dsh-vibe-math 2.3.1 → 2.3.2

package/formal-verify-v5.test.mjs

@@ -70,7 +70,17 @@ const leanRuns = []
 // This mirrors the one property that matters for the feature — an exit code that says
 // "the kernel accepted this".
 let toolchainAvailable = true
-const subprocess = {
+// A host with NO `subprocess` service at all: `ctx.get('subprocess')` returns undefined, which
+// must become a readable NO_SUBPROCESS result (and must NOT stop the code from being archived).
+let noSubprocess = false
+// A run that HANGS: `hangLean` makes the fake toolchain return a `done` that only settles
+// after `hangMs` (far beyond any cap the tests use), so the run can only be reported as a
+// timeout by actually racing `done` against a timer. `terminations` records every
+// `handle.terminate()` call, which is the observable proof that the guard fired.
+let hangLean = false
+let hangMs = 60000
+const terminations = []
+let subprocess = {
   async resolveExecutable(cmd) {
     if (!toolchainAvailable) throw new Error('spawn lean ENOENT')
     if (String(cmd) !== 'lean') throw new Error('unknown executable ' + cmd)
@@ -83,13 +93,16 @@ const subprocess = {
     leanRuns.push({ argv: spec.argv.slice(0, -1), file, cwd: spec.cwd })
     const stdout = bad ? '' : 'ok\n'
     const stderr = bad ? 'error: declaration uses sorry\n' : ''
+    const done = hangLean
+      ? new Promise(r => setTimeout(() => r({ exitCode: 0, signal: null }), hangMs))
+      : Promise.resolve({ exitCode: bad ? 1 : 0, signal: null })
     return {
-      done: Promise.resolve({ exitCode: bad ? 1 : 0, signal: null }),
+      done,
       collected: {
         stdout: { readFrom: () => ({ text: stdout, nextOffset: stdout.length, lossy: false }) },
         stderr: { readFrom: () => ({ text: stderr, nextOffset: stderr.length, lossy: false }) },
       },
-      terminate() {},
+      terminate() { terminations.push(file) },
     }
   },
 }
@@ -125,7 +138,7 @@ const ctx = {
     if (name === 'sessionProjections') return projections
     if (name === 'sandboxPolicy') return undefined
     if (name === 'compaction') return undefined
-    if (name === 'subprocess') return subprocess
+    if (name === 'subprocess') return noSubprocess ? undefined : subprocess
     return undefined
   },
   on(e, fn) { (listeners[e] = listeners[e] || []).push(fn) },
@@ -291,6 +304,41 @@ assert(!/形式化/.test(readIf(join(instRootOf(RA), 'Verified', '命题', 'p-of
 assert(!!toolRegs.find(t => t.name === 'vibe_v5_lean_run') && !!toolRegs.find(t => t.name === 'vibe_v5_lean_archive') && !!toolRegs.find(t => t.name === 'vibe_v5_lean_lib'),
   'the three Lean tools are registered in every mode (registration is static)')
 
+// ★ The mode switch must be REACHABLE THROUGH THE TOOL SCHEMA (2.3.2 defect D1) ──────────────
+// Every tool schema here is closed (`additionalProperties:false`), so a key the schema does not
+// advertise is REJECTED by any schema-validating provider. v3 shipped 2.3.0/2.3.1 with all four Lean
+// parameters missing from the set-params schema while every assertion in this file stayed green —
+// because the suite calls the handler DIRECTLY and never inspects the registered schema. The feature
+// could not be switched on at all through the tool interface.
+{
+  const setSpec = toolRegs.find((t) => t.name === 'vibe_v5_set')
+  assert(!!setSpec, "vibe_v5_set is registered")
+  assert(setSpec.parameters && setSpec.parameters.type === 'object' && setSpec.parameters.additionalProperties === false,
+    '★ vibe_v5_set publishes a CLOSED object schema (an unlisted key is rejected, so the schema IS the contract)')
+  for (const k of ['formalVerify', 'leanCommand', 'leanArgs', 'leanTimeoutMs']) {
+    assert(Object.prototype.hasOwnProperty.call(setSpec.parameters.properties, k),
+      '★ the registered schema advertises ' + k + ' (every other surface documents it; a schema that omits it makes the switch unreachable)')
+  }
+  assert(JSON.stringify(setSpec.parameters.properties.formalVerify.enum) === JSON.stringify(['off', 'encourage', 'require']),
+    'the schema narrows formalVerify to the three real modes (a typo must not be a fourth)')
+}
+
+// A stray `formal` reply in OFF mode must be INERT: the field is not offered in the reply contract
+// there, and honouring it would create Formal/ state in a mode documented as a "TRUE no-op" (the
+// TOOLS stay usable on purpose — a tool call is deliberate, a stray reply field is not).
+{
+  const wOff = await wakeAndReply(RA, 'r-1', {
+    progress: '关模式下的普通回轮。',
+    formal: { target: 'p-off-stray', decision: 'blocked', note: '不应被记录' },
+    contextPct: 20,
+  })
+  assert(!!wOff, 'off mode: a wake carrying a stray formal reply was fed to the framework')
+  const stOff2 = await callTool('vibe_v5_status', {}, RA)
+  assert((stOff2.formal.objects || []).length === 0, '★ a stray `formal` reply in off mode records NO formal object')
+  assert((stOff2.formal.todo || []).length === 0, '★ and adds nothing to the formalization TODO')
+  assert(!/p-off-stray/.test(readIf(join(instRootOf(RA), 'Formal', 'TODO.md'))), '★ and writes no TODO entry for it')
+}
+
 // ---------- 2. parameter validation ----------
 section('2 parameter validation and runtime switching')
 const RB = makeRoot()
@@ -333,6 +381,7 @@ await settle(); delivered.length = 0; await drainWakes(3, RC)
   assert(/一旦 Lean 通过，你唯一需要确认的就是忠实性/.test(vp), 'the voting prompt states that a passing Lean run shrinks the question to fidelity')
   assert(/归档可复用定义\/引理前先跑通/.test(vp), 'the voting prompt requires a GREEN RUN before archiving a reusable definition')
   assert(/LEAN_NOT_FOUND/.test(vp) && /宿主无 Lean 工具链/.test(vp), 'the voting prompt says what to do when the host has no Lean toolchain')
+  assert(/NO_SUBPROCESS/.test(vp), '§6 rule 4: the no-toolchain route names NO_SUBPROCESS too (an agent that only knows LEAN_NOT_FOUND treats a service-less host as an unknown failure and retries)')
   assert(noBareLeanTool(vp), 'no abbreviated tool name appears in the injected voting prompt')
   assert(/实现难度/.test(vp), 'the voting prompt asks for the implementation-difficulty judgement')
   assert(/可以不做，但请在回执的 formal 字段写明难度判断/.test(vp), "'encourage' explicitly allows skipping (with a recorded judgement)")
@@ -376,6 +425,42 @@ const runNoTc = await callTool('vibe_v5_lean_run', { file: 'Formal/good.lean' },
 assert(runNoTc.ok === false && runNoTc.code === 'LEAN_NOT_FOUND', 'a missing toolchain returns LEAN_NOT_FOUND instead of crashing')
 assert(/仍可把形式化代码写下来归档/.test(runNoTc.message), 'the failure explains the graceful degradation')
 toolchainAvailable = true
+// docs/formal-verification.md §7: a TIMEOUT must TERMINATE the process. `graceMs` is only a
+// request to the host, so a run whose `done` never settles within the cap must be ended by
+// `handle.terminate()` — otherwise a runaway toolchain lingers while we report LEAN_TIMEOUT.
+{
+  const before = terminations.length
+  hangLean = true
+  hangMs = 60000
+  const runHang = await callTool('vibe_v5_lean_run', { file: 'Formal/good.lean', timeout_ms: 1000 }, childAgent(childOf(RD, 'r-1')))
+  hangLean = false
+  assert(runHang.ok === false && runHang.code === 'LEAN_TIMEOUT', '★ a run that outlives the cap is reported as LEAN_TIMEOUT (got ' + runHang.code + ')')
+  assert(runHang.timedOut === true, 'the result is flagged timedOut')
+  assert(terminations.slice(before).some(f => /good\.lean$/.test(String(f))), '★ the timeout path really called handle.terminate() (the toolchain is not left running)')
+  assert(runHang.signal === 'SIGTERM', 'the synthetic outcome names the signal that ended it')
+}
+// A host that exposes NO `subprocess` service must produce the readable NO_SUBPROCESS result
+// (never a throw into the scheduler), must leave the object record honest (`attempted`, and NOT
+// passed), and must still let the code be written down through the archive route.
+{
+  noSubprocess = true
+  const runNoSvc = await callTool('vibe_v5_lean_run', { file: 'Formal/good.lean', target: 'p-nosub' }, childAgent(childOf(RD, 'r-1')))
+  assert(runNoSvc.ok === false && runNoSvc.code === 'NO_SUBPROCESS', '★ a host with no subprocess service returns NO_SUBPROCESS instead of throwing (got ' + runNoSvc.code + ')')
+  assert(typeof runNoSvc.message === 'string' && /no subprocess service/.test(runNoSvc.message), 'the result explains why Lean cannot run here')
+  const stNoSvc = await callTool('vibe_v5_status', {}, RD)
+  assert(stNoSvc.ok === true, 'the institute still answers status after that (nothing was thrown into the scheduling loop)')
+  const recNoSvc = (stNoSvc.formal.objects || []).find(o => o.target === 'p-nosub') || {}
+  assert(recNoSvc.status === 'attempted', 'the run is recorded as attempted (no toolchain = no proof), got ' + recNoSvc.status)
+  assert(!recNoSvc.proof, 'and it is NOT recorded as passed')
+  // The way out (contract §6 rule 4): the code can still be written down. The archive route
+  // itself needs no toolchain at all.
+  const arcNoSvc = await callTool('vibe_v5_lean_archive', { kind: 'proof', target: 'p-nosub', content: 'theorem p_nosub : 1 + 1 = 2 := by decide\n' }, childAgent(childOf(RD, 'r-1')))
+  assert(arcNoSvc.ok === true && arcNoSvc.passed === false && arcNoSvc.run && arcNoSvc.run.code === 'NO_SUBPROCESS',
+    'the code is still written down and archived with no toolchain, and the record stays honest (' + JSON.stringify({ ok: arcNoSvc.ok, status: arcNoSvc.status, code: arcNoSvc.run && arcNoSvc.run.code }) + ')')
+  assert(existsSync(join(instD, 'Formal', 'p-nosub.lean')), 'the working file exists on disk even though nothing could execute it')
+  assert(!existsSync(join(instD, 'Verified', 'Lean', 'p-nosub.lean')), '★ nothing is promoted to Verified/Lean/ without a green run')
+  noSubprocess = false
+}
 
 // ---------- 5. archive a proof → the vote becomes a FIDELITY review ----------
 section('5 a passing proof flips the review subject to fidelity')
@@ -405,6 +490,8 @@ await settle(); delivered.length = 0; await drainWakes(3, RD)
   assert(/形式化不合格/.test(vp), 'it names the failure a formalisation defect, not a refutation')
   assert(/decision:'defect'/.test(vp), 'it names the defect reply channel')
   assert(!/偏离 → 0/.test(vp), '★ the old "any deviation → 0" instruction is GONE')
+  assert(/本档没有门禁：请务必给一个严格介于 0 与 1 之间的弃权值，以保证本轮无法得出一致结论/.test(vp),
+    '★ encourage mode is explicit that there is NO gate and the voter\'s abstention is what prevents a conclusion (wording shared with v2/v3/v4)')
   assert(noBareLeanTool(vp), 'no abbreviated tool name appears in the fidelity prompt')
 }
 await drainWakes(10, RD)

package/installer.js

@@ -52,7 +52,9 @@ const PRESETS = [
   {
     src: 'vibe-math-v5',
     dst: 'vibe-math-v5',
-    files: ['agent.cordis.yml', 'preset.yml', 'vibe-math-v5.js', '实现方案.md'],
+    // 架构图.md belongs here for the same reason 实现方案.md does: the installer's policy is to put
+    // the preset's documentation next to the preset, and the shipped v5 directory carries both.
+    files: ['agent.cordis.yml', 'preset.yml', 'vibe-math-v5.js', '实现方案.md', '架构图.md'],
   },
 ]
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-vibe-math",
   "description": "Multi-agent mathematical problem-solving & verification frameworks for DeepSeek Harness — FOUR agent presets in one install: vibe-math-v2 (probability-driven: qs.json + Propos knowledge base + explorer→solver→review/debate verdict), vibe-math-v3 (THIRD-generation, recommended: paper-style Markdown knowledge base with Problems/Progress/Propos/Methods/Verified + planner-agent scheduling that decides the next N actions + universal theory/method invention library + agents write their own Markdown directly via a per-file write lock), and vibe-math-v4 (FOURTH-generation: persistent self-organizing resident subagents that message & meet to decide all tasks, verify only by unanimous consensus, /compact at a context threshold, and stop only when all agree the problem is solved), and vibe-math-v5 (FIFTH-generation research institute: an academician as the organizational centre who decomposes and ASSIGNS work and chairs meetings; permanent researchers who hold the vote and may hire/fire their own temp workers; temp workers with no vote; a group chat and meetings; a durable per-recipient mailbox; a compare-and-set task DAG; and a boolean m-vote consensus rule where an object enters Verified/ only when at least m voting members agree AND every one of them returns exactly 1 or exactly 0). Installing this bundle auto-installs all four presets (v1 was removed at v2.0.0).",
-  "version": "2.3.1",
+  "version": "2.3.2",
   "type": "module",
   "engines": {
     "node": "^22.19.0 || >=24.0.0"
@@ -17,6 +17,8 @@
     "audit-formal-sensitivity.mjs",
     "audit-persona-sensitivity.mjs",
     "audit-persona-surface.test.mjs",
+    "audit-prompt-invariants.mjs",
