// TLA+ Model Checking workflow. Use when: (1) running TLC model checking or simulation on a TLA+ spec, (2) analyzing counterexamples from invariant violations, (3) determining whether a violation is a spec issue, an overly-strong invariant, or a real bug in the system implementation.
Bug confirmation and reproduction. Use when: (1) a bug has been found by model checking and needs code-level validation, (2) reproducing a bug in the real system to confirm it is not a false positive, (3) assessing whether a TLA+ counterexample maps to a real triggerable scenario.
Trace harness generation (Phase 2.5). Use when: (1) instrumenting a system's source code to emit NDJSON traces for TLA+ trace validation, (2) writing test scenarios that exercise protocol code paths, (3) producing the first batch of traces from instrumented tests.
TLA+ Trace Validation workflow. Use when: (1) validating if a trace matches a TLA+ spec, (2) debugging trace validation failures (TLC reports 'Temporal properties were violated' or validation stops unexpectedly), (3) fixing spec/trace inconsistencies after root cause is identified.
TLA+ Verification workflow (orchestration). Use when: running the full verification loop — iterating between trace validation and model checking until both pass, ensuring spec faithfully models the system.
Severity classification of bugs already confirmed by Phase 4a. Use when: (1) Phase 4a (bug-confirmation) has produced confirmed-bugs.md and each entry needs a Severity tier, (2) producing the input for downstream submission filtering, (3) re-classifying bugs after status changes (e.g., REPRODUCTION FAILED → REPRODUCED on retry).
Code analysis for formal verification. Use when: (1) investigating a system implementation to identify what to model in TLA+, (2) performing bug archaeology on a codebase, (3) producing a modeling brief that guides spec generation.
| name | tla-checking-workflow |
| description | TLA+ Model Checking workflow. Use when: (1) running TLC model checking or simulation on a TLA+ spec, (2) analyzing counterexamples from invariant violations, (3) determining whether a violation is a spec issue, an overly-strong invariant, or a real bug in the system implementation. |
Read guide.md for the full workflow methodology.
