Dead code with zero callers (deprecation notes promised removal):
- RelationCSR index: always-off option (useRelationCsrIndex), never
enabled in production, wired through RelationManager/RelationUpdates/
RelationLookup. Removed the module and all wiring.
- getAggregatedBlurredValue (RelationManager) and aggregateBlurredValues
(ValueManager): @deprecated shims, zero callers.
- QualitativeRelationalComparatorRule._aggregateBlurredValues:
@deprecated shim, zero callers.
Kept compareRelationValues: non-deprecated public API, coherent and
clock-threaded, just currently callerless.
Stale scaffolding shipping in the published artifact (files: src/):
- src/ast/tests/* and src/ast/examples/*: orphaned duplicates of
tests/ast/, zero references anywhere, 11 files in the tarball.
Removed; the live copies live in tests/ast/.
Internal docs moved out of the shipped surface (1266 lines) to
docs/internal/: VALUE_OPTIMIZATION_SUMMARY, rules API_SPECIFICATION,
ast README, qualitative README — repo-kept, not packaged.
Tarball .md count: 11 -> 1. Rigor 251/251, full suite 853/791/0.
docs/API.md is the authoritative interface reference: exports, Arbiter
methods, check options/result shape with contract invariants, all ten
relation configuration formats, valueManager, partial graphs (raw spec
+ pre-built context, precedence contract), snapshots (format, frozen
restore, trust boundary), reachability (null-defer contract), OWAFusion,
audit hook, errors, reason codes, and the validity taxonomy.
README gains a capabilities section (what the engine does and does not
do) and links the reference, per the map-vs-manual split.
The reference pass surfaced one interface gap: PartialGraphContext —
a first-class public type used in the pre-built overlay form — was not
exported. It is now part of the public surface.
Verified claims against source (overlay spec keys: challenges/
challengeProofs not proofs; qualitative routing via qualitative: true /
scaleName; simpleBinary shape; reason enum; config formats). Rigor
251/251, full suite 853/791/0.
The prod-gating measurement (complex-query-bench: tuple-to-userset,
chains, defeasible, comparators, OWA, nested fusion, mixed unions over
cold traffic with binary parity) was committed but never ran in CI. The
benchmark job now runs it alongside the possibilistic baseline compare,
uploads the results artifact, and surfaces both in the run summary.
Also: refreshed the committed .rigor-baseline.json (engine unchanged
since the tag; the runner's canonical baseline lives in its artifact
store), and added npm run benchmark:complex-query for local runs.
The principle: time is caller-provided (options.now / partialGraph.now);
the wall clock is only the fallback for unpinned callers, never a hidden
decision input. Remaining clock leaks:
- getBlurredValue gained an optional now param threaded to _isValueExpired;
ChainRule (2 sites), MultiHopRule (2 sites), RelationManager (3 sites)
now pass the caller clock. Previously a pinned-clock caller's chain/
multi-hop value TTL used the WALL clock (wall in 2026, pinned T0 in
2001 -> values wrongly expired).
- MultiHopRule's TTL gate used valueFilters.ttl || 24h instead of the
valueManager's per-relation TTL (inconsistent with chain/comparator);
now valueManager.getTTL is the authority, valueFilters.ttl the override.
- QualitativeRelationalComparatorRule decay (_calculatePeriodsElapsed)
and value timestamps used the wall clock, so qualitative possibility
decay ignored the pinned clock; now threaded through _evaluateOperand.
- ValueManager decay internals (getDecayedRelation, _calculateSeparated
Decay, _calculateBlurredValue) accept a now param (background worker
still passes none -> wall clock is correct there).
- PartialGraphContext._addChallengeProof/_addRelation used Date.now()
instead of the context's own this.now (the partial graph's time).
- Arbiter gained an injectable clock (options.clock) driving unpinned
cache-entry freshness in DecisionCache, RuleEvaluator, ChainRule, and
RelationalComparatorRule; DecisionCache explicit clock still wins.
- Collected-value timestamps in DirectRule and RelationalComparatorRule
honor the caller clock.
Pinned-clock chain probe: values fresh at T0, expired at T0+61s, with the
wall clock in 2026. Rigor 251/251, full suite 853/791/0.
Two remaining clock/shape inconsistencies from the audit:
1. The direct fast path emitted a bare collected-value object
{value, source, relation, userKey, objectKey} — no possibility, no
path, no metadata. Value consumers (comparators, chains) rely on the
self-describing shape the rule paths emit. The fast path now emits
the standard shape (value/possibility/path/source/metadata), matching
DirectRule's existing _createCollectedValue contract.
