kibi-core 0.27.0 → 0.28.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kibi-core",
-  "version": "0.27.0",
+  "version": "0.28.0",
   "private": false,
   "description": "Core Prolog modules and RDF graph logic for Kibi",
   "type": "module",

package/schema/entities.pl

@@ -47,6 +47,10 @@ entity_property(req, proof_exempt_reason, string).
 % Only an approved exception makes a success scenario feasible.
 entity_property(req, approved_by, string).
 entity_property(req, approval_ref, string).
+% Why a requirement has no failure side to test (its claims state a
+% capability or output shape), and the human who accepted that.
+entity_property(req, failure_side_waiver, string).
+entity_property(req, failure_side_waiver_approved_by, string).
 % Why the requirement exists, in the words of whoever stated the intent.
 % Explanation only: it is never part of the checked meaning.
 entity_property(req, rationale, string).
@@ -83,6 +87,12 @@ entity_property(fact, valid_to, datetime).
 entity_property(fact, canonical_key, string).
 entity_property(fact, claim_key, string).
 entity_property(fact, claim_text, string).
+% Why a quantifier word in claim_text ranges over nothing, so the claim
+% needs no dimension, and the human who accepted that.
+entity_property(fact, dimension_waiver, string).
+entity_property(fact, dimension_waiver_approved_by, string).
+entity_property(fact, case_waiver, string).
+entity_property(fact, case_waiver_approved_by, string).
 entity_property(fact, predicate_name, string).
 entity_property(fact, predicate_namespace, string).
 entity_property(fact, predicate_arity, integer).
@@ -149,6 +159,8 @@ optional_property(req, semantic_source_hash).
 optional_property(req, semantic_inventory).
 optional_property(req, proof_exempt).
 optional_property(req, proof_exempt_reason).
+optional_property(req, failure_side_waiver).
+optional_property(req, failure_side_waiver_approved_by).
 optional_property(req, approved_by).
 optional_property(req, approval_ref).
 optional_property(req, rationale).

