dsh-vibe-math 2.3.0 → 2.3.2

package/audit-formal-sensitivity.mjs

@@ -22,20 +22,23 @@
 //
 // Run: node audit-formal-sensitivity.mjs
 // ============================================================
-import { readFileSync, writeFileSync, mkdtempSync, rmSync } from 'node:fs'
+import { readFileSync, writeFileSync, mkdtempSync, rmSync, mkdirSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
-import { spawnSync } from 'node:child_process'
+import { spawn, spawnSync } from 'node:child_process'
+import { cpus } from 'node:os'
 import { fileURLToPath } from 'node:url'
 
 const REPO = fileURLToPath(new URL('.', import.meta.url))
 const dir = mkdtempSync(join(tmpdir(), 'v5-formal-sens-'))
 
 const PLUGINS = {
-  v2: { file: join(REPO, 'vibe-math-v2', 'vibe-math-v2.js'), suite: 'formal-verify-v2.test.mjs', env: 'V2_PLUGIN' },
-  v3: { file: join(REPO, 'vibe-math-v3', 'vibe-math-v3.js'), suite: 'formal-verify-v3.test.mjs', env: 'V3_PLUGIN' },
-  v4: { file: join(REPO, 'vibe-math-v4', 'vibe-math-v4.js'), suite: 'formal-verify-v4.test.mjs', env: 'V4_PLUGIN' },
-  v5: { file: join(REPO, 'vibe-math-v5', 'vibe-math-v5.js'), suite: 'formal-verify-v5.test.mjs', env: 'V5_PLUGIN' },
+  // corpusEnv: each suite writes a human-reviewable prompt corpus; concurrent probes of the SAME
+  // suite must not race on it, so every probe gets its own corpus dir.
+  v2: { file: join(REPO, 'vibe-math-v2', 'vibe-math-v2.js'), suite: 'formal-verify-v2.test.mjs', env: 'V2_PLUGIN', corpusEnv: 'V2_CORPUS_DIR' },
+  v3: { file: join(REPO, 'vibe-math-v3', 'vibe-math-v3.js'), suite: 'formal-verify-v3.test.mjs', env: 'V3_PLUGIN', corpusEnv: 'V3_CORPUS_DIR' },
+  v4: { file: join(REPO, 'vibe-math-v4', 'vibe-math-v4.js'), suite: 'formal-verify-v4.test.mjs', env: 'V4_PLUGIN', corpusEnv: 'V4_CORPUS_DIR' },
+  v5: { file: join(REPO, 'vibe-math-v5', 'vibe-math-v5.js'), suite: 'formal-verify-v5.test.mjs', env: 'V5_PLUGIN', corpusEnv: 'V5_CORPUS_DIR' },
 }
 const ORIGINAL = {}
 for (const [k, v] of Object.entries(PLUGINS)) ORIGINAL[k] = readFileSync(v.file, 'utf8')
@@ -191,56 +194,148 @@ const probes = [
     to: ", 'vibe_math_lean_run_DISABLED')" },
 ]
 
+// ── prompt-surface probes (2.3.1) ────────────────────────────────────────────────────────
+// "成员读到的文字就是产品" (AUDIT-CHECKLIST §0): the injected text is a contract, so breaking it
+// must turn the preset's suite RED. Each probe mutates ONE piece of the text agents actually read.
+// `expect` is the number of times that anchor legitimately occurs (v3 declares each reply
+// contract twice; v4/v5 document the formal contract in several prompt paths). The probe runner
+// reports SETUP-FAIL when a count drifts, so this table is self-checking.
