feat: Group invariant campaigns by test contract (#14844)

* fix: make invariant campaigns contract-level

* fix: preserve separate invariants without assert_all

* Fix contract-level invariant suite grouping

* Optimize invariant result reporting

* Fix invariant suite corpus reporting edge cases

* Document invariant junit and suite helpers

* fix(forge): reduce invariant runner allocations

* refactor(forge): simplify invariant junit expansion

* Improve invariant report section labels

* Use contract-level invariant campaigns

* Fix invariant predicate rerun filters

* Polish invariant corpus and report labels

* Fix invariant clippy branch order

* fix(forge): preserve skipped invariant predicates

* test(forge): redact invariant failure temp path

* fix clippy iter_with_drain warning

* test(forge): update invariant snapshots

---------

Co-authored-by: Matthias Seitz <matthias.seitz@outlook.de>
Co-authored-by: Derek <256792747+decofe@users.noreply.github.com>

Author: 3 people

crates/config/src/invariant.rs

@@ -49,10 +49,6 @@ pub struct InvariantConfig {
     ///
     /// Example: `check_interval = 10` means assert after calls 10, 20, 30, ... and the last call.
     pub check_interval: u32,
-    /// Assert every invariant declared in the current test suite, continuing the campaign after
-    /// the first failure until all invariants have been broken (or normal limits are hit).
-    /// When `false`, the campaign aborts on the first broken invariant (legacy behavior).
-    pub assert_all: bool,
 }
 
 impl Default for InvariantConfig {
@@ -74,7 +70,6 @@ impl Default for InvariantConfig {
             max_time_delay: None,
             max_block_delay: None,
             check_interval: 1,
-            assert_all: true,
         }
     }
 }

crates/evm/evm/src/executors/corpus.rs

@@ -369,6 +369,13 @@ impl WorkerCorpus {
             }
 
             // Master worker loads the initial corpus, if it exists.
+            if fuzzed_contracts.is_some() && has_legacy_invariant_corpus_dirs(corpus_dir) {
+                let _ = sh_warn!(
+                    "Ignoring legacy invariant corpus directories under {}; new corpus entries are persisted under the contract-level corpus directory.",
+                    corpus_dir.display(),
+                );
+            }
+
             // Then, [distribute]s it to workers.
             let executor = executor.expect("Executor required for master worker");
             'corpus_replay: for entry in read_corpus_dir(corpus_dir) {
@@ -1335,6 +1342,17 @@ fn read_corpus_dir(path: &Path) -> impl Iterator<Item = CorpusDirEntry> {
     .into_iter()
 }
 
+fn has_legacy_invariant_corpus_dirs(path: &Path) -> bool {
+    std::fs::read_dir(path).is_ok_and(|entries| {
+        entries.flatten().any(|entry| {
+            let path = entry.path();
+            path.is_dir()
+                && entry.file_name().to_str().is_some_and(|name| !name.starts_with(WORKER))
+                && !path.join(OPTIMIZATION_BEST_FILE).is_file()
+        })
+    })
+}
+
 struct CorpusDirEntry {
     path: PathBuf,
     uuid: Uuid,
@@ -1471,6 +1489,30 @@ mod tests {
         (manager, seed_uuid)
     }
 
+    #[test]
+    fn detects_legacy_invariant_corpus_dirs_without_matching_worker_dirs() {
+        let corpus_root = temp_corpus_dir();
+        fs::create_dir_all(corpus_root.join("worker0")).unwrap();
+        assert!(!has_legacy_invariant_corpus_dirs(&corpus_root));
+
+        fs::create_dir_all(corpus_root.join("invariant_a")).unwrap();
+        assert!(has_legacy_invariant_corpus_dirs(&corpus_root));
+    }
+
+    #[test]
+    fn ignores_optimization_invariant_corpus_dirs_when_detecting_legacy_dirs() {
+        let corpus_root = temp_corpus_dir();
+        fs::create_dir_all(corpus_root.join("worker0")).unwrap();
+        let optimization_dir = corpus_root.join("invariant_optimize");
+        fs::create_dir_all(optimization_dir.join("worker0")).unwrap();
+        fs::write(optimization_dir.join(OPTIMIZATION_BEST_FILE), "{}").unwrap();
+
+        assert!(!has_legacy_invariant_corpus_dirs(&corpus_root));
+
+        fs::create_dir_all(corpus_root.join("invariant_legacy").join("worker0")).unwrap();
+        assert!(has_legacy_invariant_corpus_dirs(&corpus_root));
+    }
+
     #[test]
     fn favored_sets_true_and_metrics_increment_when_ratio_gt_threshold() {
         let (mut manager, uuid) = new_manager_with_single_corpus();

crates/evm/evm/src/executors/invariant/mod.rs

@@ -190,11 +190,7 @@ impl InvariantFailureMetrics {
 
 /// Bridges newly-recorded invariant breaks from `failures.errors` into the pulse
 /// `failure_metrics` so the live progress stream reflects breaks as they happen.
-///
-/// Without this, `unique_failures` only updates when the campaign is *forced to
-/// stop* (i.e., `can_continue` returns false — which only happens once *all*
-/// invariants are broken under `assert_all`). Iterates in declaration order so
-/// the emitted "failure" events are deterministic.
+/// Iterates in declaration order so the emitted "failure" events are deterministic.
 fn record_new_invariant_failures(
     failure_metrics: &mut InvariantFailureMetrics,
     invariant_contract: &InvariantContract<'_>,
@@ -511,6 +507,7 @@ impl<'a, FEN: FoundryEvmNetwork> InvariantExecutor<'a, FEN> {
         'stop: while continue_campaign(runs) {
             // Per-run failure count snapshot used to gate `afterInvariant` below.
             let failures_before_run = invariant_test.test_data.failures.invariant_count();
+            let mut stop_after_run = false;
 
