dsh-vibe-math 2.2.2 → 2.3.0

package/formal-verify-v5.test.mjs

@@ -0,0 +1,526 @@
+// ============================================================
+// V5 LEAN FORMAL VERIFICATION SUITE  (docs/formal-verification.md)
+//
+// Asserts the whole contract of the `formalVerify` knob:
+//   · 'off'       is a TRUE no-op (no Lean text anywhere, no gate)
+//   · 'encourage' injects the Lean section AND — the actual point of the feature — turns the
+//                 voting prompt into a FIDELITY review once a Lean run has passed
+//   · 'require'   withholds a true/false verdict as 未定论 until the object is Lean-passed
+//                 or carries an explicit, reasoned blocker record; then allows it, and the
+//                 Verified card records how strong the result really is
+//   · the three tools (run / archive / lib) write the right things to the right paths
+//
+// The Lean toolchain is mocked through the subprocess SERVICE, so the tests exercise the
+// real code path (resolveExecutable → spawn → collected stdout → exit code) without
+// requiring Lean to be installed.
+//
+// Run: node formal-verify-v5.test.mjs
+// ============================================================
+import { mkdtempSync, existsSync, readFileSync, mkdirSync, writeFileSync, readdirSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, dirname, isAbsolute } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const PLUGIN = process.env.V5_PLUGIN
+  ? new URL('file:///' + String(process.env.V5_PLUGIN).replace(/\\/g, '/'))
+  : new URL('./vibe-math-v5/vibe-math-v5.js', import.meta.url)
+const WS = mkdtempSync(join(tmpdir(), 'vibe-v5-lean-'))
+
+let passed = 0, failed = 0
+const failures = []
+const assert = (c, m) => { if (c) { passed++; console.log('  ok - ' + m) } else { failed++; failures.push(m); console.error('  FAIL - ' + m) } }
+const sleep = ms => new Promise(r => setTimeout(r, ms))
+const section = (t) => console.log('\n[' + t + ']')
+
+// ---------------------------------------------------------------
+// mock host
+// ---------------------------------------------------------------
+function makeProjectionRegistry() {
+  const units = new Map(); const cells = new Map()
+  const cellMap = (s) => { const id = String(s.id); let m = cells.get(id); if (!m) { m = new Map(); cells.set(id, m) } return m }
+  return {
+    register(def) { units.set(def.key, def); return () => { units.delete(def.key) } },
+    stateOf(session, key) {
+      const def = units.get(key); if (!def) return undefined
+      const m = cellMap(session)
+      if (!m.has(key)) m.set(key, def.init(session.header, session.inheritedEventCount || 0))
+      return m.get(key)
+    },
+    _drive(session, event) {
+      const m = cellMap(session)
+      for (const [k, def] of units) {
+        const cur = m.has(k) ? m.get(k) : def.init(session.header, session.inheritedEventCount || 0)
+        let next; try { next = def.apply(cur, event) } catch (e) { next = cur }
+        m.set(k, next)
+      }
+    },
+  }
+}
+
+const projections = makeProjectionRegistry()
+const listeners = {}
+const toolRegs = []
+const liveAgents = new Map()
+const spawns = []
+const wakes = []
+const delivered = []
+const leanRuns = []
+
+// A fake Lean: a file PASSES unless it still contains `sorry` or the marker `-- FAIL`.
+// This mirrors the one property that matters for the feature — an exit code that says
+// "the kernel accepted this".
+let toolchainAvailable = true
+const subprocess = {
+  async resolveExecutable(cmd) {
+    if (!toolchainAvailable) throw new Error('spawn lean ENOENT')
+    if (String(cmd) !== 'lean') throw new Error('unknown executable ' + cmd)
+    return 'lean'
+  },
+  spawn(spec) {
+    const file = spec.argv[spec.argv.length - 1]
+    const text = existsSync(file) ? readFileSync(file, 'utf8') : ''
+    const bad = /sorry|-- FAIL/.test(text)
+    leanRuns.push({ argv: spec.argv.slice(0, -1), file, cwd: spec.cwd })
+    const stdout = bad ? '' : 'ok\n'
+    const stderr = bad ? 'error: declaration uses sorry\n' : ''
+    return {
+      done: Promise.resolve({ exitCode: bad ? 1 : 0, signal: null }),
+      collected: {
+        stdout: { readFrom: () => ({ text: stdout, nextOffset: stdout.length, lossy: false }) },
+        stderr: { readFrom: () => ({ text: stderr, nextOffset: stderr.length, lossy: false }) },
+      },
+      terminate() {},
+    }
+  },
+}
+
+function makeMockSession(id, parentSession) {
+  const events = []
+  const s = {
+    id,
+    header: { version: 1, id, createdAt: Date.now(), cwd: WS, parentSession, isSeeded: false },
+    inheritedEventCount: 0,
+    get seq() { return events.length },
+    append(type, data) { const ev = { type, data, seq: events.length, time: Date.now() }; events.push(ev); projections._drive(s, ev); return ev },
+    deriveMessages() { return [] },
+    snapshotEvents(from) { return events.slice(from || 0) },
+    ownEvents() { return events.slice() },
+    _events: events,
+  }
+  return s
+}
+
+const roots = new Map()
+let rootSeq = 0
+function makeRoot() {
+  const id = 'sess-' + String.fromCharCode(65 + rootSeq++)
+  const session = makeMockSession(id, undefined)
+  const root = { id, options: { provider: 'mock', model: 'm' }, session, ctx: undefined }
+  roots.set(id, root)
+  return root
+}
+
+const ctx = {
+  get(name) {
+    if (name === 'sessionProjections') return projections
+    if (name === 'sandboxPolicy') return undefined
+    if (name === 'compaction') return undefined
+    if (name === 'subprocess') return subprocess
+    return undefined
+  },
+  on(e, fn) { (listeners[e] = listeners[e] || []).push(fn) },
+  effect(fn) { const d = fn(); return () => { if (typeof d === 'function') d() } },
+  logger: { info() {}, warn() {}, error() {} },
+  timeout(cb, ms) { const h = setTimeout(cb, ms); return () => clearTimeout(h) },
