John Dvorak
86729715f1
Per the trust-boundary direction (the caller owns evidence validation):
- Explicit possibilistic semantics module (src/core/possibility.js): the
single authoritative home for what each operator means (max = disjunctive
already-valid; min = unvalidified conjunctive ranking with the K-
validification and surfaced conflict mass; product = Thm-4 heuristic;
interior OWA = non-maxitive heuristic; reliability = adaptation, never
conflated with plausibility).
- Provenance is opt-in (re-entrant tracing practice): default check
results carry only {label, operator, regime}; conflictMass,
validifiedPossibility, sources, and nonMaxitive appear only under
includeMeta and on the explain surface. The direct-check cache now
caches only the meta-less form — includeMeta callers always get a fresh
full evaluation (previously a cached minimal result was served for
includeMeta requests, silently stripping detail).
- Audit affordance: new Arbiter({ audit }) emits one record per check
(decision, possibility, binary, partialGraphUsed, validityLabel,
sources). The engine stores nothing — the caller owns persistence;
zero cost when the hook is absent (and the full validity is forced only
on audit-enabled deployments).
- DoS hardening: partial-graph size limits are enforced BEFORE the
context allocation (the caller-supplied overlay is the per-check
allocation point); the CondensedGraphBinary reader gained full bounds
guards so malformed snapshot buffers fail with clean errors instead of
RangeError crashes or oversized allocations.
- New security-affordance pins: gating, audit records, and pre-allocation
limits.
216 lines
11 KiB
JavaScript
216 lines
11 KiB
JavaScript
/**
|
|
* rigor/validity-parity.test.js — possibilistic validity metadata.
|
|
*
|
|
* Pins the Cella-FVN-inspired validity layer:
|
|
* - every check result carries a validity block {label, operator, regime,
|
|
* sources, conflictMass, validifiedPossibility, nonMaxitive}
|
|
* - unlabeled relations default to heuristic; a labeled relation
|
|
* propagates its label through identity/max fusion
|
|
* - max (disjunctive) fusion preserves the weakest source label
|
|
* - interior OWA/averaging is non-maxitive and always heuristic
|
|
* - min (conjunctive) fusion is approximate at best, surfaces the
|
|
* conflict mass (1 - possibility), and exposes the arbitrary-regime
|
|
* validification min(1, K*possibility)
|
|
* - product-style operators (exclusion, defeasible) are always heuristic
|
|
* - reliability and validity are distinct: reliability stays the scalar
|
|
* confidence; validity tracks the epistemic label
|
|
*/
|
|
import { describe, it } from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import { rigor } from '@rigor/core';
|
|
import { Arbiter } from '../../src/index.js';
|
|
import { buildValidity, mergeValidity, weakestValidity, DEFAULT_VALIDITY } from '../../src/core/validity.js';
|
|
|
|
const child = (r) => ({ type: 'direct', relation: r });
|
|
|
|
function mk() {
|
|
const a = new Arbiter();
|
|
a.addNode('u:0', 'user');
|
|
a.addNode('d:0', 'doc');
|
|
a.addNode('g:0', 'group');
|
|
return a;
|
|
}
|
|
|
|
describe('Possibilistic validity metadata (rigor)', () => {
|
|
