eyeprolog 1.5.21 → 1.5.23

package/test/run-regression.mjs

@@ -47,6 +47,9 @@ import {
   unify,
   variantTerms,
   parseProgramText,
+  proofCertificate,
+  proofCertificatesFromText,
+  verifyProof,
 } from '../src/index.js';
 import { ISO_OPERATOR_DEFINITIONS, parseGoalText, parseNumberTokenText, tryParseClausesFastInto } from '../src/parser.js';
 import { PrologError, formalErrorTerm } from '../src/iso.js';
@@ -73,6 +76,10 @@ const testRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)));
 const packageRoot = path.resolve(testRoot, '..');
 const bin = path.join(packageRoot, 'bin', 'eyeprolog.js');
 const pkg = JSON.parse(fs.readFileSync(path.join(packageRoot, 'package.json'), 'utf8'));
+// The issue #49 hand-off checks assert demand-driven completion and bounded memory,
+// not a machine-speed threshold. Leave enough wall-clock headroom for slower or
+// contended CI hosts while still terminating a genuinely stuck child process.
+const DCG_HANDOFF_TEST_TIMEOUT_MS = 20_000;
 let tmp = null;
 let tmpCounter = 0;
 
@@ -2863,7 +2870,7 @@ c4 ?- call((!;1)).
         const result = spawnSync(process.execPath, ['--input-type=module', '--eval', script], {
           cwd: packageRoot,
           encoding: 'utf8',
-          timeout: 5000,
+          timeout: DCG_HANDOFF_TEST_TIMEOUT_MS,
         });
         if (result.error) throw result.error;
         assertEqual(result.status, 0, `65536-cell hand-off status; stderr=${result.stderr}`);
@@ -2906,7 +2913,7 @@ c4 ?- call((!;1)).
             'length(_,E),E>12,N is 2^E,\\+ \\+ (length(L,N),time(phrase(a,L))).\n' +
             ';\n;\n;\n\n' +
             'halt.\n',
-          timeout: 5000,
+          timeout: DCG_HANDOFF_TEST_TIMEOUT_MS,
         });
         if (result.error) throw result.error;
         assertEqual(result.status, 0, `deep REPL hand-off status; stderr=${result.stderr}`);
@@ -3842,6 +3849,39 @@ child.stdin.write(\`consult(${consultedAtom}).\\n\`);
         assertEqual(result.stderr, '', 'stderr');
       },
     },
+
+    {
+      name: '--proof-detail expanded exposes bundled Prolog library clauses',
+      run: () => {
+        const input = '%% goal: q(a)\n:- use_module(library(lists)).\nq(X) :- member(X, [a,b]).\n';
+        const result = runCli(['--proof-detail', 'expanded', '-'], { input });
+        assertEqual(result.status, 0, 'exit status');
+        assertIncludes(result.stdout, 'by(fact("src/lib/lists.pl"', 'expanded library source');
+        assertNotIncludes(result.stdout, 'by(library(member, 2))', 'abstract library boundary');
+      },
+    },
+    {
+      name: '--verify-proof accepts saved why/2 proof output and rejects tampering',
+      run: () => {
+        const programFile = path.join(tmp, `proof-program-${++tmpCounter}.pl`);
+        const proofFile = path.join(tmp, `proof-certificate-${++tmpCounter}.pl`);
+        fs.writeFileSync(programFile, '%% goal: q(a)\np(a).\nq(X) :- p(X).\n');
+        const generated = runCli(['--proof', programFile]);
+        assertEqual(generated.status, 0, 'proof generation status');
+        fs.writeFileSync(proofFile, generated.stdout);
+        const verified = runCli(['--verify-proof', proofFile, programFile]);
+        assertEqual(verified.status, 0, 'verification status');
+        assertEqual(verified.stdout, 'verified 1 proof certificate.\n', 'verification stdout');
+        const strictVerified = runCli(['--iso-strict', '--verify-proof', proofFile, programFile]);
+        assertEqual(strictVerified.status, 0, 'strict verification status');
+        assertEqual(strictVerified.stdout, 'verified 1 proof certificate.\n', 'strict verification stdout');
+        const tamperedFile = path.join(tmp, `proof-certificate-bad-${++tmpCounter}.pl`);
+        fs.writeFileSync(tamperedFile, generated.stdout.replace('goal(p(a))', 'goal(p(b))'));
+        const rejected = runCli(['--verify-proof', tamperedFile, programFile]);
+        assertEqual(rejected.status, 1, 'tampered verification status');
+        assertIncludes(rejected.stderr, 'proof certificate 1 failed verification', 'tampered verification stderr');
+      },
+    },
     {
       name: '-pw combines proof and warning flags',
       run: () => {
@@ -5347,11 +5387,12 @@ ${profile}`;
         assertEqual(report.total.positive + report.total.errors + report.total.warnings + report.total.proofs, report.total.total, 'conformance total');
         assertEqual(report.rows.some((row) => row.category === 'legacy-numbered'), false, 'legacy-numbered category');
         const wg17 = report.executable.find((gate) => gate.name === 'WG17 syntax');
-        assertEqual(wg17?.total, 372, 'WG17 executable total');
-        assertEqual(wg17?.passed, 372, 'WG17 executable passed');
+        const wg17FixtureTotal = readWg17SyntaxFixture().cases.length;
+        assertEqual(wg17?.total, wg17FixtureTotal, 'WG17 executable total');
+        assertEqual(wg17?.passed, wg17FixtureTotal, 'WG17 executable passed');
         assertArrayEqual(wg17?.failures ?? [], [], 'WG17 executable failures');
         const text = formatConformanceReport(report);
-        assertIncludes(text, '| WG17 syntax | 372 | 372 | pass |', 'report');
+        assertIncludes(text, `| WG17 syntax | ${wg17FixtureTotal} | ${wg17FixtureTotal} | pass |`, 'report');
         assertIncludes(text, '| variables |', 'report');
         assertIncludes(text, '| Proofs |', 'report');
         assertIncludes(text, '| **Total** |', 'report');
@@ -5624,6 +5665,74 @@ true :+ ready.
       },
     },
 
+    {
+      name: 'proof certificates verify source derivations without proof search',
+      run: () => {
+        const program = Program.parse('p(a, b).\nq(X, Y) :- p(X, Y).\n', { sourceMetadata: true });
+        const result = proofCertificate(program, parseGoalText('q(a, b)'));
+        assertEqual(result.ok, true, 'certificate generated');
+        assertEqual(result.certificate.version, 1, 'certificate version');
+        assertEqual(result.certificate.answer, 'q(a, b)', 'certificate answer');
+        const checked = verifyProof(program, result);
+        assertEqual(checked.ok, true, 'certificate verifies');
+        assertEqual(checked.trusted.length, 0, 'source-only certificate has no trusted boundaries');
+      },
+    },
+    {
+      name: 'proof verification rejects a tampered child goal',
+      run: () => {
+        const program = Program.parse('p(a, b).\nq(X, Y) :- p(X, Y).\n', { sourceMetadata: true });
+        const result = proofCertificate(program, parseGoalText('q(a, b)'));
+        const tampered = structuredClone(result.certificate);
+        tampered.proof.children[0].goal = 'p(a, c)';
+        assertEqual(verifyProof(program, tampered).ok, false, 'tampered child is rejected');
+        const bindingTamper = structuredClone(result.certificate);
+        bindingTamper.proof.bindings[1].value = 'c';
+        assertEqual(verifyProof(program, bindingTamper).ok, false, 'tampered binding is rejected');
+        const changedProgram = Program.parse('p(a, c).\nq(X, Y) :- p(X, Y).\n', { sourceMetadata: true });
+        assertEqual(verifyProof(changedProgram, result).ok, false, 'changed source program is rejected');
+      },
+    },
+    {
+      name: 'why/2 text round-trips into a verifiable proof certificate',
+      run: () => {
+        const program = Program.parse('p(a).\nq(X) :- p(X).\n', { sourceMetadata: true });
+        const result = proofCertificate(program, parseGoalText('q(a)'));
+        const parsed = proofCertificatesFromText(result.text, program);
+        assertEqual(parsed.length, 1, 'certificate count');
+        assertEqual(verifyProof(program, parsed[0]).ok, true, 'round-tripped certificate verifies');
+      },
+    },
+    {
+      name: 'proof certificate text round-trips under every double_quotes mode',
+      run: () => {
+        for (const doubleQuotes of ['chars', 'codes', 'atom']) {
+          const program = Program.parse('p(a).\nq(X) :- p(X).\n', { sourceMetadata: true, doubleQuotes });
+          const result = proofCertificate(program, parseGoalText('q(a)', { doubleQuotes }));
+          const parsed = proofCertificatesFromText(result.text, program);
+          assertEqual(parsed.length, 1, `${doubleQuotes} certificate count`);
+          assertEqual(verifyProof(program, parsed[0]).ok, true, `${doubleQuotes} certificate verifies`);
+        }
+      },
+    },
+    {
+      name: 'expanded proof detail opens bundled Prolog library clauses',
+      run: () => {
+        const program = Program.parse(':- use_module(library(lists)).\nq(X) :- member(X, [a,b]).\n', { sourceMetadata: true });
+        const abstract = proofCertificate(program, parseGoalText('q(a)'));
+        const expanded = proofCertificate(program, parseGoalText('q(a)'), { proofDetail: 'expanded' });
+        assertEqual(abstract.certificate.proof.children[0].method.type, 'library', 'abstract library boundary');
+        assertEqual(expanded.certificate.proof.children[0].method.type, 'source', 'expanded library source');
+        const abstractChecked = verifyProof(program, abstract);
+        const expandedChecked = verifyProof(program, expanded);
+        assertEqual(abstractChecked.ok, true, 'abstract certificate verifies');
+        assertEqual(abstractChecked.trusted.length, 1, 'abstract certificate reports library trust');
+        assertEqual(abstractChecked.trusted[0].type, 'library', 'reported trust boundary type');
+        assertEqual(expandedChecked.ok, true, 'expanded certificate verifies');
+        assertEqual(expandedChecked.trusted.length, 0, 'pure-Prolog expanded certificate removes library trust');
+      },
+    },
+
     {
       name: 'run accepts Program instances',
       run: () => {
@@ -7171,6 +7280,92 @@ function whiteBoxCases() {
           'double_quotes(codes) representation');
       },
     },
+    {
+      name: 'double-quoted character and code suffixes are recognized inside proper lists (issue #88 suffix follow-up)',
+      run: () => {
+        const repl = runCli([], {
+          input: 'T = [A,b,c,d,e,f].\nhalt.\n',
+        });
+        assertEqual(repl.status, 0, 'REPL exit status');
+        assertIncludes(repl.stdout, 'T = [A|"bcdef"].', 'Scryer-compatible character suffix');
+        assertNotIncludes(repl.stdout, 'T = [A, b, c, d, e, f].', 'expanded suffix suppressed');
+
+        const chars = parseGoalText('p([foo,b,c])').args[0];
+        assertEqual(
+          formatTermForWrite(chars, new Env(), {
+            quoted: true,
+            doubleQuotes: 'chars',
+            doubleBar: true,
+            compact: true,
+            operators: ISO_OPERATOR_DEFINITIONS,
+          }),
+          '[foo|"bc"]',
+          'ordinary list notation uses a quoted suffix',
+        );
+        assertEqual(
+          formatTermForWrite(chars, new Env(), {
+            quoted: true,
+            ignoreOps: true,
+            doubleQuotes: 'chars',
+            doubleBar: true,
+            compact: true,
+            operators: ISO_OPERATOR_DEFINITIONS,
+          }),
+          `'.'(foo,"bc")`,
+          'ignore_ops remains orthogonal to suffix quoting',
+        );
+        assertEqual(
+          formatTermForWrite(chars, new Env(), {
+            quoted: true,
+            doubleQuotes: null,
+            doubleBar: true,
+            compact: true,
+            operators: ISO_OPERATOR_DEFINITIONS,
+          }),
+          '[foo,b,c]',
+          'disabled double_quotes keeps expanded list notation',
+        );
+        const improper = parseGoalText('p([foo,b,c|tail])').args[0];
+        assertEqual(
+          formatTermForWrite(improper, new Env(), {
+            quoted: true,
+            doubleQuotes: 'chars',
+            doubleBar: true,
+            compact: true,
+            operators: ISO_OPERATOR_DEFINITIONS,
+          }),
+          '[foo,b,c|tail]',
+          'improper suffix is not mistaken for a proper string suffix',
+        );
+
+        const astral = parseGoalText("p([foo,'😀',x])").args[0];
+        assertEqual(
+          formatTermForWrite(astral, new Env(), {
+            quoted: true,
+            doubleQuotes: 'chars',
+            doubleBar: true,
+            compact: true,
+            operators: ISO_OPERATOR_DEFINITIONS,
+          }),
+          '[foo|"😀x"]',
+          'Unicode scalar suffix',
+        );
+
+        const codes = parseGoalText('p([foo,98,128512])', { doubleQuotes: 'codes' }).args[0];
+        assertEqual(
+          formatTermForWrite(codes, new Env(), {
+            quoted: true,
+            doubleQuotes: 'codes',
+            doubleBar: true,
+            compact: true,
+            operators: ISO_OPERATOR_DEFINITIONS,
+          }),
+          '[foo|"b😀"]',
+          'code-list suffix',
+        );
+      },
+    },
+
     {
       name: 'charsio write_term_to_chars composes double_quotes with ignore_ops',
       run: () => {
@@ -8148,6 +8343,7 @@ function documentedConformanceMetricIssues() {
   const report = buildConformanceReport();
   const iso = report.rows.find((row) => row.category === 'iso')?.total;
   const total = report.total.total;
+  const wg17 = report.executable.find((gate) => gate.name === 'WG17 syntax')?.total;
   const checks = [
     {
       file: path.join(packageRoot, 'the-art-of-eyeprolog.md'),
@@ -8177,6 +8373,21 @@ function documentedConformanceMetricIssues() {
       }
     }
   }
+  for (const file of [
+    path.join(packageRoot, 'test', 'conformance', 'README.md'),
+    path.join(packageRoot, 'test', 'conformance', 'ISO-COMPLIANCE.md'),
+  ]) {
+    const relative = path.relative(packageRoot, file);
+    const text = fs.readFileSync(file, 'utf8');
+    const claims = [
+      ...[...text.matchAll(/\b(\d+)-case[^\n|]*WG17/g)].map((match) => Number(match[1])),
+      ...[...text.matchAll(/WG17[^\n|]*?\b(\d+) executable/g)].map((match) => Number(match[1])),
+    ];
+    if (claims.length === 0) issues.push(`${relative}: WG17 total not found`);
+    for (const claim of claims) {
+      if (claim !== wg17) issues.push(`${relative}: WG17 count ${claim} != ${wg17}`);
+    }
+  }
   return issues.sort();
 }
 

package/the-art-of-eyeprolog.md

@@ -1467,25 +1467,42 @@ why(
 ).
 ```
 
-Proof output is valid EyeProlog input:
+Proof output is valid EyeProlog input and can be kept as a proof certificate:
 
 ```sh
 eyeprolog --proof examples/socrates.pl > socrates.why.pl
+eyeprolog --verify-proof socrates.why.pl examples/socrates.pl
 ```
 
+The second command checks the supplied `why/2` derivation against the program;
+it does not search again for a proof. A changed source clause, child goal, source
+location, or recorded substitution makes the certificate fail verification.
+Certificate input is parsed as Prolog data rather than loaded as a program, so
+its terms cannot trigger directives while being checked.
+
 A normal answer is one resolved ground term followed by a period. Strings,
 quoted atoms, lists, and compounds are rendered in supported source syntax so
 the output can be read back. Enabling `--proof`, `--warnings`, or `--stats`
 must not change which answers are found.
 
-The second argument of `why/2` is an abstract proof term of the general shape
+The second argument of `why/2` is a proof term of the general shape
 `proof(goal(G), by(Method), bindings(Bindings), uses(Proofs))`. User clauses
 are identified as `fact(Filename, clause(N))` or
 `rule(Filename, clause(N))`, with one-based source clause numbers. Built-ins
-are identified as `builtin(Name, Arity)`. Explanation data is outside the
+are identified as `builtin(Name, Arity)`. By default, bundled Prolog-library
+predicates appear as `library(Name, Arity)` trusted boundaries. Use
+`--proof-detail expanded` to replace those boundaries with the library source
+clauses and any trusted built-ins they call. Explanation data is outside the
 logical semantics of the input program: it describes the derivation but does
 not participate in finding it.
 
+Verification checks source steps structurally: the named clause must exist, its
+head must unify with the certified goal, its body must correspond to the child
+proofs, and recorded clause-variable bindings must agree with that derivation.
+Built-ins and abstract library nodes are deliberately trusted boundaries. This
+separates proof discovery from proof checking without pretending that host
+operations can be justified by Prolog source that does not exist.
+
 A second program can query `why/2`. Read a proof as an argument. If it contains
 irrelevant detours, improve the helpers. If a key premise is hidden inside an
 opaque value, model it as a fact. Designing for a good explanation often
@@ -1862,10 +1879,42 @@ prints numeric work counters; those counters describe this run rather than an
 additional logical answer.
 
 `run/2` accepts source text or an already parsed `Program`. Its options include
-`proof` (with `why` and `explain` as aliases), `maxDepth`, `maxInferences`,
-`maxMemoryBytes`, `solutionLimit`, a custom `registry`, and `strictNegation` or
-`analyzeNegation`. It returns `stdout`, the solver's numeric `stats`, and a
-nullable `haltCode`; it does not write to the process streams.
+`proof` (with `why` and `explain` as aliases), `proofDetail` (`abstract` or
+`expanded`), `maxDepth`, `maxInferences`, `maxMemoryBytes`, `solutionLimit`, a
+custom `registry`, and `strictNegation` or `analyzeNegation`. It returns
+`stdout`, the solver's numeric `stats`, and a nullable `haltCode`; it does not
+write to the process streams.
+
+For applications that exchange proofs independently of answer output, the same
+module exposes `proofCertificate(program, goal, options)`,
+`proofCertificatesFromText(text, program)`, and
+`verifyProof(program, certificate, options)`:
+
+```js
+import {
+  Program, parseGoalText,
+  proofCertificate, proofCertificatesFromText, verifyProof
+} from 'eyeprolog';
+
+const program = Program.parse(`
+p(a).
+q(X) :- p(X).
+`, { sourceMetadata: true });
+
+const made = proofCertificate(program, parseGoalText('q(a)'));
+console.log(verifyProof(program, made).ok); // true
+
+const received = proofCertificatesFromText(made.text, program)[0];
+console.log(verifyProof(program, received).ok); // true
+```
+
+`proofCertificate` returns both the ordinary `why/2` text and a JSON-serializable
+certificate object. `verifyProof` walks the supplied certificate rather than
+asking the solver to find another proof; its `trusted` array lists every builtin
+or abstract-library boundary that was assumed while checking it. Passing
+`proofDetail: 'expanded'` exposes bundled Prolog-library clauses in the
+certificate and therefore reduces library-level trust boundaries to the
+built-ins those clauses ultimately use.
 
 When `run` receives an already parsed `Program`, bundled-library imports
 needed only by its host-supplied goals are added to that Program before solving,
@@ -5480,9 +5529,11 @@ still retained where adjacent graphic tokens would otherwise merge, as in
 `write_term/2-3` supports `quoted/1`, `ignore_ops/1`, `numbervars/1`, and
 `variable_names/1`. Normal mode additionally accepts the EyeProlog extension
 `double_quotes(true|false)`: `true` lets eligible character/code lists use the
-current `double_quotes` representation. Proper lists can therefore be written
-as `"text"`, while a partial list such as `[a,b|Tail]` is written as
-`"ab"||Tail`. This representation choice is independent of `ignore_ops/1`: with
+current `double_quotes` representation. Proper character/code lists can therefore be written
+as `"text"`. A proper list whose final segment contains at least two characters/codes
+uses that representation for the suffix, so `[A,b,c,d,e,f]` is written as
+`[A|"bcdef"]`. A partial list such as `[a,b|Tail]` is written as `"ab"||Tail`.
+This representation choice is independent of `ignore_ops/1`: with
 `ignore_ops(true)`, operator terms use functional notation while an explicitly
 requested character/code list remains double quoted. Thus
 `write_term(f("ab",a+b),[quoted(true),ignore_ops(true),double_quotes(true)])`
@@ -9334,6 +9385,8 @@ make the observed question explicit.
 | --- | --- |
 | `-h`, `--help` | Show usage |
 | `-p`, `--proof` | Print `why/2` explanations |
+| `--proof-detail abstract|expanded` | Select library abstraction for proof output; implies `--proof` |
+| `--verify-proof File` | Verify saved `why/2` proof certificates against the input program without proof search |
 | `-q`, `--quads` | Run embedded quad tests and fail if any do not hold |
 | `--iso-strict` | Restrict parsing and execution to ISO/IEC 13211-1:1995 + Corrigenda 1–3; reject EyeProlog language extensions (including `table` and `:+`) and disable bundled-library autoloading |
 | `--portable` | Enforce the conservative EyeProlog/Trealla/Scryer interoperability profile |
@@ -9378,7 +9431,9 @@ Work in a fixed sequence:
 
 1. predict the ground answers before running the program;
 2. run without observation flags and compare stdout with that prediction;
-3. add `--proof` when the support for an answer is the question;
+3. add `--proof` when the support for an answer is the question; save the
+   output and use `--verify-proof` when the derivation itself must cross a
+   process or review boundary;
 4. add `--warnings` when portability or negative dependencies are the
    question; use `--portable` when non-profile dependencies must fail CI;
 5. add `--stats` only when comparing two executions of the same semantic case.
@@ -9388,6 +9443,8 @@ For example:
 ```sh
 eyeprolog --goal 'ancestor(X, Y)' examples/ancestor.pl
 eyeprolog --proof --goal 'type(X, Y)' examples/socrates.pl
+eyeprolog --proof examples/socrates.pl > socrates.why.pl
+eyeprolog --verify-proof socrates.why.pl examples/socrates.pl
 eyeprolog --warnings --goal 'answer(X)' test/conformance/warnings/negation/unstratified_mutual.pl
 eyeprolog --portable --goal 'sudoku9_solution(S)' examples/clpz-sudoku-9x9.pl
 eyeprolog --stats --goal 'path(a, X)' examples/path-discovery.pl > answers.pl 2> run.stats