+const DEFECT_CONTRACT_COUNT = { v2: 2, v3: 2, v4: 3, v5: 2 }
+for (const [tag, pfx] of [['v2', 'vibe_math_'], ['v3', 'vibe_math_'], ['v4', 'vibe_v4_'], ['v5', 'vibe_v5_']]) {
+  probes.push(
+    { name: tag + '-fidelity-defect-rule-removed', preset: tag, expect: 1,
+      guarantee: 'a faithfulness defect must NEVER be expressed as a vote of 0 (= 命题为假); it is a formalisation defect, not a refutation',
+      from: '发现任何偏差，不要投 0', to: '发现任何偏离一律投 0' },
+    { name: tag + '-abbreviated-tool-name-injected', preset: tag, expect: 1,
+      guarantee: 'injected text must use the REGISTERED tool name (an abbreviated lean_archive is not a tool: the agent calls nothing)',
+      from: '· ' + pfx + 'lean_archive（归档）', to: '· lean_archive（归档）' },
+    { name: tag + '-require-wording-removed', preset: tag, expect: 1,
+      guarantee: "the require gate's own wording (mandatory formalisation + the formal-required reason code) must reach the voter",
+      from: '**本模式要求**：必须产出 Lean 形式化', to: '**本模式要求**：可以不做形式化' },
+    { name: tag + '-defect-decision-not-offered', preset: tag, expect: DEFECT_CONTRACT_COUNT[tag],
+      guarantee: 'the reply contract must offer decision=defect (without it a faithfulness defect cannot be recorded at all)',
+      from: '"decision":"used|blocked|defect"', to: '"decision":"used|blocked"' },
+  )
+}
+
 let ok = 0, bad = 0
 console.log('-- Lean formal-verification sensitivity probes --')
 console.log('(a probe passes when breaking the guarantee turns that preset\'s suite RED)')
 console.log('')
 
-for (const p of probes) {
+// ── timing feedback: per-probe durations so the next run's strategy comes from data ──────
+const CONCURRENCY = (() => {
+  const arg = process.argv.find((a) => a.startsWith('--concurrency='))
+  const env = process.env.PROBE_CONCURRENCY
+  const v = Number((arg && arg.split('=')[1]) || env || Math.min(4, cpus().length))
+  return Math.max(1, Number.isFinite(v) ? v : 1)
+})()
+const ONLY = (() => {
+  const eq = process.argv.find((a) => a.startsWith('--only='))
+  if (eq) return eq.split('=')[1]
+  // also accept the space form (`--only v5`), which the usage line advertises
+  const i = process.argv.indexOf('--only')
+  return i >= 0 && process.argv[i + 1] && !process.argv[i + 1].startsWith('--') ? process.argv[i + 1] : ''
+})()
+const selected = probes.filter((p) => !ONLY || p.name.includes(ONLY) || p.preset === ONLY)
+if (process.argv.includes('--list')) {
+  for (const p of selected) console.log(p.preset + '  ' + p.name)
+  process.exit(0)
+}
+// A filter that matches nothing must FAIL, not report success: with zero probes the summary below
+// would say "0 problems / ALL PROBES RED" — a textbook false green (AUDIT-CHECKLIST §2.5).
+if (selected.length === 0) {
+  console.error('no probes matched' + (ONLY ? ' --only=' + ONLY : '') + ' — refusing to report success on an empty run')
+  process.exit(2)
+}
+
+function runAsync(cmd, args, opts) {
+  return new Promise((resolve) => {
+    const child = spawn(cmd, args, opts)
+    let out = '', err = ''
+    child.stdout.on('data', (d) => { out += d.toString() })
+    child.stderr.on('data', (d) => { err += d.toString() })
+    child.on('error', (e) => resolve({ status: null, error: e, stdout: out, stderr: err }))
+    child.on('close', (status) => resolve({ status, stdout: out, stderr: err }))
+  })
+}
+
+// One probe = one targeted mutation + one run of that preset's suite. Returns a verdict object;
+// never throws, so a single bad probe cannot take the pool down.
+async function runProbe(p) {
+  const t0 = Date.now()
   const preset = PLUGINS[p.preset]
   const original = ORIGINAL[p.preset]
-  if (p.from.startsWith('PLACEHOLDER_')) {
-    console.error('  SETUP-FAIL - ' + p.name + ': anchor not filled in yet')
-    bad++
-    continue
-  }
+  const done = (kind, detail) => ({ p, kind, detail, ms: Date.now() - t0 })
+  if (p.from.startsWith('PLACEHOLDER_')) return done('setup', 'anchor not filled in yet')
+  const want = p.expect === undefined ? 1 : p.expect
   const occurrences = original.split(p.from).length - 1
-  if (occurrences !== 1) {
-    console.error('  SETUP-FAIL - ' + p.name + ' [' + p.preset + ']: anchor matched ' + occurrences + ' times (need exactly 1)')
-    bad++
-    continue
-  }
-  const mutated = original.replace(p.from, p.to)
-  const file = join(dir, p.name + '.js')
+  if (occurrences !== want) return done('setup', 'anchor matched ' + occurrences + ' times (need exactly ' + want + ')')
+  // Mutate EVERY occurrence the anchor was asserted to have. `replace()` would only hit the first
+  // one, which silently produced a fake blind spot: the v5 reply contract is emitted in two places
+  // (replySpec + the voting prompt), so replacing just one left the other intact and the suite —
+  // correctly — stayed green.
+  const mutated = want > 1 ? original.split(p.from).join(p.to) : original.replace(p.from, p.to)
+  // One directory per probe: the mutated copy AND its corpus output (several suites write a
+  // corpus, and concurrent runs of the same suite must not race on that file).
+  const pdir = join(dir, p.name)
+  mkdirSync(pdir, { recursive: true })
+  const file = join(pdir, 'plugin.js')
   writeFileSync(file, mutated, 'utf8')
-
   // A mutation that does not even parse is red for the WRONG reason.