it('FIXED: labels, operators, conflict mass, validification per kind', () => {
|
|
// direct unlabeled -> heuristic identity; default carries the minimal
|
|
// public block (label/operator), the full detail is includeMeta-only
|
|
{
|
|
const a = mk();
|
|
a.setRelationConfig('t', { type: 'direct', relation: 'r1' });
|
|
a.addRelation('u:0', 'r1', 'd:0', { possibility: 0.8 });
|
|
const r = a.check('u:0', 't', 'd:0');
|
|
assert.equal(r.validity.label, 'heuristic');
|
|
assert.equal(r.validity.operator, 'identity');
|
|
const r2 = a.check('u:0', 't', 'd:0', { includeMeta: true });
|
|
assert.deepEqual(r2.validity.sources, ['r1']);
|
|
assert.equal(r2.validity.conflictMass, 0);
|
|
}
|
|
// labeled direct propagates its label
|
|
{
|
|
const a = mk();
|
|
a.setRelationConfig('t', { type: 'direct', relation: 'r1' });
|
|
a.addRelation('u:0', 'r1', 'd:0', { possibility: 0.8, validity: 'finite_sample' });
|
|
assert.equal(a.check('u:0', 't', 'd:0').validity.label, 'finite_sample');
|
|
}
|
|
// max fusion preserves the weakest source label
|
|
{
|
|
const a = mk();
|
|
a.setRelationConfig('t', { union: [child('r1'), child('r2')] });
|
|
a.addRelation('u:0', 'r1', 'd:0', { possibility: 0.8, validity: 'finite_sample' });
|
|
a.addRelation('u:0', 'r2', 'd:0', { possibility: 0.5, validity: 'conformal' });
|
|
const r = a.check('u:0', 't', 'd:0');
|
|
assert.equal(r.validity.label, 'conformal', 'weakest label wins through max');
|
|
assert.equal(r.validity.operator, 'max');
|
|
assert.equal(a.check('u:0', 't', 'd:0', { includeMeta: true }).validity.nonMaxitive, false);
|
|
}
|
|
// interior OWA is non-maxitive heuristic
|
|
{
|
|
const a = mk();
|
|
a.setRelationConfig('t', { union: [child('r1'), child('r2')], aggregator: 'average' });
|
|
a.addRelation('u:0', 'r1', 'd:0', { possibility: 0.8, validity: 'finite_sample' });
|
|
a.addRelation('u:0', 'r2', 'd:0', { possibility: 0.5, validity: 'finite_sample' });
|
|
const r = a.check('u:0', 't', 'd:0');
|
|
assert.equal(r.validity.operator, 'owa');
|
|
assert.equal(a.check('u:0', 't', 'd:0', { includeMeta: true }).validity.nonMaxitive, true);
|
|
assert.equal(r.validity.label, 'heuristic', 'averaging never claims validity');
|
|
}
|
|
// min fusion: approximate, conflict mass, validification
|
|
{
|
|
const a = mk();
|
|
a.setRelationConfig('t', { intersection: [child('r1'), child('r2')] });
|
|
a.addRelation('u:0', 'r1', 'd:0', { possibility: 0.8, validity: 'finite_sample' });
|
|
a.addRelation('u:0', 'r2', 'd:0', { possibility: 0.5, validity: 'finite_sample' });
|
|
const r = a.check('u:0', 't', 'd:0');
|
|
assert.equal(r.validity.operator, 'min');
|
|
assert.equal(r.validity.label, 'approximate', 'unvalidified conjunctive is approximate at best');
|
|
const rDetail = a.check('u:0', 't', 'd:0', { includeMeta: true });
|
|
assert.ok(Math.abs(rDetail.validity.conflictMass - (1 - 0.5)) < 1e-9, 'conflict mass = 1 - possibility');
|
|
assert.equal(rDetail.validity.validifiedPossibility, 1, 'min(1, K*gamma) with K=2, gamma=0.5');
|
|
}
|
|
// product operators are heuristic even with labeled sources
|
|
{
|
|
const a = mk();
|
|
a.setRelationConfig('t', { exclusion: [child('r1'), child('r2')] });
|
|