+  tools: { register(spec) { toolRegs.push(spec); return () => {} } },
+  commands: { register() { return () => {} } },
+  sessions: { async flush() { return true } },
+  subagents: {
+    list() { return ['spawn'] },
+    async startContinuable({ label, request }) {
+      const rootId = (request && request.parent && request.parent.id) || 'sess-A'
+      const id = 'c' + (spawns.length + 1)
+      liveAgents.set(id, { id, session: makeMockSession(id, rootId), options: request && request.agentOptions })
+      spawns.push({ label, childId: id, rootId, persona: request && request.persona, prompt: request && request.prompt && request.prompt[0] && request.prompt[0].text })
+      return { childId: id, messageId: 'm' + spawns.length }
+    },
+    async sendMessage(parent, childId, blocks) {
+      wakes.push({ childId, rootId: (parent && parent.id) || 'sess-A', prompt: (blocks && blocks[0] && blocks[0].text) || '' })
+      return 'w' + (wakes.length + delivered.length)
+    },
+    interrupt() {},
+    async drainContinuableChildren(parent, ids) { for (const i of ids) liveAgents.delete(i) },
+  },
+  agents: {
+    roots() { return [...roots.values()] },
+    get(id) { return roots.get(id) || liveAgents.get(id) },
+    list() { return [...roots.values(), ...liveAgents.values()] },
+  },
+  fs: {
+    async resolve(rel, opts) {
+      const b = (opts && opts.cwd) || WS
+      const p = (typeof rel === 'string' && isAbsolute(rel)) ? rel.replace(/\//g, '\\') : join(b, ...String(rel).split('/'))
+      return { targetKey: p, displayPath: p }
+    },
+    async stat(t) { return existsSync(t.targetKey) ? { version: 'v1', type: 'file', size: 1 } : undefined },
+    async readText(t) { return readFileSync(t.targetKey, 'utf8') },
+    async writeText(t, c) { mkdirSync(dirname(t.targetKey), { recursive: true }); writeFileSync(t.targetKey, c, 'utf8') },
+    async listDir(t) { if (!existsSync(t.targetKey)) return []; return readdirSync(t.targetKey, { withFileTypes: true }).map(e => ({ name: e.name, type: e.isDirectory() ? 'directory' : 'file' })) },
+  },
+}
+
+const mod = await import(PLUGIN.href + '?t=' + Date.now())
+;(mod.default || mod).apply(ctx)
+
+// ---------------------------------------------------------------
+// driving helpers
+// ---------------------------------------------------------------
+async function callTool(name, args, agent) {
+  const spec = toolRegs.find(x => x.name === name)
+  if (!spec) throw new Error('no tool ' + name)
+  return JSON.parse(await spec.execute(args || {}, { agent }))
+}
+const childAgent = (childId) => liveAgents.get(childId)
+function fireEnd(childId, reply) {
+  const blocks = reply === undefined ? [] : [{ type: 'text', text: '```json\n' + JSON.stringify(reply) + '\n```' }]
+  for (const h of (listeners['subagent/end'] || [])) {
+    h({ id: childId, runId: 'r', provider: 'spawn', local: true, stopReason: 'completed', lastAssistantMessage: blocks })
+  }
+}
+const settle = async () => { await sleep(30) }
+const memberOfChild = (childId) => { const s = spawns.find(x => x.childId === childId); const m = s ? /vibe5 (\S+) /.exec(s.label) : null; return m ? m[1] : '' }
+const spawnOf = (root, id) => spawns.find(s => s.rootId === root.id && s.label.indexOf('vibe5 ' + id + ' ') !== -1)
+const childOf = (root, id) => { const s = spawnOf(root, id); return s ? s.childId : '' }
+const spawnsFor = (root) => spawns.filter(s => s.rootId === root.id)
+
+let votePlan = new Map()
+async function drainWakes(budget, root) {
+  let n = 0
+  while (n < budget) {
+    const idx = wakes.findIndex(w => !root || w.rootId === root.id)
+    if (idx === -1) break
+    const w = wakes.splice(idx, 1)[0]
+    const owner = memberOfChild(w.childId)
+    delivered.push({ prompt: w.prompt, owner, rootId: w.rootId })
+    let reply
+    if (/【求真表决/.test(w.prompt)) {
+      const target = (/"target"\s*:\s*"([^"]+)"/.exec(w.prompt) || [])[1] || ''
+      const v = votePlan.has(owner) ? votePlan.get(owner) : 0.5
+      reply = { verdict: { target, verdict: v, reason: owner + ' 的判断' }, contextPct: 20 }
+    } else if (/【研究所会议/.test(w.prompt)) reply = { input: owner + '：意见。', solved: false, contextPct: 20 }
+    else reply = { progress: owner + '：继续推进。', solved: false, contextPct: 20 }
+    fireEnd(w.childId, reply)
+    n++
+    await settle()
+  }
+  return n
+}
+async function settleInstitute(root, rounds = 12) {
+  for (let i = 0; i < rounds; i++) {
+    await drainWakes(40, root)
+    await sleep(20)
+    const st = await callTool('vibe_v5_status', {}, root)
+    if (!st.members.some(m => m.busy) && !st.meeting && !st.verify && wakes.filter(w => w.rootId === root.id).length === 0) return st
+  }
+  return await callTool('vibe_v5_status', {}, root)
+}
+async function foundInstitute(root, problem, params) {
+  await callTool('vibe_v5_start', Object.assign({ problem, researcherCount: 2 }, params || {}), root)
+  for (const sp of spawnsFor(root)) { fireEnd(sp.childId, { progress: memberOfChild(sp.childId) + '：初见解。', solved: false, contextPct: 10 }); await settle() }
+  await callTool('vibe_v5_set', { maxParallel: 8 }, root)
+  return await settleInstitute(root)
+}
+// Vote a verdict through to completion. `waitRounds` bounds the debate loop.
+async function voteToConclusion(root, target, plan, rounds = 5) {
+  votePlan = plan
+  for (let i = 0; i < rounds; i++) {
+    delivered.length = 0
+    await settle(); await drainWakes(10, root)
+    const st = await callTool('vibe_v5_status', {}, root)
+    if (!st.verify || st.verify.target !== target) return st
+    if (st.undecided.indexOf(target) !== -1 || st.verified.indexOf(target) !== -1) return st
+  }
+  return await callTool('vibe_v5_status', {}, root)
+}
+
+// Deterministically wake ONE member and answer with a chosen reply.
