dsh-logicprobe 0.3.1 → 0.5.0

package/src/data-tool.ts

@@ -0,0 +1,65 @@
+import { defineTool, type JsonValue } from '@deepseek-ai/dsh-tools'
+import { runDataVerification, DATA_ENGINE_SCHEMA_VERSION } from './data-engine.js'
+
+export const LOGICPROBE_DATAMODEL_VERIFY_TOOL_NAME = 'logicprobe_datamodel_verify'
+
+/**
+ * Model-visible DSH tool wrapping the bundled data-model verification engine.
+ * The model passes a DataModelV1 object; the engine validates it and returns
+ * DS/DA/DD checks. Optional beforeModel/fieldMapping/copyPairs/migrationMappings
+ * enable before/after data-model regression and migration coverage checks.
+ */
+export const logicProbeDataModelVerifyTool = defineTool({
+  name: LOGICPROBE_DATAMODEL_VERIFY_TOOL_NAME,
+  description:
+    'Run executable data-model verification (logicprobe-datamodel). Takes a DataModelV1 object with schemaVersion=1, entities ({name, fields, primaryKey?, uniqueKeys?, indexes?}), relationships?, invariants?, boundaryChecks?. Optional beforeModel/fieldMapping/copyPairs/migrationMappings/backupPairs enable migration coverage, copy consistency, rollback symmetry, and before/after data regression (DD1-DD4). Returns a report with DS/DA/DD checks. See skills/logicprobe-datamodel/references/data-model-schema.md.',
+  parameters: {
+    model: {
+      type: 'json',
+      required: true,
+      description: 'DataModelV1 data model to verify.',
+    },
+    beforeModel: {
+      type: 'json',
+      description: 'Optional BEFORE DataModelV1 data model for regression comparison.',
+    },
+    fieldMapping: {
+      type: 'json',
+      description: 'Optional object mapping BEFORE "Entity.field" paths to AFTER "Entity.field" paths.',
+    },
+    copyPairs: {
+      type: 'json',
+      description: 'Optional copy pairs: { id, sourceEntity, targetEntity, mapping: {sourceField: targetField} }.',
+    },
+    migrationMappings: {
+      type: 'json',
+      description: 'Optional migration mappings: { from: "Entity.field", to: "Entity.field", transform?, note? }.',
+    },
+    backupPairs: {
+      type: 'json',
+      description: 'Optional backup/restore pairs for DA7 rollback symmetry.',
+    },
+  },
+  output: {
+    schema: {
+      type: 'json',
+      description: 'logicprobe-datamodel verification report with summary and per-check findings.',
+    },
+    render(_args, value) {
+      return [{ type: 'text' as const, text: JSON.stringify(value, null, 2) }]
+    },
+  },
+  timeoutMs: 10_000,
+  isConcurrencySafe: () => true,
+  async execute(args) {
+    return runDataVerification(args.model, {
+      beforeModel: args.beforeModel,
+      fieldMapping: args.fieldMapping as Record<string, string> | undefined,
+      copyPairs: args.copyPairs as Array<{ id: string; sourceEntity: string; targetEntity: string; mapping: Record<string, string> }> | undefined,
+      migrationMappings: args.migrationMappings as Array<{ from: string; to: string; transform?: 'copy' | 'rename' | 'split' | 'merge' | 'drop' | 'manual'; note?: string }> | undefined,
+      backupPairs: args.backupPairs as Array<{ id: string; sourceEntity: string; targetEntity: string; mapping: Record<string, string> }> | undefined,
+    }) as unknown as JsonValue
+  },
+})
+
+export { DATA_ENGINE_SCHEMA_VERSION }

package/src/engine.ts

@@ -52,12 +52,16 @@ export interface VariableSpec {
   init: number | boolean
   min?: number
   max?: number
+  monotonic?: 'inc' | 'dec'
 }
 
 export type InvariantSpec =
   | { id: string; description: string; kind: 'never-states'; states: string[] }
   | { id: string; description: string; kind: 'var-in-range'; variable: string; min?: number; max?: number }
   | { id: string; description: string; kind: 'event-before-state'; event: string; state: string }
+  | { id: string; description: string; kind: 'leads-to'; from: string; to: string }
+  | { id: string; description: string; kind: 'sequence'; events: string[] }
+  | { id: string; description: string; kind: 'atomicity'; events: string[]; commit: string; rollback?: string }
 
 export interface ResourcePairSpec {
   resource: string
@@ -81,11 +85,14 @@ export interface LogicModelV1 {
