dsh-vibe-math 2.5.0 → 2.7.0

package/tests/audit-math-computation-contract.mjs

@@ -0,0 +1,191 @@
+// ============================================================================================
+// math_computation — CROSS-PRESET CONTRACT guard (integration owner).
+//
+// Proves that all four presets wired the frozen shared interface the same way:
+//   - each imports ./math-computation.js and registers the tool through its own registration path(s);
+//   - each carries the six frozen parameter names in DEFAULT_PARAMS, its normaliser call, its
+//     parameter schema(s) and (v5) its CLOSED set schema + visibleParams;
+//   - each references the frozen prompt text constants (description / persona line / rule lines /
+//     availability line), so the shell-fallback marking and the criteria cannot silently disappear;
+//   - both persona blocks (prefix + text) list the tool;
+//   - the bilingual README documents the six parameters.
+//
+// Falsifiable: a preset that drops a param, forgets the second registration layer, or stops using
+// the frozen prompt text turns this suite RED. It is intentionally stricter than any single preset
+// suite - it is the cross-preset part no owner can weaken alone.
+//
+// Usage: node tests/audit-math-computation-contract.mjs
+// ============================================================================================
+import { existsSync, readFileSync } from 'node:fs'
+import { join, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const HERE = fileURLToPath(new URL('./', import.meta.url))
+const REPO = resolve(HERE, '..')
+// MC_CONTRACT_ROOT points the guard at a MUTATED copy of the tree (used by the round-4 item-3
+// mutant, which must delete 'Formal/Jobs' from one preset without touching the repo).
+const ROOT = process.env.MC_CONTRACT_ROOT ? resolve(String(process.env.MC_CONTRACT_ROOT)) : REPO
+// The shared defaults are the reference for AUDIT-B #6 (no preset may hold a drifting literal).
+const M = await import(new URL('../vibe-math-v2/math-computation.js', import.meta.url).href)
+const PRESETS = [
+  { dir: 'vibe-math-v2', designator: 'vibe-math-v2', dualRegistration: true },
+  { dir: 'vibe-math-v3', designator: 'vibe-math-v3', dualRegistration: true },
+  { dir: 'vibe-math-v4', designator: 'vibe-math-v4', dualRegistration: false },
+  { dir: 'vibe-math-v5', designator: 'vibe-math-v5', dualRegistration: false },
+]
+const SIX = ['mathComputation', 'mathMode', 'mathEngines', 'mathTimeoutMs', 'mathPackages', 'mathInstallScope']
+
+let passed = 0, failed = 0
+const failures = []
+function ok(cond, label, detail) {
+  if (cond) { passed++; return true }
+  failed++; failures.push(label + (detail ? ' — ' + detail : ''))
+  return false
+}
+const read = (rel) => readFileSync(join(ROOT, rel), 'utf8')
+
+function block(src, startMarker, endMarker) {
+  const i = src.indexOf(startMarker)
+  if (i === -1) return ''
+  const j = endMarker ? src.indexOf(endMarker, i) : -1
+  return j === -1 ? src.slice(i, i + 4000) : src.slice(i, j)
+}
+// A literal array assignment (e.g. `const PARAM_SCHEMA = [ … ]`) must be sliced to the CLOSING
+// bracket of the assignment, not to the first `]` inside it (that is an inner `options: [...]`).
+// The presets indent the closing bracket on its own line at two spaces, which is stable and does
+// not need a brace-aware parser.
+// A literal array assignment (e.g. `const PARAM_SCHEMA = [ … ]`) must be sliced to the CLOSING
+// bracket of the assignment, not to the first `]` inside it (that is an inner `options: [...]`).
+function arrayBlock(src, startMarker) {
+  const i = src.indexOf(startMarker)
+  if (i === -1) return ''
+  const j = src.indexOf('\n  ]', i)
+  return j === -1 ? src.slice(i, i + 4000) : src.slice(i, j)
+}
+// A registration call (`registerTool('vibe_v5_set', '<long description>', objParams({…}))`) can
+// contain `})` inside its description string, so slice to the closing bracket on its own line
+// (two-space indent) instead of the first `})`.
+function callBlock(src, startMarker) {
+  const i = src.indexOf(startMarker)
+  if (i === -1) return ''
+  const j = src.indexOf('\n  })', i)
+  if (j !== -1) return src.slice(i, j)
+  const k = src.indexOf('})', i)
+  return k === -1 ? src.slice(i, i + 4000) : src.slice(i, k)
+}
+
+console.log('-- math_computation cross-preset contract --')
+
+for (const P of PRESETS) {
+  const js = read(P.dir + '/' + P.dir + '.js')
+  const tag = P.dir + ': '
+
+  // 1. import + registration
+  ok(js.indexOf("'./math-computation.js'") !== -1, tag + 'imports the shared module')
+  ok(js.indexOf('registerMathComputation(') !== -1, tag + 'calls registerMathComputation(host)')
+  if (P.dualRegistration) {
+    // v2/v3 register every tool twice: the session handlers layer and the apply-level layer.
