kibi-core 0.26.1 → 0.28.0

package/src/checks.pl

@@ -6,7 +6,11 @@
 :- module(checks, [
     check_all/1,                    % Returns all violations as a dict
     check_all_json/1,               % Returns all violations as JSON string
+    check_all_json_file/2,          % Writes all violations as JSON to a file
     check_selected_json/2,           % Returns only selected rule violations as JSON
+    check_selected_json_file/2,      % Writes selected rule violations as JSON to a file
+    check_all_json_transport/4,      % File transport with an answer fallback
+    check_selected_json_transport/4, % Same, for selected rules
     check_must_priority_coverage/1, % Returns list of must-priority violations
     check_symbol_coverage/1,        % Returns list of uncovered symbols
     check_changed_symbol_coverage/2, % symbol-coverage restricted to a staged change set
@@ -22,6 +26,9 @@
     check_adr_proposed/1,
     check_scenario_feasibility/1,
     check_scenario_feasibility_unknown/1,
+    check_scenario_outcome_mismatch/1,
+    negative_scenario_witness/3,
+    opposing_assumption/2,
     check_exception_claim_keys/1,
     check_numeric_string_values/1,
     check_rule_key_arguments_missing/1,
@@ -107,6 +114,7 @@ check_all(ViolationsDict) :-
     check_adr_proposed(AdrProposed),
     check_scenario_feasibility(ScenarioFeasibility),
     check_scenario_feasibility_unknown(ScenarioFeasibilityUnknown),
+    check_scenario_outcome_mismatch(ScenarioOutcomeMismatch),
     check_exception_claim_keys(ExceptionClaimKeys),
     check_numeric_string_values(NumericStringValues),
     check_domain_contradictions(Contradictions),
@@ -144,6 +152,7 @@ check_all(ViolationsDict) :-
         adr_proposed: AdrProposed,
         scenario_feasibility: ScenarioFeasibility,
         scenario_feasibility_unknown: ScenarioFeasibilityUnknown,
+        scenario_outcome_mismatch: ScenarioOutcomeMismatch,
         exception_claim_keys: ExceptionClaimKeys,
         numeric_string_value: NumericStringValues,
         domain_contradictions: Contradictions,
@@ -470,7 +479,7 @@ parse_json_object(Dict, Dict) :-
     !.
 parse_json_object(Raw, Dict) :-
     (atom(Raw) ; string(Raw)),
-    catch(atom_json_dict(Raw, Dict, [value_string_as(string)]), _, fail),
+    json_text_term(Raw, Dict),
     is_dict(Dict).
 
 parse_json_list(Raw, Entries) :-
@@ -482,9 +491,48 @@ parse_json_list(^^(Value, _), Entries) :-
     parse_json_list(Value, Entries).
 parse_json_list(Raw, Entries) :-
     (atom(Raw) ; string(Raw)),
-    catch(atom_json_dict(Raw, Entries, [value_string_as(string)]), _, fail),
+    json_text_term(Raw, Entries),
     is_list(Entries).
 
+% The same JSON text (a rule body, a claim inventory, a receipt history) is
+% parsed by several rules and by every requirement that links the fact, so
+% the parsed term is kept by its text.  Parsing is a pure function of the
+% text, so the memo never goes stale; it is bounded so a long-lived engine
+% cannot grow it without limit.
+:- dynamic json_text_memo/2.
+:- dynamic json_text_memo_size/1.
+
+% mutalog-disable-next-line literal: the bound is a tuning value; any size gives the same answers
+json_text_memo_limit(16384).
+
+json_text_term(Raw, Term) :-
+    atom_string(Text, Raw),
+    (   json_text_memo(Text, Stored)
+    ->  Stored = parsed(Term)
+    ;   (   catch(atom_json_dict(Text, Parsed, [value_string_as(string)]), _, fail)
+        ->  Stored = parsed(Parsed)
+        ;   Stored = invalid
+        ),
+        json_text_remember(Text, Stored),
+        Stored = parsed(Term)
+    ).
+
+json_text_remember(Text, Stored) :-
+    (   json_text_memo_size(Size)
+    ->  true
+    ;   Size = 0
+    ),
+    json_text_memo_limit(Limit),
+    (   Size >= Limit
+    ->  retractall(json_text_memo(_, _)),
+        retractall(json_text_memo_size(_)),
+        Next = 1
+    ;   retractall(json_text_memo_size(_)),
+        Next is Size + 1
+    ),
+    assertz(json_text_memo(Text, Stored)),
+    assertz(json_text_memo_size(Next)).
+
 %% check_no_dangling_refs(-Violations)
 % Finds all relationships referencing non-existent entities.
 check_no_dangling_refs(Violations) :-
@@ -1281,7 +1329,28 @@ analysis_outcome(analysis([], [], false, []), feasible).
 % advisory reasons in reporting order; ByException is true when some check is
 % satisfiable only because an approved exception waived a constraint;
 % NotApplicable is non-empty only when no assumption is governed at all.
-scenario_feasibility_analysis(ScenarioId, analysis(Witnesses, Unknowns, ByException, NotApplicable)) :-
+% The analysis of a scenario is kept per KB generation: the blocking rule,
+% the unknown-feasibility rule and every requirement's proof ladder ask for
+% the same scenarios.  Inside a transaction (what-if staging) the KB is not
+% the generation's, so the analysis is computed afresh.
+scenario_feasibility_analysis(ScenarioId, Analysis) :-
+    (   nonvar(ScenarioId),
+        \+ rdf_db:rdf_active_transaction(_),
+        kb:index_verification_key(scenario_feasibility, Key)
+    ->  (   kb:kb_scenario_feasibility_memo(ScenarioId, Key, Analysis0)
+        ->  Analysis = Analysis0
+        ;   compute_scenario_feasibility_analysis(ScenarioId, Analysis),
+            (   once(kb:kb_scenario_feasibility_memo(_, Stored, _)),
+                Stored \== Key
+            ->  retractall(kb:kb_scenario_feasibility_memo(_, _, _))
+            ;   true
+            ),
+            assertz(kb:kb_scenario_feasibility_memo(ScenarioId, Key, Analysis))
+        )
+    ;   compute_scenario_feasibility_analysis(ScenarioId, Analysis)
+    ).
+
+compute_scenario_feasibility_analysis(ScenarioId, analysis(Witnesses, Unknowns, ByException, NotApplicable)) :-
     findall(FactId, kb_relationship(assumes, ScenarioId, FactId), Assumed0),
     sort(Assumed0, Assumed),
     (   Assumed == []
@@ -2068,6 +2137,176 @@ bool_domain_exhausted(bool, Different) :-
     memberchk(true, Different),
     memberchk(false, Different).
 
+%% negative_scenario_witness(?ScenarioId, ?ReqId, -Witness)
+% implements REQ-kibi-happy-path-gap
+% A scenario that expects rejection or error is a targeted negative for a
+% requirement when its assumptions break that requirement: the feasibility
+% analysis finds a witness naming it, or (below) an assumption opposes one of
+% the requirement's claim facts directly.  A rejection scenario whose assumptions
+% the requirements permit, or that an approved exception waives, exercises no
+% requirement's failure side.
+negative_scenario_witness(ScenarioId, ReqId,
+                          infeasibility(ReqIds, AssumedFacts, ReqFacts, Reason)) :-
+    negative_scenario(ScenarioId),
+    scenario_feasibility_analysis(ScenarioId, analysis(Witnesses, _, _, _)),
+    member(infeasibility(ReqIds, AssumedFacts, ReqFacts, Reason), Witnesses),
+    member(ReqId, ReqIds).
+% A scenario the requirement specifies may also target one of its claims
+% directly: it assumes a fact that opposes the claim's fact (a conflicting
+% property value or polarity, the opposite polarity of the same predicate),
+% or, for a rule over predicates, a fact instantiating one of the rule's
+% atoms, so the scenario is about the situation the rule governs.
+negative_scenario_witness(ScenarioId, ReqId, opposed(AssumedFact, ReqFact)) :-
+    negative_scenario(ScenarioId),
+    kb_relationship(specified_by, ReqId, ScenarioId),
+    kb:current_req(ReqId),
+    kb_relationship(assumes, ScenarioId, AssumedFact),
+    member(Link, [requires_property, requires_predicate, requires_rule]),
+    kb_relationship(Link, ReqId, ReqFact),
+    facts_oppose(AssumedFact, ReqFact).
+
+facts_oppose(AssumedFact, ReqFact) :-
+    kb:fact_property_tuple(AssumedFact, Subject, Property, OpA, TypeA, ValueA, UnitA, ScopeA, PolarityA),
+    kb:fact_property_tuple(ReqFact, Subject, Property, OpB, TypeB, ValueB, UnitB, ScopeB, PolarityB),
+    !,
+    kb:scope_intersects(ScopeA, ScopeB),
+    (   kb:polarity_conflict(Subject, Property, OpA, TypeA, ValueA, UnitA, ScopeA, PolarityA,
+                             OpB, TypeB, ValueB, UnitB, ScopeB, PolarityB, _)
+    ->  true
+    ;   PolarityA == PolarityB,
+        kb:property_conflict(Subject, Property, OpA, TypeA, ValueA, UnitA, PolarityA,
+                             OpB, TypeB, ValueB, UnitB, PolarityB, _)
+    ->  true
+    ).
+facts_oppose(AssumedFact, ReqFact) :-
+    kb:predicate_fact(AssumedFact, Namespace, Name, Args, PolarityA),
+    kb:predicate_fact(ReqFact, Namespace, Name, Args, PolarityB),
+    !,
+    PolarityA \== PolarityB.
+facts_oppose(AssumedFact, ReqFact) :-
+    kb:predicate_fact(AssumedFact, Namespace, Name, _, _),
+    stored_rule_fact(ReqFact, _, Rule),
+    sub_term(atom(Namespace, Name, _, _, _), Rule),
+    !.
+
+%% opposing_assumption(+FactId, -Assumption)
+% implements REQ-kibi-happy-path-gap
+% A fact a negative scenario can assume to oppose the claim fact FactId, as
+% the fields of a new fact: the boundary value just past a numeric bound, the
+% other boolean, a different string, a set missing a required member or
+% holding an unlisted or excluded one, the opposite polarity of a predicate,
+% or, for a rule over predicates, its head instantiated with the variable
+% names.  Fails when no such fact can be derived (a matches pattern).
+opposing_assumption(FactId, Assumption) :-
+    kb:fact_property_tuple(FactId, Subject, Property, Op, Type, Value, Unit, Scope, Polarity),
+    !,
+    (   Polarity == forbid
+    ->  Op1 = Op, Value1 = Value
+    ;   opposing_value(Type, Op, Value, Op1, Value1)
+    ),
+    Base = _{fact_kind: property_value, subject_key: Subject, property_key: Property,
+             operator: Op1, value_type: Type, value: Value1},
+    (   Unit == '' -> Assumption0 = Base ; Assumption0 = Base.put(unit, Unit) ),
+    (   Scope == '' -> Assumption = Assumption0 ; Assumption = Assumption0.put(scope, Scope) ).
+opposing_assumption(FactId, _{fact_kind: predicate, predicate_namespace: Namespace,
+                              predicate_name: Name, predicate_args: Args, polarity: Opposite}) :-
+    kb:predicate_fact(FactId, Namespace, Name, Args, Polarity),
+    !,
+    kb:opposite_predicate_polarity(Polarity, Opposite).
+opposing_assumption(FactId, _{fact_kind: predicate, predicate_namespace: Namespace,
+                              predicate_name: Name, predicate_args: Args, polarity: assert}) :-
+    stored_rule_fact(FactId, _, rule(_, _, Head, Body, _, _, _, _, _, _)),
+    (   Head = atom(Namespace, Name, Terms, _, _)
+    ->  true
+    ;   sub_term(atom(Namespace, Name, Terms, _, _), Body)
+    ),
+    !,
+    maplist(term_constant, Terms, Args).
+
+term_constant(Term, Constant) :-
+    (   Term = var(Name, _)
+    ->  downcase_atom(Name, Constant)
+    ;   Term = const(Value, _)
+    ->  term_to_atom(Value, Constant)
+    ;   term_to_atom(Term, Constant)
+    ).
+
+opposing_value(bool, eq, Value, eq, Opposite) :-
+    !,
+    (   memberchk(Value, [true, "true", 'True']) -> Opposite = false ; Opposite = true ).
+opposing_value(Type, Op, Value, Op1, Value1) :-
+    kb:is_numeric_type(Type),
+    number(Value),
+    !,
+    opposing_number(Type, Op, Value, Op1, Value1).
+opposing_value(set, Op, Members, Op1, Value1) :-
+    !,
+    opposing_set(Op, Members, Op1, Value1).
+opposing_value(_, eq, Value, neq, Value) :- !.
+opposing_value(_, neq, Value, eq, Value).
+
+opposing_number(_, gt, Bound, eq, Bound).
+opposing_number(_, lt, Bound, eq, Bound).
+opposing_number(int, gte, Bound, eq, Value) :- !, Value is Bound - 1.
+opposing_number(_, gte, Bound, lt, Bound).
+opposing_number(int, lte, Bound, eq, Value) :- !, Value is Bound + 1.
+opposing_number(_, lte, Bound, gt, Bound).
+opposing_number(_, eq, Value, neq, Value).
+opposing_number(_, neq, Value, eq, Value).
+
+opposing_set(eq, Members, eq, Fewer) :- members_but_last(Members, Fewer).
+opposing_set(includes, Members, eq, Fewer) :- members_but_last(Members, Fewer).
+opposing_set(subset_of, _, includes, [unlisted_member]).
+opposing_set(excludes, [First|_], includes, [First]).
+
+members_but_last(Members, Fewer) :-
+    (   append(Fewer, [_], Members) -> true ; Fewer = [] ).
+
+negative_scenario(ScenarioId) :-
+    (   var(ScenarioId)
+    ->  findall(Id,
+            (scenario_expects(Id, Outcome), memberchk(Outcome, [rejection, error])),
+            Ids0),
+        sort(Ids0, Ids),
+        member(ScenarioId, Ids)
+    ;   scenario_expects(ScenarioId, Outcome),
+        memberchk(Outcome, [rejection, error])
+    ).
+
+%% check_scenario_outcome_mismatch(-Violations)
+% implements REQ-kibi-happy-path-gap
+% A scenario that expects rejection or error but whose assumptions current
+% requirements govern and permit together aims at no failure: the knowledge
+% base predicts success for it.  Only a decided feasible outcome is reported;
+% a scenario that assumes nothing, or whose assumptions no requirement
+% governs, is left alone.
+check_scenario_outcome_mismatch(Violations) :-
+    findall(Violation, scenario_outcome_mismatch_violation(Violation), Unsorted),
+    sort(Unsorted, Violations).
+
+scenario_outcome_mismatch_violation(violation(
+    'scenario-outcome-mismatch',
+    ScenarioId,
+    Description,
+    "Assume a value a current requirement forbids, so the scenario exercises that requirement's failure side, or set expects: success when the scenario describes a permitted situation",
+    Source
+)) :-
+    negative_scenario(ScenarioId),
+    scenario_expects(ScenarioId, Expected),
+    scenario_feasibility_analysis(ScenarioId, Analysis),
+    analysis_outcome(Analysis, feasible),
+    findall(FactId, kb_relationship(assumes, ScenarioId, FactId), FactIds0),
+    sort(FactIds0, FactIds),
+    atomic_list_concat(FactIds, ', ', FactText),
+    format(string(Description),
+        "Scenario expects ~w, but current requirements permit everything it assumes (~w), so the knowledge base predicts success",
+        [Expected, FactText]),
+    (   kb_entity(ScenarioId, scenario, Props),
+        memberchk(source=Source, Props)
+    ->  true
+    ;   Source = ""
+    ).
+
 %% check_scenario_feasibility_unknown(-Violations)
 % implements REQ-kibi-scenario-feasibility-v2
 % Advisory: success scenarios whose feasibility the checker cannot decide.
@@ -2526,7 +2765,24 @@ check_domain_contradictions_and_witnesses(Violations, Witnesses) :-
 % Exact, JSON-safe evidence for every strict-property, ground-predicate, and
 % safe-rule contradiction result.  Rule overlap that cannot be proven or
 % disproven remains status=unresolved rather than becoming consistency.
+%
+% kb_check, kb_coverage and the proof context each ask for every witness, so
+% the result is memoized per KB generation, like the entity property memo.
+% Inside an RDF transaction (the what-if staging) it is always recomputed.
 check_domain_contradiction_witnesses(Witnesses) :-
+    (   \+ rdf_db:rdf_active_transaction(_),
+        kb:index_verification_key(domain_contradictions, Key)
+    ->  (   kb:kb_contradiction_witness_memo(Key, Cached)
+        ->  Witnesses = Cached
+        ;   compute_domain_contradiction_witnesses(Computed),
+            retractall(kb:kb_contradiction_witness_memo(_, _)),
+            assertz(kb:kb_contradiction_witness_memo(Key, Computed)),
+            Witnesses = Computed
+        )
+    ;   compute_domain_contradiction_witnesses(Witnesses)
+    ).
+
+compute_domain_contradiction_witnesses(Witnesses) :-
     findall(Witness, req_conflict_witness(_ReqA, _ReqB, Witness), GroundWitnesses),
     functional_predicate_declarations(Functional),
     findall(Witness, rule_contradiction_witness(Functional, Witness), RuleWitnesses),
@@ -2701,22 +2957,42 @@ opposing_rule_requirements(ReqA, ReqB, RuleA, RuleB) :-
 % Each unordered pair of (requirement, rule fact) endpoints is compared once,
 % ordered by the requirement-fact pair: ordering requirements and facts
 % independently would never compare REQ-A->FACT-Z with REQ-Z->FACT-A.
+%
+% Only current requirements with requires_rule links can pair, so the pairs
+% are drawn from that list (in current_req/1 order, each with its rule links
+% in relationship order) rather than from every pair of current
+% requirements; solutions and their order are unchanged.
 opposing_rule_requirement_facts(ReqA, ReqB, FactA, FactB, RuleA, RuleB) :-
-    kb:current_req(ReqA),
-    kb:current_req(ReqB),
+    rule_requirement_links(Links),
+    member(ReqA-RulesA, Links),
+    member(ReqB-RulesB, Links),
     ReqA \== ReqB,
-    kb_relationship(requires_rule, ReqA, FactA),
-    kb_relationship(requires_rule, ReqB, FactB),
+    member(FactA-RuleA, RulesA),
+    member(FactB-RuleB, RulesB),
     FactA \== FactB,
-    ReqA-FactA @< ReqB-FactB,
-    kb_entity(FactA, fact, PropsA),
-    kb_entity(FactB, fact, PropsB),
-    memberchk(fact_kind=KindA, PropsA),
-    memberchk(fact_kind=KindB, PropsB),
-    normalize_term_atom(KindA, rule),
-    normalize_term_atom(KindB, rule),
-    logic_rule_from_props(PropsA, RuleA),
-    logic_rule_from_props(PropsB, RuleB).
+    % mutalog-disable-next-line compare: equal endpoints need ReqA == ReqB, which is excluded above
+    ReqA-FactA @< ReqB-FactB.
+
+% Each requirement's rule facts with their parsed rules, read once rather
+% than once per pair: a link to a fact that is not a rule, or whose rule does
+% not parse, never pairs.
+rule_requirement_links(Links) :-
+    findall(ReqId-Rules,
+            ( kb:current_req(ReqId),
+              findall(FactId-Rule,
+                      ( kb_relationship(requires_rule, ReqId, FactId),
+                        rule_fact_rule(FactId, Rule) ),
+                      Rules),
+              % mutalog-disable-next-line goal_true,literal: a requirement without rules never pairs; this only prunes
+              Rules \== [] ),
+            Links).
+
+rule_fact_rule(FactId, Rule) :-
+    kb_entity(FactId, fact, Props),
+    memberchk(fact_kind=Kind, Props),
+    % mutalog-disable-next-line goal_true: only a rule fact carries a rule body to decode
+    normalize_term_atom(Kind, rule),
+    logic_rule_from_props(Props, Rule).
 
 rule_contradiction_witness(Functional, Witness) :-
     opposing_rule_requirement_facts(ReqA, ReqB, FactA, FactB, RuleA, RuleB),
@@ -3472,7 +3748,7 @@ inventory_entries(Raw, Entries) :-
     (   is_list(Raw) -> Entries = Raw
     ;   Raw = ^^(Value, _) -> inventory_entries(Value, Entries)
     ;   (atom(Raw) ; string(Raw)),
-        catch(atom_json_dict(Raw, JsonEntries, [value_string_as(string)]), _, fail),
+        json_text_term(Raw, JsonEntries),
         is_list(JsonEntries)
     ->  Entries = JsonEntries
     ;   (atom(Raw) ; string(Raw)),
@@ -3653,6 +3929,7 @@ check_selected_dispatch(Rules, _{
     adr_proposed: AdrProposed,
     scenario_feasibility: ScenarioFeasibility,
     scenario_feasibility_unknown: ScenarioFeasibilityUnknown,
+    scenario_outcome_mismatch: ScenarioOutcomeMismatch,
     exception_claim_keys: ExceptionClaimKeys,
     numeric_string_value: NumericStringValues,
     domain_contradictions: Contradictions,
@@ -3690,6 +3967,7 @@ check_selected_dispatch(Rules, _{
     selected_rule(Rules, 'adr-proposed', check_adr_proposed, AdrProposed),
     selected_rule(Rules, 'scenario-feasibility', check_scenario_feasibility, ScenarioFeasibility),
     selected_rule(Rules, 'scenario-feasibility-unknown', check_scenario_feasibility_unknown, ScenarioFeasibilityUnknown),
+    selected_rule(Rules, 'scenario-outcome-mismatch', check_scenario_outcome_mismatch, ScenarioOutcomeMismatch),
     selected_rule(Rules, 'exception-claim-keys', check_exception_claim_keys, ExceptionClaimKeys),
     selected_rule(Rules, 'numeric-string-value', check_numeric_string_values, NumericStringValues),
     selected_rule(Rules, 'domain-contradictions', check_domain_contradictions, Contradictions),
@@ -3748,6 +4026,66 @@ check_all_json_with_options(JsonString, RequireAdr) :-
         JsonString
     ).
 