             let initial_seq = corpus_manager.new_inputs(
                 &mut invariant_test.test_data.branch_runner,
@@ -750,8 +747,7 @@ impl<'a, FEN: FoundryEvmNetwork> InvariantExecutor<'a, FEN> {
                         invariant_test.set_last_run_inputs(&current_run.inputs);
                     }
                     // Bridge newly-recorded predicate breaks into `failure_metrics` even when
-                    // `continues == true` (under `assert_all`, breaks accumulate per tick until
-                    // the last invariant falls).
+                    // `continues == true` in multi-predicate campaigns.
                     if invariant_test.test_data.failures.invariant_count() > errors_before_check
                         || broken.is_some()
                     {
@@ -761,15 +757,13 @@ impl<'a, FEN: FoundryEvmNetwork> InvariantExecutor<'a, FEN> {
                             &invariant_test.test_data.failures,
                         );
                     }
-                    // Keep the campaign running after a recorded predicate failure only when
-                    // `assert_all && !fail_on_revert`; otherwise preserve legacy early-exit.
-                    // Handler-side assertions never reach this branch — they go through
-                    // `failures.broken_handlers` and leave `continues == true`.
                     if !continues {
-                        if self.config.assert_all && !self.config.fail_on_revert {
+                        if invariant_contract.invariant_fns.len() > 1 && !self.config.fail_on_revert
+                        {
                             break;
                         }
-                        break 'stop;
+                        stop_after_run = true;
+                        break;
                     }
                     current_run.depth += 1;
                 }
@@ -797,8 +791,8 @@ impl<'a, FEN: FoundryEvmNetwork> InvariantExecutor<'a, FEN> {
             );
 
             // Call `afterInvariant` only if declared and the current run produced no new
-            // failure. Under `assert_all` the campaign keeps running after earlier failures,
-            // but the hook must still execute on subsequent runs.
+            // failure. Multi-predicate campaigns keep running after earlier failures, but the
+            // hook must still execute on subsequent runs.
             if invariant_contract.call_after_invariant
                 && invariant_test.test_data.failures.invariant_count() == failures_before_run
             {
@@ -878,6 +872,9 @@ impl<'a, FEN: FoundryEvmNetwork> InvariantExecutor<'a, FEN> {
             }
 
             runs += 1;
+            if stop_after_run {
+                break 'stop;
+            }
         }
 
         trace!(?fuzz_fixtures);
@@ -1004,18 +1001,6 @@ impl<'a, FEN: FoundryEvmNetwork> InvariantExecutor<'a, FEN> {
         if let Some(fuzzer) = self.executor.inspector_mut().fuzzer.as_mut() {
             fuzz_state.collect_values(fuzzer.drain_collected_values());
         }
-        // First broken invariant in declaration order (anchor first, then secondaries).
-        // Iterates `invariant_fns` so the lookup is deterministic, unlike HashMap iteration.
-        if let Some(error) =
-            invariant_contract.invariant_fns.iter().find_map(|(f, _)| failures.get_failure(f))
-        {
-            // Under `assert_all` we record the preflight break and let the campaign run for
-            // the full budget; legacy mode aborts on the first broken invariant.
-            if !self.config.assert_all {
-                return Err(eyre!(error.revert_reason().unwrap_or_default()));
-            }
-        }
-
         // NOW enable call_override after the initial invariant check has passed.
         // This allows `override_call_strat` to inject calls during actual fuzz runs
         // for reentrancy vulnerability detection.

crates/evm/fuzz/src/invariant/mod.rs

@@ -280,9 +280,9 @@ pub struct InvariantContract<'a> {
     /// Stored in **source declaration order** so failure-event attribution and report
     /// rendering match user expectations.
     pub invariant_fns: Vec<(&'a Function, bool)>,
-    /// Index into [`Self::invariant_fns`] of the campaign anchor — the function chosen by
-    /// the `--mt` filter (or the only one). Used for corpus and persistence file paths and
-    /// for the legacy single-invariant `TestResult.{reason, counterexample}` fields.
+    /// Index into [`Self::invariant_fns`] of the stable campaign anchor. Boolean invariant
+    /// suites use a deterministic contract-local anchor so test filters do not affect
+    /// corpus/failure namespaces.
     pub anchor_idx: usize,
     /// If true, `afterInvariant` function is called after each invariant run.
     pub call_after_invariant: bool,
@@ -305,8 +305,7 @@ impl<'a> InvariantContract<'a> {
         Self { address, name, invariant_fns, anchor_idx, call_after_invariant, abi }
     }
 
-    /// Returns the campaign anchor — the invariant matched by `--mt` (or the only one).
-    /// Used for corpus and persistence file paths and for legacy primary `TestResult` fields.
+    /// Returns the stable campaign anchor.
     pub fn anchor(&self) -> &'a Function {
         self.invariant_fns[self.anchor_idx].0
     }