agent-formal-verify 0.4.4 → 0.4.5

package/CHANGES.md

@@ -1,5 +1,9 @@
 # Changes
 
+## 0.4.5 - follow renames before retiring a model
+
+The 0.4.4 recheck could propose retiring a model whose code still exists, and could skip the commit that changed a guarantee on purpose. Its search for the covered functions left out each model's files. A Kani harness written inside a production file, as in the bundled template, took the production functions out of the search with it, and a function renamed in place matched nothing. Step 1 now leaves out only model files that hold no production code. When a covered name is found nowhere, it finds the commit that removed the name with `git log -S` and reads all of it, and proposes retiring the model only when that commit deleted the code. The history search read a source file's first and last paths only, so a commit made at an intermediate path was skipped, and a guarantee changed there on purpose kept its old property. Step 1 now follows each source file through every rename since the sync commit and reads the log over all of its paths.
+
 ## 0.4.4 - bring existing models back in line with the code
 
 A TLA+ spec or Lean model keeps passing after the code it describes changes, because it never reads the code. When a repository already has models, the formal-verify skill now starts with them. It runs every one, finds where the functions it covers live now, and reads the commits that touched those files since the commit its header records as `Source read at`, so it follows code that moved to another file. It asks whether the model still describes the code and whether any of those commits says the guarantee changed; without that evidence the property stays, and a failure after the update is a bug candidate. Each brief has a section for an existing model: the agent edits the model's files, adds a mutation for each step the update adds, and records the commit it read the source at. When that commit is missing or no longer reachable from `HEAD`, as after a squash merge, the skill uses the last commit that touched the model. It proposes retiring a model whose functions are found nowhere and deletes it, with its CI steps and testing documentation row, when the user agrees. The reply keeps each model's verdict and adds whether it was unchanged or updated, or is proposed for retirement. A request to recheck only the existing models skips the search for new targets.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-formal-verify",
-  "version": "0.4.4",
+  "version": "0.4.5",
   "description": "Model-check protocols with TLA+, prove invariants with Lean 4, and check bounded Rust functions with Kani.",
   "author": {
     "name": "Michael Denyer",

package/skills/formal-verify/SKILL.md

@@ -25,7 +25,12 @@ Use the tool the user names. When the table gives another tool for part of the t
 
 When the repository has models from an earlier run, start with them. Find every model, wherever it lives: `.tla` specs with their `.matrix` and `.mutations` files, Lean models with their `.mutations` and `.statements` files, and Kani harness files. Each is a row in the table this step writes.
 
-Take each model's sync commit from the `Source read at` line in its header when `git merge-base --is-ancestor <commit> HEAD` succeeds, and otherwise from `git log -1 --format=%H -- <model files>`. Find where the functions and shared variables it covers live now with `git grep -l -w -e <name> -- . ':(exclude)<model file>'`, one exclude per model file. When none is found, mark the row for retirement as step 5 says. Otherwise read `git log -p <sync>..HEAD -- <source files> <files found>`, which follows code that moved to another file. A model with no sync commit has no log to read, so compare it with the code in full.
+Take each model's sync commit from the `Source read at` line in its header when `git merge-base --is-ancestor <commit> HEAD` succeeds, and otherwise from `git log -1 --format=%H -- <model files>`. A model with no sync commit has no log to read, so compare it with the code in full. For the others, collect every path the covered code has had since the sync commit:
+
+- Follow each source file in the header through the renames that `git log -M --diff-filter=R --name-status --format= <sync>..HEAD` lists, and keep every path on the way, not only the first and last.
+- Add the files where the functions and shared variables it covers live now, from `git grep -l -w -e <name> -- . ':(exclude)<model file>'`. Exclude only model files that hold no production code; a Kani harness written inside a production file stays in the search.
+
+Then read `git log -p <sync>..HEAD -- <paths collected>`, which includes commits made at an intermediate path and code that moved to another file. A covered name that `git grep` finds nowhere was renamed, moved or deleted. Find the commit that removed it with `git log -S <name> <sync>..HEAD -- <paths collected>` and read all of it with `git show <commit>`. When it renamed or moved the code, follow the code to its new name and file. Mark the row for retirement as step 5 says only when the code is gone.
 
 Record the sync commit, the commits read and the answers to two questions in the row: