dsh-logicprobe 0.8.1 → 0.9.0

package/skills/logicprobe/references/logicprobe-engine.py

@@ -392,11 +392,32 @@ def validate_model(input_value):
                         bad(p + '.from', 'must be a non-empty string')
                     elif lfrom not in invariant_state_ids:
                         bad(p + '.from', 'references unknown state ' + lfrom)
+                    # `to` is one state id or a target set. A set with a duplicate
+                    # member is a model-authoring slip that would otherwise give one
+                    # meaning two hashes, so it is rejected rather than deduplicated.
                     lto = entry.get('to')
-                    if not isinstance(lto, str) or len(lto) == 0:
-                        bad(p + '.to', 'must be a non-empty string')
-                    elif lto not in invariant_state_ids:
-                        bad(p + '.to', 'references unknown state ' + lto)
+                    if isinstance(lto, str):
+                        if len(lto) == 0:
+                            bad(p + '.to', 'must be a non-empty string')
+                        elif lto not in invariant_state_ids:
+                            bad(p + '.to', 'references unknown state ' + lto)
+                    elif isinstance(lto, list):
+                        if len(lto) == 0:
+                            bad(p + '.to', 'must be a non-empty array of state ids')
+                        else:
+                            seen_targets = set()
+                            for target_index, target in enumerate(lto):
+                                at = p + '.to[' + str(target_index) + ']'
+                                if not isinstance(target, str) or len(target) == 0:
+                                    bad(at, 'must be a non-empty string')
+                                elif target not in invariant_state_ids:
+                                    bad(at, 'references unknown state ' + target)
+                                elif target in seen_targets:
+                                    bad(at, 'duplicates state ' + target + ' in the target set')
+                                else:
+                                    seen_targets.add(target)
+                    else:
+                        bad(p + '.to', 'must be a state id or a non-empty array of state ids')
                 elif kind == 'sequence':
                     evs = entry.get('events')
                     if not isinstance(evs, list) or len(evs) == 0:
@@ -1190,10 +1211,98 @@ def _shortest_violation_for_invariant(model, max_states, invariant):
     return None
 
