dsh-vibe-math 2.7.1 → 2.7.3

package/tests/audit-path-discipline.mjs

@@ -0,0 +1,83 @@
+// Dedicated cross-preset path-discipline audit (migrated out of formal-verify-v4 so that running ONE
+// preset's suite cannot miss this class).
+//
+// Covers:
+//   * v4 / v5 : every member-visible library declaration carries the member root (Members/<x>/...).
+//   * v3      : the writer `applyAgentWrites` accepts ONLY Problems|Progress|Propos|Methods|Notes at the
+//               PROJECT ROOT, so v3's declarations must stay root-relative - a Members/<x>/... declaration
+//               is a write the writer SILENTLY DISCARDS.
+//   * v2 / v3 : PAPER_PATH_NOTE structure, by DELIVERED MATERIAL (not by function site):
+//               - the evidence-index DATA LIST must not embed the prose rule;
+//               - every delivered member-facing material that carries copyable paths must append it -
+//                 for v2 that is the digest, which INLINES the evidence index; for v3 also the journal.
+//               Function-body windows are STRICTLY bounded (no fixed-length fallback): a window that can
+//               swallow the next function produces false passes.
+import { readFileSync } from 'node:fs'
+
+const R = new URL('../', import.meta.url)
+const ENV_OF = {
+  'vibe-math-v2/vibe-math-v2.js': 'V2_PLUGIN',
+  'vibe-math-v3/vibe-math-v3.js': 'V3_PLUGIN',
+  'vibe-math-v4/vibe-math-v4.js': 'V4_PLUGIN',
+  'vibe-math-v5/vibe-math-v5.js': 'V5_PLUGIN',
+}
+// a mutant harness (tests/audit-path-discipline.mutants.mjs) points these at scratch copies
+const rd = (p) => {
+  const e = ENV_OF[p] && process.env[ENV_OF[p]]
+  return e ? readFileSync(e, 'utf8') : readFileSync(new URL(p, R), 'utf8')
+}
+let passed = 0
+let failed = 0
+const fails = []
+const assert = (c, m) => { if (c) { passed++; console.log('  ok - ' + m) } else { failed++; fails.push(m); console.error('  FAIL - ' + m) } }
+
+const v2 = rd('vibe-math-v2/vibe-math-v2.js')
+const v3 = rd('vibe-math-v3/vibe-math-v3.js')
+const v4 = rd('vibe-math-v4/vibe-math-v4.js')
+const v5 = rd('vibe-math-v5/vibe-math-v5.js')
+
+const ROOT = /Members\/<[^>]+>\/(?:Progress|Propos|Methods|Subproblems)\//g
+const LEGACY = /(?:^|[^/>])(?:Progress|Propos|Methods|Subproblems)\/<[^>]+>\//g
+
+for (const [k, src] of [['v5', v5]]) {   // v5 pending vm-v5's re-verification of its bases
+  assert((src.match(ROOT) || []).length >= 4, k + ': member-visible declarations carry the member root')
+  assert((src.match(LEGACY) || []).length === 0, k + ': no legacy project-root-relative member-library declaration')
+}
+// v4 (critical correction): writer/reader live at the PROJECT ROOT - a Members/<x>/... path is never scanned
+assert(!/Members\//.test(v4), 'v4: no Members/ occurrence at all (widened predicate: literal ids escape the placeholder form) (the framework never scans it)')
+assert(/(?:Progress|Propos|Methods|Subproblems)\/<[^>]+>\//.test(v4), 'v4: declarations use the project-root bases the writer/reader use')
+assert(/progress\.md/.test(v4), 'class guard: v4 documents/writes the Progress base it reads')
+
+assert(!/Members\//.test(v3), 'v3: no Members/ occurrence at all (widened predicate: literal ids escape the placeholder form) (applyAgentWrites would DISCARD such a write)')
+assert(/applyAgentWrites[\s\S]{0,600}?(Problems|Progress|Propos|Methods|Notes)/.test(v3), 'class guard: v3 writer whitelists the sections its prompts name')
+
+// strictly bounded function-body window: never fall back to a fixed length
+const bodyOf = (src, fn) => {
+  const a = src.indexOf('function ' + fn)
+  if (a < 0) return null
+  const b = src.slice(a + 10).search(/\n {2}(?:async )?function /)
+  if (b < 0) return null
+  return src.slice(a, a + 10 + b)
+}
+
+for (const [k, src] of [['v2', v2], ['v3', v3]]) {
+  const def = (src.match(/const PAPER_PATH_NOTE/g) || []).length
+  assert(def === 1, k + ': PAPER_PATH_NOTE defined exactly once (found ' + def + ')')
+  const idxBody = bodyOf(src, 'paperEvidenceIndex')
+  const digBody = bodyOf(src, 'buildPaperDigest')
+  assert(idxBody !== null && digBody !== null, k + ': both function windows are bounded strictly (no fixed-length fallback)')
+  // the data list is a pure path list: no prose, no note
+  assert(!/PAPER_PATH_NOTE/.test(idxBody || ''), k + ': the evidence-index DATA LIST embeds no prose rule')
+  // the delivered material inlines that list and therefore carries the paths AND must carry the note
+  assert(/paperEvidenceIndex\(\)/.test(digBody || ''), k + ': the delivered digest INLINES the evidence index (so it carries the copyable paths)')
+  assert(/PAPER_PATH_NOTE/.test(digBody || ''), k + ': the delivered digest material appends PAPER_PATH_NOTE')
+  if (k === 'v3') {
+    const jr = bodyOf(src, 'writeJournal')
+    assert(jr !== null && /PAPER_PATH_NOTE/.test(jr), 'v3: the member-facing journal (writeJournal) also appends PAPER_PATH_NOTE')
+  }
+}
+
+console.log('')
+console.log('passed=' + passed + ' failed=' + failed)
+if (failed) { console.error('FAILURES:'); for (const f of fails) console.error('  - ' + f); process.exit(1) }
+console.log('ALL GREEN')

