kibi-core 0.24.0 → 0.27.0

package/src/requirement_proof.pl

@@ -27,6 +27,7 @@
 :- use_module('logic_ir.pl', [logic_rule_safety/2]).
 :- use_module('code_certificates.pl', [code_certificate_check/2, code_certificate_digest/2]).
 :- use_module('claim_obligations.pl', [claim_obligation/3, obligation_equal/2]).
+:- use_module('model_check.pl', [model_check_obligation/4]).
 
 proof_version('kibi.requirement-proof.v5').
 
@@ -53,7 +54,13 @@ requirement_proof_context(VerificationSnapshot, CheckedAt, MaxAgeSeconds,
     (catch(parse_time(CheckedAtAtom, CheckedAtStamp), _, fail) -> true ; CheckedAtStamp = -1),
     normalize_integer(MaxAgeSeconds, MaxAge),
     normalize_atom(BindingMode, BindingModeAtom),
+    % Everything else in the context follows from the KB, so the proof memo
+    % key needs only the caller's parameters.
+    variant_sha1(params(Snapshot, CheckedAtAtom, MaxAge, BindingModeAtom, TestBindings), ParamsKey),
+    variant_sha1(findings(Contradictions, ContradictionWitnesses, UnsafeRules, UnverifiableRules), FindingsKey),
     Context = _{
+        proofMemoKey: ParamsKey,
+        ladderMemoKey: FindingsKey,
         contradictions: Contradictions,
         contradictionWitnesses: ContradictionWitnesses,
         unsafeRules: UnsafeRules,
@@ -67,28 +74,86 @@ requirement_proof_context(VerificationSnapshot, CheckedAt, MaxAgeSeconds,
     }.
 
