kibi-core 0.26.1 → 0.27.0

package/src/model_check.pl

@@ -47,7 +47,9 @@
 %                    routes.  set_relation compares the members with the
 %                    fact's set; required_fields and nullable_fields check
 %                    each selected table or object; route_middleware checks
-%                    each selected route's middleware.
+%                    each selected route's middleware; sequence_precedes
+%                    checks each "A -> B" member against the list in the
+%                    order read (every A before every B).
 %
 % Rules with explicit exists quantifiers, count or temporal expressions, or
 % durations, timestamps and intervals are outside what Kibi enumerates and
@@ -115,14 +117,18 @@ certificate_model(state_machine, Certificate, model(any(States), Table, machine(
     ;   Initial = none
     ),
     machine_table(States, Edges, Initial, Table).
-certificate_model(source, Certificate, model(none, none, source(Members, Entities, Routes))) :-
+certificate_model(source, Certificate, model(none, none, source(Members, Entities, Routes, Sequence))) :-
     !,
     required(Certificate, model, Model),
     required(Model, members, RawMembers),
     maplist(text_string, RawMembers, Members0),
     sort(Members0, Members),
     (   get_dict(entities, Model, Entities) -> true ; Entities = none ),
-    (   get_dict(routes, Model, Routes) -> true ; Routes = none ).
+    (   get_dict(routes, Model, Routes) -> true ; Routes = none ),
+    (   get_dict(sequence, Model, RawSequence)
+    ->  maplist(text_string, RawSequence, Sequence)
+    ;   Sequence = none
+    ).
 certificate_model(Kind, _, _) :-
     format(string(Reason), "a ~w certificate has no finite model to check", [Kind]),
     throw(model_error(Reason)).
@@ -391,14 +397,14 @@ obligation_result("machine_relation", Obligation, model(_, _, Machine), Result)
         ;   Result = ok
         )
     ).
-obligation_result("set_relation", Obligation, model(_, _, source(Actual, _, _)), Result) :- !,
+obligation_result("set_relation", Obligation, model(_, _, source(Actual, _, _, _)), Result) :- !,
     dict_text(Obligation, operator, Operator),
     obligation_strings(Obligation, Expected),
     (   relation_problem(Operator, Actual, Expected, "the members Kibi read from the source", Reason)
     ->  Result = problem(Reason)
     ;   Result = ok
     ).
-obligation_result(FieldKind, Obligation, model(_, _, source(_, Entities, _)), Result) :-
+obligation_result(FieldKind, Obligation, model(_, _, source(_, Entities, _, _)), Result) :-
     memberchk(FieldKind, ["required_fields", "nullable_fields"]),
     !,
     (   is_list(Entities), Entities \== []
@@ -411,7 +417,7 @@ obligation_result(FieldKind, Obligation, model(_, _, source(_, Entities, _)), Re
     ->  Result = problem(Reason)
     ;   Result = ok
     ).
-obligation_result("route_middleware", Obligation, model(_, _, source(_, _, Routes)), Result) :- !,
+obligation_result("route_middleware", Obligation, model(_, _, source(_, _, Routes, _)), Result) :- !,
     (   is_list(Routes), Routes \== []
     ->  true
     ;   throw(model_error("the source has no routes; read a route table for a middleware claim"))
@@ -429,9 +435,51 @@ obligation_result("route_middleware", Obligation, model(_, _, source(_, _, Route
     ->  Result = problem(Reason)
     ;   Result = ok
     ).
+% implements REQ-kibi-source-proof-kinds
+obligation_result("sequence_precedes", Obligation, model(_, _, source(_, _, _, Sequence)), Result) :- !,
+    (   is_list(Sequence)
+    ->  true
+    ;   throw(model_error("the source has no order; read a list for a precedes claim"))
+    ),
+    obligation_strings(Obligation, Pairs),
+    (   member(Pair, Pairs),
+        precedes_problem(Pair, Sequence, Reason)
+    ->  Result = problem(Reason)
+    ;   Result = ok
+    ).
 obligation_result(Kind, _, _, problem(Reason)) :-
     format(string(Reason), "a ~w obligation cannot be checked against a finite model", [Kind]).
 