package/tests/audit-path-discipline.mutants.mjs

@@ -0,0 +1,51 @@
+// Registered mutant harness for tests/audit-path-discipline.mjs - the audit carries its own proof.
+// One mutant per assertion family; each MUST make the audit fail, otherwise the guard does not bite.
+// Usage: node tests/audit-path-discipline.mutants.mjs   (exit 0 = every family reddened)
+import { readFileSync, writeFileSync, mkdirSync, copyFileSync, rmSync, mkdtempSync } from 'node:fs'
+import { execFileSync } from 'node:child_process'
+import { fileURLToPath } from 'node:url'
+import { dirname, join } from 'node:path'
+import { tmpdir } from 'node:os'
+const here = dirname(fileURLToPath(import.meta.url))
+const repo = join(here, '..')
+const audit = join(here, 'audit-path-discipline.mjs')
+// Unique per run (audit C: a fixed repo-local dir could collide with a concurrent run and dirtied the tree)
+const tmp = mkdtempSync(join(tmpdir(), 'audit-mutants-'))
+const families = [
+  { name: 'v4-text-shape (delivered declaration re-prefixed)', preset: 'vibe-math-v4', env: 'V4_PLUGIN',
+    from: "+'  Propos/<" + String.fromCharCode(20320) + ">/<id>.md",
+    to: "+'  Members/<" + String.fromCharCode(20320) + ">/Propos/<" + String.fromCharCode(20320) + ">/<id>.md",
+    expect: /no Members\/ occurrence at all/ },
+  { name: 'v4-literal-members (widened Members/ predicate)', preset: 'vibe-math-v4', env: 'V4_PLUGIN',
+    from: "/Propos/r-1/p-1.md", to: "/Members/r-1/Propos/p-1.md",
+    expect: /no Members\/ occurrence at all/ },
+  { name: 'v3-writer-whitelist class guard (Members/ reintroduced)', preset: 'vibe-math-v3', env: 'V3_PLUGIN',
+    from: '(^|[^/>])(Propos)\\/<([^>]+)>\\/', to: '$1Members/<$3>/$2/<$3>/', regex: true,
+    expect: /v3: no Members\// },
+  { name: 'v2 PAPER_PATH_NOTE structure (digest append dropped)', preset: 'vibe-math-v2', env: 'V2_PLUGIN',
+    from: '    L.push(PAPER_PATH_NOTE)', to: '', expect: /delivered digest material appends PAPER_PATH_NOTE/ },
+]
+mkdirSync(tmp, { recursive: true })
+let ok = 0, bad = 0
+try {
+for (const f of families) {
+  const src = join(repo, f.preset, f.preset + '.js')
+  let t = readFileSync(src, 'utf8')
+  const hits = f.regex ? (t.match(new RegExp(f.from, 'm')) || []).length : t.split(f.from).length - 1
+  if (hits < 1) { console.error('  NO-OP - ' + f.name + ' (predicate did not match)'); bad++; continue }
+  t = f.regex ? t.replace(new RegExp(f.from, 'm'), f.to) : t.split(f.from).join(f.to)
+  const out = join(tmp, f.preset + '.js')
+  writeFileSync(out, t, 'utf8')
+  let red = false, msg = ''
+  try {
+    execFileSync(process.execPath, [audit], { env: Object.assign({}, process.env, { [f.env]: out }), encoding: 'utf8' })
+  } catch (e) { red = true; msg = String((e && (e.stdout || '')) + (e && (e.stderr || ''))) }
+  const named = f.expect.test(msg)
+  if (red && named) { ok++; console.log('  ok - ' + f.name + ' reddened the audit by name') }
+  else { bad++; console.error('  FAIL - ' + f.name + ' red=' + red + ' named=' + named + ' :: ' + msg.split('\n').filter((l) => l.includes('FAIL')).slice(0, 1).join('')) }
+}
+} finally { rmSync(tmp, { recursive: true, force: true }) }
+console.log('')
+console.log('mutant families reddening the audit: ' + ok + '/' + families.length)
+if (bad) process.exit(1)
+console.log('ALL FAMILIES BITE')

package/tests/audit-persona-sensitivity.mjs

@@ -65,6 +65,20 @@ function runSuite(root) {
 
 // A sanity gate first: the UNMUTATED copy must be GREEN through the override, otherwise
 // every probe below would "detect" the override itself rather than the mutation (trap 2).
+//
+// CONCURRENCY FIX: under run-tests this suite shares the machine with a plain
+// `audit-persona-surface` job, which WRITES the shipped corpus (`prompt-corpus-persona/*`) while the
+// children below READ it - and under PERSONA_ROOT the surface suite asserts those files EXIST. In a
+// tree where the corpus has not been generated yet (or is being regenerated), a child could observe the
+// directory without the files and fail, which showed up as "sensitivity red only under concurrency 4".
+// So: generate the corpus ONCE here first (parent run, no PERSONA_ROOT), then run the control. The
+// surface suite's own write is atomic (temp file + rename), so concurrent writers cannot tear the files.
+{
+  const warm = spawnSync(process.execPath, [SUITE], { env: process.env, encoding: 'utf8', cwd: REPO })
+  const warmOut = String(warm.stdout || '') + String(warm.stderr || '')
+  console.log('  ok   - corpus warmed by a plain parent run (exit=' + warm.status + ')' + (warm.status === 0 ? '' : ' [warning: plain run not green]'))
+  if (warm.status !== 0) console.error(warmOut.split('\n').filter((l) => l.includes('FAIL')).slice(0, 4).join('\n'))
+}
 const sanityRoot = prepareRoot()
 {
   const r = runSuite(sanityRoot)