+// Firing an end for a member that has no in-flight turn is a no-op (the in-flight token is
+// what makes onMemberEnd honour the event), so the wake must be created first.
+async function wakeAndReply(root, memberId, reply, fromMember) {
+  delivered.length = 0
+  await callTool('vibe_v5_say', { to: memberId, text: '请处理这件事。' }, childAgent(childOf(root, fromMember || 'acad')))
+  await settle()
+  const idx = wakes.findIndex(w => w.rootId === root.id && memberOfChild(w.childId) === memberId)
+  if (idx === -1) return null
+  const w = wakes.splice(idx, 1)[0]
+  fireEnd(w.childId, reply)
+  await settle()
+  await drainWakes(8, root)
+  return w
+}
+
+const instRootOf = (root) => join(WS, 'VibeMath', 'Projects', 'default', 'Institutes', 'institute')
+const vibeRoot = join(WS, 'VibeMath')
+const readIf = (p) => (existsSync(p) ? readFileSync(p, 'utf8') : '')
+
+// ===============================================================
+console.log('-- V5 Lean formal verification --')
+
+// ---------- 1. 'off' is a true no-op ----------
+section("1 'off' (default) is a true no-op")
+const RA = makeRoot()
+const st0 = await foundInstitute(RA, '形式化开关默认关闭测试')
+assert(st0.params.formalVerify === 'off', "the default is 'off' (got " + st0.params.formalVerify + ')')
+{
+  const allPrompts = spawnsFor(RA).map(s => s.prompt || '').join('\n') + '\n' + delivered.filter(d => d.rootId === RA.id).map(d => d.prompt).join('\n')
+  assert(!/Lean/.test(allPrompts), 'no founding/round prompt mentions Lean in off mode')
+  assert(!/形式化/.test(allPrompts), 'no prompt mentions 形式化 in off mode')
+  assert(!/\[形式化\]/.test(allPrompts), 'the [形式化] state line is absent in off mode')
+}
+// an off-mode verification must behave exactly as before (no gate at all)
+await callTool('vibe_v5_record_proposition', { id: 'p-off', statement: '关模式下的普通命题', value: 0.6, motive: 'm', p: 0.8 }, childAgent(childOf(RA, 'r-1')))
+await callTool('vibe_v5_propose_verify', { target: 'p-off', kind: 'proposition', reason: '直接表决' }, childAgent(childOf(RA, 'r-1')))
+const offDone = await voteToConclusion(RA, 'p-off', new Map([['acad', 1], ['r-1', 1], ['r-2', 1]]))
+assert(offDone.verified.indexOf('p-off') !== -1, "'off' mode still finalizes on a unanimous boolean vote with NO Lean artifact")
+assert(existsSync(join(instRootOf(RA), 'Verified', '命题', 'p-off.md')), "the Verified card was written in 'off' mode")
+assert(!/形式化/.test(readIf(join(instRootOf(RA), 'Verified', '命题', 'p-off.md'))), 'the card carries no formal line in off mode')
+// the tools still EXIST in off mode (static registration), they are just never advertised
+assert(!!toolRegs.find(t => t.name === 'vibe_v5_lean_run') && !!toolRegs.find(t => t.name === 'vibe_v5_lean_archive') && !!toolRegs.find(t => t.name === 'vibe_v5_lean_lib'),
+  'the three Lean tools are registered in every mode (registration is static)')
+
+// ---------- 2. parameter validation ----------
+section('2 parameter validation and runtime switching')
+const RB = makeRoot()
+await foundInstitute(RB, '形式化参数校验测试')
+const bad = await callTool('vibe_v5_set', { formalVerify: 'banana' }, RB)
+assert(bad.params.formalVerify === 'off', "an unknown mode degrades to 'off', never to a stronger mode (got " + bad.params.formalVerify + ')')
+const enc = await callTool('vibe_v5_set', { formalVerify: 'encourage' }, RB)
+assert(enc.params.formalVerify === 'encourage', "'encourage' is accepted")
+const req = await callTool('vibe_v5_set', { formalVerify: 'require', leanTimeoutMs: -5, leanCommand: '   ' }, RB)
+assert(req.params.formalVerify === 'require', "'require' is accepted")
+assert(req.params.leanTimeoutMs === 120000, 'a non-positive leanTimeoutMs falls back to the default (' + req.params.leanTimeoutMs + ')')
+assert(req.params.leanCommand === 'lean', 'a blank leanCommand falls back to "lean"')
+await callTool('vibe_v5_set', { leanCommand: 'lake', leanArgs: ['env', 'lean'] }, RB)
+const stL = await callTool('vibe_v5_status', {}, RB)
+assert(stL.params.leanCommand === 'lake' && stL.params.leanArgs.join(' ') === 'env lean', 'leanCommand/leanArgs are settable (lake env lean)')
+
+// ---------- 3. 'encourage' injection ----------
+section("3 'encourage' injects the Lean section into the right prompts")
+const RC = makeRoot()
+await foundInstitute(RC, '鼓励模式注入测试')
+await callTool('vibe_v5_set', { formalVerify: 'encourage' }, RC)
+{
+  // a plain work round must carry the "formalize reusable things as you go" line
+  delivered.length = 0
+  await callTool('vibe_v5_say', { to: 'r-1', text: '请继续。' }, childAgent(childOf(RC, 'acad')))
+  await settle(); await drainWakes(6, RC)
+  const work = delivered.filter(d => d.rootId === RC.id).map(d => d.prompt).join('\n')
+  assert(/\[形式化\] 鼓励 Lean/.test(work), "the state block gains a [形式化] 鼓励 Lean line")
+  assert(/【顺手形式化（鼓励）】/.test(work), 'the work round tells members to formalize reusable objects as they go')
