1.13.0: measure + evidence compose; value-graph now a registry dep

- DSLValueGraph integrates the evidence DSL with @arbiter/value-graph: measures
  become typed value-graph nodes; attach() wires runtime.measure through the graph.
- DSLRuntime.check() now retrieves required MEASURE values and injects them as
  value-carrying self-edges, so an evidence comparator over a measure (e.g.
  budget_used(user) <= budget_limit(user)) evaluates — measure and evidence
  compose (provider-sourced AND value-graph-sourced), with 3 new composition tests.
- BUILTIN_TYPES: bigint → buffer (the value-graph wire is JSON-free/bigint-free).
- @arbiter/value-graph: file:../value-graph → ^0.1.0 (registry); CI auth adds
  @push-stream-std registry for the transitive dep.
- rigor core ^3.1.2 / probe ^0.0.8.

.gitea/workflows/ci.yaml

@@ -26,6 +26,10 @@ jobs:
           echo "//hub.kl1.tenere.ai/api/packages/Arbiter/npm/:_authToken=${{ secrets.PACKAGE_TOKEN }}" >> .npmrc
           echo "@tenere:registry=https://hub.kl1.tenere.ai/api/packages/Tenere/npm/" >> .npmrc
           echo "//hub.kl1.tenere.ai/api/packages/Tenere/npm/:_authToken=${{ secrets.PACKAGE_TOKEN }}" >> .npmrc
+          echo "@push-stream-std:registry=https://hub.kl1.tenere.ai/api/packages/push-stream-std/npm/" >> .npmrc
+          echo "//hub.kl1.tenere.ai/api/packages/push-stream-std/npm/:_authToken=${{ secrets.PACKAGE_TOKEN }}" >> .npmrc
+          echo "@rigor:registry=https://hub.kl1.tenere.ai/api/packages/Rigor/npm/" >> .npmrc
+          echo "//hub.kl1.tenere.ai/api/packages/Rigor/npm/:_authToken=${{ secrets.PACKAGE_TOKEN }}" >> .npmrc
 
       - run: npm ci
 
@@ -50,6 +54,10 @@ jobs:
           echo "//hub.kl1.tenere.ai/api/packages/Arbiter/npm/:_authToken=${{ secrets.PACKAGE_TOKEN }}" >> .npmrc
           echo "@tenere:registry=https://hub.kl1.tenere.ai/api/packages/Tenere/npm/" >> .npmrc
           echo "//hub.kl1.tenere.ai/api/packages/Tenere/npm/:_authToken=${{ secrets.PACKAGE_TOKEN }}" >> .npmrc
+          echo "@push-stream-std:registry=https://hub.kl1.tenere.ai/api/packages/push-stream-std/npm/" >> .npmrc
+          echo "//hub.kl1.tenere.ai/api/packages/push-stream-std/npm/:_authToken=${{ secrets.PACKAGE_TOKEN }}" >> .npmrc
+          echo "@rigor:registry=https://hub.kl1.tenere.ai/api/packages/Rigor/npm/" >> .npmrc
+          echo "//hub.kl1.tenere.ai/api/packages/Rigor/npm/:_authToken=${{ secrets.PACKAGE_TOKEN }}" >> .npmrc
 
       - run: npm ci
 

.npmrc

@@ -2,3 +2,7 @@
 //hub.kl1.tenere.ai/api/packages/Arbiter/npm/:_authToken=${PACKAGE_TOKEN}
 @tenere:registry=https://hub.kl1.tenere.ai/api/packages/Tenere/npm/
 //hub.kl1.tenere.ai/api/packages/Tenere/npm/:_authToken=${PACKAGE_TOKEN}
+@rigor:registry=https://hub.kl1.tenere.ai/api/packages/Rigor/npm/
+//hub.kl1.tenere.ai/api/packages/Rigor/npm/:_authToken=${PACKAGE_TOKEN}
+@push-stream-std:registry=https://hub.kl1.tenere.ai/api/packages/push-stream-std/npm/
+//hub.kl1.tenere.ai/api/packages/push-stream-std/npm/:_authToken=${PACKAGE_TOKEN}

bench/measure-hotpath.mjs

@@ -0,0 +1,26 @@
+// DSLValueGraph measure hotpath (async retrieval for authorization checks).
+import { performance } from 'node:perf_hooks';
+import { DSLRuntime, DSLValueGraph } from '../src/index.js';
+import { Arbiter } from '@arbiter/core';
+
+const rt = new DSLRuntime(new Arbiter()).compile('measure budget(user: string) { } PROVIDES number', 'bench');
+const dvg = new DSLValueGraph(rt);
+dvg.attach();
+dvg.setValue('budget', { __subject: 'u:1', user: 'u:1' }, 1250);
+
+async function measureCached() { return dvg.measure('budget', { __subject: 'u:1', user: 'u:1' }); }
+await measureCached(); // warm
+let t0 = performance.now();
+let N = 20_000;
+for (let i = 0; i < N; i++) await measureCached();
+console.log(`dvg.measure cached (async)   ${(((performance.now() - t0) / N) * 1e6).toFixed(0).padStart(8)} ns/op  ${Math.round(N / ((performance.now() - t0) / 1000)).toLocaleString()} ops/sec`);
+
+// cold: a fresh measure with an external resolver computing on the fly
+const cold = new DSLValueGraph(new DSLRuntime(new Arbiter()).compile('measure b(user: string) { } PROVIDES number', 'b'));
+cold.resolve('b', (s) => 99);
+async function measureCold() { return cold.measure('b', { __subject: 'u:1', user: 'u:1' }); }
+await measureCold();
+t0 = performance.now();
+N = 20_000;
+for (let i = 0; i < N; i++) await measureCold();
+console.log(`dvg.measure cold (resolver)  ${(((performance.now() - t0) / N) * 1e6).toFixed(0).padStart(8)} ns/op`);

package-lock.json

@@ -1,24 +1,25 @@
 {
   "name": "@arbiter/evidence-dsl",
-  "version": "1.0.0",
+  "version": "1.13.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@arbiter/evidence-dsl",
-      "version": "1.0.0",
+      "version": "1.13.0",
       "license": "ISC",
       "dependencies": {
-        "@arbiter/core": "^1.0.1"
+        "@arbiter/core": "^1.0.8",
+        "@arbiter/value-graph": "^0.1.0",
+        "@rigor/probe": "^0.0.8"
       },
       "devDependencies": {
+        "@rigor/core": "^3.1.2",
         "peggy": "^5.0.6"
       }
     },
     "node_modules/@arbiter/core": {
-      "version": "1.0.1",
-      "resolved": "https://hub.kl1.tenere.ai/api/packages/Arbiter/npm/%40arbiter%2Fcore/-/1.0.1/core-1.0.1.tgz",
-      "integrity": "sha512-BfIv6vRKsuJR39WBkBGxl2PQ/LDoW/J1u4UeFrog0AbeTSTvRqhxG1+its2pAcUvcQXq99ZOccFlK3XgNRKt4Q==",
+      "version": "1.0.8",
       "license": "ISC",
       "dependencies": {
         "@tenere/pltc-core": "^0.6.3",
@@ -26,10 +27,19 @@
         "uuidv7": "^1.0.2"
       }
     },
+    "node_modules/@arbiter/value-graph": {
+      "version": "0.1.0",
+      "resolved": "https://hub.kl1.tenere.ai/api/packages/Arbiter/npm/%40arbiter%2Fvalue-graph/-/0.1.0/value-graph-0.1.0.tgz",
+      "integrity": "sha512-sofmF6O/o3bUf2Vzg24MxSB6NLQR8s2xjaBqL+k2LbGhlmt4/lHD9J6l/CjgObn+4UsXjb/QEccZ8rX0BFOUKg==",
+      "license": "ISC",
+      "dependencies": {
+        "@push-stream-std/push-pushable": "*",
+        "@push-stream-std/push-stream-base": "*",
+        "@rigor/probe": "^0.0.8"
+      }
+    },
     "node_modules/@peggyjs/from-mem": {
       "version": "3.1.3",
-      "resolved": "https://registry.npmjs.org/@peggyjs/from-mem/-/from-mem-3.1.3.tgz",
-      "integrity": "sha512-LLlgtfXIaeYXoOYovOI0spLM8ZXaqkAlmcRRrLzHJzLMqkU6Sw0R4KMoCoHx1PjaP815pSCBlS+BN6aD8t1Jgg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -39,25 +49,318 @@
         "node": ">=20.8"
       }
     },
+    "node_modules/@push-stream-std/push-pushable": {
+      "version": "0.0.10",
+      "resolved": "https://hub.kl1.tenere.ai/api/packages/push-stream-std/npm/%40push-stream-std%2Fpush-pushable/-/0.0.10/push-pushable-0.0.10.tgz",
+      "integrity": "sha512-xf8nt50zckM8G+WRKV5RTNl4EEe6rhzuplNfqpdZ/b8kx0HnuTawDHlL0R449PKqG9X4DOQ5RzBrX2jYAnfY2A==",
+      "license": "SEE LICENSE IN LICENSE",
+      "dependencies": {
+        "@push-stream-std/push-stream-base": "*"
+      }
+    },
+    "node_modules/@push-stream-std/push-stream-base": {
+      "version": "0.0.9",
+      "resolved": "https://hub.kl1.tenere.ai/api/packages/push-stream-std/npm/%40push-stream-std%2Fpush-stream-base/-/0.0.9/push-stream-base-0.0.9.tgz",
+      "integrity": "sha512-RCbTwQz88XR0j0f/0NWIWgQ3NBQUUICu+CRHzOAvYfG2YQ8j+aTczYWTEedJJhGA+svcFrAQ8Oai/UnjtQ0l3Q==",
+      "license": "SEE LICENSE IN LICENSE"
+    },
+    "node_modules/@rigor/analysis": {
+      "version": "0.0.7",
+      "dev": true,
+      "license": "SEE LICENSE IN LICENSE",
+      "dependencies": {
+        "@rigor/instrument": "*",
+        "@rigor/trace": "*"
+      },
+      "engines": {
+        "node": ">=22.0.0"
+      }
+    },
+    "node_modules/@rigor/artifact": {
+      "version": "0.1.3",
+      "dev": true,
+      "license": "SEE LICENSE IN LICENSE",
+      "dependencies": {
+        "@rigor/trace": "*"
+      },
+      "engines": {
+        "node": ">=22.0.0"
+      }
+    },
+    "node_modules/@rigor/benchmark": {
+      "version": "0.0.6",
+      "dev": true,
+      "license": "SEE LICENSE IN LICENSE",
+      "dependencies": {
+        "@rigor/artifact": "*",
+        "@rigor/complexity": "*",
+        "@rigor/trace": "*"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@rigor/complexity": {
+      "version": "0.0.7",
+      "dev": true,
+      "license": "SEE LICENSE IN LICENSE",
+      "dependencies": {
+        "@rigor/trace": "*"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@rigor/core": {
+      "version": "3.1.2",
+      "dev": true,
+      "license": "SEE LICENSE IN LICENSE",
+      "dependencies": {
+        "@rigor/analysis": "*",
+        "@rigor/artifact": "*",
+        "@rigor/benchmark": "*",
+        "@rigor/complexity": "*",
+        "@rigor/fault": "*",
+        "@rigor/fuzzer": "*",
+        "@rigor/gen": "*",
+        "@rigor/instrument": "*",
+        "@rigor/linearizability": "*",
+        "@rigor/model": "*",
+        "@rigor/network": "*",
+        "@rigor/probe": "*",
+        "@rigor/prop": "*",
+        "@rigor/reporters": "*",
+        "@rigor/rng": "*",
+        "@rigor/search": "*",
+        "@rigor/shrink": "*",
+        "@rigor/spec": "*",
+        "@rigor/storage": "*",
+        "@rigor/trace": "*"
+      },
+      "engines": {
+        "node": ">=22.0.0"
+      }
+    },
+    "node_modules/@rigor/fault": {
+      "version": "0.0.5",
+      "license": "SEE LICENSE IN LICENSE",
+      "dependencies": {
+        "@rigor/rng": "*",
+        "@rigor/shrink": "*",
+        "@rigor/trace": "*"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@rigor/fuzzer": {
+      "version": "0.0.4",
+      "dev": true,
+      "license": "SEE LICENSE IN LICENSE",
+      "dependencies": {
+        "@rigor/artifact": "*",
+        "@rigor/rng": "*",
+        "@rigor/shrink": "*",
+        "@rigor/trace": "*"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@rigor/gen": {
+      "version": "0.0.11",
+      "license": "SEE LICENSE IN LICENSE",
+      "dependencies": {
+        "@rigor/rng": "*"
+      },
+      "engines": {
+        "node": ">=22.0.0"
+      }
+    },
+    "node_modules/@rigor/instrument": {
+      "version": "0.0.5",
+      "dev": true,
+      "license": "SEE LICENSE IN LICENSE",
+      "dependencies": {
+        "@rigor/probe": "*",
+        "@rigor/trace": "*"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@rigor/linearizability": {
+      "version": "0.0.5",
+      "dev": true,
+      "license": "SEE LICENSE IN LICENSE",
+      "engines": {
+        "node": ">=22.0.0"
+      }
+    },
+    "node_modules/@rigor/model": {
+      "version": "0.2.13",
+      "dev": true,
+      "license": "SEE LICENSE IN LICENSE",
+      "dependencies": {
+        "@rigor/artifact": "*",
+        "@rigor/complexity": "*",
+        "@rigor/fault": "*",
+        "@rigor/gen": "*",
+        "@rigor/probe": "*",
+        "@rigor/rng": "*",
+        "@rigor/shrink": "*",
+        "@rigor/trace": "*"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@rigor/network": {
+      "version": "0.0.4",
+      "dev": true,
+      "license": "SEE LICENSE IN LICENSE",
+      "dependencies": {
+        "@rigor/fault": "*",
+        "@rigor/rng": "*",
+        "@rigor/scheduler": "*",
+        "@rigor/trace": "*"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@rigor/probe": {
+      "version": "0.0.8",
+      "license": "SEE LICENSE IN LICENSE",
+      "dependencies": {
+        "@rigor/fault": "*",
+        "@rigor/gen": "*",
+        "@rigor/trace": "*"
+      },
+      "engines": {
+        "node": ">=22.0.0"
+      }
+    },
+    "node_modules/@rigor/prop": {
+      "version": "0.0.4",
+      "dev": true,
+      "license": "SEE LICENSE IN LICENSE",
+      "dependencies": {
+        "@rigor/artifact": "*",
+        "@rigor/complexity": "*",
+        "@rigor/gen": "*",
+        "@rigor/probe": "*",
+        "@rigor/rng": "*",
+        "@rigor/shrink": "*",
+        "@rigor/trace": "*"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@rigor/reporters": {
+      "version": "0.0.5",
+      "dev": true,
+      "license": "SEE LICENSE IN LICENSE",
+      "dependencies": {
+        "@rigor/artifact": "*",
+        "@rigor/trace": "*"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@rigor/rng": {
+      "version": "0.0.3",
+      "license": "SEE LICENSE IN LICENSE",
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@rigor/scheduler": {
+      "version": "0.0.4",
+      "dev": true,
+      "license": "SEE LICENSE IN LICENSE",
+      "dependencies": {
+        "@rigor/fault": "*",
+        "@rigor/rng": "*",
+        "@rigor/shrink": "*",
+        "@rigor/trace": "*"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@rigor/search": {
+      "version": "0.1.3",
+      "dev": true,
+      "license": "SEE LICENSE IN LICENSE",
+      "dependencies": {
+        "@rigor/gen": "*",
+        "@rigor/shrink": "*"
+      },
+      "engines": {
+        "node": ">=22.0.0"
+      }
+    },
+    "node_modules/@rigor/shrink": {
+      "version": "0.0.7",
+      "license": "SEE LICENSE IN LICENSE",
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@rigor/spec": {
+      "version": "2.0.1",
+      "dev": true,
+      "license": "SEE LICENSE IN LICENSE",
+      "dependencies": {
+        "@rigor/gen": "*"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@rigor/storage": {
+      "version": "0.0.4",
+      "dev": true,
+      "license": "SEE LICENSE IN LICENSE",
+      "dependencies": {
+        "@rigor/fault": "*",
+        "@rigor/rng": "*",
+        "@rigor/scheduler": "*",
+        "@rigor/trace": "*"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@rigor/trace": {
+      "version": "0.0.7",
+      "license": "SEE LICENSE IN LICENSE",
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
     "node_modules/@tenere/graph-core": {
       "version": "1.0.1",
-      "resolved": "https://hub.kl1.tenere.ai/api/packages/Tenere/npm/%40tenere%2Fgraph-core/-/1.0.1/graph-core-1.0.1.tgz",
-      "integrity": "sha512-29EzF1yBVLuaaapmrL+xNGRaWsM2Ln0G+WHVJURNzwQnDUC2ZSgaeVRMGj3aHFOj2K4mfSh9JqBP5Az2ZHU4pw==",
-      "license": "MIT"
+      "license": "MIT",
+      "engines": {
+        "node": ">=18.0.0"
+      }
     },
     "node_modules/@tenere/pltc-core": {
       "version": "0.6.3",
-      "resolved": "https://hub.kl1.tenere.ai/api/packages/Tenere/npm/%40tenere%2Fpltc-core/-/0.6.3/pltc-core-0.6.3.tgz",
-      "integrity": "sha512-+XsxNw35fyX8ku19FfyFsb6DgYoaKb6wkAbo1VF+moeyZ0D3AqDTofsBnd2sv5o2y8RpB3XftBxt0Hv1sBcQtg==",
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
         "@tenere/graph-core": "^1.0.1"
+      },
+      "engines": {
+        "node": ">=22.0.0"
       }
     },
     "node_modules/commander": {
       "version": "14.0.3",
-      "resolved": "https://registry.npmjs.org/commander/-/commander-14.0.3.tgz",
-      "integrity": "sha512-H+y0Jo/T1RZ9qPP4Eh1pkcQcLRglraJaSLoyOtHxu6AapkjWVCy2Sit1QQ4x3Dng8qDlSsZEet7g5Pq06MvTgw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -66,14 +369,10 @@
     },
     "node_modules/heapify": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/heapify/-/heapify-1.0.2.tgz",
-      "integrity": "sha512-h/b3y12Orh2VsISvDsF/vulkoKH38P7yr223hfWJILo3imy7dX8f9ZrBgkkfLsJG11g8GI1/y6+8POSxgR7YcQ==",
       "license": "MIT"
     },
     "node_modules/peggy": {
       "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/peggy/-/peggy-5.1.0.tgz",
-      "integrity": "sha512-IEo5aYRZ2kXH4Qby06cjtL114PZnwLoTiA41vUmg2vPZgANn+c87m5BUurhuDr5/cu758ZlpgsAfBVx+hhO5+w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -90,8 +389,6 @@
     },
     "node_modules/semver": {
       "version": "7.7.4",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.4.tgz",
-      "integrity": "sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA==",
       "dev": true,
       "license": "ISC",
       "bin": {
@@ -103,8 +400,6 @@
     },
     "node_modules/source-map-generator": {
       "version": "2.0.6",
-      "resolved": "https://registry.npmjs.org/source-map-generator/-/source-map-generator-2.0.6.tgz",
-      "integrity": "sha512-IlassDs1Ve8nV6uyQZXF9kdkJpVKnMte2JZQXu13M0A5zwc+vu6+LNHfmxsHBMDtoZE21RHiKI0/xvpecZRCNg==",
       "dev": true,
       "license": "BSD-3-Clause",
       "engines": {
@@ -113,8 +408,6 @@
     },
     "node_modules/uuidv7": {
       "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/uuidv7/-/uuidv7-1.2.1.tgz",
-      "integrity": "sha512-4kPkK3/XTQW9Hbm4CaqfICn+kY9LJtDVEOfgsRRra/+n2Ofg4NqzRFceAkxvQ/Ud/6BpHOPzj8cirqM7TzTN5Q==",
       "license": "Apache-2.0",
       "bin": {
         "uuidv7": "cli.js"

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arbiter/evidence-dsl",
-  "version": "1.0.0",
+  "version": "1.13.0",
   "description": "Evidence DSL v2 compiler: translates the natural Evidence DSL (ADR-000) into @arbiter/core relation configurations.",
   "license": "ISC",
   "type": "module",
@@ -13,6 +13,7 @@
     "./parser/GeneratedParser": "./src/parser/GeneratedParser.js",
     "./generator/RuleGenerator": "./src/generator/RuleGenerator.js",
     "./validation/DSLValidation": "./src/validation/DSLValidation.js",
+    "./runtime/DSLRuntime": "./src/runtime/DSLRuntime.js",
     "./interpreter/BuiltInFunctions": "./src/interpreter/BuiltInFunctions.js"
   },
   "files": [
@@ -20,12 +21,16 @@
   ],
   "scripts": {
     "test": "node --test --test-force-exit \"tests/**/*.test.js\"",
-    "generate:parser": "node scripts/generate-parser.js"
+    "generate:parser": "node scripts/generate-parser.js",
+    "bench": "node bench/measure-hotpath.mjs"
   },
   "dependencies": {
-    "@arbiter/core": "^1.0.1"
+    "@arbiter/core": "^1.0.8",
+    "@arbiter/value-graph": "^0.1.0",
+    "@rigor/probe": "^0.0.8"
   },
   "devDependencies": {
+    "@rigor/core": "^3.1.2",
     "peggy": "^5.0.6"
   }
 }

src/DSLCompiler.js

@@ -7,10 +7,10 @@ import { validateDslText } from './validation/DSLValidation.js';
  * Compiles DSL text into rule configurations for the zanzibar-graph system
  */
 export class DSLCompiler {
-  constructor(arbiter) {
+  constructor(arbiter, options = {}) {
     this.arbiter = arbiter;
     this.parser = parse;
-    this.generator = new RuleGenerator(arbiter);
+    this.generator = new RuleGenerator(arbiter, options);
     this.compiledPrograms = new Map();
   }
 
@@ -39,13 +39,15 @@ export class DSLCompiler {
       const programNode = {
         definitions: program.body.filter(s => s.type === 'Definition'),
         facts: program.body.filter(s => s.type === 'Fact'),
+        sources: program.body.filter(s => s.type === 'Source'),
         evidence: program.body.filter(s => s.type === 'Evidence'),
         measures: program.body.filter(s => s.type === 'Measure'),
         validate: () => ({ isValid: true, errors: [], warnings: [] })
       };
 
-      // Generate rules from AST
-      const generationResult = this.generator.generateRules(programNode);
+      // Generate rules from AST (scoped to the program name so recompiling a
+      // scope revokes its stale relations without touching other scopes).
+      const generationResult = this.generator.generateRules(programNode, programName);
       
       if (!generationResult.success) {
         return {

src/grammar/dsl.peggy

@@ -54,11 +54,14 @@ Definition "A type definition"
     }
 
 Field
-  = name:Identifier _ ":" _ fieldType:Type _ isArray:("[]")? _ behavior:Behavior? _ cache:CacheDirective? {
+  = name:Identifier _ ":" _ fieldType:Type optional:("?")? _ isArray:("[]")? _ behavior:Behavior? _ cache:CacheDirective? {
       return {
         type: "Field",
         name,
         fieldType,
+        // `field: type` is REQUIRED on node insert; `field: type?` is optional.
+        // Presence is enforced by the DSLRuntime when a node is created.
+        required: !optional,
         isArray: !!isArray,
         behavior: behavior || null,
         cache: cache || null
@@ -248,6 +251,13 @@ BehaviorAnnotation
   = "BEHAVES" __ "AS" __ behavior:("edge" / "transitive" / "hierarchical" / "symmetrical_graph") {
       return { type: "BehaviorAnnotation", behavior };
     }
+  / "BEHAVES" __ "{" _ behavior:(TTLBehavior) _ "}" {
+      // Fact-level freshness: `fact balance(user, amount) BEHAVES { ttl 1h }`
+      // declares the relation's value-freshness window, which the runtime uses
+      // as the provider-result cache TTL. The behavior is wrapped like the
+      // `BEHAVES AS` form so consumers read `behavior.behaviorType`.
+      return { type: "BehaviorAnnotation", behavior };
+    }
 
 FactProperty
   = "transitive" { return "transitive"; }
@@ -385,7 +395,7 @@ Boolean "A boolean literal"
   = value:("true" / "false") { return { type: "Literal", value: value === "true" }; }
 
 Duration "A time duration literal"
-  = value:([0-9]+ ("h" / "d" / "w" / "m")) { return { type: "Literal", value: text(), unit: text().slice(-1) }; }
+  = value:([0-9]+ ("s" / "m" / "h" / "d" / "w")) { return { type: "Literal", value: text(), unit: text().slice(-1) }; }
 
 
 // -- Core Tokens & Whitespace --

src/index.js

@@ -15,6 +15,12 @@ export { RuleGenerator } from './generator/RuleGenerator.js';
 // Validation
 export { validateDslText } from './validation/DSLValidation.js';
 
+// Runtime
+export { DSLRuntime } from './runtime/DSLRuntime.js';
+
+// Value-graph integration — DSL-declared measures as value-graph nodes
+export { DSLValueGraph } from './value-graph/DSLValueGraph.js';
+
 // All AST nodes
 export * from './nodes/index.js';
 

src/runtime/DSLRuntime.js

@@ -0,0 +1,944 @@
+import { DSLCompiler } from '../DSLCompiler.js';
+
+const VALUE_TYPES = new Set(['string', 'number', 'boolean', 'timestamp', 'duration', 'object', 'any']);
+
+/**
+ * DSLRuntime — higher-order wrapper combining the Evidence DSL with an
+ * @arbiter/core Arbiter.
+ *
+ * The DSL declares a typed schema: `definition` blocks (entity types with
+ * typed fields), `fact` declarations (relations with typed params, optional
+ * `*` injectable marker), and `evidence` rules (relations the runtime can
+ * check). A raw Arbiter accepts untyped inserts; this wrapper adds the
+ * DSL-informed layer:
+ *
+ *   - schema introspection: getSchema() exposes the compiled type system
+ *     (entity types/fields, facts, evidence, dependencies, providers);
+ *   - typed mutations: addNode / updateNodeData / addRelation / updateRelation
+ *     validate their arguments against the compiled schema — known types,
+ *     known relations, matching param types, typed field values — before
+ *     mutating the arbiter; removeNode / removeRelation pass through;
+ *   - per-relation data retrieval: registerFact(relation, asyncFn) registers a
+ *     provider that retrieves the missing partial-graph edges for a fact; a
+ *     bounded retrieval loop runs providers to a fixed point so a provider's
+ *     edges can satisfy another required fact;
+ *   - DSL-informed check: derives the evidence's injectable facts, retrieves
+ *     them via providers, injects them into a partial graph, and delegates to
+ *     the arbiter; require() throws on denial for middleware use.
+ *
+ * Trust boundary follows the core: caller-supplied evidence (partial graph /
+ * provider results) is trusted, never policed; only structure is validated.
+ */
+export class DSLRuntime {
+  /**
+   * @param {object} arbiter - An @arbiter/core Arbiter instance.
+   * @param {object} options
+   * @param {object} options.factProviders - relation → async fn(subject, object, ctx)
+   *   returning a boolean, possibility number, { possibility, value }, or an
+   *   array of { src, relation, dst, possibility, value } partial-graph edges.
+   * @param {object} options.policy
+   * @param {boolean} options.policy.strictTypes - throw on unknown types/relations
+   *   (default true; false degrades to arbiter behavior for undeclared names).
+   */
+  constructor(arbiter, options = {}) {
+    this.arbiter = arbiter;
+    this.compiler = new DSLCompiler(this.arbiter);
+    this.factProviders = options.factProviders || {};
+    this.measureProviders = new Map(); // measure name -> async (args, ctx) => { value, unit? }
+    this.strictTypes = options.policy?.strictTypes !== false;
+    this.program = null;
+    this.types = new Map();      // typeName -> { fields: Map(field -> {type,isArray}) }
+    this.relations = new Map();  // relation -> { kind: 'fact'|'evidence', params, injectable, ttlMs }
+    this.dependsOn = new Map();  // evidence relation -> Set(fact relations)
+
+    // Provider-result cache: relation|subject|object -> { edges, fetchedAt }.
+    // Provider retrieval is a data-store read (balance lookups, session
+    // checks, etc.) — caching results with a time expiry avoids hammering the
+    // underlying store on every check. The clock is injectable (default wall
+    // clock) and drives cache freshness, mirroring the core's unpinned-clock
+    // contract.
+    this.providerCache = new Map();
+    this.clock = typeof options.clock === 'function' ? options.clock : (() => Date.now());
+    // Default provider-result TTL in ms (0 disables caching).
+    this.defaultProviderCacheTTL = options.policy?.providerCacheTTL ?? options.providerCacheTTL ?? 30_000;
+    // Provider caching is a STORE-RETRIEVAL cache (wall-clock), deliberately
+    // independent of the caller's decision `{ now }` — a provider returns the
+    // store's current data, not a time-travel snapshot. Callers who pin time
+    // or otherwise want fresh retrieval can disable it per-check
+    // (options.cacheProviderResults: false) or globally (policy).
+    this.cacheProviderResults = options.policy?.cacheProviderResults ?? options.cacheProviderResults ?? true;
+    // Per-fact overrides (ms). DSL-declared ttl behaviors are indexed here too.
+    this.factTTLs = new Map(Object.entries(options.factTTLs || {}));
+  }
+
+  /**
+   * Compile a DSL program and index its schema. Returns this for chaining.
+   * @param {string} dsl
+   * @param {string} name
+   */
+  compile(dsl, name) {
+    const result = this.compiler.compile(dsl, name);
+    if (!result.success) {
+      const error = new Error(`DSLRuntime compile failed: ${(result.errors || []).join('; ')}`);
+      error.errors = result.errors || [];
+      throw error;
+    }
+    this.program = result.program;
+    this._indexSchema();
+    return this;
+  }
+
+  // ---------------------------------------------------------------------------
+  // Schema introspection
+  // ---------------------------------------------------------------------------
+
+  /**
+   * A serializable snapshot of the compiled type system: entity types with
+   * typed fields, facts, evidence (with their dependencies), and registered
+   * providers. Callers can use this to render forms, build clients, or audit
+   * a compiled program without reaching into the internal Maps.
+   */
+  getSchema() {
+    const types = [...this.types.entries()].map(([name, { fields }]) => ({
+      name,
+      fields: [...fields.entries()].map(([fieldName, f]) => ({
+        name: fieldName,
+        type: f.type,
+        isArray: f.isArray,
+        required: f.required !== false
+      }))
+    }));
+    const facts = [...this.relations.entries()]
+      .filter(([, r]) => r.kind === 'fact')
+      .map(([name, r]) => ({ name, params: r.params, injectable: r.injectable }));
+    const sources = [...this.relations.entries()]
+      .filter(([, r]) => r.kind === 'source')
+      .map(([name, r]) => ({ name, params: r.params, injectable: true, withinMs: r.withinMs }));
+    const evidence = [...this.relations.entries()]
+      .filter(([, r]) => r.kind === 'evidence')
+      .map(([name, r]) => ({
+        name,
+        params: r.params,
+        dependsOn: [...(this.dependsOn.get(name) || [])]
+      }));
+    const measures = [...this.relations.entries()]
+      .filter(([, r]) => r.kind === 'measure')
+      .map(([name, r]) => ({ name, params: r.params, returnType: r.returnType }));
+    return { types, facts, sources, evidence, measures, providers: this.registeredFacts() };
+  }
+
+  /** All relation names declared by the program (facts + evidence). */
+  relationNames() {
+    return [...this.relations.keys()];
+  }
+
+  _indexSchema() {
+    this.types.clear();
+    this.relations.clear();
+    this.dependsOn.clear();
+
+    for (const def of this.program.definitions || []) {
+      const fields = new Map();
+      for (const field of def.fields || []) {
+        fields.set(field.name, { type: field.fieldType, isArray: !!field.isArray, required: field.required !== false });
+      }
+      this.types.set(def.name, { fields });
+    }
+
+    for (const fact of this.program.facts || []) {
+      const ttlMs = this._ttlFromBehavior(fact.behavior);
+      this.relations.set(fact.name, {
+        kind: 'fact',
+        params: (fact.params || []).map(p => ({ name: p.name, type: p.paramType, isArray: !!p.isArray })),
+        injectable: !!fact.injectable,
+        ttlMs
+      });
+    }
+
+    // Sources are injectable, recency-gated proofs: registered as retrievable
+    // relations so a provider can supply them and `within X` gates freshness.
+    for (const src of this.program.sources || []) {
+      this.relations.set(src.name, {
+        kind: 'source',
+        params: (src.params || []).map(p => ({ name: p.name, type: p.paramType, isArray: !!p.isArray })),
+        injectable: true,
+        ttlMs: 0,
+        withinMs: src.within ? this._durationToMs(src.within) : null
+      });
+    }
+
+    for (const ev of this.program.evidence || []) {
+      this.relations.set(ev.name, {
+        kind: 'evidence',
+        params: (ev.params || []).map(p => ({ name: p.name, type: p.paramType, isArray: !!p.isArray })),
+        injectable: false
+      });
+    }
+
+    // Measures are derived-value lookups (kind: 'measure'). Their VALUES come
+    // from a registered provider (the ARRA adapter / value-graph), not the
+    // graph. `provides` declares the return type.
+    for (const m of this.program.measures || []) {
+      const provides = m.provides?.type || m.provides || 'number';
+      this.relations.set(m.name, {
+        kind: 'measure',
+        params: (m.params || []).map(p => ({ name: p.name, type: p.paramType, isArray: !!p.isArray })),
+        returnType: provides,
+        injectable: false
+      });
+    }
+
+    // Index each evidence's fact dependencies from the compiled arbiter configs.
+    for (const ev of this.program.evidence || []) {
+      const config = this.arbiter.relationConfigs.get(ev.name);
+      const deps = new Set();
+      const collect = (rule) => {
+        if (!rule || typeof rule !== 'object') return;
+        if (rule.type === 'direct' && rule.relation) deps.add(rule.relation);
+        if (rule.type === 'tuple_to_userset') {
+          if (rule.tuplesetRelation) deps.add(rule.tuplesetRelation);
+          if (rule.computedRelation) deps.add(rule.computedRelation);
+        }
+        if (rule.type === 'chain' && Array.isArray(rule.steps)) {
+          for (const s of rule.steps) {
+            if (typeof s === 'string') deps.add(s);
+            else if (s && s.relation) deps.add(s.relation);
+            else if (s && s.rule) collect(s.rule);
+          }
+        }
+        if (rule.type === 'parent' && rule.parentRelation) deps.add(rule.parentRelation);
+        if (rule.type === 'multi_hop' && rule.relation) deps.add(rule.relation);
+        if (rule.type === 'relational_comparator') {
+          collect(rule.left?.rule);
+          collect(rule.right?.rule);
+          if (rule.left?.valueRelation) deps.add(rule.left.valueRelation);
+          if (rule.right?.valueRelation) deps.add(rule.right.valueRelation);
+        }
+        for (const key of ['union', 'intersection', 'exclusion', 'never', 'always', 'requires', 'when', 'unless']) {
+          const node = rule[key];
+          if (!node) continue;
+          if (Array.isArray(node.rules)) for (const c of node.rules) collect(c);
+          if (Array.isArray(node.union?.rules)) for (const c of node.union.rules) collect(c);
+          if (Array.isArray(node.intersection?.rules)) for (const c of node.intersection.rules) collect(c);
+          if (node.direct) collect(node.direct);
+          if (node.rule) collect(node.rule);
+        }
+      };
+      if (config && Array.isArray(config.dependsOn)) {
+        for (const d of config.dependsOn) deps.add(d);
+      } else {
+        collect(config);
+      }
+      this.dependsOn.set(ev.name, deps);
+    }
+  }
+
+  // ---------------------------------------------------------------------------
+  // Provider registration (per-relation data retrieval)
+  // ---------------------------------------------------------------------------
+
+  /**
+   * Register (or replace) an async provider for a relation name. When a check
+   * needs that relation's facts and they are not in the graph, the provider is
+   * invoked to retrieve the missing partial-graph edges.
+   *
+   * @param {string} relation - fact relation name
+   * @param {Function} provider - async (subject, object, ctx) => edges
+   */
+  registerFact(relation, provider) {
+    if (typeof provider !== 'function') {
+      throw new Error(`DSLRuntime: provider for '${relation}' must be a function`);
+    }
+    this.factProviders[relation] = provider;
+    // A new provider supersedes any cached retrieval for this fact.
+    this.invalidateProviderCache(relation);
+    return this;
+  }
+
+  /** Remove a registered provider. */
+  unregisterFact(relation) {
+    delete this.factProviders[relation];
+    this.invalidateProviderCache(relation);
+    return this;
+  }
+
+  /** Relation names that currently have a registered provider. */
+  registeredFacts() {
+    return Object.keys(this.factProviders);
+  }
+
+  /**
+   * Register a measure provider. A measure is a derived-value lookup declared
+   * in the DSL (`measure name(...) { ... } provides <type>`); its VALUE comes
+   * from a registered provider (e.g. the ARRA adapter bridging the value-graph),
+   * not from the graph.
+   *
+   * @param {string} name - declared measure name
+   * @param {Function} provider - async (args, ctx) => { value, unit? } | number
+   */
+  registerMeasure(name, provider) {
+    const meta = this.relations.get(name);
+    if (!meta || meta.kind !== 'measure') {
+      throw new Error(`DSLRuntime: '${name}' is not a declared measure`);
+    }
+    if (typeof provider !== 'function') {
+      throw new Error(`DSLRuntime: provider for measure '${name}' must be a function`);
+    }
+    this.measureProviders.set(name, provider);
+    return this;
+  }
+
+  /** Unregister a measure provider. */
+  unregisterMeasure(name) {
+    this.measureProviders.delete(name);
+    return this;
+  }
+
+  /**
+   * Resolve a measure value by its parameter bindings.
+   * @param {string} name - declared measure name
+   * @param {Object} args - positional or named args (positional for unary/arity-1)
+   * @returns {Promise<{value: *, unit?: string|null, source?: string}>}
+   */
+  async measure(name, args = {}) {
+    const meta = this.relations.get(name);
+    if (!meta || meta.kind !== 'measure') {
+      if (this.strictTypes) throw new Error(`DSLRuntime: unknown measure '${name}'`);
+      return null;
+    }
+    const provider = this.measureProviders.get(name);
+    if (!provider) {
+      throw new Error(`DSLRuntime: no provider registered for measure '${name}'`);
+    }
+    const params = meta.params || [];
+    // Normalize positional args (e.g. measure(userKey)) to named bindings.
+    let bindings = args;
+    if (Array.isArray(args)) {
+      bindings = {};
+      for (let i = 0; i < params.length; i++) bindings[params[i].name] = args[i];
+    }
+    const result = await provider(bindings, { runtime: this });
+    if (typeof result === 'number' || typeof result === 'string' || typeof result === 'boolean') {
+      return { value: result, unit: null };
+    }
+    if (result && typeof result === 'object' && 'value' in result) {
+      return { value: result.value, unit: result.unit ?? null, source: result.source };
+    }
+    throw new Error(`DSLRuntime: provider for measure '${name}' must return a value or { value, unit }`);
+  }
+
+  // ---------------------------------------------------------------------------
+  // Provider-result caching
+  // ---------------------------------------------------------------------------
+
+  /**
+   * Set a per-fact provider-result TTL (ms). Overrides the policy default and
+   * the DSL-declared ttl behavior for that fact.
+   */
+  setFactTTL(relation, ms) {
+    this.factTTLs.set(relation, ms);
+    return this;
+  }
+
+  /** The effective provider-result TTL (ms) for a fact: DSL > per-fact > policy default. */
+  _ttlFor(relation) {
+    if (this.factTTLs.has(relation)) return this.factTTLs.get(relation);
+    const meta = this.relations.get(relation);
+    if (meta && meta.ttlMs != null) return meta.ttlMs;
+    return this.defaultProviderCacheTTL;
+  }
+
+  /**
+   * Invalidate cached provider results — all, or for a single relation.
+   * Callers use this when the underlying data store changes out-of-band.
+   */
+  invalidateProviderCache(relation) {
+    if (relation === undefined) {
+      this.providerCache.clear();
+      return this;
+    }
+    const prefix = `${relation}\u0000`;
+    for (const key of [...this.providerCache.keys()]) {
+      if (key.startsWith(prefix)) this.providerCache.delete(key);
+    }
+    return this;
+  }
+
+  _providerCacheKey(relation, subject, object) {
+    return `${relation}\u0000${subject}\u0000${object}`;
+  }
+
+  _providerCacheGet(relation, subject, object) {
+    const ttl = this._ttlFor(relation);
+    if (ttl <= 0) return null;
+    const entry = this.providerCache.get(this._providerCacheKey(relation, subject, object));
+    if (!entry) return null;
+    if (this.clock() - entry.fetchedAt >= ttl) {
+      this.providerCache.delete(this._providerCacheKey(relation, subject, object));
+      return null;
+    }
+    return entry;
+  }
+
+  _providerCacheSet(relation, subject, object, edges) {
+    const ttl = this._ttlFor(relation);
+    if (ttl <= 0) return;
+    this.providerCache.set(this._providerCacheKey(relation, subject, object), {
+      edges,
+      fetchedAt: this.clock()
+    });
+  }
+
+  /** Convert a DSL `BEHAVES { ttl <duration> }` behavior (or `BEHAVES AS`) into ms. */
+  _ttlFromBehavior(behavior) {
+    if (!behavior || typeof behavior !== 'object') return null;
+    const b = behavior.behavior || behavior;
+    if (b && b.behaviorType === 'ttl' && b.duration) {
+      const n = parseInt(String(b.duration.value), 10);
+      const mult = { s: 1000, m: 60_000, h: 3600_000, d: 86_400_000, w: 604_800_000 }[b.duration.unit];
+      if (!Number.isNaN(n) && mult) return n * mult;
+    }
+    return null;
+  }
+
+  /** Convert a Duration AST ({ value, unit }) to milliseconds. */
+  _durationToMs(duration) {
+    if (!duration || duration.value === undefined) return null;
+    const raw = typeof duration.value === 'string' ? duration.value : String(duration.value);
+    const unit = duration.unit || raw.slice(-1);
+    const numeric = parseFloat(raw);
+    if (!Number.isFinite(numeric)) return null;
+    const mult = { s: 1000, m: 60_000, h: 3600_000, d: 86_400_000, w: 604_800_000 }[unit];
+    return mult ? numeric * mult : null;
+  }
+
+  /**
+   * Normalize a provider result (boolean / number / { possibility, value } /
+   * array of edge objects) into an array of partial-graph edge objects. The
+   * destination follows the DSL fact's declared shape: unary and value-carrying
+   * facts are self-edges on the subject; binary entity facts go subject → object.
+   * Provider-returned edges are validated against the fact's declared typing:
+   * a value-carrying fact must return an object with a value of the declared
+   * type, and possibilities must be in [0, 1]. A violation throws — it is a
+   * provider-authoring error, not a denial.
+   */
+  _normalizeProviderEdges(result, factMeta, fact, user, object) {
+    const edges = Array.isArray(result) ? result : [result];
+    const secondParamType = factMeta.params[1] && factMeta.params[1].type;
+    const isValueFact = factMeta.params.length >= 2 && this._isValueType(secondParamType);
+    // Sources carry a timestamp in `value` for their recency (`within X`) gate.
+    const isSource = factMeta.kind === 'source';
+    const defaultDst = isValueFact ? user : (factMeta.params.length >= 2 ? object : user);
+    const label = `provider for '${fact}'`;
+    const out = [];
+    for (const edge of edges) {
+      const normalized = typeof edge === 'boolean' || typeof edge === 'number'
+        ? (() => {
+            if (isValueFact) {
+              throw new Error(`DSLRuntime: ${label} is a value-carrying fact — return { value, possibility } (got a bare ${typeof edge === 'number' ? 'number' : 'boolean'})`);
+            }
+            const possibility = edge === true ? 1 : edge;
+            this._checkPossibility(possibility, label);
+            return { src: user, dst: defaultDst, possibility };
+          })()
+        : (() => {
+            const possibility = edge.possibility ?? 1;
+            this._checkPossibility(possibility, label);
+            if (edge.value !== undefined) {
+              if (!isValueFact && !isSource) {
+                throw new Error(`DSLRuntime: ${label} returned a value for a non-value fact '${fact}'`);
+              }
+              if (isValueFact) {
+                this._checkScalarValue(secondParamType, edge.value, `${label}.value`);
+              } else if (isSource && (typeof edge.value !== 'number' || Number.isNaN(edge.value))) {
+                throw new Error(`DSLRuntime: ${label} (a source) must return a numeric timestamp in value`);
+              }
+            } else if (isValueFact) {
+              throw new Error(`DSLRuntime: ${label} must supply a 'value' of type ${secondParamType}`);
+            }
+            return {
+              ...(edge.relation ? { relation: edge.relation } : {}),
+              src: edge.src ?? user,
+              dst: edge.dst ?? defaultDst,
+              possibility,
+              ...(edge.value !== undefined ? { value: edge.value } : {}),
+              ...(edge.reliability !== undefined ? { reliability: edge.reliability } : {})
+            };
+          })();
+      out.push(normalized);
+    }
+    return out;
+  }
+
+  _checkPossibility(possibility, label) {
+    if (typeof possibility !== 'number' || !Number.isFinite(possibility) || possibility < 0 || possibility > 1) {
+      throw new Error(`DSLRuntime: ${label} returned invalid possibility ${possibility} (expected a number in [0, 1])`);
+    }
+  }
+
+  // ---------------------------------------------------------------------------
+  // Schema validation helpers
+  // ---------------------------------------------------------------------------
+
+  _isValueType(typeName) {
+    return VALUE_TYPES.has(typeName);
+  }
+
+  _nodeType(key) {
+    const nodeId = this.arbiter.resolveNodeId(key);
+    if (nodeId === undefined) return null;
+    const node = this.arbiter.nodes.get(nodeId);
+    return node ? node.type : null;
+  }
+
+  _checkNodeExists(key, position) {
+    if (!this.arbiter.nodeIdByKey.has(key)) {
+      throw new Error(`DSLRuntime: ${position} node '${key}' does not exist`);
+    }
+  }
+
+  _checkNodeType(key, expectedType, position) {
+    if (this._isValueType(expectedType)) return; // value positions are validated separately
+    const actual = this._nodeType(key);
+    if (actual === null) {
+      this._checkNodeExists(key, position);
+      return;
+    }
+    if (actual !== expectedType) {
+      throw new Error(`DSLRuntime: ${position} node '${key}' has type '${actual}', expected '${expectedType}'`);
+    }
+  }
+
+  _checkFieldValue(field, value, path) {
+    if (field.isArray) {
+      if (!Array.isArray(value)) {
+        throw new Error(`DSLRuntime: field '${path}' must be an array of ${field.type}`);
+      }
+      for (const item of value) this._checkScalarValue(field.type, item, path);
+      return;
+    }
+    this._checkScalarValue(field.type, value, path);
+  }
+
+  _checkScalarValue(type, value, path) {
+    const ok = type === 'string' ? typeof value === 'string'
+      : type === 'number' ? typeof value === 'number'
+      : type === 'boolean' ? typeof value === 'boolean'
+      : (type === 'timestamp' || type === 'duration')
+        ? (typeof value === 'number' || typeof value === 'string')
+        : true; // object / any / entity-typed fields accept any value
+    if (!ok) {
+      throw new Error(`DSLRuntime: field '${path}' must be ${type}, got ${typeof value}`);
+    }
+  }
+
+  // ---------------------------------------------------------------------------
+  // Typed mutations
+  // ---------------------------------------------------------------------------
+
+  /**
+   * Insert a node, validating the type exists (when declared) and that `data`
+   * conforms to the definition's typed fields.
+   */
+  addNode(key, typeName, data = {}) {
+    if (this.types.has(typeName)) {
+      const { fields } = this.types.get(typeName);
+      for (const [name, field] of fields) {
+        // Required fields must be present on insert (`field: type` in the DSL;
+        // `field?: type` marks a field optional).
+        if (field.required && data[name] === undefined) {
+          throw new Error(`DSLRuntime: missing required field '${typeName}.${name}' on node insert`);
+        }
+        if (data[name] !== undefined) this._checkFieldValue(field, data[name], `${typeName}.${name}`);
+      }
+    } else if (this.strictTypes) {
+      throw new Error(`DSLRuntime: unknown type '${typeName}'`);
+    }
+    // A graph mutation can make previously-retrieved facts stale.
+    this.invalidateProviderCache();
+    return this.arbiter.addNode(key, typeName, data);
+  }
+
+  /**
+   * Update node data, validating fields against the node's declared type.
+   */
+  updateNodeData(key, data) {
+    const typeName = this._nodeType(key);
+    if (typeName && this.types.has(typeName)) {
+      const { fields } = this.types.get(typeName);
+      for (const [name, field] of fields) {
+        if (data[name] !== undefined) this._checkFieldValue(field, data[name], `${typeName}.${name}`);
+      }
+    }
+    this.invalidateProviderCache();
+    return this.arbiter.updateNodeData(key, data);
+  }
+
+  /** Remove a node (passthrough to the arbiter's node manager). */
+  removeNode(key) {
+    this.invalidateProviderCache();
+    if (this.arbiter.nodeManager && typeof this.arbiter.nodeManager.removeNode === 'function') {
+      return this.arbiter.nodeManager.removeNode(key);
+    }
+    return this.arbiter.removeNode?.(key);
+  }
+
+  _relationOrThrow(relation) {
+    const meta = this.relations.get(relation);
+    if (!meta) {
+      if (this.strictTypes) throw new Error(`DSLRuntime: unknown relation '${relation}'`);
+      return null;
+    }
+    return meta;
+  }
+
+  /**
+   * Insert a relation edge. Validates the relation is declared, that the
+   * subject/object nodes match the declared entity param types, and that any
+   * primitive value param is supplied in attrs.value of the correct type.
+   */
+  addRelation(src, relation, dst, attrs = {}) {
+    const meta = this._relationOrThrow(relation);
+    if (meta) {
+      this._validateRelationEndpoints(relation, meta, src, dst, attrs);
+    }
+    this.invalidateProviderCache();
+    return this.arbiter.addRelation(src, relation, dst, attrs);
+  }
+
+  /**
+   * Update a relation edge (idempotent replace). Validates like addRelation.
+   */
+  updateRelation(src, relation, dst, attrs = {}) {
+    const meta = this._relationOrThrow(relation);
+    if (meta) {
+      this._validateRelationEndpoints(relation, meta, src, dst, attrs);
+    }
+    this.invalidateProviderCache();
+    this.arbiter.removeRelation(src, relation, dst);
+    return this.arbiter.addRelation(src, relation, dst, attrs);
+  }
+
+  /** Remove a relation edge (passthrough to the arbiter). */
+  removeRelation(src, relation, dst) {
+    this.invalidateProviderCache();
+    return this.arbiter.removeRelation(src, relation, dst);
+  }
+
+  _validateRelationEndpoints(relation, meta, src, dst, attrs) {
+    const params = meta.params;
+    if (params.length === 0) {
+      throw new Error(`DSLRuntime: relation '${relation}' declares no parameters`);
+    }
+    // First param is always the subject (entity).
+    const subjectType = params[0].type;
+    if (this._isValueType(subjectType)) {
+      throw new Error(`DSLRuntime: relation '${relation}' subject param must be an entity type, got '${subjectType}'`);
+    }
+    this._checkNodeType(src, subjectType, 'subject');
+
+    if (params.length >= 2) {
+      const secondType = params[1].type;
+      if (this._isValueType(secondType)) {
+        // Value-carrying fact (e.g. session(user, token: string)): the value
+        // lives on the edge's `value` field; the graph edge is a self-edge on
+        // the subject so the value is discoverable by value extraction.
+        if (attrs.value === undefined) {
+          attrs.value = dst;
+        }
+        this._checkScalarValue(secondType, attrs.value, `${relation}.${params[1].name}`);
+        if (dst !== src) {
+          throw new Error(`DSLRuntime: value param '${params[1].name}' must be supplied as attrs.value with dst = src (self-edge), got dst '${dst}'`);
+        }
+      } else {
+        this._checkNodeType(dst, secondType, 'object');
+      }
+    }
+  }
+
+  /**
+   * The partial-graph requirements of an evidence relation: the declared
+   * injectable facts and sources it depends on.
+   */
+  requiredFacts(relation) {
+    const deps = this.dependsOn.get(relation);
+    if (!deps) return [];
+    const required = [];
+    for (const dep of deps) {
+      const meta = this.relations.get(dep);
+      if (meta && meta.kind === 'fact' && meta.injectable) required.push(dep);
+      if (meta && meta.kind === 'source') required.push(dep);
+    }
+    return required;
+  }
+
+  /**
+   * The MEASURE requirements of an evidence relation: the derived measures its
+   * comparator operands reference (valueRelation deps that are `kind: measure`).
+   * These compose the measure system into the evidence system — the evidence's
+   * truth depends on a measure VALUE, which `check()` resolves and injects.
+   */
+  requiredMeasures(relation) {
+    const deps = this.dependsOn.get(relation);
+    if (!deps) return [];
+    const required = [];
+    for (const dep of deps) {
+      const meta = this.relations.get(dep);
+      if (meta && meta.kind === 'measure') required.push(dep);
+    }
+    return required;
+  }
+
+  // ---------------------------------------------------------------------------
+  // DSL-informed check
+  // ---------------------------------------------------------------------------
+
+  /**
+   * Validate a check request against the DSL schema, derive and retrieve the
+   * evidence's injectable facts, inject them into a partial graph, and delegate
+   * to the arbiter.
+   *
+   * Providers run in a bounded fixed-point loop: each round invokes the
+   * provider for every required fact whose edges are not yet in the partial
+   * graph. Because a provider may return edges for relations other than its
+   * own name, an edge injected in one round can satisfy another required fact
+   * (or unblock another provider) in a later round. The loop stops when a
+   * round injects no new relation or the round budget is exhausted.
+   *
+   * @param {string} user - subject key
+   * @param {string} relation - evidence (or fact) relation name
+   * @param {string} object - object key
+   * @param {object} options
+   * @param {object} options.partialGraph - caller-supplied partial graph edges
+   *   ({ relations: [{ src, relation, dst, possibility, value }], nodes, challenges })
+   * @param {object} options.factProviders - per-call provider overrides
+   *   (merged over registered providers)
+   * @param {number} options.maxProviderRounds - fixed-point loop budget (default 3)
+   * @returns {object} core check result extended with { requiredFacts, providedFacts, missingFacts }
+   */
+  async check(user, relation, object, options = {}) {
+    const meta = this.relations.get(relation);
+    if (!meta) {
+      if (this.strictTypes) throw new Error(`DSLRuntime: unknown relation '${relation}'`);
+    } else if (meta.params.length === 2) {
+      this._checkNodeType(user, meta.params[0].type, 'subject');
+      this._checkNodeType(object, meta.params[1].type, 'object');
+      // A value-typed object parameter (can_withdraw(user, amount: number))
+      // carries the expected EDGE VALUE, not a node key — validate the scalar.
+      if (this._isValueType(meta.params[1].type)) {
+        this._checkScalarValue(meta.params[1].type, object, `object of '${relation}'`);
+      }
+    } else if (meta.params.length === 1) {
+      this._checkNodeType(user, meta.params[0].type, 'subject');
+    }
+
+    // Retrieval set: for an evidence, the injectable facts it depends on; for
+    // a direct FACT check, the fact itself is the retrieval target (its
+    // provider, if registered, supplies the edge — checking `owns` directly
+    // must consult the `owns` provider, not only evidence-mediated checks).
+    const required = new Set(this.requiredFacts(relation));
+    if (meta && (meta.kind === 'fact' || meta.kind === 'source')) required.add(relation);
+    const requiredList = [...required];
+    const providers = { ...this.factProviders, ...(options.factProviders || {}) };
+    const maxRounds = options.maxProviderRounds ?? 3;
+    const partialRelations = [];
+    const injectedRelations = []; // { relation, edges, round }
+    const missingFacts = [];
+    const warnings = [];
+    const satisfied = new Set();  // facts whose edges are in the partial graph
+    const now = this.clock ? this.clock() : Date.now();
+
+    if (options.partialGraph && Array.isArray(options.partialGraph.relations)) {
+      for (const rel of options.partialGraph.relations) {
+        partialRelations.push(rel);
+        if (rel && rel.relation) satisfied.add(rel.relation);
+      }
+    }
+
+    // Fixed-point provider retrieval loop.
+    for (let round = 1; round <= maxRounds; round++) {
+      let newRelationsThisRound = 0;
+      for (const fact of requiredList) {
+        if (satisfied.has(fact)) continue;
+        const factMeta = this.relations.get(fact);
+        const provider = providers[fact];
+
+        // Provider-result cache: reuse fresh edges without re-invoking the
+        // data store. A cached entry stores the NORMALIZED edges. Per-check
+        // provider overrides are one-off observations — they bypass the cache
+        // entirely (no read, no write) so a fresh override is never masked by
+        // a cached registered-provider result, nor does it pollute the cache.
+        // options.cacheProviderResults:false (or the policy default) disables
+        // the cache for this check.
+        const cachingEnabled = options.cacheProviderResults ?? this.cacheProviderResults;
+        const isPerCheckOverride = !!(options.factProviders && fact in options.factProviders);
+        const cacheHit = (cachingEnabled && !isPerCheckOverride) ? this._providerCacheGet(fact, user, object) : null;
+        let edges = null;
+        let fromCache = false;
+        if (cacheHit) {
+          edges = cacheHit.edges;
+          fromCache = true;
+        } else if (typeof provider === 'function') {
+          let result = null;
+          let error = null;
+          try {
+            result = await provider(user, object, {
+              relation: fact,
+              params: factMeta.params,
+              runtime: this,
+              options,
+              round,
+              alreadyInjected: [...satisfied]
+            });
+          } catch (err) {
+            error = err;
+          }
+          if (error) {
+            missingFacts.push({ relation: fact, reason: error.message });
+            satisfied.add(fact);
+            continue;
+          }
+          if (result === false || result === null || result === undefined) {
+            missingFacts.push({ relation: fact, reason: 'not_provided' });
+            satisfied.add(fact);
+            continue;
+          }
+          edges = this._normalizeProviderEdges(result, factMeta, fact, user, object);
+          if (cachingEnabled && !isPerCheckOverride) this._providerCacheSet(fact, user, object, edges);
+        } else {
+          missingFacts.push({ relation: fact, reason: 'no_provider' });
+          satisfied.add(fact);
+          continue;
+        }
+
+        // A provider may return edges for relations other than its own; the
+        // injected relation names satisfy those facts too (fixed point). Apply
+        // the source recency gate (within X) and drop ghost-node edges.
+        const accepted = [];
+        for (const normalized of edges) {
+          const injectedRelation = normalized.relation ?? fact;
+          if (factMeta.kind === 'source' && factMeta.withinMs !== null && factMeta.withinMs !== undefined) {
+            if (normalized.value === undefined) {
+              throw new Error(`DSLRuntime: provider for recency-gated source '${fact}' must return a timestamp in value (within ${factMeta.withinMs}ms)`);
+            }
+            if (now - normalized.value > factMeta.withinMs) {
+              missingFacts.push({ relation: fact, reason: 'stale' });
+              continue;
+            }
+          }
+          if (normalized.src !== undefined && !this.arbiter.nodeIdByKey.has(normalized.src)) {
+            warnings.push(`provider for '${fact}' returned an edge with unknown source node '${normalized.src}' — dropped`);
+            continue;
+          }
+          if (normalized.dst !== undefined && !this.arbiter.nodeIdByKey.has(normalized.dst)) {
+            warnings.push(`provider for '${fact}' returned an edge with unknown target node '${normalized.dst}' — dropped`);
+            continue;
+          }
+          accepted.push({ relation: injectedRelation, ...normalized });
+        }
+        for (const normalized of accepted) {
+          partialRelations.push(normalized);
+          satisfied.add(normalized.relation);
+        }
+        injectedRelations.push({ relation: fact, edges: edges.length, round, cacheHit: fromCache });
+        newRelationsThisRound += edges.length;
+        satisfied.add(fact);
+      }
+      if (newRelationsThisRound === 0) break;
+    }
+
+    const checkOptions = { ...options };
+    if (partialRelations.length > 0) {
+      checkOptions.partialGraph = {
+        ...(options.partialGraph || {}),
+        relations: partialRelations
+      };
+    }
+
+    // --- Measure + evidence composition ---
+    // An evidence whose comparator references a measure (a valueRelation with
+    // `_needsValues`) needs the measure VALUE in the partial graph before the
+    // core evaluator runs. Measures inject as value-carrying self-edges on the
+    // subject, resolved through `this.measure()` — which is the attached
+    // value-graph when DSLValueGraph is wired, so both systems compose.
+    const measureRequirements = this.requiredMeasures(relation);
+    if (measureRequirements.length > 0) {
+      const bound = {};
+      for (let i = 0; i < (meta?.params || []).length; i++) {
+        if (i === 0) bound[meta.params[i].name] = user;
+        else if (i === 1 && !this._isValueType(meta.params[i].type)) bound[meta.params[i].name] = object;
+      }
+      for (const measure of measureRequirements) {
+        if (satisfied.has(measure)) continue;
+        const measureMeta = this.relations.get(measure);
+        // `__subject` aligns with the value-graph's subjectOf default so the
+        // attached DSLValueGraph resolves the same key setValue() wrote.
+        const args = { __subject: user };
+        for (const p of (measureMeta?.params || [])) args[p.name] = (p.name in bound ? bound[p.name] : user);
+        let resolved = null;
+        let err = null;
+        try {
+          resolved = await this.measure(measure, args);
+        } catch (e) {
+          err = e;
+        }
+        if (err || resolved === null || resolved === undefined) {
+          missingFacts.push({ relation: measure, reason: err ? err.message : 'not_provided' });
+          satisfied.add(measure);
+          continue;
+        }
+        partialRelations.push({
+          relation: measure,
+          src: user,
+          dst: user,
+          value: resolved.value,
+          possibility: 1,
+          ...(resolved.unit != null ? { unit: resolved.unit } : {})
+        });
+        satisfied.add(measure);
+        injectedRelations.push({ relation: measure, edges: 1, round: 'measure', cacheHit: false });
+      }
+      if (partialRelations.length > 0) {
+        checkOptions.partialGraph = {
+          ...(checkOptions.partialGraph || {}),
+          relations: partialRelations
+        };
+      }
+    }
+
+    // A value-typed object parameter means the check object IS the expected
+    // edge value, not a node key. Value-carrying facts store edges as
+    // self-edges on the subject, so the underlying check runs on the subject
+    // with the value carried as a per-check gate (options.expectedValue).
+    const isValueObject = meta && meta.params.length === 2 && this._isValueType(meta.params[1].type);
+    const checkObject = isValueObject ? user : object;
+    if (isValueObject) {
+      checkOptions.expectedValue = object;
+    }
+
+    const result = this.arbiter.check(user, relation, checkObject, checkOptions);
+
+    return {
+      ...result,
+      requiredFacts: requiredList,
+      providedFacts: injectedRelations.map(r => r.relation),
+      missingFacts,
+      warnings
+    };
+  }
+
+  /**
+   * Check and throw on denial — convenience for middleware / guards.
+   * @returns {object} the check result on success.
+   * @throws {Error} with `.result` attached when the decision denies.
+   */
+  async require(user, relation, object, options = {}) {
+    const result = await this.check(user, relation, object, options);
+    if (result.possibility <= 0) {
+      const error = new Error(`DSLRuntime: authorization denied for '${relation}' (${result.reason || 'denied'})`);
+      error.result = result;
+      throw error;
+    }
+    return result;
+  }
+}