+    const defs = (js.match(/function registerTool\s*\(/g) || []).length
+    ok(defs >= 2, tag + 'has both registerTool definition layers', 'found ' + defs)
+  }
+
+  // 2. six params everywhere
+  const defaults = block(js, 'const DEFAULT_PARAMS', '\n  }')
+  for (const k of SIX) ok(defaults.indexOf(k) !== -1, tag + 'DEFAULT_PARAMS holds ' + k)
+  ok(js.indexOf('normalizeMathParams(') !== -1, tag + 'normalises through normalizeMathParams()')
+
+  // parameter schemas: v2/v3 PARAM_SCHEMA + two set_params schemas; v4 vibe_v4_set; v5 closed set + visibleParams
+  // AUDIT-B #7: check the PROPERTY, not the prose. The set tool's description string naturally
+  // contains every parameter name, so an indexOf over the whole registration call stays green even
+  // when a property is renamed. Only the `objParams({...})` argument counts.
+  const SET_TOOL = P.dir === 'vibe-math-v2' || P.dir === 'vibe-math-v3'
+    ? "registerTool('vibe_math_set_params'"
+    : (P.dir === 'vibe-math-v4' ? "registerTool('vibe_v4_set'" : "registerTool('vibe_v5_set'")
+  {
+    const i = js.indexOf(SET_TOOL)
+    const callText = i === -1 ? '' : js.slice(i, js.indexOf('registerTool(', i + 1) === -1 ? i + 4000 : js.indexOf('registerTool(', i + 1))
+    const oi = callText.lastIndexOf('objParams(')
+    const setSchema = oi === -1 ? '' : callText.slice(oi)
+    ok(setSchema.length > 0, tag + 'set tool takes an objParams({...}) schema argument')
+    for (const k of SIX) {
+      ok(new RegExp('(^|[{,\\s])' + k + '\\s*:').test(setSchema), tag + 'set schema has the property ' + k + ' (property-level, not prose)', 'schema len ' + setSchema.length)
+    }
+  }
+  if (P.dir === 'vibe-math-v2' || P.dir === 'vibe-math-v3') {
+    const schema = arrayBlock(js, 'const PARAM_SCHEMA')
+    for (const k of SIX) ok(schema.indexOf(k) !== -1, tag + 'PARAM_SCHEMA documents ' + k)
+  } else if (P.dir === 'vibe-math-v5') {
+    const visible = block(js, 'function visibleParams()', '\n    }')
+    for (const k of SIX) ok(visible.indexOf(k) !== -1, tag + 'visibleParams exposes ' + k)
+  }
+
+  // AUDIT-B #6: the presets' exposed DEFAULTS must come from the shared MATH_PARAM_DEFAULTS, so the
+  // four copies cannot drift (v4 had a literal `mathPackages: []`). Arrays must be referenced and
+  // sliced; scalar literals must equal the shared value.
+  {
+    const defs = block(js, 'const DEFAULT_PARAMS', '\n  }')
+    for (const k of SIX) {
+      if (new RegExp('MATH_PARAM_DEFAULTS\\.' + k + '\\b').test(defs)) continue
+      if (Array.isArray(M.MATH_PARAM_DEFAULTS[k])) {
+        ok(false, tag + 'DEFAULT_PARAMS.' + k + ' must reference MATH_PARAM_DEFAULTS (array literals drift)')
+        continue
+      }
+      const m = new RegExp(k + ":\\s*(?:'([^']*)'|(\\d+))").exec(defs)
+      const val = m ? (m[1] !== undefined ? m[1] : Number(m[2])) : undefined
+      ok(val === M.MATH_PARAM_DEFAULTS[k], tag + 'DEFAULT_PARAMS.' + k + ' literal must equal the shared default', 'got ' + JSON.stringify(val) + ' want ' + JSON.stringify(M.MATH_PARAM_DEFAULTS[k]))
+    }
+  }
+
+  // round-4 item 3: `Formal/Jobs` (the async Lean job mirror) must be in EVERY preset's ensureDirs.
+  // The host creates missing parents, so this is a consistency/discoverability pin, not a
+  // correctness one - but deleting it from v4 also leaves the Lean suites green, so nothing else
+  // would notice the four presets drifting apart.
+  {
+    // Match the ensureDirs/dirs-creation FUNCTION body (not a comment, and not the unrelated
+    // verification-only dirs list that legitimately carries 'Formal' without 'Formal/Jobs').