   concurrentPairs?: [string, string][]
   boundaryChecks?: BoundaryCheckSpec[]
   resourcePairs?: ResourcePairSpec[]
+  idempotentEvents?: string[]
 }
 
 export interface VerificationOptions {
   maxStates?: number
   maxPermutationEvents?: number
+  beforeModel?: unknown
+  stateMapping?: Record<string, string>
 }
 
 export interface PathStep {
@@ -123,6 +130,23 @@ export interface VerificationReport {
     truncated?: boolean
   }
   checks: CheckResult[]
+  comparison?: ComparisonSummary
+}
+
+export interface ComparisonSummary {
+  beforeModelHash: string
+  afterModelHash: string
+  stateMapping: Record<string, string>
+  beforeStates: number
+  beforeTransitions: number
+  afterStates: number
+  afterTransitions: number
+  addedStates: string[]
+  removedStates: string[]
+  addedEvents: string[]
+  removedEvents: string[]
+  addedTransitions: TransitionSpec[]
+  removedTransitions: TransitionSpec[]
 }
 
 export interface RuntimeState {
@@ -226,6 +250,7 @@ export function validateModel(input: unknown): { ok: true; model: LogicModelV1 }
       if (variable.min !== undefined && typeof variable.min !== 'number') bad(path + '.min', 'must be a number')
       if (variable.max !== undefined && typeof variable.max !== 'number') bad(path + '.max', 'must be a number')
       if (typeof variable.min === 'number' && typeof variable.max === 'number' && variable.min > variable.max) bad(path + '.max', 'must be >= min')
+      if (variable.monotonic !== undefined && variable.monotonic !== 'inc' && variable.monotonic !== 'dec') bad(path + '.monotonic', "must be 'inc' or 'dec'")
       if (variable.kind === 'integer' && typeof variable.init === 'number') {
         if (typeof variable.min === 'number' && variable.init < variable.min) bad(path + '.init', 'must be >= min')
         if (typeof variable.max === 'number' && variable.init > variable.max) bad(path + '.init', 'must be <= max')
@@ -259,6 +284,21 @@ export function validateModel(input: unknown): { ok: true; model: LogicModelV1 }
       } else if (invariant.kind === 'event-before-state') {
         if (typeof invariant.event !== 'string' || invariant.event.length === 0) bad(path + '.event', 'must be a non-empty string')
         if (typeof invariant.state !== 'string' || invariant.state.length === 0) bad(path + '.state', 'must be a non-empty string')
+      } else if (invariant.kind === 'leads-to') {
+        if (typeof invariant.from !== 'string' || invariant.from.length === 0) bad(path + '.from', 'must be a non-empty string')
+        if (typeof invariant.to !== 'string' || invariant.to.length === 0) bad(path + '.to', 'must be a non-empty string')
+      } else if (invariant.kind === 'sequence') {
+        if (!Array.isArray(invariant.events) || invariant.events.length === 0) bad(path + '.events', 'must be a non-empty array')
+        else invariant.events.forEach((event, eventIndex) => {
+          if (typeof event !== 'string' || event.length === 0) bad(path + '.events[' + eventIndex + ']', 'must be a non-empty string')
+        })
+      } else if (invariant.kind === 'atomicity') {
+        if (!Array.isArray(invariant.events) || invariant.events.length === 0) bad(path + '.events', 'must be a non-empty array')
+        else invariant.events.forEach((event, eventIndex) => {
+          if (typeof event !== 'string' || event.length === 0) bad(path + '.events[' + eventIndex + ']', 'must be a non-empty string')
+        })
+        if (typeof invariant.commit !== 'string' || invariant.commit.length === 0) bad(path + '.commit', 'must be a non-empty string')
+        if (invariant.rollback !== undefined && typeof invariant.rollback !== 'string') bad(path + '.rollback', 'must be a string')
       } else {
         bad(path + '.kind', 'unknown invariant kind')
       }
@@ -286,6 +326,12 @@ export function validateModel(input: unknown): { ok: true; model: LogicModelV1 }
       if (!Array.isArray(check.values) || check.values.some((value) => typeof value !== 'number')) bad(path + '.values', 'must be an array of numbers')
     })
   }
+  if (root.idempotentEvents !== undefined) {
+    if (!Array.isArray(root.idempotentEvents)) bad('idempotentEvents', 'must be an array')