+  assert(/vibe_v5_lean_archive kind='def'/.test(work), 'the work round points at the archive tool for reusable definitions')
+}
+await callTool('vibe_v5_record_proposition', { id: 'p-enc', statement: '鼓励模式下的忠实性审查', value: 0.6, motive: 'm', p: 0.8 }, childAgent(childOf(RC, 'r-1')))
+await callTool('vibe_v5_propose_verify', { target: 'p-enc', kind: 'proposition', reason: '先看看提示词' }, childAgent(childOf(RC, 'r-1')))
+await settle(); delivered.length = 0; await drainWakes(3, RC)
+{
+  const vp = delivered.filter(d => d.rootId === RC.id).map(d => d.prompt).join('\n')
+  assert(/【Lean 形式化验证（鼓励模式）】/.test(vp), 'the voting prompt explains the Lean mode')
+  assert(/一旦 Lean 通过，你唯一需要确认的就是忠实性/.test(vp), 'the voting prompt states that a passing Lean run shrinks the question to fidelity')
+  assert(/实现难度/.test(vp), 'the voting prompt asks for the implementation-difficulty judgement')
+  assert(/可以不做，但请在回执的 formal 字段写明难度判断/.test(vp), "'encourage' explicitly allows skipping (with a recorded judgement)")
+  assert(/"formal":/.test(vp), 'the reply contract documents the formal field')
+}
+await drainWakes(10, RC)
+
+// ---------- 4. the run tool ----------
+section('4 lean_run executes through the subprocess service and reports honestly')
+const RD = makeRoot()
+await foundInstitute(RD, 'Lean 运行测试')
+await callTool('vibe_v5_set', { formalVerify: 'encourage' }, RD)
+const instD = instRootOf(RD)
+mkdirSync(join(instD, 'Formal'), { recursive: true })
+writeFileSync(join(instD, 'Formal', 'good.lean'), 'theorem t : 1 = 1 := rfl\n', 'utf8')
+writeFileSync(join(instD, 'Formal', 'bad.lean'), 'theorem t : 1 = 2 := by sorry\n', 'utf8')
+const runGood = await callTool('vibe_v5_lean_run', { file: 'Formal/good.lean' }, childAgent(childOf(RD, 'r-1')))
+assert(runGood.ok === true && runGood.exitCode === 0, 'a file with no sorry runs green (' + JSON.stringify({ ok: runGood.ok, exitCode: runGood.exitCode }) + ')')
+assert(leanRuns.length > 0 && leanRuns[leanRuns.length - 1].cwd.replace(/\\/g, '/') === instD.replace(/\\/g, '/'), 'the toolchain runs with the institute root as cwd')
+const runBad = await callTool('vibe_v5_lean_run', { file: 'Formal/bad.lean' }, childAgent(childOf(RD, 'r-1')))
+assert(runBad.ok === false && runBad.exitCode === 1, 'a file that still uses sorry reports a red run')
+assert(/sorry/.test(runBad.stderr), 'the compiler output is returned verbatim (' + JSON.stringify(runBad.stderr).slice(0, 60) + ')')
+const runMissing = await callTool('vibe_v5_lean_run', { file: 'Formal/nope.lean' }, childAgent(childOf(RD, 'r-1')))
+assert(runMissing.ok === false && runMissing.code === 'V5_NOT_FOUND', 'a missing file is refused with a typed code')
+// The guard's boundary is the VibeMath ROOT, not the institute: the global reuse library
+// deliberately lives at <VibeMath>/Formal/{Lib,Proved}, so climbing out of the institute
+// but staying inside VibeMath must remain legal (it just fails as a missing file).
+const runOutsideInst = await callTool('vibe_v5_lean_run', { file: '../../../Formal/Lib/x.lean' }, childAgent(childOf(RD, 'r-1')))
+assert(runOutsideInst.code === 'V5_NOT_FOUND', 'climbing out of the institute but staying inside VibeMath is allowed (the global library lives there)')
+const runEscape = await callTool('vibe_v5_lean_run', { file: '../../../../../etc/evil.lean' }, childAgent(childOf(RD, 'r-1')))
+assert(runEscape.ok === false && runEscape.code === 'V5_INVALID_ARGUMENT', '★ a traversal that climbs ABOVE the VibeMath root is refused')
+const runEscape2 = await callTool('vibe_v5_lean_run', { file: 'Formal/../../../../../../evil.lean' }, childAgent(childOf(RD, 'r-1')))
+assert(runEscape2.ok === false && runEscape2.code === 'V5_INVALID_ARGUMENT', 'a deeper traversal is refused too')
+const runEscape3 = await callTool('vibe_v5_lean_run', { file: '/etc/evil.lean' }, childAgent(childOf(RD, 'r-1')))
+assert(runEscape3.ok === false && runEscape3.code === 'V5_INVALID_ARGUMENT', 'an unrelated absolute path is refused')
+const runNotLean = await callTool('vibe_v5_lean_run', { file: 'Formal/good.txt' }, childAgent(childOf(RD, 'r-1')))
+assert(runNotLean.ok === false && runNotLean.code === 'V5_INVALID_ARGUMENT', 'only .lean files can be executed')
+toolchainAvailable = false
+const runNoTc = await callTool('vibe_v5_lean_run', { file: 'Formal/good.lean' }, childAgent(childOf(RD, 'r-1')))
+assert(runNoTc.ok === false && runNoTc.code === 'LEAN_NOT_FOUND', 'a missing toolchain returns LEAN_NOT_FOUND instead of crashing')
+assert(/仍可把形式化代码写下来归档/.test(runNoTc.message), 'the failure explains the graceful degradation')
+toolchainAvailable = true
+
+// ---------- 5. archive a proof → the vote becomes a FIDELITY review ----------
+section('5 a passing proof flips the review subject to fidelity')
+const arc = await callTool('vibe_v5_lean_archive', {
