Arbiter/core
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

js-rigor: reliability flows through every rule kind; multi_hop value collection fixed

Browse Source 
Systemic reliability gap found by the probe sweep: the compiled evaluation
paths never emitted the reliability the engine computes.

- Compiled _evaluateDirect omitted the relation's reliability, and the
  chain/multi_hop rules hardcoded reliability: 1.0 — so check() results
  reported 1.0 for any rule whose decision came through a chain, multi_hop,
  union, intersection, exclusion, or defeasible combination.
- The chain and multi_hop traversals now track per-path reliability (product
  of edge reliabilities) and report the winning path's value; the compiled
  and fallback logical operators (union/intersection/exclusion, direct_list
  fast path, early exits) report the selected child's reliability
  (max/min child or OWA trace index; exclusion multiplies both legs), and
  normal-mode defeasible combines base x requires x defeater reliabilities.
- The checker's logical fast path dropped collectedValues from union/
  intersection/exclusion results; it now passes them through.
- MultiHopRule.valueManager was read off relationManager where the real
  arbiter keeps it on the arbiter — collectValues: true on a multi_hop rule
  with a value-carrying edge crashed the evaluation (error result, silent
  denial). Now resolved at the arbiter level with a relationManager
  fallback for stubs.

Campaign pins: reliability per kind (chain/multi_hop product, union/intersection
selected child, exclusion/defeasible product), and multi_hop value collection
through persistent and partial contexts.
This commit is contained in:
John Dvorak
2026-08-01 09:52:31 -07:00
parent f0dc14fb72
commit 4fd4e20bd0
53 changed files with 361 additions and 187 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/authorization/AuthorizationChecker.js
+1
View File
@@ -339,6 +339,7 @@ export class AuthorizationChecker {
const finalResult = {
possibility: resPossibility || 0,
reliability: res.reliability !== undefined ? res.reliability : 1.0,
...(collectValues && res.collectedValues && Array.isArray(res.collectedValues) && { collectedValues: res.collectedValues }),
...(includeMeta && {
meta: {
...restMeta, // Spread meta without allow/deny
src/authorization/CompiledEvaluator.js
+51
View File
@@ -142,6 +142,7 @@ export class CompiledEvaluator {
};
const result = {
possibility: relationStrength,
reliability: directRel.reliability !== undefined ? directRel.reliability : 1.0,
possibility_allow: relationStrength,
possibility_deny: 0,
...(includeMeta && {
@@ -404,6 +405,7 @@ export class CompiledEvaluator {
const children = compiled.children || [compiled];
const possibilities = [];
const reliabilities = [];
const metas = [];
const remediationOptions = [];
const allCollectedValues = collectValues ? [] : null;
@@ -418,6 +420,7 @@ export class CompiledEvaluator {
mergeRemediationOptions(remediationOptions, extractRemediation(res));
possibilities.push(res.possibility);
reliabilities.push(res.reliability !== undefined ? res.reliability : 1.0);
metas.push(includeMeta ? res.meta : null);
if (collectValues && res.collectedValues && Array.isArray(res.collectedValues)) {
@@ -431,6 +434,7 @@ export class CompiledEvaluator {
const remediation = buildRemediation(extractRemediation(res));
return {
possibility: res.possibility,
reliability: res.reliability !== undefined ? res.reliability : 1.0,
...(collectValues && { collectedValues: allCollectedValues }),
...(includeMeta && { meta: res.meta }),
...(remediation ? { remediation } : {})
