dsh-logicprobe 0.8.0 → 0.9.0

package/src/engine.ts

@@ -154,7 +154,7 @@ export type InvariantSpec =
       when?: InvariantWhen
     }
   | { id: string; description: string; kind: 'event-before-state'; event: string; state: string }
-  | { id: string; description: string; kind: 'leads-to'; from: string; to: string }
+  | { id: string; description: string; kind: 'leads-to'; from: string; to: string | string[] }
   | { id: string; description: string; kind: 'sequence'; events: string[] }
   | { id: string; description: string; kind: 'atomicity'; events: string[]; commit: string; rollback?: string }
   | { id: string; description: string; kind: 'budget'; budget: number }
@@ -469,8 +469,27 @@ export function validateModel(input: unknown): { ok: true; model: LogicModelV1 }
       } else if (invariant.kind === 'leads-to') {
         if (typeof invariant.from !== 'string' || invariant.from.length === 0) bad(path + '.from', 'must be a non-empty string')
         else if (!invariantStateIds.has(invariant.from)) bad(path + '.from', 'references unknown state ' + invariant.from)
-        if (typeof invariant.to !== 'string' || invariant.to.length === 0) bad(path + '.to', 'must be a non-empty string')
-        else if (!invariantStateIds.has(invariant.to)) bad(path + '.to', 'references unknown state ' + invariant.to)
+        // `to` is one state id or a target set. A set with a duplicate member is a
+        // model-authoring slip that would otherwise give one meaning two hashes, so it
+        // is rejected rather than silently deduplicated.
+        if (typeof invariant.to === 'string') {
+          if (invariant.to.length === 0) bad(path + '.to', 'must be a non-empty string')
+          else if (!invariantStateIds.has(invariant.to)) bad(path + '.to', 'references unknown state ' + invariant.to)
+        } else if (Array.isArray(invariant.to)) {
+          if (invariant.to.length === 0) bad(path + '.to', 'must be a non-empty array of state ids')
+          else {
+            const targets = new Set<string>()
+            invariant.to.forEach((target, targetIndex) => {
+              const at = path + '.to[' + targetIndex + ']'
+              if (typeof target !== 'string' || target.length === 0) bad(at, 'must be a non-empty string')
+              else if (!invariantStateIds.has(target)) bad(at, 'references unknown state ' + target)
+              else if (targets.has(target)) bad(at, 'duplicates state ' + target + ' in the target set')
+              else targets.add(target)
+            })
+          }
+        } else {
+          bad(path + '.to', 'must be a state id or a non-empty array of state ids')
+        }
       } else if (invariant.kind === 'sequence') {
         if (!Array.isArray(invariant.events) || invariant.events.length === 0) bad(path + '.events', 'must be a non-empty array')
         else invariant.events.forEach((event, eventIndex) => {
@@ -1108,6 +1127,96 @@ function shortestViolationForInvariant(model: LogicModelV1, options: NormalizedO
   return undefined
 }
 
