2 Commits

Author	SHA1	Message	Date
John Dvorak	e98137a04f	bench: complex-query cold-traffic benchmark (normal vs binary) ... Prod gating is dominated by rule-based queries, not direct relations. complex-query-bench.js measures cold-traffic latency (distinct subject/object per sample, no cache reuse) across seven complex policy shapes — tuple-to-userset, 2-hop chain, defeasible exclusion, ABAC relational comparator, OWA union, nested comparator + OWA fusion, and a mixed 10-rule union — for both evaluation paths, and enforces binary/ normal decision parity on every query. At 25k and 100k nodes: binary wins every scenario (1.15x-2.0x median speedup), p99 stays sub-0.05ms, and parity mismatches are zero across all scenarios. Binary's early exit wins where a strong rule exists; the earlier direct-relation 'binary slower' observation was a cache-hit artifact (normal serves repeat queries from the rule result cache, binary correctly does not, since thresholds are per-call options). Note: report median, not avg — GC outliers inflate the mean (avg > p95 observed on two rows).	2026-08-02 13:38:37 -07:00
John Dvorak	717ae1031e	initial commit: @arbiter/core authorization engine with js-rigor hardening ... Zanzibar-style authorization graph engine (direct/chain/TTU/defeasible/ binary modes, condensed snapshots, value relations) with 39 rigor test campaigns. Includes fixes for snapshot binary writer/reader format mismatch (snapshot-of-snapshot corruption), possibility write-boundary validation, empty-graph snapshot serialization, relation lookup cache direction collision, config-redefinition cache invalidation, binary threshold semantics, defeasible compiled routing, and comparator reason whitelisting.	2026-07-31 13:44:06 -07:00