
+ * `negated` flag : when true, the condition is being added as a negated
+ * post-condition (i.e. we want to find a counterexample).
+ */
+function lowerCondition(c, ctx, negated) {
+    switch (c.type) {
+        case "budget_constraint": {
+            // parent_budget >= 0, child_budget >= 0, child_budget <= parent_budget * fraction
+            ensureDecl(ctx, "(declare-const parent_budget Real)", "parent_budget");
+            ensureDecl(ctx, "(declare-const child_budget Real)", "child_budget");
+            // Positivity is part of the pre-state, always assert.
+            ctx.assertions.push("(assert (>= parent_budget 0))");
+            ctx.assertions.push("(assert (>= child_budget 0))");
+            const expr = `(<= child_budget (* parent_budget ${c.child_max_fraction}))`;
+            ctx.assertions.push(`(assert ${negated ? `(not ${expr})` : expr})`);
+            return;
+        }
+        case "scope_subset": {
+            // Encode each child element as a Bool : it must be present in parent.
+            // We do this by reducing to a boolean conjunction over the listed
+            // child elements. Mismatches surface as a counterexample.
+            const parentSet = new Set(c.parent_scope);
+            const childOk = c.child_scope.every((s) => parentSet.has(s));
+            // No declarations needed — fold the result statically into a bool.
+            const expr = childOk ? "true" : "false";
+            ctx.assertions.push(`(assert ${negated ? `(not ${expr})` : expr})`);
+            return;
+        }
+        case "no_pii_in_output": {
+            const name = c.pii_count_var ?? "pii_count";
+            ensureDecl(ctx, `(declare-const ${name} Int)`, name);
+            // pii_count >= 0 (always)
+            ctx.assertions.push(`(assert (>= ${name} 0))`);
+            const expr = `(= ${name} 0)`;
+            ctx.assertions.push(`(assert ${negated ? `(not ${expr})` : expr})`);
+            return;
+        }
+        case "cost_positive_roi": {
+            ensureDecl(ctx, "(declare-const cost Real)", "cost");
+            ensureDecl(ctx, "(declare-const value Real)", "value");
+            ctx.assertions.push("(assert (> cost 0))");
+            ctx.assertions.push("(assert (>= value 0))");
+            const expr = `(>= (/ value cost) ${c.min_roi_ratio})`;
+            ctx.assertions.push(`(assert ${negated ? `(not ${expr})` : expr})`);
+            return;
+        }
+        case "response_time": {
+            ensureDecl(ctx, "(declare-const response_ms Real)", "response_ms");
+            ctx.assertions.push("(assert (>= response_ms 0))");
+            const expr = `(<= response_ms ${c.max_ms})`;
+            ctx.assertions.push(`(assert ${negated ? `(not ${expr})` : expr})`);
+            return;
+        }
+        case "custom_smt": {
+            const frag = c.smt_fragment.trim();
+            // The custom fragment is expected to be a parenthesised assertion body.
+            if (negated) {
+                ctx.assertions.push(`(assert (not ${frag}))`);
+            }
+            else {
+                ctx.assertions.push(`(assert ${frag})`);
+            }
+            return;
+        }
+    }
+}
+/**
+ * Compile an {@link AxiomSpec} into an SMT-LIB v2 program string.
+ *
+ * Pattern : preconditions are asserted as-is ; postconditions are joined by
+ * conjunction and asserted NEGATED. A counterexample (z3 returns `sat`)
+ * therefore means : "pre-conditions hold AND at least one post-condition
+ * fails" — i.e. an UNSAFE outcome.
+ *
+ * Includes `(check-sat)` and `(get-model)` as terminating commands.
+ */
+export function compileToSmt(spec) {
+    const ctx = {
+        declared: new Set(),
+        declarations: [],
+        assertions: [],
+    };
+    // Header — set logic to QF_LRA (quantifier-free linear real arithmetic
+    // plus integers) which covers all our supported condition kinds.
+    const header = ["(set-logic ALL)", `; AxiomSpec : ${spec.axiom}`];
+    // Preconditions : assert as-is (positive form).
+    for (const pre of spec.preconditions) {
+        lowerCondition(pre, ctx, false);
+    }
+    // Postconditions : conjoin and negate.
+    // Strategy : assert each one negated separately using De Morgan. We want
+    //   NOT (post1 AND post2 AND …) ≡ (NOT post1) OR (NOT post2) OR …
+    // For check-sat-as-counterexample, we want the solver to find *any*
+    // violation, so we encode the disjunction with an auxiliary Bool flag
+    // per postcondition. Simpler equivalent : assert (or (not post1) (not post2) …).
+    if (spec.postconditions.length === 0) {
+        // Empty postcondition set : trivially SAFE (no obligation to verify).
+        ctx.assertions.push("(assert false)");
+    }
+    else if (spec.postconditions.length === 1) {
+        lowerCondition(spec.postconditions[0], ctx, true);
+    }
+    else {
+        // Build per-postcondition expression strings via a side-context, then
+        // emit a single `(assert (or ...))`.