+/**
+ * Whether an invariant asserts a property of whole runs rather than of a single
+ * runtime state. These kinds cannot be decided by a state predicate, so they are not
+ * part of `shortestViolationForInvariant` (and therefore not of S7), which owns the
+ * states; A9-A13 own the verdicts, and `pathPropertyViolation` below makes the same
+ * verdicts available to A7 and D2.
+ */
+function isPathPropertyInvariant(invariant: InvariantSpec): boolean {
+  return invariant.kind === 'leads-to'
+    || invariant.kind === 'sequence'
+    || invariant.kind === 'atomicity'
+    || invariant.kind === 'budget'
+    || invariant.kind === 'probability'
+}
+
+/** Whether a probability invariant's bound fails for the computed hit probability. */
+function probabilityViolated(invariant: Extract<InvariantSpec, { kind: 'probability' }>, probability: number): boolean {
+  const eps = 1e-9
+  if (invariant.op === '>=') return probability < invariant.p - eps
+  if (invariant.op === '>') return probability <= invariant.p + eps
+  if (invariant.op === '<=') return probability > invariant.p + eps
+  return probability >= invariant.p - eps
+}
+
+/** Every runtime state reachable from init, capped like the other searches. */
+function reachableRuntimeStates(model: LogicModelV1, options: NormalizedOptions): RuntimeState[] {
+  const init = initialState(model)
+  const visited = new Set<string>([runtimeKey(init)])
+  const reached: RuntimeState[] = [init]
+  const queue: RuntimeState[] = [init]
+  let steps = 0
+  while (queue.length > 0) {
+    if (++steps > options.maxStates) break
+    const current = queue.shift()!
+    for (const event of allEvents(model)) {
+      for (const next of stepRuntime(model, current, event)) {
+        const key = runtimeKey(next)
+        if (visited.has(key)) continue
+        visited.add(key)
+        reached.push(next)
+        queue.push(next)
+      }
+    }
+  }
+  return reached
+}
+
+/**
+ * Violation of a path-property invariant, or undefined when it holds. Each kind
+ * delegates to the search its dedicated probe uses (A9 leads-to, A10 sequence, A11
+ * atomicity, A12 budget, A13 probability), so a verdict reported here can never
+ * disagree with the probe that owns the kind.
+ */
+function pathPropertyViolation(model: LogicModelV1, options: NormalizedOptions, invariant: InvariantSpec): InvariantViolation | undefined {
+  if (invariant.kind === 'leads-to') {
+    const targets = new Set(leadsToTargets(invariant))
+    const label = leadsToTargetLabel(invariant)
+    for (const runtime of reachableRuntimeStates(model, options)) {
+      if (runtime.state !== invariant.from) continue
+      const bad = findLeadsToBadPath(model, runtime, targets, label)
+      if (bad !== undefined) return { invariant, path: bad.path, reason: bad.reason }
+    }
+    return undefined
+  }
+  if (invariant.kind === 'sequence') return findSequenceViolation(model, options, invariant)
+  if (invariant.kind === 'atomicity') return findAtomicityViolation(model, options, invariant)
+  if (invariant.kind === 'budget') {
+    const violation = findBudgetViolation(model, options, invariant)
+    if (violation === undefined) return undefined
+    return {
+      invariant,
+      path: violation.path,
+      reason: violation.unbounded
+        ? 'a reachable cycle keeps accumulating cost, so no finite budget holds'
+        : 'a run accumulates cost ' + String(violation.cost) + ', above the declared budget ' + String(invariant.budget),
+    }
+  }
+  if (invariant.kind === 'probability') {
+    const { probability, converged } = computeHitProbability(model, options, invariant.target)
+    if (!probabilityViolated(invariant, probability)) return undefined
+    return {
+      invariant,
+      path: [],
+      reason: 'P(hit ' + invariant.target + ') = ' + probability.toFixed(6) + ' does not satisfy ' + invariant.op + ' ' + String(invariant.p)
+        + (converged ? '' : ' (value iteration did not converge)'),
+    }
+  }
+  return undefined
+}
+
 function shortestEventBeforeStateViolation(model: LogicModelV1, options: NormalizedOptions, invariant: Extract<InvariantSpec, { kind: 'event-before-state' }>): InvariantViolation | undefined {
   const init = initialState(model)
   const seenInitially = false
@@ -1138,10 +1247,12 @@ function shortestEventBeforeStateViolation(model: LogicModelV1, options: Normali
   return undefined
 }
 
-function runInvariants(model: LogicModelV1, options: NormalizedOptions): InvariantViolation[] {
+function runInvariants(model: LogicModelV1, options: NormalizedOptions, includePathProperties = false): InvariantViolation[] {
   const violations: InvariantViolation[] = []
   for (const invariant of model.invariants ?? []) {
-    const violation = shortestViolationForInvariant(model, options, invariant)
+    const violation = includePathProperties && isPathPropertyInvariant(invariant)
+      ? pathPropertyViolation(model, options, invariant)
+      : shortestViolationForInvariant(model, options, invariant)
     if (violation !== undefined) violations.push(violation)
   }
   return violations
@@ -1507,14 +1618,27 @@ function A6_resourceInjection(model: LogicModelV1): CheckResult {
 }
 
