dsh-logicprobe 0.5.5 → 0.6.0

package/README.en-US.md

@@ -14,7 +14,7 @@ Design documents are not truth — code is. A claim-verification skill that chec
 |-------|------|
 | Phase 1-2 | Enumerate every verifiable claim (API names, file paths, enum values, counts, mechanism feasibility) → verify each against the codebase with evidence |
 | Phase 2a | **8 structural checks** on extracted state-machine models: reachability, deadlock, liveness, determinism, event/guard completeness, invariant validity, monotonic variables |
-| Phase 2b | **11 adversarial probes**: unexpected events, race interleaving, order permutation, pair symmetry (lock/unlock), boundary blast, resource injection, minimal counter-example, idempotent replay, leads-to, sequence, atomicity |
+| Phase 2b | **14 adversarial probes**: unexpected events, race interleaving, order permutation, pair symmetry (lock/unlock), boundary blast, resource injection, minimal counter-example, idempotent replay, leads-to, sequence, atomicity, budget (worst-case path cost, A12), probability reachability (A13), deadline (maxTicks + tickEvents, A14) |
 | Refactoring | Before/after model comparison — behavioral preservation, invariant continuity, deadlock regression, complexity claims |
 | Data models | DataModelV1 verification — DS/DA/DD checks, migration coverage, copy consistency, before/after breaking-change regression |
 | Concurrency risk mining | Scans documents/plans for concurrency safety claims (thread-safe, lock-free, race condition, interrupt safety, etc.) and flags them for dedicated verification |
@@ -67,7 +67,10 @@ Native dsh support ships as a cordis plugin bundle at the repository root (the r
 - The skill is discovered as-is by dsh's `skill-filesystem` provider (Agent Skills open standard) — zero code.
 - The bundle injects the claim-verification gate (1% Rule / Red Flags / proactive suggestion) into the first model step of every agent session — the dsh-native counterpart of the Claude `SessionStart` hook. It also registers a model-visible catalog entry (`cordis_inspect`), a native `logicprobe_verify` tool (`ctx.tools`), and a policy-aware `logicprobe:mode` context (`ctx.systemPrompt`).
 - `logicprobe_datamodel_verify` adds data-model verification: DataModelV1, migration coverage, copy consistency, and DD1-DD4 before/after data regression.
-- `logicprobe_concurrency_scan` mines documents/plans for concurrency risk claims (thread-safe, lock-free, race condition, mutex, etc.) and flags them for dedicated verification.
+- `logicprobe_concurrency_scan` mines documents/plans for concurrency risk claims (thread-safe, lock-free, race condition, mutex, etc.), flags them for dedicated verification, and attaches tool-routing `suggestions` to absolute claims.
+- `logicprobe_verify` also supports transition `cost` (default 1) with `budget` invariants (A12 worst-case path-cost check incl. positive-cost-cycle detection), and transition `weight` (default 1) with `probability` invariants (A13 probability reachability).
+- State `onEntry`/`onExit` actions are treated by A4 Pair Symmetry as implicit acquire/release; `maxTicks` + `tickEvents` deadlines (A14); report `coverageNotes` routes timing/preemption/hybrid/probability vocabulary to dedicated tools (UPPAAL, TSan/CBMC/TLA+, SpaceEx, PRISM, ...).
+- `logicprobe_compose_verify`: composition verification of two or more state machines (rendezvous handshake semantics) reporting C1 composition deadlock / C2 rendezvous never fires.
 - Together with the embedded-workbench bundle's Plan Verification Gate, this closes the claim-verification loop in dsh.
 
 Install: see [`.dsh/INSTALL.md`](.dsh/INSTALL.md) (four options, from plain skill copy to `dsh plugin add`).
@@ -85,7 +88,7 @@ The plugin auto-injects a capability notification into the first model step. The
 
 The skill auto-classifies depth (LIGHTWEIGHT / STANDARD / ESCALATED) from plan features in Phase 0, and appends a `## Plan Verification` summary block as the audit trail.
 
-In DSH, prefer the native `logicprobe_verify` tool for state machines and `logicprobe_datamodel_verify` for data models (see the schema references under each skill). Python remains optional for non-DSH hosts: state-machine checks use `skills/logicprobe/references/verification-harness.py`; data-model checks use `skills/logicprobe-datamodel/references/data-model-harness.py`. When Python is unavailable, the corresponding guide provides a manual verification mode.
+In DSH, prefer the native `logicprobe_verify` tool for state machines and `logicprobe_datamodel_verify` for data models (see the schema references under each skill). Python remains optional for non-DSH hosts: when a LogicModelV1 JSON already exists, run the standalone engine `skills/logicprobe/references/logicprobe-engine.py` (`verify` runs S1-S8/A1-A14/D1-D4, `compose` runs C1/C2 composition, `export` emits UPPAAL/TLA+/PRISM/SPIN input — byte-identical to the dsh tools, cross-checked by tests/python/run.mjs); when the model only exists as extracted tables, fill in `skills/logicprobe/references/verification-harness.py`; data-model checks use `skills/logicprobe-datamodel/references/data-model-harness.py`. When Python is unavailable, the corresponding guide provides a manual verification mode.
 