package/tools/upgrade-wg17.mjs

@@ -11,6 +11,11 @@ const syntaxSource = 'https://www.complang.tuwien.ac.at/ulrich/iso-prolog/confor
 const syntaxFixturePath = path.join(packageRoot, 'test', 'conformance', 'wg17-syntax-cases.json');
 const syntaxCoveragePath = path.join(packageRoot, 'test', 'conformance', 'wg17-syntax-coverage.json');
 const syntaxStatusPath = path.join(packageRoot, 'test', 'conformance', 'WG17-SYNTAX-STATUS.md');
+const conformanceReportPath = path.join(packageRoot, 'conformance-report.md');
+const countDocumentationPaths = [
+  path.join(packageRoot, 'test', 'conformance', 'README.md'),
+  path.join(packageRoot, 'test', 'conformance', 'ISO-COMPLIANCE.md'),
+];
 
 const namedEntities = new Map([
   ['amp', '&'], ['lt', '<'], ['gt', '>'], ['quot', '"'], ['apos', "'"],
@@ -318,6 +323,20 @@ function formatIdList(ids) {
   return ids.length === 0 ? 'none' : ids.map((id) => `#${id}`).join(', ');
 }
 
+function updateDocumentedInventoryCount(previousCount, nextCount) {
+  if (previousCount === nextCount) return;
+  for (const filename of countDocumentationPaths) {
+    const original = fs.readFileSync(filename, 'utf8');
+    const updated = original
+      .replaceAll(`${previousCount}-case`, `${nextCount}-case`)
+      .replaceAll(`WG17 matrix has ${previousCount} executable`, `WG17 matrix has ${nextCount} executable`);
+    if (updated === original) {
+      throw new Error(`WG17 inventory count was not found in ${path.relative(packageRoot, filename)}`);
+    }
+    fs.writeFileSync(filename, updated);
+  }
+}
+
 async function readSource(source) {
   if (/^https?:\/\//i.test(source)) {
     const response = await fetch(source, {
@@ -415,6 +434,13 @@ export async function upgradeWg17({ check = false, source = syntaxSource } = {})
   // Generate status after the fixture/manifest are synchronized.
   const { renderWg17SyntaxStatus } = await import('./report-wg17-syntax-coverage.mjs');
   fs.writeFileSync(syntaxStatusPath, renderWg17SyntaxStatus());
+  updateDocumentedInventoryCount(previous.cases.length, fixture.cases.length);
+
+  // The public report executes the refreshed fixture, so keep its measured row
+  // synchronized as part of the same explicit upgrade operation.
+  const { buildConformanceReport, formatConformanceReport } = await import('../test/run-conformance-report.mjs');
+  const conformanceReport = buildConformanceReport();
+  fs.writeFileSync(conformanceReportPath, formatConformanceReport(conformanceReport));
 
   const upstreamAssertions = fixture.cases
     .filter((item) => item.outcome == null)

package/why-eyeprolog.md

@@ -203,9 +203,20 @@ make decisions, combine data from several sources, or need to be reviewed by
 someone who did not write them.
 
 Proofs make successful reasoning easier to inspect, test, teach, and discuss.
-They do not authenticate source data or replace application security. Embedders
-remain responsible for validating inputs and imposing suitable time, memory,
-depth, and solution limits.
+EyeProlog also treats a successful `why/2` term as a portable proof certificate.
+A certificate can be saved, transmitted as ordinary Prolog data, and checked later
+against the program without repeating the search that found the answer. Source
+steps are checked against the named clauses and their substitutions. Built-ins
+and abstract library steps remain explicit trusted boundaries; expanded proof
+detail opens bundled Prolog-library clauses so that more of the derivation can
+be checked from source. The verification result enumerates the remaining trusted
+boundaries rather than folding them into an undifferentiated success result.
+
+Verification and discovery therefore have different jobs: solving searches for
+a derivation, while certificate verification checks a supplied derivation. The
+certificate does not authenticate source data or replace application security.
+Embedders remain responsible for validating inputs and imposing suitable time,
+memory, depth, and solution limits.
 
 ## One engine across JavaScript environments