 function A7_shortestViolations(model: LogicModelV1, options: NormalizedOptions): CheckResult {
-  const violations = runInvariants(model, options)
-  const findings: Finding[] = violations.map((violation) => ({
-    code: 'A7_SHORTEST_COUNTEREXAMPLE',
-    severity: 'warning',
-    message: 'Invariant "' + violation.invariant.id + '" shortest violating path length: ' + violation.path.length + (violation.path.length === 0 ? ' (initial state)' : ''),
-    path: violation.path,
-    evidence: { invariant: violation.invariant.id },
-  }))
+  // Path-property invariants are included: "for any invariant that fails" is this
+  // check's contract, and a check that silently skips five of the eight kinds cannot
+  // honour it. The searches for the state kinds, for sequence, atomicity and budget
+  // are breadth-first, so their first witness is the shortest one; the leads-to walk
+  // and the probability bound have no such guarantee, and their message says what it
+  // found instead of claiming minimality.
+  const violations = runInvariants(model, options, true)
+  const findings: Finding[] = violations.map((violation) => {
+    const pathLength = violation.path.length
+    const message = isPathPropertyInvariant(violation.invariant)
+      ? 'Invariant "' + violation.invariant.id + '" violated: ' + violation.reason
+        + (pathLength === 0 ? '' : ' (witness path length: ' + pathLength + ')')
+      : 'Invariant "' + violation.invariant.id + '" shortest violating path length: ' + pathLength + (pathLength === 0 ? ' (initial state)' : '')
+    return {
+      code: 'A7_SHORTEST_COUNTEREXAMPLE',
+      severity: 'warning' as const,
+      message,
+      path: violation.path,
+      evidence: { invariant: violation.invariant.id },
+    }
+  })
   return checkResult('A7', 'Minimal Counter-Example', findings, violations.length === 0 ? 'All invariants hold for all reachable paths' : 'Violated invariants: ' + findings.length)
 }
 
@@ -1595,6 +1719,25 @@ function mapInvariantForComparison(invariant: InvariantSpec, mapping: Record<str
     }
     return mapped
   }
+  if (invariant.kind === 'leads-to') {
+    // A target set maps member by member; a rename that drops a state is reported by
+    // D2's own mapped-state check rather than silently changing the property.
+    return {
+      ...invariant,
+      id: invariant.id + ':before',
+      description: invariant.description + ' (from BEFORE)',
+      from: mapStateId(mapping, invariant.from),
+      to: typeof invariant.to === 'string' ? mapStateId(mapping, invariant.to) : invariant.to.map((state) => mapStateId(mapping, state)),
+    }
+  }
+  if (invariant.kind === 'probability') {
+    return {
+      ...invariant,
+      id: invariant.id + ':before',
+      description: invariant.description + ' (from BEFORE)',
+      target: mapStateId(mapping, invariant.target),
+    }
+  }
   return { ...invariant, id: invariant.id + ':before', description: invariant.description + ' (from BEFORE)' }
 }
 
@@ -1634,8 +1777,36 @@ function D2_invariantContinuity(before: LogicModelV1, after: LogicModelV1, optio
         })
         continue
       }
+    } else if (mapped.kind === 'leads-to') {
+      // The state references of a path-property invariant must follow stateMapping too,
+      // otherwise a pure rename searches for a state AFTER does not declare.
+      for (const state of [mapped.from, ...leadsToTargets(mapped)]) {
+        if (!afterStates.has(state)) {
+          findings.push({
+            code: 'D2_MAPPED_STATE_MISSING',
+            severity: 'warning',
+            message: 'BEFORE invariant "' + invariant.id + '" maps to state ' + state + ', which is not declared in AFTER.',
+            evidence: { invariant: invariant.id, state },
+          })
+        }
+      }
+    } else if (mapped.kind === 'probability') {
+      if (!afterStates.has(mapped.target)) {
+        findings.push({
+          code: 'D2_MAPPED_STATE_MISSING',
+          severity: 'warning',
+          message: 'BEFORE invariant "' + invariant.id + '" maps to state ' + mapped.target + ', which is not declared in AFTER.',
+          evidence: { invariant: invariant.id, state: mapped.target },
+        })
+      }
     }
-    const violation = shortestViolationForInvariant(after, options, mapped)
+    // Every invariant the engine can decide is re-decided against AFTER. Path-property
+    // kinds go through the same searches their dedicated probes use, so D2 can no
+    // longer report "all BEFORE invariants continue to hold" while A9-A13 fail on the
+    // very same model.
+    const violation = isPathPropertyInvariant(mapped)
+      ? pathPropertyViolation(after, options, mapped)
+      : shortestViolationForInvariant(after, options, mapped)
     if (violation !== undefined) {
       findings.push({
         code: 'D2_INVARIANT_REGRESSION',
@@ -1824,35 +1995,93 @@ function S8_monotonicVariables(model: LogicModelV1): CheckResult {
   return checkResult('S8', 'Monotonic Variables', findings, findings.length === 0 ? 'Monotonic variables are respected' : 'Monotonic findings: ' + findings.length)
 }
 