   const chk = spawnSync(process.execPath, ['--check', file], { encoding: 'utf8' })
-  if (chk.status !== 0) {
-    console.error('  SETUP-FAIL - ' + p.name + ': the mutated copy has a syntax error:\n' + String(chk.stderr || '').split('\n').slice(0, 4).join('\n'))
-    bad++
-    continue
-  }
-
+  if (chk.status !== 0) return done('setup', 'the mutated copy has a syntax error: ' + String(chk.stderr || '').split('\n').slice(0, 4).join(' '))
   const env = Object.assign({}, process.env)
   env[preset.env] = file
-  const r = spawnSync(process.execPath, [join(REPO, preset.suite)], { env, encoding: 'utf8', cwd: REPO })
-  if (r.status === null) {
-    console.error('  SETUP-FAIL - ' + p.name + ': the suite could not be started (' + String(r.error && r.error.message) + ')')
-    bad++
-    continue
+  if (preset.corpusEnv) env[preset.corpusEnv] = join(pdir, 'corpus')
+  const r = await runAsync(process.execPath, [join(REPO, preset.suite)], { env, encoding: 'utf8', cwd: REPO })
+  if (r.status === null) return done('setup', 'the suite could not be started (' + String(r.error && r.error.message) + ')')
+  if (r.status !== 0) return done('ok', '')
+  return done('blind', '')
+}
+
+const results = new Array(selected.length)
+let cursor = 0
+let finished = 0
+const wall0 = Date.now()
+async function worker() {
+  for (;;) {
+    const i = cursor++
+    if (i >= selected.length) return
+    const res = await runProbe(selected[i])
+    results[i] = res
+    finished++
+    const tag = '[' + String(finished).padStart(2) + '/' + selected.length + ']'
+    const secs = (res.ms / 1000).toFixed(1) + 's'
+    if (res.kind === 'ok') console.log('  ok - ' + res.p.name + ' [' + res.p.preset + '] => suite went RED as required (' + secs + ')  [' + res.p.guarantee + ']')
+    else if (res.kind === 'blind') console.error('  BLIND SPOT ' + tag + ' - ' + res.p.name + ' [' + res.p.preset + '] (' + secs + ') => suite stayed GREEN, so it does NOT detect: ' + res.p.guarantee)
+    else console.error('  SETUP-FAIL ' + tag + ' - ' + res.p.name + ' [' + res.p.preset + '] (' + secs + '): ' + res.detail)
   }
-  if (r.status !== 0) {
-    ok++
-    console.log('  ok - ' + p.name + ' [' + p.preset + '] => suite went RED as required  [' + p.guarantee + ']')
-  } else {
-    bad++
-    console.error('  BLIND SPOT - ' + p.name + ' [' + p.preset + '] => suite stayed GREEN, so it does NOT detect: ' + p.guarantee)
+}
+await Promise.all(Array.from({ length: Math.min(CONCURRENCY, selected.length) }, () => worker()))
+
+// ── timing summary: this is the feedback that decides the next run's strategy ────────────
+{
+  const wall = (Date.now() - wall0) / 1000
+  const sum = results.reduce((a, r) => a + (r ? r.ms : 0), 0) / 1000
+  const perPreset = {}
+  for (const r of results) {
+    if (!r) continue
+    perPreset[r.p.preset] = perPreset[r.p.preset] || { n: 0, s: 0 }
+    perPreset[r.p.preset].n++
+    perPreset[r.p.preset].s += r.ms / 1000
   }
+  const slow = results.filter(Boolean).slice().sort((a, b) => b.ms - a.ms).slice(0, 5)
+  console.log('')
+  console.log('-- timing --')
+  console.log('  concurrency ' + CONCURRENCY + '  ·  wall ' + wall.toFixed(1) + 's  ·  sum of probe times ' + sum.toFixed(1) + 's'
+    + '  ·  speed-up x' + (sum / Math.max(wall, 0.001)).toFixed(2))
+  console.log('  per preset: ' + Object.keys(perPreset).sort().map((k) => k + ' ' + perPreset[k].n + ' probes/' + perPreset[k].s.toFixed(0) + 's').join('  ·  '))
+  console.log('  slowest: ' + slow.map((r) => r.p.name + ' ' + (r.ms / 1000).toFixed(1) + 's').join('  ·  '))
+  ok = results.filter((r) => r && r.kind === 'ok').length
+  bad = results.filter((r) => r && r.kind !== 'ok').length
 }
 
-rmSync(dir, { recursive: true, force: true })
-console.log('')
 console.log('formal sensitivity: ' + ok + ' probes detected the break, ' + bad + ' problems')
 if (bad) process.exit(1)
 console.log('ALL FORMAL PROBES RED AS REQUIRED')

package/audit-prompt-invariants.mjs

@@ -0,0 +1,414 @@
+#!/usr/bin/env node
+/**
+ * PROMPT/INTERACTION INVARIANTS — the specific defect CLASSES this project has actually shipped,
+ * encoded as static invariants over all four presets. This is the mechanical answer to
+ * "are the prompt defects really fixed, and can they come back silently?".