+% A precedes member "A -> B" holds when A and B are both in the list and
+% every A comes before every B.
+precedes_problem(Pair, Sequence, Reason) :-
+    (   precedes_pair(Pair, First, Second)
+    ->  findall(I, nth1(I, Sequence, First), FirstAt),
+        findall(I, nth1(I, Sequence, Second), SecondAt),
+        (   FirstAt == []
+        ->  format(string(Reason), "~w is not in the list Kibi read", [First])
+        ;   SecondAt == []
+        ->  format(string(Reason), "~w is not in the list Kibi read", [Second])
+        ;   max_list(FirstAt, LastFirst),
+            min_list(SecondAt, FirstSecond),
+            LastFirst > FirstSecond
+        ->  format(string(Reason), "~w comes before ~w in the list Kibi read (items ~w and ~w)",
+                   [Second, First, FirstSecond, LastFirst])
+        )
+    ;   format(string(Reason), "~w is not spelled \"A -> B\"", [Pair])
+    ).
+
+precedes_pair(Pair, First, Second) :-
+    sub_string(Pair, Before, 4, After, " -> "),
+    sub_string(Pair, 0, Before, _, First0),
+    sub_string(Pair, _, After, 0, Second0),
+    \+ sub_string(Second0, _, _, _, " -> "),
+    normalize_space(string(First), First0),
+    normalize_space(string(Second), Second0),
+    First \== "",
+    Second \== "",
+    !.
+
 obligation_strings(Obligation, Members) :-
     get_dict(members, Obligation, Raw),
     maplist(text_string, Raw, Members0),

package/src/requirement_proof.pl

@@ -54,7 +54,13 @@ requirement_proof_context(VerificationSnapshot, CheckedAt, MaxAgeSeconds,
     (catch(parse_time(CheckedAtAtom, CheckedAtStamp), _, fail) -> true ; CheckedAtStamp = -1),
     normalize_integer(MaxAgeSeconds, MaxAge),
     normalize_atom(BindingMode, BindingModeAtom),
+    % Everything else in the context follows from the KB, so the proof memo
+    % key needs only the caller's parameters.
+    variant_sha1(params(Snapshot, CheckedAtAtom, MaxAge, BindingModeAtom, TestBindings), ParamsKey),
+    variant_sha1(findings(Contradictions, ContradictionWitnesses, UnsafeRules, UnverifiableRules), FindingsKey),
     Context = _{
+        proofMemoKey: ParamsKey,
+        ladderMemoKey: FindingsKey,
         contradictions: Contradictions,
         contradictionWitnesses: ContradictionWitnesses,
         unsafeRules: UnsafeRules,
@@ -68,28 +74,86 @@ requirement_proof_context(VerificationSnapshot, CheckedAt, MaxAgeSeconds,
     }.
 
 % implements REQ-kibi-conservative-requirement-proof
+% A requirement's proof is kept per KB generation and proof parameters, so
+% the evidence-floor rule, the coverage evidence and a coverage report in one
+% check read each ladder once.  Inside a transaction (what-if staging) the
+% KB is not the generation's, so the proof is computed afresh.
+requirement_proof(ReqId, ReqProps, Context, Proof) :-
+    (   \+ rdf_db:rdf_active_transaction(_),
+        get_dict(proofMemoKey, Context, ParamsKey),
+        kb:index_verification_key(requirement_proof, IndexKey)
+    ->  Key = key(IndexKey, ParamsKey),
+        (   kb:kb_requirement_proof_memo(ReqId, Key, Proof0)
+        ->  Proof = Proof0
+        ;   compute_requirement_proof(ReqId, ReqProps, Context, Proof),
+            (   once(kb:kb_requirement_proof_memo(_, Stored, _)),
+                Stored \== Key
+            ->  retractall(kb:kb_requirement_proof_memo(_, _, _))
+            ;   true
+            ),
+            assertz(kb:kb_requirement_proof_memo(ReqId, Key, Proof))
+        )
+    ;   compute_requirement_proof(ReqId, ReqProps, Context, Proof)
+    ).
+
+% The stages before passing_e2e read the KB and the context's KB-derived
+% findings (contradictions, unsafe and unverifiable rules) only, never the
+% caller's snapshot, receipt bindings or checkedAt.  A check passes a new
+% checkedAt every run, so these stages are kept per KB generation and those
+% findings apart from the full proof; inside a transaction they are computed
+% afresh.
+receipt_independent_stages(ReqId, ReqProps, Context, Ladder) :-
+    (   \+ rdf_db:rdf_active_transaction(_),
+        get_dict(ladderMemoKey, Context, FindingsKey),
+        kb:index_verification_key(requirement_ladder, IndexKey)
+    ->  variant_sha1(ReqProps, PropsKey),
+        Key = key(IndexKey, FindingsKey, PropsKey),
+        (   kb:kb_requirement_ladder_memo(ReqId, Key, Ladder0)
+        ->  Ladder = Ladder0
+        ;   compute_receipt_independent_stages(ReqId, ReqProps, Context, Ladder),
+            (   once(kb:kb_requirement_ladder_memo(_, key(Stored, _, _), _)),
+                Stored \== IndexKey
+            ->  retractall(kb:kb_requirement_ladder_memo(_, _, _))
+            ;   true
+            ),
+            retractall(kb:kb_requirement_ladder_memo(ReqId, _, _)),
+            assertz(kb:kb_requirement_ladder_memo(ReqId, Key, Ladder))
+        )
+    ;   compute_receipt_independent_stages(ReqId, ReqProps, Context, Ladder)
+    ).
+
+compute_receipt_independent_stages(ReqId, ReqProps, Context,
+        ladder(SemanticStage, Inventory, LogicStage, ContradictionStage,
+               ScenarioStage, ScenarioTestStage, ScenarioTests, SymbolSets)) :-
+    semantic_inventory_stage(ReqProps, SemanticStage, Inventory),
+    logic_grounding_stage(ReqId, ReqProps, Inventory, Context, LogicStage),
+    contradiction_stage(ReqId, LogicStage.status, SemanticStage.status, Context, ContradictionStage),
+    scenario_stage(ReqId, ScenarioStage, ScenarioIds),
+    scenario_test_stage(ScenarioIds, ScenarioTestStage, ScenarioTests),
+    production_symbol_sets(ReqId, SymbolSets).
+
 % Exemption first: a current requirement explicitly marked proof_exempt with a
 % reason is intentionally outside E2E-proof scope and must never fall through
 % to the ladder (which would report misleading receipt gaps).
-requirement_proof(ReqId, ReqProps, _Context, Proof) :-
+compute_requirement_proof(ReqId, ReqProps, _Context, Proof) :-
     kb:current_req(ReqId),
     proof_exempt(ReqProps, Reason),
     !,
     exempt_requirement_proof(Reason, ReqProps, Proof).
-requirement_proof(ReqId, ReqProps, _Context, Proof) :-
+compute_requirement_proof(ReqId, ReqProps, _Context, Proof) :-
     \+ kb:current_req(ReqId),
     !,
     applicability_exclusion_reason(ReqId, Reason),
     exempt_requirement_proof(Reason, ReqProps, Proof).
-requirement_proof(ReqId, ReqProps, Context, Proof) :-
-    semantic_inventory_stage(ReqProps, SemanticStage, Inventory),
-    logic_grounding_stage(ReqId, ReqProps, Inventory, Context, LogicStage),
-    contradiction_stage(ReqId, LogicStage.status, SemanticStage.status, Context, ContradictionStage),
-    scenario_stage(ReqId, ScenarioStage, ScenarioIds),
-    scenario_test_stage(ScenarioIds, ScenarioTestStage, ScenarioTests),
+compute_requirement_proof(ReqId, ReqProps, Context, Proof) :-
+    receipt_independent_stages(ReqId, ReqProps, Context,
+        ladder(SemanticStage, Inventory, LogicStage, ContradictionStage,
+               ScenarioStage, ScenarioTestStage, ScenarioTests, SymbolSets)),
     passing_e2e_stage(ScenarioTestStage, Context, PassingE2eStage, PassingE2eTests),
     executable_symbol_stage(PassingE2eTests, ExecutableStage, ExecutableSymbols),
-    production_symbol_stage(ReqId, PassingE2eTests, ScenarioTests, PassingE2eStage.receiptEvidence, Context, ProductionStage, ProductionSymbols),
+    production_symbol_stage_from_sets(ReqId, SymbolSets, PassingE2eTests, ScenarioTests,
+                                      PassingE2eStage.receiptEvidence, Context,
+                                      ProductionStage, ProductionSymbols),
     source_coordinate_stage(ReqProps, ExecutableSymbols, ProductionSymbols, CoordinateStage),
     Stages = _{
         semanticInventory: SemanticStage,
@@ -1211,6 +1275,11 @@ canonical_json_value(Value, Json) :-
     maplist(canonical_json_value, Value, Parts),
     atomics_to_string(Parts, ",", Body),
     format(string(Json), "[~s]", [Body]).
+% JSON true, false and null read back as atoms; json_write would quote them,
+% so the hash would differ from the one the CLI recorded at ingest.
+canonical_json_value(Value, Json) :-
+    memberchk(Value, [true, false, null]), !,
+    atom_string(Value, Json).
 canonical_json_value(Value, Json) :-
     with_output_to(string(Json), json_write(current_output, Value, [width(0)])).
 
@@ -1375,6 +1444,14 @@ production_symbol_stage(ReqId, PassingE2eTests, Stage, ProductionSymbols) :-
     production_symbol_stage(ReqId, PassingE2eTests, ScenarioTests, [], Context, Stage, ProductionSymbols).
 
 production_symbol_stage(ReqId, PassingE2eTests, ScenarioTests, ReceiptEvidence, Context, Stage, ProductionSymbols) :-
+    production_symbol_sets(ReqId, Sets),
+    production_symbol_stage_from_sets(ReqId, Sets, PassingE2eTests, ScenarioTests,
+                                      ReceiptEvidence, Context, Stage, ProductionSymbols).
+
+% The implementing symbols of a requirement, split into structural
+% (type-shape with a unit-test contract) and production ones, with the
+% production symbols' coordinates: all read from the KB alone.
+production_symbol_sets(ReqId, symbol_sets(StructuralSymbols, ProductionSymbols, Coordinates)) :-
     findall(SymbolId,
         (kb_relationship(implements, SymbolId, ReqId),
          kb_entity(SymbolId, symbol, _),
@@ -1383,13 +1460,17 @@ production_symbol_stage(ReqId, PassingE2eTests, ScenarioTests, ReceiptEvidence,
     sort(Implementing0, ImplementingSymbols),
     include(type_shape_symbol_with_structural_contract, ImplementingSymbols, StructuralSymbols),
     exclude(type_shape_symbol_with_structural_contract, ImplementingSymbols, ProductionSymbols),
+    maplist(symbol_coordinate_ref, ProductionSymbols, Coordinates).
+
+production_symbol_stage_from_sets(ReqId, symbol_sets(StructuralSymbols, ProductionSymbols, Coordinates),
+                                  PassingE2eTests, ScenarioTests, ReceiptEvidence, Context,
+                                  Stage, ProductionSymbols) :-
     include(symbol_not_covered_by_tests(PassingE2eTests), ProductionSymbols, UncoveredProduction),
     structural_unit_receipts(StructuralSymbols, Context, UnitReceipts),
     exclude(structural_symbol_covered(PassingE2eTests, UnitReceipts), StructuralSymbols, UncoveredStructural),
     append(UncoveredProduction, UncoveredStructural, UncoveredSymbols),
     production_stage_status(ProductionSymbols, StructuralSymbols, PassingE2eTests,
                             UncoveredProduction, UncoveredStructural, Status, StatusReason),
-    maplist(symbol_coordinate_ref, ProductionSymbols, Coordinates),
     production_coverage_explanations(
         ReqId, ProductionSymbols, StructuralSymbols, UncoveredSymbols,
         PassingE2eTests, ScenarioTests, ReceiptEvidence, UnitReceipts-Context, Explanations),

package/src/status.pl

@@ -203,7 +203,23 @@ kb_snapshot_time(SnapshotTime) :-
 % made kb_status_json quadratic (paths x entities) and could wedge large KBs
 % for minutes whenever mtime churn (e.g. a git checkout) marked whole lanes
 % newer than the snapshot.
+% The source -> entity id index reads every entity, so it is kept per KB
+% generation (whose key names the attached store's graph): status runs it on
+% each freshness probe while the KB is unchanged.  Inside a transaction it is
+% built afresh.
 entity_source_id_index(Index) :-
+    (   \+ rdf_db:rdf_active_transaction(_),
+        kb:index_verification_key(status_source_index, Key)
+    ->  (   kb:kb_status_source_index_memo(Key, Index0)
+        ->  Index = Index0
+        ;   compute_entity_source_id_index(Index),
+            retractall(kb:kb_status_source_index_memo(_, _)),
+            assertz(kb:kb_status_source_index_memo(Key, Index))
+        )
+    ;   compute_entity_source_id_index(Index)
+    ).
+
+compute_entity_source_id_index(Index) :-
     findall(RelativeSource-Id,
         (   kb_entity(Id, _Type, Props),
             entity_source_property(Props, RawSource),

package/src/units.pl

@@ -120,13 +120,11 @@ numeric_value_type(number).
 
 known_unit(Unit, BaseUnit, Factor) :-
     atom(Unit),
-    Unit \== '',
     (   unit_symbol(Unit, BaseUnit, Factor)
     ->  true
     ;   downcase_atom(Unit, Lower),
         unit_word(Lower, BaseUnit, Factor)
-    ),
-    !.
+    ).
 
 % Integers (including big integers) stay exact. Floats have binary noise
 % rounded away (0.1 h * 3600 = 360.00000000000006) before deciding whether the