 % implements REQ-kibi-conservative-requirement-proof
+% A requirement's proof is kept per KB generation and proof parameters, so
+% the evidence-floor rule, the coverage evidence and a coverage report in one
+% check read each ladder once.  Inside a transaction (what-if staging) the
+% KB is not the generation's, so the proof is computed afresh.
+requirement_proof(ReqId, ReqProps, Context, Proof) :-
+    (   \+ rdf_db:rdf_active_transaction(_),
+        get_dict(proofMemoKey, Context, ParamsKey),
+        kb:index_verification_key(requirement_proof, IndexKey)
+    ->  Key = key(IndexKey, ParamsKey),
+        (   kb:kb_requirement_proof_memo(ReqId, Key, Proof0)
+        ->  Proof = Proof0
+        ;   compute_requirement_proof(ReqId, ReqProps, Context, Proof),
+            (   once(kb:kb_requirement_proof_memo(_, Stored, _)),
+                Stored \== Key
+            ->  retractall(kb:kb_requirement_proof_memo(_, _, _))
+            ;   true
+            ),
+            assertz(kb:kb_requirement_proof_memo(ReqId, Key, Proof))
+        )
+    ;   compute_requirement_proof(ReqId, ReqProps, Context, Proof)
+    ).
+
+% The stages before passing_e2e read the KB and the context's KB-derived
+% findings (contradictions, unsafe and unverifiable rules) only, never the
+% caller's snapshot, receipt bindings or checkedAt.  A check passes a new
+% checkedAt every run, so these stages are kept per KB generation and those
+% findings apart from the full proof; inside a transaction they are computed
+% afresh.
+receipt_independent_stages(ReqId, ReqProps, Context, Ladder) :-
+    (   \+ rdf_db:rdf_active_transaction(_),
+        get_dict(ladderMemoKey, Context, FindingsKey),
+        kb:index_verification_key(requirement_ladder, IndexKey)
+    ->  variant_sha1(ReqProps, PropsKey),
+        Key = key(IndexKey, FindingsKey, PropsKey),
+        (   kb:kb_requirement_ladder_memo(ReqId, Key, Ladder0)
+        ->  Ladder = Ladder0
+        ;   compute_receipt_independent_stages(ReqId, ReqProps, Context, Ladder),
+            (   once(kb:kb_requirement_ladder_memo(_, key(Stored, _, _), _)),
+                Stored \== IndexKey
+            ->  retractall(kb:kb_requirement_ladder_memo(_, _, _))
+            ;   true
+            ),
+            retractall(kb:kb_requirement_ladder_memo(ReqId, _, _)),
+            assertz(kb:kb_requirement_ladder_memo(ReqId, Key, Ladder))
+        )
+    ;   compute_receipt_independent_stages(ReqId, ReqProps, Context, Ladder)
+    ).
+
+compute_receipt_independent_stages(ReqId, ReqProps, Context,
+        ladder(SemanticStage, Inventory, LogicStage, ContradictionStage,
+               ScenarioStage, ScenarioTestStage, ScenarioTests, SymbolSets)) :-
+    semantic_inventory_stage(ReqProps, SemanticStage, Inventory),
+    logic_grounding_stage(ReqId, ReqProps, Inventory, Context, LogicStage),
+    contradiction_stage(ReqId, LogicStage.status, SemanticStage.status, Context, ContradictionStage),
+    scenario_stage(ReqId, ScenarioStage, ScenarioIds),
+    scenario_test_stage(ScenarioIds, ScenarioTestStage, ScenarioTests),
+    production_symbol_sets(ReqId, SymbolSets).
+
 % Exemption first: a current requirement explicitly marked proof_exempt with a
 % reason is intentionally outside E2E-proof scope and must never fall through
 % to the ladder (which would report misleading receipt gaps).
-requirement_proof(ReqId, ReqProps, _Context, Proof) :-
+compute_requirement_proof(ReqId, ReqProps, _Context, Proof) :-
     kb:current_req(ReqId),
     proof_exempt(ReqProps, Reason),
     !,
     exempt_requirement_proof(Reason, ReqProps, Proof).
-requirement_proof(ReqId, ReqProps, _Context, Proof) :-
+compute_requirement_proof(ReqId, ReqProps, _Context, Proof) :-
     \+ kb:current_req(ReqId),
     !,
     applicability_exclusion_reason(ReqId, Reason),
     exempt_requirement_proof(Reason, ReqProps, Proof).
-requirement_proof(ReqId, ReqProps, Context, Proof) :-
-    semantic_inventory_stage(ReqProps, SemanticStage, Inventory),
-    logic_grounding_stage(ReqId, ReqProps, Inventory, Context, LogicStage),
-    contradiction_stage(ReqId, LogicStage.status, SemanticStage.status, Context, ContradictionStage),
-    scenario_stage(ReqId, ScenarioStage, ScenarioIds),
-    scenario_test_stage(ScenarioIds, ScenarioTestStage, ScenarioTests),
+compute_requirement_proof(ReqId, ReqProps, Context, Proof) :-
+    receipt_independent_stages(ReqId, ReqProps, Context,
+        ladder(SemanticStage, Inventory, LogicStage, ContradictionStage,
+               ScenarioStage, ScenarioTestStage, ScenarioTests, SymbolSets)),
     passing_e2e_stage(ScenarioTestStage, Context, PassingE2eStage, PassingE2eTests),
     executable_symbol_stage(PassingE2eTests, ExecutableStage, ExecutableSymbols),
-    production_symbol_stage(ReqId, PassingE2eTests, ScenarioTests, PassingE2eStage.receiptEvidence, Context, ProductionStage, ProductionSymbols),
+    production_symbol_stage_from_sets(ReqId, SymbolSets, PassingE2eTests, ScenarioTests,
+                                      PassingE2eStage.receiptEvidence, Context,
+                                      ProductionStage, ProductionSymbols),
     source_coordinate_stage(ReqProps, ExecutableSymbols, ProductionSymbols, CoordinateStage),
     Stages = _{
         semanticInventory: SemanticStage,
@@ -1009,7 +1074,7 @@ valid_receipt_version_fields('kibi.proof-receipt.v1', _Receipt).
 valid_receipt_version_fields('kibi.proof-receipt.v2', Receipt) :-
     inventory_entry_field(Receipt, kind, RawKind),
     normalize_receipt_atom(RawKind, Kind),
-    memberchk(Kind, [e2e, example, property, exhaustive, typecheck, arithmetic, smt]),
+    memberchk(Kind, [e2e, example, property, exhaustive, typecheck, arithmetic, smt, rule, state_machine, regex, source]),
     inventory_entry_field(Receipt, evidence_level, RawLevel),
     normalize_receipt_atom(RawLevel, Level),
     memberchk(Level, [proved, tested]),
@@ -1019,7 +1084,7 @@ valid_receipt_version_fields('kibi.proof-receipt.v2', Receipt) :-
     ;   true
     ),
     (   Level == proved
-    ->  memberchk(Kind, [exhaustive, typecheck, arithmetic, smt]),
+    ->  memberchk(Kind, [exhaustive, typecheck, arithmetic, smt, rule, state_machine, regex, source]),
         inventory_entry_field(Receipt, outcome, RawOutcome),
         normalize_receipt_atom(RawOutcome, passed),
         inventory_entry_field(Receipt, certificate, _),
@@ -1210,6 +1275,11 @@ canonical_json_value(Value, Json) :-
     maplist(canonical_json_value, Value, Parts),
     atomics_to_string(Parts, ",", Body),
     format(string(Json), "[~s]", [Body]).
+% JSON true, false and null read back as atoms; json_write would quote them,
+% so the hash would differ from the one the CLI recorded at ingest.
+canonical_json_value(Value, Json) :-
+    memberchk(Value, [true, false, null]), !,
+    atom_string(Value, Json).
 canonical_json_value(Value, Json) :-
     with_output_to(string(Json), json_write(current_output, Value, [width(0)])).
 