+ *
+ * Every check below exists because the class was found in a real audit round:
+ *   I1  abbreviated tool names in agent-facing text   (lean_archive is not a registered tool)
+ *   I2  a fidelity defect expressed as a 0 vote        ("偏离 → 0" records 命题为假)
+ *   I3  the defect rule missing from the injected text (不要投 0 + decision:'defect')
+ *   I4  `defect` advertised but not handled by code    (the v2 dead-channel class)
+ *   I5  the reply contract not offering `defect`       (a defect would be unrecordable)
+ *   I6  a defect accepted without a reason             (silent, unauditable decisions)
+ *   I7  the wrong reply field name in the fidelity text (`verdict` where the parser reads `Result`)
+ *   I8  the `formal` reply channel live in `off` mode  (off must be a TRUE no-op)
+ *   I9  corpus non-determinism / machine-path leaks / missing mode coverage
+ *   I10 the prompt-rule sensitivity probes going missing (a guard that is not proven to go red)
+ *   I11 the "no Lean toolchain" guidance naming only one of the two failure codes
+ *   I12 the fidelity branch promising a hold that `encourage` cannot enforce
+ *   I13 the Lean switch unreachable THROUGH the closed tool schema (v3 2.3.1: all four params
+ *       missing from vibe_math_set_params, invisible to every suite because suites call handlers)
+ *   I14 a parameter the tool schema advertises but the parameter layer silently drops
+ *
+ * Run: node audit-prompt-invariants.mjs        (add --json for a machine-readable report)
+ *      node audit-prompt-invariants.mjs --self-probe
+ *          prove the guard is a guard: re-run itself on mutated sources and require the matching
+ *          invariant to go RED (control run must stay green)
+ */
+import { readFileSync, existsSync } from 'node:fs'
+import { spawnSync } from 'node:child_process'
+import { fileURLToPath } from 'node:url'
+import { join } from 'node:path'
+
+const HERE = fileURLToPath(new URL('./', import.meta.url))
+/**
+ * `PROMPT_INVARIANTS_MUTATE` carries a JSON `[rel, from, to]` triple: a single file is mutated IN
+ * MEMORY for one child run, so `--self-probe` can demonstrate that the invariant keyed to it really
+ * turns red. (Not a NUL-separated string: env values may not contain NUL bytes.)
+ */
+function readRaw(rel) {
+  const p = join(HERE, rel)
+  if (!existsSync(p)) return null
+  let text = readFileSync(p, 'utf8')
+  const mut = process.env.PROMPT_INVARIANTS_MUTATE
+  if (mut) {
+    try {
+      const [rel2, from, to] = JSON.parse(mut)
+      if (rel2 === rel && from) text = text.replace(from, to)
+    } catch (e) { /* a malformed mutation is a harness error, not an invariant failure */ }
+  }
+  return text
+}
+const read = readRaw
+
+/**
+ * Each mutation is a real defect shape from this project's history. `expect` is a substring that
+ * MUST appear in the failing run; `control: true` marks the unmutated run, which must stay green.
+ */
+const SELF_PROBE_MUTATIONS = [
+  { name: 'control (no mutation)', rel: '', from: '', to: '', expect: '', control: true },
+  {
+    name: 'v3: one set_params registration loses the Lean params (I13 — the v2.3.1 shipped defect)',
+    rel: 'vibe-math-v3/vibe-math-v3.js',
+    from: 'formalVerify: { type: \'string\'',
+    to: 'formalVerifyDISABLED: { type: \'string\'',
+    expect: 'v3 I13: every vibe_math_set_params schema advertises',
+  },
+  {
+    name: 'v3: objParams stops closing the schema (I13 premise)',
+    rel: 'vibe-math-v3/vibe-math-v3.js',
+    from: "additionalProperties: false, required: required || [] }",
+    to: 'required: required || [] }',
+    expect: 'v3 I13: every objParams definition closes tool schemas',
+  },
+  {
+    name: 'v4: the schema advertises a knob the parameter layer drops (I14)',
+    rel: 'vibe-math-v4/vibe-math-v4.js',
+    from: "leanTimeoutMs:{type:'integer'}",
+    to: "leanTimeoutMs:{type:'integer'},bogusKnob:{type:'string'}",
+    expect: 'v4 I14: every key vibe_v4_set advertises is actually accepted',
+  },
+  {
+    name: 'v5: normalizeParams stops accepting an advertised key (I14)',
+    rel: 'vibe-math-v5/vibe-math-v5.js',
+    from: "'meetingKeepEvery', 'leanTimeoutMs']",
+    to: "'meetingKeepEvery']",
+    expect: 'advertised but dropped: [leanTimeoutMs]',
+  },
+]
+
+if (process.argv.includes('--self-probe')) {
+  const bad = []
+  for (const mut of SELF_PROBE_MUTATIONS) {
+    const r = spawnSync(process.execPath, [fileURLToPath(import.meta.url), '--json'], {
+      cwd: HERE,
+      env: Object.assign({}, process.env, mut.control ? {} : { PROMPT_INVARIANTS_MUTATE: JSON.stringify([mut.rel, mut.from, mut.to]) }),
+      encoding: 'utf8',
+    })
+    let parsed = null
+    try { parsed = JSON.parse(r.stdout) } catch (e) { /* fall through to the diagnostic below */ }
+    const text = (r.stdout || '') + (r.stderr || '')
+    if (mut.control) {
+      const ok = r.status === 0 && parsed && parsed.failed === 0
+      console.log((ok ? 'PASS ' : 'FAIL ') + 'control: the unmutated run stays green (' + (parsed ? parsed.failed + ' failures' : 'unparsable output') + ')')
+      if (!ok) bad.push('control run was not green')
+      continue
+    }
+    const hit = text.includes(mut.expect)
+    const red = r.status === 1 && parsed && parsed.failed > 0
+    const ok = red && hit
+    console.log((ok ? 'PASS ' : 'FAIL ') + mut.name + (ok ? '' : '  → exit=' + r.status + ' hit=' + hit))
+    if (!ok) bad.push(mut.name + ' (exit ' + r.status + ', expected ' + JSON.stringify(mut.expect) + ')')
+  }
+  console.log('')
+  console.log('PROMPT INVARIANT SELF-PROBE: ' + (SELF_PROBE_MUTATIONS.length - bad.length) + '/' + SELF_PROBE_MUTATIONS.length + ' as required')
+  for (const b of bad) console.error('  FAIL ' + b)
+  process.exit(bad.length === 0 ? 0 : 1)
+}
+
+/**
+ * Blank out comments (line + block) while preserving string/template literals, so invariants about
+ * "text shown to an agent" do not fire on a COMMENT that quotes an anti-pattern. A naive regex
+ * would both miss block comments and mangle strings containing `//` (URLs), so this walks the
+ * source as a tiny scanner. Newlines are preserved to keep any line-based diagnostics aligned.