@@ -441,6 +445,7 @@ export class CompiledEvaluator {
if (!possibilities.length) {
return {
possibility: 0,
reliability: 1.0,
...(collectValues && { collectedValues: allCollectedValues }),
...(includeMeta && { meta: { operation: 'union', childCount: 0 } })
};
@@ -459,8 +464,19 @@ export class CompiledEvaluator {
const remediation = result.value === 0
? buildRemediation(remediationOptions.length > 0 ? { status: 'required', options: remediationOptions } : null, { status: 'required' })
: null;
let unionReliability = 1.0;
if (includeOwaTrace && result.trace && typeof result.trace.selectedIndex === 'number') {
unionReliability = reliabilities[result.trace.selectedIndex] ?? 1.0;
} else if ((compiled.aggregator || 'max') === 'min') {
const minP = Math.min(...possibilities);
unionReliability = reliabilities[possibilities.indexOf(minP)] ?? 1.0;
} else {
const maxP = Math.max(...possibilities);
unionReliability = reliabilities[possibilities.indexOf(maxP)] ?? 1.0;
}
return {
possibility: result.value,
reliability: unionReliability,
...(collectValues && { collectedValues: allCollectedValues }),
...(includeMeta && {
meta: {
@@ -495,6 +511,7 @@ export class CompiledEvaluator {
return this._evaluateDirectList(compiled, userId, userKey, effectiveObjectId, effectiveObjectKey, visited, currentRelation, options, 'intersection');
}
const possibilities = [];
const reliabilities = [];
const metas = [];
const remediationOptions = [];
const allCollectedValues = collectValues ? [] : null;
@@ -508,6 +525,7 @@ export class CompiledEvaluator {
const childVisited = new Set(visited);
const res = this.evaluate(child, userId, userKey, objectId, objectKey, childVisited, currentRelation, options);
possibilities.push(res.possibility);
reliabilities.push(res.reliability !== undefined ? res.reliability : 1.0);
metas.push(includeMeta ? res.meta : null);
mergeRemediationOptions(remediationOptions, extractRemediation(res));
@@ -522,6 +540,7 @@ export class CompiledEvaluator {
if (fastPath && minPossibility !== null && res.possibility < minPossibility) {
return {
possibility: res.possibility,
reliability: res.reliability !== undefined ? res.reliability : 1.0,
...(collectValues && { collectedValues: allCollectedValues }),
...(includeMeta && { meta: res.meta })
};
@@ -531,6 +550,7 @@ export class CompiledEvaluator {
if (!possibilities.length) {
return {
possibility: 0,
reliability: 1.0,
...(collectValues && { collectedValues: allCollectedValues }),
...(includeMeta && { meta: { operation: 'intersection', childCount: 0 } })
};
@@ -554,8 +574,19 @@ export class CompiledEvaluator {
const remediation = result.value === 0
? buildRemediation(remediationOptions.length > 0 ? { status: 'required', options: remediationOptions } : null, { status: 'required' })
: null;
let intersectionReliability = 1.0;
if (includeOwaTrace && result.trace && typeof result.trace.selectedIndex === 'number') {
intersectionReliability = reliabilities[result.trace.selectedIndex] ?? 1.0;
} else if ((compiled.aggregator || 'min') === 'max') {
const maxP = Math.max(...possibilities);
intersectionReliability = reliabilities[possibilities.indexOf(maxP)] ?? 1.0;
} else {
const minP = Math.min(...possibilities);
intersectionReliability = reliabilities[possibilities.indexOf(minP)] ?? 1.0;
}
return {
possibility: result.value,
reliability: intersectionReliability,
...(collectValues && { collectedValues: allCollectedValues }),
...(includeMeta && {
meta: {
@@ -624,6 +655,9 @@ export class CompiledEvaluator {
return {
possibility,
// Both legs contribute to the decision, so their reliabilities
// multiply (consistent with TTU/chain path semantics).