+  kind: 'proof', target: 'p-proof', content: 'theorem p_proof : 3 * 1 ^ 2 - 2 = (1:Nat) ^ 2 := by decide\n', note: '',
+}, childAgent(childOf(RD, 'r-1')))
+assert(arc.ok === true && arc.passed === true, 'the proof is archived and passes (' + JSON.stringify({ ok: arc.ok, passed: arc.passed }) + ')')
+assert(arc.file === 'Formal/p-proof.lean', 'the working file is Formal/<target>.lean')
+assert(arc.proof === 'Verified/Lean/p-proof.lean', 'the archived proof path is Verified/Lean/<target>.lean')
+assert(existsSync(join(instD, 'Formal', 'p-proof.lean')), 'the working file exists on disk')
+assert(existsSync(join(instD, 'Verified', 'Lean', 'p-proof.lean')), '★ the proof is archived under Verified/Lean/ as the proof of that object')
+const stD = await callTool('vibe_v5_status', {}, RD)
+assert(stD.formal.passed.indexOf('p-proof') !== -1, 'status reports the object as Lean-passed')
+const idxD = readIf(join(instD, 'Formal', 'Index.md'))
+assert(/p-proof/.test(idxD) && /passed/.test(idxD) && /Verified\/Lean\/p-proof\.lean/.test(idxD), 'Formal/Index.md indexes the object, its status and its archived proof')
+// now the voting prompt must ASK FOR FIDELITY, not for a re-derivation
+await callTool('vibe_v5_record_proposition', { id: 'p-proof', statement: '3N²−2=b² 在 N=1 时成立', value: 0.6, motive: 'm', p: 0.9 }, childAgent(childOf(RD, 'r-1')))
+await callTool('vibe_v5_propose_verify', { target: 'p-proof', kind: 'proposition', reason: '已有 Lean 证明' }, childAgent(childOf(RD, 'r-1')))
+await settle(); delivered.length = 0; await drainWakes(3, RD)
+{
+  const vp = delivered.filter(d => d.rootId === RD.id).map(d => d.prompt).join('\n')
+  assert(/该对象已有\*\*通过的 Lean 形式化证明\*\*/.test(vp), 'the voting prompt announces the passing proof')
+  assert(/你不需要重新检查推导/.test(vp), '★ it tells voters NOT to re-derive')
+  assert(/忠实性审查/.test(vp), '★ it tells voters the review subject is now fidelity')
+  assert(/定义 \/ 对象 \/ 条件 \/ 假设 \/ 结论是否与命题原文\*\*完全一致\*\*/.test(vp), 'it enumerates exactly what fidelity means')
+}
+await drainWakes(10, RD)
+
+// ---------- 6. the reusable cross-project library ----------
+section('6 reusable definitions and lemmas go to the GLOBAL library')
+const libPath = join(vibeRoot, 'Formal', 'Lib')
+const provedPath = join(vibeRoot, 'Formal', 'Proved')
+const defRes = await callTool('vibe_v5_lean_archive', { kind: 'def', name: 'ZMod5', content: 'def ZMod5 := Fin 5\n' }, childAgent(childOf(RD, 'r-1')))
+assert(defRes.ok === true && defRes.file === 'Formal/Lib/ZMod5.lean', 'a reusable definition is archived to the global lib (' + defRes.file + ')')
+assert(existsSync(join(libPath, 'ZMod5.lean')), '★ the definition exists under VibeMath/Formal/Lib/ (cross-project, NOT inside the institute)')
+assert(!existsSync(join(instD, 'Formal', 'Lib', 'ZMod5.lean')), 'it is NOT duplicated inside the institute tree')
+const lemRes = await callTool('vibe_v5_lean_archive', { kind: 'lemma', name: 'sq_odd', content: 'theorem sq_odd (n : Nat) : Odd (n*n) → Odd n := by omega\n' }, childAgent(childOf(RD, 'r-1')))
+assert(lemRes.ok === true && lemRes.file === 'Formal/Proved/sq_odd.lean', 'a lemma is archived to Proved/')
+assert(existsSync(join(provedPath, 'sq_odd.lean')), 'the lemma exists under VibeMath/Formal/Proved/')
+const libIdx = readIf(join(libPath, 'Index.md'))
+assert(/ZMod5/.test(libIdx), 'Lib/Index.md lists the new definition')
+const provedIdx = readIf(join(provedPath, 'Index.md'))
+assert(/sq_odd/.test(provedIdx), 'Proved/Index.md lists the new lemma')
+const libList = await callTool('vibe_v5_lean_lib', {}, childAgent(childOf(RD, 'r-1')))
+assert(libList.ok === true && libList.counts.lib >= 1 && libList.counts.proved >= 1, 'lean_lib reports the reuse library sizes (' + JSON.stringify(libList.counts) + ')')
+assert(libList.objects.some(o => o.target === 'p-proof' && o.status === 'passed'), 'lean_lib lists per-object formal status')
+assert(/复用优先/.test(libList.hint || ''), 'lean_lib tells agents to reuse before redefining')
+const noName = await callTool('vibe_v5_lean_archive', { kind: 'def', content: 'def x := 1\n' }, childAgent(childOf(RD, 'r-1')))
+assert(noName.ok === false && noName.code === 'V5_INVALID_ARGUMENT', 'archiving a definition without a name is refused')
+const badKind = await callTool('vibe_v5_lean_archive', { kind: 'nonsense' }, childAgent(childOf(RD, 'r-1')))
+assert(badKind.ok === false && badKind.code === 'V5_INVALID_ARGUMENT', 'an unknown archive kind is refused')
+
+// ---------- 7. blocked needs a reason ----------
+section('7 a "blocker" record must be explicit and reasoned')
+const blkNoNote = await callTool('vibe_v5_lean_archive', { kind: 'blocked', target: 'p-blk' }, childAgent(childOf(RD, 'r-1')))
+assert(blkNoNote.ok === false && blkNoNote.code === 'V5_INVALID_ARGUMENT', 'blocked without a note is refused')
+const blk = await callTool('vibe_v5_lean_archive', { kind: 'blocked', target: 'p-blk', note: '需要外层解析数论框架，本轮工作量不可接受' }, childAgent(childOf(RD, 'r-1')))
+assert(blk.ok === true && blk.status === 'blocked', 'a reasoned blocker is recorded')
+const stBlk = await callTool('vibe_v5_status', {}, RD)
+assert(stBlk.formal.blocked.indexOf('p-blk') !== -1, 'status lists the blocked object')
+assert(/需要外层解析数论框架/.test(readIf(join(instD, 'Formal', 'Index.md'))), 'the blocker reason is written into the index')
+
+// ---------- 8. the 'require' gate ----------
+section("8 'require' withholds a verdict until the formal record exists")
+const RE = makeRoot()
+await foundInstitute(RE, 'require 门禁测试')
+await callTool('vibe_v5_set', { formalVerify: 'require' }, RE)
+const instE = instRootOf(RE)
+await callTool('vibe_v5_record_proposition', { id: 'p-gate', statement: '必须形式化的命题', value: 0.6, motive: 'm', p: 0.8 }, childAgent(childOf(RE, 'r-1')))
+await callTool('vibe_v5_propose_verify', { target: 'p-gate', kind: 'proposition', reason: '直接表决试试' }, childAgent(childOf(RE, 'r-1')))
+await settle(); delivered.length = 0; await drainWakes(3, RE)
+{
+  const vp = delivered.filter(d => d.rootId === RE.id).map(d => d.prompt).join('\n')
+  assert(/【Lean 形式化验证（强制模式）】/.test(vp), 'the voting prompt says 强制模式')
+  assert(/必须产出 Lean 形式化/.test(vp), "'require' states the formalization is mandatory")
+  assert(/本次裁定不会生效/.test(vp), 'the prompt warns that the verdict will not take effect without it')
+}
+const gated = await voteToConclusion(RE, 'p-gate', new Map([['acad', 1], ['r-1', 1], ['r-2', 1]]))
+assert(gated.verified.indexOf('p-gate') === -1, '★ a unanimous TRUE verdict did NOT promote the object to Verified/')
+assert(gated.undecided.indexOf('p-gate') !== -1, '★ it is recorded as 未定论 instead')
+assert(!existsSync(join(instE, 'Verified', '命题', 'p-gate.md')), 'no Verified card was written')
+const todoE = readIf(join(instE, 'Formal', 'TODO.md'))
+assert(existsSync(join(instE, 'Formal', 'TODO.md')), 'Formal/TODO.md was created')
+assert(/p-gate/.test(todoE) && /formal-required/.test(todoE), '★ the object is on the formalization TODO with the machine-readable reason')
+{
+  const chat = readdirSync(join(instE, 'Shared', 'Chat')).map(f => readIf(join(instE, 'Shared', 'Chat', f))).join('\n')
+  assert(/require 模式.*先有 Lean 通过或显式阻塞记录/.test(chat), 'the withholding is announced in the group chat')
+}
+// now formalize it and re-verify: the gate must open
+const proofNow = await callTool('vibe_v5_lean_archive', { kind: 'proof', target: 'p-gate', content: 'theorem p_gate : 2 + 2 = 4 := by decide\n' }, childAgent(childOf(RE, 'r-1')))
+assert(proofNow.ok === true && proofNow.passed === true, 'the object is now Lean-passed')
+await callTool('vibe_v5_propose_verify', { target: 'p-gate', kind: 'proposition', reason: '已形式化，重新表决' }, childAgent(childOf(RE, 'r-1')))
+const gated2 = await voteToConclusion(RE, 'p-gate', new Map([['acad', 1], ['r-1', 1], ['r-2', 1]]))
+assert(gated2.verified.indexOf('p-gate') !== -1, '★ with a passing Lean artifact the same vote DOES promote it')
+const card = readIf(join(instE, 'Verified', '命题', 'p-gate.md'))
+assert(/- 形式化: Lean 通过/.test(card), '★ the Verified card records how strong the result is (Lean 通过)')
+assert(/Verified\/Lean\/p-gate\.lean/.test(card), 'the card points at the archived proof')
+// the blocker escape hatch must also open the gate
+await callTool('vibe_v5_record_proposition', { id: 'p-blocked-ok', statement: '记录阻塞后可定论', value: 0.6, motive: 'm', p: 0.8 }, childAgent(childOf(RE, 'r-1')))
+await callTool('vibe_v5_lean_archive', { kind: 'blocked', target: 'p-blocked-ok', note: '命题涉及未形式化的分析学，本轮不做' }, childAgent(childOf(RE, 'r-1')))
+await callTool('vibe_v5_propose_verify', { target: 'p-blocked-ok', kind: 'proposition', reason: '已记录阻塞' }, childAgent(childOf(RE, 'r-1')))
+const gated3 = await voteToConclusion(RE, 'p-blocked-ok', new Map([['acad', 1], ['r-1', 1], ['r-2', 1]]))
+assert(gated3.verified.indexOf('p-blocked-ok') !== -1, '★ an explicit reasoned blocker also lets the verdict through (decide by difficulty, but decide out loud)')
+assert(/- 形式化: 阻塞（/.test(readIf(join(instE, 'Verified', '命题', 'p-blocked-ok.md'))), 'the card records the blocker')
+
+// ---------- 9. the reply-channel judgement ----------
+section('9 the per-round `formal` reply channel records the difficulty judgement')
+const RF = makeRoot()
+await foundInstitute(RF, '回执 formal 通道测试')
+await callTool('vibe_v5_set', { formalVerify: 'require' }, RF)
+const instF = instRootOf(RF)
+await callTool('vibe_v5_record_proposition', { id: 'p-reply', statement: '用回执记录阻塞', value: 0.6, motive: 'm', p: 0.8 }, childAgent(childOf(RF, 'r-1')))
+// A member that never calls a Lean tool still has to state its difficulty judgement, so the
+// JSON reply channel matters: it is the path that actually fires in practice.