+    else root.idempotentEvents.forEach((entry, index) => {
+      if (typeof entry !== 'string' || entry.length === 0) bad('idempotentEvents[' + index + ']', 'must be a non-empty string')
+    })
+  }
   if (root.resourcePairs !== undefined) {
     if (!Array.isArray(root.resourcePairs)) bad('resourcePairs', 'must be an array')
     else root.resourcePairs.forEach((entry, index) => {
@@ -1102,6 +1148,449 @@ function A7_shortestViolations(model: LogicModelV1, options: NormalizedOptions):
   return checkResult('A7', 'Minimal Counter-Example', findings, violations.length === 0 ? 'All invariants hold for all reachable paths' : 'Violated invariants: ' + findings.length)
 }
 
+function mapStateId(mapping: Record<string, string>, state: string): string {
+  return mapping[state] ?? state
+}
+
+function D1_behavioralPreservation(before: LogicModelV1, after: LogicModelV1, mapping: Record<string, string>): CheckResult {
+  const findings: Finding[] = []
+  const afterStates = new Set(after.states.map((state) => state.id))
+  const afterByFromEvent = new Map<string, Set<string>>()
+  for (const transition of after.transitions) {
+    const key = transition.from + '|' + transition.event
+    const set = afterByFromEvent.get(key) ?? new Set<string>()
+    set.add(transition.to)
+    afterByFromEvent.set(key, set)
+  }
+  const beforeInitMapped = mapStateId(mapping, before.init)
+  if (beforeInitMapped !== after.init) {
+    findings.push({
+      code: 'D1_INIT_MISMATCH',
+      severity: 'warning',
+      message: 'Mapped BEFORE init ' + beforeInitMapped + ' does not match AFTER init ' + after.init + '.',
+      evidence: { beforeInit: before.init, mappedInit: beforeInitMapped, afterInit: after.init },
+    })
+  }
+  for (const state of before.states) {
+    const mapped = mapStateId(mapping, state.id)
+    if (!afterStates.has(mapped)) {
+      findings.push({
+        code: 'D1_MAPPED_STATE_MISSING',
+        severity: 'error',
+        message: 'BEFORE state ' + state.id + ' maps to ' + mapped + ', which is not declared in AFTER.',
+        evidence: { beforeState: state.id, mappedState: mapped },
+      })
+      continue
+    }
+    for (const transition of before.transitions.filter((entry) => entry.from === state.id)) {
+      const key = mapped + '|' + transition.event
+      const targets = afterByFromEvent.get(key)
+      if (targets === undefined || targets.size === 0) {
+        findings.push({
+          code: 'D1_EVENT_DISABLED',
+          severity: 'error',
+          message: 'BEFORE can fire event ' + transition.event + ' from ' + state.id + ' (mapped to ' + mapped + '), but AFTER has no transition for that (state, event).',
+          path: [{ from: state.id, event: transition.event, to: transition.to }],
+          evidence: { beforeState: state.id, mappedState: mapped, event: transition.event },
+        })
+      }
+    }
+  }
+  return checkResult('D1', 'Behavioral Preservation', findings, findings.length === 0 ? 'BEFORE event behavior is preserved in AFTER' : 'Behavioral preservation findings: ' + findings.length)
+}
+
+function mapInvariantForComparison(invariant: InvariantSpec, mapping: Record<string, string>): InvariantSpec {
+  if (invariant.kind === 'never-states') {
+    return {
+      ...invariant,
+      id: invariant.id + ':before',
+      description: invariant.description + ' (from BEFORE)',
+      states: invariant.states.map((state) => mapStateId(mapping, state)),
+    }
+  }
+  if (invariant.kind === 'event-before-state') {
+    return {
+      ...invariant,
+      id: invariant.id + ':before',
+      description: invariant.description + ' (from BEFORE)',
+      state: mapStateId(mapping, invariant.state),
+    }
+  }
+  return { ...invariant, id: invariant.id + ':before', description: invariant.description + ' (from BEFORE)' }
+}
+
+function D2_invariantContinuity(before: LogicModelV1, after: LogicModelV1, options: NormalizedOptions, mapping: Record<string, string>): CheckResult {
+  const findings: Finding[] = []
+  const afterStates = new Set(after.states.map((state) => state.id))