reliability: (a.reliability !== undefined ? a.reliability : 1.0) * (b.reliability !== undefined ? b.reliability : 1.0),
...(collectValues && { collectedValues: allCollectedValues }),
...(includeMeta && {
meta: {
@@ -652,6 +686,7 @@ export class CompiledEvaluator {
const owaTraceOptions = includeOwaTrace ? { includeTrace: true } : null;
const possibilities = [];
const reliabilities = [];
const metas = [];
const allCollectedValues = collectValues ? [] : null;
const directRules = compiled._optimized.direct;
@@ -666,6 +701,7 @@ export class CompiledEvaluator {
const possibility = directRel ? directRel.possibility : 0;
possibilities.push(possibility);
reliabilities.push(directRel ? (directRel.reliability !== undefined ? directRel.reliability : 1.0) : 1.0);
if (includeMeta) {
const _src = directRel ? (directRel.source || 'persistent') : null;
const _allowMeta = directRel ? {
@@ -717,6 +753,7 @@ export class CompiledEvaluator {
if (op === 'union' && possibility >= minPossibility) {
return {
possibility,
reliability: directRel ? (directRel.reliability !== undefined ? directRel.reliability : 1.0) : 1.0,
...(collectValues && { collectedValues: allCollectedValues }),
...(includeMeta && { meta: metas[metas.length - 1] })
};
@@ -724,6 +761,7 @@ export class CompiledEvaluator {
if (op === 'intersection' && possibility < minPossibility) {
return {
possibility,
reliability: directRel ? (directRel.reliability !== undefined ? directRel.reliability : 1.0) : 1.0,
...(collectValues && { collectedValues: allCollectedValues }),
...(includeMeta && { meta: metas[metas.length - 1] })
};
@@ -734,6 +772,7 @@ export class CompiledEvaluator {
if (!possibilities.length) {
return {
possibility: 0,
reliability: 1.0,
...(collectValues && { collectedValues: allCollectedValues }),
...(includeMeta && { meta: { operation: op, childCount: 0 } })
};
@@ -745,8 +784,20 @@ export class CompiledEvaluator {
const aggregator = op === 'intersection' ? (compiled.aggregator || 'min') : (compiled.aggregator || 'max');
const result = OWAFusion.fuseWithMeta(possibilities, metas, weights, aggregator, true, owaTraceOptions);
let listReliability = 1.0;
if (includeOwaTrace && result.trace && typeof result.trace.selectedIndex === 'number') {
listReliability = reliabilities[result.trace.selectedIndex] ?? 1.0;
} else if (aggregator === 'min') {
const minP = Math.min(...possibilities);
listReliability = reliabilities[possibilities.indexOf(minP)] ?? 1.0;
} else {
const maxP = Math.max(...possibilities);
listReliability = reliabilities[possibilities.indexOf(maxP)] ?? 1.0;
}
return {
possibility: result.value,
reliability: listReliability,
...(collectValues && { collectedValues: allCollectedValues }),
...(includeMeta && {
meta: {
src/authorization/rules/ChainRule.js
+15 -4
View File
@@ -239,13 +239,16 @@ export class ChainRule extends BaseRule {
// Deduplicate: keep best path per node
const existing = pathMap.get(nextId);
if (existing && existing.possibility >= nextPossibility) continue;
const nextReliability = (currentPath.reliability ?? 1.0) * (rel.reliability ?? 1.0);
if (existing && existing.possibility > nextPossibility) continue;
if (existing && existing.possibility === nextPossibility && (existing.reliability ?? 1.0) >= nextReliability) continue;
// Create extended path
const extendedPath = {
id: nextId,
key: nextKey,
possibility: nextPossibility,
reliability: nextReliability,
path: [...currentPath.path, nextKey],
pathEntities: [...currentPath.pathEntities, { id: nextId, key: nextKey, source: rel.source || 'persistent' }]
};
@@ -269,10 +272,18 @@ export class ChainRule extends BaseRule {
const targetId = reverse ? userIdNum : objectIdNum;
const targetPaths = currentPaths.filter(path => path.id === targetId);
let finalPossibility = 0;
let finalReliability = 1.0;
if (targetPaths.length > 0) {
// Use MAX across paths (disjunctive)
finalPossibility = Math.max(...targetPaths.map(path => path.possibility));
// Use MAX across paths (disjunctive); the winning path's reliability
// is the product of its edges' reliabilities (MIN along the chain).
const best = targetPaths.reduce((a, b) =>
(b.possibility > a.possibility ||
(b.possibility === a.possibility && (b.reliability ?? 1.0) > (a.reliability ?? 1.0)))
? b : a
);
finalPossibility = best.possibility;
finalReliability = best.reliability ?? 1.0;
}
if (fastPath && finalPossibility < minPossibility) {
@@ -338,7 +349,7 @@ export class ChainRule extends BaseRule {
// Build authorization result with single possibility value
const authResult = {
possibility: finalPossibility,
reliability: 1.0,
reliability: finalReliability,
...(includeMeta && {
meta: finalPossibility > 0 ? {
ruleType: 'chain',
src/authorization/rules/LogicalOperators.js
+47 -2
View File
@@ -791,13 +791,19 @@ export class LogicalOperators extends BaseRule {
let possibility = 0;
let resultMeta = {};
// Reliability mirrors the possibility combination: the base leg's
// reliability is eroded by requirements and defeaters (both legs of
// each combination matter), consistent with TTU path semantics.
let reliability = 1.0;
// NEVER rules override everything when their evidence possibility exceeds threshold (0.5 default)
if (neverResult && neverResult.possibility >= 0.5) {
possibility = 0;
reliability = neverResult.reliability !== undefined ? neverResult.reliability : 1.0;
resultMeta = { ...neverResult.meta, never: true };
return {
possibility: 0,
reliability,
collectedValues: allCollectedValues,
meta: {
...resultMeta,
@@ -817,6 +823,7 @@ export class LogicalOperators extends BaseRule {
// Start with defeasible rules as base
if (defeasibleResult) {
possibility = defeasibleResult.possibility;
reliability = defeasibleResult.reliability !== undefined ? defeasibleResult.reliability : 1.0;
resultMeta = { ...defeasibleResult.meta };
}
@@ -824,6 +831,7 @@ export class LogicalOperators extends BaseRule {
if (strictResult) {
possibility = Math.max(possibility, strictResult.possibility);
if (strictResult.possibility > (defeasibleResult?.possibility || 0)) {
reliability = strictResult.reliability !== undefined ? strictResult.reliability : 1.0;
resultMeta = { ...strictResult.meta };
}
}
@@ -832,6 +840,7 @@ export class LogicalOperators extends BaseRule {
if (requiresResult) {
const reqStrength = requiresResult.possibility;
possibility = possibility * reqStrength; // Requirements failure reduces possibility
reliability = reliability * (requiresResult.reliability !== undefined ? requiresResult.reliability : 1.0);
if (reqStrength < 0.5) {
resultMeta = { ...requiresResult.meta, requirementsFailed: requiresResult.meta };
}
@@ -841,6 +850,7 @@ export class LogicalOperators extends BaseRule {
if (defeatersResult) {
const defeatStrength = defeatersResult.possibility;
possibility = possibility * (1 - defeatStrength); // Defeaters erode possibility
reliability = reliability * (defeatersResult.reliability !== undefined ? defeatersResult.reliability : 1.0);
if (defeatStrength > 0.5) {
resultMeta = { ...defeatersResult.meta, defeatedBy: defeatersResult.meta };
}
@@ -848,6 +858,7 @@ export class LogicalOperators extends BaseRule {
return {
possibility: Math.max(0, Math.min(1, possibility)),
reliability,
collectedValues: allCollectedValues,
meta: {
...resultMeta,
@@ -874,7 +885,7 @@ export class LogicalOperators extends BaseRule {
const unionConfig = normalizedRule.union;
const childRules = unionConfig.rules || [];
let possibilities = [], metas = [], reasons = [];
let possibilities = [], reliabilities = [], metas = [], reasons = [];
const remediationOptions = [];
const { fastPath = false, minPossibility = null, valueContext = null, collectValues = false, includeMeta = true, trackEvaluation = false } = options;
const allCollectedValues = collectValues ? [] : null; // Track collected values from all child rules
@@ -893,6 +904,7 @@ export class LogicalOperators extends BaseRule {
if (res.reason === 'cycle') reasons.push('cycle');
mergeRemediationOptions(remediationOptions, extractRemediation(res));
possibilities.push(res.possibility);
reliabilities.push(res.reliability !== undefined ? res.reliability : 1.0);
metas.push(includeMeta ? res.meta : null);
// Collect values from child rule results
@@ -917,6 +929,7 @@ export class LogicalOperators extends BaseRule {
const remediation = buildRemediation(extractRemediation(res));
return {
possibility: res.possibility,
reliability: res.reliability !== undefined ? res.reliability : 1.0,
...(collectValues && { collectedValues: allCollectedValues }), // Include all collected values so far
...(includeMeta && { meta: res.meta }),
...(remediation ? { remediation } : {}),
@@ -929,6 +942,7 @@ export class LogicalOperators extends BaseRule {
if (!possibilities.length) {
return {
possibility: 0,
reliability: 1.0,
...(collectValues && { collectedValues: allCollectedValues }),
...(includeMeta && { meta: { operation: 'union', childCount: 0 } }),
reason: reasons.includes('cycle') ? 'cycle' : undefined
@@ -1002,8 +1016,22 @@ export class LogicalOperators extends BaseRule {
const unionRemediation = result.value === 0
? buildRemediation(remediationOptions.length > 0 ? { status: 'required', options: remediationOptions } : null, { status: 'required' })
: null;
// Reliability of the child driving the fused value: the OWA selected
// source when traced, else the max/min possibility child (max is the
// default union aggregator).