+    "audit-spec-traceability.mjs",
     "audit-v5-integrity.mjs",
     "audit-v5-sensitivity.mjs",
     "cordis.patch.yml",
@@ -35,6 +37,7 @@
     "RELEASE-NOTES-2.2.2.md",
     "RELEASE-NOTES-2.3.0.md",
     "RELEASE-NOTES-2.3.1.md",
+    "RELEASE-NOTES-2.3.2.md",
     "selfdrive-v5.mjs",
     "示例图/框架图-v5.svg",
     "docs/架构图.md",
@@ -98,7 +101,7 @@
     },
     "minVersion": "0.1.2-rc.1",
     "testedVersion": "0.1.5-rc.2",
-    "compatNote": "依赖宿主提供的 subagents/agents/tools/commands/fs 服务与 @deepseek-ai/dsh-* 插件行；可选 subprocess/sandboxPolicy/compaction。persona 行同时携带 prefix 与 text 两个键，以兼容 0.1.3-alpha.2 的 schema 更名（prefix 必填）与 0.1.2 及更早的 text 键。已在 dsh-v0.1.5-rc.2（@deepseek-ai/dsh-persona 0.1.5-rc.2）上逐行校验全部预设行并通过（v2/v3/v4；v1 已于 v2.0.0 移除）。注意：DSH 0.1.2 起 subagents.startContinuable 的 agentOptions/toolFilter 需要宿主 provider 声明对应 capability（spawn/fork 进程内 provider 均支持），安装器启动时会做能力自检并在旧版宿主上告警。2026 兼容性修复：v2/v3 工具权限名表原先硬编码 web/fetch/bash（未注册名会使 tools.restrict() 抛错、子代理无法建立），现按真实注册名并加带守卫的重试；v4 真实 /compact 原先在 subagent/end 里查 agents.get()（该事件触发时子代理已移出注册表，属死代码），现改为在 subagent/start 捕获 Agent 引用；三套预设的可选服务改为惰性读取，不再在 apply() 快照；v4 的 tools/commands 注册补入 ctx.effect；安装器自检新增 subprocess/sandboxPolicy/compaction。v2.1.0 新增 v5 研究所体系：状态存于宿主 host-only 会话投影单元（键 vibeMathV5），因此自检新增 sessionProjections/sessions（均为可选；缺失时 v5 回退到加固 JSON 状态文件）。v5 不依赖任何 npm 实验包，纯 preset 内单文件实现。v2.3.1 是审计驱动的提示词/交互修复版（无破坏性变更，默认仍为 off）：① 忠实性缺陷不再被记成「命题为假」——新增回执取值 decision='defect'（表决者发现 Lean 代码与命题原文不一致时不得投 0，给中间值并记录具体偏差；框架随即把该对象降级为 attempted、清空 proof、撤回归档证明 Verified/Lean/<id>.lean、写入 Formal/TODO.md，require 档下本次裁定不定论），encourage 档不承诺它无法强制的搁置；② 修复 v2 的 formal 回执通道是死代码（提示词要求写进回执、契约里却没有该字段、框架也从不解析）——补齐 formalJsonField/formalReplyNote/absorbFormalFromReply 并接进初评与辩论两条路径，套件改为行为断言而非措辞断言；③ 修复 v2/v3 忠实性分支的字段名错误（写成 verdict，真实字段是 Result，会导致该票被静默丢弃）；④ 注入文本里的工具名一律改为注册名全称（v2/v3/v5 原先出现 lean_lib/lean_archive 缩写，含工具自身返回的 hint）；⑤ 新增「归档可复用定义/引理前先跑通」与「宿主无 Lean 工具链（LEAN_NOT_FOUND）时把代码归档并在 note 写明，算显式阻塞原因」两条硬要求；⑥ 四套各自新增随包发布的人工复核语料 prompt-corpus-vN/（覆盖 off/encourage/require/忠实性/工作轮/回执契约），并修复 v5 语料路径归一化在 Windows 大小写差异下漏掉 VibeMath 根绝对路径、导致语料不确定且泄露本机路径的问题；⑦ 新增 16 条提示词灵敏度探针（删掉「不要投 0」、工具名换缩写、删掉 require 门禁措辞、回执契约去掉 defect，各四套），全套件断言 v2 261 / v3 247 / v4 226 / v5 120 / prompt-v5-integrity 588。v2.3.0 为四个架构新增可调控的 Lean 形式化验证（参数 formalVerify = off/encourage/require，默认 off）：验证时按实现难度决定是否用 Lean 形式化（写代码+执行），一旦通过则审查对象从「推导是否正确」变成「Lean 的定义/对象/条件/假设/结论是否忠实于命题原文」；形式化代码归档为命题的证明（Verified/Lean/<id>.lean），可复用定义与已证引理归档到跨项目的 VibeMath/Formal/{Lib,Proved}/。require 档带门禁：真/假结论必须先有 Lean 通过或显式阻塞记录，否则记为未定论并进入形式化待办。共用契约 docs/formal-verification.md，四套各带 formal-verify-vN 套件（v2 177 / v3 189 / v4 144 / v5 88 断言）与 audit-formal-sensitivity.mjs 探针。同一次审计还发现并修复了一整类**静态提示词面**缺陷（persona ↔ 工具注册表，既有套件全部盲）：v2/v3/v4 的 persona 从未列出无条件注册的三个 *_lean_* 工具，v4 的 vibe_v4_set 参数表漏了 formalVerify/leanCommand/leanArgs/leanTimeoutMs，v3 漏了 setup/save_settings/template，v4 漏了 vibe_v4_prompts，v5 漏了增删常驻研究员的工具、且 prefix 与 text 两个块存在文字漂移；现由 audit-persona-surface.test.mjs（197 断言：双向一致性 + 未文档化工具显式快照 + prefix/text 逐行一致 + 斜杠命令 hint/usage/实际分支三处一致 + Lean 参数/档位/路径，并生成随包发布的 prompt-corpus-persona/ 人读语料）与 audit-persona-sensitivity.mjs（11 条探针，含「未变异副本必须为绿」的对照）守护，AUDIT-CHECKLIST.md 新增 §1.6。v2.2.2 新增 v5 架构图（示例图/框架图-v5.svg + docs/generate_framework_diagram_v5.mjs 零依赖 Node 生成器 + vibe-math-v5/架构图.md 全套 Mermaid 细节图），并修复在绘制架构图时暴露的真实缺陷：会议进行中提出的验证会并发启动（会议与验证的互斥此前只做了单向），现改为排队。v2.2.1 把「全面检查必查清单」(AUDIT-CHECKLIST.md) 作为随包强制流程发布，提示词/交互正确性列为第一优先审计维度。v2.2.0 修复实测发现的提示词身份错乱：状态块改为显式接收它所描述的成员，创建成员时先落盘进编制再构造入职提示词，章程快照冻结在入职时，重建会话不再自称“刚入职”，所办调用不再被误判成某位研究员，框架反馈改为独立发送者投递，一次提示词不再重复投递同一条消息，并新增 prompt-v5-integrity 提示词完整性套件 + 可人工复核的提示词语料（随包发布）。",
+    "compatNote": "依赖宿主提供的 subagents/agents/tools/commands/fs 服务与 @deepseek-ai/dsh-* 插件行；可选 subprocess/sandboxPolicy/compaction。persona 行同时携带 prefix 与 text 两个键，以兼容 0.1.3-alpha.2 的 schema 更名（prefix 必填）与 0.1.2 及更早的 text 键。已在 dsh-v0.1.5-rc.2（@deepseek-ai/dsh-persona 0.1.5-rc.2）上逐行校验全部预设行并通过（v2/v3/v4；v1 已于 v2.0.0 移除）。注意：DSH 0.1.2 起 subagents.startContinuable 的 agentOptions/toolFilter 需要宿主 provider 声明对应 capability（spawn/fork 进程内 provider 均支持），安装器启动时会做能力自检并在旧版宿主上告警。2026 兼容性修复：v2/v3 工具权限名表原先硬编码 web/fetch/bash（未注册名会使 tools.restrict() 抛错、子代理无法建立），现按真实注册名并加带守卫的重试；v4 真实 /compact 原先在 subagent/end 里查 agents.get()（该事件触发时子代理已移出注册表，属死代码），现改为在 subagent/start 捕获 Agent 引用；三套预设的可选服务改为惰性读取，不再在 apply() 快照；v4 的 tools/commands 注册补入 ctx.effect；安装器自检新增 subprocess/sandboxPolicy/compaction。v2.1.0 新增 v5 研究所体系：状态存于宿主 host-only 会话投影单元（键 vibeMathV5），因此自检新增 sessionProjections/sessions（均为可选；缺失时 v5 回退到加固 JSON 状态文件）。v5 不依赖任何 npm 实验包，纯 preset 内单文件实现。v2.3.2 是对四个架构各做一轮深度审计 + 横向同构对照后的修复版（无破坏性变更，默认仍为 off），修掉三处会让「严格验证」失效或不可用的高危缺陷：① v3 的四个 Lean 参数从未写进 vibe_math_set_params 的参数 schema（该 schema 是 additionalProperties:false，遵守 schema 的 provider 会拒绝这个调用）→ 用户永远无法开启该功能，而套件全绿（它直接调 handler、绕过 schema）；② v2 的 require 门禁只读验证侧自己的 id，而代理用对象 id 归档、别名同步只更新已存在的键 → 「归档了 passed、验证侧还没有记录」时门禁永远搁置，搁置本身又写下 rId=none，于是每轮重开一次辩论、对象永远无法定论并饿死其它对象；③ v4 的 formalSetRun 硬编码 status=attempted，把已验证对象的 passed 抹掉（与注释、规格、v2/v5 都矛盾）→ 一次随手 lean_run 就让对象丢掉「已形式化」，忠实性分支消失、require 档对已有绿色证明的对象重新关门。另修 v2 的一处门禁旁路（settleVerdict 的「判断命题」转移在 v=0 时直接写 布尔估计=0/已验证/优先级 never 并压入 正确概率:1 条目，完全不看门禁）。撤回语义按 v5 的正确做法统一四套：撤回归档证明时先删、再用 fs 复核文件真的没了、仍在则就地覆盖为撤回说明，并如实公告是哪一种（含两者都失败的告警）；lean_archive kind=proof 跑红时不再保留 prev.proof（proof 只属于 passed）并撤回旧的归档证明。提示词/交互修复：忠实性分支改为按档位承诺（只有 require 有门禁，encourage 明确写「本档没有门禁：请务必给弃权值」）；无 Lean 工具链的出路同时点名 LEAN_NOT_FOUND 与 NO_SUBPROCESS；v3 的失败提示不再让人去看并不存在的编译器输出；v4 活动日志里的缩写工具名改为注册名（并纳入注入文本扫描）；v2 的工作轮不再把可复用引理指向项目内不存在的 Formal/Proved/；v2 的 kind=def/lemma 跑红不再声称可复用；v3 setup 的重复 plannerPersona 去重；v4 规格里的幽灵工具 vibe_v4_propose_verify 修正为回执字段。语料确定性：v5 语料此前的非确定有三层根因（心跳/会议依赖真实时钟与异步顺序、最闲成员抖动、写入端只按 kind 排序），现由套件虚拟时钟 + 单成员研究所内捕捉心跳 + 写入端全序排序（kind→owner→prompt）修复，连跑 6 次字节一致且套件 7–9 s → 1.7 s；v3 的 20 条 planner:* 随机 plan id 与 epoch 时间戳一并 scrub。