Check reference
Check the contracts behind assumptions
A caller can be proved under an assumption that its callee never guarantees. assume_contract_consistency makes that dependency visible.
When a caller borrows a guarantee
An assumed callee body supplies behavior to a caller's proof. This verify-stage check scans assumptions and looks for callee lemmas. When cached verdicts are available, a proved callee lemma supplies credit; otherwise it reports recorded counterexamples, translation errors or undecided results, or falls back to expression-shape matching. Same-package findings warn. Cross-package findings are advisory when they are the only findings. Unrecoverable annotation parse errors also warn.
Illustrative example: a quota helper
Suppose a caller assumes that ApplyLimit returns the smaller of two limits. The callee has a lemma saying only that the result is nonnegative. Those are different claims: returning 100 can satisfy nonnegativity while violating a requested limit of 10.
Caller needs: result <= requestedLimit
Callee establishes: result >= 0
Missing contract: the upper bound
The example describes the review obligation; it is not solver output or directive syntax. A successful caller proof under the stronger assumption would not establish the missing callee behavior.
Repair the contract at its owner
Read the assumed body beside the callee's actual implementation and lemma. If the caller needs the upper bound, give the callee that meaningful claim and verify it. If the assumption overstates the intended interface, correct the caller and its proof. Remove an unnecessary assumption only after confirming that supported translation can analyze the real call.
proof audit --check assume_contract_consistency --verbose
What a clean result means
The fallback comparison is structural, not a semantic-equivalence proof. The cached-verdict path accepts any proved lemma on the callee without proving that its property implies the particular assumed body. Review that implication yourself and check freshness separately. With no relevant assumptions there is nothing to compare. Audit exit policy and required CI configuration determine whether non-advisory findings prevent a merge.
Follow the evidence
Start with one caller assumption and identify the callee evidence it relies on.
Review one assumed contract. Bring the caller, callee and lemma evidence so we can assess whether the caller relies on a guarantee the callee actually establishes.