+const w1 = await wakeAndReply(RF, 'r-1', {
+  progress: '难度太高，本轮不做形式化。',
+  formal: { target: 'p-reply', decision: 'blocked', note: '需要大量未形式化的实分析前置知识' },
+  contextPct: 20,
+})
+assert(!!w1, 'r-1 was woken and answered')
+const stF = await callTool('vibe_v5_status', {}, RF)
+assert(stF.formal.blocked.indexOf('p-reply') !== -1, 'a `formal.decision=blocked` reply is recorded as a blocker')
+assert(/实分析前置知识/.test(readIf(join(instF, 'Formal', 'Index.md'))), 'and its reason reaches the index')
+// a `used` judgement records the file as attempted (not yet passed — nothing ran green)
+const w2 = await wakeAndReply(RF, 'r-2', {
+  progress: '我写了形式化草稿。',
+  formal: { target: 'p-reply2', decision: 'used', file: 'Formal/p-reply2.lean' },
+  contextPct: 20,
+})
+assert(!!w2, 'r-2 was woken and answered')
+const stF2 = await callTool('vibe_v5_status', {}, RF)
+assert(stF2.formal.objects.some(o => o.target === 'p-reply2' && o.status === 'attempted'),
+  'a `formal.decision=used` reply records the object as attempted with its file')
+// a blocker with no note must be refused AND reported back to the member
+delivered.length = 0
+const w3 = await wakeAndReply(RF, 'r-1', { formal: { target: 'p-reply3', decision: 'blocked' }, contextPct: 20 })
+assert(!!w3, 'r-1 was woken for the third judgement')
+const said = delivered.map(d => d.prompt).join('\n')
+assert(/必须写明 note/.test(said), 'a blocked judgement without a note is refused with an explicit notice to the member')
+assert((await callTool('vibe_v5_status', {}, RF)).formal.objects.every(o => o.target !== 'p-reply3'),
+  'and no blocker record is created for the refused judgement')
+
+
+// ---------- 10. reporting ----------
+section('10 the office can audit formal strength')
+const rep = await callTool('vibe_v5_report', {}, RE)
+assert(/## Lean 形式化/.test(rep.report), 'the report has a Lean formal-verification section')
+assert(/已通过：.*p-gate/.test(rep.report), 'the report lists Lean-passed objects')
+assert(/已记录阻塞：.*p-blocked-ok/.test(rep.report), 'the report lists blocked objects')
+const stOff = await callTool('vibe_v5_report', {}, RA)
+assert(/未启用（`formalVerify` = off/.test(stOff.report), 'in off mode the report says the feature is not enabled')
+
+console.log('')
+console.log('passed=' + passed + ' failed=' + failed)
+if (failed) { console.error('FAILURES:'); for (const f of failures) console.error('  - ' + f); process.exit(1) }
+console.log('ALL GREEN')
+process.exit(0)

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-vibe-math",
   "description": "Multi-agent mathematical problem-solving & verification frameworks for DeepSeek Harness — FOUR agent presets in one install: vibe-math-v2 (probability-driven: qs.json + Propos knowledge base + explorer→solver→review/debate verdict), vibe-math-v3 (THIRD-generation, recommended: paper-style Markdown knowledge base with Problems/Progress/Propos/Methods/Verified + planner-agent scheduling that decides the next N actions + universal theory/method invention library + agents write their own Markdown directly via a per-file write lock), and vibe-math-v4 (FOURTH-generation: persistent self-organizing resident subagents that message & meet to decide all tasks, verify only by unanimous consensus, /compact at a context threshold, and stop only when all agree the problem is solved), and vibe-math-v5 (FIFTH-generation research institute: an academician as the organizational centre who decomposes and ASSIGNS work and chairs meetings; permanent researchers who hold the vote and may hire/fire their own temp workers; temp workers with no vote; a group chat and meetings; a durable per-recipient mailbox; a compare-and-set task DAG; and a boolean m-vote consensus rule where an object enters Verified/ only when at least m voting members agree AND every one of them returns exactly 1 or exactly 0). Installing this bundle auto-installs all four presets (v1 was removed at v2.0.0).",
-  "version": "2.2.2",
+  "version": "2.3.0",
   "type": "module",
   "engines": {
     "node": "^22.19.0 || >=24.0.0"
@@ -14,10 +14,17 @@
   },
   "files": [
     "AUDIT-CHECKLIST.md",
+    "audit-formal-sensitivity.mjs",
+    "audit-persona-sensitivity.mjs",
+    "audit-persona-surface.test.mjs",
     "audit-v5-integrity.mjs",
     "audit-v5-sensitivity.mjs",
     "cordis.patch.yml",
     "e2e-v5-round2.test.mjs",
+    "formal-verify-v2.test.mjs",
+    "formal-verify-v3.test.mjs",
+    "formal-verify-v4.test.mjs",
+    "formal-verify-v5.test.mjs",
     "installer.js",
