The row
- Ask did the suite stay green on amount 0 and 200
- Stamp no exclusivity check
- Why tests never hit 100
Topic · data constraints complete
Gist
Data constraints complete is whether authored data_constraint groups cover the input domain without gaps or overlaps. Proof runs proof audit --check data_constraints_complete. A SQL CHECK constraint is not that partition. Jama still authors.
proof audit --check data_constraints_complete
Keep Postgres if it already CHECKs a column. Keep Jama if it already authors the shall. Neither one names a boolean pair that is both true at amount=100.
01 · The overlapping pair
If two authored conditions can both be true, or a legal value matches none of them, the behavioral proof story is weak even when the requirement text looks fine.
The check is warning severity. It runs at verify. A counterexample reports fail at warning. A parse miss, a timeout, or an unrecognised solver kind reports warn. Neither blocks advancement. Read the class tag on the finding first. They have different owners. Do not treat them as one bucket.
The tags are [disproved] (the solver produced a counterexample: close the gap or the overlap), [not-parsed] (Proof could not read the expression, so no proof was attempted), [inconclusive] (timeout or resource limit), and [unclassified] (an unrecognised solver result, printed verbatim). A parse miss is a tool gap. See proof help spec_lint_data_constraint_parseable.
Authoring is a YAML block, not a column CHECK:
variables:
- name: amount_low
type: bool
direction: input
data_constraint:
domain: integer
condition: "amount <= 100"
parameters:
- name: amount
type: int
- name: amount_high
type: bool
direction: input
data_constraint:
domain: integer
condition: "amount >= 100"
parameters:
- name: amount
type: int
Both booleans are true at amount = 100. Completeness can still pass. Exclusivity cannot. The hop names that overlap. It does not rewrite the conditions. It does not inspect the Go. See
variable drift
for list vs sentence on one requirement. This hop is whether the authored cases are disjoint and complete. See
Z3/Kind2 on one function
for a lemma on the helper itself.
proof verify-properties specs/system
proof audit --check data_constraints_complete --verbose
proof help spec_lint_data_constraint_parseable
Tighten the conditions until the cases are disjoint and complete. Add or strengthen parameter constraints when the domain itself is underspecified. Do not drop a boolean so the hop goes green. A missing case is still a missing case.
02 · The exhibit
amount=100 makes both booleans true. Click the tabs.
The row
This hop
Both amount_low and amount_high are true at 100. The shall still reads as two cases.
No stampThe row
Keep the SQL CHECK. Keep the Jama field. That is not this hop.
Keep the recordProof
Same pair. A silent overlap, or this stamp. Click the tabs.
| Surface | What they do | What Proof does | What we lose |
|---|---|---|---|
| SQL CHECK | A column constraint the database enforces at write. | Warn when authored boolean cases overlap or leave a legal value unmatched. | We do not enforce Postgres. Bare "data constraint" is that SERP, not this hop. |
| Z3 / Kind2 lemma | A proof on one helper. | A partition check on the authored variable group, before the lemma. | Not a proof of the Go. See Z3/Kind2 on one function. |
| Jama field | The authoring programme. Attributes if you put them there. | A YAML group the solver can disprove next to the shall. | Not Jama's V&V. Jama still authors. We have not run a frozen Jama pack. |
| Variable drift | List vs sentence on one requirement. | Whether those named cases actually partition the domain. | Not the list/sentence hop. See variable drift. |
The teaching graph is still one group next to one domain. Read the class tag. Then pick one of four resolutions. They are alternatives.
proof verify-properties specs/system
proof audit --check data_constraints_complete --verbose
proof audit --check data_constraint_z3_coverage --verbose
proof help spec_lint_data_constraint_parseable
Close a [disproved] by tightening conditions until the cases are disjoint and complete. Route a [not-parsed] to the parse lint; do not treat it as a domain gap. Retry or bound an [inconclusive]. Do not drop a skipped variable so the hop goes green. The skip list stays on data_constraint_z3_coverage, a different hop. Jama still authors.
Proof vs Jama.
03 · The honest loss
A green data_constraints_complete can still mean the solver never ran. It is warning, not a hard gate. Jama still authors.
Warning severity either way. A counterexample fails at warning. A parse miss, a timeout, or an unrecognised kind warns. Neither blocks advancement unless you raise the fail level. The hop does not rewrite condition:. It does not inspect the implementation. It does not prove the helper clamps. Move that claim to a lemma. We have not scored this partition against a frozen Jama pack, Postgres CHECK, or a Kind2 model of the Go. The loss is named, not scored.
The list vs sentence hop stays on variable drift. The function proof stays on Z3/Kind2 on one function. The engagement stays on software correctness audit. Jama still authors.
04 · Nearby questions
What is data constraints complete? Same question. Same URL.
Is this a SQL CHECK constraint? No. That SERP is a column the database enforces at write. The command on this install is proof audit --check data_constraints_complete.
Is this Z3 on one function? No. That hop is a lemma on a helper. This hop is whether the authored boolean cases partition the domain. See Z3/Kind2 on one function.
Is this variable drift? No. Drift is list vs sentence. This hop is completeness and exclusivity of the cases you already named. See variable drift.
Does a disproved partition fail the merge? No. The check keeps warning severity. A counterexample reports fail at warning.
Is a parse miss a domain gap? No. [not-parsed] means Proof could not read the expression. Route it to proof help spec_lint_data_constraint_parseable.
Is Proof a Jama alternative for the partition? No. Jama still authors. Proof vs Jama.