+  const afterVariables = new Set((after.variables ?? []).map((variable) => variable.name))
+  for (const invariant of before.invariants ?? []) {
+    const mapped = mapInvariantForComparison(invariant, mapping)
+    if (mapped.kind === 'never-states') {
+      for (const state of mapped.states) {
+        if (!afterStates.has(state)) {
+          findings.push({
+            code: 'D2_MAPPED_STATE_MISSING',
+            severity: 'warning',
+            message: 'BEFORE invariant "' + invariant.id + '" maps to state ' + state + ', which is not declared in AFTER.',
+            evidence: { invariant: invariant.id, state },
+          })
+        }
+      }
+    } else if (mapped.kind === 'event-before-state') {
+      if (!afterStates.has(mapped.state)) {
+        findings.push({
+          code: 'D2_MAPPED_STATE_MISSING',
+          severity: 'warning',
+          message: 'BEFORE invariant "' + invariant.id + '" maps to state ' + mapped.state + ', which is not declared in AFTER.',
+          evidence: { invariant: invariant.id, state: mapped.state },
+        })
+      }
+    } else if (mapped.kind === 'var-in-range') {
+      if (!afterVariables.has(mapped.variable)) {
+        findings.push({
+          code: 'D2_VARIABLE_MISSING',
+          severity: 'warning',
+          message: 'BEFORE invariant "' + invariant.id + '" references variable ' + mapped.variable + ', which is not declared in AFTER.',
+          evidence: { invariant: invariant.id, variable: mapped.variable },
+        })
+        continue
+      }
+    }
+    const violation = shortestViolationForInvariant(after, options, mapped)
+    if (violation !== undefined) {
+      findings.push({
+        code: 'D2_INVARIANT_REGRESSION',
+        severity: 'error',
+        message: 'BEFORE invariant "' + invariant.id + '" no longer holds in AFTER: ' + violation.reason,
+        path: violation.path,
+        evidence: { beforeInvariant: invariant, afterInvariant: mapped },
+      })
+    }
+  }
+  return checkResult('D2', 'Invariant Continuity', findings, findings.length === 0 ? 'All BEFORE invariants continue to hold' : 'Invariant continuity findings: ' + findings.length)
+}
+
+function D3_regressionDelta(before: LogicModelV1, after: LogicModelV1, mapping: Record<string, string>): CheckResult {
+  const afterStateIds = new Set(after.states.map((state) => state.id))
+  const beforeMappedIds = new Set(before.states.map((state) => mapStateId(mapping, state.id)))
+  const addedStates = after.states.filter((state) => !beforeMappedIds.has(state.id)).map((state) => state.id).sort()
+  const removedStates = before.states.filter((state) => !afterStateIds.has(mapStateId(mapping, state.id))).map((state) => state.id).sort()
+  const beforeEvents = new Set(before.transitions.map((transition) => transition.event))
+  const afterEvents = new Set(after.transitions.map((transition) => transition.event))
+  const addedEvents = [...afterEvents].filter((event) => !beforeEvents.has(event)).sort()
+  const removedEvents = [...beforeEvents].filter((event) => !afterEvents.has(event)).sort()
+  const removedTransitions = before.transitions.filter((transition) => !after.transitions.some((candidate) =>
+    candidate.from === mapStateId(mapping, transition.from) &&
+    candidate.event === transition.event &&
+    candidate.to === mapStateId(mapping, transition.to)
+  ))
+  const addedTransitions = after.transitions.filter((transition) => !before.transitions.some((candidate) =>
+    mapStateId(mapping, candidate.from) === transition.from &&
+    candidate.event === transition.event &&
+    mapStateId(mapping, candidate.to) === transition.to
+  ))
+  const findings: Finding[] = []
+  for (const state of removedStates) {
+    findings.push({ code: 'D3_REMOVED_STATE', severity: 'warning', message: 'BEFORE state ' + state + ' is not present in AFTER under the given mapping.', evidence: { state } })
+  }
+  for (const event of removedEvents) {
+    findings.push({ code: 'D3_REMOVED_EVENT', severity: 'warning', message: 'BEFORE event ' + event + ' is not present in AFTER.', evidence: { event } })
+  }
+  for (const transition of removedTransitions) {
+    findings.push({
