dsh-vibe-math 2.7.2 → 2.8.0

package/tests/audit-participant-set-parity.mjs

@@ -0,0 +1,160 @@
+// ============================================================================================
+// CROSS-PRESET PARTICIPANT-SET PARITY (P4 / item 6.3)
+//
+// Expectation source: `_oneoff/review/participant-set-map.md` (table first, then this guard).
+//
+// The four presets deliberately use DIFFERENT names for the same concept - "which set of members is
+// this decision counting, and as of which roster state":
+//   · v2 `voteCount(t, round)`  -> { participants, expected, round, allParticipantsReported }
+//   · v3 `voteCount(t, round)`  -> { participants, expected, round }   (NO allParticipantsReported:
+//                                  its readers compose their own predicate - a deliberate difference)
+//   · v4 `activeRosterSnapshot()` -> `frozen: { version, participants, kind }` (atomic; deprecated
+//                                  alias `frozenParticipants`)
+//   · v5 `rosterSnapshot()` -> `quorumView(): { m, mode, voters, voterCount, started, phase, rosterVersion }`
+//
+// So a behavioural "the numbers agree" test would have to unify those contracts, which is exactly what
+// must NOT happen (v2's P2 regression came from collapsing two predicates). This guard is therefore
+// STATIC: it pins, per preset, (a) that the participant set has exactly ONE producer, (b) that the set
+// and its roster version/expectation are surfaced TOGETHER, and (c) the deliberate v2/v3 difference.
+//
+// Usage: node tests/audit-participant-set-parity.mjs
+// ============================================================================================
+import { readFileSync, existsSync } from 'node:fs'
+import { join, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const REPO = resolve(fileURLToPath(new URL('..', import.meta.url)))
+const read = (rel) => existsSync(join(REPO, rel)) ? readFileSync(join(REPO, rel), 'utf8') : ''
+
+let passed = 0, failed = 0
+const failures = []
+function ok(cond, label, detail) {
+  if (cond) { passed++; console.log('  ok   ' + label); return true }
+  failed++; failures.push(label + (detail ? ' — ' + detail : '')); console.log('  FAIL ' + label + (detail ? ' — ' + detail : ''))
+  return false
+}
+const occurrences = (s, re) => (s.match(re) || []).length
+/** The body of a named function, by brace counting from its `function <name>(` occurrence. */
+function body(src, name) {
+  const i = src.indexOf('function ' + name + '(')
+  if (i === -1) return ''
+  let depth = 0, started = false
+  for (let j = i; j < src.length; j++) {
+    if (src[j] === '{') { depth++; started = true }
+    else if (src[j] === '}') { depth--; if (started && depth === 0) return src.slice(i, j + 1) }
+  }
+  return src.slice(i)
+}
+
+// ---- `--self-probe`: the SAME predicates against deliberately broken source strings -----------
+// Shipped form of the load-bearing proof (was `_oneoff/auditR2/participant-set-proof.mjs`): six cases,
+// each GREEN on the real source and RED on the mutated string. No repo mutation, no fixtures.
+// The predicates mirror the numbered assertions below — update them together.
+function selfProbe() {
+  const v2s = read('vibe-math-v2/vibe-math-v2.js')
+  const v3s = read('vibe-math-v3/vibe-math-v3.js')
+  const v4s = read('vibe-math-v4/vibe-math-v4.js')
+  const v5s = read('vibe-math-v5/vibe-math-v5.js')
+  const ATOMIC = /frozen:\s*\(function\(sn\)\{\s*return \{version: sn\?sn\.rosterVersion:null, participants: sn\?sn\.rosterSnapshot:null, kind:/
+  const cases = [
+    ['v2 produces allParticipantsReported',
+      /allParticipantsReported: participants\.length > 0 && thisRoundIds\.length === participants\.length/.test(v2s),
+      /allParticipantsReported: participants\.length > 0 && thisRoundIds\.length === participants\.length/.test(v2s.replace(/allParticipantsReported:/g, 'renamedField:'))],
+    ['v3 deliberately LACKS the field', !/allParticipantsReported/.test(v3s),
+      !/allParticipantsReported/.test(v3s.replace('function voteCount(t, round) {', 'function voteCount(t, round) { const allParticipantsReported = 1;'))],