+%% check_all_json_file(+Path, +RequireAdr)
+% Writes the JSON check_all_json_with_options/2 would answer to Path.
+% The answer itself carries no violations, so a large KB's report is never
+% bounded by the engine's output capacity; the caller reads the file.
+check_all_json_file(Path, RequireAdr) :-
+    check_all_with_options(ViolationsDict, RequireAdr),
+    violations_json_to_file(ViolationsDict, Path).
+
+%% check_selected_json_file(+Rules, +Path)
+% File-transport form of check_selected_json/2.
+check_selected_json_file(Rules, Path) :-
+    check_selected(Rules, ViolationsDict),
+    violations_json_to_file(ViolationsDict, Path).
+
+%% check_all_json_transport(+Path, +RequireAdr, -Transport, -JsonString)
+% Writes the violations JSON to Path (Transport = file, JsonString = ''), or
+% answers it as JsonString (Transport = answer) when Path is `none` or the
+% file cannot be written: a full or read-only temp folder, or an engine that
+% cannot reach the caller's temp folder, must not fail a check that fits in
+% an answer.
+check_all_json_transport(Path, RequireAdr, Transport, JsonString) :-
+    check_all_with_options(ViolationsDict, RequireAdr),
+    violations_json_transport(ViolationsDict, Path, Transport, JsonString).
+
+%% check_selected_json_transport(+Rules, +Path, -Transport, -JsonString)
+% check_all_json_transport/4 for the named rules only.
+check_selected_json_transport(Rules, Path, Transport, JsonString) :-
+    check_selected(Rules, ViolationsDict),
+    violations_json_transport(ViolationsDict, Path, Transport, JsonString).
+
+violations_json_transport(ViolationsDict, Path, Transport, JsonString) :-
+    (   Path \== none,
+        catch(violations_json_to_file(ViolationsDict, Path), Error,
+              (   file_transport_error(Error)
+              ->  fail
+              ;   throw(Error)
+              ))
+    ->  Transport = file,
+        JsonString = ''
+    ;   Transport = answer,
+        violations_dict_to_json(ViolationsDict, JsonDict),
+        with_output_to_string(
+            json_write_dict(current_output, JsonDict, [width(0)]),
+            JsonString
+        )
+    ).
+
+file_transport_error(error(permission_error(_, _, _), _)).
+file_transport_error(error(existence_error(_, _), _)).
+file_transport_error(error(resource_error(_), _)).
+file_transport_error(error(io_error(_, _), _)).
+
+violations_json_to_file(ViolationsDict, Path) :-
+    violations_dict_to_json(ViolationsDict, JsonDict),
+    setup_call_cleanup(
+        open(Path, write, Stream, [encoding(utf8)]),
+        json_write_dict(Stream, JsonDict, [width(0)]),
+        close(Stream)
+    ).
+
 %% check_all_with_options(-ViolationsDict, +RequireAdr)
 % Returns a dict with all violations, respecting options.
 check_all_with_options(ViolationsDict, RequireAdr) :-
@@ -3764,6 +4102,7 @@ check_all_with_options(ViolationsDict, RequireAdr) :-
     check_adr_proposed(AdrProposed),
     check_scenario_feasibility(ScenarioFeasibility),
     check_scenario_feasibility_unknown(ScenarioFeasibilityUnknown),
+    check_scenario_outcome_mismatch(ScenarioOutcomeMismatch),
     check_exception_claim_keys(ExceptionClaimKeys),
     check_numeric_string_values(NumericStringValues),
     check_domain_contradictions(Contradictions),
@@ -3800,6 +4139,7 @@ check_all_with_options(ViolationsDict, RequireAdr) :-
         adr_proposed: AdrProposed,
         scenario_feasibility: ScenarioFeasibility,
         scenario_feasibility_unknown: ScenarioFeasibilityUnknown,
+        scenario_outcome_mismatch: ScenarioOutcomeMismatch,
         exception_claim_keys: ExceptionClaimKeys,
         numeric_string_value: NumericStringValues,
         domain_contradictions: Contradictions,