+      code: 'D3_REMOVED_TRANSITION',
+      severity: 'warning',
+      message: 'BEFORE transition ' + transition.from + ' -' + transition.event + '-> ' + transition.to + ' has no exact AFTER counterpart.',
+      evidence: { transition },
+    })
+  }
+  const detail = 'Delta: +' + addedStates.length + ' states, -' + removedStates.length + ' states, +' + addedEvents.length + ' events, -' + removedEvents.length + ' events, +' + addedTransitions.length + ' transitions, -' + removedTransitions.length + ' transitions'
+  return checkResult('D3', 'Regression Delta', findings, detail)
+}
+
+function deadlockStateIds(model: LogicModelV1): string[] {
+  const outgoing = new Set(model.transitions.map((transition) => transition.from))
+  return model.states.filter((state) => state.terminal !== true && !outgoing.has(state.id)).map((state) => state.id)
+}
+
+function closedSccStateSets(model: LogicModelV1): string[][] {
+  return sccs(model)
+    .filter((component) => {
+      const componentSet = new Set(component)
+      const internalEdges = model.transitions.some((transition) => componentSet.has(transition.from) && componentSet.has(transition.to))
+      const escapingEdges = model.transitions.some((transition) => componentSet.has(transition.from) && !componentSet.has(transition.to))
+      return internalEdges && !escapingEdges && !component.some((state) => isTerminal(model, state))
+    })
+    .map((component) => component.sort())
+}
+
+function D4_deadlockLivenessRegression(before: LogicModelV1, after: LogicModelV1, mapping: Record<string, string>): CheckResult {
+  const findings: Finding[] = []
+  const beforeDeadlock = new Set(deadlockStateIds(before).map((state) => mapStateId(mapping, state)))
+  const afterDeadlock = deadlockStateIds(after)
+  for (const state of afterDeadlock) {
+    if (!beforeDeadlock.has(state)) {
+      findings.push({
+        code: 'D4_DEADLOCK_REGRESSION',
+        severity: 'error',
+        message: 'AFTER introduces deadlock in state ' + state + ' that was not deadlocked in BEFORE.',
+        evidence: { state },
+      })
+    }
+  }
+  const beforeScc = new Set(closedSccStateSets(before).map((component) => component.map((state) => mapStateId(mapping, state)).sort().join(',')))
+  const afterScc = closedSccStateSets(after)
+  for (const component of afterScc) {
+    const key = component.join(',')
+    if (!beforeScc.has(key)) {
+      findings.push({
+        code: 'D4_LIVENESS_REGRESSION',
+        severity: 'error',
+        message: 'AFTER introduces a closed SCC with no exit and no terminal state: ' + key,
+        evidence: { states: component },
+      })
+    }
+  }
+  return checkResult('D4', 'Deadlock/Liveness Regression', findings, findings.length === 0 ? 'No new deadlock or liveness regressions' : 'Regression findings: ' + findings.length)
+}
+
+function buildComparisonSummary(before: LogicModelV1, after: LogicModelV1, mapping: Record<string, string>): ComparisonSummary {
+  const afterStateIds = new Set(after.states.map((state) => state.id))
+  const beforeMappedIds = new Set(before.states.map((state) => mapStateId(mapping, state.id)))
+  const addedStates = after.states.filter((state) => !beforeMappedIds.has(state.id)).map((state) => state.id).sort()
+  const removedStates = before.states.filter((state) => !afterStateIds.has(mapStateId(mapping, state.id))).map((state) => state.id).sort()
+  const beforeEvents = new Set(before.transitions.map((transition) => transition.event))
+  const afterEvents = new Set(after.transitions.map((transition) => transition.event))
+  const addedEvents = [...afterEvents].filter((event) => !beforeEvents.has(event)).sort()
+  const removedEvents = [...beforeEvents].filter((event) => !afterEvents.has(event)).sort()
+  const removedTransitions = before.transitions.filter((transition) => !after.transitions.some((candidate) =>
+    candidate.from === mapStateId(mapping, transition.from) &&
+    candidate.event === transition.event &&
+    candidate.to === mapStateId(mapping, transition.to)
+  ))
+  const addedTransitions = after.transitions.filter((transition) => !before.transitions.some((candidate) =>