+    const lines = js.split(/\r?\n/)
+    const start = lines.findIndex((l) => /function\s+(ensureDirs|mkdirs)\s*\(/.test(l))
+    const window = start === -1 ? '' : lines.slice(start, start + 15).join('\n')
+    ok(start !== -1, tag + 'has an ensureDirs()/mkdirs() function')
+    ok(window.indexOf("'Formal/Jobs'") !== -1, tag + "ensureDirs creates 'Formal/Jobs' (async Lean job mirror)")
+  }
+
+  // 3. frozen prompt text constants are actually used
+  ok(js.indexOf('MATH_TOOL_DESCRIPTION') !== -1, tag + 'uses MATH_TOOL_DESCRIPTION')
+  ok(js.indexOf('MATH_PERSONA_TOOL_LINE') !== -1, tag + 'uses MATH_PERSONA_TOOL_LINE')
+  ok(js.indexOf('MATH_RULE_LINES') !== -1, tag + 'uses MATH_RULE_LINES')
+  ok(js.indexOf('mathAvailabilityLine(') !== -1, tag + 'builds the availability line (carries the shell marking)')
+  if (P.dir === 'vibe-math-v4' || P.dir === 'vibe-math-v5') ok(js.indexOf('MATH_RULE_LINES_EN') !== -1, tag + 'bilingual rule lines referenced')
+
+  // 4. persona: both literal blocks list the tool
+  const yml = read(P.dir + '/agent.cordis.yml')
+  const blocks = yml.split(/\n\s*(?:prefix|text):\s*\|/)
+  const hits = blocks.filter((b) => b.indexOf('math_computation') !== -1).length
+  ok(hits >= 2, tag + 'both persona blocks (prefix + text) list math_computation', 'blocks with the tool: ' + hits)
+
+  // 4b. P2a: both blocks must carry the archive -> edit -> re-run rule (scriptChanged + mode:'file').
+  const wf = blocks.filter((b) => b.indexOf('scriptChanged') !== -1 && b.indexOf("mode:'file'") !== -1).length
+  ok(wf >= 2, tag + 'both persona blocks carry the archive->edit->re-run rule (scriptChanged + mode:file)', 'blocks with the rule: ' + wf)
+  ok(js.indexOf('MATH_ARCHIVE_WORKFLOW_LINE') !== -1, tag + 'references MATH_ARCHIVE_WORKFLOW_LINE (zh persona text source)')
+  if (P.dir === 'vibe-math-v4' || P.dir === 'vibe-math-v5') ok(js.indexOf('MATH_ARCHIVE_WORKFLOW_LINE_EN') !== -1, tag + 'references MATH_ARCHIVE_WORKFLOW_LINE_EN (en persona text source)')
+}
+
+// 5. README (both languages) document the six parameters
+for (const f of ['README.md', 'README.en.md']) {
+  const md = existsSync(join(ROOT, f)) ? read(f) : ''
+  for (const k of SIX) ok(md.indexOf(k) !== -1, f + ' documents ' + k)
+  ok(/math-computation\.md|math_computation/.test(md), f + ' links the math_computation feature')
+}
+
+// 6. AUDIT-A/C honesty disclosures must not silently disappear from the contract doc.
+{
+  const doc = existsSync(join(ROOT, 'docs/math-computation.md')) ? read('docs/math-computation.md') : ''
+  ok(doc.indexOf('字符串级') !== -1 && doc.indexOf('不解析符号链接') !== -1, 'docs §6 states the path guard is string-level and does not resolve links/junctions')
+  ok(doc.indexOf('只通过假 subprocess seam 验证') !== -1, 'docs §6 states engine execution is verified only through the fake subprocess seam')
+  ok(doc.indexOf('串行') !== -1 && doc.indexOf('跨进程') !== -1, 'docs §6 states the in-process serialisation and the cross-process limitation')
+}
+
+console.log('')
+console.log('=== MATH COMPUTATION CONTRACT: ' + passed + ' passed, ' + failed + ' failed ===')
+if (failures.length) { for (const f of failures.slice(0, 25)) console.error('  - ' + f); if (failures.length > 25) console.error('  … ' + (failures.length - 25) + ' more') }
+process.exit(failed === 0 ? 0 : 1)

package/tests/audit-math-computation-parity.mjs

@@ -0,0 +1,169 @@
+// ============================================================================================
+// math_computation — PARITY guard (integration owner).
+//
+// The shared module is installed as FOUR byte-identical copies (one per preset dir) because the
+// <=0.1.6 install line copies only the files listed in installer.js PRESETS[].files - a repo-root
+// shared module would be missing from an installed preset. That design is only safe if drift is
+// impossible to miss, so this guard fails when:
+//   1. any of the four copies differs from the others (byte level);
+//   2. the copies differ from the canonical source in _oneoff/mc-P1-ready/canonical/ (dev checkout);
+//   3. installer.js / package.json stop shipping the module (either install line);
+//   4. the exported freeze drifts from _oneoff/mc-P1-ready/tool-schema.json (codes, param names);
+//   5. the descriptor table loses a P1 invariant (cli default-on + policy, Maple VERIFY flag,
+//      arg-error hints on the commercial three, engine order).
+//
+// Usage: node tests/audit-math-computation-parity.mjs
+// ============================================================================================
+import { createHash } from 'node:crypto'
+import { existsSync, readFileSync } from 'node:fs'
+import { join, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const HERE = fileURLToPath(new URL('./', import.meta.url))
+const REPO = resolve(HERE, '..')
+const PRESETS = ['vibe-math-v2', 'vibe-math-v3', 'vibe-math-v4', 'vibe-math-v5']
+const MODULES = ['math-engines.js', 'math-computation.js']
+const CANON = join(REPO, '_oneoff', 'mc-P1-ready', 'canonical')
+const SCHEMA = join(REPO, '_oneoff', 'mc-P1-ready', 'tool-schema.json')
+
+let passed = 0, failed = 0
+const failures = []
+function ok(cond, label, detail) {
+  if (cond) { passed++; console.log('  ok   ' + label); return true }
+  failed++; failures.push(label + (detail ? ' — ' + detail : ''))
+  console.error('  FAIL ' + label + (detail ? ' — ' + detail : ''))
+  return false
+}
+const sha = (p) => createHash('sha256').update(readFileSync(p)).digest('hex')
+const read = (rel) => readFileSync(join(REPO, rel), 'utf8')
+
+console.log('-- math_computation parity --')
+
+// ---- 1/2. the four copies are identical, and match the canonical source ----
+for (const f of MODULES) {
+  const hashes = {}
+  for (const p of PRESETS) {
+    const file = join(REPO, p, f)
+    if (!existsSync(file)) { ok(false, p + '/' + f + ' exists'); continue }
+    const h = sha(file)
+    hashes[h] = (hashes[h] || []).concat(p)
+  }
+  const distinct = Object.keys(hashes)
+  ok(distinct.length === 1 && hashes[distinct[0]].length === 4, 'four copies of ' + f + ' are byte-identical', distinct.length + ' distinct hash(es)')
+  const canon = join(CANON, f)
+  if (existsSync(canon)) ok(sha(canon) === distinct[0], f + ' matches the canonical source', sha(canon).slice(0, 16) + ' vs ' + String(distinct[0]).slice(0, 16))
+  else console.log('  note canonical source absent (published tree) - four-way comparison only')
+}
+
+// ---- 3. both install lines ship the module ----
+{
+  const installer = read('installer.js')
+  // Parse each preset block: src + dst + (optional comment lines) + files[...]. Windows are not
+  // good enough here (the explanatory comment between dst and files pushes the module names past a
+  // fixed slice), so the files list is captured explicitly.
+  const blocks = {}
+  const re = /src:\s*'([^']+)',\s*dst:\s*'[^']+',\s*(?:\/\/[^\n]*\n\s*)*files:\s*\[([^\]]*)\]/g
+  let m
+  while ((m = re.exec(installer)) !== null) blocks[m[1]] = m[2]
+  for (const p of PRESETS) {
+    const list = blocks[p]
+    ok(!!list, 'installer.js has a PRESETS entry for ' + p)
+    for (const f of MODULES) ok(!!list && list.indexOf("'" + f + "'") !== -1, 'installer.js ' + p + ' files[] ships ' + f)
+  }
+  const pkg = JSON.parse(read('package.json'))
+  const files = pkg.files || []
+  for (const p of PRESETS) for (const f of MODULES) ok(files.indexOf(p + '/' + f) !== -1, 'package.json files[] ships ' + p + '/' + f)
+  ok(files.indexOf('docs/math-computation.md') !== -1, 'package.json files[] ships docs/math-computation.md')
+  ok(files.indexOf('tests/audit-math-computation-parity.mjs') !== -1 && files.indexOf('tests/audit-math-computation-contract.mjs') !== -1, 'package.json ships the cross-preset guards')
+  ok(files.indexOf('tests/math-computation-shared.test.mjs') !== -1, 'package.json ships the shared contract suite')
+}
+
+// ---- 4. the freeze matches tool-schema.json ----
+{
+  const mod = await import(new URL('../vibe-math-v2/math-computation.js', import.meta.url).href)
+  if (existsSync(SCHEMA)) {
+    const s = JSON.parse(readFileSync(SCHEMA, 'utf8'))
+    const codes = s.failureCodes.map((c) => c.code)
+    ok(JSON.stringify(mod.MATH_FAILURE_CODES) === JSON.stringify(codes), 'failure codes match tool-schema.json', JSON.stringify(mod.MATH_FAILURE_CODES))
+    ok(JSON.stringify(mod.MATH_PARAM_NAMES) === JSON.stringify(s.paramNamesFrozen.names), 'param names match tool-schema.json#paramNamesFrozen')
+    ok(s.paramNamesFrozen.value === true, 'param names are frozen in the schema')
+    ok(!!s.returnShell.argv && s.returnShell.argv.length > 0, 'return shell declares argv (ruling 4: echo)')
+    ok(s.failureCodes.some((c) => c.code === 'MATH_ENGINE_BAD_ARGV' && /engine-override/.test(c.next)), 'MATH_ENGINE_BAD_ARGV carries the engine-override next')
+  } else {
+    console.log('  note tool-schema.json absent (published tree) - freeze compared against the module only')
+  }
+  ok(mod.MATH_FAILURE_CODES.length === 11, 'eleven failure codes exported')
+  ok(mod.MATH_PARAM_NAMES.length === 6, 'six param names exported')
+  ok(JSON.stringify(mod.MATH_PARAM_DEFAULTS.mathEngines) === JSON.stringify(['python', 'r', 'octave', 'julia', 'matlab', 'maple', 'wolfram', 'cli']), 'default engine order is the frozen P1 set')
+}
+
+// ---- 5. descriptor invariants ----
+{
+  const E = await import(new URL('../vibe-math-v2/math-engines.js', import.meta.url).href)
+  const order = E.MATH_ENGINE_ORDER
+  ok(JSON.stringify(order) === JSON.stringify(['python', 'r', 'octave', 'julia', 'matlab', 'maple', 'wolfram', 'cli']), 'MATH_ENGINE_ORDER is exactly the P1 set')
+  ok(E.MATH_ENGINES.cli.defaultOn === true, 'cli is flagged defaultOn')
+  ok(E.MATH_ENGINES.cli.policy && E.MATH_ENGINES.cli.policy.requiresMathMode === 'typed+shell' && E.MATH_ENGINES.cli.policy.requiresEngineInList === true, 'cli policy gate declared')
+  ok(E.MATH_ENGINES.maple.verify === true && !!E.MATH_ENGINES.maple.verifyReason, 'Maple template is flagged VERIFY with a reason')
+  for (const name of ['matlab', 'maple', 'wolfram']) {
+    ok(Array.isArray(E.MATH_ENGINES[name].argErrorHints) && E.MATH_ENGINES[name].argErrorHints.length > 0, name + ' ships argErrorHints (bad-argv diagnosis)')
+    ok(E.MATH_ENGINES[name].license === 'commercial' && E.MATH_ENGINES[name].install === null, name + ' is commercial and never installable')
+  }
+  for (const name of ['python', 'r', 'octave', 'julia']) {
+    ok(E.MATH_ENGINES[name].license === 'free' && !!E.MATH_ENGINES[name].install, name + ' is free with a user-level install template')
+  }
+  ok(!!E.MATH_P2_ENGINES.sage && E.MATH_P2_ENGINES.sage.phase === 'P2', 'sage is kept as the P2 descriptor')
+  ok(E.mathEngineCandidates('cli') === null, 'cli has no detection candidates')
+}
+
+// ── 6. round-3 item 3: the machine-readable refusal vocabulary cannot drift ──────────────────────
+// The docs used to list 5 reasons while the code emitted 12, and nothing pinned the names. This
+// section derives the literals FROM the shipped module and requires the documented lists (docs +
+// tool-schema.json) to be exactly that set - adding/renaming one in the module without updating the
+// docs turns this red.
+{
+  const modHref = process.env.MATH_COMPUTATION_MODULE
+    ? new URL('file:///' + String(process.env.MATH_COMPUTATION_MODULE).replace(/\\/g, '/'))
+    : new URL('../vibe-math-v2/math-computation.js', import.meta.url)
+  const { readFileSync: rf } = await import('node:fs')
+  const src = rf(fileURLToPath(modHref), 'utf8')
+  const kinds = new Set(); for (const m of src.matchAll(/next\('([a-z-]+)'/g)) kinds.add(m[1])
+  const reasons = new Set(); for (const m of src.matchAll(/reason:\s*'([a-z-]+)'/g)) reasons.add(m[1])
+  const codes = new Set(); for (const m of src.matchAll(/fail\('(MATH_[A-Z_]+)'/g)) codes.add(m[1])
+  // round-4 item 1: the "exhaustive" check above is only sound while the vocabulary is written as
+  // STRING LITERALS. `next('reason', { reason: SOME_CONST })` would emit a value the extractor cannot
+  // see while the exhaustive assertion stayed green. Pin the machine-extractability itself:
+  //   - every `next(...)` first argument must be a string literal;
+  //   - every `reason:` field must be a string literal.
+  // A non-literal form makes this red (and then the vocabulary lists must be updated to match).
+  // Exclude helper DEFINITION lines (`function next(kind, extra)`, `bad(reason, …)`, and any
+  // parameterised helper such as `function reasonNext(r) { return next('reason', {reason: r}) }`):
+  // those are plumbing whose call sites still pass literals. The literal pattern accepts ANY quoted
+  // text (digits/underscores included) - it only asks "can the value be extracted statically?".
+  const callSites = src.split(/\r?\n/).filter((l) => !/^\s*(async\s+)?function\s+\w+\s*\(/.test(l)).join('\n')
+  const nextFirst = [...callSites.matchAll(/\bnext\(\s*([^,)]*)/g)].map((m) => m[1].trim())
+  const nonLiteralKinds = nextFirst.filter((a) => !/^'[^']*'$/.test(a))
+  ok(nonLiteralKinds.length === 0, 'every next(kind, …) kind is a STRING LITERAL (machine-extractable vocabulary)', 'non-literal: ' + JSON.stringify(nonLiteralKinds.slice(0, 3)))
+  const reasonFields = [...callSites.matchAll(/\breason:\s*([^,}\n]*)/g)].map((m) => m[1].trim())
+  const nonLiteralReasons = reasonFields.filter((v) => !/^'[^']*'$/.test(v))
+  ok(nonLiteralReasons.length === 0, 'every reason: value is a STRING LITERAL (the exhaustive list cannot be evaded)', 'non-literal: ' + JSON.stringify(nonLiteralReasons.slice(0, 3)))
+  const schemaPath = [join(REPO, '_oneoff', 'mc-P1-ready', 'tool-schema.json'), resolve(REPO, '..', '_oneoff', 'mc-P1-ready', 'tool-schema.json')].find((p) => existsSync(p))
+  const schema = schemaPath ? JSON.parse(rf(schemaPath, 'utf8')) : null
+  const RV = schema && schema.refusalVocabulary
+  const same = (a, b) => JSON.stringify([...a].sort()) === JSON.stringify([...b].sort())
+  if (!RV) {
+    console.log('  note refusalVocabulary source absent (published tree) - deriving from the module only')
+  } else {
+    ok(same(kinds, RV.nextKinds), 'documented next.kind list is EXHAUSTIVE', 'code=' + [...kinds].sort().join(',') + ' doc=' + RV.nextKinds.join(','))
+    ok(same(reasons, RV.reasons), 'documented next.reason list is EXHAUSTIVE', 'code=' + [...reasons].sort().join(',') + ' doc=' + RV.reasons.join(','))
+    ok(codes.size === 11 && schema.failureCodes.length === 11, 'the emitted failure-code set is the frozen 11')
+  }
+  const doc = rf(join(REPO, 'docs', 'math-computation.md'), 'utf8')
+  for (const k of kinds) ok(doc.indexOf('`' + k + '`') !== -1, 'docs/math-computation.md names next.kind ' + k)
+  for (const r of reasons) ok(doc.indexOf('`' + r + '`') !== -1, 'docs/math-computation.md names next.reason ' + r)
+}
+
+console.log('')
+console.log('=== MATH COMPUTATION PARITY: ' + passed + ' passed, ' + failed + ' failed ===')
+if (failures.length) for (const f of failures) console.error('  - ' + f)
+process.exit(failed === 0 ? 0 : 1)

package/tests/audit-math-computation-sensitivity.mjs

@@ -0,0 +1,231 @@
+// ============================================================================================
+// math_computation — SENSITIVITY probes (integration owner).
+//
+// Proves the shared contract suite is FALSIFIABLE: for each mutation of the module, the suite must
+// go RED for the RIGHT assertion (the probe checks both the exit code and the failing label, so a
+// suite that merely crashes does not count as evidence).
+//
+// Mechanism: copy the canonical module pair into a temp dir, apply ONE textual mutation, then run
+// `tests/math-computation-shared.test.mjs` with MATH_COMPUTATION_MODULE pointed at the mutated copy.
+// The shipped copies are never touched.
+//
+// Usage: node tests/audit-math-computation-sensitivity.mjs
+// A probe PASSES when the mutated run fails AND the expected label is among the failures.
+// ============================================================================================
+import { spawnSync } from 'node:child_process'
+import { mkdtempSync, copyFileSync, readFileSync, writeFileSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const HERE = fileURLToPath(new URL('./', import.meta.url))
+const REPO = resolve(HERE, '..')
+const SRC = join(REPO, 'vibe-math-v2')
+const SUITE = join(HERE, 'math-computation-shared.test.mjs')
+
+const PROBES = [
+  {
+    name: 'cli-default-off',
+    file: 'math-computation.js',
+    from: 'mathEngines: MATH_ENGINE_ORDER.slice(),',
+    to: "mathEngines: MATH_ENGINE_ORDER.filter(function (n) { return n !== 'cli' }),",
+    expect: 'cli runs with DEFAULT params (default-on)',
+  },
+  {
+    name: 'cli-policy-ignored',
+    file: 'math-computation.js',
+    from: "if (p.mathMode !== 'typed+shell') return bad('engine=cli is disabled while mathMode=' + p.mathMode, 'MATH_REFUSED', next('reason', { reason: 'policy' }))",
+    to: 'if (false) return bad(\'noop\')',
