dsh-logicprobe 0.4.0 → 0.5.1

package/README.en-US.md

@@ -13,9 +13,11 @@ Design documents are not truth — code is. A claim-verification skill that chec
 | Phase | What |
 |-------|------|
 | Phase 1-2 | Enumerate every verifiable claim (API names, file paths, enum values, counts, mechanism feasibility) → verify each against the codebase with evidence |
-| Phase 2a | **7 structural checks** on extracted state-machine models: reachability, deadlock, liveness, determinism, event/guard completeness, invariant validity |
-| Phase 2b | **7 adversarial probes**: unexpected events, race interleaving, order permutation, pair symmetry (lock/unlock), boundary blast, resource injection, minimal counter-example |
+| Phase 2a | **8 structural checks** on extracted state-machine models: reachability, deadlock, liveness, determinism, event/guard completeness, invariant validity, monotonic variables |
+| Phase 2b | **11 adversarial probes**: unexpected events, race interleaving, order permutation, pair symmetry (lock/unlock), boundary blast, resource injection, minimal counter-example, idempotent replay, leads-to, sequence, atomicity |
 | Refactoring | Before/after model comparison — behavioral preservation, invariant continuity, deadlock regression, complexity claims |
+| Data models | DataModelV1 verification — DS/DA/DD checks, migration coverage, copy consistency, before/after breaking-change regression |
+| Concurrency risk mining | Scans documents/plans for concurrency safety claims (thread-safe, lock-free, race condition, interrupt safety, etc.) and flags them for dedicated verification |
 | Output | Structured findings with exact file:line evidence, severity classification, correction direction — never inline fixes |
 
 The model is always shown as a transition table and **confirmed with the user before running** — extraction errors are the dominant failure mode.
@@ -64,6 +66,8 @@ Native dsh support ships as a cordis plugin bundle at the repository root (the r
 
 - The skill is discovered as-is by dsh's `skill-filesystem` provider (Agent Skills open standard) — zero code.
 - The bundle injects the claim-verification gate (1% Rule / Red Flags / proactive suggestion) into the first model step of every agent session — the dsh-native counterpart of the Claude `SessionStart` hook. It also registers a model-visible catalog entry (`cordis_inspect`), a native `logicprobe_verify` tool (`ctx.tools`), and a policy-aware `logicprobe:mode` context (`ctx.systemPrompt`).
+- `logicprobe_datamodel_verify` adds data-model verification: DataModelV1, migration coverage, copy consistency, and DD1-DD4 before/after data regression.
+- `logicprobe_concurrency_scan` mines documents/plans for concurrency risk claims (thread-safe, lock-free, race condition, mutex, etc.) and flags them for dedicated verification.
 - Together with the embedded-workbench bundle's Plan Verification Gate, this closes the claim-verification loop in dsh.
 
 Install: see [`.dsh/INSTALL.md`](.dsh/INSTALL.md) (four options, from plain skill copy to `dsh plugin add`).
@@ -77,10 +81,13 @@ The plugin auto-injects a capability notification into the first model step. The
 - **Design doc / plan review** — "Review this design document" → claim enumeration and codebase verification
 - **Behavioral questions** — "could this state machine deadlock", "is this retry limit safe", "check this timing for bugs" → the skill is proactively suggested (not auto-loaded) as an optional verification pass
 - **Refactoring plans** — the pipeline compares before/after models to flag undocumented behavioral changes
+- **Data model / migration review** — "is this migration non-breaking", "does this copy cover all required fields" → use the `logicprobe-datamodel` skill
 
 The skill auto-classifies depth (LIGHTWEIGHT / STANDARD / ESCALATED) from plan features in Phase 0, and appends a `## Plan Verification` summary block as the audit trail.
 