2. Collected-value timestamps fell back to the WALL clock (Date.now())
even for pinned-clock callers in BaseRule._createCollectedValue,
ChainRule, and TupleToUsersetRule. The metadata timestamp now honors
options.now when pinned (changed_last_at wins, then pinned now, then
wall clock). ValueContext's collectedAt remains metadata-only.
Pinned by ttl-contract.test.js: the fast-path collected value carries
the full shape and its timestamp honors the pinned clock. Rigor 251/251,
full suite 853/791/0.
The rigor suite had 98 campaigns drawing a random seed per process,
making the suite nondeterministic on a deterministic engine (one real
~1/15 flake already caught in tuple-to-userset-rule.test.js). Every
campaign now carries a fixed, per-test-unique seed:
- 16 files touched, 100 run() calls, all 100 seeded (2 were already done)
- seed names follow <file>-<purpose> kebab-case, unique within each file
- no other content changed (effort, invariants, assertions untouched)
Verification: full rigor suite green across 11 consecutive runs, full
suite 852/790/0. Determinism is now structural, not incidental.
Three related findings from the nervous-item audit:
1. TTL contract pinned (ttl-contract.test.js + README): TTL is a
VALUE-FRESHNESS gate, not an access-expiry mechanism. Direct grants
are timeless; expired values deny comparators and drop from collected
values. The direct fast path collected values WITHOUT the TTL gate
(comparators skipped expired relations, the direct path did not) —
now gated identically.
2. ChainRule cache served pinned-clock callers (ChainRule.js): a chain
result captured at one time (with then-fresh values) was served to
callers asking about another time. The chain cache now bypasses
reads AND writes when options.now is pinned, matching the rule-result
cache contract.
3. Decision caches bundled stale values (AuthorizationChecker.js):
the direct-check cache stored collectedValues alongside the timeless
decision; an unpinned caller past wall-clock expiry got the stale
value. Value-carrying results are now never cached (the decision is
timeless, the values are not). The rule-result cache is unchanged —
it serves snapshots under explicit write-invalidation (its own
contract, asserted by cache-invalidation tests).
Rigor 250/250, full suite 852/790/0.
Extends the complex-graph suite to the remaining uncovered surfaces:
- complex-graph-ttl-crucible: value-TTL expiry over community/scale-free
graphs (pinned changed_last_at writes, {now} reads, mirror freshness
rule), mutation-with-time binary parity, snapshot round-trip preserves
the TTL gate. Notable find: snapshot restore resets changed_last_at to
access time (RelationSnapshotAccess.js:91), so TTL assertions compare
each engine against its own effective write clock.
- complex-graph-overlay-crucible: partial-graph overlay over complex
graphs. Key discovery: pre-built PartialGraphContext must be passed as
partialGraphContext (partialGraph is a raw spec re-ingested at
ArbiterChecks.js:15); overlay rides the direct relations a policy
consumes (TTU-derived can_read ignores it, verified by probe).
- complex-graph-values-crucible: relational-comparator over value-carrying
relations with pinned clocks — comparator parity, value-mutation flips
the decision immediately, TTL expiry on the comparator denies.
- complex-graph-reachability-crucible: PLTC reachability vs ground-truth
BFS on scale-free/community graphs — verdict parity, fast-fail
soundness (no false positives), null-defer contract honored.
- complex-graph-batch-crucible: addRelationsBatch vs sequential build
parity, mutation parity across both, cache-freshness after mutation.
- complex-graph-quantization-crucible: 16-bit quantization band over real
possibility spreads, allow/deny agreement outside the band, snapshot-of-
snapshot semantic identity.
Also seeds the two unseeded campaigns in tuple-to-userset-rule.test.js
(flagged flake ~1/15 — nondeterministic runs on a deterministic engine).
Rigor 245/245, full suite 847/785/0.
Three improvements over the complex-graph crucibles:
1. Anti-vacuity guards (assertRealVerdict): rigor's complexity verdict
PASSES on zero observations — a broken action (missing import, wrong
args shape) silently goes green. Every complexity verdict now asserts
observationCount >= 50, costSource == expected, and calibrated ==
true, so a vacuous verdict is a test failure.
2. Snapshot complexity: serialized snapshot BYTE SIZE is O(n) in graph
size, verified deterministically (build and restore round-trip).
Wall-clock timing at sub-ms scale is pure jitter for the e-process
spread check (verified empirically — buildTime O(n) failed on spread
while buildBytes passed); latency stays covered by benchmark
percentiles.
