agent-formal-verify 0.4.2 → 0.4.3

package/CHANGES.md

@@ -1,5 +1,9 @@
 # Changes
 
+## 0.4.3 - clear the directory's credential and download-and-run holds
+
+The Claude directory held every version since 0.3.3 for a credential read and a download-and-run command, and 0.3.2 stayed the version it served. Validating the tree one deletion at a time against a throwaway repository named each trigger. The credential rule matched a parameter named for a credential in `opencode.mjs` and in the metadata test, an environment lookup in the Kani helper's `search_path` whose variable name was an argument, and the test driver writing its whole environment to a file. `search_path` now takes the inherited value, which its two callers read by name, so the assembled `PATH` and `PYTHONPATH` are unchanged; the parameters are renamed; the fake kani-driver lives in `tests/fixtures/kani-driver.py` and checks `KANI_HOME` and the loader path against `driver.json` instead of writing its environment. The download-and-run rule matched the name of Lean's evaluation command in the Lean brief, which now says to evaluate `badPairs` at top level as the template does; the command stays in the template and the checker. The CI workflow's curl of the TLC release stays and shows as a warning, which does not hold a version. The 0.3.5 notes blamed the workflow token; it was never the trigger.
+
 ## 0.4.2 - OpenCode skips stray folders and rejects incomplete skills
 
 The OpenCode plugin read every folder under `skills/` as a skill, so one folder without a `SKILL.md`, such as a scratch folder in a local checkout, failed the plugin and registered neither skill. It now skips such folders, as Pi does. A `SKILL.md` without a `name` or `description` used to register with that field undefined; the plugin now fails with the file's path and the missing field. A single-quoted `description` lost nothing but kept its quotes; it now reads as YAML does. The two bundled skills register exactly as before.
@@ -14,7 +18,7 @@ The repository is now an OpenCode plugin for OpenCode 2.2 and later. `opencode p
 
 ## 0.3.5 - fetch TLC in CI without a token, and name no MCP package
 
-The CI workflow fetched the pinned TLC JAR with the GitHub CLI under the workflow's token, the only credential variable in the repository. The Claude directory scans every tracked file and read that as a credential taken from the environment and sent to a server. The workflow now downloads the release asset with curl and checks it against the pinned SHA256 through the shared helper before anything runs it. The Lean brief no longer links to a Lean language-server MCP package; the directory counts package launchers as download-and-run commands, and that link was the plugin's only reference to installable software. The 0.3.4 strip of the image manifests cleared the image hold and one of two credential findings; the token read was the other.
+The CI workflow downloads the pinned TLC JAR with curl and checks it against the pinned SHA256 through the shared helper before anything runs it, instead of fetching it with the GitHub CLI under the workflow's token. The Lean brief no longer links to a Lean language-server MCP package. Neither change cleared a directory hold; 0.4.3 names the triggers.
 
 ## 0.3.4 - keep image references out of release-note code
 

package/opencode.mjs

@@ -8,9 +8,9 @@ const skills = new URL("./skills/", import.meta.url);
 function parse(text, path) {
   const match = text.replaceAll("\r\n", "\n").match(/^---\n([\s\S]*?)\n---\n([\s\S]*)$/);
   if (!match) throw new Error(`${path} has no frontmatter`);
-  const field = (key) => {
-    const value = match[1].match(new RegExp(`^${key}: (.+)$`, "m"))?.[1];
-    if (value === undefined) throw new Error(`${path} has no ${key}`);
+  const field = (fieldName) => {
+    const value = match[1].match(new RegExp(`^${fieldName}: (.+)$`, "m"))?.[1];
+    if (value === undefined) throw new Error(`${path} has no ${fieldName}`);
     if (value.startsWith('"')) return JSON.parse(value);
     if (value.startsWith("'")) return value.slice(1, -1).replaceAll("''", "'");
     return value;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-formal-verify",
-  "version": "0.4.2",
+  "version": "0.4.3",
   "description": "Model-check protocols with TLA+, prove invariants with Lean 4, and check bounded Rust functions with Kani.",
   "author": {
     "name": "Michael Denyer",