+    mapStateId(mapping, candidate.from) === transition.from &&
+    candidate.event === transition.event &&
+    mapStateId(mapping, candidate.to) === transition.to
+  ))
+  return {
+    beforeModelHash: modelHash(before),
+    afterModelHash: modelHash(after),
+    stateMapping: mapping,
+    beforeStates: before.states.length,
+    beforeTransitions: before.transitions.length,
+    afterStates: after.states.length,
+    afterTransitions: after.transitions.length,
+    addedStates,
+    removedStates,
+    addedEvents,
+    removedEvents,
+    addedTransitions,
+    removedTransitions,
+  }
+}
+function A8_idempotentReplay(model: LogicModelV1, exploration: Exploration): CheckResult {
+  const events = model.idempotentEvents ?? []
+  const findings: Finding[] = []
+  for (const event of events) {
+    for (const runtime of exploration.reachable) {
+      const onceOptions = stepRuntime(model, runtime, event)
+      if (onceOptions.length === 0) continue
+      for (const once of onceOptions) {
+        const twiceOptions = stepRuntime(model, once, event)
+        if (twiceOptions.length === 0) {
+          findings.push({
+            code: 'A8_NOT_REPLAYABLE',
+            severity: 'warning',
+            message: 'Idempotent event ' + event + ' is not replayable after first application from ' + runtime.state + '.',
+            path: [{ from: runtime.state, event, to: once.state }],
+            evidence: { state: runtime.state, event },
+          })
+          continue
+        }
+        for (const twice of twiceOptions) {
+          if (runtimeKey(twice) !== runtimeKey(once)) {
+            findings.push({
+              code: 'A8_NOT_IDEMPOTENT',
+              severity: 'error',
+              message: 'Idempotent event ' + event + ' changes state when applied twice from ' + runtime.state + '.',
+              path: [{ from: runtime.state, event, to: once.state }, { from: once.state, event, to: twice.state }],
+              evidence: { state: runtime.state, event, afterOnce: once, afterTwice: twice },
+            })
+            break
+          }
+        }
+      }
+    }
+  }
+  return checkResult('A8', 'Idempotent Replay', findings, findings.length === 0 ? 'Idempotent events are replay-safe' : 'Idempotent replay findings: ' + findings.length)
+}
+function S8_monotonicVariables(model: LogicModelV1): CheckResult {
+  const findings: Finding[] = []
+  for (const variable of model.variables ?? []) {
+    if (variable.monotonic === undefined) continue
+    for (const transition of model.transitions) {
+      for (const update of transition.updates ?? []) {
+        if (update.variable !== variable.name) continue
+        if (variable.monotonic === 'inc' && update.op === 'dec') {
+          findings.push({ code: 'S8_MONOTONIC_DECREASE', severity: 'error', message: 'Monotonic (inc) variable ' + variable.name + ' is decreased by ' + transition.event + '.', evidence: { variable: variable.name, transition } })
+        } else if (variable.monotonic === 'dec' && update.op === 'inc') {
+          findings.push({ code: 'S8_MONOTONIC_INCREASE', severity: 'error', message: 'Monotonic (dec) variable ' + variable.name + ' is increased by ' + transition.event + '.', evidence: { variable: variable.name, transition } })
+        } else if (update.op === 'set') {
+          findings.push({ code: 'S8_MONOTONIC_SET_REVIEW', severity: 'warning', message: 'Monotonic variable ' + variable.name + ' uses set in ' + transition.event + '; verify it cannot move backwards.', evidence: { variable: variable.name, transition } })
+        }
+      }
+    }
+  }
+  return checkResult('S8', 'Monotonic Variables', findings, findings.length === 0 ? 'Monotonic variables are respected' : 'Monotonic findings: ' + findings.length)
+}
+
+function findLeadsToBadPath(model: LogicModelV1, start: RuntimeState, target: string): { path: PathStep[]; reason: string } | undefined {
+  if (start.state === target) return undefined
+  const visited = new Set<string>()
+  const queue: Array<{ runtime: RuntimeState; path: PathStep[] }> = [{ runtime: start, path: [] }]
+  while (queue.length > 0) {
+    const entry = queue.shift()!