src/validation/DSLValidation.js

@@ -1,7 +1,9 @@
 import { parse } from '../parser/GeneratedParser.js';
 import { DSL_PRELUDE } from './DSLPrelude.js';
 
-const BUILTIN_TYPES = new Set(['string', 'number', 'boolean', 'timestamp', 'duration', 'object', 'any']);
+// NO JS bigint in the value model — large integers are `buffer` (Uint8Array),
+// matching the value-graph's JSON-free/bigint-free wire format.
+const BUILTIN_TYPES = new Set(['string', 'number', 'boolean', 'timestamp', 'duration', 'object', 'any', 'buffer', 'array', 'interval']);
 const BUILTIN_CHALLENGES = new Set([
   'mfa',
   'webauthn',
@@ -41,6 +43,7 @@ export function validateDslText(dslText, options = {}) {
   validateSources(program, tables, errors, warnings, dslText);
   validateMeasures(program, tables, errors, warnings, dslText);
   validateEvidence(program, tables, errors, warnings, dslText);
+  validateCrossKindRelationNames(program, errors, warnings, dslText);
 
   return {
     success: errors.length === 0,
@@ -140,10 +143,27 @@ function validateDefinitions(program, tables, errors, warnings, source) {
         }));
       }
     }
+
+    // Duplicate field names within a definition silently keep the last
+    // declaration (e.g. `{ id: string id: string }`) — reject loudly instead.
+    const fieldSeen = new Set();
+    for (const field of def.fields || []) {
+      if (fieldSeen.has(field.name)) {
+        errors.push(createError({
+          message: `Duplicate field '${def.name}.${field.name}'.`,
+          rule: 'Each field name must be unique within a definition.',
+          fix: `Remove the duplicate declaration of '${def.name}.${field.name}'.`,
+          location: findLocation(source, field.name),
+          context: formatContext(source, findLocation(source, def.name))
+        }));
+      }
+      fieldSeen.add(field.name);
+    }
   }
 }
 
 function validateFacts(program, tables, errors, warnings, source) {
+  const seen = new Map();
   for (const fact of program.facts || []) {
     if (tables.builtins?.facts?.has(fact.name)) {
       errors.push(createError({
@@ -154,6 +174,16 @@ function validateFacts(program, tables, errors, warnings, source) {
         context: formatContext(source, findLocation(source, fact.name))
       }));
     }
+    if (seen.has(fact.name)) {
+      errors.push(createError({
+        message: `Duplicate fact definition '${fact.name}'.`,
+        rule: 'Each fact name must be unique within a program.',
+        fix: 'Rename one of the fact definitions to a unique name.',
+        location: findLocation(source, `fact ${fact.name}`),
+        context: formatContext(source, findLocation(source, fact.name))
+      }));
+    }
+    seen.set(fact.name, fact);
     const arity = fact.params ? fact.params.length : 0;
     if (!fact.params || arity === 0) {
       warnings.push(createError({
@@ -285,6 +315,7 @@ function validateMeasures(program, tables, errors, warnings, source) {
 }
 
 function validateEvidence(program, tables, errors, warnings, source) {
+  const seen = new Map();
   for (const ev of program.evidence || []) {
     if (tables.builtins?.evidence?.has(ev.name)) {
       errors.push(createError({
@@ -295,6 +326,16 @@ function validateEvidence(program, tables, errors, warnings, source) {
         context: formatContext(source, findLocation(source, ev.name))
       }));
     }
+    if (seen.has(ev.name)) {
+      errors.push(createError({
+        message: `Duplicate evidence definition '${ev.name}'.`,
+        rule: 'Each evidence name must be unique within a program.',
+        fix: 'Rename one of the evidence definitions to a unique name.',
+        location: findLocation(source, `evidence ${ev.name}`),
+        context: formatContext(source, findLocation(source, ev.name))
+      }));
+    }
+    seen.set(ev.name, ev);
     const returnType = ev.provides || DEFAULT_EVIDENCE_RETURN;
     if (returnType !== DEFAULT_EVIDENCE_RETURN && !isTypeKnown(returnType, tables)) {
       errors.push(createError({
@@ -313,6 +354,37 @@ function validateEvidence(program, tables, errors, warnings, source) {
   }
 }
 
+/**
+ * Relation names must be unique across facts, sources, evidence, and measures.
+ * A fact and an evidence sharing a name would silently overwrite each other's
+ * relation config during generation (and read as a false cyclic reference).
+ */
+function validateCrossKindRelationNames(program, errors, warnings, source) {
+  const seen = new Map();
+  const kinds = [
+    ['fact', program.facts],
+    ['source', program.sources],
+    ['evidence', program.evidence],
+    ['measure', program.measures]
+  ];
+  for (const [kind, items] of kinds) {
+    for (const item of items || []) {
+      const prev = seen.get(item.name);
+      if (prev) {
+        errors.push(createError({
+          message: `Name '${item.name}' is already used by a ${prev} declaration.`,
+          rule: 'Relation names must be unique across facts, sources, evidence, and measures.',
+          fix: `Rename the ${kind} or the ${prev} to a unique name.`,
+          location: findLocation(source, `${kind} ${item.name}`),
+          context: formatContext(source, findLocation(source, item.name))
+        }));
+      } else {
+        seen.set(item.name, kind);
+      }
+    }
+  }
+}
+
 function validateEvidenceBody(body, scope, tables, errors, warnings, source, parent) {
   for (const stmt of body.statements || []) {
     switch (stmt.type) {
@@ -952,6 +1024,31 @@ function formatPegError(error, sourceText, sourceName) {
     message = 'Missing colon after identifier.';
     fix = 'Add ":" between a name and its type.';
     rule = 'Types must be declared using name: Type syntax.';
+  } else {
+    // Targeted hints for common declaration mistakes. The peggy error only
+    // reports "unexpected X"; these heuristics read the source around the
+    // failure to point at the real constraint.
+    const offset = error.location?.start?.offset ?? -1;
+    const before = offset >= 0 ? sourceText.slice(0, offset) : '';
+    const tail = before.split(/\n/).pop() || '';
+    const lastKeyword = (() => {
+      const matches = [...before.matchAll(/\b(fact|relation|source|evidence|measure)\b/g)];
+      return matches.length ? matches[matches.length - 1][1] : null;
+    })();
+
+    if (found === 'w' && lastKeyword === 'fact' || (found === 'w' && lastKeyword === 'relation')) {
+      message = '`within` is only valid on `source` declarations.';
+      fix = 'Move the recency constraint to a `source` declaration, or drop `within` here.';
+      rule = 'Only sources accept a `within` freshness constraint.';
+    } else if (/\bBEHAVES\b/.test(before) && tail.includes('BEHAVES')) {
+      message = 'A declaration can carry only one `BEHAVES` clause.';
+      fix = 'Choose either a behavior (`BEHAVES AS transitive`) or a TTL (`BEHAVES { ttl 1h }`), not both.';
+      rule = '`BEHAVES` may appear at most once per declaration.';
+    } else if (found === 'l' && lastKeyword === 'evidence' && sourceText.slice(offset, offset + 5) === 'limit') {
+      message = '`limit` is only valid on pattern/recursive bodies.';
+      fix = 'Move `limit N` onto the pattern itself, e.g. reports_to(user, *m) { ... } limit N.';
+      rule = 'Only pattern bodies take a recursion depth limit.';
+    }
   }
 
   return createError({

src/value-graph/DSLValueGraph.js

@@ -0,0 +1,256 @@
+/**
+ * DSLValueGraph — wires a DSLRuntime's declared MEASURES to a @arbiter/value-graph.
+ *
+ * The DSL is the schema authority: each `measure name(params) { ... } PROVIDES type`
+ * becomes a value-graph relation whose spec carries the declared return type and
+ * parameter types. The value-graph is then:
+ *
+ *   - the STORAGE substrate for values/attributes that are supplied directly
+ *     (not cached or computed) — `setValue(name, args, value)` writes them;
+ *   - the RETRIEVAL substrate for measure lookups — `measure(name, args)` (and,
+ *     after `attach()`, `runtime.measure(...)`) read through `valueGraph.get(...)`,
+ *     so authorization evaluation pulls values "for partial graph purposes";
+ *   - the COMPUTE substrate for external value resolvers — `resolve(name, fn)`
+ *     registers a callback/sync resolver that becomes the node's operator fn
+ *     (ARRA/Overlay adapters plug here).
+ *
+ * Typing / validation: values written or resolved must match the DSL-declared
+ * PROVIDES type (enforced both here and by the value-graph itself), and bindings
+ * are validated against the declared parameter types. Unknown measure names and
+ * type mismatches fail loudly.
+ */
+import { ValueGraph, validateValueType } from '@arbiter/value-graph';
+
+const CONTROL_KEYS = new Set(['__subject', '__actor', '__source', '__meta']);
+
+function isControlKey(key) {
+  return CONTROL_KEYS.has(key) || (typeof key === 'string' && key.startsWith('_'));
+}
+
+export class DSLValueGraph {
+  /**
+   * @param {DSLRuntime} runtime - an already-compiled DSLRuntime
+   * @param {Object} [options]
+   * @param {ValueGraph} [options.valueGraph] - shared graph (default: a fresh one)
+   * @param {number} [options.defaultTTL] - per-node TTL for declared measures (default 0 = persist until set/invalidate)
+   * @param {Function} [options.subjectOf] - (name, args) => subject key (default: args.__subject ?? 'global')
+   * @param {boolean} [options.strict] - throw on unknown measures (default true)
+   */
+  constructor(runtime, options = {}) {
+    this.runtime = runtime;
+    this.vg = options.valueGraph || new ValueGraph({ defaultTTL: options.defaultTTL ?? 0 });
+    this.subjectOf = options.subjectOf || ((name, args) => (args && args.__subject) || 'global');
+    this.strict = options.strict !== false;
+    this.resolvers = new Map(); // measure name -> callback/sync resolver
+    this.measures = new Map();  // measure name -> { params, returnType }
+    this._attached = new Set(); // measure names attach() registered on the runtime
+    this._registerFromSchema();
+  }
+
+  // ---------------------------------------------------------------------------
+  // Schema registration — DSL declares the value-graph's typing / structure.
+  // ---------------------------------------------------------------------------
+
+  _registerFromSchema() {
+    return this.sync();
+  }
+
+  /**
+   * Re-read the runtime schema and re-register measure nodes. Call after the
+   * runtime recompiles a new program: new measures get value-graph nodes, removed
+   * ones are dropped, and changed return types/params are updated in place.
+   */
+  sync() {
+    const schema = this.runtime.getSchema();
+    const seen = new Set();
+    for (const m of schema.measures || []) {
+      const name = m.name;
+      seen.add(name);
+      const params = (m.params || []).map((p) => ({ name: p.name, type: p.type, isArray: !!p.isArray }));
+      const returnType = m.returnType || 'number';
+      const existing = this.measures.get(name);
+      if (existing) {
+        existing.params = params;
+        existing.returnType = returnType;
+      } else {
+        this.measures.set(name, { params, returnType });
+        this.vg.define(name, {
+          operator: 'source',
+          returnType,
+          params,
+          fn: (subject, bindings, ctx, cb) => this._resolve(name, subject, bindings, ctx, cb)
+        });
+      }
+    }
+    for (const name of [...this.measures.keys()]) {
+      if (!seen.has(name)) this.measures.delete(name);
+    }
+    return this;
+  }
+
+  /** The value-graph node schema derived from the DSL (name → spec). */
+  schema() {
+    const out = {};
+    for (const [name] of this.measures) out[name] = this.vg.relationSpec(name);
+    return out;
+  }
+
+  // ---------------------------------------------------------------------------
+  // Measure metadata + binding normalization + validation
+  // ---------------------------------------------------------------------------
+
+  _measure(name) {
+    const meta = this.measures.get(name);
+    if (!meta) {
+      if (this.strict) throw new Error(`DSLValueGraph: '${name}' is not a declared measure`);
+      return null;
+    }
+    return meta;
+  }
+
+  /**
+   * Normalize positional (array) args to named bindings, strip control keys
+   * (`_subject` etc.), and validate the bound values against declared params.
+   * Positional args must match the declared arity exactly — otherwise the cache
+   * key would silently diverge from the caller's intent.
+   */
+  _bindings(name, args) {
+    const meta = this._measure(name);
+    if (!meta) return {};
+    let raw = args;
+    if (Array.isArray(args)) {
+      if (args.length !== meta.params.length) {
+        throw new Error(
+          `DSLValueGraph: measure '${name}' expects ${meta.params.length} positional argument(s), got ${args.length}`
+        );
+      }
+      raw = {};
+      for (let i = 0; i < meta.params.length; i++) raw[meta.params[i].name] = args[i];
+    }
+    const bindings = {};
+    for (const [key, value] of Object.entries(raw || {})) {
+      if (isControlKey(key)) continue;
+      bindings[key] = value;
+    }
+    for (const p of meta.params) {
+      if (!(p.name in bindings)) continue;
+      const v = bindings[p.name];
+      if (p.isArray) {
+        if (!Array.isArray(v)) throw new Error(`DSLValueGraph: parameter '${p.name}' of '${name}' must be an array`);
+      } else if (!validateValueType(v, p.type)) {
+        throw new Error(`DSLValueGraph: parameter '${p.name}' of '${name}' must match declared type '${p.type}'`);
+      }
+    }
+    return bindings;
+  }
+
+  // ---------------------------------------------------------------------------
+  // Resolvers (the compute substrate)
+  // ---------------------------------------------------------------------------
+
+  _resolve(name, subject, bindings, ctx, cb) {
+    const resolver = this.resolvers.get(name);
+    if (resolver) return resolver(subject, bindings, ctx, cb);
+    cb(null, null); // stored-only measure with nothing stored → null
+  }
+
+  /**
+   * Register an external value resolver for a declared measure. The resolver is
+   * a value-graph callback/sync resolver: `(subject, params, ctx, cb)` → calls
+   * `cb(err, value)` (or `{ value, unit, source }`) or returns a value synchronously.
+   * Unknown measures are a no-op in non-strict mode, an error in strict mode.
+   */
+  resolve(name, fn) {
+    if (!this._measure(name)) return this;
+    if (typeof fn !== 'function') throw new Error(`DSLValueGraph: resolver for '${name}' must be a function`);
+    this.resolvers.set(name, fn);
+    return this;
+  }
+
+  // ---------------------------------------------------------------------------
+  // Storage — values/attributes that are NOT cached or computed.
+  // ---------------------------------------------------------------------------
+
+  /**
+   * Store a value/attribute directly into the value-graph. The value is validated
+   * against the measure's declared PROVIDES type and readable back via getValue /
+   * measure / runtime.measure until overwritten or invalidated.
+   * Unknown measures are a no-op in non-strict mode, an error in strict mode.
+   */
+  setValue(name, args, value, { unit = null, source = 'dsl' } = {}) {
+    const meta = this._measure(name);
+    if (!meta) return this;
+    if (!validateValueType(value, meta.returnType)) {
+      throw new Error(`DSLValueGraph: value for '${name}' must match declared type '${meta.returnType}'`);
+    }
+    const bindings = this._bindings(name, args);
+    const subject = this.subjectOf(name, args);
+    this.vg.set(subject, name, bindings, { value, unit, source });
+    return this;
+  }
+
+  // ---------------------------------------------------------------------------
+  // Retrieval — partial-graph purposes.
+  // ---------------------------------------------------------------------------
+
+  /**
+   * Synchronously retrieve a value from the value-graph (stored or resolved).
+   * Returns the entry `{ value, unit, at, source, fresh }` or `null`.
+   * Unknown measures are null in non-strict mode, an error in strict mode.
+   */
+  getValue(name, args) {
+    const meta = this._measure(name);
+    if (!meta) return null;
+    const bindings = this._bindings(name, args);
+    const subject = this.subjectOf(name, args);
+    let out = null;
+    let errOut = null;
+    this.vg.get(subject, name, bindings, (err, entry) => { errOut = err; out = entry; });
+    if (errOut) throw errOut;
+    return out;
+  }
+
+  /**
+   * Async measure retrieval matching `DSLRuntime.measure`'s shape:
+   * `{ value, unit, source }`. Missing → `{ value: null, unit: null, source: null }`.
+   * Unknown measures are `{ value: null, ... }` in non-strict mode, an error in strict mode.
+   */
+  async measure(name, args = {}) {
+    const meta = this._measure(name);
+    if (!meta) return { value: null, unit: null, source: null };
+    const bindings = this._bindings(name, args);
+    const subject = this.subjectOf(name, args);
+    return new Promise((resolve, reject) => {
+      this.vg.get(subject, name, bindings, (err, entry) => {
+        if (err) return reject(err);
+        resolve(entry
+          ? { value: entry.value, unit: entry.unit, source: entry.source }
+          : { value: null, unit: null, source: null });
+      });
+    });
+  }
+
+  /**
+   * Wire `runtime.measure(name, args)` through the value-graph by registering a
+   * value-graph-backed provider for every DECLARED measure. Re-syncs first, so a
+   * recompiled runtime picks up new measures and drops attach-registered
+   * providers for removed ones. A later manual `registerMeasure` overrides it
+   * until the next attach.
+   */
+  attach() {
+    this.sync();
+    const declared = new Set(this.measures.keys());
+    for (const name of this._attached) {
+      if (!declared.has(name) && this.runtime.measureProviders.has(name)) {
+        this.runtime.unregisterMeasure(name);
+      }
+    }
+    for (const name of declared) {
+      this.runtime.registerMeasure(name, async (bindings) => this.measure(name, bindings));
+      this._attached.add(name);
+    }
+    return this;
+  }
+}
+
+export default DSLValueGraph;