3. complex-graph-mutation-crucible: MUTATION-FRESHNESS — random edge
removals/additions on community + scale-free graphs, normal/binary
agreement re-checked after EVERY mutation, stale grants and missing
fresh grants are failures. Two real findings during bring-up, both
fixture bugs rather than engine bugs:
- the scale-free generator returned a raw edge COUNT as 'relations'
while other generators returned edge arrays (now null, consistent
with dense-adversarial; the crucible walks the arbiter's store)
- arbiter.relations stores NUMERIC ids, so removals must resolve
string keys to ids before matching (string-key comparison silently
no-oped, looking like a stale grant)
Snapshot read-only semantics documented in the crucible: enableCondensed-
Snapshot flips the engine to read-only permanently, so mutation crucibles
exercise the writable path, and frozen-snapshot properties stay with the
snapshot-parity suites. Rigor 239/239, full suite 841/779/0.
Activates js-rigor's normally-dormant complexity and benchmark verdicts
against the complex-graph generators:
COMPLEXITY (e-process verified, deterministic cost signals):
- direct/chain/ttu lookups declared O(1) in graph size — verified with a
deterministic engine-lookup counter as the cost metric (wall-clock at
sub-ms scale is pure jitter for the spread check); a regression to
linear scans would grow the counter with n and trip the e-process
- union evaluated O(k) in rule count in normal mode vs O(1) in binary
mode (threshold early exit) — declared cost = rule evaluations
BENCHMARK (percentile assertions over auto-collected samples):
- direct/chain/ttu single-check actions stay under p50=0.2ms p95=1.0ms
budgets on the complex graphs
Debugging along the way surfaced two rigor API facts worth pinning:
metric readers receive the raw generated-args ARRAY (fns get the spread
values), and a missing module import silently degrades actions into
'no observations' vacuous verdicts (ReferenceError swallowed by the
runner). Full rigor 237/237.
The engine's campaigns ran on toy star graphs. complex-graphs.js adds four
production-shaped generators:
- community: stochastic block model with nested groups (groups of groups),
tuple-to-userset access, defeasible blocked overlay, cross-community
delegation chains
- scale-free: preferential attachment, power-law degree distribution,
hub-heavy adjacency
- hierarchy: org-tree (org -> dept -> team -> member) with 3-hop ownership
chains
- dense-adversarial: maximal overlap on small graphs — reciprocal edges,
self-loops, multi-rule policies (cycle + cache-collision pressure)
complex-graph-crucible.test.js runs four crucibles over them: structural
shape assertions across seeds, exhaustive normal/binary/snapshot parity
with bounds on every query, a 300-effort rigor fuzz campaign over
(generator, seed, user, relation, object) triples enforcing
allow/deny + possibility agreement across all three evaluation modes, and
a reachability guard proving complex policies (TTU, chain) are actually
exercised rather than denied trivially.
Generator fixes along the way: sub-groups own their own resources so the
one-level TTU is structurally reachable, and departments own resources so
the 3-hop chain terminates. Full rigor 234/234.
Prod gating is dominated by rule-based queries, not direct relations.
complex-query-bench.js measures cold-traffic latency (distinct
subject/object per sample, no cache reuse) across seven complex policy
shapes — tuple-to-userset, 2-hop chain, defeasible exclusion, ABAC
relational comparator, OWA union, nested comparator + OWA fusion, and a
mixed 10-rule union — for both evaluation paths, and enforces binary/
normal decision parity on every query.
At 25k and 100k nodes: binary wins every scenario (1.15x-2.0x median
speedup), p99 stays sub-0.05ms, and parity mismatches are zero across
all scenarios. Binary's early exit wins where a strong rule exists; the
earlier direct-relation 'binary slower' observation was a cache-hit
artifact (normal serves repeat queries from the rule result cache,
binary correctly does not, since thresholds are per-call options).
Note: report median, not avg — GC outliers inflate the mean (avg > p95
observed on two rows).
_checkBinary ran the visited-set cycle detection (visit-key string
allocation + Set has/add) on every call, including top-level direct
checks that never recurse — making the 'fast' binary path 2.5x slower
than the normal fast path, which already skips the block when _visited
is empty.
The cycle block now sits after the direct fast path: direct checks
return before it, while the rule-evaluation branches (which recurse via
evaluateRule with the shared _visited) still detect cycles. Binary
direct checks drop from 6.7us to 4.1us avg; the remaining 1.4x is the
honest cost of the richer binary result contract (allow/deny, threshold
compare, config lookup). Parity suites and full rigor remain green.