新增两个随包发布的常驻守卫：audit-prompt-invariants.mjs（四套 × 26 条静态不变式 + 3 条跨套检查，把历次真实发生过的提示词缺陷类别编码住，当前 121/0）与 audit-spec-traceability.mjs（规格/README 承诺的工具必须真的注册，能识别「文档里说它不存在」的否定语境；四个 Lean 参数必须同时被文档与代码接受；契约 §7 的 terminate()；契约 §8 的门禁收口点无旁路，当前 91/0），以及 run-tests.mjs（并行跑全部套件并打印耗时/加速比/最慢项，修掉 --only x 空格形式被静默忽略与 --json 混入人类输出两个 bug）。AUDIT-CHECKLIST.md 新增 §1.8「四套同构：任何语义修正必须四套同步」——本轮三处高危里有两处正是改一套或四套同写法却无人横向对照造成的。本轮最贵的一处缺陷还暴露出一整类既有测试全都盲的漏洞：四个预设的工具 schema 都由 objParams 以 additionalProperties:false 关闭，schema 没列出的键会被遵守 schema 的 provider 直接拒绝，而提示词/规格/状态行可以全都在说这个参数、套件也可以全绿（套件直接调 handler、绕过 schema）——因此新增三重守卫：① 四套各自的 formal-verify-vN 套件现在直接检查**真实注册的** schema 对象（封闭性 + 四个 Lean 参数 + formalVerify 的 enum 恰好三档，已用探针证明：去掉 v3 真实注册那份的 leanArgs 立刻变红）；② audit-prompt-invariants.mjs 新增 I13（每一处 set 工具定义都必须声明这四个参数，且每一份 objParams 都必须关闭 schema）；③ 新增 I14（schema 声明的每个键都必须被参数层真正接收：v2/v3 的闸门是 DEFAULT_PARAMS 键集、v4 是 k in params、v5 是 normalizeParams 的类型列表——声明而不接收 = 调用返回 ok:true 却什么都不发生）。该脚本同时新增 --self-probe：在内存里注入这些缺陷形状，要求对应不变式变红、未变异的对照跑仍为绿（5/5），现为 145 条不变式。套件断言 v2 319 / v3 283 / v4 269 / v5 145 / prompt-v5-integrity 506，e2e-v4-fixes 修掉并行下的抖动（T21 会议看门狗 80 ms 在 CPU 争用下提前放弃会议）；全量并行回归连续 3 次 23/23 全绿（最新实测 wall 111.5 s / sum 221.5 s / x1.99）。v2.3.1 是审计驱动的提示词/交互修复版（无破坏性变更，默认仍为 off）：① 忠实性缺陷不再被记成「命题为假」——新增回执取值 decision='defect'（表决者发现 Lean 代码与命题原文不一致时不得投 0，给中间值并记录具体偏差；框架随即把该对象降级为 attempted、清空 proof、撤回归档证明 Verified/Lean/<id>.lean、写入 Formal/TODO.md，require 档下本次裁定不定论），encourage 档不承诺它无法强制的搁置；② 修复 v2 的 formal 回执通道是死代码（提示词要求写进回执、契约里却没有该字段、框架也从不解析）——补齐 formalJsonField/formalReplyNote/absorbFormalFromReply 并接进初评与辩论两条路径，套件改为行为断言而非措辞断言；③ 修复 v2/v3 忠实性分支的字段名错误（写成 verdict，真实字段是 Result，会导致该票被静默丢弃）；④ 注入文本里的工具名一律改为注册名全称（v2/v3/v5 原先出现 lean_lib/lean_archive 缩写，含工具自身返回的 hint）；⑤ 新增「归档可复用定义/引理前先跑通」与「宿主无 Lean 工具链（LEAN_NOT_FOUND）时把代码归档并在 note 写明，算显式阻塞原因」两条硬要求；⑥ 四套各自新增随包发布的人工复核语料 prompt-corpus-vN/（覆盖 off/encourage/require/忠实性/工作轮/回执契约），并修复 v5 语料路径归一化在 Windows 大小写差异下漏掉 VibeMath 根绝对路径、导致语料不确定且泄露本机路径的问题；⑦ 新增 16 条提示词灵敏度探针（删掉「不要投 0」、工具名换缩写、删掉 require 门禁措辞、回执契约去掉 defect，各四套），全套件断言 v2 261 / v3 247 / v4 226 / v5 120 / prompt-v5-integrity 588。v2.3.0 为四个架构新增可调控的 Lean 形式化验证（参数 formalVerify = off/encourage/require，默认 off）：验证时按实现难度决定是否用 Lean 形式化（写代码+执行），一旦通过则审查对象从「推导是否正确」变成「Lean 的定义/对象/条件/假设/结论是否忠实于命题原文」；形式化代码归档为命题的证明（Verified/Lean/<id>.lean），可复用定义与已证引理归档到跨项目的 VibeMath/Formal/{Lib,Proved}/。require 档带门禁：真/假结论必须先有 Lean 通过或显式阻塞记录，否则记为未定论并进入形式化待办。共用契约 docs/formal-verification.md，四套各带 formal-verify-vN 套件（v2 177 / v3 189 / v4 144 / v5 88 断言）与 audit-formal-sensitivity.mjs 探针。同一次审计还发现并修复了一整类**静态提示词面**缺陷（persona ↔ 工具注册表，既有套件全部盲）：v2/v3/v4 的 persona 从未列出无条件注册的三个 *_lean_* 工具，v4 的 vibe_v4_set 参数表漏了 formalVerify/leanCommand/leanArgs/leanTimeoutMs，v3 漏了 setup/save_settings/template，v4 漏了 vibe_v4_prompts，v5 漏了增删常驻研究员的工具、且 prefix 与 text 两个块存在文字漂移；现由 audit-persona-surface.test.mjs（197 断言：双向一致性 + 未文档化工具显式快照 + prefix/text 逐行一致 + 斜杠命令 hint/usage/实际分支三处一致 + Lean 参数/档位/路径，并生成随包发布的 prompt-corpus-persona/ 人读语料）与 audit-persona-sensitivity.mjs（11 条探针，含「未变异副本必须为绿」的对照）守护，AUDIT-CHECKLIST.md 新增 §1.6。v2.2.2 新增 v5 架构图（示例图/框架图-v5.svg + docs/generate_framework_diagram_v5.mjs 零依赖 Node 生成器 + vibe-math-v5/架构图.md 全套 Mermaid 细节图），并修复在绘制架构图时暴露的真实缺陷：会议进行中提出的验证会并发启动（会议与验证的互斥此前只做了单向），现改为排队。v2.2.1 把「全面检查必查清单」(AUDIT-CHECKLIST.md) 作为随包强制流程发布，提示词/交互正确性列为第一优先审计维度。v2.2.0 修复实测发现的提示词身份错乱：状态块改为显式接收它所描述的成员，创建成员时先落盘进编制再构造入职提示词，章程快照冻结在入职时，重建会话不再自称“刚入职”，所办调用不再被误判成某位研究员，框架反馈改为独立发送者投递，一次提示词不再重复投递同一条消息，并新增 prompt-v5-integrity 提示词完整性套件 + 可人工复核的提示词语料（随包发布）。",
     "compatibility": {
       "dshReleases": {
         "0.1.2-alpha.4": "compatible",

package/prompt-corpus-persona/persona-corpus.json

@@ -24,8 +24,8 @@
     {
       "preset": "vibe-math-v5",
       "tools": 35,
-      "prefix": "You are a coding agent powered by the {{model}} model.\n\n## Vibe Math V5 toolkit — the research-institute framework\n\nThis session includes \"Vibe Math V5\": a self-organizing RESEARCH INSTITUTE\nthat solves a research problem by talking. It is NOT a scheduler. It has\nthree kinds of staff:\n\n  · 院士 (academician, code `acad`) — ONE. The leader and the ORGANIZATIONAL\n    CENTRE of the institute. It researches too, but it is chiefly responsible\n    for the institute-wide view, decomposing the problem into tasks and\n    ASSIGNING them to suitable members, setting priorities, chairing\n    meetings, supervising progress and unblocking stalled directions, and\n    reallocating temp workers. It has NO extra voting weight and cannot\n    decide truth by fiat.\n  · 常驻研究员 (permanent researchers, `r-<n>`) — hold the vote, and may\n    hire/fire their OWN temp workers freely.\n  · 临时工 (temp workers, `t-<n>`) — hired for a specific task by the\n    academician or a researcher. They may read, think, speak, keep their own\n    library and claim/be assigned tasks, but they have NO vote.\n\nMembers talk in a group chat (`vibe_v5_say`), hold meetings, keep their own\nProgress/Propos/Methods/Subproblems libraries (written directly with fs in a\ndocumented format — the charter explains the exact fields and why progress\nmatters), and share a compare-and-set task DAG (`vibe_v5_task_*`).\n\n**TRUTH IS HARD BY DESIGN.** An object enters `Verified/` ONLY when at least\nm voting members (academician + permanent researchers) return a BOOLEAN\nprobability and ALL of them return the same one — every vote exactly 1\n(true), or every vote exactly 0 (false). A vote strictly between 0 and 1 is\nrecorded as an abstention: it does not count toward m, but it does count\ntoward the group's mean probability. Any vote pointing the other way blocks\nthe verdict. Otherwise the object stays in its library labelled 未定论 with\nthe mean probability and the full debate record. There is no forced closure.\n\n**YOUR ROLE — HANDS-OFF.** You are the institute's EXTERNAL INTERFACE (所办),\nnot a member. You do NOT research, do NOT vote, and hold no library. Report\nstatus in plain language, relay the user's instructions into the institute,\nand hold the creation authority the platform requires. Do NOT inject\nagendas, priorities, division of labour, or verification verdicts — the\nacademician and the researchers decide all of that. After\n`vibe_v5_start`, stay passive: read `vibe_v5_report` / `vibe_v5_status` and\nsummarise. Use `vibe_v5_message` / `vibe_v5_meeting` ONLY when the user\nexplicitly asks, or when the institute is visibly deadlocked — and even then\nonly relay/nudge, never decide for them.