tests/ChainConditionStep.test.js

@@ -0,0 +1,129 @@
+/**
+ * tests/ChainConditionStep.test.js — a chain whose FINAL (object-side) hop
+ * references a defeasible/logical evidence. The compiler lowers it to a
+ * condition step: `{ rule: <config>, conditionStep: true }`, which the engine
+ * verifies at (intermediate, object) rather than traversing an edge.
+ *
+ * Only the final step may be a condition (the object is known); an
+ * intermediate condition cannot discover nodes and is a compile error.
+ */
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { Arbiter } from '@arbiter/core';
+import { DSLCompiler } from '../src/DSLCompiler.js';
+
+const DEFS = `
+  definition Employee { id: string }
+  definition Group { id: string }
+  definition Doc { id: string }
+  fact member_of(user: Employee, group: Group)
+  fact can_view(group: Group, doc: Doc)
+  fact banned(group: Group)
+  fact can_edit(group: Group, doc: Doc)
+`;
+
+function compile(dsl, name = 'chain-cond') {
+  const arb = new Arbiter();
+  const compiler = new DSLCompiler(arb);
+  const result = compiler.compile(dsl, name);
+  return { arb, result };
+}
+
+describe('Chain condition step (logical evidence as final hop)', () => {
+  it('lowers a defeasible final step to a condition step and grants', () => {
+    const { arb, result } = compile(`
+      ${DEFS}
+      evidence gated(group: Group, doc: Doc) { WHEN can_view(group, doc) UNLESS banned(group) }
+      evidence can_via(user: Employee, doc: Doc) { member_of(user, *g) { gated(g, doc) } }
+    `);
+    assert.ok(result.success, JSON.stringify(result.errors));
+    const steps = arb.relationConfigs.get('can_via').steps;
+    assert.equal(steps[0], 'member_of');
+    assert.equal(steps[1].conditionStep, true);
+    assert.equal(steps[1].rule.type, 'logical');
+    // transitive dependency collection through the condition step
+    assert.deepEqual(arb.relationConfigs.get('can_via').dependsOn, ['member_of', 'can_view', 'banned']);
+
+    arb.addNode('u:1', 'Employee'); arb.addNode('g:1', 'Group'); arb.addNode('doc:9', 'Doc');
+    arb.addRelation('u:1', 'member_of', 'g:1', { possibility: 1.0 });
+    arb.addRelation('g:1', 'can_view', 'doc:9', { possibility: 0.7 });
+    assert.equal(arb.check('u:1', 'can_via', 'doc:9').possibility, 0.7);
+
+    // banning the intermediate defeats the condition hop
+    arb.addRelation('g:1', 'banned', 'g:1', { possibility: 1.0 });
+    assert.equal(arb.check('u:1', 'can_via', 'doc:9').possibility, 0);
+  });
+
+  it('supports ALWAYS/NEVER evidence as a condition step', () => {
+    const { arb, result } = compile(`
+      ${DEFS}
+      evidence gated(group: Group, doc: Doc) { ALWAYS can_edit(group, doc) }
+      evidence can_via(user: Employee, doc: Doc) { member_of(user, *g) { gated(g, doc) } }
+    `);
+    assert.ok(result.success, JSON.stringify(result.errors));
+    const steps = arb.relationConfigs.get('can_via').steps;
+    assert.equal(steps[1].conditionStep, true);
+    arb.addNode('u:1', 'Employee'); arb.addNode('g:1', 'Group'); arb.addNode('doc:9', 'Doc');
+    arb.addRelation('u:1', 'member_of', 'g:1', { possibility: 1.0 });
+    arb.addRelation('g:1', 'can_edit', 'doc:9', { possibility: 0.6 });
+    assert.equal(arb.check('u:1', 'can_via', 'doc:9').possibility, 0.6);
+    arb.removeRelation('g:1', 'can_edit', 'doc:9');
+    assert.equal(arb.check('u:1', 'can_via', 'doc:9').possibility, 0);
+  });
+
+  it('keeps the condition evidence checkable in its own right', () => {
+    const { arb, result } = compile(`
+      ${DEFS}
+      evidence gated(group: Group, doc: Doc) { WHEN can_view(group, doc) UNLESS banned(group) }
+      evidence can_via(user: Employee, doc: Doc) { member_of(user, *g) { gated(g, doc) } }
+    `);
+    assert.ok(result.success, JSON.stringify(result.errors));
+    arb.addNode('g:1', 'Group'); arb.addNode('doc:9', 'Doc');
+    arb.addRelation('g:1', 'can_view', 'doc:9', { possibility: 0.8 });
+    assert.equal(arb.check('g:1', 'gated', 'doc:9').possibility, 0.8);
+  });
+
+  it('parallel intermediates aggregate through the condition step', () => {
+    const { arb, result } = compile(`
+      ${DEFS}
+      evidence gated(group: Group, doc: Doc) { can_view(group, doc) }
+      evidence can_via(user: Employee, doc: Doc) { member_of(user, *g) { gated(g, doc) } }
+    `);
+    assert.ok(result.success, JSON.stringify(result.errors));
+    arb.addNode('u:1', 'Employee'); arb.addNode('g:1', 'Group'); arb.addNode('g2:2', 'Group'); arb.addNode('doc:9', 'Doc');
+    arb.addRelation('u:1', 'member_of', 'g:1', { possibility: 0.5 });
+    arb.addRelation('g:1', 'can_view', 'doc:9', { possibility: 0.7 });
+    arb.addRelation('u:1', 'member_of', 'g2:2', { possibility: 1.0 });
+    arb.addRelation('g2:2', 'can_view', 'doc:9', { possibility: 0.8 });
+    // max over paths: min(0.5,0.7)=0.5, min(1.0,0.8)=0.8 -> 0.8
+    assert.equal(arb.check('u:1', 'can_via', 'doc:9').possibility, 0.8);
+  });
+
+  it('expands an INTERMEDIATE condition step via rule-based reachability', () => {
+    const { arb, result } = compile(`
+      definition Employee { id: string }
+      definition Doc { id: string }
+      fact peer(user: Employee, other: Employee)
+      fact trusted(other: Employee)
+      fact can_read(user: Employee, doc: Doc)
+      evidence peer_trusted(user: Employee, other: Employee) { WHEN peer(user, other) UNLESS trusted(other) }
+      evidence can_access(user: Employee, doc: Doc) { peer_trusted(user, *p) { can_read(p, doc) } }
+    `);
+    assert.ok(result.success, JSON.stringify(result.errors));
+    const steps = arb.relationConfigs.get('can_access').steps;
+    assert.equal(steps[0].conditionStep, true);
+    assert.equal(steps[0].rule.type, 'logical');
+
+    arb.addNode('u:1', 'Employee'); arb.addNode('p:1', 'Employee'); arb.addNode('p:2', 'Employee'); arb.addNode('doc:9', 'Doc');
+    arb.addRelation('u:1', 'peer', 'p:1', { possibility: 1.0 });
+    arb.addRelation('u:1', 'peer', 'p:2', { possibility: 1.0 });
+    arb.addRelation('p:1', 'trusted', 'p:1', { possibility: 1.0 }); // p:1 filtered
+    arb.addRelation('p:1', 'can_read', 'doc:9', { possibility: 0.9 });
+    arb.addRelation('p:2', 'can_read', 'doc:9', { possibility: 0.7 });
+    // only untrusted peer p:2 survives the intermediate condition -> 0.7
+    assert.equal(arb.check('u:1', 'can_access', 'doc:9').possibility, 0.7);
+    // trusting p:2 too removes all intermediates -> 0
+    arb.addRelation('p:2', 'trusted', 'p:2', { possibility: 1.0 });
+    assert.equal(arb.check('u:1', 'can_access', 'doc:9').possibility, 0);
+  });
+});

tests/ChainStepComposition.test.js

@@ -0,0 +1,127 @@
+/**
+ * tests/ChainStepComposition.test.js — evidence composition inside CHAIN
+ * steps. A chain step that references a derived evidence is expanded at
+ * compile time:
+ *   - a DIRECT evidence step → renamed to its underlying relation
+ *     (member_of(user,*g){ group_read(g,doc) } where group_read = can_view
+ *      becomes step 'can_view');
+ *   - a CHAIN evidence step → its steps are spliced into the parent chain
+ *     (a sub-path flattens into the linear source→…→object traversal);
+ *   - a DEFEASIBLE / LOGICAL / COMPARATOR evidence step is not an edge
+ *     traversal and is rejected at compile time;
+ *   - cycles and self-references through chain steps are compile errors.
+ */
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { Arbiter } from '@arbiter/core';
+import { DSLCompiler } from '../src/DSLCompiler.js';
+
+const DEFS = `
+  definition Employee { id: string }
+  definition Group { id: string }
+  definition Doc { id: string }
+  fact member_of(user: Employee, group: Group)
+  fact group_has(group: Group, sub: Group)
+  fact can_view(group: Group, doc: Doc)
+  fact can_access(group: Group, doc: Doc)
+  fact banned(group: Group)
+`;
+
+function compile(dsl, name = 'chain-compose') {
+  const arb = new Arbiter();
+  const compiler = new DSLCompiler(arb);
+  const result = compiler.compile(dsl, name);
+  return { arb, result };
+}
+
+describe('Chain step composition', () => {
+  it('renames a direct-evidence chain step to its underlying relation', () => {
+    const { arb, result } = compile(`
+      ${DEFS}
+      evidence group_read(group: Group, doc: Doc) { can_view(group, doc) }
+      evidence can_via(user: Employee, doc: Doc) { member_of(user, *g) { group_read(g, doc) } }
+    `);
+    assert.ok(result.success, JSON.stringify(result.errors));
+    // step 'group_read' → 'can_view'
+    assert.deepEqual(arb.relationConfigs.get('can_via').steps, ['member_of', 'can_view']);
+    arb.addNode('u:1', 'Employee'); arb.addNode('g:1', 'Group'); arb.addNode('doc:9', 'Doc');
+    arb.addRelation('u:1', 'member_of', 'g:1', { possibility: 1.0 });
+    arb.addRelation('g:1', 'can_view', 'doc:9', { possibility: 0.7 });
+    assert.equal(arb.check('u:1', 'can_via', 'doc:9').possibility, 0.7);
+  });
+
+  it('splices a chain-evidence step into the parent chain', () => {
+    const { arb, result } = compile(`
+      ${DEFS}
+      evidence group_enter(group: Group, doc: Doc) { group_has(group, *s) { can_access(s, doc) } }
+      evidence can_deep(user: Employee, doc: Doc) { member_of(user, *g) { group_enter(g, doc) } }
+    `);
+    assert.ok(result.success, JSON.stringify(result.errors));
+    // step 'group_enter' → its steps [group_has, can_access]
+    assert.deepEqual(arb.relationConfigs.get('can_deep').steps, ['member_of', 'group_has', 'can_access']);
+    arb.addNode('u:1', 'Employee'); arb.addNode('g:1', 'Group'); arb.addNode('g2:2', 'Group'); arb.addNode('doc:9', 'Doc');
+    arb.addRelation('u:1', 'member_of', 'g:1', { possibility: 1.0 });
+    arb.addRelation('g:1', 'group_has', 'g2:2', { possibility: 0.9 });
+    arb.addRelation('g2:2', 'can_access', 'doc:9', { possibility: 0.8 });
+    assert.equal(arb.check('u:1', 'can_deep', 'doc:9').possibility, 0.8);
+  });
+
+  it('expands a chain step whose direct evidence is itself composed', () => {
+    const { arb, result } = compile(`
+      ${DEFS}
+      evidence group_view(group: Group, doc: Doc) { can_view(group, doc) }
+      evidence group_read(group: Group, doc: Doc) { group_view(group, doc) }
+      evidence can_via(user: Employee, doc: Doc) { member_of(user, *g) { group_read(g, doc) } }
+    `);
+    assert.ok(result.success, JSON.stringify(result.errors));
+    assert.deepEqual(arb.relationConfigs.get('can_via').steps, ['member_of', 'can_view']);
+    arb.addNode('u:1', 'Employee'); arb.addNode('g:1', 'Group'); arb.addNode('doc:9', 'Doc');
+    arb.addRelation('u:1', 'member_of', 'g:1', { possibility: 1.0 });
+    arb.addRelation('g:1', 'can_view', 'doc:9', { possibility: 0.6 });
+    assert.equal(arb.check('u:1', 'can_via', 'doc:9').possibility, 0.6);
+  });
+
+  it('lowers a logical evidence FINAL step to a condition step', () => {
+    const { arb, result } = compile(`
+      ${DEFS}
+      evidence gated(group: Group, doc: Doc) { WHEN can_view(group, doc) UNLESS banned(group) }
+      evidence can_via(user: Employee, doc: Doc) { member_of(user, *g) { gated(g, doc) } }
+    `);
+    assert.ok(result.success, JSON.stringify(result.errors));
+    // final-step logical evidence → condition step (verified at the object)
+    const steps = arb.relationConfigs.get('can_via').steps;
+    assert.equal(steps[0], 'member_of');
+    assert.equal(steps[1].conditionStep, true);
+    assert.equal(steps[1].rule.type, 'logical');
+  });
+
+  it('rejects a mutual cycle through chain steps', () => {
+    const { result } = compile(`
+      ${DEFS}
+      evidence cyc_a(group: Group, doc: Doc) { group_has(group, *g) { cyc_b(g, doc) } }
+      evidence cyc_b(group: Group, doc: Doc) { cyc_a(group, doc) }
+    `);
+    assert.equal(result.success, false);
+    assert.ok(result.errors.some(e => /[Cc]yclic/.test(e)), JSON.stringify(result.errors));
+  });
+
+  it('rejects a self-reference through its own chain step', () => {
+    const { result } = compile(`
+      ${DEFS}
+      evidence cyc_c(group: Group, doc: Doc) { group_has(group, *g) { cyc_c(g, doc) } }
+    `);
+    assert.equal(result.success, false);
+    assert.ok(result.errors.some(e => /[Cc]yclic/.test(e)), JSON.stringify(result.errors));
+  });
+
+  it('re-derives transitive dependencies through expanded chain steps', () => {
+    const { arb, result } = compile(`
+      ${DEFS}
+      evidence group_read(group: Group, doc: Doc) { can_view(group, doc) }
+      evidence can_via(user: Employee, doc: Doc) { member_of(user, *g) { group_read(g, doc) } }
+    `);
+    assert.ok(result.success, JSON.stringify(result.errors));
+    // dependsOn reflects the expanded step, not the evidence reference
+    assert.deepEqual(arb.relationConfigs.get('can_via').dependsOn, ['member_of', 'can_view']);
+  });
+});

tests/DSLCompiler.test.js

@@ -196,6 +196,36 @@ describe('DSL Compiler', () => {
     assert.ok(invalidResult.errors.length > 0, 'Should have validation errors');
   });
 
+  test('Rejects duplicate fields within a definition', () => {
+    const dupFieldDSL = `
+      definition Employee { id: string id: string }
+    `;
+    const result = compiler.validate(dupFieldDSL);
+    assert.ok(!result.success, 'Duplicate field should fail validation');
+    assert.match(result.errors[0], /Duplicate field 'Employee.id'/);
+  });
+
+  test('Hints at the real constraint for common declaration mistakes', () => {
+    const withinOnFact = compiler.compile(`
+      definition Employee { id: string? }
+      fact owns(user: Employee, doc: Employee) within 1h
+    `, 'err-within');
+    assert.match(withinOnFact.errors[0], /within.*only valid on `source`/);
+
+    const doubleBehaves = compiler.compile(`
+      definition Employee { id: string? }
+      fact rel(user: Employee, doc: Employee) BEHAVES AS transitive BEHAVES { ttl 1h }
+    `, 'err-behaves');
+    assert.match(doubleBehaves.errors[0], /only one `BEHAVES` clause/);
+
+    const limitAfterBody = compiler.compile(`
+      definition Employee { id: string? }
+      fact owns(user: Employee, doc: Employee)
+      evidence can_read(user: Employee, doc: Employee) { owns(user, doc) } limit 5
+    `, 'err-limit');
+    assert.match(limitAfterBody.errors[0], /`limit` is only valid on pattern/);
+  });
+
   test('Rule generation', () => {
     const dsl = `
       definition Employee {

tests/DSLRuntime.test.js

@@ -0,0 +1,327 @@
+/**
+ * tests/DSLRuntime.test.js — higher-order DSL+Core wrapper.
+ *
+ * Covers:
+ *   - schema indexing (types, relations, injectable facts, dependency graph)
+ *   - typed inserts/updates (addNode / updateNodeData / addRelation / updateRelation)
+ *     reject unknown types, wrong node types, and mistyped field values
+ *   - DSL-informed check: derives partial-graph requirements, retrieves missing
+ *     injectable facts through providers, injects them, and delegates
+ *   - missing-fact reporting
+ *
+ * NOTE: referencing a derived evidence relation as a sub-rule of another rule
+ * (e.g. `WHEN can_read(user, doc)` where can_read is an evidence) lowers to a
+ * direct edge lookup and does NOT re-derive the evidence's config. Evidence
+ * composition across rules is a documented gap (use fusion or facts).
+ */
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { Arbiter } from '@arbiter/core';
+import { DSLRuntime } from '../src/runtime/DSLRuntime.js';
+
+const BASE_DSL = `
+  definition Employee { id: string? level: number? active: boolean? }
+  definition Group { id: string? }
+  definition Doc { id: string? }
+  fact member_of(user: Employee, group: Group)
+  fact *owns(user: Employee, doc: Doc)
+  fact *user_score(user: Employee, value: number)
+  fact *granted(user: Employee, doc: Doc)
+  fact can_access(group: Group, doc: Doc)
+  evidence can_read(user: Employee, doc: Doc) { owns(user, doc) }
+  evidence can_enter(user: Employee, doc: Doc) { member_of(user, *g) { can_access(g, doc) } }
+  evidence can_borrow(user: Employee, doc: Doc) { WHEN granted(user, doc) UNLESS user_score(user, 1) }
+`;
+
+function makeRuntime() {
+  return new DSLRuntime(new Arbiter()).compile(BASE_DSL, 'rt-test');
+}
+
+describe('DSLRuntime', () => {
+  it('indexes the DSL schema', () => {
+    const rt = makeRuntime();
+    assert.ok(rt.types.has('Employee'));
+    assert.equal(rt.types.get('Employee').fields.get('level').type, 'number');
+    assert.equal(rt.relations.get('owns').kind, 'fact');
+    assert.equal(rt.relations.get('owns').injectable, true);
+    assert.equal(rt.relations.get('member_of').injectable, false);
+    assert.equal(rt.relations.get('can_read').kind, 'evidence');
+    assert.deepEqual(rt.requiredFacts('can_read'), ['owns']);
+  });
+
+  it('validates typed node inserts', () => {
+    const rt = makeRuntime();
+    rt.addNode('u:1', 'Employee', { level: 3, active: true });
+    assert.throws(() => rt.addNode('g:1', 'Ghost', {}), /unknown type/);
+    assert.throws(() => rt.addNode('u:2', 'Employee', { level: 'high' }), /must be number/);
+    assert.throws(() => rt.addNode('u:3', 'Employee', { active: 'yes' }), /must be boolean/);
+  });
+
+  it('validates node updates against the declared type', () => {
+    const rt = makeRuntime();
+    rt.addNode('u:1', 'Employee', { level: 3, active: true });
+    rt.updateNodeData('u:1', { level: 5 });
+    assert.throws(() => rt.updateNodeData('u:1', { level: 'x' }), /must be number/);
+  });
+
+  it('validates relation endpoints against declared param types', () => {
+    const rt = makeRuntime();
+    rt.addNode('u:1', 'Employee', {});
+    rt.addNode('g:1', 'Group', {});
+    rt.addNode('doc:9', 'Doc', {});
+    rt.addRelation('u:1', 'member_of', 'g:1', { possibility: 1.0 });
+    assert.throws(() => rt.addRelation('u:1', 'member_of', 'doc:9', {}), /expected 'Group'/);
+    assert.throws(() => rt.addRelation('u:1', 'ghost_relation', 'g:1', {}), /unknown relation/);
+    // value-param fact: second param is a number value, dst must be the subject
+    rt.addRelation('u:1', 'user_score', 'u:1', { possibility: 1.0, value: 5 });
+    assert.throws(() => rt.addRelation('u:1', 'user_score', 'g:1', { possibility: 1.0, value: 5 }), /self-edge/);
+    assert.throws(() => rt.addRelation('u:1', 'user_score', 'u:1', { possibility: 1.0, value: 'high' }), /must be number/);
+  });
+
+  it('updateRelation validates and replaces', () => {
+    const rt = makeRuntime();
+    rt.addNode('u:1', 'Employee', {});
+    rt.addNode('g:1', 'Group', {});
+    rt.addNode('doc:9', 'Doc', {});
+    rt.addRelation('u:1', 'member_of', 'g:1', { possibility: 0.5 });
+    rt.updateRelation('u:1', 'member_of', 'g:1', { possibility: 1.0 });
+    assert.equal(rt.arbiter.check('u:1', 'member_of', 'g:1').possibility, 1.0);
+    assert.throws(() => rt.updateRelation('u:1', 'member_of', 'doc:9', {}), /expected 'Group'/);
+  });
+
+  it('DSL-informed check retrieves injectable facts via providers', async () => {
+    const rt = makeRuntime();
+    rt.addNode('u:1', 'Employee', {});
+    rt.addNode('doc:9', 'Doc', {});
+    const res = await rt.check('u:1', 'can_read', 'doc:9', {
+      factProviders: { owns: async () => 0.8 }
+    });
+    assert.equal(res.possibility, 0.8);
+    assert.equal(res.reason, 'allow_rule_matched');
+    assert.deepEqual(res.requiredFacts, ['owns']);
+    assert.deepEqual(res.providedFacts, ['owns']);
+    assert.deepEqual(res.missingFacts, []);
+  });
+
+  it('reports missing facts when a provider declines', async () => {
+    const rt = makeRuntime();
+    rt.addNode('u:1', 'Employee', {});
+    rt.addNode('doc:9', 'Doc', {});
+    const res = await rt.check('u:1', 'can_read', 'doc:9', {
+      factProviders: { owns: async () => null }
+    });
+    assert.equal(res.possibility, 0);
+    assert.deepEqual(res.missingFacts, [{ relation: 'owns', reason: 'not_provided' }]);
+  });
+
+  it('merges caller-supplied partial graphs with provider results', async () => {
+    const rt = makeRuntime();
+    rt.addNode('u:1', 'Employee', {});
+    rt.addNode('doc:9', 'Doc', {});
+    const res = await rt.check('u:1', 'can_read', 'doc:9', {
+      partialGraph: { relations: [{ src: 'u:1', relation: 'owns', dst: 'doc:9', possibility: 1.0 }] },
+      factProviders: { owns: async () => null }
+    });
+    assert.equal(res.possibility, 1.0);
+  });
+
+  it('unary condition inside binary evidence (subject-as-object) defeats the grant', async () => {
+    const rt = makeRuntime();
+    rt.addNode('u:1', 'Employee', {});
+    rt.addNode('doc:9', 'Doc', {});
+    // can_borrow: WHEN granted(user, doc) UNLESS user_score(user, 1).
+    // user_score is injectable+unary; the provider injects a user self-edge
+    // with value 1 -> the unless fires and defeats the grant.
+    const res = await rt.check('u:1', 'can_borrow', 'doc:9', {
+      factProviders: {
+        granted: async () => 0.9,
+        user_score: async () => ({ possibility: 1.0, value: 1 })
+      }
+    });
+    assert.equal(res.possibility, 0);
+    assert.equal(res.reason, 'defeated_by_unless');
+    assert.deepEqual(res.requiredFacts, ['granted', 'user_score']);
+  });
+
+  it('chain evidence across an intermediate validates and checks', async () => {
+    const rt = makeRuntime();
+    rt.addNode('u:1', 'Employee', {});
+    rt.addNode('g:1', 'Group', {});
+    rt.addNode('doc:9', 'Doc', {});
+    rt.addRelation('u:1', 'member_of', 'g:1', { possibility: 1.0 });
+    rt.addRelation('g:1', 'can_access', 'doc:9', { possibility: 0.7 });
+    // can_enter: member_of(user, *g) { can_access(g, doc) } — chain [member_of, can_access]
+    const res = await rt.check('u:1', 'can_enter', 'doc:9', {});
+    assert.equal(res.possibility, 0.7);
+  });
+
+  it('rejects checks against unknown relations in strict mode', async () => {
+    const rt = makeRuntime();
+    rt.addNode('u:1', 'Employee', {});
+    rt.addNode('doc:9', 'Doc', {});
+    await assert.rejects(() => rt.check('u:1', 'does_not_exist', 'doc:9'), /unknown relation/);
+  });
+
+  it('derives transitive required facts through evidence composition', async () => {
+    const dsl = `
+      definition Employee { id: string? }
+      definition Doc { id: string? }
+      fact *owns(user: Employee, doc: Doc)
+      fact *banned(user: Employee)
+      evidence can_read(user: Employee, doc: Doc) { owns(user, doc) }
+      evidence can_open(user: Employee, doc: Doc) { WHEN can_read(user, doc) UNLESS banned(user) }
+    `;
+    const rt = new DSLRuntime(new Arbiter()).compile(dsl, 'rt-comp');
+    rt.addNode('u:1', 'Employee', {});
+    rt.addNode('doc:9', 'Doc', {});
+    // can_open composes can_read, so its requirements reach through to owns.
+    assert.deepEqual(rt.requiredFacts('can_open'), ['owns', 'banned']);
+    const granted = await rt.check('u:1', 'can_open', 'doc:9', {
+      factProviders: { owns: async () => 0.9, banned: async () => 0 }
+    });
+    assert.equal(granted.possibility, 0.9);
+    assert.equal(granted.reason, 'allow_rule_matched');
+    assert.deepEqual(granted.providedFacts, ['owns', 'banned']);
+    const denied = await rt.check('u:1', 'can_open', 'doc:9', {
+      factProviders: { owns: async () => 0.9, banned: async () => 1 }
+    });
+    assert.equal(denied.possibility, 0);
+    assert.equal(denied.reason, 'defeated_by_unless');
+  });
+
+  it('derives transitive required facts through a condition-step chain', () => {
+    const dsl = `
+      definition Employee { id: string? }
+      definition Group { id: string? }
+      definition Doc { id: string? }
+      fact *member_of(user: Employee, group: Group)
+      fact *can_view(group: Group, doc: Doc)
+      fact *banned(group: Group)
+      evidence gated(group: Group, doc: Doc) { WHEN can_view(group, doc) UNLESS banned(group) }
+      evidence can_via(user: Employee, doc: Doc) { member_of(user, *g) { gated(g, doc) } }
+    `;
+    const rt = new DSLRuntime(new Arbiter()).compile(dsl, 'rt-cond');
+    // The condition step's facts (can_view, banned) reach through to the
+    // evidence's requirements, alongside the edge-traversal fact.
+    assert.deepEqual(rt.requiredFacts('can_via'), ['member_of', 'can_view', 'banned']);
+  });
+
+  it('negates a NOT predicate (1 - possibility)', async () => {
+    const dsl = `
+      definition Employee { id: string? }
+      fact banned(user: Employee)
+      evidence can_enter(user: Employee) { NOT banned(user) }
+    `;
+    // Absent predicate negates to allow.
+    const absent = new DSLRuntime(new Arbiter()).compile(dsl, 'rt-not-absent');
+    absent.addNode('u:1', 'Employee', {});
+    assert.equal((await absent.check('u:1', 'can_enter', 'u:1')).possibility, 1);
+    // Present predicate negates to its complement.
+    const present = new DSLRuntime(new Arbiter()).compile(dsl, 'rt-not-present');
+    present.addNode('u:1', 'Employee', {});
+    present.addRelation('u:1', 'banned', 'u:1', { possibility: 0.9 });
+    const denied = await present.check('u:1', 'can_enter', 'u:1');
+    assert.ok(Math.abs(denied.possibility - 0.1) < 1e-9, `expected 0.1, got ${denied.possibility}`);
+    // Nested inside an AND: the negated child still scopes to the subject.
+    const nested = new DSLRuntime(new Arbiter()).compile(`
+      definition Employee { id: string? }
+      definition Doc { id: string? }
+      fact owns(user: Employee, doc: Doc)
+      fact banned(user: Employee)
+      evidence can_open(user: Employee, doc: Doc) { owns(user, doc) NOT banned(user) }
+    `, 'rt-not-nested');
+    nested.addNode('u:1', 'Employee', {});
+    nested.addNode('doc:9', 'Doc', {});
+    nested.addRelation('u:1', 'owns', 'doc:9', { possibility: 0.8 });
+    nested.addRelation('u:1', 'banned', 'u:1', { possibility: 0.6 });
+    assert.equal((await nested.check('u:1', 'can_open', 'doc:9')).possibility, 0.4);
+  });
+
+  it('resolves BEHAVES AS transitive facts as bounded transitive closure', async () => {
+    const dsl = `
+      definition Employee { id: string? }
+      fact reports_to(user: Employee, boss: Employee) BEHAVES AS transitive
+      evidence can_see(user: Employee, doc: Employee) { reports_to(user, doc) }
+    `;
+    const rt = new DSLRuntime(new Arbiter()).compile(dsl, 'rt-transitive');
+    ['e:1', 'e:2', 'e:3', 'e:4'].forEach(k => rt.addNode(k, 'Employee', {}));
+    rt.addRelation('e:1', 'reports_to', 'e:2', { possibility: 1.0 });
+    rt.addRelation('e:2', 'reports_to', 'e:3', { possibility: 0.9 });
+    rt.addRelation('e:3', 'reports_to', 'e:4', { possibility: 0.8 });
+    // Direct checks on the transitive fact follow multi-hop paths.
+    assert.equal((await rt.check('e:1', 'reports_to', 'e:3')).possibility, 0.9);
+    assert.equal((await rt.check('e:1', 'reports_to', 'e:4')).possibility, 0.8);
+    // Reverse direction does not grant.
+    assert.equal((await rt.check('e:2', 'reports_to', 'e:1')).possibility, 0);
+    // Evidence references inherit the closure.
+    assert.equal((await rt.check('e:1', 'can_see', 'e:4')).possibility, 0.8);
+    // Non-transitive facts stay direct-only.
+    const direct = new DSLRuntime(new Arbiter()).compile(`
+      definition Employee { id: string? }
+      fact knows(user: Employee, peer: Employee)
+      evidence can_ping(user: Employee, doc: Employee) { knows(user, doc) }
+    `, 'rt-nontransitive');
+    ['a:1', 'a:2', 'a:3'].forEach(k => direct.addNode(k, 'Employee', {}));
+    direct.addRelation('a:1', 'knows', 'a:2', { possibility: 1.0 });
+    direct.addRelation('a:2', 'knows', 'a:3', { possibility: 1.0 });
+    assert.equal((await direct.check('a:1', 'can_ping', 'a:3')).possibility, 0);
+  });
+
+  it('bounds transitive closure depth by the fact limit', async () => {
+    const rt = new DSLRuntime(new Arbiter()).compile(`
+      definition Employee { id: string? }
+      fact reports_to(user: Employee, boss: Employee) BEHAVES AS transitive limit 2
+      evidence can_see(user: Employee, doc: Employee) { reports_to(user, doc) }
+    `, 'rt-transitive-limit');
+    ['e:1', 'e:2', 'e:3', 'e:4'].forEach(k => rt.addNode(k, 'Employee', {}));
+    rt.addRelation('e:1', 'reports_to', 'e:2', { possibility: 1.0 });
+    rt.addRelation('e:2', 'reports_to', 'e:3', { possibility: 1.0 });
+    rt.addRelation('e:3', 'reports_to', 'e:4', { possibility: 1.0 });
+    assert.equal((await rt.check('e:1', 'can_see', 'e:3')).possibility, 1.0);
+    assert.equal((await rt.check('e:1', 'can_see', 'e:4')).possibility, 0);
+  });
+
+  it('retrieves sources through providers and gates them by within recency', async () => {
+    const rt = new DSLRuntime(new Arbiter()).compile(`
+      definition Employee { id: string? }
+      definition Doc { id: string? }
+      source *session(user: Employee) within 1h
+      fact *owns(user: Employee, doc: Doc)
+      evidence can_read(user: Employee, doc: Doc) { session(user) owns(user, doc) }
+    `, 'rt-source');
+    rt.addNode('u:1', 'Employee', {});
+    rt.addNode('doc:9', 'Doc', {});
+    assert.ok(rt.relations.has('session'));
+    assert.equal(rt.relations.get('session').kind, 'source');
+    assert.equal(rt.relations.get('session').withinMs, 3_600_000);
+    // A fresh session proof grants.
+    const fresh = await rt.check('u:1', 'can_read', 'doc:9', {
+      factProviders: { session: async () => ({ possibility: 1.0, value: Date.now() }), owns: async () => 0.9 }
+    });
+    assert.equal(fresh.possibility, 0.9);
+    assert.deepEqual(fresh.providedFacts, ['session', 'owns']);
+    // A stale proof (2h old, beyond the 1h window) denies as stale.
+    const stale = await rt.check('u:1', 'can_read', 'doc:9', {
+      factProviders: { session: async () => ({ possibility: 1.0, value: Date.now() - 2 * 3600_000 }), owns: async () => 0.9 }
+    });
+    assert.equal(stale.possibility, 0);
+    assert.deepEqual(stale.missingFacts, [{ relation: 'session', reason: 'stale' }]);
+  });
+
+  it('warns about and drops provider edges referencing unknown nodes', async () => {
+    const rt = new DSLRuntime(new Arbiter()).compile(`
+      definition Employee { id: string? }
+      definition Doc { id: string? }
+      fact *owns(user: Employee, doc: Doc)
+      evidence can_read(user: Employee, doc: Doc) { owns(user, doc) }
+    `, 'rt-ghost');
+    rt.addNode('u:1', 'Employee', {});
+    rt.addNode('doc:9', 'Doc', {});
+    const res = await rt.check('u:1', 'can_read', 'doc:9', {
+      factProviders: { owns: async () => [{ src: 'ghost:1', dst: 'doc:9', possibility: 0.9 }] }
+    });
+    assert.equal(res.possibility, 0);
+    assert.equal(res.warnings.length, 1);
+    assert.match(res.warnings[0], /unknown source node 'ghost:1'/);
+  });
+});

tests/DSLRuntimeCache.test.js

@@ -0,0 +1,203 @@
+/**
+ * tests/DSLRuntimeCache.test.js — provider-result caching with time expiry.
+ *
+ * Registered providers retrieve missing facts from a data store; caching the
+ * retrieval avoids hammering the store on repeated checks. TTL resolution:
+ * DSL-declared `BEHAVES { ttl <duration> }` on a fact > per-fact setFactTTL >
+ * policy default (30s). Per-check factProviders are cache-transparent (one-off
+ * observations: no cache read, no cache write). Registering a provider or
+ * mutating the graph invalidates the cache.
+ */
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { Arbiter } from '@arbiter/core';
+import { DSLRuntime } from '../src/runtime/DSLRuntime.js';
+
+const BASE_DSL = `
+  definition Employee { id: string? }
+  definition Doc { id: string? }
+  fact *owns(user: Employee, doc: Doc)
+  evidence can_read(user: Employee, doc: Doc) { owns(user, doc) }
+`;
+
+function makeRuntime(options = {}) {
+  let t = 0;
+  const clock = () => t;
+  const rt = new DSLRuntime(new Arbiter(), { clock, ...options }).compile(BASE_DSL, 'rt-cache');
+  rt._test_advance = (ms) => { t += ms; };
+  return rt;
+}
+
+describe('DSLRuntime provider-result caching', () => {
+  it('reuses a registered provider result within the TTL', async () => {
+    const rt = makeRuntime();
+    rt.addNode('u:1', 'Employee', {});
+    rt.addNode('doc:9', 'Doc', {});
+    let calls = 0;
+    rt.registerFact('owns', async () => { calls++; return 0.9; });
+    await rt.check('u:1', 'can_read', 'doc:9');
+    await rt.check('u:1', 'can_read', 'doc:9');
+    assert.equal(calls, 1, 'provider should be invoked once within TTL');
+  });
+
+  it('re-invokes the provider after the TTL expires', async () => {
+    const rt = makeRuntime();
+    rt.setFactTTL('owns', 100);
+    rt.addNode('u:1', 'Employee', {});
+    rt.addNode('doc:9', 'Doc', {});
+    let calls = 0;
+    let value = 0.9;
+    rt.registerFact('owns', async () => { calls++; return value; });
+    const first = await rt.check('u:1', 'can_read', 'doc:9');
+    assert.equal(first.possibility, 0.9);
+    rt._test_advance(50);
+    await rt.check('u:1', 'can_read', 'doc:9'); // within TTL -> cached
+    assert.equal(calls, 1);
+    rt._test_advance(60); // past TTL (110 total)
+    value = 0.4;
+    const after = await rt.check('u:1', 'can_read', 'doc:9');
+    assert.equal(calls, 2);
+    assert.equal(after.possibility, 0.4);
+  });
+
+  it('per-check factProviders override the cache (fresh observation)', async () => {
+    const rt = makeRuntime();
+    rt.addNode('u:1', 'Employee', {});
+    rt.addNode('doc:9', 'Doc', {});
+    rt.registerFact('owns', async () => 0.9);
+    await rt.check('u:1', 'can_read', 'doc:9');
+    // Per-check override is cache-transparent: it must NOT be masked by the
+    // cached 0.9, and it must NOT overwrite the cached value.
+    const over = await rt.check('u:1', 'can_read', 'doc:9', {
+      factProviders: { owns: async () => 0.2 }
+    });
+    assert.equal(over.possibility, 0.2);
+    const next = await rt.check('u:1', 'can_read', 'doc:9');
+    assert.equal(next.possibility, 0.9, 'registered provider cache untouched by per-check override');
+  });
+
+  it('registerFact invalidates the cached result for that relation', async () => {
+    const rt = makeRuntime();
+    rt.addNode('u:1', 'Employee', {});
+    rt.addNode('doc:9', 'Doc', {});
+    rt.registerFact('owns', async () => 0.9);
+    await rt.check('u:1', 'can_read', 'doc:9');
+    rt.registerFact('owns', async () => 0.3); // re-register -> cache invalidated
+    const res = await rt.check('u:1', 'can_read', 'doc:9');
+    assert.equal(res.possibility, 0.3);
+  });
+
+  it('invalidates cached results on graph mutations', async () => {
+    const rt = makeRuntime();
+    rt.addNode('u:1', 'Employee', {});
+    rt.addNode('doc:9', 'Doc', {});
+    let calls = 0;
+    rt.registerFact('owns', async () => { calls++; return 0.9; });
+    await rt.check('u:1', 'can_read', 'doc:9');
+    assert.equal(calls, 1);
+    rt.addRelation('u:1', 'owns', 'doc:9', { possibility: 1.0 }); // mutation clears cache
+    const res = await rt.check('u:1', 'can_read', 'doc:9');
+    assert.equal(calls, 2, 'graph mutation should invalidate the provider cache');
+  });
+
+  it('invalidateProviderCache() clears all or per relation', async () => {
+    const dsl = `
+      definition Employee { id: string? }
+      definition Doc { id: string? }
+      fact *owns(user: Employee, doc: Doc)
+      fact *banned(user: Employee)
+      evidence can_read(user: Employee, doc: Doc) { owns(user, doc) }
+      evidence can_open(user: Employee, doc: Doc) { WHEN can_read(user, doc) UNLESS banned(user) }
+    `;
+    const rt = new DSLRuntime(new Arbiter()).compile(dsl, 'rt-cache2');
+    rt.addNode('u:1', 'Employee', {});
+    rt.addNode('doc:9', 'Doc', {});
+    let ownsCalls = 0, bannedCalls = 0;
+    rt.registerFact('owns', async () => { ownsCalls++; return 0.9; });
+    rt.registerFact('banned', async () => { bannedCalls++; return 0; });
+    await rt.check('u:1', 'can_open', 'doc:9');
+    assert.equal(ownsCalls, 1);
+    assert.equal(bannedCalls, 1);
+    // Invalidate a non-dependency relation: can_open's cache (owns+banned) survives.
+    rt.invalidateProviderCache('does_not_exist');
+    await rt.check('u:1', 'can_open', 'doc:9');
+    assert.equal(ownsCalls, 1);
+    assert.equal(bannedCalls, 1);
+    // Invalidate owns only: banned survives, owns re-fetched.
+    rt.invalidateProviderCache('owns');
+    await rt.check('u:1', 'can_open', 'doc:9');
+    assert.equal(ownsCalls, 2, 'owns cache cleared by per-relation invalidation');
+    assert.equal(bannedCalls, 1, 'banned cache survives per-relation invalidation');
+    // Clear all.
+    rt.invalidateProviderCache();
+    await rt.check('u:1', 'can_open', 'doc:9');
+    assert.equal(bannedCalls, 2, 'full invalidation clears every relation');
+  });
+
+  it('policy default TTL applies when no per-fact TTL is set', async () => {
+    const rt = makeRuntime({ policy: { providerCacheTTL: 50 } });
+    rt.addNode('u:1', 'Employee', {});
+    rt.addNode('doc:9', 'Doc', {});
+    let calls = 0;
+    rt.registerFact('owns', async () => { calls++; return 0.9; });
+    await rt.check('u:1', 'can_read', 'doc:9');
+    rt._test_advance(40);
+    await rt.check('u:1', 'can_read', 'doc:9');
+    assert.equal(calls, 1, 'within 50ms policy TTL -> cached');
+    rt._test_advance(20);
+    await rt.check('u:1', 'can_read', 'doc:9');
+    assert.equal(calls, 2, 'past 50ms policy TTL -> re-invoked');
+  });
+
+  it('uses the DSL-declared fact TTL (BEHAVES { ttl X })', async () => {
+    const dsl = `
+      definition Employee { id: string? }
+      definition Doc { id: string? }
+      fact *balance(user: Employee, amount: number) BEHAVES { ttl 1h }
+      evidence can_spend(user: Employee, doc: Doc) { balance(user, 1) }
+    `;
+    let t = 0;
+    const rt = new DSLRuntime(new Arbiter(), { clock: () => t }).compile(dsl, 'rt-dsl-ttl');
+    // The DSL declares a 1h TTL for the balance fact.
+    assert.equal(rt.relations.get('balance').ttlMs, 3600_000);
+    rt.addNode('u:1', 'Employee', {});
+    rt.addNode('doc:9', 'Doc', {});
+    let calls = 0;
+    rt.registerFact('balance', async () => { calls++; return { possibility: 1.0, value: 50 }; });
+    await rt.check('u:1', 'can_spend', 'doc:9');
+    assert.equal(calls, 1);
+    t += 60 * 60 * 1000 - 1; // just under 1h
+    await rt.check('u:1', 'can_spend', 'doc:9');
+    assert.equal(calls, 1, 'cached within DSL-declared 1h TTL');
+    t += 2;
+    await rt.check('u:1', 'can_spend', 'doc:9');
+    assert.equal(calls, 2, 're-invoked past the DSL-declared 1h TTL');
+  });
+
+  it('cacheProviderResults:false bypasses the cache per check', async () => {
+    const rt = makeRuntime();
+    rt.addNode('u:1', 'Employee', {});
+    rt.addNode('doc:9', 'Doc', {});
+    let calls = 0;
+    rt.registerFact('owns', async () => { calls++; return 0.9; });
+    await rt.check('u:1', 'can_read', 'doc:9');
+    assert.equal(calls, 1);
+    // Bypass forces a fresh retrieval without clearing the cache.
+    await rt.check('u:1', 'can_read', 'doc:9', { cacheProviderResults: false });
+    assert.equal(calls, 2);
+    // Cache still intact for the next default check.
+    await rt.check('u:1', 'can_read', 'doc:9');
+    assert.equal(calls, 2);
+  });
+
+  it('policy.cacheProviderResults:false disables caching globally', async () => {
+    const rt = makeRuntime({ policy: { cacheProviderResults: false } });
+    rt.addNode('u:1', 'Employee', {});
+    rt.addNode('doc:9', 'Doc', {});
+    let calls = 0;
+    rt.registerFact('owns', async () => { calls++; return 0.9; });
+    await rt.check('u:1', 'can_read', 'doc:9');
+    await rt.check('u:1', 'can_read', 'doc:9');
+    assert.equal(calls, 2, 'no caching when disabled globally');
+  });
+});

tests/DSLRuntimeExt.test.js

@@ -0,0 +1,233 @@
+/**
+ * tests/DSLRuntimeExt.test.js — extended DSLRuntime capabilities:
+ *   - schema introspection (getSchema)
+ *   - per-relation provider registration (registerFact/unregisterFact)
+ *   - provider merging (registered + per-check overrides)
+ *   - bounded fixed-point provider retrieval loop (edges satisfy other facts)
+ *   - require() throw-on-deny
+ *   - removal passthroughs and fact-relation check validation
+ *   - timestamp/duration field typing
+ */
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { Arbiter } from '@arbiter/core';
+import { DSLRuntime } from '../src/runtime/DSLRuntime.js';
+
+const BASE_DSL = `
+  definition Employee { id: string? level: number? active: boolean? }
+  definition Doc { id: string? created: timestamp? }
+  fact *owns(user: Employee, doc: Doc)
+  fact *banned(user: Employee)
+  evidence can_read(user: Employee, doc: Doc) { owns(user, doc) }
+  evidence can_open(user: Employee, doc: Doc) { WHEN can_read(user, doc) UNLESS banned(user) }
+`;
+
+function makeRuntime() {
+  return new DSLRuntime(new Arbiter()).compile(BASE_DSL, 'rt-ext');
+}
+
+describe('DSLRuntime extended', () => {
+  it('exposes a serializable schema snapshot', () => {
+    const rt = makeRuntime();
+    const schema = rt.getSchema();
+    assert.ok(Array.isArray(schema.types));
+    const employee = schema.types.find(t => t.name === 'Employee');
+    assert.ok(employee);
+    assert.ok(employee.fields.some(f => f.name === 'level' && f.type === 'number'));
+    const owns = schema.facts.find(f => f.name === 'owns');
+    assert.equal(owns.injectable, true);
+    assert.equal(owns.params[1].type, 'Doc');
+    const can_open = schema.evidence.find(e => e.name === 'can_open');
+    assert.ok(can_open.dependsOn.includes('owns'));
+    assert.deepEqual(schema.providers, []);
+    assert.ok(rt.relationNames().includes('owns') && rt.relationNames().includes('can_read'));
+  });
+
+  it('registers, lists, and unregisters per-relation providers', () => {
+    const rt = makeRuntime();
+    rt.registerFact('owns', async () => 0.8);
+    assert.deepEqual(rt.registeredFacts(), ['owns']);
+    rt.registerFact('banned', async () => 0);
+    assert.deepEqual(rt.registeredFacts().sort(), ['banned', 'owns']);
+    rt.unregisterFact('banned');
+    assert.deepEqual(rt.registeredFacts(), ['owns']);
+    assert.throws(() => rt.registerFact('owns', 'not a function'), /must be a function/);
+  });
+
+  it('merges registered providers with per-check overrides', async () => {
+    const rt = makeRuntime();
+    rt.registerFact('owns', async () => 0.5);
+    rt.registerFact('banned', async () => 0);
+    rt.addNode('u:1', 'Employee', {});
+    rt.addNode('doc:9', 'Doc', {});
+    // registered owns (0.5) wins over nothing; per-check banned overrides
+    const res = await rt.check('u:1', 'can_open', 'doc:9', {
+      factProviders: { banned: async () => 0 }
+    });
+    assert.equal(res.possibility, 0.5);
+    assert.deepEqual(res.providedFacts.sort(), ['banned', 'owns']);
+  });
+
+  it('runs providers to a fixed point when edges satisfy other required facts', async () => {
+    // can_open needs owns (injectable). A registered owns provider returns an
+    // edge for a DIFFERENT injectable fact that can_open also requires via
+    // composition — here we add a transitive requirement to prove the loop.
+    const dsl = `
+      definition Employee { id: string? }
+      definition Doc { id: string? }
+      fact *owns(user: Employee, doc: Doc)
+      fact *granted(user: Employee, doc: Doc)
+      evidence base_read(user: Employee, doc: Doc) { owns(user, doc) }
+      evidence can_open(user: Employee, doc: Doc) { WHEN base_read(user, doc) UNLESS granted(user, doc) }
+    `;
+    const rt = new DSLRuntime(new Arbiter()).compile(dsl, 'rt-loop');
+    rt.addNode('u:1', 'Employee', {});
+    rt.addNode('doc:9', 'Doc', {});
+    let ownsCalls = 0;
+    let grantedCalls = 0;
+    rt.registerFact('owns', async () => {
+      ownsCalls++;
+      // First round the owns provider also supplies the granted edge (a
+      // fixed-point dependency: granted needs owns to have been retrieved).
+      return [
+        { src: 'u:1', relation: 'owns', dst: 'doc:9', possibility: 0.9 },
+        { src: 'u:1', relation: 'granted', dst: 'doc:9', possibility: 0 }
+      ];
+    });
+    rt.registerFact('granted', async () => { grantedCalls++; return 0; });
+    const res = await rt.check('u:1', 'can_open', 'doc:9', { maxProviderRounds: 3 });
+    assert.equal(res.possibility, 0.9);
+    // granted was satisfied by the owns provider's extra edge, so its own
+    // provider was never needed in a later round.
+    assert.equal(grantedCalls, 0);
+    assert.ok(ownsCalls >= 1);
+    assert.deepEqual(res.providedFacts, ['owns']);
+    assert.deepEqual(res.missingFacts, []);
+  });
+
+  it('require() throws on denial and returns the result on grant', async () => {
+    const rt = makeRuntime();
+    rt.addNode('u:1', 'Employee', {});
+    rt.addNode('doc:9', 'Doc', {});
+    rt.registerFact('owns', async () => 0.9);
+    const ok = await rt.require('u:1', 'can_read', 'doc:9');
+    assert.equal(ok.possibility, 0.9);
+    rt.registerFact('owns', async () => 0);
+    await assert.rejects(
+      () => rt.require('u:1', 'can_read', 'doc:9'),
+      (err) => err.result && err.result.possibility === 0 && /denied/.test(err.message)
+    );
+  });
+
+  it('passes through node/relation removal', () => {
+    const rt = makeRuntime();
+    rt.addNode('u:1', 'Employee', {});
+    rt.addNode('doc:9', 'Doc', {});
+    rt.addRelation('u:1', 'owns', 'doc:9', { possibility: 1.0 });
+    rt.removeRelation('u:1', 'owns', 'doc:9');
+    assert.equal(rt.arbiter.check('u:1', 'owns', 'doc:9').possibility, 0);
+    rt.removeNode('u:1');
+    assert.equal(rt.arbiter.nodeIdByKey.has('u:1'), false);
+  });
+
+  it('validates fact-relation check endpoints like evidence', async () => {
+    const rt = makeRuntime();
+    rt.addNode('u:1', 'Employee', {});
+    rt.addNode('doc:9', 'Doc', {});
+    // can_read is evidence; owns is a fact — checking a fact still validates.
+    await assert.rejects(() => rt.check('u:1', 'owns', 'u:1', {}), /expected 'Doc'/);
+  });
+
+  it('accepts timestamp field values and rejects mistyped ones', () => {
+    const rt = makeRuntime();
+    rt.addNode('doc:9', 'Doc', { created: 1720000000000 });
+    rt.updateNodeData('doc:9', { created: '2026-08-03T00:00:00Z' });
+    assert.throws(() => rt.addNode('doc:8', 'Doc', { created: {} }), /must be timestamp/);
+  });
+
+  it('direct FACT checks consult the registered provider', async () => {
+    const rt = makeRuntime();
+    rt.addNode('u:1', 'Employee', {});
+    rt.addNode('doc:9', 'Doc', {});
+    let calls = 0;
+    rt.registerFact('owns', async () => { calls++; return 0.9; });
+    // Checking the fact directly (not via an evidence) must retrieve it.
+    const res = await rt.check('u:1', 'owns', 'doc:9');
+    assert.equal(res.possibility, 0.9);
+    assert.equal(calls, 1);
+    assert.deepEqual(res.requiredFacts, ['owns']);
+    assert.deepEqual(res.providedFacts, ['owns']);
+    // Without a provider and without an edge, it reports the missing fact.
+    const rt2 = new DSLRuntime(new Arbiter()).compile(BASE_DSL, 'rt-fact-miss');
+    rt2.addNode('u:1', 'Employee', {});
+    rt2.addNode('doc:9', 'Doc', {});
+    const missed = await rt2.check('u:1', 'owns', 'doc:9');
+    assert.equal(missed.possibility, 0);
+    assert.deepEqual(missed.missingFacts, [{ relation: 'owns', reason: 'no_provider' }]);
+  });
+
+  it('recompiling a scope uninstalls its stale relation configs', async () => {
+    const rt = new DSLRuntime(new Arbiter());
+    rt.compile(`
+      definition Employee { id: string? }
+      definition Doc { id: string? }
+      fact owns(user: Employee, doc: Doc)
+      evidence can_read(user: Employee, doc: Doc) { owns(user, doc) }
+    `, 'rt-stale');
+    rt.addNode('u:1', 'Employee', {});
+    rt.addNode('doc:9', 'Doc', {});
+    rt.addRelation('u:1', 'owns', 'doc:9', { possibility: 1.0 });
+    assert.equal(rt.arbiter.check('u:1', 'can_read', 'doc:9').possibility, 1.0);
+
+    // Recompile the SAME scope with a different program: can_read/owns are no
+    // longer declared and must not keep granting. A second scope's relations
+    // would be unaffected (compileMultiple coexistence).
+    rt.compile(`
+      definition Employee { id: string? }
+      definition Doc { id: string? }
+      fact shares(user: Employee, doc: Doc)
+      evidence can_share(user: Employee, doc: Doc) { shares(user, doc) }
+    `, 'rt-stale');
+    const stale = rt.arbiter.check('u:1', 'can_read', 'doc:9');
+    assert.equal(stale.possibility, 0, 'revoked can_read must not keep granting');
+    assert.ok(!rt.arbiter.relationConfigs.has('can_read'));
+    assert.ok(!rt.arbiter.relationConfigs.has('owns'));
+    assert.ok(rt.arbiter.relationConfigs.has('can_share'));
+  });
+
+  it('indexes measures and resolves them via a registered provider', async () => {
+    const rt = new DSLRuntime(new Arbiter()).compile(`
+      definition Employee { id: string? }
+      definition Project { id: string? }
+      measure budget_available(tenant: Employee, feature: string) { } PROVIDES number
+      measure clearance(user: Employee) { } PROVIDES string
+    `, 'rt-measures');
+    // Schema exposes measures with their return type.
+    const schema = rt.getSchema();
+    const budget = schema.measures.find(m => m.name === 'budget_available');
+    assert.ok(budget);
+    assert.equal(budget.returnType, 'number');
+    assert.deepEqual(budget.params.map(p => p.name), ['tenant', 'feature']);
+    assert.ok(rt.relationNames().includes('clearance'));
+
+    // No provider yet → resolution fails loudly.
+    await assert.rejects(() => rt.measure('budget_available', { tenant: 'tenant:acme', feature: 'tokens_in:gpt-4' }), /no provider registered/);
+
+    // Register a provider (the ARRA adapter would bridge the value-graph).
+    rt.registerMeasure('budget_available', async ({ tenant, feature }) => {
+      assert.equal(tenant, 'tenant:acme');
+      assert.equal(feature, 'tokens_in:gpt-4');
+      return { value: 1250, unit: 'tokens' };
+    });
+    const resolved = await rt.measure('budget_available', { tenant: 'tenant:acme', feature: 'tokens_in:gpt-4' });
+    assert.equal(resolved.value, 1250);
+    assert.equal(resolved.unit, 'tokens');
+
+    // Positional args bind by param order for unary measures.
+    rt.registerMeasure('clearance', async () => ({ value: 'secret' }));
+    assert.equal((await rt.measure('clearance', ['user:alice'])).value, 'secret');
+
+    // registerMeasure rejects undeclared names.
+    assert.throws(() => rt.registerMeasure('nope', async () => 1), /not a declared measure/);
+  });
+});