 
-def _run_invariants(model, max_states):
+def _is_path_property_invariant(invariant):
+    # Whether an invariant asserts a property of whole runs rather than of a single
+    # runtime state. These kinds cannot be decided by a state predicate, so they are
+    # not part of _shortest_violation_for_invariant (and therefore not of S7), which
+    # owns the states; A9-A13 own the verdicts, and _path_property_violation below
+    # makes the same verdicts available to A7 and D2.
+    return invariant['kind'] in ('leads-to', 'sequence', 'atomicity', 'budget', 'probability')
+
+
+def _probability_violated(invariant, probability):
+    # Whether a probability invariant's bound fails for the computed hit probability.
+    eps = 1e-9
+    op = invariant['op']
+    if op == '>=':
+        return probability < invariant['p'] - eps
+    if op == '>':
+        return probability <= invariant['p'] + eps
+    if op == '<=':
+        return probability > invariant['p'] + eps
+    return probability >= invariant['p'] - eps
+
+
+def _reachable_runtime_states(model, max_states):
+    # Every runtime state reachable from init, capped like the other searches.
+    init = _initial_state(model)
+    visited = set([_runtime_key(init)])
+    reached = [init]
+    queue = deque([init])
+    steps = 0
+    while queue:
+        steps += 1
+        if steps > max_states:
+            break
+        current = queue.popleft()
+        for event in _all_events(model):
+            for nxt in _step_runtime(model, current, event):
+                k = _runtime_key(nxt)
+                if k in visited:
+                    continue
+                visited.add(k)
+                reached.append(nxt)
+                queue.append(nxt)
+    return reached
+
+
+def _path_property_violation(model, max_states, invariant):
+    # Violation of a path-property invariant, or None when it holds. Each kind
+    # delegates to the search its dedicated probe uses (A9 leads-to, A10 sequence, A11
+    # atomicity, A12 budget, A13 probability), so a verdict reported here can never
+    # disagree with the probe that owns the kind.
+    kind = invariant['kind']
+    if kind == 'leads-to':
+        targets = set(_leads_to_targets(invariant))
+        label = _leads_to_target_label(invariant)
+        for runtime in _reachable_runtime_states(model, max_states):
+            if runtime['state'] != invariant['from']:
+                continue
+            bad = _find_leads_to_bad_path(model, runtime, targets, label)
+            if bad is not None:
+                return {'invariant': invariant, 'path': bad['path'], 'reason': bad['reason']}
+        return None
+    if kind == 'sequence':
+        return _find_sequence_violation(model, max_states, invariant)
+    if kind == 'atomicity':
+        return _find_atomicity_violation(model, max_states, invariant)
+    if kind == 'budget':
+        violation = _find_budget_violation(model, max_states, invariant)
+        if violation is None:
+            return None
+        reason = ('a reachable cycle keeps accumulating cost, so no finite budget holds'
+                  if violation['unbounded']
+                  else 'a run accumulates cost ' + str(violation['cost']) + ', above the declared budget ' + str(invariant['budget']))
+        return {'invariant': invariant, 'path': violation['path'], 'reason': reason}
+    if kind == 'probability':
+        computed = _compute_hit_probability(model, max_states, invariant['target'])
+        probability = computed['probability']
+        if not _probability_violated(invariant, probability):
+            return None
+        reason = ('P(hit ' + invariant['target'] + ') = ' + '{:.6f}'.format(probability)
+                  + ' does not satisfy ' + invariant['op'] + ' ' + str(invariant['p'])
+                  + ('' if computed['converged'] else ' (value iteration did not converge)'))
+        return {'invariant': invariant, 'path': [], 'reason': reason}
+    return None
+
+
+def _run_invariants(model, max_states, include_path_properties=False):
     violations = []
     for invariant in model.get('invariants') or []:
-        violation = _shortest_violation_for_invariant(model, max_states, invariant)
+        if include_path_properties and _is_path_property_invariant(invariant):
+            violation = _path_property_violation(model, max_states, invariant)
+        else:
+            violation = _shortest_violation_for_invariant(model, max_states, invariant)
         if violation is not None:
             violations.append(violation)
     return violations
@@ -1575,14 +1684,27 @@ def A6_resource_injection(model):
 
 
 def A7_shortest_violations(model, max_states):
-    violations = _run_invariants(model, max_states)
+    # Path-property invariants are included: "for any invariant that fails" is this
+    # check's contract, and a check that silently skips five of the eight kinds cannot
+    # honour it. The searches for the state kinds, for sequence, atomicity and budget
+    # are breadth-first, so their first witness is the shortest one; the leads-to walk
+    # and the probability bound have no such guarantee, and their message says what it
+    # found instead of claiming minimality.
+    violations = _run_invariants(model, max_states, True)
     findings = []
     for violation in violations:
         invariant = violation['invariant']
+        path_length = len(violation['path'])
+        if _is_path_property_invariant(invariant):
+            message = ('Invariant "' + invariant['id'] + '" violated: ' + violation['reason']
+                       + ('' if path_length == 0 else ' (witness path length: ' + str(path_length) + ')'))
+        else:
+            message = ('Invariant "' + invariant['id'] + '" shortest violating path length: ' + str(path_length)
+                       + (' (initial state)' if path_length == 0 else ''))
         findings.append({
             'code': 'A7_SHORTEST_COUNTEREXAMPLE',
             'severity': 'warning',
-            'message': 'Invariant "' + invariant['id'] + '" shortest violating path length: ' + str(len(violation['path'])) + (' (initial state)' if len(violation['path']) == 0 else ''),
+            'message': message,
             'path': violation['path'],
             'evidence': {'invariant': invariant['id']},
         })
@@ -1648,6 +1770,14 @@ def _map_invariant_for_comparison(invariant, mapping):
         when = invariant.get('when')
         if when is not None and 'state' in when:
             out['when'] = {'state': _map_state_id(mapping, when['state'])}
+    elif invariant['kind'] == 'leads-to':
+        # A target set maps member by member; a rename that drops a state is reported by
+        # D2's own mapped-state check rather than silently changing the property.
+        out['from'] = _map_state_id(mapping, invariant['from'])
+        to = invariant['to']
+        out['to'] = _map_state_id(mapping, to) if isinstance(to, str) else [_map_state_id(mapping, s) for s in to]
+    elif invariant['kind'] == 'probability':
+        out['target'] = _map_state_id(mapping, invariant['target'])
     return out
 
