Skip to content

Preserve water-warning obligations across detector updates - #2

Merged
hyperpolymath merged 1 commit into
mainfrom
feat/water-leak-continuity
Sep 7, 2026
Merged

hyperpolymath merged 1 commit into
mainfrom
feat/water-leak-continuity

Conversation

@hyperpolymath

Copy link
Copy Markdown
Owner

A detector update during an active simulated water warning must preserve the original readings, the warning's identity and its outstanding operator acknowledgement. This change adds a resident domain ledger around the existing detector model and checks acknowledgements before and after activation, signal clearance without acknowledgement, and rejection of a migration which erases report ownership.

The reproducible command is mix run -e 'Firmboot.WaterLeak.Experiment.run()'. The required Agda/Elixir job also runs it. The experiment uses finite synthetic interval volumes and two already compiled detector implementations; it does not perform physical leak detection, actuation, durable storage or general code loading. The domain report states the observation contract and source/model correspondence gaps.

Validation:

  • 43 Elixir tests, including ten domain tests and 640 six-sample trajectories across both update directions. Independent fixture checks reject corrupted observations, warning identities and acknowledgement journals.
  • 16 new Lean lemmas and witnesses: 95 named axiom expectations in total, with the native axiom policy checking 770 declarations. All seven false-claim controls and the custom-axiom control reject for their intended reason.
  • Full Agda verification, 11 semantic rejection controls and 64 unchanged generated Elixir agreement witnesses.
  • Actionlint, authoritative Actions dependency-lock verification, REUSE licensing coverage and local secret scanning.

The Lean results prove properties of the defined model. A whole-program refinement proof for the Elixir implementation remains open; domain ledger costs are not included in the existing assigned detector timing budget.

@coderabbitai

coderabbitai Bot commented Sep 7, 2026 •

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: cad0d61c-b321-41cf-9209-ea4c7cf20ae7

📥 Commits

Reviewing files that changed from the base of the PR and between fcf8e2e and 72422af.

📒 Files selected for processing (16)
  • .github/workflows/verify.yml
  • PURPOSE.md
  • README.md
  • VERIFICATION.md
  • docs/water-leak-experiment.md
  • lib/firmboot/water_leak.ex
  • lib/firmboot/water_leak/checker.ex
  • lib/firmboot/water_leak/experiment.ex
  • proofs/lean/Audit.lean
  • proofs/lean/Firmboot.lean
  • proofs/lean/Firmboot/WaterLeak.lean
  • proofs/lean/README.md
  • proofs/lean/controls/AcknowledgeOtherSource.lean
  • proofs/lean/controls/ClearWarningOnUpdate.lean
  • proofs/lean/verify.sh
  • test/firmboot/water_leak_test.exs

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details
⏰ Context from checks skipped due to timeout. (1)
  • GitHub Check: Agda contract and Elixir agreement
🧰 Additional context used
🪛 LanguageTool
VERIFICATION.md

[grammar] ~15-~15: The verb “double-checking” is spelled with a hyphen.
Context: ...cks with safe mode, without K, internal double checking and warnings as errors; all 11 intentio...

(DOUBLE_HYPHEN)

docs/water-leak-experiment.md

[uncategorized] ~55-~55: Use a comma before “or” if it connects two independent clauses (unless they are closely connected and short).
Context: ... warning, not that a leak was repaired or an incident resolved. A same-operator...

(COMMA_COMPOUND_SENTENCE_2)


[style] ~58-~58: Would you like to use the Oxford spelling “authorization”? The spelling ‘authorisation’ is also correct.
Context: ...dentials; there is no authentication or authorisation protocol. The measurement journal, war...

(OXFORD_SPELLING_Z_NOT_S)

🔇 Additional comments (8)
proofs/lean/Firmboot.lean (1)

6-6: LGTM!

proofs/lean/Firmboot/WaterLeak.lean (1)

1-148: LGTM!

proofs/lean/Audit.lean (1)

319-381: LGTM!

proofs/lean/README.md (1)

17-26: LGTM!