tests/DSLRuntimeTyping.test.js

@@ -0,0 +1,136 @@
+/**
+ * tests/DSLRuntimeTyping.test.js — duration seconds, required fields, and
+ * type validation of insertions / updates / provider retrievals.
+ *
+ * - Duration literals now accept s/m/h/d/w: `BEHAVES { ttl 30s }` is 30s.
+ * - Definition fields are REQUIRED by default (`field: type`); `field: type?`
+ *   marks a field optional. addNode enforces presence on insert.
+ * - Provider-returned edges are validated against the fact's declared typing:
+ *   a value-carrying fact must return { value, possibility } with a value of
+ *   the declared type, and possibilities must lie in [0, 1].
+ */
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { Arbiter } from '@arbiter/core';
+import { DSLRuntime } from '../src/runtime/DSLRuntime.js';
+
+describe('DSLRuntime typing', () => {
+  it('accepts seconds/minutes/hours/days/weeks in duration literals', async () => {
+    const dsl = `
+      definition Employee { id: string? }
+      definition Doc { id: string? }
+      fact *a(user: Employee, amount: number) BEHAVES { ttl 30s }
+      fact *b(user: Employee, amount: number) BEHAVES { ttl 2m }
+      fact *c(user: Employee, amount: number) BEHAVES { ttl 1h }
+      fact *d(user: Employee, amount: number) BEHAVES { ttl 3d }
+      fact *e(user: Employee, amount: number) BEHAVES { ttl 1w }
+    `;
+    const rt = new DSLRuntime(new Arbiter()).compile(dsl, 'rt-units');
+    assert.equal(rt.relations.get('a').ttlMs, 30_000);
+    assert.equal(rt.relations.get('b').ttlMs, 120_000);
+    assert.equal(rt.relations.get('c').ttlMs, 3_600_000);
+    assert.equal(rt.relations.get('d').ttlMs, 259_200_000);
+    assert.equal(rt.relations.get('e').ttlMs, 604_800_000);
+  });
+
+  it('enforces required definition fields on node insert', () => {
+    const rt = new DSLRuntime(new Arbiter()).compile(`
+      definition Employee { id: string level: number active: boolean? }
+    `, 'rt-req');
+    // id and level are required (no `?`); active is optional.
+    assert.throws(() => rt.addNode('u:1', 'Employee', { level: 3 }), /missing required field 'Employee.id'/);
+    assert.throws(() => rt.addNode('u:2', 'Employee', { id: 'u:2' }), /missing required field 'Employee.level'/);
+    rt.addNode('u:3', 'Employee', { id: 'u:3', level: 5 }); // both required, no active -> ok
+    rt.addNode('u:4', 'Employee', { id: 'u:4', level: 5, active: true });
+  });
+
+  it('exposes requiredness in the schema snapshot', () => {
+    const rt = new DSLRuntime(new Arbiter()).compile(`
+      definition Employee { id: string level: number? }
+    `, 'rt-schema-req');
+    const employee = rt.getSchema().types.find(t => t.name === 'Employee');
+    assert.equal(employee.fields.find(f => f.name === 'id').required, true);
+    assert.equal(employee.fields.find(f => f.name === 'level').required, false);
+  });
+
+  it('validates a provider-returned value against the declared value type', async () => {
+    const rt = new DSLRuntime(new Arbiter()).compile(`
+      definition Employee { id: string? }
+      definition Doc { id: string? }
+      fact *balance(user: Employee, amount: number)
+      evidence can_spend(user: Employee, doc: Doc) { balance(user, 1) }
+    `, 'rt-valuetype');
+    rt.addNode('u:1', 'Employee', {});
+    rt.addNode('doc:9', 'Doc', {});
+    rt.registerFact('balance', async () => ({ possibility: 1.0, value: 'high' }));
+    await assert.rejects(() => rt.check('u:1', 'can_spend', 'doc:9'), /must be number/);
+  });
+
+  it('requires a value for a value-carrying fact (no bare-number shorthand)', async () => {
+    const rt = new DSLRuntime(new Arbiter()).compile(`
+      definition Employee { id: string? }
+      definition Doc { id: string? }
+      fact *balance(user: Employee, amount: number)
+      evidence can_spend(user: Employee, doc: Doc) { balance(user, 1) }
+    `, 'rt-valshape');
+    rt.addNode('u:1', 'Employee', {});
+    rt.addNode('doc:9', 'Doc', {});
+    rt.registerFact('balance', async () => 0.9);
+    await assert.rejects(() => rt.check('u:1', 'can_spend', 'doc:9'), /value-carrying fact/);
+    rt.registerFact('balance', async () => ({ possibility: 1.0 })); // missing value
+    await assert.rejects(() => rt.check('u:1', 'can_spend', 'doc:9'), /must supply a 'value'/);
+  });
+
+  it('rejects a provider-returned possibility outside [0, 1]', async () => {
+    const rt = new DSLRuntime(new Arbiter()).compile(`
+      definition Employee { id: string? }
+      definition Doc { id: string? }
+      fact *owns(user: Employee, doc: Doc)
+      evidence can_read(user: Employee, doc: Doc) { owns(user, doc) }
+    `, 'rt-poss');
+    rt.addNode('u:1', 'Employee', {});
+    rt.addNode('doc:9', 'Doc', {});
+    rt.registerFact('owns', async () => ({ possibility: 2.0 }));
+    await assert.rejects(() => rt.check('u:1', 'can_read', 'doc:9'), /invalid possibility/);
+  });
+
+  it('enforces a literal value in evidence as an exact edge-value gate', async () => {
+    const rt = new DSLRuntime(new Arbiter()).compile(`
+      definition Employee { id: string? }
+      fact balance(user: Employee, amount: number)
+      evidence can_afford(user: Employee) { balance(user, 5) }
+    `, 'rt-expected-value');
+    rt.addNode('u:1', 'Employee', {});
+    // An edge carrying amount 3 must NOT satisfy balance(user, 5) — without the
+    // gate every balance edge matched regardless of amount (silent over-grant).
+    rt.addRelation('u:1', 'balance', 'u:1', { possibility: 1.0, value: 3 });
+    const denied = await rt.check('u:1', 'can_afford', 'u:1');
+    assert.equal(denied.possibility, 0, 'value-3 edge must not satisfy balance(user, 5)');
+    rt.addRelation('u:1', 'balance', 'u:1', { possibility: 0.8, value: 5 });
+    const granted = await rt.check('u:1', 'can_afford', 'u:1');
+    assert.equal(granted.possibility, 0.8, 'value-5 edge must satisfy balance(user, 5)');
+  });
+
+  it('treats a value-typed evidence OBJECT param as the expected edge value', async () => {
+    const rt = new DSLRuntime(new Arbiter()).compile(`
+      definition Employee { id: string? }
+      fact balance(user: Employee, amount: number)
+      evidence can_withdraw(user: Employee, amount: number) { balance(user, amount) }
+    `, 'rt-value-object');
+    rt.addNode('u:1', 'Employee', {});
+    rt.addRelation('u:1', 'balance', 'u:1', { possibility: 0.9, value: 5 });
+    // The check object is the VALUE, not a node key: grant only on exact match.
+    const granted = await rt.check('u:1', 'can_withdraw', 5);
+    assert.equal(granted.possibility, 0.9, 'value-5 check must match the value-5 edge');
+    const denied = await rt.check('u:1', 'can_withdraw', 3);
+    assert.equal(denied.possibility, 0, 'value-3 check must not match the value-5 edge');
+    // Re-checking the granted value must not hit a value-3 cache entry.
+    const again = await rt.check('u:1', 'can_withdraw', 5);
+    assert.equal(again.possibility, 0.9, 'value-5 re-check must not be served the value-3 result');
+    // Direct fact check with a value object works the same way.
+    const direct = await rt.check('u:1', 'balance', 5);
+    assert.equal(direct.possibility, 0.9, 'direct balance(user, 5) must match the value-5 edge');
+    // A non-scalar object for a value-typed param is rejected loudly.
+    await assert.rejects(() => rt.check('u:1', 'can_withdraw', 'u:1'), /must be number/);
+  });
+});

tests/DSLValueGraph.test.js

@@ -0,0 +1,201 @@
+/**
+ * DSLValueGraph — evidence DSL declares the value-graph's typing/structures;
+ * measures retrieve through the graph (partial-graph purposes), and attributes
+ * that are neither cached nor computed are stored directly via setValue.
+ */
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { Arbiter } from '@arbiter/core';
+import { ValueGraph } from '@arbiter/value-graph';
+import { DSLRuntime, DSLValueGraph } from '../src/index.js';
+
+function makeRuntime(dsl) {
+  return new DSLRuntime(new Arbiter()).compile(dsl, 'vg-test');
+}
+
+const DSL = `
+  definition Employee { id: string? }
+  definition Project { id: string? }
+  measure budget_available(tenant: Employee, feature: string) { } PROVIDES number
+  measure clearance(user: Employee) { } PROVIDES string
+  measure is_active(user: Employee) { } PROVIDES boolean
+`;
+
+describe('DSLValueGraph integration', () => {
+  it('derives the value-graph node schema from the DSL measures', () => {
+    const dvg = new DSLValueGraph(makeRuntime(DSL));
+    const schema = dvg.schema();
+    assert.equal(schema.budget_available.returnType, 'number');
+    assert.deepEqual(schema.budget_available.params.map((p) => p.name), ['tenant', 'feature']);
+    assert.equal(schema.clearance.returnType, 'string');
+    assert.equal(schema.is_active.returnType, 'boolean');
+  });
+
+  it('stores attributes that are neither cached nor computed, and reads them back', () => {
+    const dvg = new DSLValueGraph(makeRuntime(DSL));
+    dvg.setValue('budget_available', { __subject: 'tenant:acme', tenant: 'tenant:acme', feature: 'tokens_in:gpt-4' }, 1250, { unit: 'tokens' });
+    const entry = dvg.getValue('budget_available', { __subject: 'tenant:acme', tenant: 'tenant:acme', feature: 'tokens_in:gpt-4' });
+    assert.equal(entry.value, 1250);
+    assert.equal(entry.unit, 'tokens');
+    assert.equal(entry.source, 'dsl');
+    assert.equal(entry.fresh, true);
+  });
+
+  it('measure() retrieves through the value-graph (partial-graph purposes)', async () => {
+    const dvg = new DSLValueGraph(makeRuntime(DSL));
+    dvg.setValue('clearance', { __subject: 'user:alice', user: 'user:alice' }, 'secret');
+    const resolved = await dvg.measure('clearance', { __subject: 'user:alice', user: 'user:alice' });
+    assert.equal(resolved.value, 'secret');
+  });
+
+  it('attach() wires runtime.measure() through the value-graph', async () => {
+    const rt = makeRuntime(DSL);
+    const dvg = new DSLValueGraph(rt);
+    dvg.setValue('is_active', { __subject: 'user:alice', user: 'user:alice' }, true);
+    dvg.attach();
+    const resolved = await rt.measure('is_active', { __subject: 'user:alice', user: 'user:alice' });
+    assert.equal(resolved.value, true);
+    // A measure with nothing stored resolves to null — no provider explosion.
+    const missing = await rt.measure('clearance', { __subject: 'user:bob', user: 'user:bob' });
+    assert.equal(missing.value, null);
+  });
+
+  it('resolves a value via an external callback resolver (the compute substrate)', async () => {
+    const dvg = new DSLValueGraph(makeRuntime(DSL));
+    dvg.resolve('budget_available', (subject, params, ctx, cb) => {
+      cb(null, { value: 999, unit: 'tokens', source: 'overlay:balances' });
+    });
+    const entry = await dvg.measure('budget_available', { __subject: 'tenant:acme', tenant: 'tenant:acme', feature: 'x' });
+    assert.equal(entry.value, 999);
+    assert.equal(entry.unit, 'tokens');
+    assert.equal(entry.source, 'overlay:balances');
+  });
+
+  it('validates stored values against the declared PROVIDES type', () => {
+    const dvg = new DSLValueGraph(makeRuntime(DSL));
+    assert.throws(() => dvg.setValue('budget_available', { feature: 'x' }, 'not-a-number'), /must match declared type 'number'/);
+    assert.throws(() => dvg.setValue('clearance', { user: 'u' }, 42), /must match declared type 'string'/);
+  });
+
+  it('validates parameter bindings against the declared parameter types', () => {
+    const dvg = new DSLValueGraph(makeRuntime(DSL));
+    assert.throws(() => dvg.setValue('budget_available', { tenant: 't', feature: 42 }, 5),
+      /parameter 'feature' of 'budget_available' must match declared type 'string'/);
+  });
+
+  it('rejects unknown measure names', async () => {
+    const dvg = new DSLValueGraph(makeRuntime(DSL));
+    assert.throws(() => dvg.setValue('nope', {}, 1), /not a declared measure/);
+    assert.throws(() => dvg.getValue('nope', {}), /not a declared measure/);
+    assert.throws(() => dvg.resolve('nope', () => 1), /not a declared measure/);
+    await assert.rejects(() => dvg.measure('nope', {}), /not a declared measure/);
+  });
+
+  it('binds positional args by declared parameter order', () => {
+    const dvg = new DSLValueGraph(makeRuntime(DSL));
+    dvg.setValue('budget_available', ['tenant:acme', 'tokens_in:gpt-4'], 50);
+    const entry = dvg.getValue('budget_available', ['tenant:acme', 'tokens_in:gpt-4']);
+    assert.equal(entry.value, 50);
+  });
+
+  it('the value-graph itself enforces declared return types on resolver results', async () => {
+    const dvg = new DSLValueGraph(makeRuntime(DSL));
+    dvg.resolve('clearance', (s, p, ctx, cb) => cb(null, 12345)); // number, but PROVIDES string
+    const err = await dvg.measure('clearance', { __subject: 'user:alice', user: 'user:alice' }).then(() => null, (e) => e);
+    assert.ok(err, 'a wrong-typed resolver result must be rejected');
+    assert.match(err.message, /must match declared type 'string'/);
+  });
+
+  it('shares a caller-supplied value graph and supports subjectOf', () => {
+    const vg = new ValueGraph();
+    const dvg = new DSLValueGraph(makeRuntime(DSL), {
+      valueGraph: vg,
+      subjectOf: (name, args) => args.tenant || args.user || 'global'
+    });
+    assert.equal(dvg.vg, vg);
+    dvg.setValue('clearance', { user: 'user:alice' }, 'top-secret');
+    assert.equal(dvg.getValue('clearance', { user: 'user:alice' }).value, 'top-secret');
+  });
+
+  it('rigor: setValue/getValue round-trips always return the stored value', async () => {
+    const { rigor } = await import('@rigor/core');
+    const report = await rigor.campaign(
+      [rigor.fn('roundtrip', (value) => {
+        const dvg = new DSLValueGraph(makeRuntime(DSL));
+        dvg.setValue('budget_available', { __subject: 'tenant:acme', tenant: 'tenant:acme', feature: 'f' }, value);
+        const e = dvg.getValue('budget_available', { __subject: 'tenant:acme', tenant: 'tenant:acme', feature: 'f' });
+        return e ? e.value : 'MISSING';
+      }, rigor.args(rigor.gen.int(-100000, 100000)))],
+      rigor.crucible([rigor.invariant('roundtrip', (ctx) => ctx.actual === ctx.args[0])])
+    ).run({ effort: 150, seed: 'dsl-vg-roundtrip' });
+    if (report.status !== 'passed') {
+      throw new Error(`DSLValueGraph rigor roundtrip failed: ${JSON.stringify((report.failures || []).slice(0, 3))}`);
+    }
+  });
+
+  it('rigor: setValue rejects wrong-typed values for every generated value', async () => {
+    const { rigor } = await import('@rigor/core');
+    const report = await rigor.campaign(
+      [rigor.fn('typed-reject', (value) => {
+        const dvg = new DSLValueGraph(makeRuntime(DSL));
+        try {
+          dvg.setValue('clearance', { user: 'u' }, value); // PROVIDES string
+          return { ok: true };
+        } catch (e) {
+          return { ok: false, error: e.message };
+        }
+      }, rigor.args(rigor.gen.int(0, 100)))],
+      rigor.crucible([rigor.invariant('rejects', (ctx) => ctx.actual.ok === false && /must match declared type 'string'/.test(ctx.actual.error))])
+    ).run({ effort: 150, seed: 'dsl-vg-typecheck' });
+    if (report.status !== 'passed') {
+      throw new Error(`DSLValueGraph rigor typecheck failed: ${JSON.stringify((report.failures || []).slice(0, 3))}`);
+    }
+  });
+
+  it('the aligned type vocabulary round-trips buffer/interval/any/duration', () => {
+    const dvg = new DSLValueGraph(makeRuntime(`
+      definition T { id: string }
+      measure quota(user: string) { } PROVIDES buffer
+      measure span(user: string) { } PROVIDES interval
+      measure whatever(user: string) { } PROVIDES any
+      measure window(user: string) { } PROVIDES duration
+    `));
+    const bytes = new Uint8Array([1, 2, 3, 254, 255]);
+    dvg.setValue('quota', { __subject: 'u', user: 'u' }, bytes);
+    assert.deepEqual([...dvg.getValue('quota', { __subject: 'u', user: 'u' }).value], [...bytes]);
+    dvg.setValue('span', { __subject: 'u', user: 'u' }, { lower: 100, upper: 200 });
+    assert.deepEqual(dvg.getValue('span', { __subject: 'u', user: 'u' }).value, { lower: 100, upper: 200 });
+    dvg.setValue('whatever', { __subject: 'u', user: 'u' }, 42); // any → accepted
+    assert.equal(dvg.getValue('whatever', { __subject: 'u', user: 'u' }).value, 42);
+    dvg.setValue('window', { __subject: 'u', user: 'u' }, '1h');
+    assert.equal(dvg.getValue('window', { __subject: 'u', user: 'u' }).value, '1h');
+  });
+
+  it('sync() re-registers measures after the runtime recompiles', () => {
+    const rt = new DSLRuntime(new Arbiter()).compile('measure a() { } PROVIDES number', 'v1');
+    const dvg = new DSLValueGraph(rt);
+    rt.compile('measure b() { } PROVIDES string', 'v2'); // a removed, b added
+    // Before sync: stale schema.
+    assert.throws(() => dvg.setValue('b', {}, 'x'), /not a declared measure/);
+    // After sync: b is usable, a is gone.
+    dvg.sync();
+    dvg.setValue('b', {}, 'x');
+    assert.equal(dvg.getValue('b', {}).value, 'x');
+    assert.throws(() => dvg.setValue('a', {}, 1), /not a declared measure/);
+    // schema() reflects the current measure set
+    assert.ok(dvg.schema().b);
+    assert.ok(!dvg.schema().a);
+  });
+
+  it('attach() re-syncs and unregisters providers for removed measures after recompile', async () => {
+    const rt = new DSLRuntime(new Arbiter()).compile('measure a() { } PROVIDES number', 'v1');
+    const dvg = new DSLValueGraph(rt);
+    dvg.attach();
+    rt.compile('measure b() { } PROVIDES string', 'v2');
+    dvg.attach(); // re-sync + re-wire
+    dvg.setValue('b', { __subject: 't' }, 'hello');
+    assert.equal((await rt.measure('b', { __subject: 't' })).value, 'hello');
+    // a is no longer declared after the recompile → the runtime rejects it
+    await assert.rejects(() => rt.measure('a', { __subject: 't' }), /unknown measure/);
+  });
+});

tests/DefinitionTests.js

@@ -19,11 +19,11 @@ describe('Type Definitions', () => {
   test('Basic definitions', () => {
     const testCases = [
       {
-        input: `definition User { role: string }`,
+        input: `definition Employee { role: string }`,
         description: 'Simple definition with one field'
       },
       {
-        input: `definition User {
+        input: `definition Employee {
           role: string
           isActive: boolean
         }`,
@@ -57,7 +57,8 @@ describe('Type Definitions', () => {
     ];
 
     testCases.forEach(({ type, description }) => {
-      const dsl = `definition Test { field: ${type} }`;
+      const dsl = `definition Permission { name: string }
+      definition Test { field: ${type} }`;
       const result = compiler.compile(dsl, `test-field-type-${Date.now()}`);
       assert.ok(result.success, `${description} should parse successfully`);
     });
@@ -73,7 +74,8 @@ describe('Type Definitions', () => {
     ];
 
     testCases.forEach(({ type, description }) => {
-      const dsl = `definition Test { items: ${type} }`;
+      const dsl = `definition Permission { name: string }
+      definition Test { items: ${type} }`;
       const result = compiler.compile(dsl, `test-array-${Date.now()}`);
       assert.ok(result.success, `${description} should parse successfully`);
     });
@@ -82,61 +84,61 @@ describe('Type Definitions', () => {
   test('Behaviors', () => {
     const testCases = [
       {
-        input: `definition User {
+        input: `definition Employee {
           balance: number BEHAVES { decaying down hourly }
         }`,
         description: 'Decay behavior - down hourly'
       },
       {
-        input: `definition User {
+        input: `definition Employee {
           reputation: number BEHAVES { decaying up daily }
         }`,
         description: 'Decay behavior - up daily'
       },
       {
-        input: `definition User {
+        input: `definition Employee {
           score: number BEHAVES { decaying neutral weekly }
         }`,
         description: 'Decay behavior - neutral weekly'
       },
       {
-        input: `definition User {
+        input: `definition Employee {
           stability: number BEHAVES { decaying stable monthly }
         }`,
         description: 'Decay behavior - stable monthly'
       },
       {
-        input: `definition User {
+        input: `definition Employee {
           confidence: number BEHAVES { blurring fixed }
         }`,
         description: 'Blur behavior - fixed'
       },
       {
-        input: `definition User {
+        input: `definition Employee {
           accuracy: number BEHAVES { blurring adaptive }
         }`,
         description: 'Blur behavior - adaptive'
       },
       {
-        input: `definition User {
+        input: `definition Employee {
           precision: number BEHAVES { blurring confidence confidence_90 }
         }`,
         description: 'Blur behavior - confidence with level'
       },
       {
-        input: `definition User {
+        input: `definition Employee {
           session: string BEHAVES { ttl 1h }
         }`,
         description: 'TTL behavior - hours'
       },
       {
-        input: `definition User {
+        input: `definition Employee {
           token: string BEHAVES { ttl 24h }
         }`,
         description: 'TTL behavior - 24 hours'
       },
       {
-        input: `definition User {
+        input: `definition Employee {
           cache: string BEHAVES { ttl 7d }
         }`,
         description: 'TTL behavior - days'
@@ -152,25 +154,25 @@ describe('Type Definitions', () => {
   test('Caching', () => {
     const testCases = [
       {
-        input: `definition User {
+        input: `definition Employee {
           role: string CACHE eager
         }`,
         description: 'Eager caching'
       },
       {
-        input: `definition User {
+        input: `definition Employee {
           score: number CACHE lazy
         }`,
         description: 'Lazy caching'
       },
       {
-        input: `definition User {
+        input: `definition Employee {
           balance: number BEHAVES { decaying down hourly } CACHE eager
         }`,
         description: 'Behavior with eager caching'
       },
       {
-        input: `definition User {
+        input: `definition Employee {
           reputation: number BEHAVES { blurring adaptive } CACHE lazy
         }`,
         description: 'Behavior with lazy caching'
@@ -186,7 +188,7 @@ describe('Type Definitions', () => {
   test('Complex definitions', () => {
     const testCases = [
       {
-        input: `definition User {
+        input: `definition Employee {
           role: string
           isActive: boolean
           lastActive: timestamp BEHAVES {
@@ -206,10 +208,12 @@ describe('Type Definitions', () => {
         description: 'Complex definition with multiple behaviors and caching'
       },
       {
-        input: `definition Group {
+        input: `definition Employee { role: string }
+        definition Permission { name: string }
+        definition Group {
           name: string
           permissions: Permission[]
-          members: User[]
+          members: Employee[]
           created: timestamp BEHAVES {
             decaying stable monthly
           } CACHE lazy
@@ -218,9 +222,10 @@ describe('Type Definitions', () => {
         description: 'Definition with arrays and mixed behaviors'
       },
       {
-        input: `definition Document {
+        input: `definition Employee { role: string }
+        definition Document {
           level: string
-          owner: User
+          owner: Employee
           tags: string[]
           content: string BEHAVES {
             blurring fixed
@@ -246,27 +251,27 @@ describe('Type Definitions', () => {
   test('Definition error handling', () => {
     const testCases = [
       {
-        input: `definition User { role: string`,
+        input: `definition Employee { role: string`,
         description: 'Missing closing brace should fail'
       },
       {
-        input: `definition User { role: }`,
+        input: `definition Employee { role: }`,
         description: 'Missing field type should fail'
       },
       {
-        input: `definition User { : string }`,
+        input: `definition Employee { : string }`,
         description: 'Missing field name should fail'
       },
       {
-        input: `definition User { role: string BEHAVES { }`,
+        input: `definition Employee { role: string BEHAVES { }`,
         description: 'Incomplete behavior should fail'
       },
       {
-        input: `definition User { role: string CACHE }`,
+        input: `definition Employee { role: string CACHE }`,
         description: 'Incomplete cache directive should fail'
       },
       {
-        input: `definition User { role: string BEHAVES { invalid } }`,
+        input: `definition Employee { role: string BEHAVES { invalid } }`,
         description: 'Invalid behavior should fail'
       }
     ];