a.addRelation('u:0', 'r1', 'd:0', { possibility: 0.8, validity: 'finite_sample' });
|
|
a.addRelation('u:0', 'r2', 'd:0', { possibility: 0.5, validity: 'finite_sample' });
|
|
assert.equal(a.check('u:0', 't', 'd:0').validity.label, 'heuristic');
|
|
a.setRelationConfig('t2', { type: 'defeasible', when: child('r1'), unless: child('r2') });
|
|
assert.equal(a.check('u:0', 't2', 'd:0').validity.label, 'heuristic');
|
|
}
|
|
// chain: conjunctive ranking with conflict surfacing
|
|
{
|
|
const a = mk();
|
|
a.setRelationConfig('t', { type: 'chain', steps: [{ relation: 'member_of', direction: 'out' }, { relation: 'viewer', direction: 'out' }] });
|
|
a.addRelation('u:0', 'member_of', 'g:0', { possibility: 0.9 });
|
|
a.addRelation('g:0', 'viewer', 'd:0', { possibility: 0.6 });
|
|
const r = a.check('u:0', 't', 'd:0');
|
|
assert.equal(r.validity.operator, 'min');
|
|
assert.ok(Math.abs(a.check('u:0', 't', 'd:0', { includeMeta: true }).validity.conflictMass - 0.4) < 1e-9, 'chain conflict mass');
|
|
}
|
|
// reliability and validity stay distinct
|
|
{
|
|
const a = mk();
|
|
a.setRelationConfig('t', { type: 'direct', relation: 'r1' });
|
|
a.addRelation('u:0', 'r1', 'd:0', { possibility: 0.8, reliability: 0.42, validity: 'finite_sample' });
|
|
const r = a.check('u:0', 't', 'd:0');
|
|
assert.equal(r.reliability, 0.42, 'reliability unchanged');
|
|
assert.equal(r.validity.label, 'finite_sample', 'validity independent of reliability');
|
|
}
|
|
});
|
|
|
|
it('PROPERTY CAMPAIGN: helper semantics (weakest, merge, default identity)', async () => {
|
|
const result = await rigor.campaign(
|
|
[rigor.fn('helpers', (labels) => {
|
|
const weakest = weakestValidity(labels);
|
|
const merged = mergeValidity(labels.map(l => ({
|
|
label: l, operator: 'max', regime: 'arbitrary', sources: ['r'], nonMaxitive: false, conflictMass: 0, validifiedPossibility: null
|
|
})));
|
|
const single = mergeValidity([{
|
|
label: labels[0], operator: 'max', regime: 'arbitrary', sources: ['r'], nonMaxitive: false, conflictMass: 0, validifiedPossibility: null
|
|
}]);
|
|
return {
|
|
weakest: weakestValidity([labels[0], weakest]),
|
|
mergedWeakest: merged.label === weakest,
|
|
singlePass: single === undefined ? false : single.label === labels[0],
|
|
defaultIsFrozen: Object.isFrozen(DEFAULT_VALIDITY),
|
|
buildPositional: buildValidity('min', ['a'], ['finite_sample'], 2, 0.5).validifiedPossibility === 1
|
|
};
|
|
}, rigor.args(rigor.gen.array(rigor.gen.oneOf(['finite_sample', 'anytime', 'conformal', 'approximate', 'heuristic', 'unknown']), 1, 4)))],
|
|
rigor.crucible([
|
|
rigor.invariant('helper invariants', ({ error, errorMessage, actual }) => !error && !errorMessage && Object.values(actual).every(Boolean))
|
|
])
|
|
).run({ effort: 200, seed: 'validity-helpers-2026', artifacts: { dir: '', persist: 'never' } });
|
|
|
|
const inv = result.crucibleVerdict?.invariants?.find(i => i.name === 'helper invariants');
|
|
assert.ok(inv && inv.passed, `validity helpers violated in ${inv?.failureCount} cases`);
|
|
});
|
|
});
|
|
|
|
describe('Security affordances (rigor)', () => {
|
|
it('FIXED: default results carry only the minimal validity; detail is opt-in', () => {
|
|
const a = mk();
|
|