 Sample models are available under [`examples/`](examples/README.md): order state-machine before/after, e-commerce data model, and User field migration.
 

package/README.md

@@ -12,7 +12,7 @@
 |------|------|
 | Phase 1-2 | 枚举每个可验证声称（API 名、文件路径、枚举值、数量、机制可行性）→ 逐条对照代码库给出证据 |
 | Phase 2a | 对提取的状态机模型执行 **8 项结构检查**：可达性、死锁、活性、确定性、事件/守卫完备性、不变量有效性、单调变量 |
-| Phase 2b | **11 种对抗探针**：意外事件、竞态交错、顺序置换、配对对称（lock/unlock）、边界轰炸、资源注入、最小反例、幂等重放、必达、顺序、原子性 |
+| Phase 2b | **14 种对抗探针**：意外事件、竞态交错、顺序置换、配对对称（lock/unlock）、边界轰炸、资源注入、最小反例、幂等重放、必达、顺序、原子性、预算（最坏路径代价 A12）、概率可达（P(击中)≥p，A13）、期限（maxTicks+tickEvents，A14） |
 | 重构模式 | 前后模型对比——行为保持、不变量连续性、死锁回归、复杂度声称 |
 | 数据模型模式 | DataModelV1 数据模型验证——DS/DA/DD 检查，迁移覆盖、copy 一致性、before/after 破坏性变更回归 |
 | 并发风险挖掘 | 扫描文档/计划中的并发安全声称（thread-safe、lock-free、race condition、中断安全等），标记需要专用验证 |
@@ -65,6 +65,9 @@ git clone https://github.com/AmethystLuna/logicprobe.git ~/.claude/plugins/dev/l
 - 技能遵循 Agent Skills 开放标准，被 dsh 的 `skill-filesystem` provider 原样发现——零代码。
 - bundle 将 claim 验证门禁（1% Rule / Red Flags / 主动建议）注入每个 agent 会话的第一个模型步骤——是 Claude `SessionStart` hook 在 dsh 的原生对应物，并注册模型可见目录条目（`cordis_inspect`）、原生工具 `logicprobe_verify`（`ctx.tools`）以及策略感知上下文 `logicprobe:mode`（`ctx.systemPrompt`）。
 - `logicprobe_verify` 支持 `beforeModel` + `stateMapping` 的 BEFORE/AFTER 对比（D1-D4），可直接验证重构/迁移的行为保持、不变量连续性、回归增量和死锁/活性回归。
+- `logicprobe_verify` 还支持：迁移/处理器代价 `cost`（缺省 1）与 `budget` 不变量（A12 最坏路径代价检查，含正成本环检测）、迁移权重 `weight` 与 `probability` 不变量（A13 概率可达）。
+- 状态 `onEntry`/`onExit` 动作（A4 自动纳入配对检查）；`maxTicks`+`tickEvents` 期限（A14）；报告 `coverageNotes`（时序/抢占/混合/概率词汇 → UPPAAL/TSan/CBMC/TLA+/SpaceEx/PRISM 等外部工具路由）。
+- `logicprobe_compose_verify`：两台及以上状态机组合验证（握手 rendezvous 语义），报 C1 组合死锁 / C2 握手永不触发。
 - `logicprobe_datamodel_verify` 新增数据模型验证：DataModelV1、迁移覆盖、copy 一致性、DD1-DD4 before/after 数据回归。
 - `logicprobe_concurrency_scan` 扫描文档/计划中的并发风险声称（thread-safe、lock-free、race condition、mutex 等），标记需要专用并发验证。
 - 与 embedded-workbench bundle 的 Plan Verification Gate 配合，在 dsh 中闭环了 claim 验证链路。
@@ -84,7 +87,7 @@ git clone https://github.com/AmethystLuna/logicprobe.git ~/.claude/plugins/dev/l
 
 技能在 Phase 0 依据计划特征自动分级（LIGHTWEIGHT / STANDARD / ESCALATED），并在计划文件追加 `## Plan Verification` 摘要块作为审计痕迹。
 