package/src/claim_obligations.pl

@@ -35,7 +35,10 @@
 %                              has each member as a required (or nullable)
 %                              field; with property middleware every
 %                              selected route's middleware stands in the
-%                              relation
+%                              relation; with property precedes and
+%                              operator includes each member "A -> B"
+%                              holds in the list read: A and B are in it
+%                              and every A comes before every B
 %   set fact under state_machine with operator includes, subset_of or
 %   excludes, or with property reachable_pairs or required_waypoints
 %       state_machine          the projection stands in the operator's
@@ -230,6 +233,14 @@ source_obligation(FactId, Members, Operator, Result) :-
         )
     ;   Property == middleware
     ->  Result = obligation(_{kind: "route_middleware", operator: OperatorString, members: Members})
+    ;   Property == precedes
+    ->  (   Operator == includes
+        ->  Result = obligation(_{kind: "sequence_precedes", members: Members})
+        ;   format(string(Reason),
+                   "~w is a precedes fact with operator ~w; a source proof decides precedes only with includes (each member \"A -> B\" holds)",
+                   [FactId, Operator]),
+            Result = incompatible(Reason)
+        )
     ;   Result = obligation(_{kind: "set_relation", operator: OperatorString, members: Members})
     ).
 
@@ -350,6 +361,10 @@ obligation_key(Obligation, relation(Operator, Members)) :-
     dict_text(Obligation, operator, Operator),
     obligation_members(Obligation, Members),
     !.
+obligation_key(Obligation, precedes(Members)) :-
+    dict_text(Obligation, kind, "sequence_precedes"),
+    obligation_members(Obligation, Members),
+    !.
 obligation_key(Obligation, middleware(Operator, Members)) :-
     dict_text(Obligation, kind, "route_middleware"),
     dict_text(Obligation, operator, Operator),

package/src/code_certificates.pl

@@ -291,6 +291,10 @@ kind_problem(source, Certificate, Reason) :-
     ;   get_dict(routes, Model, Routes),
         \+ ( is_list(Routes), maplist(source_route_ok, Routes) )
     ->  Reason = "every source route must have a method, a path and a middleware list"
+    ;   get_dict(sequence, Model, Sequence),
+        \+ ( is_list(Sequence), forall(member(Item, Sequence), string(Item)),
+              sort(Sequence, Members) )
+    ->  Reason = "the source model's sequence must list the members in the order read"
     ).
 
 sorted_distinct_strings(List) :-