+    expect: 'cli refused while mathMode=typed',
+  },
+  {
+    name: 'argv-echo-removed',
+    file: 'math-computation.js',
+    from: '    argv: assembled.argv.slice(),\n    scriptPath: scriptRel, scriptHash: scriptHash,',
+    to: '    scriptPath: scriptRel, scriptHash: scriptHash,',
+    expect: 'receipt argv === returned argv',
+  },
+  {
+    name: 'bad-argv-collapsed',
+    file: 'math-computation.js',
+    from: "      const out = fail('MATH_ENGINE_BAD_ARGV', engineLabel,",
+    to: "      const out = fail('MATH_NONZERO_EXIT', engineLabel,",
+    expect: 'usage/option error -> MATH_ENGINE_BAD_ARGV (not collapsed into NONZERO_EXIT)',
+  },
+  {
+    name: 'timeout-not-reported',
+    file: 'math-computation.js',
+    from: '  if (receipt.timedOut) {',
+    to: '  if (false) {',
+    expect: 'hang -> MATH_TIMEOUT',
+  },
+  {
+    name: 'param-renamed',
+    file: 'math-computation.js',
+    from: "  'mathComputation', 'mathMode', 'mathEngines', 'mathTimeoutMs', 'mathPackages', 'mathInstallScope',",
+    to: "  'mathComputation', 'mathMode', 'mathEngines', 'mathTimeoutMs', 'mathPkgs', 'mathInstallScope',",
+    expect: 'six frozen param names in order',
+  },
+  {
+    name: 'no-subprocess-flag-ignored',
+    file: 'math-computation.js',
+    from: "  if (typeof H.hasSubprocess === 'function' && H.hasSubprocess() === false) {",
+    to: '  if (false) {',
+    expect: 'host that declares no subprocess -> MATH_NO_SUBPROCESS (not ENGINE_NOT_FOUND)',
+  },
+  // ── P2a: archive -> edit -> re-run integrity ─────────────────────────────────────────────────
+  {
+    name: 'script-fields-dropped-from-return',
+    file: 'math-computation.js',
+    from: '    scriptPath: scriptRel, scriptHash: scriptHash,\n    attempt: attempt, attemptDir: dir, baseRunDir: baseDir,\n    scriptChanged: scriptChanged, scriptChangedDuringRun: scriptChangedDuringRun,\n    sourceFile: fileRel || null,\n    previousReceipt: receipt.previousReceipt,\n    packages: pk.found,',
+    to: '    packages: pk.found,',
+    expect: 'scriptPath + scriptHash are in the return value AND the receipt',
+  },
+  {
+    name: 'script-changed-never-flagged',
+    file: 'math-computation.js',
+    from: "  const scriptChanged = !!(mode === 'file' && prevReceipt && prevReceipt.scriptHash && prevReceipt.scriptHash !== scriptHash)",
+    to: '  const scriptChanged = false',
+    expect: 'edited file -> scriptChanged:true (no silent pass)',
+  },
+  {
+    name: 'mid-run-change-unflagged',
+    file: 'math-computation.js',
+    from: '    scriptChangedDuringRun = sourceHashAfter !== sourceHashBefore\n  }\n  if (!r) return fail(\'MATH_NO_SUBPROCESS\'',
+    to: '    scriptChangedDuringRun = false\n  }\n  if (!r) return fail(\'MATH_NO_SUBPROCESS\'',
+    expect: 'mid-run edit -> scriptChangedDuringRun:true',
+  },
+  {
+    name: 'archive-overwrite-instead-of-append',
+    file: 'math-computation.js',
+    from: "  const hasFirst = await H.exists(baseDir + '/receipt.json')\n  if (!hasFirst) return { attempt: 1, dir: baseDir }\n  let n = 2",
+    to: "  const hasFirst = await H.exists(baseDir + '/receipt.json')\n  return { attempt: 1, dir: baseDir }\n  let n = 2",
+    expect: 'a repeat is appended as attempt 2 (never overwriting attempt 1)',
+  },
+  {
+    name: 'retention-warning-silenced',
+    file: 'math-computation.js',
+    from: '  if (attempt > MATH_ARCHIVE_MAX_ATTEMPTS_PER_RUN) {',
+    to: '  if (false) {',
+    expect: 'over the retention cap the tool warns (ARCHIVE_RETENTION_EXCEEDED)',
+  },
+  {
+    name: 'receipt-reconciliation-skipped',
+    file: 'math-computation.js',
+    from: '  const scriptChanged = scriptMissing || (currentHash !== null && recordedHash !== null && currentHash !== recordedHash)',
+    to: '  const scriptChanged = false',
+    expect: 'op=receipt reports scriptChanged for an edited archive script',
+  },
+  // ── audit-C fixes ───────────────────────────────────────────────────────────────────────────
+  {
+    name: 'archive-allocation-unlocked',
+    file: 'math-computation.js',
+    // Each call gets its own lock chain, i.e. the per-archive-id serialisation is gone while the
+    // call itself is still awaited.