-Python 可选：状态机验证使用 `skills/logicprobe/references/verification-harness.py`，数据模型验证使用 `skills/logicprobe-datamodel/references/data-model-harness.py`；不可用（如离线开发机）时，对应 guide 提供手动验证模式。
+Python 可选：已有 LogicModelV1 JSON 时可直接运行独立引擎 `skills/logicprobe/references/logicprobe-engine.py`（`verify` 跑 S1-S8/A1-A14/D1-D4，`compose` 跑 C1/C2 组合，`export` 生成 UPPAAL/TLA+/PRISM/SPIN 输入——与 dsh 工具逐字节一致，见 tests/python/run.mjs）；模型仅为抽取出的状态表时，填充模板 `skills/logicprobe/references/verification-harness.py`；数据模型验证使用 `skills/logicprobe-datamodel/references/data-model-harness.py`；不可用（如离线开发机）时，对应 guide 提供手动验证模式。
 
 示例模型见 [`examples/`](examples/README.md)：订单状态机 before/after、电商数据模型、User 字段迁移。
 

package/lib/compose-tool.js

@@ -0,0 +1,43 @@
+import { defineTool } from '@deepseek-ai/dsh-tools';
+import { runCompositionVerification } from './engine.js';
+export const LOGICPROBE_COMPOSE_TOOL_NAME = 'logicprobe_compose_verify';
+/**
+ * DSH tool wrapping multi-machine composition verification:
+ * product-space reachability with rendezvous handshakes (C1 deadlock, C2 sync).
+ */
+export const logicProbeComposeTool = defineTool({
+    name: LOGICPROBE_COMPOSE_TOOL_NAME,
+    description: 'Run composition verification over two or more LogicModelV1 state machines (logicprobe). Pass machines as an array of models and optionally rendezvous: a list of handshake events that must fire simultaneously across all machines declaring them (at least two participants, all jointly enabled, guards held; a terminal machine stops participating). Non-rendezvous events advance exactly one firing machine. Returns C1 composition-deadlock findings (a reachable state where no machine can advance while at least one is not terminal) and C2 rendezvous-never-fires findings. Each machine validates against the same schema as logicprobe_verify.',
+    parameters: {
+        machines: {
+            type: 'json',
+            required: true,
+            description: 'Array of LogicModelV1 state-machine models to compose (two or more).',
+        },
+        rendezvous: {
+            type: 'json',
+            description: 'Optional array of handshake event names shared by the machines.',
+        },
+        maxStates: {
+            type: 'integer',
+            description: 'Maximum composite states to explore. Default 10000.',
+        },
+    },
+    output: {
+        schema: {
+            type: 'json',
+            description: 'Composition verification report with C1/C2 findings.',
+        },
+        render(_args, value) {
+            return [{ type: 'text', text: JSON.stringify(value, null, 2) }];
+        },
+    },
+    timeoutMs: 10_000,
+    isConcurrencySafe: () => true,
+    async execute(args) {
+        return runCompositionVerification(args.machines, {
+            rendezvous: args.rendezvous,
+            maxStates: args.maxStates,
+        });
+    },
+});

package/lib/concurrency.js

@@ -36,6 +36,15 @@ export function runConcurrencyScan(text) {
     const lines = text.split(/\r?\n/);
     const findings = [];
     const seen = new Set();
+    const suggestionsFor = (label) => {
+        if (/thread-safe|lock-free|wait-free|race-free|no data race|data race|race condition|thread safety/.test(label)) {
+            return ['TSan / Helgrind (runtime data-race detection)', 'CBMC / static analysis (proof-oriented)', 'TLA+ (exhaustive interleaving model)'];
+        }
+        if (/interrupt-safe|ISR-safe|interrupt context|critical section|disable_irq|enable_irq/.test(label)) {
+            return ['RTOS-aware analysis (interrupt latency, priority inversion)', 'CBMC (state-machine + ISR interleaving proof)', 'TLA+ (preemption/exclusion model)'];
+        }
+        return ['Dedicated concurrency verification (TSan, CBMC, TLA+, or RTOS-specific analysis)'];
+    };
     lines.forEach((line, index) => {
         const lineNumber = index + 1;
         const lower = line.toLowerCase();
@@ -50,11 +59,12 @@ export function runConcurrencyScan(text) {
                 code: rule.absolute ? 'CONCURRENCY_ABSOLUTE_CLAIM' : 'CONCURRENCY_KEYWORD',
                 severity: rule.absolute ? 'error' : 'warning',
                 message: rule.absolute
-                    ? 'Concurrency safety claim "' + rule.label + '" detected; this requires dedicated verification (TSan, model checker, or explicit proof).'
+                    ? 'Concurrency safety claim "' + rule.label + '" detected; logicprobe does not verify concurrency — this needs dedicated verification.'
                     : 'Concurrency-related term "' + rule.label + '" detected; review whether the plan addresses this risk.',
                 line: lineNumber,
                 snippet: line.trim().slice(0, 200),
                 keyword: rule.label,
+                ...(rule.absolute ? { suggestions: suggestionsFor(rule.label) } : {}),
             };
             findings.push(finding);
         }