-function findLeadsToBadPath(model: LogicModelV1, start: RuntimeState, target: string): { path: PathStep[]; reason: string } | undefined {
-  if (start.state === target) return undefined
-  const visited = new Set<string>()
-  const queue: Array<{ runtime: RuntimeState; path: PathStep[] }> = [{ runtime: start, path: [] }]
-  while (queue.length > 0) {
-    const entry = queue.shift()!
-    const key = runtimeKey(entry.runtime)
-    if (entry.runtime.state === target) continue
-    if (visited.has(key)) return { path: entry.path, reason: 'Cycle avoids target ' + target }
-    visited.add(key)
-    const nexts: Array<{ next: RuntimeState; event: string }> = []
-    for (const event of allEvents(model)) {
-      for (const next of stepRuntime(model, entry.runtime, event)) nexts.push({ next, event })
+/**
+ * Target states of a `leads-to` invariant. The schema accepts one state id or a
+ * non-empty array of them, so "reach any of these" needs no separate invariant kind.
+ */
+function leadsToTargets(invariant: Extract<InvariantSpec, { kind: 'leads-to' }>): string[] {
+  return typeof invariant.to === 'string' ? [invariant.to] : invariant.to
+}
+
+/** Target list as findings print it. A single target renders as its bare id, so existing messages stay byte-identical. */
+function leadsToTargetLabel(invariant: Extract<InvariantSpec, { kind: 'leads-to' }>): string {
+  return leadsToTargets(invariant).join(', ')
+}
+
+/**
+ * Find a run from `start` that reaches none of `targets`, or return undefined when
+ * every run reaches at least one of them. The property is universal (see the A9 row
+ * in `SKILL.md`): one branch that loops forever, or that stops before any target,
+ * refutes it.
+ *
+ * The search is a depth-first walk of the run graph with three colours, and runs at a
+ * target are success leaves that are never expanded:
+ *
+ * - a node reached while it is on the current walk (GRAY) closes a cycle that avoids
+ *   every target, so some run never reaches one;
+ * - a node with no outgoing step at all stops the machine where it stands, which is
+ *   the same violation for a different reason;
+ * - a node whose walk completed without a violation is BLACK, and reaching it again
+ *   from another branch is a shared sub-graph, not a cycle.
+ *
+ * That last point is why the colour map cannot be a plain visited set: a diamond
+ * (two branches rejoining) is acyclic and must pass, while a genuine cycle must not.
+ * A run is identified by its state plus its variable values, so the same state id
+ * with different values is a different node.
+ */
+function findLeadsToBadPath(model: LogicModelV1, start: RuntimeState, targets: Set<string>, label: string): { path: PathStep[]; reason: string } | undefined {
+  if (targets.has(start.state)) return undefined
+  const GRAY = 1
+  const BLACK = 2
+  interface LeadFrame {
+    runtime: RuntimeState
+    path: PathStep[]
+    /** Outgoing steps, filled on first expansion; `undefined` means "not expanded yet". */
+    nexts: Array<{ next: RuntimeState; event: string }> | undefined
+    index: number
+  }
+  const color = new Map<string, number>()
+  const stack: LeadFrame[] = [{ runtime: start, path: [], nexts: undefined, index: 0 }]
+  color.set(runtimeKey(start), GRAY)
+  while (stack.length > 0) {
+    const frame = stack[stack.length - 1]
+    if (frame.nexts === undefined) {
+      const nexts: Array<{ next: RuntimeState; event: string }> = []
+      for (const event of allEvents(model)) {
+        for (const next of stepRuntime(model, frame.runtime, event)) nexts.push({ next, event })
+      }
+      frame.nexts = nexts
+      if (nexts.length === 0) return { path: frame.path, reason: 'Dead end before target ' + label }
     }
-    if (nexts.length === 0) return { path: entry.path, reason: 'Dead end before target ' + target }
-    for (const { next, event } of nexts) {
-      queue.push({ runtime: next, path: [...entry.path, { from: entry.runtime.state, event, to: next.state }] })
+    if (frame.index >= frame.nexts.length) {
+      color.set(runtimeKey(frame.runtime), BLACK)
+      stack.pop()
+      continue
     }
+    const { next, event } = frame.nexts[frame.index]
+    frame.index += 1
+    const step: PathStep = { from: frame.runtime.state, event, to: next.state }
+    if (targets.has(next.state)) continue
+    const key = runtimeKey(next)
+    const seen = color.get(key)
+    if (seen === GRAY) return { path: [...frame.path, step], reason: 'Cycle avoids target ' + label }
+    if (seen === BLACK) continue
+    color.set(key, GRAY)
+    stack.push({ runtime: next, path: [...frame.path, step], nexts: undefined, index: 0 })
   }
-  return { path: [], reason: 'No path reaches target ' + target }
+  // Every branch either reached a target or rejoined a branch that did.
+  return undefined
 }
 