+ */
+function stripComments(src) {
+  const out = []
+  let i = 0
+  let state = 'code' // code | line | block | sq | dq | tpl
+  while (i < src.length) {
+    const c = src[i]
+    const c2 = src[i + 1]
+    if (state === 'code') {
+      if (c === '/' && c2 === '/') { state = 'line'; out.push('  '); i += 2; continue }
+      if (c === '/' && c2 === '*') { state = 'block'; out.push('  '); i += 2; continue }
+      if (c === "'") state = 'sq'
+      else if (c === '"') state = 'dq'
+      else if (c === '`') state = 'tpl'
+      out.push(c); i++; continue
+    }
+    if (state === 'line') {
+      if (c === '\n') { state = 'code'; out.push(c) } else out.push(' ')
+      i++; continue
+    }
+    if (state === 'block') {
+      if (c === '*' && c2 === '/') { state = 'code'; out.push('  '); i += 2; continue }
+      out.push(c === '\n' ? c : ' '); i++; continue
+    }
+    // inside a string/template: copy verbatim, honouring escapes and the closing quote
+    if (c === '\\') { out.push(c, c2 === undefined ? '' : c2); i += 2; continue }
+    if ((state === 'sq' && c === "'") || (state === 'dq' && c === '"') || (state === 'tpl' && c === '`')) state = 'code'
+    out.push(c); i++
+  }
+  return out.join('')
+}
+
+/**
+ * Balanced-bracket slice starting at src[openIdx] (one of ( [ {), string/comment aware.
+ * Used by the TOOL-SURFACE invariants (I13/I14) to read a real parameter schema out of the source.
+ */
+function balanced(src, openIdx) {
+  let depth = 0
+  let i = openIdx
+  let state = 'code'
+  while (i < src.length) {
+    const c = src[i]
+    const c2 = src[i + 1]
+    if (state === 'code') {
+      if (c === "'" || c === '"' || c === '`') { state = c; i++; continue }
+      if (c === '(' || c === '[' || c === '{') depth++
+      else if (c === ')' || c === ']' || c === '}') { depth--; if (depth === 0) return src.slice(openIdx, i + 1) }
+      i++; continue
+    }
+    if (c === '\\') { i += 2; continue }
+    if (c === state) state = 'code'
+    i++
+  }
+  return src.slice(openIdx)
+}
+/** Split an object-body on TOP-LEVEL commas only (brackets and strings respected). */
+function splitTopLevel(body) {
+  const parts = []
+  let cur = ''
+  let depth = 0
+  let state = 'code'
+  for (let i = 0; i < body.length; i++) {
+    const c = body[i]
+    const c2 = body[i + 1]
+    if (state === 'code') {
+      if (c === "'" || c === '"' || c === '`') { state = c; cur += c; continue }
+      if (c === '{' || c === '[' || c === '(') depth++
+      else if (c === '}' || c === ']' || c === ')') depth--
+      if (c === ',' && depth === 0) { parts.push(cur); cur = ''; continue }
+      cur += c; continue
+    }
+    if (c === '\\') { cur += c + (c2 || ''); i++; continue }
+    if (c === state) state = 'code'
+    cur += c
+  }
+  parts.push(cur)
+  return parts.map((p) => p.trim()).filter(Boolean)
+}
+/** Property keys of the object literal at/after `at` (null when there is no object literal there). */
+function objectKeys(src, at) {
+  const open = src.indexOf('{', at)
+  if (open < 0) return null
+  const region = balanced(src, open)
+  return splitTopLevel(region.slice(1, -1))
+    .map((p) => { const m = p.match(/^['"]?([A-Za-z_$][\w$]*)['"]?\s*:/); return m ? m[1] : null })
+    .filter(Boolean)
+}
+
+const PRESETS = [
+  { tag: 'v2', js: 'vibe-math-v2/vibe-math-v2.js', suite: 'formal-verify-v2.test.mjs', corpus: 'prompt-corpus-v2/formal-verify-v2.md', valueField: 'Result', prefix: 'vibe_math_', setTool: 'vibe_math_set_params' },
+  { tag: 'v3', js: 'vibe-math-v3/vibe-math-v3.js', suite: 'formal-verify-v3.test.mjs', corpus: 'prompt-corpus-v3/formal-verify-v3.md', valueField: 'Result', prefix: 'vibe_math_', setTool: 'vibe_math_set_params' },