+    ['v4 frozen is atomic', ATOMIC.test(v4s),
+      ATOMIC.test(v4s.replace(/frozen:\s*\(function\(sn\)\{\s*return \{version: sn\?sn\.rosterVersion:null, participants: sn\?sn\.rosterSnapshot:null, kind:/, 'frozen: {version: rosterVersion, participants: null, kind: null}, x: (function(sn){ return {version: sn?sn.rosterVersion:null, participants: sn?sn.rosterSnapshot:null, kind:'))],
+    ['v4 removal prunes both frozen sets', occurrences(v4s.slice(v4s.indexOf('function removeMember')), /rosterSnapshot\.filter\(x=>x!==id\)/g) >= 2,
+      occurrences(v4s.slice(v4s.indexOf('function removeMember')).replace(/rosterSnapshot\.filter\(x=>x!==id\)/g, 'noop()'), /rosterSnapshot\.filter\(x=>x!==id\)/g) >= 2],
+    ['v5 quorumView surfaces rosterVersion', /\brosterVersion:/.test(v5s.slice(v5s.indexOf('function quorumView'), v5s.indexOf('function quorumView') + 900)),
+      /\brosterVersion:/.test(v5s.slice(v5s.indexOf('function quorumView'), v5s.indexOf('function quorumView') + 900).replace(/rosterVersion:/g, 'ver:'))],
+    ['exactly ONE v2 producer', occurrences(v2s, /function voteCount\(t, round\)/g) === 1,
+      occurrences(v2s + '\n  function voteCount(t, round) { return null }\n', /function voteCount\(t, round\)/g) === 1],
+  ]
+  let bad = 0
+  for (const [name, greenNow, redWhenBroken] of cases) {
+    const good = greenNow === true && redWhenBroken === false
+    if (!good) bad++
+    console.log((good ? '  ok   ' : '  FAIL ') + name + ' :: green-now=' + greenNow + ' broken-goes-red=' + !redWhenBroken)
+  }
+  console.log('=== PARTICIPANT-SET SELF-PROBE: ' + (cases.length - bad) + '/' + cases.length + ' as required ===')
+  return bad === 0
+}
+if (process.argv.includes('--self-probe')) process.exit(selfProbe() ? 0 : 1)
+const v2 = read('vibe-math-v2/vibe-math-v2.js')
+const v3 = read('vibe-math-v3/vibe-math-v3.js')
+const v4 = read('vibe-math-v4/vibe-math-v4.js')
+const v5 = read('vibe-math-v5/vibe-math-v5.js')
+
+console.log('-- participant-set parity across the four presets --')
+
+// ---- 1. v2: one producer, set + expectation + the field, and it is CONSUMED ----
+{
+  const b = body(v2, 'voteCount')
+  ok(occurrences(v2, /function voteCount\(t, round\)/g) === 1, 'v2: exactly ONE participant-set producer (voteCount)')
+  ok(/participants: participants/.test(b) && /expected: expected/.test(b) && /round: r/.test(b),
+    'v2: voteCount returns the SET together with its expectation + round')
+  ok(/allParticipantsReported: participants\.length > 0 && thisRoundIds\.length === participants\.length/.test(b),
+    'v2: voteCount produces allParticipantsReported (its single predicate)')
+  ok(occurrences(v2, /voteCount\(t, (?:t|meta)\.round\)\.allParticipantsReported/g) >= 2,
+    'v2: the field is CONSUMED (both readers go through voteCount, not a re-derivation)')
+  const expectedLine = /const expected = Math\.max\(MIN_REVIEWERS, Number\(tt\.expectedCount\) \|\| 0\)/.test(b)
+  ok(expectedLine, 'v2: expected comes from the CREATION-TIME snapshot with the MIN_REVIEWERS floor (deliberately kept)')
+}
+
+// ---- 2. v3: one producer, NO allParticipantsReported (the documented difference), snapshot-only quorum ----
+{
+  const b = body(v3, 'voteCount')
+  ok(occurrences(v3, /function voteCount\(t, round\)/g) === 1, 'v3: exactly ONE participant-set producer (voteCount)')
+  ok(/participants: participants/.test(b) && /expected: expected/.test(b), 'v3: voteCount returns the SET together with its expectation')
+  ok(!/allParticipantsReported/.test(v3), 'v3: deliberately has NO allParticipantsReported (readers compose their own predicate - do not "unify" it away)')
+  const mv = body(v3, 'minVotes')
+  ok(mv.length > 0 && !/params\.verifierCount/.test(mv), 'v3: minVotes reads the SNAPSHOT only (live params.verifierCount must not leak back in)')
+}
+
+// ---- 3. v4: one producer, ATOMIC set+version, deprecated alias, removal prunes ----
+{
+  ok(occurrences(v4, /function activeRosterSnapshot\(/g) === 1, 'v4: exactly ONE participant-set producer (activeRosterSnapshot)')