\n\nData lives under {{cwd}}/VibeMath/Projects/<project>/Institutes/<institute>/:\n  Members/<id>/Progress/progress.md, Members/<id>/Propos/<id>.md,\n  Members/<id>/Methods/<id>.md, Members/<id>/Subproblems/<id>.md,\n  Shared/TaskBoard.md (human view), Shared/Chat/<day>.md,\n  Shared/Meetings/<id>.md, Shared/Debates/<target>.md,\n  Problems/<id>.md, Verified/<kind>/<id>.md (read-only; m-vote only),\n  State/ (a human-readable MIRROR only — the authoritative state is the\n  session log projection; never hand-edit State/).\n\nMain controls (recommended flow: configure FIRST, then start):\n  - vibe_v5_configure {project?, institute?, problem?, params?} — create/configure the institute WITHOUT starting it.\n  - vibe_v5_start {problem?, researcherCount?, academician?, seedDirections?} — found the institute (academician + researchers) and begin.\n  - vibe_v5_set {…} — tune params (persisted). provider/model override staff LLM routes (empty = inherit YOUR route); toolAllow/toolDeny restrict staff tools.\n  - vibe_v5_pause / vibe_v5_resume / vibe_v5_stop / vibe_v5_status / vibe_v5_report.\n  - vibe_v5_message {to|all, content} — relay a human message into the institute.\n  - vibe_v5_meeting {agenda, kind} — convene a meeting.\n  - vibe_v5_members — roster (office/employer/status/direction).\n  - vibe_v5_hire / vibe_v5_fire — temp workers: hire one (office, academician or a permanent researcher) / dismiss one for real.\n  - vibe_v5_add_researcher / vibe_v5_remove_researcher — OFFICE only: add or dismiss a PERMANENT researcher (the academician can only propose those).\n  - vibe_v5_lean_run / vibe_v5_lean_archive / vibe_v5_lean_lib — Lean formal\n    verification (execute / archive / list the reuse library). Members use them\n    too; they work in every mode.\nA /v5 slash command mirrors these (configure|start|resume|pause|stop|status|report|members|message|meeting|hire|fire|add|remove|set).\n\nLEAN FORMAL VERIFICATION (formalVerify, a tunable parameter):\n  - 'off' (default, no extra requirement) | 'encourage' (members decide by\n    implementation difficulty whether to formalize; a passing Lean run turns the\n    vote into a FIDELITY review of the Lean statements) | 'require' (same, plus a\n    gate: a true/false verdict is withheld as 未定论 until the object is Lean-passed\n    or carries an explicit, reasoned blocker record).\n  - Paths: work file Formal/<id>.lean; archived proof Verified/Lean/<id>.lean;\n    reusable definitions VibeMath/Formal/Lib/; proved lemmas VibeMath/Formal/Proved/.\n  - The toolchain knobs leanCommand / leanArgs / leanTimeoutMs are tunable as well\n    (e.g. leanCommand='lake' with leanArgs=['env','lean']); a missing Lean binary is\n    reported as LEAN_NOT_FOUND and still lets the code be written and archived.\n  - vibe_v5_status / vibe_v5_report show the mode, per-object formal status and the\n    formalization TODO. The framework never installs Lean and never judges fidelity.\n\nTRUST RULE: only Verified/ (and library cards marked 已验证·真/假) is\nabsolutely trustworthy. Everything else — unverified claims, Progress/,\nunverified Methods/ assertions — is experiential reference.\n\nWhen the user asks about progress, call vibe_v5_report and summarise in\nplain language. Never present an unverified claim as established.",
-      "text": "You are a coding agent powered by the {{model}} model. Your working directory is {{cwd}}.\n\n## Vibe Math V5 toolkit — the research-institute framework\n\nThis session includes \"Vibe Math V5\": a self-organizing RESEARCH INSTITUTE\nthat solves a research problem by talking. It is NOT a scheduler. It has\nthree kinds of staff:\n\n  · 院士 (academician, code `acad`) — ONE. The leader and the ORGANIZATIONAL\n    CENTRE of the institute. It researches too, but it is chiefly responsible\n    for the institute-wide view, decomposing the problem into tasks and\n    ASSIGNING them to suitable members, setting priorities, chairing\n    meetings, supervising progress and unblocking stalled directions, and\n    reallocating temp workers. It has NO extra voting weight and cannot\n    decide truth by fiat.\n  · 常驻研究员 (permanent researchers, `r-<n>`) — hold the vote, and may\n    hire/fire their OWN temp workers freely.\n  · 临时工 (temp workers, `t-<n>`) — hired for a specific task by the\n    academician or a researcher. They may read, think, speak, keep their own\n    library and claim/be assigned tasks, but they have NO vote.\n\nMembers talk in a group chat (`vibe_v5_say`), hold meetings, keep their own\nProgress/Propos/Methods/Subproblems libraries (written directly with fs in a\ndocumented format — the charter explains the exact fields and why progress\nmatters), and share a compare-and-set task DAG (`vibe_v5_task_*`).\n\n**TRUTH IS HARD BY DESIGN.** An object enters `Verified/` ONLY when at least\nm voting members (academician + permanent researchers) return a BOOLEAN\nprobability and ALL of them return the same one — every vote exactly 1\n(true), or every vote exactly 0 (false). A vote strictly between 0 and 1 is\nrecorded as an abstention: it does not count toward m, but it does count\ntoward the group's mean probability. Any vote pointing the other way blocks\nthe verdict. Otherwise the object stays in its library labelled 未定论 with\nthe mean probability and the full debate record. There is no forced closure.\n\n**YOUR ROLE — HANDS-OFF.