README: purpose-first (possibility not boolean, caller owns evidence/time),
install, verified quick start, concepts (result shape, overlays, temporal
context), API table, development commands, design notes.
benchmark: scripts/benchmark.js on @tenere/benchmark-lib — eight contours
(direct/union/denied/meta/overlay/binary checks, snapshot build/restore),
committed .rigor-baseline.json, exit 1 on high-severity regressions.
CI: benchmark job compares on push (continue-on-error), re-saves baseline
and uploads it as an artifact on tags; publish now depends on benchmark
passing as well as test.
- @tenere/pltc-core switches from a machine-local file: dependency to the
published ^0.6.3 from the Tenere npm registry (the file: path does not
exist in a fresh checkout; lockfile regenerated to the tarball).
- .npmrc routes @tenere and @arbiter scopes alongside @rigor so registry
installs and the eventual publish resolve against the hub.
- package.json gains a files whitelist (src/ only) so tests, benchmarks,
and scratch directories never ship in the tarball.
- .gitea/workflows/ci.yaml: node 22, full suite + rigor campaigns on push/
PR, npm publish on v* tags to the Arbiter org registry.
A new rigor contract test (public-contract) asserts every check result —
allowed, denied, missing_node, no_config, cycle, threshold, binary — carries
possibility, reliability, validity, and reason with defined invariants
(possibility/reliability in [0,1], validity labels in the taxonomy, denied
decisions leak zero reliability, JSON round-trip stable).
The pin surfaced three real shape gaps in AuthorizationChecker, now fixed:
the no_relation fast-path miss and binary direct-miss emitted no validity,
and the binary direct-allow path omitted reliability. All structural and
binary return sites now emit the canonical {possibility, reason, reliability,
validity} contract.
Also pins isReachable's boolean|null deferral contract, explain enrichment,
snapshot round-trip outcome preservation, and read-idempotent node queries.
A new rigor campaign (snapshot-adversarial-fuzz) hunts malformed restore
buffers: every read must succeed into a structurally sound graph or throw
a clean bounded error. It surfaced three real bugs now fixed:
1. BinaryReader threw a caller-contract TypeError on Buffer/Uint8Array
input (fs-style restore) instead of reading it — normalized to a
DataView over the real ArrayBuffer.
2. readBytes built its slice with this.view.buffer + this.offset,
ignoring view.byteOffset — pooled Buffers (byteOffset 768+) read the
wrong memory region entirely, corrupting restored graphs.
3. The edge gate validated array contents but not the header count
fields: a desynced edgeIndex (indices build iterates edgeIndex, not
array length) turned a one-byte flip into a 13-second effective hang.
The gate now cross-validates numNodes/numEdges/edgeIndex/
nextRelationId/valueCount/degreeCount against their sections, and
LazyNodeIdTable bounds-guards garbage offset slices.
Binary mode now carries validity on every return site (direct, logical,
loop, early-termination, structural), gated like the normal path.
The now parameter (and partialGraph.now) replaced the need for global
Date.now patching in tests. The ttl-expiry parity campaign's module-scope
patch and the relational-comparator Time-Based Decay tests' before/after
patches now pass the clock explicitly through check options — no global
mutation, no restore-order fragility, and the pinned-clock cache bypass
keeps every evaluation honest. No stale references to the removed
compiled evaluator or useCompiled option remain in the test suite.
The partial graph is the caller's self-contained view of the world — so
the time belongs in it. partialGraph.now becomes the evaluation clock for
that check (TTL gates, proof expiry, decay all honor it), with an
explicit options.now taking precedence. The explain rerun replays the
SAME partial graph object and reproduces the original decision; the
serializer records request.temporal.now for the record.
Pins: partialGraph.now driving a challenge decision both sides of the
window, the explicit-override precedence, and the explain rerun with the
same object.
The errors-skill's two-pass model applied without a journal: the caller
owns the temporal context. Every decision-flipping temporal feature (the
clock behind TTL gates, challenge-proof expiry, value decay) is now
parameterized as options.now, so an explain rerun that replays the
original temporal parameters reproduces the original decision exactly.
Threaded now through: the comparator's operand value paths
(_getCachedDirectValue/_extractValues/isWithinTTL), the challenge proof
lookup, and the multi_hop value collection (isWithinTTL + blur). All four
result caches bypass cached decisions when the clock is pinned (rule-
result cache, the checker's rule/direct caches, and the comparator's
derived operand cache) — interleaved pinned-clock checks are per-time
with no cross-contamination.