-In DSH, prefer the native `logicprobe_verify` tool (see `skills/logicprobe/references/dsh-model-schema.md`). Python remains optional for non-DSH hosts: when available, the reusable harness at `references/verification-harness.py` runs the checks; when not (air-gapped machines), the guide at `references/logic-verification-guide.md` provides a manual verification mode.
+In DSH, prefer the native `logicprobe_verify` tool for state machines and `logicprobe_datamodel_verify` for data models (see the schema references under each skill). Python remains optional for non-DSH hosts: state-machine checks use `skills/logicprobe/references/verification-harness.py`; data-model checks use `skills/logicprobe-datamodel/references/data-model-harness.py`. When Python is unavailable, the corresponding guide provides a manual verification mode.
+
+Sample models are available under [`examples/`](examples/README.md): order state-machine before/after, e-commerce data model, and User field migration.
 
 ## Codex CLI
 

package/README.md

@@ -11,9 +11,11 @@
 | 阶段 | 内容 |
 |------|------|
 | Phase 1-2 | 枚举每个可验证声称（API 名、文件路径、枚举值、数量、机制可行性）→ 逐条对照代码库给出证据 |
-| Phase 2a | 对提取的状态机模型执行 **7 项结构检查**：可达性、死锁、活性、确定性、事件/守卫完备性、不变量有效性 |
-| Phase 2b | **7 种对抗探针**：意外事件、竞态交错、顺序置换、配对对称（lock/unlock）、边界轰炸、资源注入、最小反例 |
+| Phase 2a | 对提取的状态机模型执行 **8 项结构检查**：可达性、死锁、活性、确定性、事件/守卫完备性、不变量有效性、单调变量 |
+| Phase 2b | **11 种对抗探针**：意外事件、竞态交错、顺序置换、配对对称（lock/unlock）、边界轰炸、资源注入、最小反例、幂等重放、必达、顺序、原子性 |
 | 重构模式 | 前后模型对比——行为保持、不变量连续性、死锁回归、复杂度声称 |
+| 数据模型模式 | DataModelV1 数据模型验证——DS/DA/DD 检查，迁移覆盖、copy 一致性、before/after 破坏性变更回归 |
+| 并发风险挖掘 | 扫描文档/计划中的并发安全声称（thread-safe、lock-free、race condition、中断安全等），标记需要专用验证 |
 | 输出 | 结构化发现：精确 file:line 证据、严重性分级、修正方向——绝不在核查中直接改代码 |
 
 模型永远先以转换表形式展示并**经用户确认后才运行**——模型提取错误是验证的头号失败模式。
@@ -63,6 +65,8 @@ git clone https://github.com/AmethystLuna/logicprobe.git ~/.claude/plugins/dev/l
 - 技能遵循 Agent Skills 开放标准，被 dsh 的 `skill-filesystem` provider 原样发现——零代码。
 - bundle 将 claim 验证门禁（1% Rule / Red Flags / 主动建议）注入每个 agent 会话的第一个模型步骤——是 Claude `SessionStart` hook 在 dsh 的原生对应物，并注册模型可见目录条目（`cordis_inspect`）、原生工具 `logicprobe_verify`（`ctx.tools`）以及策略感知上下文 `logicprobe:mode`（`ctx.systemPrompt`）。
 - `logicprobe_verify` 支持 `beforeModel` + `stateMapping` 的 BEFORE/AFTER 对比（D1-D4），可直接验证重构/迁移的行为保持、不变量连续性、回归增量和死锁/活性回归。
+- `logicprobe_datamodel_verify` 新增数据模型验证：DataModelV1、迁移覆盖、copy 一致性、DD1-DD4 before/after 数据回归。
+- `logicprobe_concurrency_scan` 扫描文档/计划中的并发风险声称（thread-safe、lock-free、race condition、mutex 等），标记需要专用并发验证。
 - 与 embedded-workbench bundle 的 Plan Verification Gate 配合，在 dsh 中闭环了 claim 验证链路。
 