tests/EvidenceComposition.test.js

@@ -0,0 +1,216 @@
+/**
+ * tests/EvidenceComposition.test.js — referencing a derived evidence as a
+ * sub-rule of another evidence (WHEN can_read(user, doc) where can_read is
+ * itself an evidence).
+ *
+ * Composition is resolved at COMPILE time: the generator inlines each
+ * evidence reference with the referenced evidence's own config (a linker
+ * pass that handles forward references and rejects cycles), so the engine
+ * evaluates a fully-resolved, acyclic config tree.
+ */
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { Arbiter } from '@arbiter/core';
+import { DSLCompiler } from '../src/DSLCompiler.js';
+import { DSLRuntime } from '../src/runtime/DSLRuntime.js';
+import { DSLValueGraph } from '../src/value-graph/DSLValueGraph.js';
+
+const DEFS = `
+  definition Employee { id: string }
+  definition Group { id: string }
+  definition Doc { id: string }
+  fact owns(user: Employee, doc: Doc)
+  fact *trusted(user: Employee)
+  fact member_of(user: Employee, group: Group)
+  fact can_access(group: Group, doc: Doc)
+`;
+
+function compile(dsl, name = 'compose') {
+  const arb = new Arbiter();
+  const compiler = new DSLCompiler(arb);
+  const result = compiler.compile(dsl, name);
+  return { arb, result };
+}
+
+describe('Evidence composition', () => {
+  it('composes a direct evidence into another evidence', () => {
+    const { arb, result } = compile(`
+      ${DEFS}
+      evidence can_read(user: Employee, doc: Doc) { owns(user, doc) }
+      evidence can_browse(user: Employee, doc: Doc) { can_read(user, doc) }
+    `);
+    assert.ok(result.success, JSON.stringify(result.errors));
+    arb.addNode('u:1', 'Employee'); arb.addNode('doc:9', 'Doc');
+    arb.addRelation('u:1', 'owns', 'doc:9', { possibility: 0.8 });
+    const res = arb.check('u:1', 'can_browse', 'doc:9');
+    assert.equal(res.possibility, 0.8);
+    // The reference is inlined to the underlying fact config.
+    assert.equal(arb.relationConfigs.get('can_browse').type, 'direct');
+    assert.equal(arb.relationConfigs.get('can_browse').relation, 'owns');
+  });
+
+  it('composes an evidence inside a defeasible WHEN/UNLESS', () => {
+    const { arb, result } = compile(`
+      ${DEFS}
+      evidence can_read(user: Employee, doc: Doc) { owns(user, doc) }
+      evidence can_open(user: Employee, doc: Doc) { WHEN can_read(user, doc) UNLESS trusted(user) }
+    `);
+    assert.ok(result.success, JSON.stringify(result.errors));
+    arb.addNode('u:1', 'Employee'); arb.addNode('doc:9', 'Doc');
+    arb.addRelation('u:1', 'owns', 'doc:9', { possibility: 0.9 });
+    assert.equal(arb.check('u:1', 'can_open', 'doc:9').possibility, 0.9);
+    arb.addRelation('u:1', 'trusted', 'u:1', { possibility: 1.0 });
+    const denied = arb.check('u:1', 'can_open', 'doc:9');
+    assert.equal(denied.possibility, 0);
+    assert.equal(denied.reason, 'defeated_by_unless');
+  });
+
+  it('composes a chain evidence into another evidence', () => {
+    const { arb, result } = compile(`
+      ${DEFS}
+      evidence can_enter(user: Employee, doc: Doc) { member_of(user, *g) { can_access(g, doc) } }
+      evidence can_work(user: Employee, doc: Doc) { can_enter(user, doc) }
+    `);
+    assert.ok(result.success, JSON.stringify(result.errors));
+    arb.addNode('u:1', 'Employee'); arb.addNode('g:1', 'Group'); arb.addNode('doc:9', 'Doc');
+    arb.addRelation('u:1', 'member_of', 'g:1', { possibility: 1.0 });
+    arb.addRelation('g:1', 'can_access', 'doc:9', { possibility: 0.7 });
+    const res = arb.check('u:1', 'can_work', 'doc:9');
+    assert.equal(res.possibility, 0.7);
+    assert.equal(arb.relationConfigs.get('can_work').type, 'chain');
+  });
+
+  it('composes transitively (A → B → fact) and re-derives dependencies', () => {
+    const { arb, result } = compile(`
+      ${DEFS}
+      evidence can_read(user: Employee, doc: Doc) { owns(user, doc) }
+      evidence can_browse(user: Employee, doc: Doc) { can_read(user, doc) }
+      evidence can_open(user: Employee, doc: Doc) { can_browse(user, doc) }
+    `);
+    assert.ok(result.success, JSON.stringify(result.errors));
+    arb.addNode('u:1', 'Employee'); arb.addNode('doc:9', 'Doc');
+    arb.addRelation('u:1', 'owns', 'doc:9', { possibility: 0.6 });
+    assert.equal(arb.check('u:1', 'can_open', 'doc:9').possibility, 0.6);
+    assert.deepEqual(arb.relationConfigs.get('can_open').dependsOn, ['owns']);
+  });
+
+  it('composes a value-carrying evidence and preserves subject-as-object scope', () => {
+    const { arb, result } = compile(`
+      ${DEFS}
+      fact *user_risk(user: Employee, value: number)
+      evidence risk_ok(user: Employee, doc: Doc) { user_risk(user, 1) }
+      evidence can_proceed(user: Employee, doc: Doc) { risk_ok(user, doc) }
+    `);
+    assert.ok(result.success, JSON.stringify(result.errors));
+    arb.addNode('u:1', 'Employee'); arb.addNode('doc:9', 'Doc');
+    arb.addRelation('u:1', 'user_risk', 'u:1', { possibility: 1.0, value: 1 });
+    const res = arb.check('u:1', 'can_proceed', 'doc:9');
+    assert.equal(res.possibility, 1);
+  });
+
+  it('composes evidence inside a comparator operand', () => {
+    const { arb, result } = compile(`
+      ${DEFS}
+      fact *user_risk(user: Employee, value: number)
+      fact *risk_limit(doc: Doc, value: number)
+      evidence user_risk_ok(user: Employee, doc: Doc) { user_risk(user, 1) }
+      evidence can_proceed(user: Employee, doc: Doc) { user_risk_ok(user, doc) }
+    `);
+    assert.ok(result.success, JSON.stringify(result.errors));
+    arb.addNode('u:1', 'Employee'); arb.addNode('doc:9', 'Doc');
+    arb.addRelation('u:1', 'user_risk', 'u:1', { possibility: 1.0, value: 1 });
+    assert.equal(arb.check('u:1', 'can_proceed', 'doc:9').possibility, 1);
+  });
+
+  it('rejects cyclic evidence references at compile time', () => {
+    const { result } = compile(`
+      ${DEFS}
+      evidence a(user: Employee, doc: Doc) { b(user, doc) }
+      evidence b(user: Employee, doc: Doc) { a(user, doc) }
+    `);
+    assert.equal(result.success, false);
+    assert.ok(result.errors.some(e => /[Cc]yclic/.test(e)), JSON.stringify(result.errors));
+  });
+
+  it('rejects self-referencing evidence at compile time', () => {
+    const { result } = compile(`
+      ${DEFS}
+      evidence a(user: Employee, doc: Doc) { a(user, doc) }
+    `);
+    assert.equal(result.success, false);
+    assert.ok(result.errors.some(e => /[Cc]yclic/.test(e)), JSON.stringify(result.errors));
+  });
+
+  it('keeps the referenced evidence checkable in its own right', () => {
+    const { arb, result } = compile(`
+      ${DEFS}
+      evidence can_read(user: Employee, doc: Doc) { owns(user, doc) }
+      evidence can_browse(user: Employee, doc: Doc) { can_read(user, doc) }
+    `);
+    assert.ok(result.success);
+    arb.addNode('u:1', 'Employee'); arb.addNode('doc:9', 'Doc');
+    arb.addRelation('u:1', 'owns', 'doc:9', { possibility: 0.5 });
+    assert.equal(arb.check('u:1', 'can_read', 'doc:9').possibility, 0.5);
+    assert.equal(arb.check('u:1', 'can_browse', 'doc:9').possibility, 0.5);
+  });
+
+  describe('measure + evidence composition', () => {
+    const M_DEFS = `
+      definition Employee { id: string }
+      measure budget_used(user: Employee) { } PROVIDES number
+      measure budget_limit(user: Employee) { } PROVIDES number
+      evidence can_use(user: Employee, doc: string) { budget_used(user) <= budget_limit(user) }
+    `;
+
+    it('compiles an evidence comparator over measure valueRelations', () => {
+      const { arb, result } = compile(M_DEFS, 'm+e-compile');
+      assert.ok(result.success, JSON.stringify(result.errors));
+      const cfg = arb.relationConfigs.get('can_use');
+      assert.equal(cfg.type, 'relational_comparator');
+      assert.equal(cfg.left.valueRelation, 'budget_used');
+      assert.equal(cfg.right.valueRelation, 'budget_limit');
+      assert.deepEqual(cfg.dependsOn, ['budget_used', 'budget_limit']);
+      assert.equal(cfg._needsValues, true);
+    });
+
+    it('evaluates with measure values from registered providers (measure → evidence)', async () => {
+      const rt = new DSLRuntime(new Arbiter()).compile(M_DEFS, 'm+e-provider');
+      const dvg = new DSLValueGraph(rt);
+      dvg.attach(); // wires runtime.measure through the value-graph
+      rt.registerMeasure('budget_used', async () => ({ value: 900 }));
+      rt.registerMeasure('budget_limit', async () => ({ value: 1000 }));
+      rt.arbiter.addNode('u:1', 'Employee');
+
+      // Both systems live: the measure resolves standalone...
+      assert.equal((await rt.measure('budget_used', { user: 'u:1' })).value, 900);
+      // ...and composes into the evidence comparator.
+      const allow = await rt.check('u:1', 'can_use', 'doc:9');
+      assert.equal(allow.possibility, 1);
+      assert.equal(allow.reason, 'allow_rule_matched');
+      assert.ok(allow.providedFacts.includes('budget_used'), 'measure injected as a partial-graph edge');
+    });
+
+    it('evaluates with measure values stored in the value-graph (setValue)', async () => {
+      const rt = new DSLRuntime(new Arbiter()).compile(M_DEFS, 'm+e-vg');
+      const dvg = new DSLValueGraph(rt);
+      dvg.attach();
+      dvg.setValue('budget_used', { __subject: 'u:1', user: 'u:1' }, 900);
+      dvg.setValue('budget_limit', { __subject: 'u:1', user: 'u:1' }, 1000);
+      rt.arbiter.addNode('u:1', 'Employee');
+
+      const allow = await rt.check('u:1', 'can_use', 'doc:9');
+      assert.equal(allow.possibility, 1, 'in-budget evidence allowed from graph-sourced measures');
+
+      // Over budget → the comparator denies.
+      const rt2 = new DSLRuntime(new Arbiter()).compile(M_DEFS, 'm+e-vg2');
+      const dvg2 = new DSLValueGraph(rt2);
+      dvg2.attach();
+      dvg2.setValue('budget_used', { __subject: 'u:1', user: 'u:1' }, 1200);
+      dvg2.setValue('budget_limit', { __subject: 'u:1', user: 'u:1' }, 1000);
+      rt2.arbiter.addNode('u:1', 'Employee');
+      const deny = await rt2.check('u:1', 'can_use', 'doc:9');
+      assert.equal(deny.possibility, 0);
+      assert.equal(deny.reason, 'values_compared_comparison_false');
+    });
+  });
+});

tests/EvidenceTests.js

@@ -12,6 +12,49 @@ function createMockArbiter() {
   };
 }
 
+const DSL_SUPPORT = `
+  definition Employee {
+    role: string
+    isActive: boolean
+    isTrusted: boolean
+    hasRecentActivity: boolean
+    lastActive: timestamp
+    isBlacklisted: boolean
+    session: string
+  }
+
+  definition Document {
+    level: string
+    isPublic: boolean
+    isEditable: boolean
+  }
+
+  definition Resource {
+    level: string
+    isPublic: boolean
+  }
+
+  fact hasRole(user: any, role: string)
+  fact hasClearance(user: any, level: string)
+  fact owns(user: any, doc: any)
+  fact isSuspended(user: any)
+  fact isActive(user: any)
+  fact isTrusted(user: any)
+  fact hasRecentActivity(user: any)
+  fact isBlacklisted(user: any)
+  fact isMember(user: any, group: any)
+  fact isFriend(user: any, friend: any)
+  fact similar(a: any, b: any)
+  fact reachable(user: any, doc: any)
+  fact parentOf(user: any, parent: any)
+  fact isEditable(doc: any)
+  fact isPublic(doc: any)
+  fact recentlyActive(user: any)
+  fact reputationScore(user: any)
+  fact activityScore(user: any)
+  fact verificationLevel(user: any)
+`;
+
 describe('Evidence Rules', () => {
   const arbiter = createMockArbiter();
   const compiler = new DSLCompiler(arbiter);
@@ -19,35 +62,35 @@ describe('Evidence Rules', () => {
   test('Basic evidence', () => {
     const testCases = [
       {
-        input: `evidence canRead(user: User, doc: Document) {
+        input: `evidence canRead(user: Employee, doc: Document) {
           hasRole(user, 'admin')
         }`,
         description: 'Simple evidence with function call'
       },
       {
-        input: `evidence canAccess(user: User, resource: Resource) {
-          user.isActive
+        input: `evidence canAccess(user: Employee, resource: Resource) {
+          isActive(user)
         }`,
         description: 'Evidence with attribute access'
       },
       {
-        input: `evidence canModify(user: User, doc: Document) {
-          user.isActive
+        input: `evidence canModify(user: Employee, doc: Document) {
+          isActive(user)
           hasRole(user, 'admin')
         }`,
         description: 'Evidence with multiple conditions'
       },
       {
-        input: `evidence canDelete(user: User, doc: Document) {
+        input: `evidence canDelete(user: Employee, doc: Document) {
           owns(user, doc)
-          user.isActive
+          isActive(user)
         }`,
         description: 'Evidence with ownership and status'
       }
     ];
 
     testCases.forEach(({ input, description }) => {
-      const result = compiler.compile(input, `test-basic-evidence-${Date.now()}`);
+      const result = compiler.compile(DSL_SUPPORT + input, `test-basic-evidence-${Date.now()}`);
       assert.ok(result.success, `${description} should parse successfully`);
       assert.ok(result.program.evidence.length > 0, 'Should have evidence');
     });
@@ -56,32 +99,32 @@ describe('Evidence Rules', () => {
   test('Defeasible logic', () => {
     const testCases = [
       {
-        input: `evidence canAccess(user: User, resource: Resource) {
-          ALWAYS user.isActive
+        input: `evidence canAccess(user: Employee, resource: Resource) {
+          ALWAYS isActive(user)
         }`,
         description: 'ALWAYS rule - strict requirement'
       },
       {
-        input: `evidence canAccess(user: User, resource: Resource) {
+        input: `evidence canAccess(user: Employee, resource: Resource) {
           WHEN hasRole(user, 'admin')
         }`,
         description: 'WHEN rule - defeasible condition'
       },
       {
-        input: `evidence canAccess(user: User, resource: Resource) {
+        input: `evidence canAccess(user: Employee, resource: Resource) {
           WHEN hasRole(user, 'admin') UNLESS isSuspended(user)
         }`,
         description: 'WHEN/UNLESS rule - defeasible with defeater'
       },
       {
-        input: `evidence canAccess(user: User, resource: Resource) {
+        input: `evidence canAccess(user: Employee, resource: Resource) {
           REQUIRES hasClearance(user, resource.level)
         }`,
         description: 'REQUIRES rule - inverse defeater'
       },
       {
-        input: `evidence canAccessCritical(user: User, resource: Resource) {
-          ALWAYS user.isActive
+        input: `evidence canAccessCritical(user: Employee, resource: Resource) {
+          ALWAYS isActive(user)
 
           WHEN hasRole(user, 'admin') UNLESS isSuspended(user)
 
@@ -90,16 +133,16 @@ describe('Evidence Rules', () => {
         description: 'Complex defeasible logic with all rule types'
       },
       {
-        input: `evidence canAccessSensitive(user: User, doc: Document) {
-          ALWAYS user.isActive
+        input: `evidence canAccessSensitive(user: Employee, doc: Document) {
+          ALWAYS isActive(user)
 
           WHEN hasRole(user, 'admin') UNLESS isSuspended(user)
 
           REQUIRES hasClearance(user, doc.level)
 
           fusion majority {
-            user.isTrusted
-            user.hasRecentActivity
+            isTrusted(user),
+            hasRecentActivity(user)
           }
         }`,
         description: 'Defeasible logic with fusion'
@@ -107,7 +150,7 @@ describe('Evidence Rules', () => {
     ];
 
     testCases.forEach(({ input, description }) => {
-      const result = compiler.compile(input, `test-defeasible-${Date.now()}`);
+      const result = compiler.compile(DSL_SUPPORT + input, `test-defeasible-${Date.now()}`);
       assert.ok(result.success, `${description} should parse successfully`);
     });
   });
@@ -115,52 +158,52 @@ describe('Evidence Rules', () => {
   test('Pattern matching', () => {
     const testCases = [
       {
-        input: `evidence canRead(user: User, doc: Document) {
+        input: `evidence canRead(user: Employee, doc: Document) {
           isMember(user, *group) {
-            canRead(group, doc)
+            reachable(group, doc)
           }
         }`,
         description: 'Basic pattern matching with wildcard'
       },
       {
-        input: `evidence canRead(user: User, doc: Document) {
+        input: `evidence canRead(user: Employee, doc: Document) {
           isMember(user, *group) {
-            canRead(group, doc)
+            reachable(group, doc)
           } limit 5
         }`,
         description: 'Pattern matching with limit'
       },
       {
-        input: `evidence canRead(user: User, doc: Document) {
+        input: `evidence canRead(user: Employee, doc: Document) {
           similar(doc, *similar) |similarity| {
-            canRead(user, similar)
+            reachable(user, similar)
           } with similarity > 0.7
         }`,
         description: 'Pattern matching with binding and condition'
       },
       {
-        input: `evidence canRead(user: User, doc: Document) {
+        input: `evidence canRead(user: Employee, doc: Document) {
           similar(doc, *similar) |similarity| {
-            canRead(user, similar)
-          } with similarity > 0.7 limit 5
+            reachable(user, similar)
+          } limit 5 with similarity > 0.7
         }`,
         description: 'Pattern matching with binding, condition, and limit'
       },
       {
-        input: `evidence canRead(user: User, doc: Document) {
+        input: `evidence canRead(user: Employee, doc: Document) {
           isMember(user, *group) {
             isMember(group, *parentGroup) {
-              canRead(parentGroup, doc)
+              reachable(parentGroup, doc)
             } limit 2
           } limit 3
         }`,
         description: 'Nested pattern matching'
       },
       {
-        input: `evidence canRead(user: User, doc: Document) {
+        input: `evidence canRead(user: Employee, doc: Document) {
           isFriend(user, *friend) {
             isMember(friend, *group) {
-              canRead(group, doc)
+              reachable(group, doc)
             } limit 1
           } limit 5
         }`,
@@ -169,7 +212,7 @@ describe('Evidence Rules', () => {
     ];
 
     testCases.forEach(({ input, description }) => {
-      const result = compiler.compile(input, `test-pattern-${Date.now()}`);
+      const result = compiler.compile(DSL_SUPPORT + input, `test-pattern-${Date.now()}`);
       assert.ok(result.success, `${description} should parse successfully`);
     });
   });
@@ -177,58 +220,59 @@ describe('Evidence Rules', () => {
   test('Fusion', () => {
     const testCases = [
       {
-        input: `evidence canAccess(user: User, resource: Resource) {
+        input: `evidence canAccess(user: Employee, resource: Resource) {
           fusion min {
-            hasClearance(user, resource.level)
-            user.isActive
+            hasClearance(user, resource.level),
+            isActive(user)
           }
         }`,
         description: 'Min fusion - all conditions must be true'
       },
       {
-        input: `evidence canAccess(user: User, resource: Resource) {
+        input: `evidence canAccess(user: Employee, resource: Resource) {
           fusion max {
-            hasRole(user, 'admin')
+            hasRole(user, 'admin'),
             hasRole(user, 'superuser')
           }
         }`,
         description: 'Max fusion - any condition can be true'
       },
       {
-        input: `evidence canAccess(user: User, resource: Resource) {
+        input: `evidence canAccess(user: Employee, resource: Resource) {
           fusion majority {
-            hasClearance(user, 'secret')
-            user.isTrusted
-            user.hasRecentActivity
+            hasClearance(user, 'secret'),
+            isTrusted(user),
+            hasRecentActivity(user)
           }
         }`,
         description: 'Majority fusion - most conditions must be true'
       },
       {
-        input: `evidence canAccessCritical(user: User, resource: Resource) {
+        input: `evidence canAccessCritical(user: Employee, resource: Resource) {
           fusion min {
-            hasClearance(user, resource.level)
-            user.isActive
-            NOT user.isBlacklisted
+            hasClearance(user, resource.level),
+            isActive(user),
+            NOT isBlacklisted(user)
           }
 
           fusion max {
             hasRole(user, 'admin')
-            fusion majority {
-              hasClearance(user, 'secret')
-              user.isTrusted
-              user.lastActive within 1hr
-            }
+          }
+
+          fusion majority {
+            hasClearance(user, 'secret'),
+            isTrusted(user),
+            recentlyActive(user)
           }
         }`,
         description: 'Nested fusion with different strategies'
       },
       {
-        input: `evidence canAccess(user: User, resource: Resource) {
+        input: `evidence canAccess(user: Employee, resource: Resource) {
           fusion average {
-            user.reputation
-            user.activityScore
-            user.verificationLevel
+            reputationScore(user),
+            activityScore(user),
+            verificationLevel(user)
           }
         }`,
         description: 'Average fusion for numeric values'
@@ -236,7 +280,7 @@ describe('Evidence Rules', () => {
     ];
 
     testCases.forEach(({ input, description }) => {
-      const result = compiler.compile(input, `test-fusion-${Date.now()}`);
+      const result = compiler.compile(DSL_SUPPORT + input, `test-fusion-${Date.now()}`);
       assert.ok(result.success, `${description} should parse successfully`);
     });
   });
@@ -244,67 +288,68 @@ describe('Evidence Rules', () => {
   test('Complex evidence', () => {
     const testCases = [
       {
-        input: `evidence canRead(user: User, doc: Document) {
+        input: `evidence canRead(user: Employee, doc: Document) {
           owns(user, doc)
 
           isMember(user, *group) {
-            canRead(group, doc)
+            reachable(group, doc)
           } limit 5
 
           parentOf(user, *parent) {
-            canRead(parent, doc)
+            reachable(parent, doc)
           } limit 3
 
           similar(doc, *similar) |similarity| {
-            canRead(user, similar)
-          } with similarity > 0.7 limit 5
+            reachable(user, similar)
+          } limit 5 with similarity > 0.7
 
           WHEN hasRole(user, 'admin') UNLESS isSuspended(user)
         }`,
         description: 'Complex evidence with all features'
       },
       {
-        input: `evidence canAccessCritical(user: User, resource: Resource) {
-          ALWAYS user.isActive
+        input: `evidence canAccessCritical(user: Employee, resource: Resource) {
+          ALWAYS isActive(user)
 
           WHEN hasRole(user, 'admin') UNLESS isSuspended(user)
 