package/tests/audit-persona-surface.mutants.mjs

@@ -0,0 +1,69 @@
+#!/usr/bin/env node
+/**
+ * Mutant harness for tests/audit-persona-surface.test.mjs (ships: `tests/*.mutants.mjs`).
+ *
+ * Converts the dev-only scratch proof (`_oneoff/auditR2/persona-mutant.mjs`) into package-reproducible
+ * form: a COPY of the four preset dirs is driven through the guard's `PERSONA_ROOT` seam, so the shipped
+ * files are never touched, and one single-site mutation must redden the guard BY NAME.
+ *
+ * The invariant: "every registered tool is mentioned in the persona, or explicitly allow-listed" — a newly
+ * registered tool that the persona never mentions (and the allow-list does not cover) must FAIL.
+ *
+ * Run: node tests/audit-persona-surface.mutants.mjs
+ */
+import { mkdtempSync, cpSync, readFileSync, writeFileSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { spawnSync } from 'node:child_process'
+import { fileURLToPath } from 'node:url'
+
+const HERE = fileURLToPath(new URL('./', import.meta.url))
+const REPO = join(HERE, '..')
+const GUARD = join(HERE, 'audit-persona-surface.test.mjs')
+const EXPECT = 'every registered tool is mentioned in the persona, or explicitly allow-listed'
+let passed = 0, failed = 0
+const ok = (c, l, d) => { if (c) { passed++; console.log('  ok   ' + l) } else { failed++; console.log('  FAIL ' + l + (d ? ' — ' + d : '')) } }
+
+const runGuard = (env) => {
+  const r = spawnSync(process.execPath, [GUARD], { cwd: REPO, encoding: 'utf8', maxBuffer: 1 << 26, env: Object.assign({}, process.env, env || {}) })
+  const o = String(r.stdout || '') + String(r.stderr || '')
+  return { status: r.status, out: o, sum: (o.split('\n').filter((l) => /RESULT:/.test(l)).slice(-1)[0] || '').trim(), failLines: o.split('\n').filter((l) => /^\s*FAIL\b|^  - /.test(l)) }
+}
+
+// baseline 1: the real tree
+const base = runGuard(null)
+ok(base.status === 0, 'baseline: the shipped guard is green on the real tree', base.sum.slice(0, 70))
+
+// baseline 2: the COPIED tree the mutation will use (proves the copy is faithful, not the mutation)
+const root = mkdtempSync(join(tmpdir(), 'persona-surface-mut-'))
+for (const dir of ['vibe-math-v2', 'vibe-math-v3', 'vibe-math-v4', 'vibe-math-v5']) cpSync(join(REPO, dir), join(root, dir), { recursive: true })
+const copyBase = runGuard({ PERSONA_ROOT: root })
+ok(copyBase.status === 0, 'baseline: the same guard is green on the copied tree (PERSONA_ROOT seam is faithful)', copyBase.sum.slice(0, 70))
+
+// mutant: register a tool the persona never mentions and the allow-list does not cover
+const v2 = join(root, 'vibe-math-v2', 'vibe-math-v2.js')
+const src = readFileSync(v2, 'utf8')
+const anchor = "registerTool('vibe_math_status'"
+if (src.indexOf(anchor) === -1) ok(false, 'the single-site anchor applies (registerTool call site)', 'ANCHOR MISS')
+else {
+  writeFileSync(v2, src.replace(anchor, "registerTool('vibe_math_brand_new_unmentioned', objParams({}), () => ({ok:true}))\n  " + anchor))
+  const mut = runGuard({ PERSONA_ROOT: root })
+  const named = mut.out.split('\n').some((l) => l.indexOf(EXPECT) !== -1)
+  ok(mut.status !== 0 && named, '★ a newly registered, unmentioned tool reddens the guard by name (unit: registered tool names)', mut.sum.slice(0, 80))
+  if (!named) for (const l of mut.failLines.slice(0, 4)) console.log('        ' + l.trim().slice(0, 140))
+}
+// Stronger seam evidence than "green on the copy" (R17): DELETE a preset dir from a FRESH copy and the
+// guard must fail with ENOENT naming the COPIED path — that proves the seam is actually READ, rather than
+// the guard silently falling back to the real tree (which would make the mutation case above meaningless).
+const root2 = mkdtempSync(join(tmpdir(), 'persona-surface-seam-'))
+for (const dir of ['vibe-math-v2', 'vibe-math-v3', 'vibe-math-v5']) cpSync(join(REPO, dir), join(root2, dir), { recursive: true })
+const missing = runGuard({ PERSONA_ROOT: root2 })
+const namesCopiedPath = missing.out.indexOf(root2) !== -1 && /ENOENT/.test(missing.out)
+ok(missing.status !== 0 && namesCopiedPath,
+  '★ seam is READ: removing a preset from the copy makes the guard fail with ENOENT on the COPIED path (unit: ENOENT paths)',
+  'exit=' + missing.status + ' namesCopied=' + namesCopiedPath)
+rmSync(root2, { recursive: true, force: true })
+rmSync(root, { recursive: true, force: true })
+console.log('')
+console.log('=== PERSONA SURFACE MUTANTS: ' + passed + ' passed, ' + failed + ' failed ===')
+process.exit(failed === 0 ? 0 : 1)