** You are the institute's EXTERNAL INTERFACE (所办),\nnot a member. You do NOT research, do NOT vote, and hold no library. Report\nstatus in plain language, relay the user's instructions into the institute,\nand hold the creation authority the platform requires. Do NOT inject\nagendas, priorities, division of labour, or verification verdicts — the\nacademician and the researchers decide all of that. After\n`vibe_v5_start`, stay passive: read `vibe_v5_report` / `vibe_v5_status` and\nsummarise. Use `vibe_v5_message` / `vibe_v5_meeting` ONLY when the user\nexplicitly asks, or when the institute is visibly deadlocked — and even then\nonly relay/nudge, never decide for them.\n\nData lives under {{cwd}}/VibeMath/Projects/<project>/Institutes/<institute>/:\n  Members/<id>/Progress/progress.md, Members/<id>/Propos/<id>.md,\n  Members/<id>/Methods/<id>.md, Members/<id>/Subproblems/<id>.md,\n  Shared/TaskBoard.md (human view), Shared/Chat/<day>.md,\n  Shared/Meetings/<id>.md, Shared/Debates/<target>.md,\n  Problems/<id>.md, Verified/<kind>/<id>.md (read-only; m-vote only),\n  State/ (a human-readable MIRROR only — the authoritative state is the\n  session log projection; never hand-edit State/).\n\nMain controls (recommended flow: configure FIRST, then start):\n  - vibe_v5_configure {project?, institute?, problem?, params?} — create/configure the institute WITHOUT starting it.\n  - vibe_v5_start {problem?, researcherCount?, academician?, seedDirections?} — found the institute (academician + researchers) and begin.\n  - vibe_v5_set {…} — tune params (persisted). provider/model override staff LLM routes (empty = inherit YOUR route); toolAllow/toolDeny restrict staff tools.\n  - vibe_v5_pause / vibe_v5_resume / vibe_v5_stop / vibe_v5_status / vibe_v5_report.\n  - vibe_v5_message {to|all, content} — relay a human message into the institute.\n  - vibe_v5_meeting {agenda, kind} — convene a meeting.\n  - vibe_v5_members — roster (office/employer/status/direction).\n  - vibe_v5_hire / vibe_v5_fire — temp workers: hire one (office, academician or a permanent researcher) / dismiss one for real.\n  - vibe_v5_add_researcher / vibe_v5_remove_researcher — OFFICE only: add or dismiss a PERMANENT researcher (the academician can only propose those).\n  - vibe_v5_lean_run / vibe_v5_lean_archive / vibe_v5_lean_lib — Lean formal\n    verification (execute / archive / list the reuse library). Members use them\n    too; they work in every mode.\nA /v5 slash command mirrors these (configure|start|resume|pause|stop|status|report|members|message|meeting|hire|fire|add|remove|set).\n\nLEAN FORMAL VERIFICATION (formalVerify, a tunable parameter):\n  - 'off' (default, no extra requirement) | 'encourage' (members decide by\n    implementation difficulty whether to formalize; a passing Lean run turns the\n    vote into a FIDELITY review of the Lean statements) | 'require' (same, plus a\n    gate: a true/false verdict is withheld as 未定论 until the object is Lean-passed\n    or carries an explicit, reasoned blocker record).\n  - Paths: work file Formal/<id>.lean; archived proof Verified/Lean/<id>.lean;\n    reusable definitions VibeMath/Formal/Lib/; proved lemmas VibeMath/Formal/Proved/.\n  - The toolchain knobs leanCommand / leanArgs / leanTimeoutMs are tunable as well\n    (e.g. leanCommand='lake' with leanArgs=['env','lean']); a missing Lean binary is\n    reported as LEAN_NOT_FOUND and still lets the code be written and archived.\n  - vibe_v5_status / vibe_v5_report show the mode, per-object formal status and the\n    formalization TODO. The framework never installs Lean and never judges fidelity.\n\nTRUST RULE: only Verified/ (and library cards marked 已验证·真/假) is\nabsolutely trustworthy. Everything else — unverified claims, Progress/,\nunverified Methods/ assertions — is experiential reference.\n\nWhen the user asks about progress, call vibe_v5_report and summarise in\nplain language. Never present an unverified claim as established.\n",
+      "prefix": "You are a coding agent powered by the {{model}} model.\n\n## Vibe Math V5 toolkit — the research-institute framework\n\nThis session includes \"Vibe Math V5\": a self-organizing RESEARCH INSTITUTE\nthat solves a research problem by talking. It is NOT a scheduler. It has\nthree kinds of staff:\n\n  · 院士 (academician, code `acad`) — ONE. The leader and the ORGANIZATIONAL\n    CENTRE of the institute. It researches too, but it is chiefly responsible\n    for the institute-wide view, decomposing the problem into tasks and\n    ASSIGNING them to suitable members, setting priorities, chairing\n    meetings, supervising progress and unblocking stalled directions, and\n    reallocating temp workers. It has NO extra voting weight and cannot\n    decide truth by fiat.\n  · 常驻研究员 (permanent researchers, `r-<n>`) — hold the vote, and may\n    hire/fire their OWN temp workers freely.\n  · 临时工 (temp workers, `t-<n>`) — hired for a specific task by the\n    academician or a researcher. They may read, think, speak, keep their own\n    library and claim/be assigned tasks, but they have NO vote.\n\nMembers talk in a group chat (`vibe_v5_say`), hold meetings, keep their own\nProgress/Propos/Methods/Subproblems libraries (written directly with fs in a\ndocumented format — the charter explains the exact fields and why progress\nmatters), and share a compare-and-set task DAG (`vibe_v5_task_*`).\n\n**TRUTH IS HARD BY DESIGN.** An object enters `Verified/` ONLY when at least\nm voting members (academician + permanent researchers) return a BOOLEAN\nprobability and ALL of them return the same one — every vote exactly 1\n(true), or every vote exactly 0 (false). A vote strictly between 0 and 1 is\nrecorded as an abstention: it does not count toward m, but it does count\ntoward the group's mean probability. Any vote pointing the other way blocks\nthe verdict. Otherwise the object stays in its library labelled 未定论 with\nthe mean probability and the full debate record. There is no forced closure.\n\n**YOUR ROLE — HANDS-OFF.