The explain serializer records request.temporal.now so the caller knows
exactly what to replay. The happy path stays minimal and fast (no now ->
no parameter, no cache changes); the rerun (explain with the temporal
context) carries the full diagnostics.
Pins: interleaved fresh/expired/expired-again comparator checks, the
explain replay of both decisions + the recorded temporal context, and
challenge-proof expiry replay.
The compiled evaluator is gone, so useCompiled: false is inert. Removed
every remaining reference: the TTU matrix pin's redundant fallback check,
the OWA wrapper's useCompiled parameter, the comparator full-path test's
redundant rule-path check, and the compiled-rule-parity campaign (which
existed solely to compare the two paths — now trivially identical).
The RuleCompiler remains as the config validator; _compiled metadata
still rides in snapshots.
The compiled evaluation path was never a performance win and was a
double-implementation liability: every semantics fix had to land twice
(CompiledEvaluator + LogicalOperators/handlers), and several bugs lived
only in one copy. A warm benchmark shows the compiled path at parity at
best (the apparent 7x chain regression was cold-cache confound).
Removed the runtime compiled dispatch entirely: RuleEvaluator evaluates
every rule through the single fallback path (logical operators + rule
handlers). The RuleCompiler remains as the config VALIDATOR only
(_compileErrors/_compileWarnings + _needsValues + the _compiled metadata
carried by snapshots). CompiledEvaluator.js deleted.
Fixes surfaced by removing the mask:
- The defeasible fallback wrap produced the wrong component shape
({rules} instead of {union:{rules}}/{intersection:{rules}}) — the
compiled path always ran for defeasible configs, so the fallback had
never executed; now wrapped correctly.
- Defeasible configs had no normal-dispatch routing (the compiled
evaluator handled them); routed to evaluateDefeasible.
- The binary defeasible path forced the binary mode's internal 0.5
threshold, while the compiled path always ran normal mode — the binary
decision is now the thresholded normal combination (preserving the
pinned contract).
- The fallback union/intersection/exclusion results now carry the
validity blocks (previously only the compiled versions did).
The persistence probe found three silent-loss defects in the snapshot
round trip: relation validity labels (finite_sample downgraded to
heuristic after save/load!), decay configs, and the value manager's
per-relation TTL settings all vanished. The restored arbiter built its
indices directly from the condensed graph, whose edge channel carries
possibility/reliability/value only.
Format version 2 now carries per-relation metadata (validity, decayConfig)
and the valueTtls table in the snapshot payload; both the snapshot-access
layer and the CondensedGraphIndices build merge the metadata back, so a
restored arbiter is lossless end to end. Version 1 buffers are rejected
with the existing clean version error.
Pinned: a persistence round-trip test asserting validity label, decay
config, TTL, and the restored check's validity label. Suites: rigor
207/0, full 809/747/0.
Per the trust-boundary direction (the caller owns evidence validation):
- Explicit possibilistic semantics module (src/core/possibility.js): the
single authoritative home for what each operator means (max = disjunctive
already-valid; min = unvalidified conjunctive ranking with the K-
validification and surfaced conflict mass; product = Thm-4 heuristic;
interior OWA = non-maxitive heuristic; reliability = adaptation, never
conflated with plausibility).
- Provenance is opt-in (re-entrant tracing practice): default check
results carry only {label, operator, regime}; conflictMass,
validifiedPossibility, sources, and nonMaxitive appear only under
includeMeta and on the explain surface. The direct-check cache now
caches only the meta-less form — includeMeta callers always get a fresh
full evaluation (previously a cached minimal result was served for
includeMeta requests, silently stripping detail).
- Audit affordance: new Arbiter({ audit }) emits one record per check
(decision, possibility, binary, partialGraphUsed, validityLabel,
sources). The engine stores nothing — the caller owns persistence;
zero cost when the hook is absent (and the full validity is forced only
on audit-enabled deployments).
- DoS hardening: partial-graph size limits are enforced BEFORE the
context allocation (the caller-supplied overlay is the per-check
allocation point); the CondensedGraphBinary reader gained full bounds
guards so malformed snapshot buffers fail with clean errors instead of
RangeError crashes or oversized allocations.
- New security-affordance pins: gating, audit records, and pre-allocation
limits.
Adds an epistemic validity layer in the spirit of the zig-contour fusion
spec: every check result now carries a validity block {label, operator,
regime, sources, conflictMass, validifiedPossibility, nonMaxitive}.
- Relations accept a validity label (default heuristic = unlabeled input).
- Labels propagate through fusion: identity/max preserve the weakest
source label (max is already valid under arbitrary dependence); min
(conjunctive: intersection, chain, TTU, multi_hop, parent) is
approximate at best, surfaces the conflict mass (1 - possibility) that
was previously dropped, and exposes the arbitrary-regime validification
min(1, K*gamma); product-style operators (exclusion, defeasible) and
interior OWA averaging are always heuristic, with nonMaxitive flagged.
- Reliability and validity are now explicitly distinct: reliability stays
the scalar confidence adaptation; validity tracks the epistemic label.
- The hottest paths attach a shared frozen default block instead of
allocating (perf A/B shows no regression: ~300k ops/s direct both ways).
- Pre-existing fixes surfaced while wiring: the array-form logical config
dropped top-level aggregator/owaWeights (average union compiled as max),
and _createStandardResult dropped unknown fields (validity never
survived rule results).
New campaign validity-parity.test.js pins the label taxonomy, conflict
mass, validification, weakest-propagation, and the reliability/validity
separation. Suites: rigor 203/0, full 803/741/0.
Probe sweep of the OWA surfaces found three real defects:
- reliabilityWeighting was a silent no-op everywhere: every implementation
scaled possibilities by metas[i].reliability, but no child meta ever
carried a reliability field (the compiled direct omitted it and the
DirectRule handler omitted it too), so the weighting was always x1.0.
All weighting branches now use the tracked child reliabilities, and the
DirectRule handler + its meta now carry the relation's reliability.
- The compiled union and the direct_list fast path had no
reliabilityWeighting branch at all; both now apply it.
- Shorthand children ({ relation: 'editor' }) dispatch to the direct
handler but carry no type, so _getRuleResultCacheKey derived the generic
'rule' suffix for every shorthand child of a logical rule — the first
child's cached result was served for all of them (the fallback path
returned the owner's 0.8 for the editor). The key derivation now matches
the shorthand dispatch. The RuleEvaluator also treats shorthand operands
as direct rules instead of unknown_rule_type on the non-compiled path.
New pins: an OWA differential property (custom weights, max/min/average
aggregators, reliabilityWeighting, compiled path) and a multi_hop
pathAggregation=owa fixed pin with reliability propagation.
The transient full-suite flake (fail 1 in ~5-10% of runs, only visible on
some invocations) was finally captured: challenge-proof's most-recent-proof
property failed once in 800 cases. Root cause: _addChallengeProof built
issuedAt with proof.issuedAt || proof.issued_at || proof.timestamp ||
Date.now() — a generated issuedAt of 0 (epoch) was replaced with the wall
clock, so an epoch-issued proof became the most recent one and the
lookup returned a timestamp (1.7e12) that could never match the
expectation. The same ||-chain corrupted expiresAt: 0 into null, making
epoch-expired proofs never expire. All three chains (issuedAt, expiresAt,
proofId) now use nullish coalescing so zero is a valid timestamp.
Fixed pin added; the challenge-proof file went from ~10% flake to 20/20
clean, and the full suite is stable at 801 tests / 739 pass / 0 fail.
The new value-collection crucibles in the TTU and chain differential
campaigns immediately found three engine defects:
- TTU join pushed 0-strength 'matches' (missing computed leg, or
0-possibility edges, with minPossibility 0) as valid paths: denied
decisions reported tuple_to_userset_found and leaked the tupleset edge's
value into collectedValues. Both join modes now require combined > 0.
- A ReferenceError (bare resolveKey) crashed the computed-join mode under
collectValues, silently turning the whole check into an evaluation_error
denial. Fixed the call to this.arbiter.resolveKey.
- Multi-path TTU fusion fell back to Math.max over all path reliabilities,
pairing the winning possibility with another intermediate's reliability.
The fallback now picks the max-possibility path's reliability.
New campaigns: defeasible and intersection differential properties
(when/unless and min-children with reliability parity under persistent/
partial splits). The model-based campaign keeps its reliability crucible;
its value comparison was reverted — the harness's shrink reporting is
opaque and unreconstructable there, and the value semantics are covered by
the TTU/chain campaigns instead.
The reliability gap found last round was invisible to every parity mirror
(they compared possibility only). Hardened the existing campaigns so the
mirrors carry reliability too:
- batch-order-parity: batch ops carry reliability; the mirror tracks
last-write-wins reliability and the crucible asserts engine reliability
parity (mirror corrected: add-on-existing preserves reliability, it does
not reset it).
- rule-kind-partial-parity: the TTU differential property now generates
per-edge reliabilities and asserts the winning intermediate's
reliability (tupleset.reli * computed.reli); a new chain reliability
differential property does the same for 2-step chains.
- snapshot-quantization-parity: edges carry deterministic reliabilities and
the round-trip pins the codec's reliability channel (product-aware
tolerance: chain reliability multiplies two quantized inputs).
- model-based-graph: the reference model tracks reliability per tuple and
checks it alongside possibility for direct and chain queries.
The model crucible immediately caught a real bug: the direct-check fast
path returned the relation's reliability on a DENIED decision (possibility
0), while the rule-collection path zeroes it — denied results leaked
reliability. Both fast-path branches (direct match and threshold_not_met)
now report reliability 0 when the decision is denied.
Systemic reliability gap found by the probe sweep: the compiled evaluation
paths never emitted the reliability the engine computes.
- Compiled _evaluateDirect omitted the relation's reliability, and the
chain/multi_hop rules hardcoded reliability: 1.0 — so check() results
reported 1.0 for any rule whose decision came through a chain, multi_hop,
union, intersection, exclusion, or defeasible combination.
- The chain and multi_hop traversals now track per-path reliability (product
of edge reliabilities) and report the winning path's value; the compiled
and fallback logical operators (union/intersection/exclusion, direct_list
fast path, early exits) report the selected child's reliability
(max/min child or OWA trace index; exclusion multiplies both legs), and
normal-mode defeasible combines base x requires x defeater reliabilities.
- The checker's logical fast path dropped collectedValues from union/
intersection/exclusion results; it now passes them through.
- MultiHopRule.valueManager was read off relationManager where the real
arbiter keeps it on the arbiter — collectValues: true on a multi_hop rule
with a value-carrying edge crashed the evaluation (error result, silent
denial). Now resolved at the arbiter level with a relationManager
fallback for stubs.
Campaign pins: reliability per kind (chain/multi_hop product, union/intersection
selected child, exclusion/defeasible product), and multi_hop value collection
through persistent and partial contexts.
Two issues found by the extended probe sweep:
- A relational_comparator operand backed by a tuple_to_userset rule always
denied: the TTU rule collected only the intermediate KEY, which the
operand extraction skips as non-numeric, so no value was ever available.
The TTU rule now emits a value-carrying collected entry when the
tupleset edge carries a numeric value (entityKey = tuple src, relation =
tupleset relation), keeping the bare intermediate key when there is no
value. Comparator-with-TTU-operand now allows/denies on the tuple value
through both persistent and partial contexts.
- _modifyRelation ignored the changed_last_at override that the add path
honors: value-changing modifies stamped fresh Date.now() regardless of
the pin, so replay/restore tools pinning timestamps got different
semantics via modify vs add. The override now applies to refresh events
(value/reliability/possibility change) and is ignored for value-unchanged
writes, preserving the TTL parity contract that identical replays never
un-expire old values.
Verified clean: intersection through partial, defeasible with logical
when, challenge subject object/session with sessionKey, non-binary
minAllowPossibility threshold, batch value updates, explain agreement
under partial.
Bug 34: ArbiterChecks.check destructured { reliability, ...rest } out of
every normal (and binary) check result since the initial commit — the
engine computes reliability faithfully (TTU tupleset.reli * computed.reli,
direct relation reliability) and explain() preserved it, but the public
check() API silently dropped it. explain() kept it, so exposing it in
check() is the intended contract. The destructuring is removed; direct
and TTU checks now return reliability (0.6 / 0.72 in the pins).
Campaign pins added: TTU multi-path fusion (max over intermediates of
min(legs)) with reliability propagation through both persistent and
partial contexts, the maxIntermediates circuit breaker through partial,
and snapshot-restored arbiters evaluating TTU.
The full suite intermittently failed (pass counts 725-735, fail 0-1) under
parallel node --test execution. The reachability integration test asserted
a single-shot 100ms quick-failure bound and big-graph-optimized a 1s load
bound — both are regression smoke checks that can blow on a GC pause or
CPU contention spike while other files' campaigns run concurrently.
Both now re-measure once before failing, keeping the tight regression
signal while eliminating load-induced flakes. Full suite is now stable at
735 pass / 0 fail / 62 skipped across repeated runs.