 安装：参见 [`.dsh/INSTALL.md`](.dsh/INSTALL.md)（四种方式，从纯技能拷贝到 `dsh plugin add`）。
@@ -76,10 +80,13 @@ git clone https://github.com/AmethystLuna/logicprobe.git ~/.claude/plugins/dev/l
 - **设计文档 / 计划审查** — "Review this design document" → 声称枚举与代码库核查
 - **行为类问题** — "could this state machine deadlock"、"is this retry limit safe"、"check this timing for bugs" → 主动建议（不自动加载）作为可选验证
 - **重构计划** — 管线对比前后模型，标记计划未声明的行为变化
+- **数据模型/迁移审查** — "is this migration non-breaking"、"does this copy cover all required fields" → 使用 `logicprobe-datamodel` 技能
 
 技能在 Phase 0 依据计划特征自动分级（LIGHTWEIGHT / STANDARD / ESCALATED），并在计划文件追加 `## Plan Verification` 摘要块作为审计痕迹。
 
-Python 可选：可用时使用 `references/verification-harness.py` 自动执行检查；不可用（如离线开发机）时，`references/logic-verification-guide.md` 提供手动验证模式。
+Python 可选：状态机验证使用 `skills/logicprobe/references/verification-harness.py`，数据模型验证使用 `skills/logicprobe-datamodel/references/data-model-harness.py`；不可用（如离线开发机）时，对应 guide 提供手动验证模式。
+
+示例模型见 [`examples/`](examples/README.md)：订单状态机 before/after、电商数据模型、User 字段迁移。
 
 ## Codex CLI
 

package/lib/concurrency-tool.js

@@ -0,0 +1,34 @@
+import { defineTool } from '@deepseek-ai/dsh-tools';
+import { runConcurrencyScan } from './concurrency.js';
+export const LOGICPROBE_CONCURRENCY_SCAN_TOOL_NAME = 'logicprobe_concurrency_scan';
+/**
+ * Model-visible DSH tool that mines design documents/plans for concurrency-related
+ * claims and risk keywords. It does not prove concurrency safety; it flags terms
+ * such as "thread-safe", "lock-free", "race condition", "atomic", "mutex", etc.,
+ * so the model can either provide dedicated evidence or mark the claim unverified.
+ */
+export const logicProbeConcurrencyScanTool = defineTool({
+    name: LOGICPROBE_CONCURRENCY_SCAN_TOOL_NAME,
+    description: 'Scan a document or plan text for concurrency risk points. Use ONLY after confirming the target actually has concurrency requirements or behavior (threads, async tasks, interrupts, shared state, parallel execution). If the target is purely sequential, do not call this tool. Returns findings for keywords like thread-safe, lock-free, data race, race condition, atomic, synchronized, mutex, semaphore, shared variable, reentrant, interrupt-safe. Absolute claims (thread-safe, lock-free, no data race) are flagged as errors requiring dedicated verification.',
+    parameters: {
+        text: {
+            type: 'string',
+            required: true,
+            description: 'Document or plan text to scan for concurrency-related claims.',
+        },
+    },
+    output: {
+        schema: {
+            type: 'json',
+            description: 'Concurrency scan report with findings and summary.',
+        },
+        render(_args, value) {
+            return [{ type: 'text', text: JSON.stringify(value, null, 2) }];
+        },
+    },
+    timeoutMs: 10_000,
+    isConcurrencySafe: () => true,
+    async execute(args) {
+        return runConcurrencyScan(args.text);
+    },
+});

