Check reference
Find data constraints the solver did not check
“All checked constraints passed” can hide constraints that were never checked. data_constraint_z3_coverage compares the authored set with the set reached by the property pipeline.
Count logical variables, then inspect omissions
The check works with logical component:name keys, so mirrored YAML rows do not inflate the authored count. It considers supported completeness, exclusivity, implication and postcondition analyses. Non-auxiliary authored constraints that the pipeline skips produce warnings with skip reasons. Auxiliary variables are excluded from this denominator. Duplicate logical declarations remain diagnostic information worth reviewing for cross-layer drift.
Illustrative example: a skipped quota predicate
A model declares quota_exceeded as an internal boolean with a numeric condition, but provides no supported parameter binding. A green result for other variables cannot answer whether this predicate has been checked.
Authored predicate: quota_exceeded
Meaning: quota_used >= quota_max
Review questions:
Which inputs bind quota_used and quota_max?
Is this an observed input predicate or an internal helper?
Which guarantee consumes it?
This is an inspection example, not captured audit output. Resolve direction and parameter ownership according to the real interface.
Repair the skipped shape
Supply the declared dependencies or typed parameters needed by the encoder. For partitioned input domains, add the complementary cases and a real consuming guarantee; changing internal to input alone may expose a completeness gap. An assumption that mentions the predicate does not create the behavioral implication obligation of a guarantee. Mark a variable auxiliary only when it genuinely serves proof bookkeeping.
proof verify-properties specs/system quota
proof audit --check data_constraint_z3_coverage --verbose
Coverage is separate from a successful proof
If the Z3 report is unavailable, this gate reports that it is skipping coverage; inspect the upstream failure. Otherwise it exposes omissions from analysis. Use the property and implication verdicts to determine whether reached constraints were proved, disproved or inconclusive. Neither coverage nor a successful model proof establishes that production code implements the predicate. Keep concrete boundary tests and code bindings as separate evidence. The example component name must be replaced with your configured component.
Follow the evidence
Investigate the first skipped logical variable before trusting the summary count.
Review one skipped constraint. Bring the variable declaration and verification report so we can identify why it was omitted and what evidence is still needed.