The reverse branch of TupleToUsersetRule ignored tuplesetDirection: it
looked up the tupleset relation as outgoing-from-user even when 'in' was
set, while the join honored 'in' by using t.src as the intermediate —
the documented shape (intermediates hold the relation TO the user) never
matched, and only a degenerate join-on-user shape produced results. The
same gap existed in the compiled direct_join optimization.
Fixed the fallback tupleset lookup (including the graph-neighbor path and
the computed-join tupleEdge direction) and the optimized direct_join to
honor tuplesetDirection in reverse mode. Matrix pins reverse-in (both
evaluation paths, persistent + partial), multi_hop reverse, chain-in,
union-with-chain-child, defeasible split legs, TTU value flow, and
challenge-via-binary.
Two real bugs found by the new rule-kind x partial-graph parity campaign:
- TupleToUsersetRule 'computed' join mode (computed side has fewer
intermediates than the tupleset side) pushed path objects carrying
combinedPossibility, but _buildFinalResult reads path.possibility —
every valid TTU grant in that mode silently returned 0, in persistent
and partial contexts alike.
- _collectRelationUsages only registered explicit type:'direct' children,
so shorthand logical operands ({ relation: 'owner' } inside union/
intersection/exclusion) left the dependency index empty: writes to a
base relation never invalidated cached logical decisions, and a check
performed before an add kept serving its stale result forever.
New campaign rule-kind-partial-parity.test.js pins the full kind x
persistent/partial matrix (direct, chain, multi_hop, TTU out/in/reverse,
parent, computed, defeasible, union, exclusion, comparator, challenge,
binary) plus seeded differential properties for TTU, comparator, and
exclusion; artifact persistence disabled to avoid disk bloat.
- Arbiter constructor and setPartialGraphPolicy dropped maxNodes,
maxRelations, and reservedRelations — the partial-graph context always
saw the 1000/2000 defaults, silently disabling configured DoS guards.
Both paths now carry the limits through; policy limits test pins
constructor + setter enforcement and custom reservedRelations.
The binary branch of AuthorizationChecker.check rebuilt its options with a
fixed six-field object, silently discarding partialGraphContext (and any
other caller option) — binary checks denied grants the normal path
allowed. Now spreads all caller options through. binary-partial-parity
pins: partial grants above the threshold allow, below deny, persistent
wins over partial, and binary decisions agree with normal decisions on
the same overlay.
- invalidateRuleResultCacheByRelation now walks the transitive closure of
the dependency index (owner -> is_owner -> computed can_read): mutating
a base relation left computed/multi_hop results stale
- _collectRelationUsages registers multi_hop and parent rule relations
(parentRelation + subject relation) so their caches invalidate on
base-relation mutations
- advanced-rule-kinds.test.js: multi_hop (min-over-path, depth-limited),
computed (userset alias), parent (subject relation on the target's
parent) through the full check() path under random mutations
- _addRelationInternal now validates possibility like the single-add path
(batch adds could store out-of-range values and make the transactional
wrapper report success:true after a partial apply)
- tx-rollback-parity.test.js: poison at every batch position rolls back
fully; clean batches apply in order; batch+PLTC reachability reflects
batch writes immediately
updateRelationsBatch previously pre-sorted ops remove->modify->add, which
changed the final state whenever one tuple was touched by mixed kinds:
[add, remove] left the tuple present, [modify, add, modify] ended with
the middle value. Now ops apply strictly in the given order via the
dedup-aware _addRelationInternal (in-place last-write-wins) with upfront
validation, post-batch PLTC edge updates, and per-relation arbiter-level
cache invalidation.
batch-order-parity.test.js pins the contract with an in-order mirror
(modify-of-missing is a silent no-op).
Engine fixes:
- RelationUpdates.updateRelationsBatch: invalidate arbiter-level caches
(rule result cache, ChainRule caches, direct-check cache) per affected
relation — batch updates bypassed Arbiter.addRelation and served stale
decisions after batch modify/swap with warm caches
- updateRelationsBatchTransactional rollback: new Map(Set) crashed with
'Iterator value is not an entry object' — fixed to new Set
- RelationalComparatorRule: value extraction (direct-list and cached
direct paths) now gates on valueManager._isValueExpired — TTL-expired
values no longer feed comparator decisions
Campaigns:
- value-freshness-parity.test.js: batch modify/swap/tx rollback freshness
with comparator mirror (batch MODIFY of a missing relation is a silent
no-op — pinned)
- ttl-expiry-parity.test.js: injected-clock TTL expiry through the
comparator path (exact parity with caching off; bounded staleness with
caching on), faithful changed_last_at mirror semantics
John Dvorak