Skip to content

feat(contracts): runtime-checked requires preconditions + counterexample evidence (v1.7.0, Theme A-lite) - #72

Merged
escapeboy merged 1 commit into
masterfrom
feat/contracts-runtime
Jul 15, 2026
Merged

feat(contracts): runtime-checked requires preconditions + counterexample evidence (v1.7.0, Theme A-lite)#72
escapeboy merged 1 commit into
masterfrom
feat/contracts-runtime

Conversation

@escapeboy

Copy link
Copy Markdown
Owner

Sprint 2 / Theme A-lite — agentlanguages.dev competitive-borrow program

Borrowed from Vera/Aver (design-by-contract) and Vow (counterexample = concrete replayable input). No SMT/Z3 — consistent with the 1.5.0 Decided ruling against symbolic model checking; stays in Boruna's concrete-trace + replay philosophy. (User chose this lighter path over full Z3.)

What

  • requires <expr> preconditions compiled to runtime guards at function entry (reusing the previously-dormant Op::Assert — no bytecode bump). Functions without contracts emit no guard.
  • Violation → VmError::ContractViolation { message, counterexample }, where counterexample is the offending arguments (positional, rendered) — the replayable input an auditor needs. Captured in the run's hash-chained audit log (tamper-evident).
  • Stable error_kind contract_violation (retry: no — deterministic in inputs).
  • ensures postconditions deferred (documented).

Gates (local, clippy 1.97)

compiler ✓ · vm ✓ · orchestrator ✓ (new contract + classify tests) · clippy --all-targets --features serve ✓ · fmt ✓.

Release

1.6.0 → 1.7.0 (CHANGELOG, README badge). See docs/design-contracts-runtime.md.

…xample evidence

Sprint 2 / Theme A-lite of the agentlanguages.dev competitive-borrow program.
Borrowed from Vera/Aver (design-by-contract) + Vow (counterexample = concrete
replayable input). NO SMT — consistent with the 1.5.0 'Decided' ruling.

- requires clauses compiled to runtime guards at function entry (reusing the
  dormant Op::Assert; no bytecode bump). Functions without contracts emit none.
- Violation -> VmError::ContractViolation { message, counterexample }, where
  counterexample is the offending args (positional, rendered) -> the replayable
  input an auditor needs. Captured in the hash-chained audit log.
- Stable error_kind 'contract_violation' (retry: no, deterministic in inputs).
- ensures postconditions deferred (documented).
- Version 1.6.0 -> 1.7.0; CHANGELOG, README, ax-language reference,
  docs/design-contracts-runtime.md.
- Tests: codegen emits/omits Assert, VM counterexample capture, satisfied path,
  error classification.
@github-actions

Copy link
Copy Markdown

Bench compare

Threshold for regression: ≥ 10% slower mean.

Benchmark Mean change 99% CI
compile_crud_admin_template -2.51% [-5.64%, +0.58%]
compile_medium_program +0.93% [-0.92%, +2.41%]
compile_small_program +2.49% [+1.15%, +3.88%]
evidence_build_5_steps +21.97% [+12.54%, +31.85%]
evidence_build_empty +16.64% [+8.47%, +25.72%]
evidence_verify_10_steps +113.68% [+88.17%, +138.23%]
evidence_verify_5_steps +70.37% [+42.98%, +98.31%]
vm_call_dispatch_loop/iters=1000 -14.49% [-18.83%, -9.67%]
vm_call_dispatch_loop/iters=10000 -14.17% [-18.50%, -9.53%]
vm_pure_loop/iters=1000 -13.93% [-17.08%, -10.54%]
vm_pure_loop/iters=10000 -14.64% [-17.92%, -11.16%]
vm_pure_loop/iters=100000 +3.83% [+1.61%, +5.91%]
vm_record_loop/iters=1000 +2.21% [-0.65%, +4.90%]
vm_record_loop/iters=10000 +1.43% [-2.17%, +5.03%]

⚠️ 4 benchmark(s) regressed past threshold:

  • evidence_build_5_steps
  • evidence_build_empty
  • evidence_verify_10_steps
  • evidence_verify_5_steps

@escapeboy
escapeboy merged commit e47024b into master Jul 15, 2026
4 of 5 checks passed
@escapeboy
escapeboy deleted the feat/contracts-runtime branch July 15, 2026 19:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant