Code predicates modeled

The check is code_predicates_modeled. It is SPEC-stage plus audit. Severity is warning. The hop reads persisted MC/DC decision and condition expressions, then a conservative scan of the # Implements: function. It does not rewrite the YAML. It does not call Z3. It does not call Kind2.

It fires when a load-bearing numeric compare on that function is missing from FRETish and missing from verification.not_modeled. Load-bearing surfaces are comparison expressions, len(...), range(...N), and kwargs whose name is a bound (ExpiresIn, expires, timeout, retries, threshold, limit, ttl, delay). Constructor and config kwargs such as indent, memory_size, temperature, max_tokens, and response_code are not.

Each compare must appear in FRETish as a typed variable whose bound is written, or be named by a verification.not_modeled entry whose predicate covers the compare. A boolean envelope that omits the numeric compares, lengths, and status checks the function actually evaluates is not a model of that function. The hop scans the implements function, not the whole file.

Mass not_modeled is not a silent escape. More than three not_modeled predicates on one requirement needs a [ki:] tracker id in the reason. A code comment proof:domain-exempt: next to the compare is the same honest opt-out, matched by compare text, with a reason of at least 16 characters. A blank marker does not suppress.

This is not a contradiction finding. A parseable, satisfiable, fully traced shall can still leave the numeric decision only in the Go. The help file teaches that first.

# SYS-REQ-410 FRETish:
# when authorized and present
#   the store shall always satisfy ok
# authorized, present, ok are booleans.

# Go still does:
#   if len(readme) > 5000 { truncate }

# proof audit --check code_predicates_modeled
# [SPEC] code_predicates_modeled
# 1 load-bearing compare not in the model
# SYS-REQ-410: len(readme) > 5000
# silent compare: last VALID still on two booleans

The fix is on the model, not on another test. Declare a typed variable whose domain includes the bound, and write the bound into the FRETish. The literal must appear: len(readme) > 5000 is modeled by a readme_length int with the 5000 threshold referenced, not by a bare readme_present boolean. The accepted forms are a ranged int or real, a data_constraint, or a domain.tables value.

proof audit --check code_predicates_modeled --verbose
proof help domain-modeling
proof review req SYS-REQ-410

The teaching graph is still one authorize shall whose two booleans sat on a len(readme) > 5000 truncate. Close it by writing readme_length into FRETish with the bound, or by naming the compare in not_modeled with a reason, or by a proof:domain-exempt: comment on that line. Do not add a spare test to look covered. Do not waive the hop with a one-word reason. With two booleans the hop still fires, and the 5000 did not go anywhere. It just stayed in the Go.

# SYS-REQ-410 now names the bound
#   readme_length: int, range 0..100000
#   when readme_length > 5000
#     the doc_service shall always satisfy readme_truncated
#
# proof audit --check code_predicates_modeled
# 0 load-bearing compares missing. this hop is quiet

A verify-stage shall whose traces look richer than its variables stays on under-modeled requirements. A description that named a domain no variable models stays on solver modeling opportunity. Jama still authors. Proof vs Jama.

Warning, not fail on its own. Constructor and config kwargs are a pass, not a model. A code-comment exemption is silence with a reason, not a proof that the bound is right. More than three not_modeled entries still need a [ki:] tracker; without it the hop keeps warning. The hop does not rewrite the YAML. It does not add a variable. It does not prove the Go. It does not fill a Jama cell. A parseable, satisfiable, fully traced shall can still leave the numeric decision in the implements function; a quiet hop is not a proof that the model is enough, only that every collected compare was named or exempted. We have not scored this floor against a frozen Jama pack or a ReqIF export. The loss is named, not scored.

The verify-stage density hop stays on under-modeled requirements. The description-domain hop stays on solver modeling opportunity. The unconstrained-output hop stays on gaps clean. The engagement stays on software correctness audit. Jama still authors.

What is code predicates modeled? Same question. Same URL.

Is this under-modeled requirements? No. That hop is verify-stage: whether traces already look richer than the variables. This hop is spec-stage: whether a load-bearing compare on the implements function is in FRETish at all. See under-modeled requirements.

Is this solver modeling? No. That hop is a description that named a domain no variable models. This hop is a compare the Go already evaluates. See solver modeling opportunity.

Is this gaps clean? No. That hop is an unconstrained output while Kind2 still printed realisable. See gaps clean.

Is this non-boolean inputs constrained? No. That hop is a spec-side non-bool input with no range, constraint, or table. This hop is a load-bearing compare on the implements function. See non-boolean inputs constrained.

Does a domain-exempt comment prove the bound is right? No. It names why the compare is not a spec domain. The hop still counts it in the summary.

Does a quiet hop prove the code matches the shall? No. The hop observes compares against FRETish and not_modeled. It does not prove the Go.

Is Proof a Jama alternative for the shall? No. Jama still authors. Proof vs Jama.