@@ -1374,6 +1444,14 @@ production_symbol_stage(ReqId, PassingE2eTests, Stage, ProductionSymbols) :-
     production_symbol_stage(ReqId, PassingE2eTests, ScenarioTests, [], Context, Stage, ProductionSymbols).
 
 production_symbol_stage(ReqId, PassingE2eTests, ScenarioTests, ReceiptEvidence, Context, Stage, ProductionSymbols) :-
+    production_symbol_sets(ReqId, Sets),
+    production_symbol_stage_from_sets(ReqId, Sets, PassingE2eTests, ScenarioTests,
+                                      ReceiptEvidence, Context, Stage, ProductionSymbols).
+
+% The implementing symbols of a requirement, split into structural
+% (type-shape with a unit-test contract) and production ones, with the
+% production symbols' coordinates: all read from the KB alone.
+production_symbol_sets(ReqId, symbol_sets(StructuralSymbols, ProductionSymbols, Coordinates)) :-
     findall(SymbolId,
         (kb_relationship(implements, SymbolId, ReqId),
          kb_entity(SymbolId, symbol, _),
@@ -1382,13 +1460,17 @@ production_symbol_stage(ReqId, PassingE2eTests, ScenarioTests, ReceiptEvidence,
     sort(Implementing0, ImplementingSymbols),
     include(type_shape_symbol_with_structural_contract, ImplementingSymbols, StructuralSymbols),
     exclude(type_shape_symbol_with_structural_contract, ImplementingSymbols, ProductionSymbols),
+    maplist(symbol_coordinate_ref, ProductionSymbols, Coordinates).
+
+production_symbol_stage_from_sets(ReqId, symbol_sets(StructuralSymbols, ProductionSymbols, Coordinates),
+                                  PassingE2eTests, ScenarioTests, ReceiptEvidence, Context,
+                                  Stage, ProductionSymbols) :-
     include(symbol_not_covered_by_tests(PassingE2eTests), ProductionSymbols, UncoveredProduction),
     structural_unit_receipts(StructuralSymbols, Context, UnitReceipts),
     exclude(structural_symbol_covered(PassingE2eTests, UnitReceipts), StructuralSymbols, UncoveredStructural),
     append(UncoveredProduction, UncoveredStructural, UncoveredSymbols),
     production_stage_status(ProductionSymbols, StructuralSymbols, PassingE2eTests,
                             UncoveredProduction, UncoveredStructural, Status, StatusReason),
-    maplist(symbol_coordinate_ref, ProductionSymbols, Coordinates),
     production_coverage_explanations(
         ReqId, ProductionSymbols, StructuralSymbols, UncoveredSymbols,
         PassingE2eTests, ScenarioTests, ReceiptEvidence, UnitReceipts-Context, Explanations),
@@ -1996,7 +2078,7 @@ claim_entry(ReqId, ProofStatus, IntentLevel, BoundTests, InventoryEntry, Entry)
             sort(Bindings0, Bindings),
             include(binding_is(rejected), Bindings, RejectedBindings),
             maplist(binding_rejection(Key), RejectedBindings, Rejections),
-            (   member(B, Bindings), get_dict(binding, B, derived), get_dict(scope, B, code)
+            (   member(B, Bindings), get_dict(binding, B, derived), \+ get_dict(scope, B, intent)
             ->  Level = proved
             ;   Level = tested
             ),
@@ -2097,6 +2179,12 @@ certificate_obligation_problem(arithmetic, Evidence, Obligation, Problem) :-
     ;   Problem = 'the certificate\'s claim is not the fact\'s constraint'
     ).
 