     "prompt-v5-integrity.test.mjs",
     "RELEASE-NOTES-2.0.22.md",
@@ -25,10 +32,16 @@
     "RELEASE-NOTES-2.2.0.md",
     "RELEASE-NOTES-2.2.1.md",
     "RELEASE-NOTES-2.2.2.md",
+    "RELEASE-NOTES-2.3.0.md",
     "selfdrive-v5.mjs",
     "示例图/框架图-v5.svg",
     "docs/架构图.md",
+    "docs/formal-verification.md",
     "docs/generate_framework_diagram_v5.mjs",
+    "prompt-corpus-persona/persona-corpus.json",
+    "prompt-corpus-persona/persona-corpus.md",
+    "prompt-corpus-v3/formal-verify-v3.json",
+    "prompt-corpus-v3/formal-verify-v3.md",
     "prompt-corpus-v5/prompt-corpus-v5.json",
     "prompt-corpus-v5/prompt-corpus-v5.md",
     "vibe-math-v2/实现方案.md",
@@ -78,7 +91,7 @@
     },
     "minVersion": "0.1.2-rc.1",
     "testedVersion": "0.1.5-rc.2",
-    "compatNote": "依赖宿主提供的 subagents/agents/tools/commands/fs 服务与 @deepseek-ai/dsh-* 插件行；可选 subprocess/sandboxPolicy/compaction。persona 行同时携带 prefix 与 text 两个键，以兼容 0.1.3-alpha.2 的 schema 更名（prefix 必填）与 0.1.2 及更早的 text 键。已在 dsh-v0.1.5-rc.2（@deepseek-ai/dsh-persona 0.1.5-rc.2）上逐行校验全部预设行并通过（v2/v3/v4；v1 已于 v2.0.0 移除）。注意：DSH 0.1.2 起 subagents.startContinuable 的 agentOptions/toolFilter 需要宿主 provider 声明对应 capability（spawn/fork 进程内 provider 均支持），安装器启动时会做能力自检并在旧版宿主上告警。2026 兼容性修复：v2/v3 工具权限名表原先硬编码 web/fetch/bash（未注册名会使 tools.restrict() 抛错、子代理无法建立），现按真实注册名并加带守卫的重试；v4 真实 /compact 原先在 subagent/end 里查 agents.get()（该事件触发时子代理已移出注册表，属死代码），现改为在 subagent/start 捕获 Agent 引用；三套预设的可选服务改为惰性读取，不再在 apply() 快照；v4 的 tools/commands 注册补入 ctx.effect；安装器自检新增 subprocess/sandboxPolicy/compaction。v2.1.0 新增 v5 研究所体系：状态存于宿主 host-only 会话投影单元（键 vibeMathV5），因此自检新增 sessionProjections/sessions（均为可选；缺失时 v5 回退到加固 JSON 状态文件）。v5 不依赖任何 npm 实验包，纯 preset 内单文件实现。v2.2.2 新增 v5 架构图（示例图/框架图-v5.svg + docs/generate_framework_diagram_v5.mjs 零依赖 Node 生成器 + vibe-math-v5/架构图.md 全套 Mermaid 细节图），并修复在绘制架构图时暴露的真实缺陷：会议进行中提出的验证会并发启动（会议与验证的互斥此前只做了单向），现改为排队。v2.2.1 把「全面检查必查清单」(AUDIT-CHECKLIST.md) 作为随包强制流程发布，提示词/交互正确性列为第一优先审计维度。v2.2.0 修复实测发现的提示词身份错乱：状态块改为显式接收它所描述的成员，创建成员时先落盘进编制再构造入职提示词，章程快照冻结在入职时，重建会话不再自称“刚入职”，所办调用不再被误判成某位研究员，框架反馈改为独立发送者投递，一次提示词不再重复投递同一条消息，并新增 prompt-v5-integrity 提示词完整性套件 + 可人工复核的提示词语料（随包发布）。",
+    "compatNote": "依赖宿主提供的 subagents/agents/tools/commands/fs 服务与 @deepseek-ai/dsh-* 插件行；可选 subprocess/sandboxPolicy/compaction。persona 行同时携带 prefix 与 text 两个键，以兼容 0.1.3-alpha.2 的 schema 更名（prefix 必填）与 0.1.2 及更早的 text 键。已在 dsh-v0.1.5-rc.2（@deepseek-ai/dsh-persona 0.1.5-rc.2）上逐行校验全部预设行并通过（v2/v3/v4；v1 已于 v2.0.0 移除）。注意：DSH 0.1.2 起 subagents.startContinuable 的 agentOptions/toolFilter 需要宿主 provider 声明对应 capability（spawn/fork 进程内 provider 均支持），安装器启动时会做能力自检并在旧版宿主上告警。2026 兼容性修复：v2/v3 工具权限名表原先硬编码 web/fetch/bash（未注册名会使 tools.restrict() 抛错、子代理无法建立），现按真实注册名并加带守卫的重试；v4 真实 /compact 原先在 subagent/end 里查 agents.get()（该事件触发时子代理已移出注册表，属死代码），现改为在 subagent/start 捕获 Agent 引用；三套预设的可选服务改为惰性读取，不再在 apply() 快照；v4 的 tools/commands 注册补入 ctx.effect；安装器自检新增 subprocess/sandboxPolicy/compaction。v2.1.0 新增 v5 研究所体系：状态存于宿主 host-only 会话投影单元（键 vibeMathV5），因此自检新增 sessionProjections/sessions（均为可选；缺失时 v5 回退到加固 JSON 状态文件）。v5 不依赖任何 npm 实验包，纯 preset 内单文件实现。v2.3.0 为四个架构新增可调控的 Lean 形式化验证（参数 formalVerify = off/encourage/require，默认 off）：验证时按实现难度决定是否用 Lean 形式化（写代码+执行），一旦通过则审查对象从「推导是否正确」变成「Lean 的定义/对象/条件/假设/结论是否忠实于命题原文」；形式化代码归档为命题的证明（Verified/Lean/<id>.lean），可复用定义与已证引理归档到跨项目的 VibeMath/Formal/{Lib,Proved}/。require 档带门禁：真/假结论必须先有 Lean 通过或显式阻塞记录，否则记为未定论并进入形式化待办。共用契约 docs/formal-verification.md，四套各带 formal-verify-vN 套件（v2 177 / v3 189 / v4 144 / v5 88 断言）与 audit-formal-sensitivity.mjs 探针。同一次审计还发现并修复了一整类**静态提示词面**缺陷（persona ↔ 工具注册表，既有套件全部盲）：v2/v3/v4 的 persona 从未列出无条件注册的三个 *_lean_* 工具，v4 的 vibe_v4_set 参数表漏了 formalVerify/leanCommand/leanArgs/leanTimeoutMs，v3 漏了 setup/save_settings/template，v4 漏了 vibe_v4_prompts，v5 漏了增删常驻研究员的工具、且 prefix 与 text 两个块存在文字漂移；现由 audit-persona-surface.test.mjs（197 断言：双向一致性 + 未文档化工具显式快照 + prefix/text 逐行一致 + 斜杠命令 hint/usage/实际分支三处一致 + Lean 参数/档位/路径，并生成随包发布的 prompt-corpus-persona/ 人读语料）与 audit-persona-sensitivity.mjs（11 条探针，含「未变异副本必须为绿」的对照）守护，AUDIT-CHECKLIST.md 新增 §1.6。v2.2.2 新增 v5 架构图（示例图/框架图-v5.svg + docs/generate_framework_diagram_v5.mjs 零依赖 Node 生成器 + vibe-math-v5/架构图.md 全套 Mermaid 细节图），并修复在绘制架构图时暴露的真实缺陷：会议进行中提出的验证会并发启动（会议与验证的互斥此前只做了单向），现改为排队。v2.2.1 把「全面检查必查清单」(AUDIT-CHECKLIST.md) 作为随包强制流程发布，提示词/交互正确性列为第一优先审计维度。v2.2.0 修复实测发现的提示词身份错乱：状态块改为显式接收它所描述的成员，创建成员时先落盘进编制再构造入职提示词，章程快照冻结在入职时，重建会话不再自称“刚入职”，所办调用不再被误判成某位研究员，框架反馈改为独立发送者投递，一次提示词不再重复投递同一条消息，并新增 prompt-v5-integrity 提示词完整性套件 + 可人工复核的提示词语料（随包发布）。",
     "compatibility": {
       "dshReleases": {
         "0.1.2-alpha.4": "compatible",