js-rigor: reliability flows through every rule kind; multi_hop value collection fixed

Systemic reliability gap found by the probe sweep: the compiled evaluation
paths never emitted the reliability the engine computes.

- Compiled _evaluateDirect omitted the relation's reliability, and the
  chain/multi_hop rules hardcoded reliability: 1.0 — so check() results
  reported 1.0 for any rule whose decision came through a chain, multi_hop,
  union, intersection, exclusion, or defeasible combination.
- The chain and multi_hop traversals now track per-path reliability (product
  of edge reliabilities) and report the winning path's value; the compiled
  and fallback logical operators (union/intersection/exclusion, direct_list
  fast path, early exits) report the selected child's reliability
  (max/min child or OWA trace index; exclusion multiplies both legs), and
  normal-mode defeasible combines base x requires x defeater reliabilities.
- The checker's logical fast path dropped collectedValues from union/
  intersection/exclusion results; it now passes them through.
- MultiHopRule.valueManager was read off relationManager where the real
  arbiter keeps it on the arbiter — collectValues: true on a multi_hop rule
  with a value-carrying edge crashed the evaluation (error result, silent
  denial). Now resolved at the arbiter level with a relationManager
  fallback for stubs.

Campaign pins: reliability per kind (chain/multi_hop product, union/intersection
selected child, exclusion/defeasible product), and multi_hop value collection
through persistent and partial contexts.
This commit is contained in:
John Dvorak
2026-08-01 09:52:31 -07:00
parent f0dc14fb72
commit 4fd4e20bd0
53 changed files with 361 additions and 187 deletions
+6 -6
View File
@@ -68,7 +68,7 @@ describe('Authorization graph semantics (rigor)', () => {
rigor.crucible([
rigor.invariant('direct-exact', ({ error, errorMessage }) => !error && !errorMessage)
])
).run({ effort: 400, seed: 'authz-graph-direct' });
).run({ effort: 400, seed: 'authz-graph-direct' , artifacts: { dir: '', persist: 'never' }});
const inv = report.crucibleVerdict?.invariants?.find(i => i.name === 'direct-exact');
assert.ok(inv);
@@ -103,7 +103,7 @@ describe('Authorization graph semantics (rigor)', () => {
rigor.crucible([
rigor.invariant('absent-denies', ({ error, errorMessage }) => !error && !errorMessage)
])
).run({ effort: 300, seed: 'authz-graph-absent' });
).run({ effort: 300, seed: 'authz-graph-absent' , artifacts: { dir: '', persist: 'never' }});
const inv = report.crucibleVerdict?.invariants?.find(i => i.name === 'absent-denies');
assert.ok(inv);
@@ -146,7 +146,7 @@ describe('Authorization graph semantics (rigor)', () => {
rigor.crucible([
rigor.invariant('weakest-link', ({ error, errorMessage }) => !error && !errorMessage)
])
).run({ effort: 400, seed: 'authz-graph-chain' });
).run({ effort: 400, seed: 'authz-graph-chain' , artifacts: { dir: '', persist: 'never' }});
const inv = report.crucibleVerdict?.invariants?.find(i => i.name === 'weakest-link');
assert.ok(inv);
@@ -196,7 +196,7 @@ describe('Authorization graph semantics (rigor)', () => {
rigor.crucible([
rigor.invariant('disjunctive-max', ({ error, errorMessage }) => !error && !errorMessage)
])
).run({ effort: 500, seed: 'authz-graph-multipath' });
).run({ effort: 500, seed: 'authz-graph-multipath' , artifacts: { dir: '', persist: 'never' }});
const inv = report.crucibleVerdict?.invariants?.find(i => i.name === 'disjunctive-max');
assert.ok(inv);
@@ -248,7 +248,7 @@ describe('Authorization graph semantics (rigor)', () => {
rigor.crucible([
rigor.invariant('tus-weakest-link', ({ error, errorMessage }) => !error && !errorMessage)
])
).run({ effort: 400, seed: 'authz-graph-tus' });
).run({ effort: 400, seed: 'authz-graph-tus' , artifacts: { dir: '', persist: 'never' }});
const inv = report.crucibleVerdict?.invariants?.find(i => i.name === 'tus-weakest-link');
assert.ok(inv);
@@ -287,7 +287,7 @@ describe('Authorization graph semantics (rigor)', () => {
rigor.crucible([
rigor.invariant('revoke-invalidates', ({ error, errorMessage }) => !error && !errorMessage)
])
).run({ effort: 300, seed: 'authz-graph-mutation' });
).run({ effort: 300, seed: 'authz-graph-mutation' , artifacts: { dir: '', persist: 'never' }});
const inv = report.crucibleVerdict?.invariants?.find(i => i.name === 'revoke-invalidates');
assert.ok(inv);