+certificate_obligation_problem(Kind, Evidence, Obligation, Problem) :-
+    memberchk(Kind, [rule, state_machine, source]),
+    get_dict(certificate, Evidence, Certificate),
+    model_check_obligation(Kind, Obligation, Certificate, problem(Problem0)),
+    atom_string(Problem, Problem0).
+
 %% claim_summary(+ClaimEvidence, -Summary, -UnprovedClaims)
 claim_summary(ClaimEvidence, Summary, Unproved) :-
     include(applicable_claim, ClaimEvidence, Applicable),

package/src/rule_registry.pl

@@ -318,4 +318,4 @@ rule_description('policy-markers', 'When a plugin activated for kibi.check-polic
 rule_description('kb-consistency', 'The facts current requirements name must hold together, jointly and not only pairwise: every property context needs a value that satisfies all its facts, every atom and decision key one truth value, and stored rules a stratification. Each finding is a contradiction certificate (an irreducible core, two disagreeing facts or a negation cycle) re-verified by the independent checker, or a certificate that checker rejects').
 rule_description('kb-consistency-unresolved', 'Advisory: a property context, atom or decision key whose facts the consistency checker cannot compare (mixed value types or units, an unsupported operator or polarity, or a contradiction whose validity windows never overlap); it never counts as consistent').
 rule_description('evidence-floor', 'Every current requirement\'s computed evidence level (proved, tested, asserted, unverified) must reach its floor: required_evidence when set, otherwise tested for a firm requirement and no floor for any other. Receipts that are only older than the code count as pending re-proof and pass, unless kibi check runs with --fresh-evidence, which also needs a clean proof snapshot').
-rule_description('proof-contract-claims', 'From schema 12, every certificate-kind proof contract (exhaustive, typecheck, arithmetic, smt) must name the claims it proves in proves, and each named claim must be a modeled claim of a current requirement the test reaches through its scenarios, grounded by a fact that proof kind can express or attest').
+rule_description('proof-contract-claims', 'From schema 12, every certificate-kind proof contract (exhaustive, typecheck, arithmetic, smt, rule, state_machine, regex) must name the claims it proves in proves, and each named claim must be a modeled claim of a current requirement the test reaches through its scenarios, grounded by a fact that proof kind can express or attest').

package/src/status.pl

@@ -203,7 +203,23 @@ kb_snapshot_time(SnapshotTime) :-
 % made kb_status_json quadratic (paths x entities) and could wedge large KBs
 % for minutes whenever mtime churn (e.g. a git checkout) marked whole lanes
 % newer than the snapshot.
+% The source -> entity id index reads every entity, so it is kept per KB
+% generation (whose key names the attached store's graph): status runs it on
+% each freshness probe while the KB is unchanged.  Inside a transaction it is
+% built afresh.
 entity_source_id_index(Index) :-
+    (   \+ rdf_db:rdf_active_transaction(_),
+        kb:index_verification_key(status_source_index, Key)
+    ->  (   kb:kb_status_source_index_memo(Key, Index0)
+        ->  Index = Index0
+        ;   compute_entity_source_id_index(Index),
+            retractall(kb:kb_status_source_index_memo(_, _)),
+            assertz(kb:kb_status_source_index_memo(Key, Index))
+        )
+    ;   compute_entity_source_id_index(Index)
+    ).
+
+compute_entity_source_id_index(Index) :-
     findall(RelativeSource-Id,
         (   kb_entity(Id, _Type, Props),
             entity_source_property(Props, RawSource),

package/src/units.pl

@@ -120,13 +120,11 @@ numeric_value_type(number).
 
 known_unit(Unit, BaseUnit, Factor) :-
     atom(Unit),
-    Unit \== '',
     (   unit_symbol(Unit, BaseUnit, Factor)
     ->  true
     ;   downcase_atom(Unit, Lower),
         unit_word(Lower, BaseUnit, Factor)
-    ),
-    !.
+    ).
 
 % Integers (including big integers) stay exact. Floats have binary noise
 % rounded away (0.1 h * 3600 = 360.00000000000006) before deciding whether the