dsh-vibe-math 2.4.1 → 2.6.0

package/tests/audit-persona-sensitivity.mjs

@@ -107,8 +107,10 @@ const probes = [
     name: 'v3-tool-registered-but-not-documented',
     preset: 'vibe-math-v3', file: 'vibe-math-v3.js', nth: 'first', expect: 2,
     guarantee: 'a newly registered tool must be documented in the persona (or the snapshot updated on purpose)',
-    from: "  registerTool('vibe_math_lean_run', '(member) Execute the Lean toolchain",
-    to: "  registerTool('vibe_math_extra_tool', 'x', objParams({}), async function () { return {} })\n  registerTool('vibe_math_lean_run', '(member) Execute the Lean toolchain",
+    // NOTE: the description argument is now `TOOL_DESC.<name>` (v3 audit of the two
+    // registration paths) — the anchor follows the call shape, not the literal text.
+    from: "  registerTool('vibe_math_lean_run', TOOL_DESC.vibe_math_lean_run,",
+    to: "  registerTool('vibe_math_extra_tool', 'x', objParams({}), async function () { return {} })\n  registerTool('vibe_math_lean_run', TOOL_DESC.vibe_math_lean_run,",
   },
 
   // ── v4 ─────────────────────────────────────────────────────────────────────
@@ -146,22 +148,80 @@ const probes = [
     name: 'v4-usage-advertises-phantom-subcommand',
     preset: 'vibe-math-v4', file: 'vibe-math-v4.js', nth: 'first', expect: 1,
     guarantee: 'the unknown-subcommand usage string must not advertise a subcommand that no branch implements',
-    from: "usage:'configure|start|resume|pause|abort|status|report|message <to|all> <content>|meeting|members|add|remove|set'",
-    to: "usage:'configure|start|resume|pause|abort|status|report|message <to|all> <content>|meeting|members|add|remove|scan|set'",
+    // The anchor must be the CURRENT literal. Round A changed both the usage string and the
+    // hint to advertise `start [problem]` / `set <k=v>...` (vibe-math-v4.js:2492). While the
+    // anchor kept the pre-fix literal it matched 0 times, so this probe reported SETUP-FAIL
+    // every run and the F-section agreement between usage and branches had NO sensitivity
+    // proof at all (the hint probe at :155 was updated, this one was not).
+    // Round H (final paper) inserted `paper [...]` into both the usage and the hint; the anchor
+    // follows the new literal again, so the probe keeps proving the usage<->branches agreement.
+    from: "usage:'configure|start [problem]|resume|pause|abort|status|report|message <to|all> <content>|meeting|paper [lang=zh|en] [format=md|tex|both] [editor=office|resident:<id>] [force]|members|add|remove|set <k=v>...'",
+    to: "usage:'configure|start [problem]|resume|pause|abort|status|report|message <to|all> <content>|meeting|paper [lang=zh|en] [format=md|tex|both] [editor=office|resident:<id>] [force]|members|add|remove|scan|set <k=v>...'",
   },
   {
     name: 'v4-hint-advertises-unimplemented-subcommand',
     preset: 'vibe-math-v4', file: 'vibe-math-v4.js', nth: 'first', expect: 1,
     guarantee: 'the typing hint must not advertise a subcommand the handler does not implement',
-    from: "message <to|all> <content>|meeting|members|add|remove|set]'",
-    to: "message <to|all> <content>|meeting|add|remove|set]'",
+    // Same reason as above: the hint now carries the `paper [...]` entry between `meeting` and
+    // `members`, so the anchor names the current literal and drops an IMPLEMENTED subcommand
+    // (`members`) from the mutated hint — the suite's implemented-subset-of-hint check must fail.
+    from: "message <to|all> <content>|meeting|paper [lang=zh|en] [format=md|tex|both] [editor=office|resident:<id>] [force]|members|add|remove|set]'",
+    to: "message <to|all> <content>|meeting|paper [lang=zh|en] [format=md|tex|both] [editor=office|resident:<id>] [force]|add|remove|set]'",
   },
   {
     name: 'v5-persona-slash-list-drops-add-remove',
     preset: 'vibe-math-v5', file: 'agent.cordis.yml', nth: 'all', expect: 2,
     guarantee: "the persona's /v5 list must match the command hint (a human reading the persona must see every subcommand)",
-    from: 'meeting|hire|fire|add|remove|set)',
-    to: 'meeting|hire|fire|set)',
+    // Round H appended `|paper` to the persona's /v5 list (and to the command hint), so the
+    // anchor carries the new tail; the mutation still drops the two subcommands whose absence
+    // the Round-G persona actually had (`add|remove`), which the hint<->persona equality check
+    // must catch.
+    from: 'meeting|hire|fire|add|remove|set|paper)',
+    to: 'meeting|hire|fire|set|paper)',
+  },
+  // ── final-paper surface (Round H) ──────────────────────────────────────────
+  // These two pin the surface the final-paper feature ADDED, so a later edit cannot quietly
+  // drop it: the v4 hint must keep advertising the subcommand its handler implements, and the
+  // v5 persona must keep naming the tools the plugin actually registers.
+  {
+    name: 'v4-hint-stops-advertising-paper',
+    preset: 'vibe-math-v4', file: 'vibe-math-v4.js', nth: 'first', expect: 1,
+    guarantee: 'the /v4 hint must keep advertising the final-paper subcommand the handler implements',
+    from: "|meeting|paper [lang=zh|en] [format=md|tex|both] [editor=office|resident:<id>] [force]|members|add|remove|set]'",
+    to: "|meeting|members|add|remove|set]'",
+  },
+  {
+    name: 'v5-paper-tool-renamed-in-plugin',
+    preset: 'vibe-math-v5', file: 'vibe-math-v5.js', nth: 'first', expect: 1,
+    guarantee: 'renaming the final-paper tool must be caught (the persona still advertises vibe_v5_paper)',
+    from: "  registerTool('vibe_v5_paper',",
+    to: "  registerTool('vibe_v5_paperX',",
+  },
+  // ── the persona↔hint list itself (the gap that hid `paper` in v2/v3/v4) ────────────────────
+  // The surface suite used to SKIP this comparison whenever the persona list contained `...`
+  // (v3's trailing ellipsis) or an argument placeholder with `...` (v4's `set <k=v>...`), and v2
+  // never enumerated at all. Each probe below drops ONE implemented subcommand from the persona
+  // list and requires the suite to go RED, so a future omission cannot hide behind an ellipsis.
+  {
+    name: 'v2-persona-slash-list-drops-paper',
+    preset: 'vibe-math-v2', file: 'agent.cordis.yml', nth: 'all', expect: 2,
+    guarantee: 'the v2 persona must name EVERY implemented /vibe subcommand explicitly (it never enumerated before)',
+    from: '|decisions|agents|paper [lang=zh|en] [format=both|md|tex] [force]).',
+    to: '|decisions|agents).',
+  },
+  {
+    name: 'v3-persona-slash-list-drops-paper',
+    preset: 'vibe-math-v3', file: 'agent.cordis.yml', nth: 'all', expect: 2,
+    guarantee: "the v3 persona's /vibe list must name every implemented subcommand (the old trailing '...' skipped the check)",
+    from: '|decisions|agents|paper [lang=zh|en] [format=both|md|tex] [force]).',
+    to: '|decisions|agents).',
+  },
+  {
+    name: 'v4-persona-slash-list-drops-paper',
+    preset: 'vibe-math-v4', file: 'agent.cordis.yml', nth: 'all', expect: 2,
+    guarantee: "a dropped v4 persona entry must be caught even though the list contains `set <k=v>...` (the old ellipsis escape)",
+    from: '|meeting|paper [lang=zh|en] [format=md|tex|both] [editor=office|resident:<id>] [force]|members',
+    to: '|meeting|members',
   },
 ]
 