+    from: '  return await withArchiveLock(baseDir, async () => {',
+    to: "  return await withArchiveLock(baseDir + ':' + Math.random(), async () => {",
+    expect: '★ 同一 id 的并发运行绝不共用一个 attempt 目录（并发下的 append-only）',
+  },
+  {
+    name: 'deleted-source-unflagged',
+    file: 'math-computation.js',
+    from: '    scriptChangedDuringRun = sourceHashAfter !== sourceHashBefore',
+    to: '    scriptChangedDuringRun = false',
+    expect: 'the source file disappearing mid-run is a change: scriptChangedDuringRun:true',
+  },
+  {
+    name: 'missing-archive-script-unflagged',
+    file: 'math-computation.js',
+    from: '  const scriptChanged = scriptMissing || (currentHash !== null && recordedHash !== null && currentHash !== recordedHash)',
+    to: '  const scriptChanged = false',
+    expect: 'a deleted archive script makes op=receipt report scriptChanged (fail-closed)',
+  },
+  {
+    name: 'listdir-retention-skipped',
+    file: 'math-computation.js',
+    from: "  if (typeof H.listDir === 'function' && H.listDir) {",
+    to: '  if (false) {',
+    expect: 'listDir shows more than MATH_ARCHIVE_MAX_RUNS -> ARCHIVE_RETENTION_EXCEEDED (warn only)',
+  },
+  // ── audit-B fixes ───────────────────────────────────────────────────────────────────────────
+  {
+    name: 'override-ignored',
+    file: 'math-computation.js',
+    from: '  const o = ov && isObj(ov) ? ov[det.name] : null\n  if (!o) return d',
+    to: '  const o = ov && isObj(ov) ? ov[det.name] : null\n  if (!o || o) return d',
+    expect: 'the overridden scriptArgv really changes the assembled argv',
+  },
+  {
+    name: 'override-not-accepted',
+    file: 'math-computation.js',
+    from: "'dryRun', 'confirm', 'mathEngineOverride']",
+    to: "'dryRun', 'confirm']",
+    expect: 'mathEngineOverride is ACCEPTED (previously rejected as an unknown argument)',
+  },
+  {
+    name: 'archive-missing-not-refused',
+    file: 'math-computation.js',
+    from: "  if (json === undefined) return fail('MATH_REFUSED', null, '没有找到回执归档：",
+    to: "  if (json === undefined) return fail('MATH_INVALID_ARGUMENT', null, '没有找到回执归档：",
+    expect: 'op=receipt on a missing archive -> MATH_REFUSED',
+  },
+  {
+    name: 'shell-line-in-all-tiers',
+    file: 'math-computation.js',
+    from: "  const shell = mode === 'typed+shell' ? '\\n' + MATH_SHELL_RULE_LINE : ''",
+    to: "  const shell = '\\n' + MATH_SHELL_RULE_LINE",
+    expect: 'typed tier drops the shell-fallback sentence',
+  },
+]
+
+let ok = 0, bad = 0
+console.log('-- math_computation sensitivity probes --')
+console.log('(a probe passes when the mutation makes the shared contract suite RED for the named assertion)')
+console.log('')
+
+function runSuite(modulePath) {
+  const r = spawnSync(process.execPath, [SUITE], {
+    cwd: REPO, encoding: 'utf8',
+    env: Object.assign({}, process.env, { MATH_COMPUTATION_MODULE: modulePath }),
+  })
+  const out = String(r.stdout || '') + String(r.stderr || '')
+  const fails = out.split('\n').filter((l) => /FAIL /.test(l)).map((l) => l.trim())
+  return { code: r.status, fails, out }
+}
+
+// control: the unmutated canonical pair must be GREEN, otherwise every probe below is meaningless
+{
+  const dir = mkdtempSync(join(tmpdir(), 'mc-sens-control-'))
+  copyFileSync(join(SRC, 'math-engines.js'), join(dir, 'math-engines.js'))
+  copyFileSync(join(SRC, 'math-computation.js'), join(dir, 'math-computation.js'))
+  const r = runSuite(join(dir, 'math-computation.js'))
+  const tail = r.out.trim().split('\n').filter(Boolean).slice(-1)[0] || ''
+  if (r.code === 0) { ok++; console.log('  ok   control (unmutated copy) -> suite GREEN  ' + tail) }
+  else { bad++; console.log('  FAIL control (unmutated copy) went RED: ' + r.fails.slice(0, 3).join(' | ')) }
+  rmSync(dir, { recursive: true, force: true })
+}
+
+for (const p of PROBES) {
+  const dir = mkdtempSync(join(tmpdir(), 'mc-sens-' + p.name + '-'))
+  copyFileSync(join(SRC, 'math-engines.js'), join(dir, 'math-engines.js'))
+  const src = readFileSync(join(SRC, p.file), 'utf8')
+  if (src.indexOf(p.from) === -1) {
+    bad++
+    console.log('  FAIL ' + p.name + ' — mutation anchor no longer applies (drift): ' + JSON.stringify(p.from.slice(0, 60)))
+    rmSync(dir, { recursive: true, force: true })
+    continue
+  }
+  writeFileSync(join(dir, p.file), src.split(p.from).join(p.to))
+  const r = runSuite(join(dir, p.file))
+  const hit = r.fails.some((f) => f.indexOf(p.expect) !== -1)
+  if (r.code !== 0 && hit) { ok++; console.log('  ok   ' + p.name + ' -> RED on "' + p.expect + '"') }
+  else {
+    bad++
+    console.log('  FAIL ' + p.name + ' -> exit=' + r.code + ' expectedLabelFound=' + hit + ' fails=' + r.fails.slice(0, 3).join(' | '))
+  }
+  rmSync(dir, { recursive: true, force: true })
+}
+
+console.log('')
+console.log('math_computation sensitivity: ' + ok + ' probe(s) detected the break, ' + bad + ' problem(s)')
+process.exit(bad === 0 ? 0 : 1)