package/lib/concurrency.js

@@ -0,0 +1,76 @@
+const KEYWORD_RULES = [
+    { pattern: /\bthread\s*-?\s*safe\b/i, label: 'thread-safe', absolute: true },
+    { pattern: /\block\s*-?\s*free\b/i, label: 'lock-free', absolute: true },
+    { pattern: /\bwait\s*-?\s*free\b/i, label: 'wait-free', absolute: true },
+    { pattern: /\bno\s+data\s+race\b/i, label: 'no data race', absolute: true },
+    { pattern: /\brace\s*-?\s*free\b/i, label: 'race-free', absolute: true },
+    { pattern: /\bdata\s+race\b/i, label: 'data race', absolute: false },
+    { pattern: /\brace\s+condition\b/i, label: 'race condition', absolute: false },
+    { pattern: /\bthread\s*-?\s*safety\b/i, label: 'thread safety', absolute: false },
+    { pattern: /\bconcurrent\b/i, label: 'concurrent', absolute: false },
+    { pattern: /\bparallel\b/i, label: 'parallel', absolute: false },
+    { pattern: /\bmulti-?threaded\b/i, label: 'multi-threaded', absolute: false },
+    { pattern: /\bmultithreaded\b/i, label: 'multithreaded', absolute: false },
+    { pattern: /\batomic\b/i, label: 'atomic', absolute: false },
+    { pattern: /\bsynchronized\b/i, label: 'synchronized', absolute: false },
+    { pattern: /\bmutex\b/i, label: 'mutex', absolute: false },
+    { pattern: /\bsemaphore\b/i, label: 'semaphore', absolute: false },
+    { pattern: /\bspinlock\b/i, label: 'spinlock', absolute: false },
+    { pattern: /\bshared\s+variable\b/i, label: 'shared variable', absolute: false },
+    { pattern: /\bshared\s+memory\b/i, label: 'shared memory', absolute: false },
+    { pattern: /\bglobal\s+state\b/i, label: 'global state', absolute: false },
+    { pattern: /\breentrant\b/i, label: 'reentrant', absolute: false },
+    { pattern: /\binterrupt\s*-?\s*safe\b/i, label: 'interrupt-safe', absolute: true },
+    { pattern: /\bISR\s*-?\s*safe\b/i, label: 'ISR-safe', absolute: true },
+    { pattern: /\binterrupt\s+safety\b/i, label: 'interrupt safety', absolute: false },
+    { pattern: /\binterrupt\s+context\b/i, label: 'interrupt context', absolute: false },
+    { pattern: /\bISR\b/i, label: 'ISR', absolute: false },
+    { pattern: /\bIRQ\b/i, label: 'IRQ', absolute: false },
+    { pattern: /\bNMI\b/i, label: 'NMI', absolute: false },
+    { pattern: /\bcritical\s+section\b/i, label: 'critical section', absolute: false },
+    { pattern: /\bdisable_irq\b/i, label: 'disable_irq', absolute: false },
+    { pattern: /\benable_irq\b/i, label: 'enable_irq', absolute: false },
+    { pattern: /\bspin_lock_irqsave\b/i, label: 'spin_lock_irqsave', absolute: false },
+];
+export function runConcurrencyScan(text) {
+    const lines = text.split(/\r?\n/);
+    const findings = [];
+    const seen = new Set();
+    lines.forEach((line, index) => {
+        const lineNumber = index + 1;
+        const lower = line.toLowerCase();
+        for (const rule of KEYWORD_RULES) {
+            if (!rule.pattern.test(line))
+                continue;
+            const key = rule.label + ':' + lineNumber;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            const finding = {
+                code: rule.absolute ? 'CONCURRENCY_ABSOLUTE_CLAIM' : 'CONCURRENCY_KEYWORD',
+                severity: rule.absolute ? 'error' : 'warning',
+                message: rule.absolute
+                    ? 'Concurrency safety claim "' + rule.label + '" detected; this requires dedicated verification (TSan, model checker, or explicit proof).'
+                    : 'Concurrency-related term "' + rule.label + '" detected; review whether the plan addresses this risk.',
+                line: lineNumber,
+                snippet: line.trim().slice(0, 200),
+                keyword: rule.label,
+            };
+            findings.push(finding);
+        }
+    });
+    const errors = findings.filter((finding) => finding.severity === 'error').length;
+    const warnings = findings.filter((finding) => finding.severity === 'warning').length;
+    const absoluteClaims = findings.filter((finding) => finding.code === 'CONCURRENCY_ABSOLUTE_CLAIM').length;
+    return {
+        ok: true,
+        findings,
+        summary: {
+            lines: lines.length,
+            keywords: findings.length,
+            absoluteClaims,
+            warnings,
+            errors,
+        },
+    };
+}