package/tests/audit-persona-surface.test.mjs

@@ -2,6 +2,14 @@
 /**
  * PERSONA SURFACE — prompt/allocation consistency for the four presets.
  *
+ * DEFECT CLASS (why this guard exists; it belongs to the dual-persona-block parity family of §3)
+ *   "capability advertised but never granted, or granted but never advertised": the persona block is
+ *   the main agent view of the tool surface, so a registered-but-unnamed tool is invisible and a
+ *   named-but-unregistered tool is a trap. Every other suite calls apply(ctx) directly and never
+ *   parses the YAML, so this class cannot fail anywhere else.
+ *
+ * Run: node tests/audit-persona-surface.test.mjs
+ *
  * WHY THIS EXISTS
  *   The persona row of each `agent.cordis.yml` is the prompt the MAIN agent actually
  *   receives, and it is the only place the main agent learns which `vibe_*` tools exist
@@ -26,7 +34,10 @@
  *      `text` must not receive a different tool surface from a new host that uses `prefix`;
  *   C. mentions ⊆ registered: every `vibe_*` token in the persona is a registered tool
  *      (a `name*` mention is allowed when some registered tool carries that prefix);
- *   D. registered \ mentioned equals an explicit, reviewed snapshot — so adding a tool
+ *   D. every registered tool is either MENTIONED in the persona or consciously ALLOW-LISTED, and the
+ *      allow-list is itself validated (real tools only, empty by default) — so adding a tool forcing a
+ *      decision: name it, or add it to the list with a reason. (Earlier this was a snapshot equality,
+ *      which went red whenever a legitimately newly-named tool emptied the "undocumented" set.)
  *      without documenting it (or deleting a tool the persona still advertises) fails
  *      loudly and forces the author to make a decision;
  *   E. the parameter surface of the Lean feature (the four names) and its semantics
@@ -36,7 +47,7 @@
  * the coordinator's persona?" — virtually all of them are `(member)` / `(academician)` /
  * `(resident)` tools that only subagents call.
  */
-import { readFileSync, writeFileSync, mkdirSync, existsSync } from 'node:fs'
+import { readFileSync, writeFileSync, mkdirSync, existsSync, renameSync } from 'node:fs'
 import { join, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
@@ -133,9 +144,12 @@ const PRESETS = [
     js: 'vibe-math-v2.js',
     prefix: 'vibe_math_',
     tools: 28,
-    // member-facing write-lock / scheduler-metadata tools; the v2 coordinator never
-    // writes Markdown itself, so they stay out of its persona.
-    undocumented: [],
+    // D. registered \ mentioned ⊆ allow-list: EVERY registered tool must be mentioned in the persona,
+    // unless its name is listed here as a conscious exception (the allow-list is empty by default, so a
+    // newly registered tool cannot slip in unnamed). An entry must be a REAL registered tool, and a
+    // preset may also pin names that must be mentioned (never allow-listed).
+    allowList: [],
+    required: [],
     lean: { tools: ['vibe_math_lean_run', 'vibe_math_lean_archive', 'vibe_math_lean_lib', 'vibe_math_lean_read', 'vibe_math_lean_job'], extra: [] },
     // the shared math-computation tool (docs/math-computation.md) is prefix-less by
     // design (INTERFACE-FREEZE.md §3), so it is pinned explicitly here.
@@ -146,11 +160,11 @@ const PRESETS = [
     js: 'vibe-math-v3.js',
     prefix: 'vibe_math_',
     tools: 36,
-    // `vibe_math_sync_meta` is no longer undocumented: the promotion-contract line of the
-    // persona now names it as the place to report `lemmas[].价值/关键性` (v3 audit M1 —
-    // without a prompt-side source for that field the promotion main line is unreachable).
-    // The write-lock pair stays out: solver/method-keeper prompts carry it via kcWriteRules().
-    undocumented: ['vibe_math_claim_write', 'vibe_math_release_write'],
+    // `vibe_math_sync_meta` is named by the promotion-contract line, and the write-lock pair is now
+    // named too (the lock is described in the persona, so leaving the two tools unmentioned was the
+    // last hole). Both stay REQUIRED: they must be mentioned, never allow-listed.
+    allowList: [],
+    required: ['vibe_math_claim_write', 'vibe_math_release_write'],
     lean: { tools: ['vibe_math_lean_run', 'vibe_math_lean_archive', 'vibe_math_lean_lib', 'vibe_math_lean_read', 'vibe_math_lean_job'], extra: [] },
     // the shared math-computation tool (docs/math-computation.md) is prefix-less by
     // design (INTERFACE-FREEZE.md §3), so it is pinned explicitly here.
@@ -161,15 +175,18 @@ const PRESETS = [
     js: 'vibe-math-v4.js',
     prefix: 'vibe_v4_',
     tools: 35,
-    // resident-facing tools (mail, library cards, task board, write lock). The
-    // coordinator drives residents through vibe_v4_message / _meeting / _add_member.
-    undocumented: [
+    // Member-facing tools (mail, library cards, task board, write lock) that the v4 persona describes
+    // GENERICALLY rather than naming one by one; the coordinator drives residents through
+    // vibe_v4_message / _meeting / _add_member. Allow-listed ON PURPOSE, so a NEWLY registered tool
+    // still has to be named (or added here consciously).
+    allowList: [
       'vibe_v4_send_message', 'vibe_v4_publish_progress', 'vibe_v4_record_proposition',
       'vibe_v4_record_method', 'vibe_v4_record_subproblem', 'vibe_v4_read_progress',
       'vibe_v4_list_residents', 'vibe_v4_propose_task', 'vibe_v4_claim_task',
       'vibe_v4_task_done', 'vibe_v4_list_tasks', 'vibe_v4_report_context',
       'vibe_v4_claim_write', 'vibe_v4_release_write',
     ],
+    required: [],
     lean: { tools: ['vibe_v4_lean_run', 'vibe_v4_lean_archive', 'vibe_v4_lean_lib', 'vibe_v4_lean_read', 'vibe_v4_lean_job'], extra: ['vibe_v4_formal_report'] },
     // the shared math-computation tool (docs/math-computation.md) is prefix-less by
     // design (INTERFACE-FREEZE.md §3), so it is pinned explicitly here.
@@ -180,17 +197,18 @@ const PRESETS = [
     js: 'vibe-math-v5.js',
     prefix: 'vibe_v5_',
     tools: 40,
-    // member- and academician-facing tools; the office (main agent) holds only the
-    // institute-level controls plus the hiring authority. The final-paper pair is an
-    // OFFICE control and IS named in the persona (vibe_v5_paper / vibe_v5_finalize_paper),
-    // so it must not appear in this snapshot.
-    undocumented: [
+    // Member- and academician-facing tools that the v5 persona describes GENERICALLY; the office (main
+    // agent) holds only the institute-level controls plus the hiring authority. The final-paper pair is
+    // an OFFICE control and IS named in the persona (vibe_v5_paper / vibe_v5_finalize_paper), so it must
+    // NOT be allow-listed here. Allow-listed ON PURPOSE: a NEWLY registered tool still has to be named.
+    allowList: [
       'vibe_v5_wait', 'vibe_v5_record_progress', 'vibe_v5_record_proposition',
       'vibe_v5_record_method', 'vibe_v5_record_subproblem', 'vibe_v5_read_library',
       'vibe_v5_propose_verify', 'vibe_v5_verdict', 'vibe_v5_task_create',
       'vibe_v5_task_list', 'vibe_v5_task_get', 'vibe_v5_task_update',
       'vibe_v5_overview', 'vibe_v5_assign', 'vibe_v5_prioritize', 'vibe_v5_nudge',
     ],
+    required: [],
     lean: { tools: ['vibe_v5_lean_run', 'vibe_v5_lean_archive', 'vibe_v5_lean_lib', 'vibe_v5_lean_read', 'vibe_v5_lean_job'], extra: [] },
     // the shared math-computation tool (docs/math-computation.md) is prefix-less by
     // design (INTERFACE-FREEZE.md §3), so it is pinned explicitly here.
@@ -264,8 +282,21 @@ for (const P of PRESETS) {
     for (const w of wildcards) {
       ok([...registered].some((n) => n.startsWith(w)), `${P.dir} [${key}]: wildcard mention ${w}* matches no registered tool`)
     }
-    const undocumented = [...registered].filter((n) => !mentioned.has(n)).sort()
-    eq(undocumented, [...P.undocumented].sort(), `${P.dir} [${key}]: undocumented-tool snapshot changed`)
+    const unmentioned = [...registered].filter((n) => !mentioned.has(n)).sort()
+    // ALLOW-LIST design (replaces the old "equals a reviewed snapshot" equality): a registered tool may
+    // be absent from the persona ONLY if its name is consciously allow-listed for this preset. The
+    // allow-list is empty by default (v2/v3), so a newly registered tool turns this red until it is
+    // either mentioned in the persona or deliberately added to the list with a reason.
+    const allowed = new Set(P.allowList || [])
+    const illegal = unmentioned.filter((n) => !allowed.has(n))
+    ok(illegal.length === 0, `${P.dir} [${key}]: every registered tool is mentioned in the persona, or explicitly allow-listed`,
+      'unmentioned and not allow-listed: ' + JSON.stringify(illegal))
+    const staleAllowed = [...allowed].filter((n) => !registered.has(n)).sort()
+    ok(staleAllowed.length === 0, `${P.dir} [${key}]: every allow-list entry is a real registered tool`,
+      'allow-listed but not registered: ' + JSON.stringify(staleAllowed))
+    for (const must of (P.required || [])) {
+      ok(mentioned.has(must) && !allowed.has(must), `${P.dir} [${key}]: ${must} must be MENTIONED in the persona (never allow-listed)`)
+    }
   }
 