+    const key = runtimeKey(entry.runtime)
+    if (entry.runtime.state === target) continue
+    if (visited.has(key)) return { path: entry.path, reason: 'Cycle avoids target ' + target }
+    visited.add(key)
+    const nexts: Array<{ next: RuntimeState; event: string }> = []
+    for (const event of allEvents(model)) {
+      for (const next of stepRuntime(model, entry.runtime, event)) nexts.push({ next, event })
+    }
+    if (nexts.length === 0) return { path: entry.path, reason: 'Dead end before target ' + target }
+    for (const { next, event } of nexts) {
+      queue.push({ runtime: next, path: [...entry.path, { from: entry.runtime.state, event, to: next.state }] })
+    }
+  }
+  return { path: [], reason: 'No path reaches target ' + target }
+}
+
+function A9_leadsTo(model: LogicModelV1, exploration: Exploration): CheckResult {
+  const findings: Finding[] = []
+  for (const invariant of model.invariants ?? []) {
+    if (invariant.kind !== 'leads-to') continue
+    for (const runtime of exploration.reachable) {
+      if (runtime.state !== invariant.from) continue
+      const bad = findLeadsToBadPath(model, runtime, invariant.to)
+      if (bad !== undefined) {
+        findings.push({
+          code: 'A9_LEADS_TO_VIOLATION',
+          severity: 'error',
+          message: 'Leads-to invariant "' + invariant.id + '" violated from ' + invariant.from + ': ' + bad.reason,
+          path: bad.path,
+          evidence: { invariant },
+        })
+        break
+      }
+    }
+  }
+  return checkResult('A9', 'Leads-To', findings, findings.length === 0 ? 'All leads-to invariants hold' : 'Leads-to findings: ' + findings.length)
+}
+
+function findSequenceViolation(model: LogicModelV1, options: NormalizedOptions, invariant: Extract<InvariantSpec, { kind: 'sequence' }>): InvariantViolation | undefined {
+  const events = invariant.events
+  const init = initialState(model)
+  const key = (runtime: RuntimeState, progress: number): string => runtimeKey(runtime) + '|' + progress
+  const visited = new Set<string>([key(init, 0)])
+  const queue: Array<{ runtime: RuntimeState; progress: number; path: PathStep[] }> = [{ runtime: init, progress: 0, path: [] }]
+  let steps = 0
+  while (queue.length > 0) {
+    const entry = queue.shift()!
+    if (++steps > options.maxStates) break
+    for (const event of allEvents(model)) {
+      for (const next of stepRuntime(model, entry.runtime, event)) {
+        let progress = entry.progress
+        let violation = false
+        if (progress < events.length && event === events[progress]) {
+          progress += 1
+        } else {
+          const index = events.indexOf(event)
+          if (index > progress) violation = true
+        }
+        const path = [...entry.path, { from: entry.runtime.state, event, to: next.state }]
+        if (violation) {
+          return { invariant, path, reason: 'Event ' + event + ' occurred before ' + events[progress] }
+        }
+        const nextKey = key(next, progress)
+        if (!visited.has(nextKey)) {
+          visited.add(nextKey)
+          queue.push({ runtime: next, progress, path })
+        }
+      }
+    }
+  }
+  return undefined
+}
+
+function A10_sequenceOrder(model: LogicModelV1, options: NormalizedOptions): CheckResult {
+  const findings: Finding[] = []
+  for (const invariant of model.invariants ?? []) {
+    if (invariant.kind !== 'sequence') continue
+    const violation = findSequenceViolation(model, options, invariant)
+    if (violation !== undefined) {
+      findings.push({
+        code: 'A10_SEQUENCE_VIOLATION',
+        severity: 'error',
+        message: 'Sequence invariant "' + invariant.id + '" violated: ' + violation.reason,
+        path: violation.path,
+        evidence: { invariant },
+      })
+    }
+  }
+  return checkResult('A10', 'Sequence Order', findings, findings.length === 0 ? 'All sequence invariants hold' : 'Sequence findings: ' + findings.length)
+}
+
+function findAtomicityViolation(model: LogicModelV1, options: NormalizedOptions, invariant: Extract<InvariantSpec, { kind: 'atomicity' }>): InvariantViolation | undefined {
+  const atomic = new Set(invariant.events)
+  const init = initialState(model)
+  const key = (runtime: RuntimeState, started: boolean, closed: boolean): string => runtimeKey(runtime) + '|' + (started ? '1' : '0') + '|' + (closed ? '1' : '0')
+  const visited = new Set<string>([key(init, false, false)])
+  const queue: Array<{ runtime: RuntimeState; started: boolean; closed: boolean; path: PathStep[] }> = [{ runtime: init, started: false, closed: false, path: [] }]
+  let steps = 0
+  while (queue.length > 0) {
+    const entry = queue.shift()!
