Arbiter/core
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

js-rigor: reliability flows through every rule kind; multi_hop value collection fixed

Browse Source 
Systemic reliability gap found by the probe sweep: the compiled evaluation
paths never emitted the reliability the engine computes.

- Compiled _evaluateDirect omitted the relation's reliability, and the
  chain/multi_hop rules hardcoded reliability: 1.0 — so check() results
  reported 1.0 for any rule whose decision came through a chain, multi_hop,
  union, intersection, exclusion, or defeasible combination.
- The chain and multi_hop traversals now track per-path reliability (product
  of edge reliabilities) and report the winning path's value; the compiled
  and fallback logical operators (union/intersection/exclusion, direct_list
  fast path, early exits) report the selected child's reliability
  (max/min child or OWA trace index; exclusion multiplies both legs), and
  normal-mode defeasible combines base x requires x defeater reliabilities.
- The checker's logical fast path dropped collectedValues from union/
  intersection/exclusion results; it now passes them through.
- MultiHopRule.valueManager was read off relationManager where the real
  arbiter keeps it on the arbiter — collectValues: true on a multi_hop rule
  with a value-carrying edge crashed the evaluation (error result, silent
  denial). Now resolved at the arbiter level with a relationManager
  fallback for stubs.

Campaign pins: reliability per kind (chain/multi_hop product, union/intersection
selected child, exclusion/defeasible product), and multi_hop value collection
through persistent and partial contexts.
This commit is contained in:
John Dvorak
2026-08-01 09:52:31 -07:00
parent f0dc14fb72
commit 4fd4e20bd0
53 changed files with 361 additions and 187 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/authorization/rules/ChainRule.js
+15 -4
View File
@@ -239,13 +239,16 @@ export class ChainRule extends BaseRule {
// Deduplicate: keep best path per node
const existing = pathMap.get(nextId);
if (existing && existing.possibility >= nextPossibility) continue;
const nextReliability = (currentPath.reliability ?? 1.0) * (rel.reliability ?? 1.0);
if (existing && existing.possibility > nextPossibility) continue;
if (existing && existing.possibility === nextPossibility && (existing.reliability ?? 1.0) >= nextReliability) continue;
// Create extended path
const extendedPath = {
id: nextId,
key: nextKey,
possibility: nextPossibility,
reliability: nextReliability,
path: [...currentPath.path, nextKey],
pathEntities: [...currentPath.pathEntities, { id: nextId, key: nextKey, source: rel.source || 'persistent' }]
};
@@ -269,10 +272,18 @@ export class ChainRule extends BaseRule {
const targetId = reverse ? userIdNum : objectIdNum;
const targetPaths = currentPaths.filter(path => path.id === targetId);
let finalPossibility = 0;
let finalReliability = 1.0;
if (targetPaths.length > 0) {
// Use MAX across paths (disjunctive)
finalPossibility = Math.max(...targetPaths.map(path => path.possibility));
// Use MAX across paths (disjunctive); the winning path's reliability
// is the product of its edges' reliabilities (MIN along the chain).
const best = targetPaths.reduce((a, b) =>
(b.possibility > a.possibility ||
(b.possibility === a.possibility && (b.reliability ?? 1.0) > (a.reliability ?? 1.0)))
? b : a
);
finalPossibility = best.possibility;
finalReliability = best.reliability ?? 1.0;
}
if (fastPath && finalPossibility < minPossibility) {
@@ -338,7 +349,7 @@ export class ChainRule extends BaseRule {
// Build authorization result with single possibility value
const authResult = {
possibility: finalPossibility,
reliability: 1.0,
reliability: finalReliability,
...(includeMeta && {
meta: finalPossibility > 0 ? {
ruleType: 'chain',
src/authorization/rules/LogicalOperators.js
+47 -2
View File
@@ -791,13 +791,19 @@ export class LogicalOperators extends BaseRule {
let possibility = 0;
let resultMeta = {};
// Reliability mirrors the possibility combination: the base leg's
// reliability is eroded by requirements and defeaters (both legs of
// each combination matter), consistent with TTU path semantics.
let reliability = 1.0;
// NEVER rules override everything when their evidence possibility exceeds threshold (0.5 default)
if (neverResult && neverResult.possibility >= 0.5) {
possibility = 0;
reliability = neverResult.reliability !== undefined ? neverResult.reliability : 1.0;
resultMeta = { ...neverResult.meta, never: true };
return {
possibility: 0,
reliability,
collectedValues: allCollectedValues,
meta: {
...resultMeta,
@@ -817,6 +823,7 @@ export class LogicalOperators extends BaseRule {
// Start with defeasible rules as base
if (defeasibleResult) {
possibility = defeasibleResult.possibility;
reliability = defeasibleResult.reliability !== undefined ? defeasibleResult.reliability : 1.0;
resultMeta = { ...defeasibleResult.meta };
}
@@ -824,6 +831,7 @@ export class LogicalOperators extends BaseRule {
if (strictResult) {
possibility = Math.max(possibility, strictResult.possibility);
if (strictResult.possibility > (defeasibleResult?.possibility || 0)) {
reliability = strictResult.reliability !== undefined ? strictResult.reliability : 1.0;
resultMeta = { ...strictResult.meta };
}
}
@@ -832,6 +840,7 @@ export class LogicalOperators extends BaseRule {
if (requiresResult) {
const reqStrength = requiresResult.possibility;
possibility = possibility * reqStrength; // Requirements failure reduces possibility
reliability = reliability * (requiresResult.reliability !== undefined ? requiresResult.reliability : 1.0);
if (reqStrength < 0.5) {
resultMeta = { ...requiresResult.meta, requirementsFailed: requiresResult.meta };
}
@@ -841,6 +850,7 @@ export class LogicalOperators extends BaseRule {
if (defeatersResult) {
const defeatStrength = defeatersResult.possibility;
possibility = possibility * (1 - defeatStrength); // Defeaters erode possibility
reliability = reliability * (defeatersResult.reliability !== undefined ? defeatersResult.reliability : 1.0);
if (defeatStrength > 0.5) {
resultMeta = { ...defeatersResult.meta, defeatedBy: defeatersResult.meta };
}
@@ -848,6 +858,7 @@ export class LogicalOperators extends BaseRule {
return {
possibility: Math.max(0, Math.min(1, possibility)),
reliability,
collectedValues: allCollectedValues,
meta: {
...resultMeta,
@@ -874,7 +885,7 @@ export class LogicalOperators extends BaseRule {
const unionConfig = normalizedRule.union;
const childRules = unionConfig.rules || [];
let possibilities = [], metas = [], reasons = [];
let possibilities = [], reliabilities = [], metas = [], reasons = [];
const remediationOptions = [];
const { fastPath = false, minPossibility = null, valueContext = null, collectValues = false, includeMeta = true, trackEvaluation = false } = options;
const allCollectedValues = collectValues ? [] : null; // Track collected values from all child rules
@@ -893,6 +904,7 @@ export class LogicalOperators extends BaseRule {
if (res.reason === 'cycle') reasons.push('cycle');
mergeRemediationOptions(remediationOptions, extractRemediation(res));
possibilities.push(res.possibility);
reliabilities.push(res.reliability !== undefined ? res.reliability : 1.0);
metas.push(includeMeta ? res.meta : null);
// Collect values from child rule results
@@ -917,6 +929,7 @@ export class LogicalOperators extends BaseRule {
const remediation = buildRemediation(extractRemediation(res));
return {
possibility: res.possibility,
reliability: res.reliability !== undefined ? res.reliability : 1.0,
...(collectValues && { collectedValues: allCollectedValues }), // Include all collected values so far
...(includeMeta && { meta: res.meta }),
...(remediation ? { remediation } : {}),
@@ -929,6 +942,7 @@ export class LogicalOperators extends BaseRule {
if (!possibilities.length) {
return {
possibility: 0,
reliability: 1.0,
...(collectValues && { collectedValues: allCollectedValues }),
...(includeMeta && { meta: { operation: 'union', childCount: 0 } }),
reason: reasons.includes('cycle') ? 'cycle' : undefined
@@ -1002,8 +1016,22 @@ export class LogicalOperators extends BaseRule {
const unionRemediation = result.value === 0
? buildRemediation(remediationOptions.length > 0 ? { status: 'required', options: remediationOptions } : null, { status: 'required' })
: null;
// Reliability of the child driving the fused value: the OWA selected
// source when traced, else the max/min possibility child (max is the
// default union aggregator).