+  { tag: 'v4', js: 'vibe-math-v4/vibe-math-v4.js', suite: 'formal-verify-v4.test.mjs', corpus: 'prompt-corpus-v4/formal-verify-v4.md', valueField: 'verdict', prefix: 'vibe_v4_', setTool: 'vibe_v4_set' },
+  { tag: 'v5', js: 'vibe-math-v5/vibe-math-v5.js', suite: 'formal-verify-v5.test.mjs', corpus: 'prompt-corpus-v5/prompt-corpus-v5.md', valueField: 'verdict', prefix: 'vibe_v5_', setTool: 'vibe_v5_set' },
+]
+const LEAN_PARAMS = ['formalVerify', 'leanCommand', 'leanArgs', 'leanTimeoutMs']
+
+let passed = 0
+const failures = []
+const notes = []
+function check(cond, label, detail) {
+  if (cond) { passed++; return true }
+  failures.push(label + (detail ? ' — ' + detail : ''))
+  return false
+}
+
+for (const P of PRESETS) {
+  const js = read(P.js)
+  const suite = read(P.suite)
+  const corpus = read(P.corpus)
+  if (!check(js !== null, P.tag + ': plugin source readable', P.js)) continue
+  if (!check(suite !== null, P.tag + ': suite readable', P.suite)) continue
+  if (!check(corpus !== null, P.tag + ': prompt corpus shipped', P.corpus)) continue
+
+  // I1/I2 run on the source with comments blanked: a comment may legitimately quote an
+  // anti-pattern as documentation, but any STRING can reach an agent.
+  const code = stripComments(js)
+
+  // I1 — no abbreviated tool name in code/strings (code identifiers are leanArchive / leanRunTool,
+  // so a bare lean_* token is always a string that can be shown to an agent).
+  const bare = code.match(/(^|[^A-Za-z0-9_])lean_(run|archive|lib)\b/g) || []
+  check(bare.length === 0, P.tag + ' I1: no abbreviated Lean tool name in agent-facing text', 'found ' + JSON.stringify(bare.slice(0, 3)))
+
+  // I2 — never tell a voter to answer 0 for a faithfulness defect (comments excluded).
+  check(!/偏离\s*(?:→|->|=>)\s*0/.test(code), P.tag + ' I2: no "偏离 → 0" instruction')
+
+  // I3 — the defect rule is in the injected text.
+  check(js.includes('不要投 0'), P.tag + ' I3: injected text forbids a 0 vote on a defect')
+  check(/'defect'/.test(js) || /"defect"/.test(js), P.tag + ' I3: injected text names decision=\'defect\'')
+
+  // I4 — the defect decision is actually HANDLED (comparison + a downgrade to `attempted`).
+  const comparesDefect = /(?:===|==)\s*'defect'/.test(js) || /'defect'\s*(?:===|==)/.test(js)
+  check(comparesDefect, P.tag + ' I4: the code compares decision against \'defect\'')
+  const downgrades = /status:\s*'attempted'/.test(js) || /status='attempted'/.test(js) || /status:\s*"attempted"/.test(js)
+  check(downgrades, P.tag + " I4: a defect downgrades the record to 'attempted'")
+
+  // I5 — the reply contract offers the defect decision.
+  const contractCount = js.split('"decision":"used|blocked|defect"').length - 1
+  check(contractCount >= 1, P.tag + ' I5: the reply contract offers used|blocked|defect', 'occurrences=' + contractCount)
+
+  // I6 — a defect without a reason is refused.
+  check(/!note/.test(js), P.tag + ' I6: a defect/blocker without a note is rejected')
+
+  // I7 — the fidelity instruction names the field the parser really reads.
+  {
+    const lines = js.split(/\r?\n/)
+    const i = lines.findIndex((l) => l.includes('不要投 0'))
+    const window = i >= 0 ? lines.slice(Math.max(0, i - 3), i + 8).join('\n') : ''
+    check(i >= 0 && window.includes(P.valueField),
+      P.tag + ' I7: the fidelity instruction names ' + P.valueField + ' (the real reply field)',
+      i < 0 ? 'the 不要投 0 rule was not found' : 'window: ' + window.slice(0, 120).replace(/\n/g, ' | '))
+    if (P.tag === 'v2' || P.tag === 'v3') {
+      check(!/给出\s*verdict/.test(js), P.tag + ' I7b: no "给出 verdict" in a Result-based preset')
+    }
+  }
+
+  // I8 — the `formal` reply channel is inert in off mode (tools stay usable on purpose).