 function A9_leadsTo(model: LogicModelV1, exploration: Exploration): CheckResult {
   const findings: Finding[] = []
   for (const invariant of model.invariants ?? []) {
     if (invariant.kind !== 'leads-to') continue
+    const targets = new Set(leadsToTargets(invariant))
+    const label = leadsToTargetLabel(invariant)
     for (const runtime of exploration.reachable) {
       if (runtime.state !== invariant.from) continue
-      const bad = findLeadsToBadPath(model, runtime, invariant.to)
+      const bad = findLeadsToBadPath(model, runtime, targets, label)
       if (bad !== undefined) {
         findings.push({
           code: 'A9_LEADS_TO_VIOLATION',
@@ -2276,16 +2505,10 @@ function computeHitProbability(model: LogicModelV1, options: NormalizedOptions,
 
 function A13_probability(model: LogicModelV1, options: NormalizedOptions): CheckResult {
   const findings: Finding[] = []
-  const eps = 1e-9
   for (const invariant of model.invariants ?? []) {
     if (invariant.kind !== 'probability') continue
     const { probability, converged } = computeHitProbability(model, options, invariant.target)
-    let violated = false
-    if (invariant.op === '>=') violated = probability < invariant.p - eps
-    else if (invariant.op === '>') violated = probability <= invariant.p + eps
-    else if (invariant.op === '<=') violated = probability > invariant.p + eps
-    else violated = probability >= invariant.p - eps
-    if (violated) {
+    if (probabilityViolated(invariant, probability)) {
       findings.push({
         code: 'A13_PROBABILITY_VIOLATION',
         severity: 'error',

package/src/index.ts

@@ -75,7 +75,7 @@ export type InteractionMode = 'ask' | 'auto' | 'follow-approval'
 const DEFAULT_GATE_CONTENT = `<EXTREMELY_IMPORTANT>
 Plugin logicprobe is active. Documents are not truth — code is. Verify every verifiable claim before accepting or acting on any design.
 
-**1% Rule**: If there is even a 1% chance the logicprobe skill applies — reviewing design documents, architecture specs, technical proposals, or refactoring plans that make claims about API names, file locations, enum values, mechanism feasibility, state machines, protocol logic, data models, schema migrations, data invariants, or behavioral guarantees ("always"/"never"/"guaranteed") — load it with the skill tool before responding. The cost of loading is trivial compared to the cost of a false claim.
+**1% Rule**: If there is even a 1% chance the logicprobe skill applies — reviewing design documents, architecture specs, technical proposals, or refactoring plans that make claims about API names, file locations, enum values, mechanism feasibility, state machines, protocol logic, data models, schema migrations, data invariants, behavioral guarantees ("always"/"never"/"guaranteed"), worst-case path cost or declared budgets, probabilistic reachability ("≥90% of runs reach SAFE"), deadlines ("must leave within 2 ticks"), cross-machine handshakes, or concurrency guarantees ("thread-safe"/"lock-free"/"ISR-safe") — load it with the skill tool before responding. The cost of loading is trivial compared to the cost of a false claim.
 