package/src/cases.pl

@@ -0,0 +1,311 @@
+% implements REQ-kibi-case-coverage
+%
+% Edge cases derived from a requirement's typed claims.  A case is never
+% authored: it is computed from a property fact the requirement grounds a
+% claim on, so it cannot drift from the claim.  Each case names a value
+% class of the fact's subject and property (a boundary, a count of zero,
+% one or many, a member of a set, a value outside it), the outcome the
+% claim predicts for it, and a stable id hashed from the claim key, the
+% generator and the constraint.
+%
+% A scenario covers a case when the requirement specifies it, its expects
+% matches the predicted outcome (rejection and error both refuse), and one
+% of its assumes facts on the same subject and property entails the case
+% constraint.  Cases are generated per fact, never across facts, in a
+% deterministic order and capped per fact.
+:- module(cases, [
+    requirement_cases/2,
+    fact_cases/3,
+    case_covering_scenarios/3,
+    case_dict/2,
+    fact_case_waiver/2,
+    case_limit/1
+]).
+
+:- use_module(library(crypto)).
+:- use_module(library(lists)).
+:- use_module(library(apply)).
+:- use_module('kb.pl').
+:- use_module('intervals.pl', [numeric_constraint_entailed/3]).
+
+%% case_limit(-Limit)
+% Most cases one fact yields.  Beyond it the requirement reports
+% caseLimitReached and the rest are left out, in their deterministic order.
+case_limit(12).
+
+% case(Id, ClaimKey, FactId, Subject-Property, Generator, Constraint, Predicted)
+%   Constraint is num(Type, Op, Value) on the property, member(Value),
+%   non_member(Set) or excluded(Value) for a set property.
+%   Predicted is success, rejection or unspecified.
+
+%% requirement_cases(+ReqId, -Cases)
+% Every case of every property fact a current requirement grounds a claim
+% on with requires_property, sorted by claim key, fact and generation order.
+requirement_cases(ReqId, Cases) :-
+    findall(FactId, kb_relationship(requires_property, ReqId, FactId), Facts0),
+    sort(Facts0, Facts),
+    findall(Case,
+        (   member(FactId, Facts),
+            fact_cases(FactId, FactCases, _),
+            member(Case, FactCases)
+        ),
+        Cases).
+
+%% fact_cases(+FactId, -Cases, -LimitReached)
+fact_cases(FactId, Cases, LimitReached) :-
+    kb:fact_property_tuple(FactId, Subject, Property, AuthoredOp, ValueType, Value, _Unit, _Scope, Polarity),
+    claim_key_of(FactId, ClaimKey),
+    effective_operator(Polarity, AuthoredOp, Op),
+    findall(Generator-Constraint-Predicted,
+        fact_case(ValueType, Op, Value, Generator, Constraint, Predicted),
+        Raw0),
+    distinct_constraints(Raw0, Raw),
+    case_limit(Limit),
+    length(Raw, Count),
+    (   Count > Limit
+    ->  length(Kept, Limit),
+        append(Kept, _, Raw),
+        LimitReached = true
+    ;   Kept = Raw,
+        LimitReached = false
+    ),
+    findall(case(Id, ClaimKey, FactId, Subject-Property, Generator, Constraint, Predicted),
+        (   member(Generator-Constraint-Predicted, Kept),
+            case_id(ClaimKey, Generator, Constraint, Id)
+        ),
+        Cases).
+
+claim_key_of(FactId, Key) :-
+    kb_entity(FactId, fact, Props),
+    (   memberchk(claim_key=Raw, Props)
+    ->  normalize_term_atom(Raw, Key)
+    ;   Key = FactId
+    ).
+
+effective_operator(require, Op, Op) :- !.
+effective_operator(forbid, Op, Negated) :- negated_operator(Op, Negated), !.
+effective_operator(_, Op, Op).
+
+negated_operator(eq, neq).
+negated_operator(neq, eq).
+negated_operator(lt, gte).
+negated_operator(gte, lt).
+negated_operator(gt, lte).
+negated_operator(lte, gt).
+negated_operator(includes, excludes).
+negated_operator(excludes, includes).
+
+% Two generators can name the same value class (eq 0 is both the boundary
+% and the zero count), or one class can sit inside another with the same
+% outcome (eq 0 and eq 1 inside lt 8): the first one in generation order
+% keeps it, so each case is a class a scenario must reach on its own.
+distinct_constraints(Raw, Distinct) :-
+    foldl(keep_new_case, Raw, [], Reversed),
+    reverse(Reversed, Distinct).
+
+keep_new_case(_-C-P, Kept, Kept) :-
+    member(_-Earlier-P, Kept),
+    subsumed_constraint(C, Earlier),
+    !.
+keep_new_case(Case, Kept, [Case|Kept]).
+
+subsumed_constraint(C, C) :- !.
+subsumed_constraint(num(Type, Op, Value), num(Type, EarlierOp, EarlierValue)) :-
+    integer_variables(Type, Var, IntVars),
+    numeric_constraint_entailed([c(Op, Var, Value)], c(EarlierOp, Var, EarlierValue), IntVars).
+
+%% fact_case(+ValueType, +Op, +Value, -Generator, -Constraint, -Predicted)
+% Numeric facts: the bound itself and the nearest value past it, then the
+% zero, one and many classes when the property is an integer count.
+fact_case(Type, Op, Value, Generator, num(Type, CaseOp, CaseValue), Predicted) :-
+    numeric_type(Type),
+    number(Value),
+    numeric_case(Type, Op, Value, Generator, CaseOp, CaseValue),
+    numeric_prediction(Type, Op, Value, CaseOp, CaseValue, Predicted).
+% Set facts: each member, then the value class outside the set.
+fact_case(set, Op, Members, member, member(Member), success) :-
+    memberchk(Op, [eq, includes, subset_of]),
+    is_list(Members),
+    member(Member, Members).
+fact_case(set, Op, Members, non_member, non_member(Members), Predicted) :-
+    is_list(Members),
+    non_member_prediction(Op, Predicted).
+fact_case(set, excludes, Members, excluded_member, excluded(Member), rejection) :-
+    is_list(Members),
+    member(Member, Members).
+
+upper_past(eq, gt).
+upper_past(neq, gt).
+upper_past(lte, gt).
+upper_past(lt, gte).
+lower_past(eq, lt).
+lower_past(neq, lt).
+lower_past(gte, lt).
+lower_past(gt, lte).
+
+numeric_type(int).
+numeric_type(number).
+
+non_member_prediction(eq, rejection).
+non_member_prediction(subset_of, rejection).
+non_member_prediction(includes, unspecified).
+
+% The boundary rows of x Op V: the bound itself, and each open side past
+% it (x > V for an upper bound, x < V for a lower one), so any value that
+% breaks the bound lands in the past-the-bound class.
+numeric_case(_, Op, V, boundary, eq, V) :-
+    memberchk(Op, [eq, neq, lte, gte]).
+numeric_case(int, lt, V, boundary, eq, Inside) :- Inside is V - 1.
+numeric_case(int, gt, V, boundary, eq, Inside) :- Inside is V + 1.
+numeric_case(_, Op, V, boundary, PastOp, V) :-
+    upper_past(Op, PastOp).
+numeric_case(Type, Op, V, boundary, PastOp, V) :-
+    lower_past(Op, PastOp),
+    \+ (Type == int, PastOp == lt, V =< 0),
+    \+ (Type == int, PastOp == lte, V < 0).
+% Zero, one and many: the partition a one-item test hides.  It applies to
+% an integer property bounded at one or more; a bound of zero is already
+% split by its boundary rows.
+numeric_case(int, _, V, cardinality, eq, 0) :- V >= 1.
+numeric_case(int, _, V, cardinality, eq, 1) :- V >= 1.
+numeric_case(int, _, V, cardinality, gte, 2) :- V >= 1.
+
+% A case is predicted success when every value it admits satisfies the
+% claim and rejection when none does.  A class that straddles the bound
+% (x >= 2 against x <= 5) is not a case: its values on each side are the
+% boundary rows already.
+numeric_prediction(Type, Op, Value, CaseOp, CaseValue, Predicted) :-
+    integer_variables(Type, Var, IntVars),
+    (   numeric_constraint_entailed([c(CaseOp, Var, CaseValue)], c(Op, Var, Value), IntVars)
+    ->  Predicted = success
+    ;   negated_operator(Op, Negated),
+        numeric_constraint_entailed([c(CaseOp, Var, CaseValue)], c(Negated, Var, Value), IntVars)
+    ->  Predicted = rejection
+    ).
+
+integer_variables(int, Var, [Var]) :- !.
+integer_variables(_, _, []).
+
+case_id(ClaimKey, Generator, Constraint, Id) :-
+    format(string(Text), '~w|~w|~q', [ClaimKey, Generator, Constraint]),
+    crypto_data_hash(Text, Hash, [algorithm(sha256), encoding(utf8)]),
+    sub_atom(Hash, 0, 12, _, Prefix),
+    upcase_atom(Prefix, Upper),
+    atom_concat('CASE-', Upper, Id).
+
+%% case_covering_scenarios(+ScenarioIds, +Case, -Covering)
+% The requirement's scenarios, other than drafts, whose expects matches the
+% case's predicted outcome and whose assumptions on the case's subject and
+% property entail the case constraint.
+case_covering_scenarios(ScenarioIds, case(_, _, _, Key, _, Constraint, Predicted), Covering) :-
+    findall(ScenarioId,
+        (   member(ScenarioId, ScenarioIds),
+            \+ draft_scenario(ScenarioId),
+            scenario_expects(ScenarioId, Expects),
+            outcome_matches(Predicted, Expects),
+            kb_relationship(assumes, ScenarioId, AssumedId),
+            assumption_entails(AssumedId, Key, Constraint)
+        ),
+        Covering0),
+    sort(Covering0, Covering).
+
+draft_scenario(ScenarioId) :-
+    kb_entity(ScenarioId, scenario, Props),
+    memberchk(status=Raw, Props),
+    normalize_term_atom(Raw, draft).
+
+scenario_expects(ScenarioId, Expects) :-
+    kb_entity(ScenarioId, scenario, Props),
+    (   memberchk(expects=Raw, Props)
+    ->  normalize_term_atom(Raw, Expects)
+    ;   Expects = success
+    ).
+
+outcome_matches(success, success).
+outcome_matches(rejection, rejection).
+outcome_matches(rejection, error).
+
+assumption_entails(FactId, Subject-Property, Constraint) :-
+    kb:fact_property_tuple(FactId, Subject, Property, AuthoredOp, ValueType, Value, _, _, Polarity),
+    effective_operator(Polarity, AuthoredOp, Op),
+    constraint_entailed(ValueType, Op, Value, Constraint).
+
+constraint_entailed(Type, Op, Value, num(_, CaseOp, CaseValue)) :-
+    numeric_type(Type),
+    number(Value),
+    integer_variables(Type, Var, IntVars),
+    numeric_constraint_entailed([c(Op, Var, Value)], c(CaseOp, Var, CaseValue), IntVars).
+constraint_entailed(set, Op, Members, member(Member)) :-
+    memberchk(Op, [eq, includes]),
+    memberchk(Member, Members).
+constraint_entailed(set, Op, Members, non_member(Allowed)) :-
+    memberchk(Op, [eq, includes]),
+    member(Member, Members),
+    \+ memberchk(Member, Allowed),
+    !.
+constraint_entailed(set, Op, Members, excluded(Member)) :-
+    memberchk(Op, [eq, includes]),
+    memberchk(Member, Members).
+
+%% case_dict(+Case, -Dict)
+% The case as reported, with the assumption a scenario would state to land
+% in it and the expects it would declare.
+case_dict(case(Id, ClaimKey, FactId, Subject-Property, Generator, Constraint, Predicted), Dict) :-
+    constraint_text(Constraint, Text),
+    constraint_assumption(Subject, Property, Constraint, Assumption),
+    Dict = _{
+        caseId: Id,
+        claimKey: ClaimKey,
+        factId: FactId,
+        subjectKey: Subject,
+        propertyKey: Property,
+        generator: Generator,
+        constraint: Text,
+        predicted: Predicted,
+        assumption: Assumption
+    }.
+
+constraint_assumption(Subject, Property, num(Type, Op, Value), Assumption) :-
+    Assumption = _{fact_kind: property_value, subject_key: Subject, property_key: Property,
+                   operator: Op, value_type: Type, value: Value}.
+constraint_assumption(Subject, Property, member(Member), Assumption) :-
+    Assumption = _{fact_kind: property_value, subject_key: Subject, property_key: Property,
+                   operator: includes, value_type: set, value: [Member]}.
+constraint_assumption(Subject, Property, non_member(_), Assumption) :-
+    Assumption = _{fact_kind: property_value, subject_key: Subject, property_key: Property,
+                   operator: includes, value_type: set, value: ['<a value outside the set>']}.
+constraint_assumption(Subject, Property, excluded(Member), Assumption) :-
+    Assumption = _{fact_kind: property_value, subject_key: Subject, property_key: Property,
+                   operator: includes, value_type: set, value: [Member]}.
+
+%% fact_case_waiver(+FactId, -Waiver)
+% A grounding fact whose cases a person accepted as covered some other way
+% (a unit suite that walks every member, a value class the system cannot
+% produce) records why in case_waiver and who accepted it in
+% case_waiver_approved_by.  Only an approved waiver counts.  Waiver is _{}
+% when none is recorded.
+fact_case_waiver(FactId, Waiver) :-
+    (   kb_entity(FactId, fact, Props),
+        memberchk(case_waiver=RawReason, Props),
+        normalize_term_atom(RawReason, Reason),
+        Reason \== ''
+    ->  atom_string(Reason, ReasonText),
+        (   memberchk(case_waiver_approved_by=RawBy, Props),
+            normalize_term_atom(RawBy, By),
+            By \== ''
+        ->  atom_string(By, ByText),
+            Waiver = _{reason: ReasonText, approvedBy: ByText}
+        ;   Waiver = _{reason: ReasonText}
+        )
+    ;   Waiver = _{}
+    ).
+
+constraint_text(num(_, Op, Value), Text) :-
+    format(string(Text), '~w ~w', [Op, Value]).
+constraint_text(member(Member), Text) :-
+    format(string(Text), 'includes ~w', [Member]).
+constraint_text(non_member(Allowed), Text) :-
+    atomic_list_concat(Allowed, ', ', Joined),
+    format(string(Text), 'includes a value outside [~w]', [Joined]).
+constraint_text(excluded(Member), Text) :-
+    format(string(Text), 'includes ~w', [Member]).

package/src/checks.pl

@@ -26,6 +26,9 @@
     check_adr_proposed/1,
     check_scenario_feasibility/1,
     check_scenario_feasibility_unknown/1,
+    check_scenario_outcome_mismatch/1,
+    negative_scenario_witness/3,
+    opposing_assumption/2,
     check_exception_claim_keys/1,
     check_numeric_string_values/1,
     check_rule_key_arguments_missing/1,
@@ -111,6 +114,7 @@ check_all(ViolationsDict) :-
     check_adr_proposed(AdrProposed),
     check_scenario_feasibility(ScenarioFeasibility),
     check_scenario_feasibility_unknown(ScenarioFeasibilityUnknown),
+    check_scenario_outcome_mismatch(ScenarioOutcomeMismatch),
     check_exception_claim_keys(ExceptionClaimKeys),
     check_numeric_string_values(NumericStringValues),
     check_domain_contradictions(Contradictions),
@@ -148,6 +152,7 @@ check_all(ViolationsDict) :-
         adr_proposed: AdrProposed,
         scenario_feasibility: ScenarioFeasibility,
         scenario_feasibility_unknown: ScenarioFeasibilityUnknown,
+        scenario_outcome_mismatch: ScenarioOutcomeMismatch,
         exception_claim_keys: ExceptionClaimKeys,
         numeric_string_value: NumericStringValues,
         domain_contradictions: Contradictions,
@@ -2132,6 +2137,176 @@ bool_domain_exhausted(bool, Different) :-
     memberchk(true, Different),
     memberchk(false, Different).
 
+%% negative_scenario_witness(?ScenarioId, ?ReqId, -Witness)
+% implements REQ-kibi-happy-path-gap
+% A scenario that expects rejection or error is a targeted negative for a
+% requirement when its assumptions break that requirement: the feasibility
+% analysis finds a witness naming it, or (below) an assumption opposes one of
+% the requirement's claim facts directly.  A rejection scenario whose assumptions
+% the requirements permit, or that an approved exception waives, exercises no
+% requirement's failure side.
+negative_scenario_witness(ScenarioId, ReqId,
+                          infeasibility(ReqIds, AssumedFacts, ReqFacts, Reason)) :-
+    negative_scenario(ScenarioId),
+    scenario_feasibility_analysis(ScenarioId, analysis(Witnesses, _, _, _)),
+    member(infeasibility(ReqIds, AssumedFacts, ReqFacts, Reason), Witnesses),
+    member(ReqId, ReqIds).
+% A scenario the requirement specifies may also target one of its claims
+% directly: it assumes a fact that opposes the claim's fact (a conflicting
+% property value or polarity, the opposite polarity of the same predicate),
+% or, for a rule over predicates, a fact instantiating one of the rule's
+% atoms, so the scenario is about the situation the rule governs.
+negative_scenario_witness(ScenarioId, ReqId, opposed(AssumedFact, ReqFact)) :-
+    negative_scenario(ScenarioId),
+    kb_relationship(specified_by, ReqId, ScenarioId),
+    kb:current_req(ReqId),
+    kb_relationship(assumes, ScenarioId, AssumedFact),
+    member(Link, [requires_property, requires_predicate, requires_rule]),
+    kb_relationship(Link, ReqId, ReqFact),
+    facts_oppose(AssumedFact, ReqFact).
+
+facts_oppose(AssumedFact, ReqFact) :-
+    kb:fact_property_tuple(AssumedFact, Subject, Property, OpA, TypeA, ValueA, UnitA, ScopeA, PolarityA),
+    kb:fact_property_tuple(ReqFact, Subject, Property, OpB, TypeB, ValueB, UnitB, ScopeB, PolarityB),
+    !,
+    kb:scope_intersects(ScopeA, ScopeB),
+    (   kb:polarity_conflict(Subject, Property, OpA, TypeA, ValueA, UnitA, ScopeA, PolarityA,
+                             OpB, TypeB, ValueB, UnitB, ScopeB, PolarityB, _)
+    ->  true
+    ;   PolarityA == PolarityB,
+        kb:property_conflict(Subject, Property, OpA, TypeA, ValueA, UnitA, PolarityA,
+                             OpB, TypeB, ValueB, UnitB, PolarityB, _)
+    ->  true
+    ).
+facts_oppose(AssumedFact, ReqFact) :-
+    kb:predicate_fact(AssumedFact, Namespace, Name, Args, PolarityA),
+    kb:predicate_fact(ReqFact, Namespace, Name, Args, PolarityB),
+    !,
+    PolarityA \== PolarityB.
+facts_oppose(AssumedFact, ReqFact) :-
+    kb:predicate_fact(AssumedFact, Namespace, Name, _, _),
+    stored_rule_fact(ReqFact, _, Rule),
+    sub_term(atom(Namespace, Name, _, _, _), Rule),
+    !.
+
+%% opposing_assumption(+FactId, -Assumption)
+% implements REQ-kibi-happy-path-gap
+% A fact a negative scenario can assume to oppose the claim fact FactId, as
+% the fields of a new fact: the boundary value just past a numeric bound, the
+% other boolean, a different string, a set missing a required member or
+% holding an unlisted or excluded one, the opposite polarity of a predicate,
+% or, for a rule over predicates, its head instantiated with the variable
+% names.  Fails when no such fact can be derived (a matches pattern).
+opposing_assumption(FactId, Assumption) :-
+    kb:fact_property_tuple(FactId, Subject, Property, Op, Type, Value, Unit, Scope, Polarity),
+    !,
+    (   Polarity == forbid
+    ->  Op1 = Op, Value1 = Value
+    ;   opposing_value(Type, Op, Value, Op1, Value1)
+    ),
+    Base = _{fact_kind: property_value, subject_key: Subject, property_key: Property,
+             operator: Op1, value_type: Type, value: Value1},
+    (   Unit == '' -> Assumption0 = Base ; Assumption0 = Base.put(unit, Unit) ),
+    (   Scope == '' -> Assumption = Assumption0 ; Assumption = Assumption0.put(scope, Scope) ).
+opposing_assumption(FactId, _{fact_kind: predicate, predicate_namespace: Namespace,
+                              predicate_name: Name, predicate_args: Args, polarity: Opposite}) :-
+    kb:predicate_fact(FactId, Namespace, Name, Args, Polarity),
+    !,
+    kb:opposite_predicate_polarity(Polarity, Opposite).
+opposing_assumption(FactId, _{fact_kind: predicate, predicate_namespace: Namespace,
+                              predicate_name: Name, predicate_args: Args, polarity: assert}) :-
+    stored_rule_fact(FactId, _, rule(_, _, Head, Body, _, _, _, _, _, _)),
+    (   Head = atom(Namespace, Name, Terms, _, _)
+    ->  true
+    ;   sub_term(atom(Namespace, Name, Terms, _, _), Body)
+    ),
+    !,
+    maplist(term_constant, Terms, Args).
+
+term_constant(Term, Constant) :-
+    (   Term = var(Name, _)
+    ->  downcase_atom(Name, Constant)
+    ;   Term = const(Value, _)
+    ->  term_to_atom(Value, Constant)
+    ;   term_to_atom(Term, Constant)
+    ).
+
+opposing_value(bool, eq, Value, eq, Opposite) :-
+    !,
+    (   memberchk(Value, [true, "true", 'True']) -> Opposite = false ; Opposite = true ).
+opposing_value(Type, Op, Value, Op1, Value1) :-
+    kb:is_numeric_type(Type),
+    number(Value),
+    !,
+    opposing_number(Type, Op, Value, Op1, Value1).
+opposing_value(set, Op, Members, Op1, Value1) :-
+    !,
+    opposing_set(Op, Members, Op1, Value1).
+opposing_value(_, eq, Value, neq, Value) :- !.
+opposing_value(_, neq, Value, eq, Value).
+
+opposing_number(_, gt, Bound, eq, Bound).
+opposing_number(_, lt, Bound, eq, Bound).
+opposing_number(int, gte, Bound, eq, Value) :- !, Value is Bound - 1.
+opposing_number(_, gte, Bound, lt, Bound).
+opposing_number(int, lte, Bound, eq, Value) :- !, Value is Bound + 1.
+opposing_number(_, lte, Bound, gt, Bound).
+opposing_number(_, eq, Value, neq, Value).
+opposing_number(_, neq, Value, eq, Value).
+
+opposing_set(eq, Members, eq, Fewer) :- members_but_last(Members, Fewer).
+opposing_set(includes, Members, eq, Fewer) :- members_but_last(Members, Fewer).
+opposing_set(subset_of, _, includes, [unlisted_member]).
+opposing_set(excludes, [First|_], includes, [First]).
+
+members_but_last(Members, Fewer) :-
+    (   append(Fewer, [_], Members) -> true ; Fewer = [] ).
+
+negative_scenario(ScenarioId) :-
+    (   var(ScenarioId)
+    ->  findall(Id,
+            (scenario_expects(Id, Outcome), memberchk(Outcome, [rejection, error])),
+            Ids0),
+        sort(Ids0, Ids),
+        member(ScenarioId, Ids)
+    ;   scenario_expects(ScenarioId, Outcome),
+        memberchk(Outcome, [rejection, error])
+    ).
+
+%% check_scenario_outcome_mismatch(-Violations)
+% implements REQ-kibi-happy-path-gap
+% A scenario that expects rejection or error but whose assumptions current
+% requirements govern and permit together aims at no failure: the knowledge
+% base predicts success for it.  Only a decided feasible outcome is reported;
+% a scenario that assumes nothing, or whose assumptions no requirement
+% governs, is left alone.
+check_scenario_outcome_mismatch(Violations) :-
+    findall(Violation, scenario_outcome_mismatch_violation(Violation), Unsorted),
+    sort(Unsorted, Violations).
+
+scenario_outcome_mismatch_violation(violation(
+    'scenario-outcome-mismatch',
+    ScenarioId,
+    Description,
+    "Assume a value a current requirement forbids, so the scenario exercises that requirement's failure side, or set expects: success when the scenario describes a permitted situation",
+    Source
+)) :-
+    negative_scenario(ScenarioId),
+    scenario_expects(ScenarioId, Expected),
+    scenario_feasibility_analysis(ScenarioId, Analysis),
+    analysis_outcome(Analysis, feasible),
+    findall(FactId, kb_relationship(assumes, ScenarioId, FactId), FactIds0),
+    sort(FactIds0, FactIds),
+    atomic_list_concat(FactIds, ', ', FactText),
+    format(string(Description),
+        "Scenario expects ~w, but current requirements permit everything it assumes (~w), so the knowledge base predicts success",
+        [Expected, FactText]),
+    (   kb_entity(ScenarioId, scenario, Props),
+        memberchk(source=Source, Props)
+    ->  true
+    ;   Source = ""
+    ).
+
 %% check_scenario_feasibility_unknown(-Violations)
 % implements REQ-kibi-scenario-feasibility-v2
 % Advisory: success scenarios whose feasibility the checker cannot decide.
@@ -3754,6 +3929,7 @@ check_selected_dispatch(Rules, _{
     adr_proposed: AdrProposed,
     scenario_feasibility: ScenarioFeasibility,
     scenario_feasibility_unknown: ScenarioFeasibilityUnknown,
+    scenario_outcome_mismatch: ScenarioOutcomeMismatch,
     exception_claim_keys: ExceptionClaimKeys,
     numeric_string_value: NumericStringValues,
     domain_contradictions: Contradictions,
@@ -3791,6 +3967,7 @@ check_selected_dispatch(Rules, _{
     selected_rule(Rules, 'adr-proposed', check_adr_proposed, AdrProposed),
     selected_rule(Rules, 'scenario-feasibility', check_scenario_feasibility, ScenarioFeasibility),
     selected_rule(Rules, 'scenario-feasibility-unknown', check_scenario_feasibility_unknown, ScenarioFeasibilityUnknown),
+    selected_rule(Rules, 'scenario-outcome-mismatch', check_scenario_outcome_mismatch, ScenarioOutcomeMismatch),
     selected_rule(Rules, 'exception-claim-keys', check_exception_claim_keys, ExceptionClaimKeys),
     selected_rule(Rules, 'numeric-string-value', check_numeric_string_values, NumericStringValues),
     selected_rule(Rules, 'domain-contradictions', check_domain_contradictions, Contradictions),
@@ -3925,6 +4102,7 @@ check_all_with_options(ViolationsDict, RequireAdr) :-
     check_adr_proposed(AdrProposed),
     check_scenario_feasibility(ScenarioFeasibility),
     check_scenario_feasibility_unknown(ScenarioFeasibilityUnknown),
+    check_scenario_outcome_mismatch(ScenarioOutcomeMismatch),
     check_exception_claim_keys(ExceptionClaimKeys),
     check_numeric_string_values(NumericStringValues),
     check_domain_contradictions(Contradictions),
@@ -3961,6 +4139,7 @@ check_all_with_options(ViolationsDict, RequireAdr) :-
         adr_proposed: AdrProposed,
         scenario_feasibility: ScenarioFeasibility,
         scenario_feasibility_unknown: ScenarioFeasibilityUnknown,
+        scenario_outcome_mismatch: ScenarioOutcomeMismatch,
         exception_claim_keys: ExceptionClaimKeys,
         numeric_string_value: NumericStringValues,
         domain_contradictions: Contradictions,

package/src/requirement_proof.pl

@@ -20,6 +20,8 @@
 :- use_module('checks.pl', [
     check_domain_contradictions_and_witnesses/2,
     infeasible_scenario/5,
+    negative_scenario_witness/3,
+    opposing_assumption/2,
     scenario_feasibility_outcome/2,
     check_rule_safety/1,
     check_rule_verifiability/1
@@ -28,6 +30,7 @@
 :- use_module('code_certificates.pl', [code_certificate_check/2, code_certificate_digest/2]).
 :- use_module('claim_obligations.pl', [claim_obligation/3, obligation_equal/2]).
 :- use_module('model_check.pl', [model_check_obligation/4]).
+:- use_module('cases.pl', [fact_cases/3, case_covering_scenarios/3, case_dict/2, fact_case_waiver/2]).
 
 proof_version('kibi.requirement-proof.v5').
 
@@ -155,12 +158,18 @@ compute_requirement_proof(ReqId, ReqProps, Context, Proof) :-
                                       PassingE2eStage.receiptEvidence, Context,
                                       ProductionStage, ProductionSymbols),
     source_coordinate_stage(ReqProps, ExecutableSymbols, ProductionSymbols, CoordinateStage),
+    negative_path_stage(ReqId, ScenarioStage, ScenarioTestStage, Context, NegativePathStage),
+    dimension_stage(ReqId, ScenarioTestStage, Context, DimensionStage),
+    cases_stage(ReqId, ScenarioStage, ScenarioTestStage, Context, CasesStage),
     Stages = _{
         semanticInventory: SemanticStage,
         logicGrounding: LogicStage,
         contradictions: ContradictionStage,
         scenarios: ScenarioStage,
         scenarioTests: ScenarioTestStage,
+        negativePath: NegativePathStage,
+        dimension: DimensionStage,
+        cases: CasesStage,
         passingE2e: PassingE2eStage,
         executableSymbols: ExecutableStage,
         productionSymbols: ProductionStage,
@@ -688,6 +697,12 @@ scenario_stage(ReqId, Stage, ScenarioIds) :-
             unknown_feasibility_reason(Reason, ReasonText)
         ),
         UnknownFeasibility),
+    % implements REQ-kibi-happy-path-gap
+    % The linked scenarios that exercise this requirement's failure side: they
+    % expect rejection or error and assume a value it forbids.
+    findall(ScenarioId,
+        (member(ScenarioId, ScenarioIds), once(negative_scenario_witness(ScenarioId, ReqId, _))),
+        NegativeScenarios),
     (   (ScenarioIds = [] ; InvalidScenarioTargets \= [])
     ->  Status = missing
     ;   InfeasibleScenarios \= []
@@ -702,6 +717,7 @@ scenario_stage(ReqId, Stage, ScenarioIds) :-
         invalidScenarioTargets: InvalidScenarioTargets,
         infeasibleScenarios: InfeasibleScenarios,
         unknownFeasibility: UnknownFeasibility,
+        negativeScenarios: NegativeScenarios,
         sources: Sources
     }.
 
@@ -716,6 +732,376 @@ unknown_feasibility_reason(undetermined_validity(_), undetermined_validity).
 existing_scenario(ScenarioId) :-
     kb_entity(ScenarioId, scenario, _).
 