+    if (++steps > options.maxStates) break
+    for (const event of allEvents(model)) {
+      for (const next of stepRuntime(model, entry.runtime, event)) {
+        const started = entry.started || atomic.has(event)
+        const closed = entry.closed || event === invariant.commit || (invariant.rollback !== undefined && event === invariant.rollback)
+        const path = [...entry.path, { from: entry.runtime.state, event, to: next.state }]
+        if (entry.started && !entry.closed && !atomic.has(event) && event !== invariant.commit && event !== invariant.rollback) {
+          return { invariant, path, reason: 'Left atomic scope via ' + event + ' without commit/rollback' }
+        }
+        if (started && !closed && isTerminal(model, next.state)) {
+          return { invariant, path, reason: 'Terminal state reached with incomplete atomic group' }
+        }
+        const nextKey = key(next, started, closed)
+        if (!visited.has(nextKey)) {
+          visited.add(nextKey)
+          queue.push({ runtime: next, started, closed, path })
+        }
+      }
+    }
+  }
+  return undefined
+}
+
+function A11_atomicity(model: LogicModelV1, options: NormalizedOptions): CheckResult {
+  const findings: Finding[] = []
+  for (const invariant of model.invariants ?? []) {
+    if (invariant.kind !== 'atomicity') continue
+    const violation = findAtomicityViolation(model, options, invariant)
+    if (violation !== undefined) {
+      findings.push({
+        code: 'A11_ATOMICITY_VIOLATION',
+        severity: 'error',
+        message: 'Atomicity invariant "' + invariant.id + '" violated: ' + violation.reason,
+        path: violation.path,
+        evidence: { invariant },
+      })
+    }
+  }
+  return checkResult('A11', 'Atomicity', findings, findings.length === 0 ? 'All atomicity invariants hold' : 'Atomicity findings: ' + findings.length)
+}
 // ---------------------------------------------------------------------------
 // main entry
 // ---------------------------------------------------------------------------
@@ -1137,6 +1626,7 @@ export function runVerification(input: unknown, options: VerificationOptions = {
     S5_eventCompleteness(model),
     S6_guardCompleteness(model),
     S7_invariants(model, normalized),
+    S8_monotonicVariables(model),
     A1_unexpectedEvents(model),
     A2_raceInterleaving(model, exploration),
     A3_orderPermutation(model, normalized),
@@ -1144,7 +1634,49 @@ export function runVerification(input: unknown, options: VerificationOptions = {
     A5_boundaryBlast(model),
     A6_resourceInjection(model),
     A7_shortestViolations(model, normalized),
+    A8_idempotentReplay(model, exploration),
+    A9_leadsTo(model, exploration),
+    A10_sequenceOrder(model, normalized),
+    A11_atomicity(model, normalized),
   ]
+  let comparison: ComparisonSummary | undefined
+  if (options.beforeModel !== undefined) {
+    const beforeValidation = validateModel(options.beforeModel)
+    if (!beforeValidation.ok) {
+      return {
+        ok: false,
+        schemaVersion: 1,
+        modelHash: modelHash(model),
+        summary: {
+          states: model.states.length,
+          transitions: model.transitions.length,
+          errors: beforeValidation.errors.length,
+          warnings: 0,
+          checksRun: checks.length + 1,
+          truncated: exploration.truncated,
+        },
+        checks: [
+          ...checks,
+          {
+            id: 'BEFORE_MODEL',
+            name: 'Before Model Validation',
+            status: 'fail',
+            detail: 'Before model schema validation failed: ' + beforeValidation.errors.length + ' errors',
+            findings: beforeValidation.errors.map((message) => ({ code: 'BEFORE_MODEL_INVALID', severity: 'error', message })),
+          },
+        ],
+      }
+    }
+    const before = beforeValidation.model
+    const mapping = options.stateMapping ?? {}
+    checks.push(
+      D1_behavioralPreservation(before, model, mapping),
+      D2_invariantContinuity(before, model, normalized, mapping),
+      D3_regressionDelta(before, model, mapping),
+      D4_deadlockLivenessRegression(before, model, mapping),
+    )
+    comparison = buildComparisonSummary(before, model, mapping)
+  }
   const errors = checks.reduce((sum, check) => sum + check.findings.filter((finding) => finding.severity === 'error').length, 0)
   const warnings = checks.reduce((sum, check) => sum + check.findings.filter((finding) => finding.severity === 'warning').length, 0)
   return {
@@ -1160,5 +1692,6 @@ export function runVerification(input: unknown, options: VerificationOptions = {
       truncated: exploration.truncated,
     },
     checks,
+    ...(comparison === undefined ? {} : { comparison }),
   }
 }