 **Red Flags** — if you think any of these, STOP. You are rationalizing:
 
@@ -86,7 +86,16 @@ Plugin logicprobe is active. Documents are not truth — code is. Verify every v
 | "I'll verify while implementing" | Verification happens before implementation, not during. |
 | "I can check this with reasoning alone" | Behavioral claims are verified with code/models, not intuition. One counter-example refutes a universal claim. |
 
-**Native verification path**: In dsh, prefer the \`logicprobe_verify\` tool for state-machine checks and \`logicprobe_datamodel_verify\` for data-model/schema migration checks. Both support before/after regression and common domain constraints (idempotency, monotonic, sequence, leads-to, atomicity). To model a code flow as UML, or to audit such a modelling, use \`logicprobe_uml\` (render | parse | review). Python harnesses remain the fallback for non-dsh hosts.
+**Native verification path** (dsh) — six model-invocable tools:
+
+- \`logicprobe_verify\` — state machines: S1-S8 structural + A1-A14 adversarial, including A12 worst-case path cost against a declared \`budget\`, A13 probabilistic reachability over a DTMC, and A14 discrete-tick deadlines. Pass \`beforeModel\` + \`stateMapping\` to add the D1-D4 before/after regression.
+- \`logicprobe_datamodel_verify\` — data models and schema migrations: DS/DA checks, migration coverage, copy consistency, rollback symmetry, DD1-DD4 data regression.
+- \`logicprobe_compose_verify\` — two or more machines checked together (rendezvous handshake semantics): C1 composition deadlock, C2 rendezvous that never fires.
+- \`logicprobe_concurrency_scan\` — mine concurrency claims (thread-safe, lock-free, race condition, mutex, ISR-safe) and route them to dedicated verification; logicprobe does not prove concurrency safety.
+- \`logicprobe_export\` — emit external-checker input from a verified model: UPPAAL, TLA+, PRISM, SPIN.
+- \`logicprobe_uml\` — model a code flow as UML (render), read a diagram back into a model (parse), or audit the modelling (review: UML001-UML019 structural defects, documentation gaps, diagram-versus-model round-trip fidelity).
+
+Python harnesses in the skill references remain the fallback for non-dsh hosts.
 
 **Proactive suggestion**: When a user asks code-level behavioral questions — "could this state machine deadlock", "is this retry limit safe", "check this timing sequence for bugs", "is this migration non-breaking", "does this copy cover all required fields" — suggest logicprobe as an optional verification pass (do not auto-escalate).
 </EXTREMELY_IMPORTANT>`
@@ -211,7 +220,7 @@ function resolveInteraction(config: Config, session: Session): 'ask' | 'auto' {
 function modeContextText(config: Config, session: Session): string {
   const interaction = resolveInteraction(config, session)
   const lines = [
-    'logicprobe: use `logicprobe_verify` for state machines and `logicprobe_datamodel_verify` for data models; both cover before/after regression and common domain constraints.',
+    'logicprobe: native tools — `logicprobe_verify` (state machines: S1-S8 + A1-A14, incl. A12 budget/worst-case path cost, A13 probabilistic reachability, A14 deadlines; `beforeModel` adds D1-D4 regression), `logicprobe_datamodel_verify` (data models and schema migrations: DS/DA, migration coverage, copy consistency, rollback symmetry, DD1-DD4), `logicprobe_compose_verify` (two or more machines: C1 composition deadlock, C2 rendezvous never fires), `logicprobe_concurrency_scan` (mine concurrency claims — it does not prove concurrency safety), `logicprobe_export` (UPPAAL, TLA+, PRISM, SPIN input from a verified model).',
     'logicprobe: use `logicprobe_uml` to model a code flow as UML (render), to read a UML diagram back into a model (parse), or to audit the modelling (review: structural defects, documentation gaps, diagram-vs-model round-trip fidelity).',
     interaction === 'auto'
       ? 'logicprobe interaction=auto: do NOT call ask_user_question for model confirmation; run round-trip validation of the extracted transition table and mark the result UNCONFIRMED.'

