# Formal models

[Quint](https://quint-lang.org) models of designs where interleavings matter
more than any single code path. A model is a hand-written reading of the code:
it finds flaws the design and the code share, not places where the code
strays from the design. So every counterexample is also reproduced as a failing
test against the real code before anything is changed.

## `orchestrator.qnt`: nisse-dev's control loop

Models `nisse-dev/src/nisse_dev/control.py`: the states, the gate, pending
questions, Gitea comment cursors, publish intents, and the worker queue.
Operator messages, Gitea comments, planner/executor/publisher outcomes
(exceptions included) and **a crash at any point** all interleave freely.
Each pure function is named after the method it mirrors.

The properties are at the end of the file (`all_properties` is their
conjunction). Counterexamples are written out as short traces in
`orchestrator_scenarios.qnt`, and replayed against the real code in
`nisse-dev/tests/test_quint_counterexamples.py`.

```sh
npm install -g @informalsystems/quint     # 0.33 or later

# Random simulation, one property at a time:
quint run specs/orchestrator.qnt --invariant=no_stranding \
    --max-steps=40 --max-samples=200000

# The counterexample traces (each expects its property to break):
quint test specs/orchestrator_scenarios.qnt
```

Exhaustive bounded checking (`quint verify`) uses Apalache and needs Java 17.

**Keeping it true.** When `control.py` changes how a state is entered or
left, change the matching function here in the same PR. When a
counterexample's fix lands, flip its scenario's `expect` to the property
holding, and drop the `xfail` from its Python reproduction.