let unionReliability = 1.0;
if (includeOwaTrace && result.trace && typeof result.trace.selectedIndex === 'number') {
unionReliability = reliabilities[result.trace.selectedIndex] ?? 1.0;
} else if ((unionConfig.aggregator || 'max') === 'min') {
const minP = Math.min(...possibilities);
unionReliability = reliabilities[possibilities.indexOf(minP)] ?? 1.0;
} else {
const maxP = Math.max(...possibilities);
unionReliability = reliabilities[possibilities.indexOf(maxP)] ?? 1.0;
}
return {
possibility: result.value,
reliability: unionReliability,
...(collectValues && { collectedValues: allCollectedValues }), // Include all collected values from child rules
...(includeMeta && {
meta: {
@@ -1039,7 +1067,7 @@ export class LogicalOperators extends BaseRule {
const intersectionConfig = normalizedRule.intersection;
const childRules = intersectionConfig.rules || [];
let possibilities = [], metas = [], reasons = [];
let possibilities = [], reliabilities = [], metas = [], reasons = [];
const remediationOptions = [];
const { fastPath = false, minPossibility = null, valueContext = null, collectValues = false, includeMeta = true, trackEvaluation = false } = options;
const allCollectedValues = collectValues ? [] : null; // Track collected values from all child rules
@@ -1059,6 +1087,7 @@ export class LogicalOperators extends BaseRule {
const res = this.ruleEvaluator.evaluateRule(userId, userKey, objectId, objectKey, child, visited, currentRelation, options);
if (res.reason === 'cycle') reasons.push('cycle');
possibilities.push(res.possibility);
reliabilities.push(res.reliability !== undefined ? res.reliability : 1.0);
metas.push(includeMeta ? res.meta : null);
mergeRemediationOptions(remediationOptions, extractRemediation(res));
@@ -1128,8 +1157,21 @@ export class LogicalOperators extends BaseRule {
const intersectionRemediation = result.value === 0
? buildRemediation(remediationOptions.length > 0 ? { status: 'required', options: remediationOptions } : null, { status: 'required' })
: null;
// Reliability of the child driving the fused value (min is the
// default intersection aggregator).
let intersectionReliability = 1.0;
if (includeOwaTrace && result.trace && typeof result.trace.selectedIndex === 'number') {
intersectionReliability = reliabilities[result.trace.selectedIndex] ?? 1.0;
} else if ((intersectionConfig.aggregator || 'min') === 'max') {
const maxP = Math.max(...possibilities);
intersectionReliability = reliabilities[possibilities.indexOf(maxP)] ?? 1.0;
} else {
const minP = Math.min(...possibilities);
intersectionReliability = reliabilities[possibilities.indexOf(minP)] ?? 1.0;
}
return {
possibility: result.value,
reliability: intersectionReliability,
...(collectValues && { collectedValues: allCollectedValues }), // Include all collected values from child rules
...(includeMeta && {
meta: {
@@ -1251,6 +1293,9 @@ export class LogicalOperators extends BaseRule {
return {
possibility,
// Both legs contribute to the decision, so their reliabilities
// multiply (consistent with TTU/chain path semantics).
reliability: (a.reliability !== undefined ? a.reliability : 1.0) * (b.reliability !== undefined ? b.reliability : 1.0),
// In binary mode the negated child's strength is the deny side of the
// dual-threshold contract: deny fires when P(B) >= maxDenyPossibility.