a.setRelationConfig('t', { intersection: [child('r1'), child('r2')] });
|
|
a.addRelation('u:0', 'r1', 'd:0', { possibility: 0.8, validity: 'finite_sample' });
|
|
a.addRelation('u:0', 'r2', 'd:0', { possibility: 0.5, validity: 'finite_sample' });
|
|
// default: minimal block — no conflict mass, no sources, no validified value
|
|
const r = a.check('u:0', 't', 'd:0');
|
|
assert.equal(r.validity.label, 'approximate');
|
|
assert.equal(r.validity.operator, 'min');
|
|
assert.ok(!('conflictMass' in r.validity), 'conflict mass is not on the default result');
|
|
assert.ok(!('validifiedPossibility' in r.validity), 'validified value is not on the default result');
|
|
assert.ok(!('sources' in r.validity), 'sources are not on the default result');
|
|
// includeMeta: full debugging detail
|
|
const r2 = a.check('u:0', 't', 'd:0', { includeMeta: true });
|
|
assert.equal(r2.validity.conflictMass, 0.5);
|
|
assert.equal(r2.validity.validifiedPossibility, 1);
|
|
assert.deepEqual(r2.validity.sources, ['r1', 'r2']);
|
|
// explain (internal surface) carries the full block
|
|
const e = a.explain('u:0', 't', 'd:0');
|
|
assert.equal(e.decision?.validity?.conflictMass, 0.5, 'explain carries full validity');
|
|
});
|
|
|
|
it('FIXED: audit hook emits one record per check; absent by default', () => {
|
|
const records = [];
|
|
const a = new Arbiter({ audit: (entry) => records.push(entry) });
|
|
a.addNode('u:0', 'user');
|
|
a.addNode('d:0', 'doc');
|
|
a.setRelationConfig('t', { type: 'direct', relation: 'r1' });
|
|
a.addRelation('u:0', 'r1', 'd:0', { possibility: 0.8, validity: 'finite_sample' });
|
|
const r = a.check('u:0', 't', 'd:0');
|
|
assert.equal(records.length, 1, 'one audit record per check');
|
|
assert.equal(records[0].decision, 'allow');
|
|
assert.equal(records[0].possibility, 0.8);
|
|
assert.equal(records[0].validityLabel, 'finite_sample');
|
|
assert.deepEqual(records[0].sources, ['r1']);
|
|
assert.equal(records[0].partialGraphUsed, false);
|
|
// overlay checks flag partial usage
|
|
a.check('u:0', 't', 'd:0', { partialGraph: { relations: [{ src: 'u:0', relation: 'r1', dst: 'd:0', possibility: 0.9 }] } });
|
|
assert.equal(records[1].partialGraphUsed, true);
|
|
// no hook -> no records, no crash
|
|
const plain = new Arbiter();
|
|
plain.addNode('u:0', 'user');
|
|
plain.addNode('d:0', 'doc');
|
|
plain.setRelationConfig('t', { type: 'direct', relation: 'r1' });
|
|
plain.addRelation('u:0', 'r1', 'd:0', { possibility: 0.8 });
|
|
assert.equal(plain.check('u:0', 't', 'd:0').possibility, 0.8);
|
|
});
|
|
|
|
it('FIXED: oversized partial graphs are rejected before allocation', () => {
|
|
const a = new Arbiter({ partialGraphPolicy: { maxRelations: 2, maxNodes: 3 } });
|
|
a.addNode('u:0', 'user');
|
|
a.addNode('d:0', 'doc');
|
|
a.setRelationConfig('t', { type: 'direct', relation: 'owner' });
|
|
assert.throws(
|
|
() => a.check('u:0', 't', 'd:0', { partialGraph: { relations: [{}, {}, {}, {}] } }),
|
|
/exceeds max relations/,
|
|
'relation limit enforced pre-allocation'
|
|
);
|
|
assert.throws(
|
|
() => a.check('u:0', 't', 'd:0', { partialGraph: { nodes: [{}, {}, {}, {}] } }),
|
|
/exceeds max nodes/,
|
|
'node limit enforced pre-allocation'
|
|
);
|
|
});
|
|
});
|