let unionReliability = 1.0;
if (includeOwaTrace && result.trace && typeof result.trace.selectedIndex === 'number') {
unionReliability = reliabilities[result.trace.selectedIndex] ?? 1.0;
} else if ((unionConfig.aggregator || 'max') === 'min') {
const minP = Math.min(...possibilities);
unionReliability = reliabilities[possibilities.indexOf(minP)] ?? 1.0;
} else {
const maxP = Math.max(...possibilities);
unionReliability = reliabilities[possibilities.indexOf(maxP)] ?? 1.0;
}
return {
possibility: result.value,
reliability: unionReliability,
...(collectValues && { collectedValues: allCollectedValues }), // Include all collected values from child rules
...(includeMeta && {
meta: {
@@ -1039,7 +1067,7 @@ export class LogicalOperators extends BaseRule {
const intersectionConfig = normalizedRule.intersection;
const childRules = intersectionConfig.rules || [];
let possibilities = [], metas = [], reasons = [];
let possibilities = [], reliabilities = [], metas = [], reasons = [];
const remediationOptions = [];
const { fastPath = false, minPossibility = null, valueContext = null, collectValues = false, includeMeta = true, trackEvaluation = false } = options;
const allCollectedValues = collectValues ? [] : null; // Track collected values from all child rules
@@ -1059,6 +1087,7 @@ export class LogicalOperators extends BaseRule {
const res = this.ruleEvaluator.evaluateRule(userId, userKey, objectId, objectKey, child, visited, currentRelation, options);
if (res.reason === 'cycle') reasons.push('cycle');
possibilities.push(res.possibility);
reliabilities.push(res.reliability !== undefined ? res.reliability : 1.0);
metas.push(includeMeta ? res.meta : null);
mergeRemediationOptions(remediationOptions, extractRemediation(res));
@@ -1128,8 +1157,21 @@ export class LogicalOperators extends BaseRule {
const intersectionRemediation = result.value === 0
? buildRemediation(remediationOptions.length > 0 ? { status: 'required', options: remediationOptions } : null, { status: 'required' })
: null;
// Reliability of the child driving the fused value (min is the
// default intersection aggregator).
let intersectionReliability = 1.0;
if (includeOwaTrace && result.trace && typeof result.trace.selectedIndex === 'number') {
intersectionReliability = reliabilities[result.trace.selectedIndex] ?? 1.0;
} else if ((intersectionConfig.aggregator || 'min') === 'max') {
const maxP = Math.max(...possibilities);
intersectionReliability = reliabilities[possibilities.indexOf(maxP)] ?? 1.0;
} else {
const minP = Math.min(...possibilities);
intersectionReliability = reliabilities[possibilities.indexOf(minP)] ?? 1.0;
}
return {
possibility: result.value,
reliability: intersectionReliability,
...(collectValues && { collectedValues: allCollectedValues }), // Include all collected values from child rules
...(includeMeta && {
meta: {
@@ -1251,6 +1293,9 @@ export class LogicalOperators extends BaseRule {
return {
possibility,
// Both legs contribute to the decision, so their reliabilities
// multiply (consistent with TTU/chain path semantics).
reliability: (a.reliability !== undefined ? a.reliability : 1.0) * (b.reliability !== undefined ? b.reliability : 1.0),
// In binary mode the negated child's strength is the deny side of the
// dual-threshold contract: deny fires when P(B) >= maxDenyPossibility.
...(options.binary && { possibility_deny: b.possibility ?? 0 }),
src/authorization/rules/MultiHopRule.js
+15 -7
View File
@@ -121,6 +121,7 @@ export class MultiHopRule extends BaseRule {
new Set(),
[],
1.0,
1.0,
reverse,
collectValuesEnabled,
trackPaths,
@@ -162,7 +163,7 @@ export class MultiHopRule extends BaseRule {
}
// Aggregate paths to get final possibility
const { finalPossibility, bestPath } = this._aggregatePaths(
const { finalPossibility, finalReliability = 1.0, bestPath } = this._aggregatePaths(
pathsWithValues, pathAggregation, owaWeights, evaluation, options.trackEvaluation
);
@@ -215,7 +216,7 @@ export class MultiHopRule extends BaseRule {
const authResult = {
possibility: finalPossibility,
reliability: 1.0,
reliability: finalReliability,
...(includeMeta && {
meta: allowMeta
}),
@@ -231,7 +232,7 @@ export class MultiHopRule extends BaseRule {
* @private
*/
_findPathsAndCollectValues(startId, endId, relation, maxDepth,
visited, currentPath = [], currentPoss = 1.0,
visited, currentPath = [], currentPoss = 1.0, currentReliability = 1.0,
reverse = false, collectValues = true,
trackPaths = true,
stopSignal = null,
@@ -250,6 +251,7 @@ export class MultiHopRule extends BaseRule {
nodeIds: trackPaths ? [...currentPath.map(step => step.nodeId), endId] : [endId],
hops: currentPath.length,
possibility: currentPoss,
reliability: currentReliability,
collectedValues: [],
pathSteps: trackPaths ? [...currentPath] : null
};
@@ -300,6 +302,7 @@ export class MultiHopRule extends BaseRule {
if (!nextKey) continue;
const nextPoss = Math.min(currentPoss, edge.possibility ?? 1.0);
const nextReliability = currentReliability * (edge.reliability !== undefined ? edge.reliability : 1.0);
if (fastPath && nextPoss < minPossibility) continue;
const pathStep = (collectValues || trackPaths) ? {
@@ -321,6 +324,7 @@ export class MultiHopRule extends BaseRule {
visited,
nextPath,
nextPoss,
nextReliability,
reverse,
collectValues,
trackPaths,
@@ -346,6 +350,9 @@ export class MultiHopRule extends BaseRule {
*/
_collectValuesFromPath(pathSteps, defaultRelation, valueFilters, valueContext) {
const collectedValues = [];
// Get blurred interval from ValueManager (arbiter-level; some stubs and
// older layouts keep it on the relation manager)
const valueManager = this.arbiter.valueManager || this.arbiter.relationManager?.valueManager;
for (let stepIndex = 0; stepIndex < pathSteps.length; stepIndex++) {
const step = pathSteps[stepIndex];
@@ -375,8 +382,7 @@ export class MultiHopRule extends BaseRule {
continue;
}
// Get blurred interval from ValueManager
const blurred = this.arbiter.relationManager.valueManager.getBlurredValue(step.edge);
const blurred = valueManager.getBlurredValue(step.edge);
if (blurred.interval) {
const collectedValue = this._createCollectedValue(
@@ -439,7 +445,7 @@ export class MultiHopRule extends BaseRule {
changed_last_at: contextValue.timestamp
};
const blurred = this.arbiter.relationManager.valueManager.getBlurredValue(tempRelation);
const blurred = valueManager.getBlurredValue(tempRelation);
if (blurred.interval) {
const collectedValue = this._createCollectedValue(
@@ -503,6 +509,7 @@ export class MultiHopRule extends BaseRule {
const path = pathsWithValues[0];
return {
finalPossibility: path.possibility,
finalReliability: path.reliability !== undefined ? path.reliability : 1.0,
bestPath: path
};
}
@@ -597,7 +604,8 @@ export class MultiHopRule extends BaseRule {
}
return {
finalPossibility: possibilityResult.value,
finalPossibility: possibilityResult.value,
finalReliability: bestPath ? (bestPath.reliability !== undefined ? bestPath.reliability : 1.0) : 1.0,
bestPath
};
}