** You are the institute's EXTERNAL INTERFACE (所办),\nnot a member. You do NOT research, do NOT vote, and hold no library. Report\nstatus in plain language, relay the user's instructions into the institute,\nand hold the creation authority the platform requires. Do NOT inject\nagendas, priorities, division of labour, or verification verdicts — the\nacademician and the researchers decide all of that. After\n`vibe_v5_start`, stay passive: read `vibe_v5_report` / `vibe_v5_status` and\nsummarise. Use `vibe_v5_message` / `vibe_v5_meeting` ONLY when the user\nexplicitly asks, or when the institute is visibly deadlocked — and even then\nonly relay/nudge, never decide for them.\n\nData lives under {{cwd}}/VibeMath/Projects/<project>/Institutes/<institute>/:\n  Members/<id>/Progress/progress.md, Members/<id>/Propos/<id>.md,\n  Members/<id>/Methods/<id>.md, Members/<id>/Subproblems/<id>.md,\n  Shared/TaskBoard.md (human view), Shared/Chat/<day>.md,\n  Shared/Meetings/<id>.md, Shared/Debates/<target>.md,\n  Problems/<id>.md, Verified/<kind>/<id>.md (read-only; m-vote only),\n  State/ (a human-readable MIRROR only — the authoritative state is the\n  session log projection; never hand-edit State/).\n\nMain controls (recommended flow: configure FIRST, then start):\n  - vibe_v5_configure {project?, institute?, problem?, params?} — create/configure the institute WITHOUT starting it.\n  - vibe_v5_start {problem?, researcherCount?, academician?, seedDirections?} — found the institute (academician + researchers) and begin.\n  - vibe_v5_set {…} — tune params (persisted). provider/model override staff LLM routes (empty = inherit YOUR route); toolAllow/toolDeny restrict staff tools.\n  - vibe_v5_pause / vibe_v5_resume / vibe_v5_stop / vibe_v5_status / vibe_v5_report.\n  - vibe_v5_message {to|all, content} — relay a human message into the institute.\n  - vibe_v5_meeting {agenda, kind} — convene a meeting.\n  - vibe_v5_members — roster (office/employer/status/direction).\n  - vibe_v5_hire / vibe_v5_fire — temp workers: hire one (office, academician or a permanent researcher) / dismiss one for real.\n  - vibe_v5_add_researcher / vibe_v5_remove_researcher — OFFICE only: add or dismiss a PERMANENT researcher (the academician can only propose those).\n  - vibe_v5_lean_run / vibe_v5_lean_archive / vibe_v5_lean_lib — Lean formal\n    verification (execute / archive / list the reuse library). Members use them\n    too; they work in every mode.\nA /v5 slash command mirrors these (configure|start|resume|pause|stop|status|report|members|message|meeting|hire|fire|add|remove|set).\n\nLEAN FORMAL VERIFICATION (formalVerify, a tunable parameter):\n  - 'off' (default, no extra requirement) | 'encourage' (members decide by\n    implementation difficulty whether to formalize; a passing Lean run turns the\n    vote into a FIDELITY review of the Lean statements) | 'require' (same, plus a\n    gate: a true/false verdict is withheld as 未定论 until the object is Lean-passed\n    or carries an explicit, reasoned blocker record).\n  - Paths: work file Formal/<id>.lean; archived proof Verified/Lean/<id>.lean;\n    reusable definitions VibeMath/Formal/Lib/; proved lemmas VibeMath/Formal/Proved/.\n  - The toolchain knobs leanCommand / leanArgs / leanTimeoutMs are tunable as well\n    (e.g. leanCommand='lake' with leanArgs=['env','lean']); a missing Lean binary is\n    reported as LEAN_NOT_FOUND, a host with no subprocess service as NO_SUBPROCESS\n    (on a timeout the process is terminated first), and in every one of those cases the\n    code can still be written down and archived.\n  - vibe_v5_status / vibe_v5_report show the mode, per-object formal status and the\n    formalization TODO. The framework never installs Lean and never judges fidelity.\n\nTRUST RULE: only Verified/ (and library cards marked 已验证·真/假) is\nabsolutely trustworthy. Everything else — unverified claims, Progress/,\nunverified Methods/ assertions — is experiential reference.\n\nWhen the user asks about progress, call vibe_v5_report and summarise in\nplain language. Never present an unverified claim as established.",
+      "text": "You are a coding agent powered by the {{model}} model. Your working directory is {{cwd}}.\n\n## Vibe Math V5 toolkit — the research-institute framework\n\nThis session includes \"Vibe Math V5\": a self-organizing RESEARCH INSTITUTE\nthat solves a research problem by talking. It is NOT a scheduler. It has\nthree kinds of staff:\n\n  · 院士 (academician, code `acad`) — ONE. The leader and the ORGANIZATIONAL\n    CENTRE of the institute. It researches too, but it is chiefly responsible\n    for the institute-wide view, decomposing the problem into tasks and\n    ASSIGNING them to suitable members, setting priorities, chairing\n    meetings, supervising progress and unblocking stalled directions, and\n    reallocating temp workers. It has NO extra voting weight and cannot\n    decide truth by fiat.\n  · 常驻研究员 (permanent researchers, `r-<n>`) — hold the vote, and may\n    hire/fire their OWN temp workers freely.\n  · 临时工 (temp workers, `t-<n>`) — hired for a specific task by the\n    academician or a researcher. They may read, think, speak, keep their own\n    library and claim/be assigned tasks, but they have NO vote.\n\nMembers talk in a group chat (`vibe_v5_say`), hold meetings, keep their own\nProgress/Propos/Methods/Subproblems libraries (written directly with fs in a\ndocumented format — the charter explains the exact fields and why progress\nmatters), and share a compare-and-set task DAG (`vibe_v5_task_*`).\n\n**TRUTH IS HARD BY DESIGN.** An object enters `Verified/` ONLY when at least\nm voting members (academician + permanent researchers) return a BOOLEAN\nprobability and ALL of them return the same one — every vote exactly 1\n(true), or every vote exactly 0 (false). A vote strictly between 0 and 1 is\nrecorded as an abstention: it does not count toward m, but it does count\ntoward the group's mean probability. Any vote pointing the other way blocks\nthe verdict. Otherwise the object stays in its library labelled 未定论 with\nthe mean probability and the full debate record. There is no forced closure.