package/tests/audit-persona-surface.test.mjs

@@ -143,7 +143,11 @@ const PRESETS = [
     js: 'vibe-math-v3.js',
     prefix: 'vibe_math_',
     tools: 33,
-    undocumented: ['vibe_math_claim_write', 'vibe_math_release_write', 'vibe_math_sync_meta'],
+    // `vibe_math_sync_meta` is no longer undocumented: the promotion-contract line of the
+    // persona now names it as the place to report `lemmas[].价值/关键性` (v3 audit M1 —
+    // without a prompt-side source for that field the promotion main line is unreachable).
+    // The write-lock pair stays out: solver/method-keeper prompts carry it via kcWriteRules().
+    undocumented: ['vibe_math_claim_write', 'vibe_math_release_write'],
     lean: { tools: ['vibe_math_lean_run', 'vibe_math_lean_archive', 'vibe_math_lean_lib'], extra: [] },
   },
   {
@@ -166,9 +170,11 @@ const PRESETS = [
     dir: 'vibe-math-v5',
     js: 'vibe-math-v5.js',
     prefix: 'vibe_v5_',
-    tools: 35,
+    tools: 37,
     // member- and academician-facing tools; the office (main agent) holds only the
-    // institute-level controls plus the hiring authority.
+    // institute-level controls plus the hiring authority. The final-paper pair is an
+    // OFFICE control and IS named in the persona (vibe_v5_paper / vibe_v5_finalize_paper),
+    // so it must not appear in this snapshot.
     undocumented: [
       'vibe_v5_wait', 'vibe_v5_record_progress', 'vibe_v5_record_proposition',
       'vibe_v5_record_method', 'vibe_v5_record_subproblem', 'vibe_v5_read_library',
@@ -254,12 +260,19 @@ for (const P of PRESETS) {
   if (!hintOpen) eq(implemented.filter((c) => !hinted.includes(c)).sort(), [], `${P.dir}: implemented slash subcommand(s) are missing from the hint`)
   eq(used.sort(), implemented, `${P.dir}: the usage string and the implemented slash subcommands disagree`)
   const personaEnum = /slash command mirrors[^(]*\(([\s\S]*?)\)/.exec(blocks.prefix.join('\n') + '\n' + blocks.text.join('\n'))
-  if (personaEnum && personaEnum[1].includes('|')) {
+  // An ellipsis must NOT switch this check off (that is how a dropped `paper` entry survived here),
+  // and `...` inside an argument placeholder (`set <k=v>...`) is not an abbreviation at all. So the
+  // persona is compared against the BRANCHES (the ground truth), and every implemented subcommand
+  // must be named EXPLICITLY. Only a HINT that is itself abbreviated makes the reverse direction
+  // (persona ⊆ hint) unprovable, so only that direction is relaxed then.
+  if (!personaEnum) {
+    ok(false, `${P.dir}: the persona never enumerates its /vN subcommands (list them so a human can see every one)`)
+  } else {
     const personaCmds = cmdsFrom(personaEnum[1].replace(/^\s*\/[a-z0-9]+\s+/, ''))
-    if (personaCmds.length) {
-      eq(personaCmds.filter((c) => !hinted.includes(c)).sort(), [], `${P.dir}: the persona enumerates slash subcommand(s) the hint does not know`)
-      if (!/\.\.\./.test(personaEnum[1]) && !hintOpen) eq(personaCmds.slice().sort(), hinted.slice().sort(), `${P.dir}: the persona's /vN list and the command hint disagree`)
-    }
+    ok(personaCmds.length > 0, `${P.dir}: no slash subcommand could be parsed from the persona's /vN list`)
+    eq(personaCmds.filter((c) => !implemented.includes(c)).sort(), [], `${P.dir}: the persona enumerates slash subcommand(s) the handler does not implement`)
+    eq(implemented.filter((c) => !personaCmds.includes(c)).sort(), [], `${P.dir}: the persona's /vN list omits subcommand(s) the handler implements — list them explicitly, do not hide behind "..."`)
+    if (!hintOpen) eq(personaCmds.slice().sort(), implemented.slice().sort(), `${P.dir}: the persona's /vN list and the command hint disagree`)
   }
 
   // ---- E. the Lean feature's prompt surface ----------------------------

package/tests/audit-v5-sensitivity.mjs

@@ -31,6 +31,31 @@ const original = readFileSync(SRC, 'utf8')
 const REPO = fileURLToPath(new URL('..', import.meta.url))
 const dir = mkdtempSync(join(tmpdir(), 'v5-sens-'))
 
+// `armNextVerify`'s two exclusion gates (a live MEETING and a live VERIFICATION), each written
+// at the function head AND as a re-check inside the `while` loop with no `await` in between.
+// `armGuards(true, true)` is the pristine source text; the probes switch ONE gate off in BOTH
+// copies, which is the minimal edit that actually breaks the guarantee. Keeping the block in
+// one place means the two mutations cannot drift apart from the source they mutate.
+const armGuards = (meetingOn, verifyOn) => [
+  ...(meetingOn ? ['      if (meeting) return'] : []),
+  '      // Only one begin may be in flight. Without this, two callers (a scheduling pass',
+  '      // and a fresh proposal) could both pass the `currentVerify()` check before either',
+  '      // has published its verdict record and would start the SAME object twice.',
+  '      if (beginLock) return',
+  ...(verifyOn ? ['      if (currentVerify()) return'] : []),
+  '      beginLock = true',
+  '      try {',
+  '        while (true) {',
+  '          // NEVER remove a proposal we are not about to run: the entry leaves the durable',
+  '          // queue only in the same step that starts it. The old code shifted it out and then',
+  '          // returned because a meeting was live, so the proposal existed in neither the queue',
+  '          // nor `verdicts` until some later pass happened to re-arm it (audit M2). Re-check',
+  '          // the exclusion guards here too: `await putQueue` can let a meeting open.',
+  '          const q = inst().queue.slice()',
+  '          if (!q.length) return',
+  '          if (' + (meetingOn && verifyOn ? 'meeting || currentVerify()' : meetingOn ? 'meeting' : 'currentVerify()') + ') return',
+].join('\n')
+
 // Each probe: { name, ref, guarantee, from, to }
 // `from` must occur exactly once, so a mutation can never quietly hit the wrong site.
 const probes = [
@@ -141,9 +166,19 @@ const probes = [
     name: 'begin-not-exclusive',
     ref: 'prompt-v5-integrity.test.mjs',
     guarantee: '⑱ a second proposal must QUEUE, never start a concurrent ballot',
-    from: "      if (beginLock) return\n      if (currentVerify()) return\n      beginLock = true",
-    to: "      beginLock = true",
-  },
+    from: armGuards(true, true),
+    to: armGuards(true, false),
+  },
+  // NOTE — the mutual-exclusion gates of `armNextVerify` are written TWICE: once at the
+  // function head and once as a re-check inside the `while (true)` loop, and there is NO
+  // `await` between them. The head copies are therefore redundant mirrors of the in-loop
+  // ones, and a probe that deletes only a head copy is SEMANTICALLY INERT — it can never go
+  // red, which would masquerade as a "blind spot" forever (this was the state of both of the
+  // ⑱/㉝ probes: the in-loop re-check kept the invariant alive and
+  // `prompt-v5-integrity.test.mjs` stayed green). The probes for ⑱ and ㉝ therefore remove
+  // BOTH copies of the ONE gate they test, which is the minimal edit that actually lets a
+  // second ballot start — and the suite's case 9b ("a second proposal QUEUES") and case 10b
+  // ("a verification proposed DURING a meeting must queue") do detect exactly that.
   // NOTE — a probe for `continueMeetingRound`'s `if (finalizeLock) { armHeartbeat(); return }`
   // re-arm was REMOVED, not because the re-arm is unnecessary but because the state it
   // guards is UNREACHABLE, so no black-box probe can detect its removal:
@@ -269,8 +304,10 @@ const probes = [
     name: 'verify-preempts-a-live-meeting',
     ref: 'prompt-v5-integrity.test.mjs',
     guarantee: '㉝ a verification proposed during a meeting must QUEUE, never start concurrently (the two are mutually exclusive)',
-    from: "      if (meeting) return\n      // Only one begin may be in flight.",
-    to: "      // Only one begin may be in flight.",
+    // Removes BOTH `meeting` gates (see the note above `meeting-never-finalized`): deleting
+    // only the head copy is inert because the in-loop re-check runs before any `await`.
+    from: armGuards(true, true),
+    to: armGuards(false, true),
   },
 
   // ── LEAN FORMAL VERIFICATION PROBES (docs/formal-verification.md) ─────────
@@ -362,7 +399,11 @@ for (const p of probes) {
     continue
   }
   const r = spawnSync(process.execPath, [testPath], {
-    env: Object.assign({}, process.env, { V5_PLUGIN: file }),
+    // V5_CORPUS_DIR: a MUTATED run must never rewrite the shipped `prompt-corpus-v5/`. The
+    // corpus is the mandatory human-review artifact (AUDIT-CHECKLIST §0.3/§2.4); letting a
+    // deliberately broken copy dump its prompts there would leave the working tree holding
+    // mutant text until someone re-ran the healthy suite.
+    env: Object.assign({}, process.env, { V5_PLUGIN: file, V5_CORPUS_DIR: join(dir, 'corpus') }),
     encoding: 'utf8',
     cwd: REPO,
   })