+  ok(/frozen:\s*\(function\(sn\)\{\s*return \{version: sn\?sn\.rosterVersion:null, participants: sn\?sn\.rosterSnapshot:null, kind:/.test(v4),
+    'v4: `frozen` is the ATOMIC triple {version, participants, kind}')
+  ok(/frozenParticipants:\s*\(activeRosterSnapshot\(\)\|\|\{\}\)\.rosterSnapshot\|\|null/.test(v4) && /deprecated/.test(v4),
+    'v4: `frozenParticipants` stays only as a deprecated alias of frozen.participants')
+  const rm = body(v4, 'removeMember')
+  ok(occurrences(rm, /rosterSnapshot=(\w+)\.rosterSnapshot\.filter\(x=>x!==id\)|rosterSnapshot\.filter\(x=>x!==id\)/g) >= 2,
+    'v4: removal prunes BOTH frozen sets (that is what keeps "removal releases the wait" true)')
+  ok(/function bumpRoster\(/.test(v4) && /rosterVersion\+\+/.test(body(v4, 'bumpRoster')), 'v4: exactly one roster-version bump helper')
+}
+
+// ---- 4. v5: one producer, quorum view surfaces the set + version together ----
+{
+  ok(occurrences(v5, /function rosterSnapshot\(\)/g) === 1, 'v5: exactly ONE participant-set producer (rosterSnapshot)')
+  const qv = body(v5, 'quorumView')
+  const keys = ['m', 'mode', 'voters', 'voterCount', 'started', 'phase', 'rosterVersion']
+  const missing = keys.filter((k) => !new RegExp('\\b' + k + ':').test(qv))
+  ok(qv.length > 0 && missing.length === 0, 'v5: quorumView surfaces the set (voters/voterCount) TOGETHER with m + rosterVersion', 'missing: ' + JSON.stringify(missing))
+  ok(/return \{[\s\S]*?version: rosterVersion\(\)[\s\S]*?voters:/.test(body(v5, 'rosterSnapshot')),
+    'v5: the snapshot captures version + voters in one object (no re-derivation between them)')
+}
+
+// ---- 5. the two cross-preset invariants, stated once (so a future preset cannot skip them) ----
+{
+  const producers = [
+    ['v2', occurrences(v2, /function voteCount\(t, round\)/g)],
+    ['v3', occurrences(v3, /function voteCount\(t, round\)/g)],
+    ['v4', occurrences(v4, /function activeRosterSnapshot\(/g)],
+    ['v5', occurrences(v5, /function rosterSnapshot\(\)/g)],
+  ]
+  ok(producers.every(([, n]) => n === 1), 'every preset has EXACTLY ONE participant-set producer ("produced only once")', JSON.stringify(producers))
+  const setAndVersion = [
+    ['v2', /participants: participants/.test(body(v2, 'voteCount')) && /expected: expected/.test(body(v2, 'voteCount'))],
+    ['v3', /participants: participants/.test(body(v3, 'voteCount')) && /expected: expected/.test(body(v3, 'voteCount'))],
+    ['v4', /participants: sn\?sn\.rosterSnapshot:null/.test(v4) && /version: sn\?sn\.rosterVersion:null/.test(v4)],
+    ['v5', /voterCount: snap\.voterCount/.test(body(v5, 'quorumView')) && /rosterVersion: snap\.version/.test(body(v5, 'quorumView'))],
+  ]
+  ok(setAndVersion.every(([, b]) => b), 'every preset surfaces the set AND its roster version/expectation together', JSON.stringify(setAndVersion.filter(([, b]) => !b).map(([n]) => n)))
+}
+
+console.log('')
+console.log('=== PARTICIPANT SET PARITY: ' + passed + ' passed, ' + failed + ' failed ===')
+if (failures.length) for (const f of failures) console.error('  - ' + f)
+process.exit(failed === 0 ? 0 : 1)

package/tests/audit-path-discipline.mjs

@@ -0,0 +1,83 @@
+// Dedicated cross-preset path-discipline audit (migrated out of formal-verify-v4 so that running ONE
+// preset's suite cannot miss this class).
+//
+// Covers:
+//   * v4 / v5 : every member-visible library declaration carries the member root (Members/<x>/...).
+//   * v3      : the writer `applyAgentWrites` accepts ONLY Problems|Progress|Propos|Methods|Notes at the
+//               PROJECT ROOT, so v3's declarations must stay root-relative - a Members/<x>/... declaration
+//               is a write the writer SILENTLY DISCARDS.
+//   * v2 / v3 : PAPER_PATH_NOTE structure, by DELIVERED MATERIAL (not by function site):
+//               - the evidence-index DATA LIST must not embed the prose rule;
+//               - every delivered member-facing material that carries copyable paths must append it -
+//                 for v2 that is the digest, which INLINES the evidence index; for v3 also the journal.
