Assume contract consistency

The check is assume_contract_consistency. It is implement-stage. Severity of a missing or mismatched callee lemma is warning, not fail. The inspect command is the same audit, plus proof workflow check --stage implement --verbose.

A lemma on the host uses // reqproof:assume to bridge a cross-package or opaque-type call. The assume declares a contract: what the callee guarantees. The callee's lemma is supposed to prove that contract. This hop walks every assume and asks two things. Does the callee have a lemma that proves the same property. Is the assume body the same shape as the lemma body: same return expression, same field writes.

The help file teaches the hollow assume first. policy.Service.ClearSession is named. The function has no // reqproof:lemma. Tests still pass because nobody asked the callee.

// On the host
// reqproof:assume policy.Service.ClearSession
//   func(t *Service, session *user.SessionState) error { return nil }

# policy.Service.ClearSession has no lemma
# proof audit --check assume_contract_consistency
# [IMPLEMENT] assume_contract_consistency -- no callee lemma for ClearSession
# silent assume: the suite still printed green

Add a lemma on the callee that proves the property the assume claims. Or remove the assume if it is unnecessary. Then re-run the same check. Do not leave a comment that names a function the solver never saw.

proof audit --check assume_contract_consistency
proof workflow check --stage implement --verbose
proof workflow check --only assume_contract_consistency
proof audit --scope baseline --verbose

The teaching graph is still one assume whose board called the suite done and whose callee never proved the property. Close it by adding the lemma, or by removing the assume. The same hop also catches a mismatch: the assume returns result while the lemma proves t.applyAPILevelLimits(...).Limit.QuotaMax >= 0. If they describe the same contract, rewrite one to match the other structurally. If they describe different properties, fix whichever is wrong. A malformed // reqproof:* that the Go parser cannot recover from is a warning with the scanner diagnostic, not a pass. An orphan // reqproof:* with no host declaration is INFO (E_ORPHAN_DIRECTIVE); the assume analysis still runs. Do not treat a Jama note as this hop. Do not treat a green suite as a backed contract.

// On the host
// reqproof:assume policy.Service.applyAPILevelLimits
//   func(t *Service, policyAD, currAD user.AccessDefinition) user.AccessDefinition {
//     result := policyAD
//     return result
//   }

// On the callee
// reqproof:lemma apply_api_limits_quota_max_nonneg
//   proves t.applyAPILevelLimits(policyAD, currAD).Limit.QuotaMax >= 0

# proof audit --check assume_contract_consistency
# assume body return (result) does not match lemma proves expression

The YAML assume/guarantee hop stays on design by contract. The solver hop stays on Z3/Kind2 on one function. Jama still authors. Proof vs Jama.

Warning, not fail. Not blocking. No // reqproof:assume in the tree is a pass. No Go source is a skip, and a skip still passes. The hop looks at assume bodies and lemma proves expressions. It does not run Z3. It does not run Kind2. A syntactic match is not a solver verdict. It does not write the lemma. It does not rewrite the assume. It does not prove the Go. Copied assumes that still match still pass. Cross-package or opaque callees that cannot host a lemma need a project-level waiver; the hop does not invent one. We have not scored this floor against a frozen Jama pack or a ReqIF export. The loss is named, not scored.

The YAML hop stays on design by contract. The engagement stays on software correctness audit. Jama still authors.

What is assume contract consistency? Same question. Same URL.

Is this design by contract? No. That hop matches YAML assume/guarantee pairs across components. This hop is a source // reqproof:assume whose callee lemma must match the body. See design by contract.

Is this a Z3 proof of the function? No. Z3 asks every input of a lemma you already wrote. This hop asks whether the assume even has a lemma, and whether the shapes match. See Z3/Kind2 on one function.

Is this formalization lemma verdict consistency? No. That hop is a SYS-REQ that already claims valid while the lemma cache is still timeout. This hop is a source assume. See formalization lemma verdict consistency.

Is this annotation validity? No. That hop is a comment that names an ID the spec set no longer holds. This hop is a comment that names a callee the lemma set does not back. See annotation validity.

Is this contract alignment clean? No. That hop is a cobra file whose help, IDs, and tests must keep up with the surface. This hop is a source assume. See contract alignment clean.

Does a tree with no assumes pass? Yes. No // reqproof:assume is a pass. That is not a proof that the callees are correct. It is a proof that this hop had nothing to walk.

Does a green hop prove the code matches the shall? No. The hop observes assume comments and lemma comments. It does not prove the Go.

Is Proof a Jama alternative for the shall? No. Jama still authors. Proof vs Jama.