 
@@ -1683,7 +1813,33 @@ def D2_invariant_continuity(before, after, max_states, mapping):
                     'evidence': {'invariant': invariant['id'], 'variable': mapped['variable']},
                 })
                 continue
-        violation = _shortest_violation_for_invariant(after, max_states, mapped)
+        elif mapped['kind'] == 'leads-to':
+            # The state references of a path-property invariant must follow stateMapping
+            # too, otherwise a pure rename searches for a state AFTER does not declare.
+            for state in [mapped['from']] + _leads_to_targets(mapped):
+                if state not in after_states:
+                    findings.append({
+                        'code': 'D2_MAPPED_STATE_MISSING',
+                        'severity': 'warning',
+                        'message': 'BEFORE invariant "' + invariant['id'] + '" maps to state ' + state + ', which is not declared in AFTER.',
+                        'evidence': {'invariant': invariant['id'], 'state': state},
+                    })
+        elif mapped['kind'] == 'probability':
+            if mapped['target'] not in after_states:
+                findings.append({
+                    'code': 'D2_MAPPED_STATE_MISSING',
+                    'severity': 'warning',
+                    'message': 'BEFORE invariant "' + invariant['id'] + '" maps to state ' + mapped['target'] + ', which is not declared in AFTER.',
+                    'evidence': {'invariant': invariant['id'], 'state': mapped['target']},
+                })
+        # Every invariant the engine can decide is re-decided against AFTER.
+        # Path-property kinds go through the same searches their dedicated probes use,
+        # so D2 can no longer report "all BEFORE invariants continue to hold" while
+        # A9-A13 fail on the very same model.
+        if _is_path_property_invariant(mapped):
+            violation = _path_property_violation(after, max_states, mapped)
+        else:
+            violation = _shortest_violation_for_invariant(after, max_states, mapped)
         if violation is not None:
             findings.append({
                 'code': 'D2_INVARIANT_REGRESSION',
@@ -1869,21 +2025,36 @@ def S8_monotonic_variables(model):
                          'Monotonic variables are respected' if not findings else 'Monotonic findings: ' + str(len(findings)))
 