+  const offGuards = {
+    v2: /absorbFormal(?:From)?Reply[\s\S]{0,900}!formalOn\(\)/,
+    v3: /absorbFormal(?:From)?Reply[\s\S]{0,900}!formalOn\(\)/,
+    v4: /applyFormalReply[\s\S]{0,900}!formalOn\(\)/,
+    v5: /formalOn\(\)\s*&&\s*p\.formal/,
+  }
+  check(offGuards[P.tag].test(js), P.tag + ' I8: the reply channel is gated on formalOn() (off stays a no-op)')
+
+  // I9 — the corpus covers every mode and is deterministic / machine-path free.
+  check(corpus.includes('【Lean 形式化验证（鼓励模式）】'), P.tag + ' I9: corpus covers encourage mode')
+  check(corpus.includes('【Lean 形式化验证（强制模式）】'), P.tag + ' I9: corpus covers REQUIRE mode')
+  check(corpus.includes('不要投 0'), P.tag + ' I9: corpus contains the fidelity/defect rule')
+  check(/used\|blocked\|defect/.test(corpus), P.tag + ' I9: corpus contains the reply contract line')
+  check(/【顺手形式化/.test(corpus), P.tag + ' I9: corpus contains the work-round line')
+  check(!/[A-Za-z]:[\\/]/.test(corpus), P.tag + ' I9: corpus leaks no absolute path')
+  check(!/\d{4}-\d{2}-\d{2}[ T]\d{2}:\d{2}/.test(corpus), P.tag + ' I9: corpus carries no timestamp (deterministic)')
+  check(!/vibe-v[0-9]-[a-z]+-[A-Za-z0-9]{4,}/.test(corpus), P.tag + ' I9: corpus leaks no temp-dir name')
+
+  // I10 — the prompt-rule probes exist for this preset (a guard nobody can prove is a guard nobody has).
+  const probeSrc = read('audit-formal-sensitivity.mjs') || ''
+  for (const kind of ['fidelity-defect-rule-removed', 'abbreviated-tool-name-injected', 'require-wording-removed', 'defect-decision-not-offered']) {
+    check(probeSrc.includes("tag + '-" + kind + "'") || probeSrc.includes("'" + P.tag + '-' + kind + "'"),
+      P.tag + ' I10: probe exists for ' + kind)
+  }
+
+  // I10b — the suite asserts the defect path (behaviourally, not just wording).
+  check(/\bdefect\b/.test(suite), P.tag + ' I10b: the suite exercises the defect path')
+
+  // I11 — the "no toolchain" guidance must name BOTH failure codes. An agent that only knows
+  // LEAN_NOT_FOUND treats NO_SUBPROCESS as an unknown failure and retries instead of recording the
+  // blocker (contract §6 hard rule 4).
+  {
+    const lines = js.split(/\r?\n/)
+    const gi = lines.findIndex((l) => l.includes('宿主无 Lean 工具链'))
+    const win = gi >= 0 ? lines.slice(Math.max(0, gi - 3), gi + 1).join('\n') : ''
+    check(gi >= 0 && /LEAN_NOT_FOUND/.test(win) && /NO_SUBPROCESS/.test(win),
+      P.tag + ' I11: the no-toolchain guidance names LEAN_NOT_FOUND AND NO_SUBPROCESS',
+      gi < 0 ? 'the guidance line was not found' : 'window: ' + win.slice(0, 140).replace(/\n/g, ' | '))
+  }
+
+  // I12 — the fidelity branch must qualify its promise BY MODE. Only `require` has a gate, so the
+  // text must say "本次裁定不定论" for require AND explicitly tell the voter, for encourage, that
+  // this mode has no gate and their abstention is what prevents a conclusion. Shipping the
+  // unconditional claim was a real defect that survived in three presets after v5 was fixed.
+  check(js.includes('本档没有门禁'), P.tag + ' I12: the fidelity text states the encourage branch has no gate')
+  check(js.includes('本次裁定**不定论**') || js.includes('本次裁定不定论'), P.tag + ' I12: the fidelity text states the require hold')
+
+  // I13 — the Lean switch must be REACHABLE THROUGH THE TOOL SCHEMA. Every tool schema here is
+  // built by `objParams`, which closes it with `additionalProperties:false`: a key the schema does
+  // not list is REJECTED by any schema-validating provider. v3 shipped 2.3.0/2.3.1 with all four
+  // Lean params missing from `vibe_math_set_params` and every suite stayed green, because the
+  // suites call the handler directly and never look at the schema — the feature could not be turned
+  // on at all. So: EVERY registration of the parameter tool (v2/v3 register it twice, for two agent
+  // scopes) must advertise all four, and the closed-schema premise must still hold.
+  {
+    // EVERY objParams definition must close its schema: one open definition (v2/v3 define it twice,
+    // for two agent scopes) would let tools registered through it accept arbitrary keys.
+    const defs = [...code.matchAll(/function objParams\(/g)].map((m) => m.index)
+    const closedDefs = defs.filter((i) => /additionalProperties:\s*false/.test(code.slice(i, i + 220)))
+    check(defs.length > 0 && closedDefs.length === defs.length,
+      P.tag + ' I13: every objParams definition closes tool schemas (additionalProperties:false)',
+      'definitions=' + defs.length + ' closed=' + closedDefs.length +
+      (defs.length ? '; if this is gone the schema no longer rejects unlisted keys and I13 loses its premise' : ''))
+    const regRe = new RegExp("registerTool\\(\\s*['\"]" + P.setTool + "['\"]", 'g')
+    const schemas = []
+    let m
+    while ((m = regRe.exec(code))) {
+      const rest = code.slice(m.index)
+      const oi = rest.indexOf('objParams(')
+      schemas.push(oi < 0 ? null : objectKeys(rest, oi + 'objParams'.length))
+    }
+    check(schemas.length >= 1, P.tag + ' I13: the parameter tool ' + P.setTool + ' is registered',
+      'no registerTool(\'' + P.setTool + '\') call found')
+    const bad = schemas.map((s, i) => (s === null ? 'reg#' + i + ': no objParams schema'
+      : LEAN_PARAMS.filter((k) => !s.includes(k)))).filter((x) => (Array.isArray(x) ? x.length : true))
+    check(schemas.length >= 1 && bad.length === 0,
+      P.tag + ' I13: every ' + P.setTool + ' schema advertises ' + LEAN_PARAMS.join('/'),
+      bad.length ? JSON.stringify(bad) : 'no registration found')
+
+    // I14 — a key the schema ACCEPTS must really be accepted by the parameter layer. Otherwise the
+    // tool advertises a knob that is silently dropped: the caller sees {ok:true} and nothing changes.
+    // The accept gate is DEFAULT_PARAMS for v2/v3/v4 (`if (k in params)`) and the typed lists inside
+    // normalizeParams for v5 (only those keys are copied through).
+    let accepts = null
+    if (P.tag === 'v5') {
+      const fn = code.indexOf('function normalizeParams')
+      const region = fn < 0 ? '' : balanced(code, code.indexOf('{', fn))
+      const names = []
+      for (const kind of ['ints', 'bools', 'strs', 'arrs']) {
+        const ai = region.indexOf('const ' + kind + ' = [')
+        if (ai < 0) continue
+        const arr = balanced(region, region.indexOf('[', ai))
+        for (const lit of arr.match(/'[A-Za-z_$][\w$]*'/g) || []) names.push(lit.slice(1, -1))
+      }
+      accepts = names.length ? [...new Set(names)] : null
+    } else {
+      const di = code.indexOf('DEFAULT_PARAMS =')
+      accepts = di < 0 ? null : objectKeys(code, di)
+    }
+    check(accepts !== null && accepts.length > 0, P.tag + ' I14: the parameter accept-set is readable',
+      'extractor found no parameter set — the invariant cannot be checked')
+    const union = [...new Set(schemas.filter(Boolean).flat())]
+    const dropped = accepts ? union.filter((k) => !accepts.includes(k)) : []
+    check(accepts !== null && dropped.length === 0,
+      P.tag + ' I14: every key ' + P.setTool + ' advertises is actually accepted (no silently-dropped knob)',
+      'advertised but dropped: [' + dropped.join(',') + ']')
+    check(union.length >= LEAN_PARAMS.length, P.tag + ' I14: the parameter schema was parsed (' + union.length + ' keys)',
+      'schema extraction returned ' + union.length + ' keys')
+  }
+
+  notes.push(P.tag + ': plugin ' + js.length + 'B · suite ' + suite.length + 'B · corpus ' + corpus.length + 'B')
+}
+
+// Cross-preset: the probe script must refuse to report success on an empty selection (false green).
+{
+  const probeSrc = read('audit-formal-sensitivity.mjs') || ''
+  check(/selected\.length === 0/.test(probeSrc), 'X1: the probe runner fails on an empty selection instead of reporting success')
+  const runner = read('run-tests.mjs') || ''
+  check(/no suites matched/.test(runner), 'X2: the suite runner fails when no suite matches')
+  check(/argv\[i \+ 1\]/.test(runner) && /argv\[\+\+i\]/.test(runner), 'X3: the suite runner accepts both --flag=x and --flag x')
+}
+
+const out = { passed, failed: failures.length, failures, notes }
+if (process.argv.includes('--json')) {
+  console.log(JSON.stringify(out, null, 2))
+} else {
+  console.log('-- prompt/interaction invariants (all four presets) --')
+  for (const n of notes) console.log('  note ' + n)
+  console.log('')
+  for (const f of failures) console.error('  FAIL ' + f)
+  console.log('')
+  console.log('PROMPT INVARIANTS: ' + passed + ' passed, ' + failures.length + ' failed')
+}
+process.exit(failures.length === 0 ? 0 : 1)