From 351551af0f9b2e5e7fdff44da9824e27fc16367b Mon Sep 17 00:00:00 2001 From: John Dvorak Date: Mon, 3 Aug 2026 12:08:54 -0700 Subject: [PATCH] =?UTF-8?q?feat:=20chain=20condition=20steps=20=E2=80=94?= =?UTF-8?q?=20defeasible/logical=20evidence=20as=20final=20chain=20hop?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A chain's FINAL (object-side) step may now reference a defeasible/logical evidence. The compiler lowers it to a condition step ({ rule: , conditionStep: true }) that the engine verifies at (intermediate, object) instead of traversing an edge. Requires @arbiter/core@^1.0.3 (ChainRule condition-step support). - _expandChainSteps: a logical/defeasible/comparator evidence is expressible as a final condition step; non-final such steps remain a compile error (a condition cannot discover intermediate nodes). - Dependency collection (generator + DSLRuntime) descends into condition-step rule configs, so partial-graph requirements reach through them. Tests: ChainConditionStep (defeasible + ALWAYS steps, independent checkability, parallel aggregation), oracle campaign chain_condition_step construct (oracle = min(pm, pv*(1-pb))), DSLRuntime transitive required facts through a condition step. --- package-lock.json | 12 +-- package.json | 4 +- src/generator/RuleGenerator.js | 22 +++-- src/runtime/DSLRuntime.js | 6 +- tests/ChainConditionStep.test.js | 101 ++++++++++++++++++++++ tests/ChainStepComposition.test.js | 12 ++- tests/DSLRuntime.test.js | 17 ++++ tests/rigor/dsl-generative-oracle.test.js | 27 ++++-- tests/rigor/dsl-illegal-mutations.test.js | 8 -- 9 files changed, 178 insertions(+), 31 deletions(-) create mode 100644 tests/ChainConditionStep.test.js diff --git a/package-lock.json b/package-lock.json index 1d8c499..8a035be 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,15 +1,15 @@ { "name": "@arbiter/evidence-dsl", - "version": "1.1.0", + "version": "1.4.0", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "@arbiter/evidence-dsl", - "version": "1.1.0", + "version": "1.4.0", "license": "ISC", "dependencies": { - "@arbiter/core": "^1.0.2" + "@arbiter/core": "^1.0.3" }, "devDependencies": { "@rigor/core": "^3.1.0", @@ -17,9 +17,9 @@ } }, "node_modules/@arbiter/core": { - "version": "1.0.2", - "resolved": "https://hub.kl1.tenere.ai/api/packages/Arbiter/npm/%40arbiter%2Fcore/-/1.0.2/core-1.0.2.tgz", - "integrity": "sha512-N1duiHy1Rlsxqpvu8uPf4tMaLOQ2tNXvGs53jLkRcIAYqafIAMvcf0BPS2iE2xVKNsqY92+F05bZZEAO5jnbyQ==", + "version": "1.0.3", + "resolved": "https://hub.kl1.tenere.ai/api/packages/Arbiter/npm/%40arbiter%2Fcore/-/1.0.3/core-1.0.3.tgz", + "integrity": "sha512-MCXxyeWBoYjEJMrdO8N8q9uEdX7JgDvwRH39D+8x65zFz+JCNWIQ8H4DgsP2rgF+yzv/cdVH4BX9PfFt6i0ftQ==", "license": "ISC", "dependencies": { "@tenere/pltc-core": "^0.6.3", diff --git a/package.json b/package.json index 4a0ab4a..93d3b27 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@arbiter/evidence-dsl", - "version": "1.3.0", + "version": "1.4.0", "description": "Evidence DSL v2 compiler: translates the natural Evidence DSL (ADR-000) into @arbiter/core relation configurations.", "license": "ISC", "type": "module", @@ -24,7 +24,7 @@ "generate:parser": "node scripts/generate-parser.js" }, "dependencies": { - "@arbiter/core": "^1.0.2" + "@arbiter/core": "^1.0.3" }, "devDependencies": { "@rigor/core": "^3.1.0", diff --git a/src/generator/RuleGenerator.js b/src/generator/RuleGenerator.js index af9355b..0da679a 100644 --- a/src/generator/RuleGenerator.js +++ b/src/generator/RuleGenerator.js @@ -155,6 +155,7 @@ export class RuleGenerator { for (const step of rule.steps) { if (typeof step === 'string') targetSet.add(step); else if (step && typeof step.relation === 'string') targetSet.add(step.relation); + else if (step && step.rule) collect(step.rule, targetSet); } } if (rule.type === 'relational_comparator') { @@ -1070,13 +1071,18 @@ export class RuleGenerator { * - chain evidence → splice its steps into this chain (flattening) * (a step that is itself a sub-path becomes its steps, preserving the * linear source→…→object traversal); - * - anything else (defeasible/logical/comparator) → compile error: such a - * step is a condition, not an edge traversal, and cannot lower to a flat - * chain step. + * - logical / defeasible / comparator evidence → only expressible as a + * FINAL condition-gated step (the object is known, so the engine can + * verify the condition at (intermediate, object) instead of traversing + * an edge). Emitted as a `{ rule: }` step the ChainRule + * evaluates as a condition hop. Non-final such steps are a compile + * error: a condition cannot discover intermediate nodes. */ _expandChainSteps(steps, stack) { const out = []; - for (const step of steps) { + for (let idx = 0; idx < steps.length; idx++) { + const step = steps[idx]; + const isLast = idx === steps.length - 1; const stepName = typeof step === 'string' ? step : step.relation; if (stepName && this.evidenceNames.has(stepName)) { if (stack.has(stepName)) { @@ -1099,8 +1105,14 @@ export class RuleGenerator { out.push(...this._expandChainSteps(resolved.steps, refStack)); continue; } + if (isLast) { + // Condition-gated final hop: inline the evidence's config as a + // rule step the engine evaluates at (intermediate, object). + out.push({ rule: this._deepCloneRule(resolved), conditionStep: true }); + continue; + } this.errors.push(`Chain step '${stepName}' references an evidence with type '${resolved.type || 'logical'}'. ` + - 'Chain steps can only reference facts, direct evidence, or chain evidence.'); + 'Only the final chain step may reference a defeasible/logical evidence (a condition-gated hop); intermediate steps must be edge traversals.'); out.push(step); continue; } diff --git a/src/runtime/DSLRuntime.js b/src/runtime/DSLRuntime.js index 54f46f8..cfbe0c5 100644 --- a/src/runtime/DSLRuntime.js +++ b/src/runtime/DSLRuntime.js @@ -103,7 +103,11 @@ export class DSLRuntime { if (rule.computedRelation) deps.add(rule.computedRelation); } if (rule.type === 'chain' && Array.isArray(rule.steps)) { - for (const s of rule.steps) deps.add(typeof s === 'string' ? s : s.relation); + for (const s of rule.steps) { + if (typeof s === 'string') deps.add(s); + else if (s && s.relation) deps.add(s.relation); + else if (s && s.rule) collect(s.rule); + } } if (rule.type === 'parent' && rule.parentRelation) deps.add(rule.parentRelation); if (rule.type === 'multi_hop' && rule.relation) deps.add(rule.relation); diff --git a/tests/ChainConditionStep.test.js b/tests/ChainConditionStep.test.js new file mode 100644 index 0000000..ef50b00 --- /dev/null +++ b/tests/ChainConditionStep.test.js @@ -0,0 +1,101 @@ +/** + * tests/ChainConditionStep.test.js — a chain whose FINAL (object-side) hop + * references a defeasible/logical evidence. The compiler lowers it to a + * condition step: `{ rule: , conditionStep: true }`, which the engine + * verifies at (intermediate, object) rather than traversing an edge. + * + * Only the final step may be a condition (the object is known); an + * intermediate condition cannot discover nodes and is a compile error. + */ +import { describe, it } from 'node:test'; +import assert from 'node:assert/strict'; +import { Arbiter } from '@arbiter/core'; +import { DSLCompiler } from '../src/DSLCompiler.js'; + +const DEFS = ` + definition Employee { id: string } + definition Group { id: string } + definition Doc { id: string } + fact member_of(user: Employee, group: Group) + fact can_view(group: Group, doc: Doc) + fact banned(group: Group) + fact can_edit(group: Group, doc: Doc) +`; + +function compile(dsl, name = 'chain-cond') { + const arb = new Arbiter(); + const compiler = new DSLCompiler(arb); + const result = compiler.compile(dsl, name); + return { arb, result }; +} + +describe('Chain condition step (logical evidence as final hop)', () => { + it('lowers a defeasible final step to a condition step and grants', () => { + const { arb, result } = compile(` + ${DEFS} + evidence gated(group: Group, doc: Doc) { WHEN can_view(group, doc) UNLESS banned(group) } + evidence can_via(user: Employee, doc: Doc) { member_of(user, *g) { gated(g, doc) } } + `); + assert.ok(result.success, JSON.stringify(result.errors)); + const steps = arb.relationConfigs.get('can_via').steps; + assert.equal(steps[0], 'member_of'); + assert.equal(steps[1].conditionStep, true); + assert.equal(steps[1].rule.type, 'logical'); + // transitive dependency collection through the condition step + assert.deepEqual(arb.relationConfigs.get('can_via').dependsOn, ['member_of', 'can_view', 'banned']); + + arb.addNode('u:1', 'Employee'); arb.addNode('g:1', 'Group'); arb.addNode('doc:9', 'Doc'); + arb.addRelation('u:1', 'member_of', 'g:1', { possibility: 1.0 }); + arb.addRelation('g:1', 'can_view', 'doc:9', { possibility: 0.7 }); + assert.equal(arb.check('u:1', 'can_via', 'doc:9').possibility, 0.7); + + // banning the intermediate defeats the condition hop + arb.addRelation('g:1', 'banned', 'g:1', { possibility: 1.0 }); + assert.equal(arb.check('u:1', 'can_via', 'doc:9').possibility, 0); + }); + + it('supports ALWAYS/NEVER evidence as a condition step', () => { + const { arb, result } = compile(` + ${DEFS} + evidence gated(group: Group, doc: Doc) { ALWAYS can_edit(group, doc) } + evidence can_via(user: Employee, doc: Doc) { member_of(user, *g) { gated(g, doc) } } + `); + assert.ok(result.success, JSON.stringify(result.errors)); + const steps = arb.relationConfigs.get('can_via').steps; + assert.equal(steps[1].conditionStep, true); + arb.addNode('u:1', 'Employee'); arb.addNode('g:1', 'Group'); arb.addNode('doc:9', 'Doc'); + arb.addRelation('u:1', 'member_of', 'g:1', { possibility: 1.0 }); + arb.addRelation('g:1', 'can_edit', 'doc:9', { possibility: 0.6 }); + assert.equal(arb.check('u:1', 'can_via', 'doc:9').possibility, 0.6); + arb.removeRelation('g:1', 'can_edit', 'doc:9'); + assert.equal(arb.check('u:1', 'can_via', 'doc:9').possibility, 0); + }); + + it('keeps the condition evidence checkable in its own right', () => { + const { arb, result } = compile(` + ${DEFS} + evidence gated(group: Group, doc: Doc) { WHEN can_view(group, doc) UNLESS banned(group) } + evidence can_via(user: Employee, doc: Doc) { member_of(user, *g) { gated(g, doc) } } + `); + assert.ok(result.success, JSON.stringify(result.errors)); + arb.addNode('g:1', 'Group'); arb.addNode('doc:9', 'Doc'); + arb.addRelation('g:1', 'can_view', 'doc:9', { possibility: 0.8 }); + assert.equal(arb.check('g:1', 'gated', 'doc:9').possibility, 0.8); + }); + + it('parallel intermediates aggregate through the condition step', () => { + const { arb, result } = compile(` + ${DEFS} + evidence gated(group: Group, doc: Doc) { can_view(group, doc) } + evidence can_via(user: Employee, doc: Doc) { member_of(user, *g) { gated(g, doc) } } + `); + assert.ok(result.success, JSON.stringify(result.errors)); + arb.addNode('u:1', 