+        const subCtx = {
+            declared: ctx.declared,
+            declarations: ctx.declarations,
+            assertions: [],
+        };
+        const negatedExprs = [];
+        for (const post of spec.postconditions) {
+            const before = subCtx.assertions.length;
+            lowerCondition(post, subCtx, true);
+            // The last appended assertion is "(assert <neg expr>)" or pre-assertions.
+            // To recover only the negated post-condition body, we accept that some
+            // conditions append additional non-negotiable preconditions (positivity).
+            // Those are valid in any case and stay in the main assertion list.
+            for (let i = before; i < subCtx.assertions.length; i++) {
+                const a = subCtx.assertions[i];
+                // Heuristic : split positivity asserts (>= x 0) and the negated body.
+                // The negated body always contains "(not ".
+                if (a.includes("(not ")) {
+                    // Extract the inner expr "(not …)" inside the outer assert.
+                    const inner = a.slice("(assert ".length, -1);
+                    negatedExprs.push(inner);
+                }
+            }
+            // Drop the negated body assertions from subCtx so we only keep
+            // the positivity ones in the main assertion list.
+            subCtx.assertions = subCtx.assertions.filter((a) => !a.includes("(not "));
+        }
+        ctx.assertions = subCtx.assertions;
+        ctx.assertions.push(`(assert (or ${negatedExprs.join(" ")}))`);
+    }
+    return [
+        ...header,
+        ...ctx.declarations,
+        ...ctx.assertions,
+        "(check-sat)",
+        "(get-model)",
+    ].join("\n");
+}
+// ---------------------------------------------------------------------------
+// Pre-built specs for the 5 Vauban axioms
+// ---------------------------------------------------------------------------
+/**
+ * Default per-axiom AxiomSpec presets. Consumers can override the timeout
+ * or augment with additional conditions before passing to `formalVerify`.
+ *
+ * Robuste        : 5s — engineering robustness, may need richer checks
+ * Institutionnel : 10s — strongest spec, PII + scope-subset + budget
+ * SOTA           : 2s  — lightweight (single ROI check on cost)
+ * AntiFragile    : 1s  — response-time bound only
+ * Profitable     : 1s  — cost-vs-value ROI check
+ */
+export const AXIOM_SPECS = {
+    Robuste: {
+        axiom: "Robuste",
+        preconditions: [],
+        postconditions: [
+            { type: "budget_constraint", child_max_fraction: 1.0 },
+            { type: "response_time", max_ms: 30_000 },
+        ],
+        timeout_ms: 5000,
+    },
+    Institutionnel: {
+        axiom: "Institutionnel",
+        preconditions: [],
+        postconditions: [
+            { type: "no_pii_in_output" },
+            { type: "budget_constraint", child_max_fraction: 1.0 },
+        ],
+        timeout_ms: 10_000,
+    },
+    SOTA: {
+        axiom: "SOTA",
+        preconditions: [],
+        postconditions: [{ type: "cost_positive_roi", min_roi_ratio: 1.0 }],
+        timeout_ms: 2000,
+    },
+    AntiFragile: {
+        axiom: "AntiFragile",
+        preconditions: [],
+        postconditions: [{ type: "response_time", max_ms: 60_000 }],
+        timeout_ms: 1000,
+    },
+    Profitable: {
+        axiom: "Profitable",
+        preconditions: [],
+        postconditions: [{ type: "cost_positive_roi", min_roi_ratio: 1.5 }],
+        timeout_ms: 1000,
+    },
+};
+//# sourceMappingURL=spec-language.js.map

package/dist/verify/formal/spec-language.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec-language.js","sourceRoot":"","sources":["../../../src/verify/formal/spec-language.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AA4CH,SAAS,UAAU,CAAC,GAAmB,EAAE,IAAY,EAAE,IAAY;IACjE,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO;IACnC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvB,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CACrB,CAAY,EACZ,GAAmB,EACnB,OAAgB;IAEhB,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,mBAAmB,CAAC,CAAC,CAAC;YACzB,kFAAkF;YAClF,UAAU,CAAC,GAAG,EAAE,oCAAoC,EAAE,eAAe,CAAC,CAAC;YACvE,UAAU,CAAC,GAAG,EAAE,mCAAmC,EAAE,cAAc,CAAC,CAAC;YACrE,sDAAsD;YACtD,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;YACrD,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;YACpD,MAAM,IAAI,GAAG,qCAAqC,CAAC,CAAC,kBAAkB,IAAI,CAAC;YAC3E,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,OAAO,CAAC,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;YACpE,OAAO;QACT,CAAC;QAED,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,sEAAsE;YACtE,kEAAkE;YAClE,0DAA0D;YAC1D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;YAC1C,MAAM,OAAO,GAAG,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7D,mEAAmE;YACnE,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;YACxC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,OAAO,CAAC,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;YACpE,OAAO;QACT,CAAC;QAED,KAAK,kBAAkB,CAAC,CAAC,CAAC;YACxB,MAAM,IAAI,GAAG,CAAC,CAAC,aAAa,IAAI,WAAW,CAAC;YAC5C,UAAU,CAAC,GAAG,EAAE,kBAAkB,IAAI,OAAO,EAAE,IAAI,CAAC,CAAC;YACrD,0BAA0B;YAC1B,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,CAAC;YAC/C,MAAM,IAAI,GAAG,MAAM,IAAI,KAAK,CAAC;YAC7B,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,OAAO,CAAC,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;YACpE,OAAO;QACT,CAAC;QAED,KAAK,mBAAmB,CAAC,CAAC,CAAC;YACzB,UAAU,CAAC,GAAG,EAAE,2BAA2B,EAAE,MAAM,CAAC,CAAC;YACrD,UAAU,CAAC,GAAG,EAAE,4BAA4B,EAAE,OAAO,CAAC,CAAC;YACvD,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;YAC3C,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;YAC7C,MAAM,IAAI,GAAG,sBAAsB,CAAC,CAAC,aAAa,GAAG,CAAC;YACtD,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,OAAO,CAAC,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;YACpE,OAAO;QACT,CAAC;QAED,KAAK,eAAe,CAAC,CAAC,CAAC;YACrB,UAAU,CAAC,GAAG,EAAE,kCAAkC,EAAE,aAAa,CAAC,CAAC;YACnE,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;YACnD,MAAM,IAAI,GAAG,mBAAmB,CAAC,CAAC,MAAM,GAAG,CAAC;YAC5C,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,OAAO,CAAC,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;YACpE,OAAO;QACT,CAAC;QAED,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;YACnC,wEAAwE;YACxE,IAAI,OAAO,EAAE,CAAC;gBACZ,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,CAAC;YAChD,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,IAAI,GAAG,CAAC,CAAC;YAC1C,CAAC;YACD,OAAO;QACT,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAAC,IAAe;IAC1C,MAAM,GAAG,GAAmB;QAC1B,QAAQ,EAAE,IAAI,GAAG,EAAE;QACnB,YAAY,EAAE,EAAE;QAChB,UAAU,EAAE,EAAE;KACf,CAAC;IAEF,uEAAuE;IACvE,iEAAiE;IACjE,MAAM,MAAM,GAAG,CAAC,iBAAiB,EAAE,iBAAiB,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IAElE,gDAAgD;IAChD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACrC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IAED,uCAAuC;IACvC,yEAAyE;IACzE,kEAAkE;IAClE,oEAAoE;IACpE,sEAAsE;IACtE,iFAAiF;IACjF,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,sEAAsE;QACtE,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACxC,CAAC;SAAM,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,cAAc,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACrD,CAAC;SAAM,CAAC;QACN,sEAAsE;QACtE,qCAAqC;QACrC,MAAM,MAAM,GAAmB;YAC7B,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,UAAU,EAAE,EAAE;SACf,CAAC;QACF,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;YACxC,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YACnC,0EAA0E;YAC1E,uEAAuE;YACvE,0EAA0E;YAC1E,mEAAmE;YACnE,KAAK,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACvD,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAE,CAAC;gBAChC,sEAAsE;gBACtE,4CAA4C;gBAC5C,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;oBACxB,4DAA4D;oBAC5D,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;oBAC7C,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC3B,CAAC;YACH,CAAC;YACD,+DAA+D;YAC/D,kDAAkD;YAClD,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5E,CAAC;QACD,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QACnC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,eAAe,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjE,CAAC;IAED,OAAO;QACL,GAAG,MAAM;QACT,GAAG,GAAG,CAAC,YAAY;QACnB,GAAG,GAAG,CAAC,UAAU;QACjB,aAAa;QACb,aAAa;KACd,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,0CAA0C;AAC1C,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,WAAW,GAA8B;IACpD,OAAO,EAAE;QACP,KAAK,EAAE,SAAS;QAChB,aAAa,EAAE,EAAE;QACjB,cAAc,EAAE;YACd,EAAE,IAAI,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,GAAG,EAAE;YACtD,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE;SAC1C;QACD,UAAU,EAAE,IAAI;KACjB;IACD,cAAc,EAAE;QACd,KAAK,EAAE,gBAAgB;QACvB,aAAa,EAAE,EAAE;QACjB,cAAc,EAAE;YACd,EAAE,IAAI,EAAE,kBAAkB,EAAE;YAC5B,EAAE,IAAI,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,GAAG,EAAE;SACvD;QACD,UAAU,EAAE,MAAM;KACnB;IACD,IAAI,EAAE;QACJ,KAAK,EAAE,MAAM;QACb,aAAa,EAAE,EAAE;QACjB,cAAc,EAAE,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;QACnE,UAAU,EAAE,IAAI;KACjB;IACD,WAAW,EAAE;QACX,KAAK,EAAE,aAAa;QACpB,aAAa,EAAE,EAAE;QACjB,cAAc,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC3D,UAAU,EAAE,IAAI;KACjB;IACD,UAAU,EAAE;QACV,KAAK,EAAE,YAAY;QACnB,aAAa,EAAE,EAAE;QACjB,cAAc,EAAE,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;QACnE,UAAU,EAAE,IAAI;KACjB;CACF,CAAC"}