 
-def _find_leads_to_bad_path(model, start, target):
-    # Find a run from start that never reaches target, or None when every run does.
-    # The property is universal (see the A9 row in SKILL.md): one branch that loops
-    # forever, or that stops before the target, refutes it.
+def _leads_to_targets(invariant):
+    # Target states of a leads-to invariant. The schema accepts one state id or a
+    # non-empty array of them, so "reach any of these" needs no separate kind.
+    to = invariant['to']
+    return [to] if isinstance(to, str) else list(to)
+
+
+def _leads_to_target_label(invariant):
+    # Target list as findings print it. A single target renders as its bare id, so
+    # existing messages stay byte-identical.
+    return ', '.join(_leads_to_targets(invariant))
+
+
+def _find_leads_to_bad_path(model, start, targets, label):
+    # Find a run from start that reaches none of targets, or None when every run
+    # reaches at least one of them. The property is universal (see the A9 row in
+    # SKILL.md): one branch that loops forever, or that stops before any target,
+    # refutes it.
     #
-    # Depth-first walk of the run graph with three colours; target runs are success
-    # leaves that are never expanded. A node reached while it is on the current walk
-    # (GRAY) closes a cycle that avoids the target. A node with no outgoing step at
-    # all stops the machine where it stands, which is the same violation for a
-    # different reason. A node whose walk completed without a violation is BLACK, and
-    # reaching it again from another branch is a shared sub-graph, not a cycle -- that
-    # is why the colour map cannot be a plain visited set: a diamond (two branches
-    # rejoining) is acyclic and must pass, while a genuine cycle must not. A run is
-    # identified by its state plus its variable values.
-    if start['state'] == target:
+    # Depth-first walk of the run graph with three colours; runs at a target are
+    # success leaves that are never expanded. A node reached while it is on the
+    # current walk (GRAY) closes a cycle that avoids every target. A node with no
+    # outgoing step at all stops the machine where it stands, which is the same
+    # violation for a different reason. A node whose walk completed without a
+    # violation is BLACK, and reaching it again from another branch is a shared
+    # sub-graph, not a cycle -- that is why the colour map cannot be a plain visited
+    # set: a diamond (two branches rejoining) is acyclic and must pass, while a
+    # genuine cycle must not. A run is identified by its state plus its variable
+    # values.
+    if start['state'] in targets:
         return None
     GRAY = 1
     BLACK = 2
@@ -1899,7 +2070,7 @@ def _find_leads_to_bad_path(model, start, target):
                     nexts.append({'next': nxt, 'event': event})
             frame['nexts'] = nexts
             if not nexts:
-                return {'path': frame['path'], 'reason': 'Dead end before target ' + target}
+                return {'path': frame['path'], 'reason': 'Dead end before target ' + label}
         if frame['index'] >= len(frame['nexts']):
             color[_runtime_key(frame['runtime'])] = BLACK
             stack.pop()
@@ -1907,12 +2078,12 @@ def _find_leads_to_bad_path(model, start, target):
         item = frame['nexts'][frame['index']]
         frame['index'] += 1
         step = {'from': frame['runtime']['state'], 'event': item['event'], 'to': item['next']['state']}
-        if item['next']['state'] == target:
+        if item['next']['state'] in targets:
             continue
         key = _runtime_key(item['next'])
         seen = color.get(key)
         if seen == GRAY:
-            return {'path': frame['path'] + [step], 'reason': 'Cycle avoids target ' + target}
+            return {'path': frame['path'] + [step], 'reason': 'Cycle avoids target ' + label}
         if seen == BLACK:
             continue
         color[key] = GRAY
@@ -1926,10 +2097,12 @@ def A9_leads_to(model, exploration):
     for invariant in model.get('invariants') or []:
         if invariant['kind'] != 'leads-to':
             continue
+        targets = set(_leads_to_targets(invariant))
+        label = _leads_to_target_label(invariant)
         for runtime in exploration['reachable']:
             if runtime['state'] != invariant['from']:
                 continue
-            bad = _find_leads_to_bad_path(model, runtime, invariant['to'])
+            bad = _find_leads_to_bad_path(model, runtime, targets, label)
             if bad is not None:
                 findings.append({
                     'code': 'A9_LEADS_TO_VIOLATION',
@@ -2309,7 +2482,6 @@ def _compute_hit_probability(model, max_states, target_state):
 
 def A13_probability(model, max_states):
     findings = []
-    eps = 1e-9
     for invariant in model.get('invariants') or []:
         if invariant['kind'] != 'probability':
             continue
@@ -2318,16 +2490,7 @@ def A13_probability(model, max_states):
         converged = result['converged']
         op = invariant['op']
         p_bound = invariant['p']
-        violated = False
-        if op == '>=':
-            violated = probability < p_bound - eps
-        elif op == '>':
-            violated = probability <= p_bound + eps
-        elif op == '<=':
-            violated = probability > p_bound + eps
-        else:
-            violated = probability >= p_bound - eps
-        if violated:
+        if _probability_violated(invariant, probability):
             findings.append({
                 'code': 'A13_PROBABILITY_VIOLATION',
                 'severity': 'error',

package/skills/logicprobe-datamodel/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: logicprobe-datamodel
-description: "Use when reviewing design documents, architecture specs, technical proposals, schema changes, data contracts, or refactoring plans that make claims about entities, fields, constraints, relationships, data invariants, migration coverage, or before/after data-model equivalence. When the document contains schema changes, data migration logic, or data-behavioral assertions ('all records must have X', 'target count equals source count', 'no orphan rows', 'migration is non-breaking'), escalate into data-model verification — generate and run executable checks for structural consistency, data invariants, migration coverage, copy consistency, and breaking changes before trusting any claim. Also proactively SUGGEST this skill for code-level data/schema behavioral questions."
+description: "Use when reviewing design documents, architecture specs, technical proposals, schema changes, data contracts, or refactoring plans that make claims about entities, fields, constraints, relationships, data invariants, migration coverage, copy consistency, rollback symmetry, or before/after data-model equivalence. When the document contains schema changes, data migration logic, or data-behavioural assertions ('all records must have X', 'target count equals source count', 'no orphan rows', 'ids never move backwards', 'exactly one row per event', 'rollback restores the old shape', 'migration is non-breaking'), escalate into data-model verification — generate and run executable checks for structural consistency (DS1-DS4), data invariants and adversarial probes (DA1-DA12: null/boundary injection, uniqueness, referential integrity, migration coverage, copy consistency, rollback symmetry, idempotency, monotonicity, ordering, leads-to, atomicity), and before/after data regression (DD1-DD4) before trusting any claim. Behavioural, state-machine, protocol and concurrency claims belong to the sibling logicprobe skill. Also proactively SUGGEST this skill for code-level data/schema behavioural questions."
 ---
 
 # Logic Probe Data

package/src/concurrency-tool.ts

@@ -1,4 +1,4 @@
-import { defineTool } from '@deepseek-ai/dsh-tools'
+import { defineTool } from '@deepseek-ai/dsh-tools'
 import type { JsonValue } from './json-value.js'
 import { runConcurrencyScan } from './concurrency.js'
 
@@ -13,7 +13,7 @@ export const LOGICPROBE_CONCURRENCY_SCAN_TOOL_NAME = 'logicprobe_concurrency_sca
 export const logicProbeConcurrencyScanTool = defineTool({
   name: LOGICPROBE_CONCURRENCY_SCAN_TOOL_NAME,
   description:
-    'Scan a document or plan text for concurrency risk points. Use ONLY after confirming the target actually has concurrency requirements or behavior (threads, async tasks, interrupts, shared state, parallel execution). If the target is purely sequential, do not call this tool. Returns findings for keywords like thread-safe, lock-free, data race, race condition, atomic, synchronized, mutex, semaphore, shared variable, reentrant, interrupt-safe. Absolute claims (thread-safe, lock-free, no data race) are flagged as errors requiring dedicated verification.',
+    'Scan a document or plan text for concurrency risk points. Use ONLY after confirming the target actually has concurrency requirements or behavior (threads, async tasks, interrupts, shared state, parallel execution). If the target is purely sequential, do not call this tool. Returns findings for keywords like thread-safe, lock-free, wait-free, data race, race condition, atomic, synchronized, mutex, semaphore, spinlock, shared variable, shared memory, reentrant, interrupt-safe, ISR, IRQ, NMI, critical section, disable_irq/enable_irq. Absolute claims (thread-safe, lock-free, no data race, interrupt-safe, ISR-safe) are flagged as errors requiring dedicated verification, and each carries suggestions naming the analysis to run instead (TSan/Helgrind, CBMC, TLA+, or RTOS-aware interrupt analysis). logicprobe does not prove concurrency safety.',
   parameters: {
     text: {
       type: 'string',