'Employee'); arb.addNode('g:1', 'Group'); arb.addNode('g2:2', 'Group'); arb.addNode('doc:9', 'Doc'); + arb.addRelation('u:1', 'member_of', 'g:1', { possibility: 0.5 }); + arb.addRelation('g:1', 'can_view', 'doc:9', { possibility: 0.7 }); + arb.addRelation('u:1', 'member_of', 'g2:2', { possibility: 1.0 }); + arb.addRelation('g2:2', 'can_view', 'doc:9', { possibility: 0.8 }); + // max over paths: min(0.5,0.7)=0.5, min(1.0,0.8)=0.8 -> 0.8 + assert.equal(arb.check('u:1', 'can_via', 'doc:9').possibility, 0.8); + }); +}); diff --git a/tests/ChainStepComposition.test.js b/tests/ChainStepComposition.test.js index de6604a..da33063 100644 --- a/tests/ChainStepComposition.test.js +++ b/tests/ChainStepComposition.test.js @@ -81,14 +81,18 @@ describe('Chain step composition', () => { assert.equal(arb.check('u:1', 'can_via', 'doc:9').possibility, 0.6); }); - it('rejects a defeasible/logical evidence as a chain step', () => { - const { result } = compile(` + it('lowers a logical evidence FINAL step to a condition step', () => { + const { arb, result } = compile(` ${DEFS} evidence gated(group: Group, doc: Doc) { WHEN can_view(group, doc) UNLESS banned(group) } evidence can_via(user: Employee, doc: Doc) { member_of(user, *g) { gated(g, doc) } } `); - assert.equal(result.success, false); - assert.ok(result.errors.some(e => /Chain step 'gated'/.test(e)), JSON.stringify(result.errors)); + assert.ok(result.success, JSON.stringify(result.errors)); + // final-step logical evidence → condition step (verified at the object) + const steps = arb.relationConfigs.get('can_via').steps; + assert.equal(steps[0], 'member_of'); + assert.equal(steps[1].conditionStep, true); + assert.equal(steps[1].rule.type, 'logical'); }); it('rejects a mutual cycle through chain steps', () => { diff --git a/tests/DSLRuntime.test.js b/tests/DSLRuntime.test.js index d842bcb..b03f41f 100644 --- a/tests/DSLRuntime.test.js +++ b/tests/DSLRuntime.test.js @@ -188,4 +188,21 @@ describe('DSLRuntime', () => { assert.equal(denied.possibility, 0); assert.equal(denied.reason, 'defeated_by_unless'); }); + + it('derives transitive required facts through a condition-step chain', () => { + const dsl = ` + definition Employee { id: string } + definition Group { id: string } + definition Doc { id: string } + fact *member_of(user: Employee, group: Group) + fact *can_view(group: Group, doc: Doc) + fact *banned(group: Group) + evidence gated(group: Group, doc: Doc) { WHEN can_view(group, doc) UNLESS banned(group) } + evidence can_via(user: Employee, doc: Doc) { member_of(user, *g) { gated(g, doc) } } + `; + const rt = new DSLRuntime(new Arbiter()).compile(dsl, 'rt-cond'); + // The condition step's facts (can_view, banned) reach through to the + // evidence's requirements, alongside the edge-traversal fact. + assert.deepEqual(rt.requiredFacts('can_via'), ['member_of', 'can_view', 'banned']); + }); }); diff --git a/tests/rigor/dsl-generative-oracle.test.js b/tests/rigor/dsl-generative-oracle.test.js index 44d7df2..6e7aa21 100644 --- a/tests/rigor/dsl-generative-oracle.test.js +++ b/tests/rigor/dsl-generative-oracle.test.js @@ -34,6 +34,7 @@ const FACTS = ` fact granted(user: Employee, doc: Doc) fact group_perm(group: Group, doc: Doc) fact banned(user: Employee) + fact group_banned(group: Group) fact mfa(user: Employee) `; @@ -128,6 +129,19 @@ function buildProgram(kind, ps) { oracle = Math.min(pm, pv); break; } + case 'chain_condition_step': { + // gated (a defeasible evidence) as the FINAL chain step → a condition + // step: the engine verifies gated at (intermediate, object). The oracle + // is the chain's min combined with the condition's base*(1-defeat). + const [pm, pv, pb] = ps; + evidence = `evidence gated(group: Group, doc: Doc) { WHEN group_perm(group, doc) UNLESS group_banned(group) } + evidence can_via(user: Employee, doc: Doc) { member_of(user, *g) { gated(g, doc) } }`; + edges.push({ src: 'u:1', relation: 'member_of', dst: 'g:1', possibility: pm }); + edges.push({ src: 'g:1', relation: 'group_perm', dst: 'doc:9', possibility: pv }); + edges.push({ src: 'g:1', relation: 'group_banned', dst: 'g:1', possibility: pb }); + oracle = Math.min(pm, pv * (1 - pb)); + break; + } default: throw new Error(`unknown construct: ${kind}`); } @@ -163,7 +177,8 @@ function runCheck({ kind, ps }) { } const CONSTRUCTS = ['direct', 'chain', 'tuple_to_userset', 'fusion_min', 'fusion_max', - 'when_unless', 'never_always', 'requires_when', 'composition', 'chain_step_composition']; + 'when_unless', 'never_always', 'requires_when', 'composition', 'chain_step_composition', + 'chain_condition_step']; describe('DSL generative oracle parity (rigor)', () => { it('generated legal DSL compiles and every check matches the oracle', async () => { @@ -174,7 +189,7 @@ describe('DSL generative oracle parity (rigor)', () => { kind: rigor.gen.oneOf(CONSTRUCTS), // exactly two edge possibilities (direct uses only the first); // a shorter array would leave pB undefined and produce a NaN oracle - ps: rigor.gen.tuple(rigor.gen.oneOf(P), rigor.gen.oneOf(P)) + ps: rigor.gen.tuple(rigor.gen.oneOf(P), rigor.gen.oneOf(P), rigor.gen.oneOf(P)) }) )) ], @@ -192,13 +207,14 @@ describe('DSL generative oracle parity (rigor)', () => { }); it('exhaustive deterministic sweep: every construct x every possibility value', () => { - // Anti-vacuity complement to the campaign: sweep the full P × P grid per - // construct without any RNG, so a construct the campaign skipped would + // Anti-vacuity complement to the campaign: sweep the full P × P × P grid + // per construct without any RNG, so a construct the campaign skipped would // still be caught here. for (const kind of CONSTRUCTS) { for (const a of P) { for (const b of P) { - const ps = kind === 'direct' ? [a] : [a, b]; + for (const c of P) { + const ps = kind === 'direct' ? [a] : [a, b, c]; const { dsl, edges, oracle, relation } = buildProgram(kind, ps); const arbiter = new Arbiter(); arbiter.addNode('u:1', 'Employee'); @@ -212,6 +228,7 @@ describe('DSL generative oracle parity (rigor)', () => { Math.abs(result.possibility - oracle) <= EPS, `${kind} ps=[${ps}] check=${result.possibility}(${result.reason}) vs oracle=${oracle}` ); + } } } } diff --git a/tests/rigor/dsl-illegal-mutations.test.js b/tests/rigor/dsl-illegal-mutations.test.js index 6521310..96c444e 100644 --- a/tests/rigor/dsl-illegal-mutations.test.js +++ b/tests/rigor/dsl-illegal-mutations.test.js @@ -96,14 +96,6 @@ const MUTATIONS = { 'evidence can_read(user: Employee, doc: Doc) { owns(user, doc) }', 'fact can_read(user: Employee, doc: Doc)\n evidence can_read(user: Employee, doc: Doc) { owns(user, doc) }' ) - }, - non_lowerable_chain_step: { - desc: 'a defeasible evidence used as a chain step (cannot lower to an edge)', - mustFail: true, - apply: () => VALID_DSL.replace( - 'evidence can_enter(user: Employee, doc: Doc) { member_of(user, *g) { can_access(g, doc) } }', - 'evidence can_gated(group: Group, doc: Doc) { WHEN can_access(group, doc) UNLESS banned(group) }\n evidence can_enter(user: Employee, doc: Doc) { member_of(user, *g) { can_gated(g, doc) } }' - ).replace('fact can_access(group: Group, doc: Doc)', 'fact can_access(group: Group, doc: Doc)\n fact banned(group: Group)') } };