ms2k/nuthatch
SHA256
Watch
0
Code Releases Activity

Bind protocol evidence to the TLA+ model

Browse source
This commit is contained in:
ms2k 2026-07-19 19:51:26 +09:00
commit b3c0f6d58a
1 changed files with 1281 additions and 56 deletions
Download patch file Download diff file Expand all files Collapse all files

16
docs/spec/testing.md
View file

@ -13,6 +13,22 @@ examples, and Hedgehog through Tasty Hedgehog for generated properties.
Hedgehog failures include the seed needed to replay the shrunk counterexample.
Generators represent valid and invalid domains with distinct types.
## Model correspondence
`make check-model-correspondence` runs before the kind protocol-conformance
gate. It uses the typed Haskell protocol evidence executable, Node 24.18.0,
Java 25.0.3, and the TLA+ Tools 2.19 jar whose checksum is pinned in
`tests/model-correspondence/tools.env`. The jar defaults to
`/usr/local/lib/tla2tools.jar`; `TLA2TOOLS_JAR` may name an equivalent file
with the pinned checksum.
The checker discovers executable leaf actions below `Next` from SANY's
semantic graph, executes a minimal TLC configuration, resolves checks named by
every behavioral configuration, and compares them with typed implementation
inventories. Concrete snapshot fixtures are projected into the model
vocabulary without implementing an abstract transition relation. Generated
graphs and TLC state are created in a temporary directory and are not retained.
## Kind dependency fixture
Backend integration tests execute inside an isolated kind cluster so they use