+%% negative_path_stage(+ReqId, +ScenarioStage, +ScenarioTestStage, +Context, -Stage)
+% implements REQ-kibi-happy-path-gap
+% A requirement is not tested while only its happy path is: when it grounds
+% a claim (a property value, predicate or rule), at least one linked
+% scenario must expect rejection or error and assume a value or situation
+% the requirement forbids.  Claims a fresh certificate proves at code scope
+% decide their failure side already and need none.  Status is not_required
+% (no such claim, or all certified), passed, waived (an approved
+% failure_side_waiver) or missing.
+negative_path_stage(ReqId, ScenarioStage, ScenarioTestStage, Context, Stage) :-
+    findall(Key-FactId,
+        (   negative_path_link(Link),
+            kb_relationship(Link, ReqId, FactId),
+            fact_claim_key_or_id(FactId, Key)
+        ),
+        ClaimFacts0),
+    sort(ClaimFacts0, ClaimFacts),
+    certified_claim_keys(ReqId, ScenarioTestStage, Context, Certified),
+    exclude(certified_claim(Certified), ClaimFacts, OpenFacts),
+    pairs_keys(OpenFacts, Open0),
+    sort(Open0, Open),
+    pending_certified_claim_keys(ScenarioTestStage, Context, Open, Pending),
+    (   get_dict(negativeScenarios, ScenarioStage, Negatives) -> true ; Negatives = [] ),
+    failure_side_waiver(ReqId, Waiver),
+    (   Open == []
+    ->  Status = not_required
+    ;   Negatives \== []
+    ->  Status = passed
+    ;   get_dict(approvedBy, Waiver, _)
+    ->  Status = waived
+    ;   Status = missing
+    ),
+    (   Status == missing
+    ->  findall(_{claimKey: Key, factId: FactId, assumption: Assumption, expects: rejection},
+            (member(Key-FactId, OpenFacts), once(opposing_assumption(FactId, Assumption))),
+            Suggestions)
+    ;   Suggestions = []
+    ),
+    Stage = _{
+        status: Status,
+        claims: Open,
+        certifiedClaims: Certified,
+        negativeScenarios: Negatives,
+        suggestedNegatives: Suggestions,
+        pendingReproofClaims: Pending,
+        waiver: Waiver
+    }.
+
+% Open claims a certificate test proves (its contract lists them in proves)
+% whose receipt is only older than the code: re-running kibi prove certifies
+% them, so the evidence floor treats them like any other stale receipt.
+pending_certified_claim_keys(ScenarioTestStage, Context, Open, Keys) :-
+    (   get_dict(tests, ScenarioTestStage, Tests) -> true ; Tests = [] ),
+    findall(Key,
+        (   member(TestId, Tests),
+            test_receipt_evidence(Context, [unit, integration, end_to_end], TestId, Evidence),
+            get_dict(state, Evidence, stale),
+            kb_entity(TestId, test, Props),
+            memberchk(proof_contract=RawContract, Props),
+            proof_contract_dict(RawContract, Contract),
+            get_dict(proves, Contract, Proves),
+            is_list(Proves),
+            member(RawKey, Proves),
+            normalize_atom(RawKey, Key),
+            memberchk(Key, Open)
+        ),
+        Keys0),
+    sort(Keys0, Keys).
+
+%% failure_side_waiver(+ReqId, -Waiver)
+% A requirement whose claims state a capability or an output shape has no
+% input to refuse, so its failure side can be waived: failure_side_waiver
+% gives the reason and failure_side_waiver_approved_by names the human who
+% accepted it.  Only an approved waiver satisfies the stage; a reason alone
+% is reported as pending approval.  Waiver is _{} when none is recorded.
+failure_side_waiver(ReqId, Waiver) :-
+    (   kb_entity(ReqId, req, Props),
+        memberchk(failure_side_waiver=RawReason, Props),
+        normalize_atom(RawReason, Reason),
+        Reason \== ''
+    ->  atom_string(Reason, ReasonText),
+        (   memberchk(failure_side_waiver_approved_by=RawBy, Props),
+            normalize_atom(RawBy, By),
+            By \== ''
+        ->  atom_string(By, ByText),
+            Waiver = _{reason: ReasonText, approvedBy: ByText}
+        ;   Waiver = _{reason: ReasonText}
+        )
+    ;   Waiver = _{}
+    ).
+
+certified_claim(Certified, Key-_) :- memberchk(Key, Certified).
+
+%% cases_stage(+ReqId, +ScenarioStage, +ScenarioTestStage, +Context, -Stage)
+% implements REQ-kibi-case-coverage
+% Edge cases derived from the requirement's typed property claims
+% (cases.pl): the bound and the value past it, zero, one and many for a
+% count, each member of a set and a value outside it.  A case is covered
+% when a linked scenario, other than a draft, assumes a value in its class
+% and expects the outcome the claim predicts.  Every case whose predicted
+% outcome is rejection must be covered: that is where a test of the one
+% case that works hides the case that breaks.  Uncovered success cases and
+% cases no claim decides (unspecified) are reported, not blocking.  Claims
+% a fresh certificate proves at code scope are decided already.  A grounding
+% fact can carry a case_waiver with case_waiver_approved_by.  Status is
+% not_required (no rejection case), passed, waived (every uncovered
+% rejection case is on a fact with an approved waiver) or missing.
+cases_stage(ReqId, ScenarioStage, ScenarioTestStage, Context, Stage) :-
+    findall(FactId, kb_relationship(requires_property, ReqId, FactId), Facts0),
+    sort(Facts0, Facts),
+    certified_claim_keys(ReqId, ScenarioTestStage, Context, Certified),
+    (   get_dict(scenarios, ScenarioStage, ScenarioIds) -> true ; ScenarioIds = [] ),
+    foldl(fact_case_rows(Certified, ScenarioIds), Facts, rows([], false), rows(Rows0, LimitReached)),
+    reverse(Rows0, Rows),
+    include(case_row_blocking, Rows, Blocking),
+    partition(case_row_waived, Blocking, WaivedRows, OpenRows),
+    findall(Key, (member(Row, OpenRows), get_dict(claimKey, Row, Key)), OpenKeys0),
+    sort(OpenKeys0, OpenKeys),
+    pending_certified_claim_keys(ScenarioTestStage, Context, OpenKeys, Pending),
+    case_summary(Rows, Summary),
+    (   \+ (member(Row, Rows), get_dict(predicted, Row, rejection))
+    ->  Status = not_required
+    ;   OpenRows == [],
+        WaivedRows == []
+    ->  Status = passed
+    ;   OpenRows == []
+    ->  Status = waived
+    ;   Status = missing
+    ),
+    Stage = _{
+        status: Status,
+        cases: Rows,
+        uncoveredCases: OpenRows,
+        waivedCases: WaivedRows,
+        summary: Summary,
+        limitReached: LimitReached,
+        pendingReproofClaims: Pending
+    }.
+
+fact_case_rows(Certified, ScenarioIds, FactId, rows(Acc0, Limit0), rows(Acc, Limit)) :-
+    (   fact_cases(FactId, Cases, FactLimit),
+        Cases = [case(_, ClaimKey, _, _, _, _, _)|_],
+        \+ memberchk(ClaimKey, Certified)
+    ->  fact_case_waiver(FactId, Waiver),
+        foldl(case_row(ScenarioIds, Waiver), Cases, Acc0, Acc),
+        (   FactLimit == true -> Limit = true ; Limit = Limit0 )
+    ;   Acc = Acc0,
+        Limit = Limit0
+    ).
+
+case_row(ScenarioIds, Waiver, Case, Acc, [Row|Acc]) :-
+    case_dict(Case, Dict),
+    case_covering_scenarios(ScenarioIds, Case, Covering),
+    (   Covering \== []
+    ->  Coverage = covered
+    ;   get_dict(predicted, Dict, unspecified)
+    ->  Coverage = unspecified
+    ;   get_dict(approvedBy, Waiver, _)
+    ->  Coverage = waived
+    ;   Coverage = uncovered
+    ),
+    Row0 = Dict.put(_{coverage: Coverage, scenarios: Covering}),
+    (   Waiver == _{} -> Row = Row0 ; Row = Row0.put(waiver, Waiver) ).
+
+% A rejection case blocks until a scenario covers it or its fact's waiver
+% is approved.
+case_row_blocking(Row) :-
+    get_dict(predicted, Row, rejection),
+    get_dict(coverage, Row, Coverage),
+    memberchk(Coverage, [uncovered, waived]).
+
+case_row_waived(Row) :- get_dict(coverage, Row, waived).
+
+case_summary(Rows, _{generated: Generated, covered: Covered, uncovered: Uncovered,
+                     unspecified: Unspecified, waived: Waived}) :-
+    length(Rows, Generated),
+    coverage_count(Rows, covered, Covered),
+    coverage_count(Rows, uncovered, Uncovered),
+    coverage_count(Rows, unspecified, Unspecified),
+    coverage_count(Rows, waived, Waived).
+
+coverage_count(Rows, Coverage, Count) :-
+    aggregate_all(count, (member(Row, Rows), get_dict(coverage, Row, Coverage)), Count).
+
+%% dimension_stage(+ReqId, +ScenarioTestStage, +Context, -Stage)
+% implements REQ-kibi-dimension-gap
+% A claim that quantifies over a collection (each, every, all) or bounds a
+% cardinality (at least, at most, exactly, no more than) must be grounded on what
+% varies: a count or bound, a set, a rule over a variable or a state
+% machine.  A claim whose grounding facts are all booleans or ground
+% predicates states the verdict, not the dimension, so a scenario with one
+% file can pass where many files break.  Claims a fresh certificate proves
+% at code scope are decided already.  A grounding fact can carry a
+% dimension_waiver reason and a dimension_waiver_approved_by human for a
+% quantifier word that does not range over anything ("without any network
+% access").  Only, any and some are left out: they mostly scope a
+% condition ("only when", "before any write") rather than range over one.  Status is not_required (no such claim), waived (each one has an
+% approved waiver) or missing.
+dimension_stage(ReqId, ScenarioTestStage, Context, Stage) :-
+    findall(Key-FactId,
+        (   negative_path_link(Link),
+            kb_relationship(Link, ReqId, FactId),
+            fact_claim_key_or_id(FactId, Key)
+        ),
+        ClaimFacts0),
+    sort(ClaimFacts0, ClaimFacts),
+    pairs_keys(ClaimFacts, Keys0),
+    sort(Keys0, Keys),
+    certified_claim_keys(ReqId, ScenarioTestStage, Context, Certified),
+    findall(Claim,
+        (   member(Key, Keys),
+            \+ memberchk(Key, Certified),
+            findall(FactId, member(Key-FactId, ClaimFacts), FactIds),
+            unrepresented_quantified_claim(Key, FactIds, Claim)
+        ),
+        Claims),
+    partition(approved_dimension_waiver, Claims, Waived, Open),
+    findall(Key, (member(Claim, Open), get_dict(claimKey, Claim, Key)), OpenKeys),
+    pending_certified_claim_keys(ScenarioTestStage, Context, OpenKeys, Pending),
+    (   Claims == []
+    ->  Status = not_required
+    ;   Open == []
+    ->  Status = waived
+    ;   Status = missing
+    ),
+    Stage = _{
+        status: Status,
+        claims: Open,
+        waivedClaims: Waived,
+        pendingReproofClaims: Pending
+    }.
+
+% A claim whose text quantifies and whose every grounding fact is a boolean
+% property value or a ground predicate.
+unrepresented_quantified_claim(Key, FactIds, Claim) :-
+    FactIds = [_|_],
+    forall(member(FactId, FactIds), dimensionless_fact(FactId)),
+    claim_text_of(FactIds, Text),
+    claim_quantifier(Text, Quantifier),
+    !,
+    quantifier_rewrites(Quantifier, Rewrites),
+    dimension_waiver(FactIds, Waiver),
+    atom_string(Quantifier, QuantifierText),
+    Claim = _{
+        claimKey: Key,
+        claimText: Text,
+        quantifier: QuantifierText,
+        factIds: FactIds,
+        rewrites: Rewrites,
+        waiver: Waiver
+    }.
+
+dimensionless_fact(FactId) :-
+    kb_entity(FactId, fact, Props),
+    memberchk(fact_kind=RawKind, Props),
+    normalize_atom(RawKind, Kind),
+    (   Kind == predicate
+    ->  true
+    ;   Kind == property_value,
+        memberchk(value_type=RawType, Props),
+        normalize_atom(RawType, bool)
+    ).
+
+claim_text_of(FactIds, Text) :-
+    member(FactId, FactIds),
+    kb_entity(FactId, fact, Props),
+    memberchk(claim_text=Raw, Props),
+    normalize_atom(Raw, Atom),
+    Atom \== '',
+    !,
+    atom_string(Atom, Text).
+claim_text_of(FactIds, Text) :-
+    member(FactId, FactIds),
+    kb_entity(FactId, fact, Props),
+    memberchk(title=Raw, Props),
+    !,
+    normalize_atom(Raw, Atom),
+    atom_string(Atom, Text).
+
+%% claim_quantifier(+Text, -Quantifier)
+% The first quantifier over a collection (each, every, all) or cardinality
+% bound (exactly, at least, at most, no more than) in Text.
+claim_quantifier(Text, Quantifier) :-
+    string_lower(Text, Lower),
+    split_string(Lower, " \t\n\r.,;:()[]\"'`/!?-", " \t\n\r.,;:()[]\"'`/!?-", Words0),
+    exclude(==(""), Words0, Words),
+    quantifier_in(Words, Quantifier).
+
+quantifier_in(["no", "more", "than"|_], no_more_than) :- !.
+quantifier_in(["at", "least"|_], at_least) :- !.
+quantifier_in(["at", "most"|_], at_most) :- !.
+quantifier_in([Word|_], Quantifier) :-
+    memberchk(Word, ["each", "every", "all", "exactly"]),
+    !,
+    atom_string(Quantifier, Word).
+quantifier_in([_|Rest], Quantifier) :-
+    quantifier_in(Rest, Quantifier).
+
+% The typed groundings that represent what a quantifier ranges over, most
+% likely first.
+quantifier_rewrites(Quantifier, ["bound"]) :-
+    memberchk(Quantifier, [at_least, at_most, exactly, no_more_than]),
+    !.
+quantifier_rewrites(_, ["rule", "count", "set"]).
+
+%% dimension_waiver(+FactIds, -Waiver)
+% A grounding fact's dimension_waiver reason and the human who approved it
+% in dimension_waiver_approved_by.  An approved waiver on any grounding fact
+% wins; otherwise a reason alone is reported as pending approval.  Waiver is
+% _{} when none is recorded.
+dimension_waiver(FactIds, Waiver) :-
+    findall(W, (member(FactId, FactIds), fact_dimension_waiver(FactId, W)), Waivers),
+    (   member(W, Waivers), get_dict(approvedBy, W, _)
+    ->  Waiver = W
+    ;   Waivers = [W|_]
+    ->  Waiver = W
+    ;   Waiver = _{}
+    ).
+
+fact_dimension_waiver(FactId, Waiver) :-
+    kb_entity(FactId, fact, Props),
+    memberchk(dimension_waiver=RawReason, Props),
+    normalize_atom(RawReason, Reason),
+    Reason \== '',
+    atom_string(Reason, ReasonText),
+    (   memberchk(dimension_waiver_approved_by=RawBy, Props),
+        normalize_atom(RawBy, By),
+        By \== ''
+    ->  atom_string(By, ByText),
+        Waiver = _{reason: ReasonText, approvedBy: ByText}
+    ;   Waiver = _{reason: ReasonText}
+    ).
+
+approved_dimension_waiver(Claim) :-
+    get_dict(approvedBy, Claim.waiver, _).
+
+negative_path_link(requires_property).
+negative_path_link(requires_predicate).
+negative_path_link(requires_rule).
+
+fact_claim_key_or_id(FactId, Key) :-
+    (   kb_entity(FactId, fact, Props),
+        memberchk(claim_key=Raw, Props),
+        normalize_atom(Raw, Key0),
+        Key0 \== ''
+    ->  Key = Key0
+    ;   Key = FactId
+    ).
+
+% Claims of ReqId a passed receipt binds with a derived obligation outside
+% intent scope: a certificate decides them, both sides.
+certified_claim_keys(ReqId, ScenarioTestStage, Context, Keys) :-
+    (   get_dict(tests, ScenarioTestStage, Tests) -> true ; Tests = [] ),
+    findall(Key,
+        (   member(TestId, Tests),
+            test_receipt_evidence(Context, [unit, integration, end_to_end], TestId, Evidence),
+            get_dict(state, Evidence, passed),
+            get_dict(claimBindings, Evidence, Recorded),
+            member(Entry, Recorded),
+            inventory_entry_field(Entry, requirement_id, RawReq),
+            normalize_atom(RawReq, ReqId),
+            inventory_entry_field(Entry, claim_key, RawKey),
+            normalize_atom(RawKey, Key),
+            test_claim_binding(ReqId, Key, [TestId-Evidence], Binding),
+            get_dict(binding, Binding, derived),
+            \+ get_dict(scope, Binding, intent)
+        ),
+        Keys0),
+    sort(Keys0, Keys).
+
 scenario_test_stage(ScenarioIds, Stage, ScenarioTests) :-
     maplist(scenario_test_obligation, ScenarioIds, Obligations),
     findall(TestId,
@@ -2280,14 +2666,58 @@ freshness_gap(stale_proof_receipt).
 freshness_gap(proof_contract_mismatch).
 