Also applies to: 93-93, 107-110, 181-201

proofs/lean/controls/AcknowledgeOtherSource.lean (1)

1-5: LGTM!

proofs/lean/controls/ClearWarningOnUpdate.lean (1)

1-5: LGTM!

proofs/lean/verify.sh (1)

49-49: LGTM!

Also applies to: 64-64

lib/firmboot/water_leak.ex (1)

1-101: LGTM!


📝 Summary

Summary by CodeRabbit

  • New Features

    • Added a simulated water-leak monitoring workflow that records readings, issues uniquely identified warnings, preserves them through detector updates, and supports operator acknowledgements.
    • Added reproducible scenarios covering warning continuity, acknowledgements, validation, and rejected updates.
  • Bug Fixes

    • Improved safeguards against invalid readings, duplicate or unknown warnings, incorrect acknowledgements, and attempts to erase warning ownership.
  • Documentation

    • Added user-facing documentation covering the simulation, execution steps, evidence, limitations, and verification results.
  • Tests

    • Expanded automated coverage with 640 short traces, tampering checks, and formal verification controls.

Walkthrough

The change adds a finite water-warning simulation with raw-reading retention, warning identity, acknowledgements, independent checking, Lean proofs, executable scenarios, expanded tests, and verification documentation.

Changes

Water-warning continuity

Layer / File(s) Summary
Formal water-warning ledger
proofs/lean/Firmboot/WaterLeak.lean, proofs/lean/Audit.lean, proofs/lean/controls/*, proofs/lean/verify.sh, proofs/lean/Firmboot.lean, proofs/lean/README.md
Adds the Lean ledger model, sampling and acknowledgement operations, continuity theorems, axiom audits, and seven rejected false-claim controls.
Elixir ledger and experiment execution
lib/firmboot/water_leak.ex, lib/firmboot/water_leak/checker.ex, lib/firmboot/water_leak/experiment.ex, test/firmboot/water_leak_test.exs, .github/workflows/verify.yml
Adds validated water-warning state handling, transcript verification, three reproducible scenarios, 640 trace combinations, mutation checks, and CI execution of the experiment.
Verification and experiment documentation
docs/water-leak-experiment.md, VERIFICATION.md, README.md, PURPOSE.md
Documents the contract, execution traces, formal and runtime evidence, limitations, reproduction commands, and separate physical-safety obligations.

Estimated code review effort: 4 (Complex) | ~45 minutes

Merge Risk: ⚪ Minimal · up to 72422

This adds an in-memory simulated water-warning ledger that retains readings, warning identity, and acknowledgements across detector updates. Current merge-readiness risk is minimal within the documented experimental scope.

Sequence Diagram(s)

sequenceDiagram
  participant Experiment as Firmboot.WaterLeak.Experiment
  participant Ledger as Firmboot.WaterLeak
  participant Model as Firmboot.Model
  participant Checker as Firmboot.WaterLeak.Checker
  Experiment->>Ledger: request detector update
  Experiment->>Ledger: sample reading
  Ledger->>Model: apply transition
  Model-->>Ledger: return updated model state
  Ledger-->>Experiment: return warnings and observations
  Experiment->>Ledger: acknowledge warning
  Experiment->>Checker: verify transcript and state
  Checker-->>Experiment: return :ok or violations
Loading

Poem

A rabbit checks the warning stream,
And keeps each reading in the dream.
The model shifts, the records stay,
Receipts mark the proper day.
Lean guards the burrow gate,
While tests hop through every state.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 9.09% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 11 functions across 5 files. (11 skipped: … Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly describes the main change: preserving water-warning obligations across detector updates.
Description check ✅ Passed The description directly explains the ledger, acknowledgement behaviour, experiment command, validation, and stated limitations.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Full details: Docstring Coverage

Explanation

Docstring coverage is 9.09% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 11 functions across 5 files. (11 skipped: 11 unsupported.)

  • Fix all pre-merge checks with AI
✨ Finishing Touches 💡 1
📝 Generate docstrings 💡
  • Create stacked PR
  • Commit on current branch

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@hyperpolymath
hyperpolymath merged commit 31a22c5 into main Sep 7, 2026
12 checks passed
@hyperpolymath
hyperpolymath deleted the feat/water-leak-continuity branch September 7, 2026 03:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant