initial commit: @arbiter/core authorization engine with js-rigor hardening

Zanzibar-style authorization graph engine (direct/chain/TTU/defeasible/ binary modes, condensed snapshots, value relations) with 39 rigor test campaigns. Includes fixes for snapshot binary writer/reader format mismatch (snapshot-of-snapshot corruption), possibility write-boundary validation, empty-graph snapshot serialization, relation lookup cache direction collision, config-redefinition cache invalidation, binary threshold semantics, defeasible compiled routing, and comparator reason whitelisting.
2026-07-31 13:44:06 -07:00
commit 717ae1031e
373 changed files with 654131 additions and 0 deletions
@@ -0,0 +1,59 @@
+/**
+ * rigor-smoke.test.js — verifies the @rigor/core import path works
+ * from the lib test directory and that a minimal campaign runs.
+ *
+ * If this test fails to import or run, none of the property tests below
+ * can ship.
+ */
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { rigor } from '@rigor/core';
+
+describe('js-rigor smoke', () => {
+  it('exports the rigor facade', () => {
+    assert.ok(rigor, 'rigor is exported');
+    assert.equal(typeof rigor.campaign, 'function');
+    assert.equal(typeof rigor.crucible, 'function');
+    assert.ok(rigor.gen, 'rigor.gen is available');
+  });
+
+  it('runs a minimal campaign and returns a report', async () => {
+    const report = await rigor.campaign(
+      [
+        rigor.fn('abs', (n) => Math.abs(n),
+          rigor.args(rigor.gen.int(-100, 100)),
+          rigor.metrics({ n: ({ args }) => args[0] }))
+      ],
+      rigor.crucible([
+        rigor.invariant('non-negative', ({ actual }) => actual >= 0),
+        rigor.invariant('idempotent', ({ actual, fn }) => fn(actual) === actual)
+      ])
+    ).run({ effort: 200 });
+
+    assert.ok(report, 'campaign returns a report');
+    assert.equal(typeof report.toTAP, 'function', 'report has toTAP()');
+    // The report should have iterated at least once
+    assert.ok(report.stats || report.coverage || report.summary,
+      'report has stats/coverage/summary');
+  });
+
+  it('detects a violated invariant with a minimal failing oracle', async () => {
+    const report = await rigor.campaign(
+      [
+        rigor.fn('alwaysZero', () => 0,
+          rigor.args(rigor.gen.int()))
+      ],
+      rigor.crucible([
+        rigor.invariant('equals-one', ({ actual }) => actual === 1)
+      ])
+    ).run({ effort: 50 });
+
+    // Report shape varies — log it for debugging.
+    if (process.env.TEST_DEBUG === '1') {
+      console.log('report keys:', Object.keys(report));
+      console.log('report.toTAP():', report.toTAP());
+    }
+    // At minimum the report should have *some* representation of the failure.
+    assert.ok(report, 'report returned');
+  });
+});