 freshness_only_gaps(Gaps, Stages) :-
-    include(freshness_gap, Gaps, [_|_]),
-    exclude(freshness_gap, Gaps, Rest),
+    % A stale certificate receipt of a unit-scope test is not a gap of its
+    % own, so a stage that waits only on one counts as the freshness gap.
+    (   include(freshness_gap, Gaps, [_|_])
+    ->  true
+    ;   negative_path_freshness_only(Stages)
+    ;   dimension_freshness_only(Stages)
+    ;   cases_freshness_only(Stages)
+    ),
+    exclude(freshness_gap, Gaps, Rest0),
+    (   negative_path_freshness_only(Stages)
+    ->  exclude(==(happy_path_only), Rest0, Rest1)
+    ;   Rest1 = Rest0
+    ),
+    (   dimension_freshness_only(Stages)
+    ->  exclude(==(dimension_unrepresented), Rest1, Rest2)
+    ;   Rest2 = Rest1
+    ),
+    (   cases_freshness_only(Stages)
+    ->  exclude(==(uncovered_case), Rest2, Rest)
+    ;   Rest = Rest2
+    ),
     (   Rest == []
     ->  true
     ;   Rest == [missing_production_symbol_coverage],
         production_coverage_freshness_only(Stages)
     ).
 
+% The failure side is open only because certificate receipts that prove
+% every open claim are stale.
+negative_path_freshness_only(Stages) :-
+    get_dict(negativePath, Stages, Stage),
+    Stage.status == missing,
+    Stage.claims \== [],
+    subtract(Stage.claims, Stage.pendingReproofClaims, []).
+
+% Every open quantified claim waits only on a stale certificate receipt.
+dimension_freshness_only(Stages) :-
+    get_dict(dimension, Stages, Stage),
+    Stage.status == missing,
+    findall(Key, (member(Claim, Stage.claims), get_dict(claimKey, Claim, Key)), Keys),
+    Keys \== [],
+    subtract(Keys, Stage.pendingReproofClaims, []).
+
+% Every uncovered rejection case waits only on a stale certificate receipt.
+cases_freshness_only(Stages) :-
+    get_dict(cases, Stages, Stage),
+    Stage.status == missing,
+    findall(Key, (member(Row, Stage.uncoveredCases), get_dict(claimKey, Row, Key)), Keys0),
+    sort(Keys0, Keys),
+    Keys \== [],
+    subtract(Keys, Stage.pendingReproofClaims, []).
+
 production_coverage_freshness_only(Stages) :-
     Stage = Stages.productionSymbols,
     forall(member(SymbolId, Stage.uncoveredSymbols),
@@ -2351,12 +2781,16 @@ prop_text(Props, Key, Text) :-
     normalize_atom(Raw, Text),
     Text \== ''.
 
+% The origin is JSON text, read whole: normalize_atom/2 keeps only what
+% follows the last "/", which cut an origin.ref quoting a URL down to a
+% fragment of the JSON.
 origin_field(Props, Key, Value) :-
     memberchk(origin=Raw, Props),
-    normalize_atom(Raw, Json),
+    kb:source_value_atom(Raw, Json),
     catch(atom_json_dict(Json, Origin, [value_string_as(atom)]), _, fail),
+    is_dict(Origin),
     get_dict(Key, Origin, Value0),
-    normalize_atom(Value0, Value),
+    kb:source_value_atom(Value0, Value),
     Value \== ''.
 
 stage_dict(Stages, Stage) :-
@@ -2413,6 +2847,9 @@ proof_gap_present(infeasible_scenario, Stages) :- Stages.scenarios.infeasibleSce
 proof_gap_present(unknown_scenario_feasibility, Stages) :-
     get_dict(unknownFeasibility, Stages.scenarios, Unknown),
     Unknown \= [].
+proof_gap_present(happy_path_only, Stages) :- Stages.negativePath.status == missing.
+proof_gap_present(dimension_unrepresented, Stages) :- Stages.dimension.status == missing.
+proof_gap_present(uncovered_case, Stages) :- Stages.cases.status == missing.
 proof_gap_present(missing_scenario_test, Stages) :- memberchk(Stages.scenarios.status, [passed, blocked]), Stages.scenarioTests.status == missing.
 proof_gap_present(missing_passing_e2e, Stages) :- Stages.passingE2e.status == missing.
 proof_gap_present(missing_proof_receipt, Stages) :- Stages.passingE2e.missingReceiptTests \= [].
@@ -2442,6 +2879,9 @@ gap_definition(contradiction_check_incomplete, 41, contradictions, "Complete log
 gap_definition(unknown_scenario_feasibility, 49, scenarios, "Link the property values the success scenario relies on with assumes facts that a current requirement constrains, so its feasibility can be decided.").
 gap_definition(missing_scenario, 50, scenarios, "Add a specified_by scenario for the requirement.").
 gap_definition(infeasible_scenario, 49, scenarios, "Set expects: rejection on the scenario, correct its assumes fact, or record a human-approved exception requirement that exempts the forbidding requirement.").
+gap_definition(dimension_unrepresented, 47, dimension, "Ground the quantified claim on what varies: an integer count or bound, a set of members, a rule over a variable, or a state machine. If the quantifier word ranges over nothing, record a dimension_waiver on the grounding fact for a person to approve, and record their approval in the same pull request.").
+gap_definition(uncovered_case, 46, cases, "Cover each rejection case: add a scenario that assumes a value in the case's class (the case's assumption), expects rejection or error, is linked with specified_by and is verified by a passing end-to-end test. If a person accepts the cases as covered another way, record a case_waiver on the grounding fact for them to approve, and record their approval in the same pull request.").
+gap_definition(happy_path_only, 48, negative_path, "Add a scenario that expects rejection or error and assumes a value this requirement forbids, link it with specified_by, and verify it with a passing end-to-end test.").
 gap_definition(missing_scenario_test, 51, scenario_tests, "Link the scenario to a test with verified_by or validates.").
 gap_definition(missing_passing_e2e, 52, passing_e2e, "Record fresh passing end-to-end evidence on a scenario-backed test.").
 gap_definition(missing_proof_receipt, 53, passing_e2e, "Run the configured proof integration through kibi prove and append its kibi.proof-receipt.v1 result for the scenario-backed proof-bearing test.").

package/src/rule_registry.pl

@@ -28,6 +28,7 @@ known_rule('deprecated-adr-no-successor').
 known_rule('superseded-requirement-open').
 known_rule('scenario-feasibility').
 known_rule('scenario-feasibility-unknown').
+known_rule('scenario-outcome-mismatch').
 known_rule('exception-claim-keys').
 known_rule('numeric-string-value').
 known_rule('rule-key-arguments-missing').
@@ -86,6 +87,7 @@ rule_enforcement_class('deprecated-adr-no-successor', canonical).
 rule_enforcement_class('superseded-requirement-open', canonical).
 rule_enforcement_class('scenario-feasibility', canonical).
 rule_enforcement_class('scenario-feasibility-unknown', advisory).
+rule_enforcement_class('scenario-outcome-mismatch', canonical).
 rule_enforcement_class('exception-claim-keys', canonical).
 rule_enforcement_class('numeric-string-value', advisory).
 rule_enforcement_class('rule-key-arguments-missing', advisory).
@@ -144,6 +146,7 @@ rule_implementation('deprecated-adr-no-successor', prolog).
 rule_implementation('superseded-requirement-open', prolog).
 rule_implementation('scenario-feasibility', prolog).
 rule_implementation('scenario-feasibility-unknown', prolog).
+rule_implementation('scenario-outcome-mismatch', prolog).
 rule_implementation('exception-claim-keys', prolog).
 rule_implementation('numeric-string-value', prolog).
 rule_implementation('rule-key-arguments-missing', prolog).
@@ -198,6 +201,7 @@ rule_predicate('deprecated-adr-no-successor', check_deprecated_adrs).
 rule_predicate('superseded-requirement-open', check_superseded_requirement_open).
 rule_predicate('scenario-feasibility', check_scenario_feasibility).
 rule_predicate('scenario-feasibility-unknown', check_scenario_feasibility_unknown).
+rule_predicate('scenario-outcome-mismatch', check_scenario_outcome_mismatch).
 rule_predicate('exception-claim-keys', check_exception_claim_keys).
 rule_predicate('numeric-string-value', check_numeric_string_values).
 rule_predicate('rule-key-arguments-missing', check_rule_key_arguments_missing).
@@ -235,6 +239,7 @@ rule_predicate_arity('deprecated-adr-no-successor', 1).
 rule_predicate_arity('superseded-requirement-open', 1).
 rule_predicate_arity('scenario-feasibility', 1).
 rule_predicate_arity('scenario-feasibility-unknown', 1).
+rule_predicate_arity('scenario-outcome-mismatch', 1).
 rule_predicate_arity('exception-claim-keys', 1).
 rule_predicate_arity('numeric-string-value', 1).
 rule_predicate_arity('rule-key-arguments-missing', 1).
@@ -276,6 +281,7 @@ rule_description('deprecated-adr-no-successor', 'Deprecated ADRs must have a suc
 rule_description('superseded-requirement-open', 'A requirement that another requirement supersedes must have status closed, and supersedes links between requirements must not form a cycle').
 rule_description('scenario-feasibility', 'A scenario that expects success must not assume property values that cannot hold, alone or together, with what current requirements require through typed property values or rules, unless an approved exception requirement waives that requirement or the listed clauses').
 rule_description('scenario-feasibility-unknown', 'Advisory: a scenario that expects success assumes nothing, assumes values that contradict each other, assumes a property value no governing requirement constrains comparably (type, unit or operator mismatch, or conflicting requirements), leaves a governing rule\'s conditions undecided, or conflicts only with constraints whose validity window may not cover it, so its feasibility cannot be decided').
+rule_description('scenario-outcome-mismatch', 'A scenario that expects rejection or error must assume a value or situation a current requirement forbids: when every assumption is governed by current requirements and they permit all of them together, the knowledge base predicts success and the scenario exercises no failure side').
 rule_description('exception-claim-keys', 'An exception requirement\'s exempts_claims must name claim keys of a requirement it exempts, and requires an exempts link').
 rule_description('numeric-string-value', 'Advisory: a property value stores a numeric-looking string where the comparison is numeric (ordering operator, or an int/number fact on the same property); the finding names the fact and the typed value, without converting it').
 rule_description('rule-key-arguments-missing', 'Advisory: an opposing rule pair stays unresolved only because a body predicate declares no key_arguments; the finding names the predicate and the key positions that would decide the pair').