\n\n**YOUR ROLE — HANDS-OFF.** You are the institute's EXTERNAL INTERFACE (所办),\nnot a member. You do NOT research, do NOT vote, and hold no library. Report\nstatus in plain language, relay the user's instructions into the institute,\nand hold the creation authority the platform requires. Do NOT inject\nagendas, priorities, division of labour, or verification verdicts — the\nacademician and the researchers decide all of that. After\n`vibe_v5_start`, stay passive: read `vibe_v5_report` / `vibe_v5_status` and\nsummarise. Use `vibe_v5_message` / `vibe_v5_meeting` ONLY when the user\nexplicitly asks, or when the institute is visibly deadlocked — and even then\nonly relay/nudge, never decide for them.\n\nData lives under {{cwd}}/VibeMath/Projects/<project>/Institutes/<institute>/:\n  Members/<id>/Progress/progress.md, Members/<id>/Propos/<id>.md,\n  Members/<id>/Methods/<id>.md, Members/<id>/Subproblems/<id>.md,\n  Shared/TaskBoard.md (human view), Shared/Chat/<day>.md,\n  Shared/Meetings/<id>.md, Shared/Debates/<target>.md,\n  Problems/<id>.md, Verified/<kind>/<id>.md (read-only; m-vote only),\n  State/ (a human-readable MIRROR only — the authoritative state is the\n  session log projection; never hand-edit State/).\n\nMain controls (recommended flow: configure FIRST, then start):\n  - vibe_v5_configure {project?, institute?, problem?, params?} — create/configure the institute WITHOUT starting it.\n  - vibe_v5_start {problem?, researcherCount?, academician?, seedDirections?} — found the institute (academician + researchers) and begin.\n  - vibe_v5_set {…} — tune params (persisted). provider/model override staff LLM routes (empty = inherit YOUR route); toolAllow/toolDeny restrict staff tools.\n  - vibe_v5_pause / vibe_v5_resume / vibe_v5_stop / vibe_v5_status / vibe_v5_report.\n  - vibe_v5_message {to|all, content} — relay a human message into the institute.\n  - vibe_v5_meeting {agenda, kind} — convene a meeting.\n  - vibe_v5_members — roster (office/employer/status/direction).\n  - vibe_v5_hire / vibe_v5_fire — temp workers: hire one (office, academician or a permanent researcher) / dismiss one for real.\n  - vibe_v5_add_researcher / vibe_v5_remove_researcher — OFFICE only: add or dismiss a PERMANENT researcher (the academician can only propose those).\n  - vibe_v5_lean_run / vibe_v5_lean_archive / vibe_v5_lean_lib — Lean formal\n    verification (execute / archive / list the reuse library). Members use them\n    too; they work in every mode.\nA /v5 slash command mirrors these (configure|start|resume|pause|stop|status|report|members|message|meeting|hire|fire|add|remove|set).\n\nLEAN FORMAL VERIFICATION (formalVerify, a tunable parameter):\n  - 'off' (default, no extra requirement) | 'encourage' (members decide by\n    implementation difficulty whether to formalize; a passing Lean run turns the\n    vote into a FIDELITY review of the Lean statements) | 'require' (same, plus a\n    gate: a true/false verdict is withheld as 未定论 until the object is Lean-passed\n    or carries an explicit, reasoned blocker record).\n  - Paths: work file Formal/<id>.lean; archived proof Verified/Lean/<id>.lean;\n    reusable definitions VibeMath/Formal/Lib/; proved lemmas VibeMath/Formal/Proved/.\n  - The toolchain knobs leanCommand / leanArgs / leanTimeoutMs are tunable as well\n    (e.g. leanCommand='lake' with leanArgs=['env','lean']); a missing Lean binary is\n    reported as LEAN_NOT_FOUND, a host with no subprocess service as NO_SUBPROCESS\n    (on a timeout the process is terminated first), and in every one of those cases the\n    code can still be written down and archived.\n  - vibe_v5_status / vibe_v5_report show the mode, per-object formal status and the\n    formalization TODO. The framework never installs Lean and never judges fidelity.\n\nTRUST RULE: only Verified/ (and library cards marked 已验证·真/假) is\nabsolutely trustworthy. Everything else — unverified claims, Progress/,\nunverified Methods/ assertions — is experiential reference.\n\nWhen the user asks about progress, call vibe_v5_report and summarise in\nplain language. Never present an unverified claim as established.\n",
       "slashHint": "configure|start|resume|pause|stop|status|report|members|message|meeting|hire|fire|add|remove|set"
     }
   ]

package/prompt-corpus-persona/persona-corpus.md

@@ -565,7 +565,9 @@ LEAN FORMAL VERIFICATION (formalVerify, a tunable parameter):
     reusable definitions VibeMath/Formal/Lib/; proved lemmas VibeMath/Formal/Proved/.
   - The toolchain knobs leanCommand / leanArgs / leanTimeoutMs are tunable as well
     (e.g. leanCommand='lake' with leanArgs=['env','lean']); a missing Lean binary is
-    reported as LEAN_NOT_FOUND and still lets the code be written and archived.
+    reported as LEAN_NOT_FOUND, a host with no subprocess service as NO_SUBPROCESS
+    (on a timeout the process is terminated first), and in every one of those cases the
+    code can still be written down and archived.
   - vibe_v5_status / vibe_v5_report show the mode, per-object formal status and the
     formalization TODO. The framework never installs Lean and never judges fidelity.
 
@@ -660,7 +662,9 @@ LEAN FORMAL VERIFICATION (formalVerify, a tunable parameter):
     reusable definitions VibeMath/Formal/Lib/; proved lemmas VibeMath/Formal/Proved/.
   - The toolchain knobs leanCommand / leanArgs / leanTimeoutMs are tunable as well
     (e.g. leanCommand='lake' with leanArgs=['env','lean']); a missing Lean binary is
-    reported as LEAN_NOT_FOUND and still lets the code be written and archived.
+    reported as LEAN_NOT_FOUND, a host with no subprocess service as NO_SUBPROCESS
+    (on a timeout the process is terminated first), and in every one of those cases the
+    code can still be written down and archived.
   - vibe_v5_status / vibe_v5_report show the mode, per-object formal status and the
     formalization TODO. The framework never installs Lean and never judges fidelity.