package/src/tool.ts

@@ -1,4 +1,4 @@
-import { defineTool } from '@deepseek-ai/dsh-tools'
+import { defineTool } from '@deepseek-ai/dsh-tools'
 import type { JsonValue } from './json-value.js'
 import { runVerification } from './engine.js'
 
@@ -16,7 +16,7 @@ export const LOGICPROBE_VERIFY_TOOL_NAME = 'logicprobe_verify'
 export const logicProbeVerifyTool = defineTool({
   name: LOGICPROBE_VERIFY_TOOL_NAME,
   description:
-    'Run executable state-machine verification (logicprobe). Takes a LogicModelV1 object with schemaVersion=1, init, states ({id, terminal?}), transitions ({from, event, to, guard?, updates?, cost?}), variables?, invariants?, concurrentPairs?, boundaryChecks?, resourcePairs?, idempotentEvents?, narrative?. Guards are structured ({variable, op, value} | {all} | {any} | {not}); invariants support never-states, var-in-range ({variable, min?, max?, when?} — when scopes the range to a state ({state}) or a guard node, is evaluated on the post-state of every transition, leaves the initial state checked unconditionally, and is rejected on any other invariant kind), event-before-state, leads-to, sequence, atomicity, budget (transition cost defaults to 1; A12 checks every reachable path stays within the declared budget and reports the shortest over-budget counterexample), and probability (transition weight, default 1, makes the model a DTMC; A13 checks P(hit target) against the bound by value iteration). The schema is closed: an undeclared key on any model part (model, state, transition, update, variable, invariant, boundaryCheck, resourcePair, narrative, scenario) is a validation error, never ignored. Variables support monotonic inc/dec. The optional narrative block carries natural-language descriptions of states (narrative.states), events (narrative.events), and (state, event) scenarios (narrative.scenarios: [{from, event, scenario}]); when present it must fully cover the model and is echoed in the report. Returns a report with S1-S8 structural checks and A1-A13 adversarial/probability probes including shortest counterexample paths. If beforeModel is provided, also runs D1-D4 before/after regression checks. See skills/logicprobe/references/dsh-model-schema.md.',
+    'Run executable state-machine verification (logicprobe). Takes a LogicModelV1 object with schemaVersion=1, init, states ({id, terminal?}), transitions ({from, event, to, guard?, updates?, cost?}), variables?, invariants?, concurrentPairs?, boundaryChecks?, resourcePairs?, idempotentEvents?, narrative?. Guards are structured ({variable, op, value} | {all} | {any} | {not}); invariants support never-states, var-in-range ({variable, min?, max?, when?} — when scopes the range to a state ({state}) or a guard node, is evaluated on the post-state of every transition, leaves the initial state checked unconditionally, and is rejected on any other invariant kind), event-before-state, leads-to (`to` is one state id or a non-empty array of them: every path must reach at least one member), sequence, atomicity, budget (transition cost defaults to 1; A12 checks every reachable path stays within the declared budget and reports the shortest over-budget counterexample), and probability (transition weight, default 1, makes the model a DTMC; A13 checks P(hit target) against the bound by value iteration), and deadline (declaring maxTicks on a state is how many tick steps it may stay resident and the top-level tickEvents list names those steps; A14 reports the over-residency path, and A14_NO_TICK_EVENTS when maxTicks is declared without tickEvents). The schema is closed: an undeclared key on any model part (model, state, transition, update, variable, invariant, boundaryCheck, resourcePair, narrative, scenario) is a validation error, never ignored. Variables support monotonic inc/dec. The optional narrative block carries natural-language descriptions of states (narrative.states), events (narrative.events), and (state, event) scenarios (narrative.scenarios: [{from, event, scenario}]); when present it must fully cover the model and is echoed in the report. Returns a report with S1-S8 structural checks and A1-A14 adversarial, cost, probability and deadline probes, including counterexample paths (shortest where the search is breadth-first). If beforeModel is provided, also runs D1-D4 before/after regression checks. See skills/logicprobe/references/dsh-model-schema.md.',
   parameters: {
     model: {
       type: 'json',