initial commit: @arbiter/core authorization engine with js-rigor hardening

Zanzibar-style authorization graph engine (direct/chain/TTU/defeasible/
binary modes, condensed snapshots, value relations) with 39 rigor test
campaigns. Includes fixes for snapshot binary writer/reader format
mismatch (snapshot-of-snapshot corruption), possibility write-boundary
validation, empty-graph snapshot serialization, relation lookup cache
direction collision, config-redefinition cache invalidation, binary
threshold semantics, defeasible compiled routing, and comparator
reason whitelisting.

tests/rules/direct-rule.test.js

@@ -0,0 +1,76 @@
+import { DirectRule } from '../../src/authorization/rules/DirectRule.js';
+import { Arbiter } from '../../src/core/Arbiter.js';
+import { describe, it, beforeEach } from 'node:test';
+import assert from 'node:assert/strict';
+
+describe('DirectRule', () => {
+  let arbiter;
+  let rule;
+  let directRule;
+
+  beforeEach(() => {
+    // Minimal mock Arbiter with indices
+    arbiter = {
+      relationManager: {
+        getDirectRelation: (src, rel, dst) => {
+          if (rel === 'friend' && src === 'alice' && dst === 'bob') {
+            return { possibility: 0.9, value: 42, changed_last_at: Date.now() };
+          }
+          if (rel === 'friend' && src === 'bob' && dst === 'alice') {
+            return { possibility: 0.7, value: 24, changed_last_at: Date.now() };
+          }
+          if (rel === 'colleague' && src === 'alice' && dst === 'carol') {
+            return { possibility: 0.5 };
+          }
+          return null;
+        }
+      },
+      keyByNodeId: new Map([
+        ['alice', 'alice'],
+        ['bob', 'bob'],
+        ['carol', 'carol']
+      ])
+    };
+    directRule = new DirectRule(arbiter);
+  });
+
+  it('returns correct possibility and collected value for direct relation', () => {
+    rule = { type: 'direct', relation: 'friend' };
+    const res = directRule.evaluate('alice', 'alice', 'bob', 'bob', rule, {}, null, {});
+    assert.strictEqual(res.possibility, 0.9);
+    assert.ok(Array.isArray(res.collectedValues));
+    assert.strictEqual(res.collectedValues.length, 1);
+    assert.strictEqual(res.collectedValues[0].value, 42);
+  });
+
+  it('returns correct possibility and collected value for reverse relation', () => {
+    rule = { type: 'direct', relation: 'friend', reverse: true };
+    const res = directRule.evaluate('alice', 'alice', 'bob', 'bob', rule, {}, null, {});
+    assert.strictEqual(res.possibility, 0.7);
+    assert.ok(Array.isArray(res.collectedValues));
+    assert.strictEqual(res.collectedValues.length, 1);
+    assert.strictEqual(res.collectedValues[0].value, 24);
+  });
+
+  it('returns no collected values if relation has no value', () => {
+    rule = { type: 'direct', relation: 'colleague' };
+    const res = directRule.evaluate('alice', 'alice', 'carol', 'carol', rule, {}, null, {});
+    assert.strictEqual(res.possibility, 0.5);
+    assert.ok(Array.isArray(res.collectedValues));
+    assert.strictEqual(res.collectedValues.length, 0);
+  });
+
+  it('returns possibility 0 if no relation exists', () => {
+    rule = { type: 'direct', relation: 'enemy' };
+    const res = directRule.evaluate('alice', 'alice', 'bob', 'bob', rule, {}, null, {});
+    assert.strictEqual(res.possibility, 0);
+  });
+
+  it('applies early exit logic if fastPath and minPossibility are set', () => {
+    rule = { type: 'direct', relation: 'friend' };
+    const res = directRule.evaluate('alice', 'alice', 'bob', 'bob', rule, {}, null, { fastPath: true, minPossibility: 0.8 });
+    assert.strictEqual(res.possibility, 0.9);
+    assert.strictEqual(res.meta.earlyExit, true);
+    assert.strictEqual(res.meta.earlyExitReason, 'strength_threshold_met');
+  });
+});