   // ---- F. the slash-command surface -------------------------------------
@@ -360,8 +391,18 @@ try {
         '### config.prefix', '', '```text', r.prefix, '```', '', '### config.text', '', '```text', r.text, '```', '')
     }
     mkdirSync(corpusDir, { recursive: true })
-    writeFileSync(join(corpusDir, 'persona-corpus.md'), md.join('\n'), 'utf8')
-    writeFileSync(join(corpusDir, 'persona-corpus.json'), JSON.stringify({ presets: rows }, null, 2) + '\n', 'utf8')
+    // CONCURRENCY FIX: `audit-persona-sensitivity` spawns this suite with PERSONA_ROOT, and those child
+    // runs READ these two shipped files while a parallel `run-tests` job may be WRITING them. A plain
+    // writeFileSync let a reader observe a half-written JSON (the flake: sensitivity red only under
+    // concurrency 4, SETUP-FAIL in its control run). Write a unique temp file in the same directory and
+    // rename it into place, so a reader sees either the old or the new file, never a partial one.
+    const writeAtomic = (target, data) => {
+      const tmp = target + '.tmp-' + process.pid + '-' + Math.random().toString(36).slice(2)
+      writeFileSync(tmp, data, 'utf8')
+      renameSync(tmp, target)
+    }
+    writeAtomic(join(corpusDir, 'persona-corpus.md'), md.join('\n'))
+    writeAtomic(join(corpusDir, 'persona-corpus.json'), JSON.stringify({ presets: rows }, null, 2) + '\n')
   }
   // Round-trip check: the shipped corpus must name all four presets and carry line 0 of each block.
   // Skipped under PERSONA_ROOT: there `rows` describe the mutated copy while the corpus on disk