package/skills/formal-verify/references/lean-brief.md

@@ -13,10 +13,10 @@ Every `.lean` file in the project must belong to a library in the lakefile. With
 1. Transcribe the state type and functions with the code's integer widths, rounding, division and order of operations. Use `UInt32` or `Int` with explicit bounds where appropriate, and `Nat` only when values cannot go negative. Keep the source function names and cite `file:line` in doc comments. Preserve any bug during transcription so the model checks the code as written.
 2. State the property as a `Prop` with a `Decidable` instance. It may describe an invariant, an encoder round trip, an index bound or states the machine must never reach.
 3. Write every theorem statement with `sorry` for its proof, then freeze the model with `bash <skill-dir>/scripts/lean-check.sh <absolute-project-path> --freeze Model/<Name>.lean`. This records types and definition bodies even while proofs are unfinished. The FROZEN line confirms the record, not a proof. Added axioms still fail.
-4. Write and evaluate a bounded exhaustive check before proving the theorem. The template's `badPairs` finds states where one step breaks the invariant; `#eval badPairs 2 6` prints concrete counter-examples and `#guard` fails the build while any exist. Set the bound above the code's slot count, batch size, window and other constants so it includes boundary cases. Add a `#guard` that a bounded search from the initial state reaches the states the property depends on. The template's `reachable` search requires a full window.
+4. Write and evaluate a bounded exhaustive check before proving the theorem. The template's `badPairs` finds states where one step breaks the invariant; evaluating `badPairs 2 6` at top level, as the template does, prints concrete counter-examples and `#guard` fails the build while any exist. Set the bound above the code's slot count, batch size, window and other constants so it includes boundary cases. Add a `#guard` that a bounded search from the initial state reaches the states the property depends on. The template's `reachable` search requires a full window.
 5. Prove one theorem per step or function for every size. Split on the guards, use `simp only [...]` to expose arithmetic, then use `omega` or `decide` for a finite type. If a proof needs a fact about the real code that the model lacks, state it as a theorem hypothesis and name it in a comment. Do not declare it as an `axiom`. An unfinished proof may use `sorry`, but the Lean checker reports it as a failure. The checker also fails every declaration that rests on an axiom beyond `propext`, `Classical.choice` and `Quot.sound`, which also rules out `native_decide`.
 
-After a proof closes, print differential test vectors with `#eval`. Include boundary inputs and a spread of in-range inputs, with each input and the model's output on one line. Write a test in the target repository's own framework that calls the production function on those inputs and compares its output. A mismatch is a bug in the production code or the transcription; establish which before reporting. State how many vectors agree and the integer widths in both implementations. If the production comparison was not run, say so beside the proof verdict.
+After a proof closes, print differential test vectors by evaluating them at top level, as the template does. Include boundary inputs and a spread of in-range inputs, with each input and the model's output on one line. Write a test in the target repository's own framework that calls the production function on those inputs and compares its output. A mismatch is a bug in the production code or the transcription; establish which before reporting. State how many vectors agree and the integer widths in both implementations. If the production comparison was not run, say so beside the proof verdict.
 
 When a theorem needs a proof beyond bounded search and the host offers Lean language-server tools for goals and diagnostics, use them to shorten the loop. This plugin neither requires nor configures such a server.
 

package/skills/formal-verify/scripts/kani.py

@@ -44,9 +44,11 @@ class Outcome:
     output: str
 
 
-def search_path(variable, *directories):
-    inherited = [os.environ[variable]] if variable in os.environ else []
-    return os.pathsep.join([*(str(directory) for directory in directories), *inherited])
+def search_path(inherited, *directories):
+    entries = [str(directory) for directory in directories]
+    if inherited is not None:
+        entries.append(inherited)
+    return os.pathsep.join(entries)
 
 
 class Kani:
@@ -67,8 +69,8 @@ class Kani:
         self.env = os.environ | {
             "KANI_HOME": str(home),
             "RUSTUP_TOOLCHAIN": str((bundle / "toolchain").resolve()),
-            "PATH": search_path("PATH", bundle / "bin", bundle / "pyroot/bin", bundle / "toolchain/bin"),
-            "PYTHONPATH": search_path("PYTHONPATH", bundle / "pyroot"),
+            "PATH": search_path(os.environ.get("PATH"), bundle / "bin", bundle / "pyroot/bin", bundle / "toolchain/bin"),
+            "PYTHONPATH": search_path(os.environ.get("PYTHONPATH"), bundle / "pyroot"),
         }
         # A parent cargo (cargo run, cargo test, a build script) exports its rustup toolchain's
         # lib directory here; the bundled compiler must load only the bundled toolchain.