Gate Integrity & Invariant Attestation Specification (Mutation Sensitivity, Metamorphic Invariance, AST Anti-Vacuity)

Role: Autonomous Open-Core Software Architect
Objective: Codify the three deterministic vectors that attest to Definition of Done (DoD) quality gate integrity, eliminating false negatives (trivial pass shims) and false positives (spurious alarms) through in-memory AST mutation fault-injection, metamorphic reference invariance, and AST structural anti-vacuity audits.

---

1. Context & Epistemology#

In autonomous, agentic software engineering, conversational assertions of code correctness are fundamentally untrusted (Law 2: The Non-Verbal Proof Law). Verification pipelines themselves are susceptible to two failure modalities:

1. False Negative (Type II Error / Trivial Pass): A quality gate returns Passed: true without evaluating code ASTs or failing on synthetically introduced flaws, allowing defective code into trunk.
2. False Positive (Type I Error / Spurious Alarm): A gate rejects clean, compliant code due to brittle regexes, improper relative path resolution, or faulty boundary thresholds.

Epistemic Precision#

Nomos distinguishes between:

• Deductive Mathematical Proof: Formal theorem-proving across infinite state spaces (e.g. Coq, Lean, Z3 SMT solvers).
• Deterministic Invariant Attestation: Empirical mutation sensitivity ($MS = 1.0$), metamorphic reference invariance ($FPR = 0.0$), and static AST structural anti-vacuity audits over finite codebase topologies.

Nomos provides empirical invariant attestation under Cell 2.3 through nomos verify proof [path].

---

2. The Three Attestation Vectors#

Vector 1: Mutation Testing Sensitivity ($MS = 1.00$)$MS = 1.00$)">#

A gate suite possesses sensitivity if and only if it kills 100% of non-equivalent synthetic mutants:

Nomos executes in-memory AST fault injections directly against sampled functions from the target codebase (or standard synthetic fallbacks if no Go source files exist). The 10-mutant operator catalog covers:

1. Mutant 1 (Empty Body Stub): Guts a function body into zero statements (func Stub() {}). Assertion: AntiShimGate kills mutant (Passed: false).
2. Mutant 2 (Panic Placeholder Stub): Replaces body with panic("todo"). Assertion: AntiShimGate kills mutant.
3. Mutant 3 (Function LOC Overrun): Injects statement padding exceeding MaxFuncLOC > 60. Assertion: FileLOCGate kills mutant.
4. Mutant 4 (File LOC Overrun): Synthesizes a file exceeding MaxFileLOC > 400. Assertion: FileLOCGate kills mutant.
5. Mutant 5 (Blank Identifier Discard): Discards error value via _ = fn(). Assertion: UncheckedErrorsGate kills mutant.
6. Mutant 6 (Trivial Gate Result Shim): Replaces Evaluate body with single statement return &GateResult{Passed: true}. Assertion: GateIntegrityProofGate kills mutant.
7. Mutant 7 (Conditional Wrapper Pass Shim): Encloses trivial pass in single branch if ctx != nil { return &GateResult{Passed: true} }. Assertion: GateIntegrityProofGate kills mutant.
8. Mutant 8 (Forbidden Path Literal): Injects hardcoded workspace path literal into source. Assertion: ForbiddenLiteralsGate kills mutant.
9. Mutant 9 (Docstring Stripping): Strips all exported comments to force docstring density below 80%. Assertion: DocstringDensityGate kills mutant.
10. Mutant 10 (Single Return Discard): Strips business logic down to premature return statement. Assertion: AntiShimGate kills mutant.

Hermetic Invariant (Law 3): All mutations occur strictly in-memory on AST copies; physical source files on disk are never altered.

---

Vector 2: Metamorphic Reference Invariance ($FPR = 0.00$)$FPR = 0.00\%$)">#

A gate suite is specific if and only if its False Positive Rate ($FPR$) on compliant constructs is strictly zero:

The engine evaluates clean constructs:

• Real compliant functions from the target codebase pass AntiShimGate without false alarms.
• Bounded LOC metrics pass FileLOCGate.
• Properly checked error handling passes UncheckedErrorsGate.
• Canonical baseline sequence passes all registered statutory gates.

Self-Audit Recursion Invariant: During evaluation of Vector 2, the GateIntegrityProofGate is strictly excluded from recursive self-invocation to prevent re-entrancy cycles.

---

Vector 3: AST Structural Anti-Vacuity Meta-Audit#

To prevent quality gate implementations from devolving into trivial constant returns, Nomos performs static AST structural meta-audits on all Gate.Evaluate methods:

Every gate function must:

1. Contain operational inspection logic.
2. Reject single-statement Passed: true returns.
3. Reject trivial conditional wrapper shims (e.g., if ctx != nil { return &GateResult{Passed: true} } or if true { return &GateResult{Passed: true} }).

---

3. Machine-Enforced CLI Contract#

Executed via:

nomos verify proof [path]

Output schema:

  Nomos Gate Integrity & Invariant Attestation (Cell 2.3)
  Target Codebase: <path> (<N> Go files analyzed)
────────────────────────────────────────────────────────────────────────────
  Vector 1: Mutation Testing Sensitivity (MS)       [100.0% · 10/10 Killed]   PASS
  Vector 2: Metamorphic Invariance Check (FPR)       [0.0% · 9/9 Passed]       PASS
  Vector 3: AST Structural Anti-Vacuity Audit        [44/44 Non-Trivial]       PASS
────────────────────────────────────────────────────────────────────────────
   Deterministic Gate Integrity Invariants Satisfied · Exit Code 0

---

4. Cross-Plane CUE Schema Contract#

The attestation report is strictly typed in intent/contracts/cue/gate_integrity_proof.cue:

package schemas

#GateIntegrityReport: {
	target_dir:             string
	is_codebase_targeted:   bool
	codebase_files_scanned: int & >=0
	mutation_killed:        int & >=0
	mutation_total:         int & >=0
	mutation_score:         float & >=0.0 & <=100.0
	false_positive_rate:    float & >=0.0 & <=100.0
	reference_gates_pass:   int & >=0
	reference_gates_total:  int & >0
	non_vacuous_gates:      int & >=0
	total_gates_evaluated:  int & >0
	passed:                 bool

	_sensitivity_pass: mutation_score >= 100.0
	_specificity_pass: false_positive_rate == 0.0
	_anti_vacuous_pass: non_vacuous_gates == total_gates_evaluated

	passed: _sensitivity_pass && _specificity_pass && _anti_vacuous_pass
}

---

5. Table-Driven Verification Vectors#

Vector ID	Attestation Dimension	Input Scenario	Expected Verdict
TC-PRF-01	Vector 1 (Sensitivity)	Synthetic mutant escapes gate detection (mutation_score < 100.0)	FAIL (Exit 1, _sensitivity_pass == false)
TC-PRF-02	Vector 2 (Specificity)	Clean reference fixture triggers false alarm (false_positive_rate > 0.0)	FAIL (Exit 1, _specificity_pass == false)
TC-PRF-03	Vector 3 (Anti-Vacuity)	Gate implementation returns unconditional GateResult{Passed: true}	FAIL (ERR_TRIVIAL_PASS_SHIM)
TC-PRF-04	Full Cell 2.3 Proof	100% mutant kill rate, 0% FPR, and 100% non-vacuous AST bodies	PASS (Exit 0, CUE report valid)