package/tests/audit-prompt-duplication.mjs

@@ -0,0 +1,143 @@
+// ============================================================================
+// audit-prompt-duplication.mjs — shipped invariant for v2/v3/v4 (v5 has its own,
+// tests/audit-v5-prompt-duplication.mjs): every preset's injected toolkit prompt
+// text exists TWICE in its `agent.cordis.yml` (two agent-instructions entries:
+// office + members). In these three presets the SECOND entry continues with more
+// YAML after the shared toolkit text, so the invariant is stated as:
+//   (1) the two copies share a substantial COMMON PREFIX of prompt lines (≥ 60% of
+//       the shorter copy, and every line the first copy adds beyond the prefix is
+//       pure YAML scaffolding — never prompt prose), and
+//   (2) the review-10 clauses (V2-1 disclosures, V2-3 path bases) are present inside
+//       that shared prefix, i.e. in BOTH copies.
+// No YAML anchor is used on purpose (it would change what the loader expands).
+// Falsifiability: `tests/audit-prompt-duplication.mutants.mjs` (single-copy edit ⇒ named red).
+// Run: node tests/audit-prompt-duplication.mjs [--json]
+// ============================================================================
+import { readFileSync, existsSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
+import { dirname, join } from 'node:path'
+
+const HERE = dirname(fileURLToPath(import.meta.url))
+const REPO = join(HERE, '..')
+const PRESETS = ['vibe-math-v2', 'vibe-math-v3', 'vibe-math-v4']
+// In-memory single-site mutation for the mutants driver: [preset, from, to] (first occurrence only).
+const MUT = process.env.PROMPT_DUP_MUTATE ? JSON.parse(process.env.PROMPT_DUP_MUTATE) : null
+const SKIP_CLAUSES = process.env.PROMPT_DUP_SKIP_CLAUSES === '1'
+
+const PATH_CLAUSES = [
+  ['V2-3 base statement', /every path here is resolved against the SESSION WORKING DIRECTORY/],
+  ['V2-3 short-form equivalence', /names the SAME file/],
+]
+// Clause expectations are CODE-TRUTH-DRIVEN, not global: a DISCLOSURE is required only in presets
+// whose code actually implements that behaviour, and the guard checks BOTH directions (prompt
+// declares it ⇔ the JS carries the behaviour marker, re-measured every run). Each entry is
+// [name, prompt regex, code marker regex, which presets the code justifies]. A preset whose JS lacks
+// the marker must NOT declare the clause (`must NOT be declared here`) — declaring a behaviour that
+// does not exist is worse than the undisclosed-behaviour gap it was meant to close.
+const DISCLOSURES = [
+  // window 1 (V2-1 ①–③)
+  ['V2-1 paper force-finalise / reaping disclosure', /DISCLOSURE \(existing behaviour\): the FINAL PAPER/, /reapedThisRun|forcedAfterCap/, ['v2', 'v3']],
+  ['V2-1 auto-resolve disclosure', /DISCLOSURE \(existing behaviour\): switching the mode to `auto`/, /auto-resolved/, ['v2', 'v3']],
+  ['V2-1 progress-push disclosure', /DISCLOSURE \(existing behaviour\): the framework itself pushes a progress/, /\u8fdb\u5ea6\u66f4\u65b0\uff1a/, ['v2', 'v3']],
+  // window 2 (V2-1 ④–⑦)
+  ['V2-1 project-lock takeover disclosure', /DISCLOSURE \(existing behaviour\): a second session can TAKE OVER/, /lock taken over/, ['v3']],
+  ['V2-1 auto-reprioritisation disclosure', /DISCLOSURE \(existing behaviour\): the framework can adjust problem\/proposition priorities/, /priorities auto-adjusted/, ['v2', 'v3']],
+  ['V2-1 math-policy refusal disclosure', /DISCLOSURE \(existing behaviour\): when mathMode is `typed`/, /mathMode|typed\+shell/, ['v2', 'v3', 'v4']],
+  ['V2-3e math-policy line', /math_computation policy: mathComputation/, /mathComputation/, ['v2', 'v3', 'v4']],
+  ['V2-1 post-compaction recap disclosure', /DISCLOSURE \(existing behaviour\): after a real context compaction the framework injects/, /\u6838\u5fc3\u89c4\u5219\u91cd\u7533|CONTEXT COMPACT/, ['v4']],
+]
+const PRESET_KEY = { 'vibe-math-v2': 'v2', 'vibe-math-v3': 'v3', 'vibe-math-v4': 'v4' }
+// Declaration-syntax scanner (§9.7⑨): anchored on the SHAPE of a declaration, not on a substring.
+const NAME_RE = '[a-zA-Z][A-Za-z0-9]*'
+const DECL_BULLET = new RegExp('^\\s*-\\s+`?(' + NAME_RE + ')`?\\s*=\\s*\\S')
+const DECL_LIST = new RegExp('^\\s*(?:' + NAME_RE + '\\s*=\\s*[^,\\n]{1,40})(?:\\s*[,，]\\s*' + NAME_RE + '\\s*=\\s*[^,\\n]{1,40})+\\s*$')
+function declarations(rawLines) {
+  const out = []
+  rawLines.forEach((raw, i) => {
+    const line = raw.replace(/\r$/, '')
+    const m1 = DECL_BULLET.exec(line)
+    if (m1) { out.push({ name: m1[1], line: i + 1 }); return }
+    if (DECL_LIST.test(line)) for (const m of line.matchAll(new RegExp('\\b(' + NAME_RE + ')\\s*=\\s*', 'g'))) out.push({ name: m[1], line: i + 1 })
+  })
+  return out
+}
+const normLine = (l) => l.replace(/\s+/g, ' ').replace(/\{\{cwd\}\}|\{\{model\}\}/g, '<T>').trim()
+const SCAFFOLD = /^(-|#|\s*$)|^(suffix|text|priority|config|name|id|content|role):|^You are a coding agent powered by/
+
+const failures = []
+let passed = 0
+const check = (cond, msg) => { if (cond) passed += 1; else failures.push(msg) }
+const report = []
+
+for (const preset of PRESETS) {
+  const rel = preset + '/agent.cordis.yml'