...(options.binary && { possibility_deny: b.possibility ?? 0 }),
src/authorization/rules/MultiHopRule.js
+15 -7
View File
@@ -121,6 +121,7 @@ export class MultiHopRule extends BaseRule {
new Set(),
[],
1.0,
1.0,
reverse,
collectValuesEnabled,
trackPaths,
@@ -162,7 +163,7 @@ export class MultiHopRule extends BaseRule {
}
// Aggregate paths to get final possibility
const { finalPossibility, bestPath } = this._aggregatePaths(
const { finalPossibility, finalReliability = 1.0, bestPath } = this._aggregatePaths(
pathsWithValues, pathAggregation, owaWeights, evaluation, options.trackEvaluation
);
@@ -215,7 +216,7 @@ export class MultiHopRule extends BaseRule {
const authResult = {
possibility: finalPossibility,
reliability: 1.0,
reliability: finalReliability,
...(includeMeta && {
meta: allowMeta
}),
@@ -231,7 +232,7 @@ export class MultiHopRule extends BaseRule {
* @private
*/
_findPathsAndCollectValues(startId, endId, relation, maxDepth,
visited, currentPath = [], currentPoss = 1.0,
visited, currentPath = [], currentPoss = 1.0, currentReliability = 1.0,
reverse = false, collectValues = true,
trackPaths = true,
stopSignal = null,
@@ -250,6 +251,7 @@ export class MultiHopRule extends BaseRule {
nodeIds: trackPaths ? [...currentPath.map(step => step.nodeId), endId] : [endId],
hops: currentPath.length,
possibility: currentPoss,
reliability: currentReliability,
collectedValues: [],
pathSteps: trackPaths ? [...currentPath] : null
};
@@ -300,6 +302,7 @@ export class MultiHopRule extends BaseRule {
if (!nextKey) continue;
const nextPoss = Math.min(currentPoss, edge.possibility ?? 1.0);
const nextReliability = currentReliability * (edge.reliability !== undefined ? edge.reliability : 1.0);
if (fastPath && nextPoss < minPossibility) continue;
const pathStep = (collectValues || trackPaths) ? {
@@ -321,6 +324,7 @@ export class MultiHopRule extends BaseRule {
visited,
nextPath,
nextPoss,
nextReliability,
reverse,
collectValues,
trackPaths,
@@ -346,6 +350,9 @@ export class MultiHopRule extends BaseRule {
*/
_collectValuesFromPath(pathSteps, defaultRelation, valueFilters, valueContext) {
const collectedValues = [];
// Get blurred interval from ValueManager (arbiter-level; some stubs and
// older layouts keep it on the relation manager)
const valueManager = this.arbiter.valueManager || this.arbiter.relationManager?.valueManager;
for (let stepIndex = 0; stepIndex < pathSteps.length; stepIndex++) {
const step = pathSteps[stepIndex];
@@ -375,8 +382,7 @@ export class MultiHopRule extends BaseRule {
continue;
}
// Get blurred interval from ValueManager
const blurred = this.arbiter.relationManager.valueManager.getBlurredValue(step.edge);
const blurred = valueManager.getBlurredValue(step.edge);
if (blurred.interval) {
const collectedValue = this._createCollectedValue(
@@ -439,7 +445,7 @@ export class MultiHopRule extends BaseRule {
changed_last_at: contextValue.timestamp
};
const blurred = this.arbiter.relationManager.valueManager.getBlurredValue(tempRelation);
const blurred = valueManager.getBlurredValue(tempRelation);
if (blurred.interval) {
const collectedValue = this._createCollectedValue(
@@ -503,6 +509,7 @@ export class MultiHopRule extends BaseRule {
const path = pathsWithValues[0];
return {
finalPossibility: path.possibility,
finalReliability: path.reliability !== undefined ? path.reliability : 1.0,
bestPath: path
};
}
@@ -597,7 +604,8 @@ export class MultiHopRule extends BaseRule {
}
return {
finalPossibility: possibilityResult.value,
finalPossibility: possibilityResult.value,
finalReliability: bestPath ? (bestPath.reliability !== undefined ? bestPath.reliability : 1.0) : 1.0,
bestPath
};
}