+//               Function-body windows are STRICTLY bounded (no fixed-length fallback): a window that can
+//               swallow the next function produces false passes.
+import { readFileSync } from 'node:fs'
+
+const R = new URL('../', import.meta.url)
+const ENV_OF = {
+  'vibe-math-v2/vibe-math-v2.js': 'V2_PLUGIN',
+  'vibe-math-v3/vibe-math-v3.js': 'V3_PLUGIN',
+  'vibe-math-v4/vibe-math-v4.js': 'V4_PLUGIN',
+  'vibe-math-v5/vibe-math-v5.js': 'V5_PLUGIN',
+}
+// a mutant harness (tests/audit-path-discipline.mutants.mjs) points these at scratch copies
+const rd = (p) => {
+  const e = ENV_OF[p] && process.env[ENV_OF[p]]
+  return e ? readFileSync(e, 'utf8') : readFileSync(new URL(p, R), 'utf8')
+}
+let passed = 0
+let failed = 0
+const fails = []
+const assert = (c, m) => { if (c) { passed++; console.log('  ok - ' + m) } else { failed++; fails.push(m); console.error('  FAIL - ' + m) } }
+
+const v2 = rd('vibe-math-v2/vibe-math-v2.js')
+const v3 = rd('vibe-math-v3/vibe-math-v3.js')
+const v4 = rd('vibe-math-v4/vibe-math-v4.js')
+const v5 = rd('vibe-math-v5/vibe-math-v5.js')
+
+const ROOT = /Members\/<[^>]+>\/(?:Progress|Propos|Methods|Subproblems)\//g
+const LEGACY = /(?:^|[^/>])(?:Progress|Propos|Methods|Subproblems)\/<[^>]+>\//g
+
+for (const [k, src] of [['v5', v5]]) {   // v5 pending vm-v5's re-verification of its bases
+  assert((src.match(ROOT) || []).length >= 4, k + ': member-visible declarations carry the member root')
+  assert((src.match(LEGACY) || []).length === 0, k + ': no legacy project-root-relative member-library declaration')
+}
+// v4 (critical correction): writer/reader live at the PROJECT ROOT - a Members/<x>/... path is never scanned
+assert(!/Members\//.test(v4), 'v4: no Members/ occurrence at all (widened predicate: literal ids escape the placeholder form) (the framework never scans it)')
+assert(/(?:Progress|Propos|Methods|Subproblems)\/<[^>]+>\//.test(v4), 'v4: declarations use the project-root bases the writer/reader use')
+assert(/progress\.md/.test(v4), 'class guard: v4 documents/writes the Progress base it reads')
+
+assert(!/Members\//.test(v3), 'v3: no Members/ occurrence at all (widened predicate: literal ids escape the placeholder form) (applyAgentWrites would DISCARD such a write)')
+assert(/applyAgentWrites[\s\S]{0,600}?(Problems|Progress|Propos|Methods|Notes)/.test(v3), 'class guard: v3 writer whitelists the sections its prompts name')
+
+// strictly bounded function-body window: never fall back to a fixed length
+const bodyOf = (src, fn) => {
+  const a = src.indexOf('function ' + fn)
+  if (a < 0) return null
+  const b = src.slice(a + 10).search(/\n {2}(?:async )?function /)
+  if (b < 0) return null
+  return src.slice(a, a + 10 + b)
+}
+
+for (const [k, src] of [['v2', v2], ['v3', v3]]) {
+  const def = (src.match(/const PAPER_PATH_NOTE/g) || []).length
+  assert(def === 1, k + ': PAPER_PATH_NOTE defined exactly once (found ' + def + ')')
+  const idxBody = bodyOf(src, 'paperEvidenceIndex')
+  const digBody = bodyOf(src, 'buildPaperDigest')
+  assert(idxBody !== null && digBody !== null, k + ': both function windows are bounded strictly (no fixed-length fallback)')
+  // the data list is a pure path list: no prose, no note
+  assert(!/PAPER_PATH_NOTE/.test(idxBody || ''), k + ': the evidence-index DATA LIST embeds no prose rule')
+  // the delivered material inlines that list and therefore carries the paths AND must carry the note
+  assert(/paperEvidenceIndex\(\)/.test(digBody || ''), k + ': the delivered digest INLINES the evidence index (so it carries the copyable paths)')
+  assert(/PAPER_PATH_NOTE/.test(digBody || ''), k + ': the delivered digest material appends PAPER_PATH_NOTE')
+  if (k === 'v3') {
+    const jr = bodyOf(src, 'writeJournal')
+    assert(jr !== null && /PAPER_PATH_NOTE/.test(jr), 'v3: the member-facing journal (writeJournal) also appends PAPER_PATH_NOTE')
+  }
+}
+
+console.log('')
+console.log('passed=' + passed + ' failed=' + failed)
+if (failed) { console.error('FAILURES:'); for (const f of fails) console.error('  - ' + f); process.exit(1) }
+console.log('ALL GREEN')

package/tests/audit-path-discipline.mutants.mjs

@@ -0,0 +1,51 @@
+// Registered mutant harness for tests/audit-path-discipline.mjs - the audit carries its own proof.
+// One mutant per assertion family; each MUST make the audit fail, otherwise the guard does not bite.
+// Usage: node tests/audit-path-discipline.mutants.mjs   (exit 0 = every family reddened)
+import { readFileSync, writeFileSync, mkdirSync, copyFileSync, rmSync, mkdtempSync } from 'node:fs'
+import { execFileSync } from 'node:child_process'
+import { fileURLToPath } from 'node:url'
+import { dirname, join } from 'node:path'
+import { tmpdir } from 'node:os'
+const here = dirname(fileURLToPath(import.meta.url))
+const repo = join(here, '..')
+const audit = join(here, 'audit-path-discipline.mjs')
+// Unique per run (audit C: a fixed repo-local dir could collide with a concurrent run and dirtied the tree)
+const tmp = mkdtempSync(join(tmpdir(), 'audit-mutants-'))
+const families = [
+  { name: 'v4-text-shape (delivered declaration re-prefixed)', preset: 'vibe-math-v4', env: 'V4_PLUGIN',
+    from: "+'  Propos/<" + String.fromCharCode(20320) + ">/<id>.md",
+    to: "+'  Members/<" + String.fromCharCode(20320) + ">/Propos/<" + String.fromCharCode(20320) + ">/<id>.md",
+    expect: /no Members\/ occurrence at all/ },
+  { name: 'v4-literal-members (widened Members/ predicate)', preset: 'vibe-math-v4', env: 'V4_PLUGIN',
+    from: "/Propos/r-1/p-1.md", to: "/Members/r-1/Propos/p-1.md",
+    expect: /no Members\/ occurrence at all/ },
+  { name: 'v3-writer-whitelist class guard (Members/ reintroduced)', preset: 'vibe-math-v3', env: 'V3_PLUGIN',
+    from: '(^|[^/>])(Propos)\\/<([^>]+)>\\/', to: '$1Members/<$3>/$2/<$3>/', regex: true,
+    expect: /v3: no Members\// },
+  { name: 'v2 PAPER_PATH_NOTE structure (digest append dropped)', preset: 'vibe-math-v2', env: 'V2_PLUGIN',
+    from: '    L.push(PAPER_PATH_NOTE)', to: '', expect: /delivered digest material appends PAPER_PATH_NOTE/ },
+]
+mkdirSync(tmp, { recursive: true })
+let ok = 0, bad = 0
+try {
+for (const f of families) {
+  const src = join(repo, f.preset, f.preset + '.js')
+  let t = readFileSync(src, 'utf8')
+  const hits = f.regex ? (t.match(new RegExp(f.from, 'm')) || []).length : t.split(f.from).length - 1
+  if (hits < 1) { console.error('  NO-OP - ' + f.name + ' (predicate did not match)'); bad++; continue }
+  t = f.regex ? t.replace(new RegExp(f.from, 'm'), f.to) : t.split(f.from).join(f.to)
+  const out = join(tmp, f.preset + '.js')
+  writeFileSync(out, t, 'utf8')
+  let red = false, msg = ''
+  try {
+    execFileSync(process.execPath, [audit], { env: Object.assign({}, process.env, { [f.env]: out }), encoding: 'utf8' })
+  } catch (e) { red = true; msg = String((e && (e.stdout || '')) + (e && (e.stderr || ''))) }
+  const named = f.expect.test(msg)
+  if (red && named) { ok++; console.log('  ok - ' + f.name + ' reddened the audit by name') }
+  else { bad++; console.error('  FAIL - ' + f.name + ' red=' + red + ' named=' + named + ' :: ' + msg.split('\n').filter((l) => l.includes('FAIL')).slice(0, 1).join('')) }
+}
+} finally { rmSync(tmp, { recursive: true, force: true }) }
+console.log('')
+console.log('mutant families reddening the audit: ' + ok + '/' + families.length)
+if (bad) process.exit(1)
+console.log('ALL FAMILIES BITE')