+  const abs = join(REPO, rel)
+  if (!existsSync(abs)) { check(false, rel + ' is missing'); continue }
+  let text = readFileSync(abs, 'utf8')
+  if (MUT && MUT[0] === preset) {
+    const i = text.indexOf(MUT[1])
+    if (i === -1) { check(false, preset + ': mutant anchor not found (harness problem)'); continue }
+    text = text.slice(0, i) + MUT[2] + text.slice(i + MUT[1].length)
+  }
+  const lines = text.split('\n')
+  const starts = []
+  lines.forEach((l, i) => { if (/## Vibe Math V\d+ toolkit/.test(l) || /This session includes "Vibe Math V/.test(l)) starts.push(i) })
+  const heads = []
+  for (const s of starts) if (!heads.length || s - heads[heads.length - 1] > 3) heads.push(s)
+  check(heads.length === 2, preset + ': exactly TWO toolkit prompt copies (got ' + heads.length + ' at ' + JSON.stringify(heads.map((h) => h + 1)) + ')')
+  if (heads.length !== 2) { report.push({ preset, copies: heads.length }); continue }
+  const A = lines.slice(heads[0], heads[1]).map(normLine).filter((x) => x)
+  const B = lines.slice(heads[1]).map(normLine).filter((x) => x)
+  let common = 0
+  while (common < A.length && common < B.length && A[common] === B[common]) common += 1
+  const shared = A.slice(0, common).join(' ')
+  const tailA = A.slice(common)
+  const shorter = Math.min(A.length, B.length)
+  const ratio = common / Math.max(1, shorter)
+  check(ratio >= 0.6, preset + ': the two copies share a substantial common prefix (' + common + '/' + shorter + ' = ' + ratio.toFixed(2) + ' ≥ 0.60)')
+  const proseTail = tailA.filter((l) => !SCAFFOLD.test(l))
+  check(proseTail.length === 0, preset + ': everything the first copy adds beyond the shared prefix is YAML scaffolding, not prompt prose (' + proseTail.length + ' prose line(s) left'
+    + (proseTail.length ? ': ' + JSON.stringify(proseTail.slice(0, 2).map((x) => x.slice(0, 60))) : '') + ')')
+  if (!SKIP_CLAUSES) {
+    for (const [name, re] of PATH_CLAUSES) check(re.test(shared), preset + ': ' + name + ' present in BOTH copies (inside the shared prefix)')
+    // bidirectional: the prompt declares the behaviour ⇔ the JS carries its marker
+    const jsAbs = join(REPO, preset, preset + '.js')
+    const js = existsSync(jsAbs) ? readFileSync(jsAbs, 'utf8') : ''
+    check(!!js, preset + ': the JS source is readable for the code-truth check')
+    DISCLOSURES.forEach(([name, promptRe, codeRe, applies]) => {
+      const expected = applies.indexOf(PRESET_KEY[preset]) !== -1
+      const inCode = codeRe.test(js)
+      check(inCode === expected, preset + ': code-truth for "' + name + '" (expected=' + expected + ', code marker present=' + inCode + ')')
+      if (expected) check(promptRe.test(shared), preset + ': ' + name + ' present in BOTH copies (inside the shared prefix)')
+      else check(!promptRe.test(shared), preset + ': ' + name + ' must NOT be declared here (the code does not implement it)')
+    })
+    // ── declaration-syntax scanner (§9.7⑨) ────────────────────────────────────────────────
+    // A parameter the prompt PRESENTS AS A DECLARATION must be readable as `params.<name>` in that
+    // preset's JS, and must be declared in BOTH copies. The scan anchors on the declaration's
+    // SYNTAX (a bullet starting with `- <name> = …`, or a pure `name = value, name2 = value2`
+    // list), never on a substring: a mention inside a disclosure sentence must not count as a
+    // declaration. On today's prompts this scan is EMPTY by construction (vacuous-by-construction);
+    // the mutant driver injects a declaration line into ONE copy to prove the scan bites.
+    const declA = declarations(lines.slice(heads[0], heads[1]))
+    const declB = declarations(lines.slice(heads[1]))
+    const namesA = [...new Set(declA.map((d) => d.name))]
+    const namesB = new Set(declB.map((d) => d.name))
+    for (const name of namesA) {
+      check(namesB.has(name), preset + ': parameter "' + name + '" declared in copy 1 (L' + declA.find((d) => d.name === name).line + ' of its slice) must also be declared in copy 2')
+      check(new RegExp('params\\.' + name + '\\b').test(js), preset + ': parameter "' + name + '" is presented as a declaration but the JS never reads params.' + name)
+    }
+    for (const d of declB) {
+      if (!namesA.includes(d.name)) check(false, preset + ': parameter "' + d.name + '" is declared in copy 2 only (L' + d.line + ' of its slice) — both copies must agree')
+    }
+    report.push({ preset, copies: 2, sharedLines: common, ratio: Number(ratio.toFixed(3)), declarations: namesA.length })
+  }
+}
+
+if (process.argv.includes('--json')) console.log(JSON.stringify({ passed, failed: failures.length, failures, report }))
+else {
+  console.log('v2/v3/v4 prompt duplication audit')
+  for (const r of report) console.log('  ' + r.preset + ': copies=' + (r.copies || 2) + ' sharedLines=' + r.sharedLines + ' ratio=' + r.ratio + ' declaredParams=' + (r.declarations === undefined ? '-' : r.declarations))
+  for (const f of failures) console.log('  FAIL - ' + f)
+  console.log((failures.length ? 'FAILED' : 'ALL GREEN') + ' — passed=' + passed + ' failed=' + failures.length)
+}
+process.exit(failures.length ? 1 : 0)

package/tests/audit-prompt-duplication.mutants.mjs

@@ -0,0 +1,50 @@
+// Falsifiability driver for tests/audit-prompt-duplication.mjs (v2/v3/v4): a SINGLE-SITE edit in ONE
+// prompt copy of ONE preset must turn both the equality check and the clause check NAMED-red, while
+// the unmutated control stays green.
+import { spawnSync } from 'node:child_process'
+const SUITE = 'D:/wd/vibemath开发/Vibe-Mathematics/tests/audit-prompt-duplication.mjs'
+const run = (env) => {
+  const r = spawnSync(process.execPath, [SUITE, '--json'], { encoding: 'utf8', timeout: 120000, env: Object.assign({}, process.env, env || {}) })
+  let parsed = null
+  try { parsed = JSON.parse(r.stdout) } catch (e) { /* reported */ }
+  return { code: r.status, parsed, out: String(r.stdout || '') + String(r.stderr || '') }
+}
+const control = run({ PROMPT_DUP_SKIP_CLAUSES: '1' })   // duplication-only control (clauses land with the prompt edits)
+const MUTS = [
+  ['v2 single-copy drift', ['vibe-math-v2', 'Data lives under {{cwd}}/VibeMath/Projects/<project>/', 'Data lives under {{cwd}}/VibeMath/Projects/<project>/ (mutated in ONE copy only)']],
+  ['v3 single-copy drift', ['vibe-math-v3', 'TRUST RULE: only Verified/', 'TRUST RULE (mutated in ONE copy only): only Verified/']],
+  ['v4 single-copy drift', ['vibe-math-v4', 'TRUST RULE: only Verified/', 'TRUST RULE (mutated in ONE copy only): only Verified/']],
+]
+// Declaration-syntax scanner self-probe (§9.7⑨): inject ONE declaration-syntax line into ONE copy at
+// that preset's own anchor. v2/v3 read params.activityLogCap ⇒ the single-copy rule must fire; v4
+// never reads it ⇒ the code-truth rule must fire.
+const DECL_MUTS = [
+  ['v2 declaration line (one copy)', ['vibe-math-v2', 'When the user asks about progress, call vibe_math_report and summarize in plain language.', 'When the user asks about progress, call vibe_math_report and summarize in plain language.\r\n        - activityLogCap = 100']],
+  ['v3 declaration line (one copy)', ['vibe-math-v3', 'When the user asks about progress, call vibe_math_report and summarize in plain language.', 'When the user asks about progress, call vibe_math_report and summarize in plain language.\r\n        - activityLogCap = 100']],
+  ['v4 declaration line (unread field)', ['vibe-math-v4', 'When the user asks about progress, call vibe_v4_report and summarize in plain language.', 'When the user asks about progress, call vibe_v4_report and summarize in plain language.\r\n        - activityLogCap = 100']],
+]
+let problems = 0
+console.log('control (duplication-only, clauses skipped): exit=' + control.code + ' | ' + JSON.stringify(control.parsed && { passed: control.parsed.passed, failed: control.parsed.failed })
+  + (control.parsed && control.parsed.report ? ' | ' + control.parsed.report.map((r) => r.preset + ':ratio=' + r.ratio).join(' ') : ''))
+if (control.code !== 0) problems += 1
+const NAMED = /share a substantial common prefix|present in BOTH copies|scaffolding, not prompt prose/
+for (const [name, mut] of MUTS) {
+  const r = run({ PROMPT_DUP_MUTATE: JSON.stringify(mut), PROMPT_DUP_SKIP_CLAUSES: '1' })
+  const named = !!(r.parsed && (r.parsed.failures || []).some((f) => NAMED.test(f)))
+  const ok = r.code !== 0 && named
+  if (!ok) problems += 1
+  console.log(name.padEnd(24) + ': exit=' + r.code + (ok ? '  RED (as required)' : '  NOT RED'))
+  for (const f of ((r.parsed && r.parsed.failures) || []).slice(0, 1)) console.log('    → ' + String(f).slice(0, 150))
+}
+// declaration-syntax scanner probes run in DEFAULT mode (the scan lives in the clause block)
+const DECL_NAMED = /must also be declared in copy 2|never reads params\.|declared in copy 2 only/
+for (const [name, mut] of DECL_MUTS) {
+  const r = run({ PROMPT_DUP_MUTATE: JSON.stringify(mut) })
+  const named = !!(r.parsed && (r.parsed.failures || []).some((f) => DECL_NAMED.test(f)))
+  const ok = r.code !== 0 && named
+  if (!ok) problems += 1
+  console.log(name.padEnd(32) + ': exit=' + r.code + (ok ? '  RED (as required)' : '  NOT RED'))
+  for (const f of ((r.parsed && r.parsed.failures) || []).filter((f) => DECL_NAMED.test(f)).slice(0, 2)) console.log('    → ' + String(f).slice(0, 160))
+}
+console.log(problems === 0 ? '\nPROMPT-DUPLICATION (v2/v3/v4) MUTANTS: every single-copy edit turns the NAMED check red' : '\nPROMPT-DUPLICATION MUTANTS: ' + problems + ' problem(s)')
+process.exit(problems === 0 ? 0 : 1)