           REQUIRES hasClearance(user, resource.level)
 
           fusion min {
-            hasClearance(user, resource.level)
-            user.isActive
-            NOT user.isBlacklisted
+            hasClearance(user, resource.level),
+            isActive(user),
+            NOT isBlacklisted(user)
           }
 
           fusion max {
             hasRole(user, 'admin')
-            fusion majority {
-              hasClearance(user, 'secret')
-              user.isTrusted
-              user.lastActive within 1hr
-            }
+          }
+
+          fusion majority {
+            hasClearance(user, 'secret'),
+            isTrusted(user),
+            recentlyActive(user)
           }
         }`,
         description: 'Critical access with all rule types and fusion'
       },
       {
-        input: `evidence canModify(user: User, doc: Document) {
+        input: `evidence canModify(user: Employee, doc: Document) {
           owns(user, doc)
 
           isMember(user, *group) {
-            canModify(group, doc)
+            reachable(group, doc)
           } limit 3
 
           similar(doc, *similar) |similarity| {
-            canModify(user, similar)
-            similar.isEditable
-          } with similarity > 0.8 limit 2
+            reachable(user, similar)
+            isEditable(similar)
+          } limit 2 with similarity > 0.8
 
           fusion majority {
-            user.isTrusted
-            user.hasRecentActivity
-            doc.isPublic
+            isTrusted(user),
+            hasRecentActivity(user),
+            isPublic(doc)
           }
         }`,
         description: 'Modification access with similarity and fusion'
@@ -312,7 +357,7 @@ describe('Evidence Rules', () => {
     ];
 
     testCases.forEach(({ input, description }) => {
-      const result = compiler.compile(input, `test-complex-evidence-${Date.now()}`);
+      const result = compiler.compile(DSL_SUPPORT + input, `test-complex-evidence-${Date.now()}`);
       assert.ok(result.success, `${description} should parse successfully`);
     });
   });
@@ -320,42 +365,42 @@ describe('Evidence Rules', () => {
   test('Evidence error handling', () => {
     const testCases = [
       {
-        input: `evidence canRead(user: User, doc: Document) {
+        input: `evidence canRead(user: Employee, doc: Document) {
           hasRole(user, 'admin'
         }`,
         description: 'Missing closing parenthesis should fail'
       },
       {
-        input: `evidence canRead(user: User, doc: Document) {
+        input: `evidence canRead(user: Employee, doc: Document) {
           WHEN hasRole(user, 'admin') UNLESS
         }`,
         description: 'Incomplete UNLESS condition should fail'
       },
       {
-        input: `evidence canRead(user: User, doc: Document) {
+        input: `evidence canRead(user: Employee, doc: Document) {
           fusion min {
             hasRole(user, 'admin')
         }`,
         description: 'Incomplete fusion should fail'
       },
       {
-        input: `evidence canRead(user: User, doc: Document) {
+        input: `evidence canRead(user: Employee, doc: Document) {
           isMember(user, *group) {
-            canRead(group, doc)
+            reachable(group, doc)
           } with
         }`,
         description: 'Incomplete with clause should fail'
       },
       {
-        input: `evidence canRead(user: User, doc: Document) {
+        input: `evidence canRead(user: Employee, doc: Document) {
           isMember(user, *group) {
-            canRead(group, doc)
+            reachable(group, doc)
           } limit
         }`,
         description: 'Incomplete limit should fail'
       },
       {
-        input: `evidence canRead(user: User, doc: Document) {
+        input: `evidence canRead(user: Employee, doc: Document) {
           invalid syntax here
         }`,
         description: 'Invalid syntax should fail'
@@ -364,7 +409,7 @@ describe('Evidence Rules', () => {
 
     testCases.forEach(({ input, description }) => {
       try {
-        const result = compiler.compile(input, `test-evidence-error-${Date.now()}`);
+        const result = compiler.compile(DSL_SUPPORT + input, `test-evidence-error-${Date.now()}`);
         assert.ok(!result.success, `${description} should fail to parse`);
       } catch {
         // Expected to fail

tests/ExpressionTests.js

@@ -12,6 +12,57 @@ function createMockArbiter() {
   };
 }
 
+// The compiler validates evidence bodies as generated rules, which only accept
+// predicate-call forms. Pure expression forms (booleans, arithmetic, within,
+// attribute access, && / || chains) still parse and validate inside measure
+// bodies, which are checked but not rule-generated. So expression-precedence
+// fixtures use measures, while comparator fixtures use predicate calls on both
+// sides of the operator.
+const SCORE_FACT = `
+  fact score(value: number)
+`;
+
+const EMPLOYEE_FIELDS = `
+  definition Employee {
+    role: string
+    isActive: boolean
+    isSuspended: boolean
+    isBlacklisted: boolean
+    isTrusted: boolean
+    lastActive: timestamp
+    lastLogin: timestamp
+    createdAt: timestamp
+    lastActivity: timestamp
+    hasEmergencyAccess: boolean
+    balance: number
+    score: number
+    profile: Profile
+    permissions: Permission[]
+  }
+
+  definition Profile {
+    name: string
+    permissions: Permission[]
+  }
+
+  definition Permission {
+    name: string
+  }
+
+  definition Resource {
+    name: string
+  }
+
+  definition Document {
+    name: string
+  }
+
+  fact hasRole(user: any, role: string)
+  fact isMember(user: any, group: any)
+  fact hasPermission(user: any, resource: any, action: string)
+  fact isActive(user: any)
+`;
+
 describe('Expression Parsing', () => {
   const arbiter = createMockArbiter();
   const compiler = new DSLCompiler(arbiter);
@@ -19,34 +70,34 @@ describe('Expression Parsing', () => {
   test('Arithmetic operator precedence', () => {
     const testCases = [
       {
-        input: '1 + 2 * 3',
+        input: 'score(1 + 2 * 3) > score(0)',
         expected: 'Should evaluate as 1 + (2 * 3) = 7',
         description: 'Multiplication before addition'
       },
       {
-        input: '10 - 3 * 2',
+        input: 'score(10 - 3 * 2) > score(0)',
         expected: 'Should evaluate as 10 - (3 * 2) = 4',
         description: 'Multiplication before subtraction'
       },
       {
-        input: '8 / 2 * 4',
+        input: 'score(8 / 2 * 4) > score(0)',
         expected: 'Should evaluate as (8 / 2) * 4 = 16',
         description: 'Left-associative division and multiplication'
       },
       {
-        input: '2 + 3 * 4 - 5',
+        input: 'score(2 + 3 * 4 - 5) > score(0)',
         expected: 'Should evaluate as 2 + (3 * 4) - 5 = 9',
         description: 'Mixed arithmetic with correct precedence'
       },
       {
-        input: '(1 + 2) * 3',
+        input: 'score((1 + 2) * 3) > score(0)',
         expected: 'Should evaluate as (1 + 2) * 3 = 9',
         description: 'Parentheses override precedence'
       }
     ];
 
     testCases.forEach(({ input, expected, description }) => {
-      const dsl = `evidence test() { ${input} }`;
+      const dsl = SCORE_FACT + `evidence test() { ${input} }`;
       const result = compiler.compile(dsl, `test-arithmetic-${Date.now()}`);
       assert.ok(result.success, `${description} should parse successfully`);
     });
@@ -82,7 +133,7 @@ describe('Expression Parsing', () => {
     ];
 
     testCases.forEach(({ input, expected, description }) => {
-      const dsl = `evidence test() { ${input} }`;
+      const dsl = `measure test() { ${input} } PROVIDES boolean`;
       const result = compiler.compile(dsl, `test-logical-${Date.now()}`);
       assert.ok(result.success, `${description} should parse successfully`);
     });
@@ -90,18 +141,19 @@ describe('Expression Parsing', () => {
 
   test('Comparison operators', () => {
     const testCases = [
-      { input: '1 == 1', description: 'Equality comparison' },
-      { input: '1 != 2', description: 'Inequality comparison' },
-      { input: '5 > 3', description: 'Greater than' },
-      { input: '3 < 5', description: 'Less than' },
-      { input: '4 >= 4', description: 'Greater than or equal' },
-      { input: '4 <= 4', description: 'Less than or equal' },
-      { input: '1 == 1 && 2 > 1', description: 'Comparison with logical operators' },
-      { input: '1 + 2 == 3', description: 'Arithmetic in comparison' }
+      { input: 'score(1) == score(1)', description: 'Equality comparison', measure: false },
+      { input: 'score(1) != score(2)', description: 'Inequality comparison', measure: false },
+      { input: 'score(5) > score(3)', description: 'Greater than', measure: false },
+      { input: 'score(3) < score(5)', description: 'Less than', measure: false },
+      { input: 'score(4) >= score(4)', description: 'Greater than or equal', measure: false },
+      { input: 'score(4) <= score(4)', description: 'Less than or equal', measure: false },
+      { input: 'score(1) == score(1) && score(2) > score(1)', description: 'Comparison with logical operators', measure: true },
+      { input: 'score(1 + 2) == score(3)', description: 'Arithmetic in comparison', measure: false }
     ];
 
-    testCases.forEach(({ input, description }) => {
-      const dsl = `evidence test() { ${input} }`;
+    testCases.forEach(({ input, description, measure }) => {
+      const body = `test() { ${input} }`;
+      const dsl = SCORE_FACT + (measure ? `measure ${body} PROVIDES boolean` : `evidence ${body}`);
       const result = compiler.compile(dsl, `test-comparison-${Date.now()}`);
       assert.ok(result.success, `${description} should parse successfully`);
     });
@@ -116,7 +168,7 @@ describe('Expression Parsing', () => {
     ];
 
     testCases.forEach(({ input, description }) => {
-      const dsl = `evidence test() { ${input} }`;
+      const dsl = EMPLOYEE_FIELDS + `measure test(user: Employee) { ${input} } PROVIDES boolean`;
       const result = compiler.compile(dsl, `test-temporal-${Date.now()}`);
       assert.ok(result.success, `${description} should parse successfully`);
     });
@@ -124,14 +176,14 @@ describe('Expression Parsing', () => {
 
   test('Unary operators', () => {
     const testCases = [
-      { input: 'NOT true', description: 'NOT operator' },
-      { input: '!false', description: 'Alternative NOT operator' },
-      { input: 'NOT (true && false)', description: 'NOT with parenthesized expression' },
-      { input: 'NOT user.isSuspended', description: 'NOT with attribute access' }
+      { input: 'NOT true', description: 'NOT operator', params: '' },
+      { input: '! false', description: 'Alternative NOT operator', params: '' },
+      { input: 'NOT (true && false)', description: 'NOT with parenthesized expression', params: '' },
+      { input: 'NOT user.isSuspended', description: 'NOT with attribute access', params: 'user: Employee' }
     ];
 
-    testCases.forEach(({ input, description }) => {
-      const dsl = `evidence test() { ${input} }`;
+    testCases.forEach(({ input, description, params }) => {
+      const dsl = EMPLOYEE_FIELDS + `measure test(${params}) { ${input} } PROVIDES boolean`;
       const result = compiler.compile(dsl, `test-unary-${Date.now()}`);
       assert.ok(result.success, `${description} should parse successfully`);
     });
@@ -141,13 +193,13 @@ describe('Expression Parsing', () => {
     const testCases = [
       { input: 'user.role', description: 'Simple attribute access' },
       { input: 'user.profile.name', description: 'Nested attribute access' },
-      { input: 'user.permissions[0]', description: 'Array access' },
-      { input: 'user.role.permissions[0]', description: 'Nested attribute with array access' },
+      { input: 'user.permissions', description: 'Array access' },
+      { input: 'user.profile.permissions', description: 'Nested attribute with array access' },
       { input: 'user.isActive && user.role == "admin"', description: 'Attribute access in logical expression' }
     ];
 
     testCases.forEach(({ input, description }) => {
-      const dsl = `evidence test() { ${input} }`;
+      const dsl = EMPLOYEE_FIELDS + `measure test(user: Employee) { ${input} } PROVIDES boolean`;
       const result = compiler.compile(dsl, `test-attribute-${Date.now()}`);
       assert.ok(result.success, `${description} should parse successfully`);
     });
@@ -155,15 +207,17 @@ describe('Expression Parsing', () => {
 
   test('Function calls', () => {
     const testCases = [
-      { input: 'hasRole(user, "admin")', description: 'Simple function call' },
-      { input: 'isMember(user, group)', description: 'Function call with variables' },
-      { input: 'hasPermission(user, resource, "read")', description: 'Function call with multiple arguments' },
-      { input: 'hasRole(user, "admin") && isActive(user)', description: 'Multiple function calls' },
-      { input: 'hasRole(user, user.role)', description: 'Function call with attribute access' }
+      { input: 'hasRole(user, "admin")', description: 'Simple function call', measure: false },
+      { input: 'isMember(user, group)', description: 'Function call with variables', measure: false },
+      { input: 'hasPermission(user, resource, "read")', description: 'Function call with multiple arguments', measure: false },
+      { input: 'hasRole(user, "admin") && isActive(user)', description: 'Multiple function calls', measure: true },
+      { input: 'hasRole(user, user.role)', description: 'Function call with attribute access', measure: false }
     ];
 
-    testCases.forEach(({ input, description }) => {
-      const dsl = `evidence test() { ${input} }`;
+    testCases.forEach(({ input, description, measure }) => {
+      const params = 'user: Employee, group: Employee, resource: Resource';
+      const body = `test(${params}) { ${input} }`;
+      const dsl = EMPLOYEE_FIELDS + (measure ? `measure ${body} PROVIDES boolean` : `evidence ${body}`);
       const result = compiler.compile(dsl, `test-function-${Date.now()}`);
       assert.ok(result.success, `${description} should parse successfully`);
     });
@@ -194,7 +248,8 @@ describe('Expression Parsing', () => {
     ];
 
     testCases.forEach(({ input, description }) => {
-      const dsl = `evidence test() { ${input} }`;
+      const params = 'user: Employee, resource: Resource, doc: Document';
+      const dsl = EMPLOYEE_FIELDS + `measure test(${params}) { ${input} } PROVIDES boolean`;
       const result = compiler.compile(dsl, `test-complex-${Date.now()}`);
       assert.ok(result.success, `${description} should parse successfully`);
     });

tests/FactTests.js

@@ -12,6 +12,24 @@ function createMockArbiter() {
   };
 }
 
+const DSL_SUPPORT = `
+  definition Group {
+    name: string
+  }
+
+  definition Document {
+    title: string
+  }
+
+  definition Resource {
+    name: string
+  }
+
+  definition Permission {
+    name: string
+  }
+`;
+
 describe('Fact Declarations', () => {
   const arbiter = createMockArbiter();
   const compiler = new DSLCompiler(arbiter);
@@ -41,7 +59,7 @@ describe('Fact Declarations', () => {
     ];
 
     testCases.forEach(({ input, description }) => {
-      const result = compiler.compile(input, `test-basic-fact-${Date.now()}`);
+      const result = compiler.compile(DSL_SUPPORT + input, `test-basic-fact-${Date.now()}`);
       assert.ok(result.success, `${description} should parse successfully`);
       assert.ok(result.program.facts.length > 0, 'Should have facts');
     });
@@ -72,7 +90,7 @@ describe('Fact Declarations', () => {
     ];
 
     testCases.forEach(({ input, description }) => {
-      const result = compiler.compile(input, `test-fact-property-${Date.now()}`);
+      const result = compiler.compile(DSL_SUPPORT + input, `test-fact-property-${Date.now()}`);
       assert.ok(result.success, `${description} should parse successfully`);
     });
   });
@@ -102,7 +120,7 @@ describe('Fact Declarations', () => {
     ];
 
     testCases.forEach(({ input, description }) => {
-      const result = compiler.compile(input, `test-fact-cache-${Date.now()}`);
+      const result = compiler.compile(DSL_SUPPORT + input, `test-fact-cache-${Date.now()}`);
       assert.ok(result.success, `${description} should parse successfully`);
     });
   });
@@ -132,7 +150,7 @@ describe('Fact Declarations', () => {
     ];
 
     testCases.forEach(({ input, description }) => {
-      const result = compiler.compile(input, `test-fact-limit-${Date.now()}`);
+      const result = compiler.compile(DSL_SUPPORT + input, `test-fact-limit-${Date.now()}`);
       assert.ok(result.success, `${description} should parse successfully`);
     });
   });
@@ -149,7 +167,7 @@ describe('Fact Declarations', () => {
     ];
 
     testCases.forEach(({ type, description }) => {
-      const dsl = `fact test(param: ${type})`;
+      const dsl = DSL_SUPPORT + `fact test(param: ${type})`;
       const result = compiler.compile(dsl, `test-param-type-${Date.now()}`);
       assert.ok(result.success, `${description} should parse successfully`);
     });
@@ -182,7 +200,7 @@ describe('Fact Declarations', () => {
     ];
 
     testCases.forEach(({ input, description }) => {
-      const result = compiler.compile(input, `test-complex-facts-${Date.now()}`);
+      const result = compiler.compile(DSL_SUPPORT + input, `test-complex-facts-${Date.now()}`);
       assert.ok(result.success, `${description} should parse successfully`);
       assert.ok(result.program.facts.length > 0, 'Should have facts');
     });
@@ -222,7 +240,7 @@ describe('Fact Declarations', () => {
 
     testCases.forEach(({ input, description }) => {
       try {
-        const result = compiler.compile(input, `test-fact-error-${Date.now()}`);
+        const result = compiler.compile(DSL_SUPPORT + input, `test-fact-error-${Date.now()}`);
         assert.ok(!result.success, `${description} should fail to parse`);
       } catch {
         // Expected to fail

tests/IntegrationTests.js

@@ -19,8 +19,9 @@ describe('Integration Tests', () => {
   test('Complete authorization system', () => {
     const completeSystem = `
       // Type definitions with complex behaviors
-      definition User {
-        role: string
+      definition Employee {
+        role: Role
+        group: Group
         isActive: boolean
         lastActive: timestamp BEHAVES {
           decaying down hourly
@@ -41,21 +42,34 @@ describe('Integration Tests', () => {
         reputation: number BEHAVES {
           decaying up daily
         } CACHE lazy
+        activityScore: number
+        verificationLevel: number
+      }
+
+      definition Role {
+        permissions: Permission[]
+        clearance: string
       }
 
       definition Group {
         name: string
         permissions: Permission[]
         level: string
+        clearance: string
         isPublic: boolean CACHE eager
         created: timestamp BEHAVES {
           decaying stable monthly
         } CACHE lazy
       }
 
+      definition Permission {
+        name: string
+        level: string
+      }
+
       definition Document {
         level: string
-        owner: User
+        owner: Employee
         tags: string[]
         content: string BEHAVES {
           blurring fixed
@@ -71,7 +85,7 @@ describe('Integration Tests', () => {
 
       definition Resource {
         level: string
-        owner: User
+        owner: Employee
         permissions: Permission[]
         isPublic: boolean CACHE eager
         accessCount: number BEHAVES {
@@ -80,122 +94,132 @@ describe('Integration Tests', () => {
       }
 
       // Facts with various properties and caching
-      fact hasRole(user: User, role: string) CACHE eager
-      fact isMember(user: User, group: Group) transitive CACHE lazy limit 10
-      fact isFriend(user: User, friend: User) symmetrical CACHE eager limit 100
-      fact owns(user: User, doc: Document) CACHE eager
-      fact isSuspended(user: User) CACHE lazy
-      fact hasPermission(user: User, resource: Resource, action: string) CACHE eager
-      fact isAdmin(user: User) CACHE eager
-      fact isOwner(user: User, resource: Resource) CACHE eager
-      fact hasAccess(user: User, resource: Resource, level: string) CACHE lazy
-      fact isColleague(user: User, colleague: User) symmetrical CACHE lazy limit 50
-      fact isParentOf(parent: User, child: User) transitive CACHE eager limit 3
+      fact hasRole(user: Employee, role: string) CACHE eager
+      fact isMember(user: any, group: any) transitive CACHE lazy limit 10
+      fact isFriend(user: any, friend: any) symmetrical CACHE eager limit 100
+      fact owns(user: Employee, doc: Document) CACHE eager
+      fact isSuspended(user: Employee) CACHE lazy
+      fact hasPermission(user: Employee, resource: Resource, action: string) CACHE eager
+      fact isAdmin(user: Employee) CACHE eager
+      fact isOwner(user: Employee, resource: Resource) CACHE eager
+      fact hasAccess(user: Employee, resource: Resource, level: string) CACHE lazy
+      fact isColleague(user: any, colleague: any) symmetrical CACHE lazy limit 50
+      fact isParentOf(parent: Employee, child: Employee) transitive CACHE eager limit 3
+      fact reachable(user: any, doc: any) CACHE lazy
+      fact hasClearance(user: Employee, level: string) CACHE eager
+      fact parentOf(user: any, parent: any) CACHE eager
+      fact similar(a: any, b: any) CACHE lazy
+      fact isActive(user: Employee) CACHE eager
+      fact isTrusted(user: Employee) CACHE eager
+      fact isBlacklisted(user: Employee) CACHE lazy
+      fact hasRecentActivity(user: Employee) CACHE lazy
+      fact recentlyActive(user: Employee) CACHE lazy
 
       // Evidence rules with complex logic
-      evidence canRead(user: User, doc: Document) {
+      evidence canRead(user: Employee, doc: Document) {
         owns(user, doc)
 
         isMember(user, *group) {
-          canRead(group, doc)
+          reachable(group, doc)
         } limit 5
 
         parentOf(user, *parent) {
-          canRead(parent, doc)
+          reachable(parent, doc)
         } limit 3
 
         similar(doc, *similar) |similarity| {
-          canRead(user, similar)
-        } with similarity > 0.7 limit 5
+          reachable(user, similar)
+        } limit 5 with similarity > 0.7
 
         WHEN hasRole(user, 'admin') UNLESS isSuspended(user)
       }
 
-      evidence canWrite(user: User, doc: Document) {
+      evidence canWrite(user: Employee, doc: Document) {
         owns(user, doc)
 
         isMember(user, *group) {
-          canWrite(group, doc)
+          reachable(group, doc)
         } limit 3
 
         WHEN hasRole(user, 'admin') UNLESS isSuspended(user)
 
-        REQUIRES user.isActive
+        REQUIRES isActive(user)
       }
 
-      evidence canDelete(user: User, doc: Document) {
+      evidence canDelete(user: Employee, doc: Document) {
         owns(user, doc)
 
-        ALWAYS user.isActive
+        ALWAYS isActive(user)
 
         WHEN hasRole(user, 'admin') UNLESS isSuspended(user)
 
-        REQUIRES user.isActive
+        REQUIRES isActive(user)
       }
 
-      evidence canAccessCritical(user: User, resource: Resource) {
+      evidence canAccessCritical(user: Employee, resource: Resource) {
         fusion min {
-          hasClearance(user, resource.level)
-          user.isActive
-          NOT user.isBlacklisted
+          hasClearance(user, resource.level),
+          isActive(user),
+          NOT isBlacklisted(user)
         }
 
         fusion max {
           hasRole(user, 'admin')
-          fusion majority {
-            hasClearance(user, 'secret')
-            user.isTrusted
-            user.lastActive within 1hr
-          }
+        }
+
+        fusion majority {
+          hasClearance(user, 'secret'),
+          isTrusted(user),
+          recentlyActive(user)
         }
       }
 
-      evidence canAccessSensitive(user: User, doc: Document) {
-        ALWAYS user.isActive
+      evidence canAccessSensitive(user: Employee, doc: Document) {
+        ALWAYS isActive(user)
 
         WHEN hasRole(user, 'admin') UNLESS isSuspended(user)
 
         REQUIRES hasClearance(user, doc.level)
 
         fusion majority {
-          user.isTrusted
-          user.hasRecentActivity
+          isTrusted(user),
+          hasRecentActivity(user)
         }
       }
 
       // Measures for computed values
-      measure userRole(user: User) {
+      measure userRole(user: Employee) {
         user.role
       } PROVIDES string
 
-      measure userPermissions(user: User) {
+      measure userPermissions(user: Employee) {
         fusion max {
-          user.role.permissions
+          user.role.permissions,
           user.group.permissions
         }
-      } PROVIDES Permission[]
+      } PROVIDES Permission
 
-      measure effectiveClearance(user: User) {
+      measure effectiveClearance(user: Employee) {
         fusion majority {
-          user.clearance
-          user.role.clearance
+          user.clearance,
+          user.role.clearance,
           user.group.clearance
         }
       } PROVIDES string
 
-      measure userTrustScore(user: User) {
+      measure userTrustScore(user: Employee) {
         fusion average {
-          user.reputation
-          user.activityScore
+          user.reputation,
+          user.activityScore,
           user.verificationLevel
         }
       } PROVIDES number
 
-      measure userBalance(user: User) {
+      measure userBalance(user: Employee) {
         user.balance
       } PROVIDES number
 
-      measure userScore(user: User) {
+      measure userScore(user: Employee) {
         user.score
       } PROVIDES number
     `;
@@ -211,64 +235,71 @@ describe('Integration Tests', () => {
   test('Multi-domain system', () => {
     const multiDomain = `
       // Authentication domain
-      definition User {
+      definition Employee {
         role: string
         isActive: boolean
         lastActive: timestamp BEHAVES { decaying down hourly } CACHE lazy
         session: string BEHAVES { ttl 24h } CACHE eager
       }
 
-      fact hasRole(user: User, role: string) CACHE eager
-      fact isActive(user: User) CACHE eager
+      fact hasRole(user: Employee, role: string) CACHE eager
+      fact isActive(user: Employee) CACHE eager
+      fact recentlyActive(user: any) CACHE lazy
+      fact isPublic(doc: any) CACHE eager
 
-      evidence canAuthenticate(user: User) {
-        user.isActive
-        user.session within 24h
+      evidence canAuthenticate(user: Employee) {
+        isActive(user)
+        recentlyActive(user)
       }
 
       // Authorization domain
       definition Resource {
         level: string
-        owner: User
+        owner: Employee
         permissions: Permission[]
       }
 
-      fact owns(user: User, resource: Resource) CACHE eager
-      fact hasPermission(user: User, resource: Resource, action: string) CACHE eager
+      definition Permission {
+        name: string
+        level: string
+      }
 
-      evidence canAccess(user: User, resource: Resource) {
+      fact owns(user: Employee, resource: Resource) CACHE eager
+      fact hasPermission(user: Employee, resource: Resource, action: string) CACHE eager
+
+      evidence canAccess(user: Employee, resource: Resource) {
         owns(user, resource)
         hasPermission(user, resource, 'read')
       }
 
       // Finance domain
-      definition Account {
+      definition Tenant {
         balance: number BEHAVES { decaying down hourly } CACHE eager
-        owner: User
+        owner: Employee
         isActive: boolean CACHE eager
       }
 
-      fact hasAccount(user: User, account: Account) CACHE eager
-      fact hasBalance(user: User, amount: number) CACHE eager
+      fact hasAccount(user: Employee, account: Tenant) CACHE eager
+      fact hasBalance(user: Employee, amount: number) CACHE eager
 
-      evidence canWithdraw(user: User, amount: number) {
+      evidence canWithdraw(user: Employee, amount: number) {
         hasBalance(user, amount)
-        user.isActive
+        isActive(user)
       }
 
       // Social domain
       definition Group {
         name: string
-        members: User[]
+        members: Employee[]
         isPublic: boolean CACHE eager
       }
 
-      fact isMember(user: User, group: Group) transitive CACHE lazy limit 10
-      fact isFriend(user: User, friend: User) symmetrical CACHE eager limit 100
+      fact isMember(user: any, group: any) transitive CACHE lazy limit 10
+      fact isFriend(user: any, friend: any) symmetrical CACHE eager limit 100
 
-      evidence canAccessGroup(user: User, group: Group) {
+      evidence canAccessGroup(user: Employee, group: Group) {
         isMember(user, group)
-        group.isPublic
+        isPublic(group)
       }
     `;
 
@@ -281,7 +312,7 @@ describe('Integration Tests', () => {
 
   test('Hierarchical access', () => {
     const hierarchicalSystem = `
-      definition User {
+      definition Employee {
         role: string
         level: string
         isActive: boolean
@@ -294,28 +325,35 @@ describe('Integration Tests', () => {
         parent: Organization
       }
 
-      fact isMember(user: User, org: Organization) transitive CACHE lazy limit 5
-      fact isParentOf(parent: Organization, child: Organization) transitive CACHE eager limit 3
-      fact hasRole(user: User, role: string) CACHE eager
-      fact hasClearance(user: User, level: string) CACHE eager
+      definition Resource {
+        level: string
+      }
 
-      evidence canAccessOrg(user: User, org: Organization) {
+      fact isMember(user: any, org: any) transitive CACHE lazy limit 5
+      fact isParentOf(parent: Organization, child: Organization) transitive CACHE eager limit 3
+      fact reachable(user: any, doc: any) CACHE lazy
+      fact hasRole(user: Employee, role: string) CACHE eager
+      fact hasClearance(user: Employee, level: string) CACHE eager
+      fact isSuspended(user: any) CACHE lazy
+      fact parentOf(user: any, parent: any) CACHE eager
+
+      evidence canAccessOrg(user: Employee, org: Organization) {
         isMember(user, org)
 
         isParentOf(org, *parentOrg) {
-          canAccessOrg(user, parentOrg)
+          reachable(user, parentOrg)
         } limit 3
 
-        WHEN hasRole(user, 'admin') UNLESS user.isSuspended
+        WHEN hasRole(user, 'admin') UNLESS isSuspended(user)
       }
 
-      evidence canAccessResource(user: User, resource: Resource) {
+      evidence canAccessResource(user: Employee, resource: Resource) {
         isMember(user, *org) {
-          canAccessResource(org, resource)
+          reachable(org, resource)
         } limit 5
 
         parentOf(user, *parent) {
-          canAccessResource(parent, resource)
+          reachable(parent, resource)
         } limit 2
       }
     `;
@@ -326,7 +364,7 @@ describe('Integration Tests', () => {
 
   test('Similarity-based access', () => {
     const similaritySystem = `
-      definition User {
+      definition Employee {
         profile: string
         interests: string[]
         isActive: boolean
@@ -336,39 +374,47 @@ describe('Integration Tests', () => {
         content: string
         tags: string[]
         isPublic: boolean
-        owner: User
+        owner: Employee
       }
 
-      fact isFriend(user: User, friend: User) symmetrical CACHE eager limit 100
-      fact hasInterest(user: User, interest: string) CACHE lazy
-      fact hasTag(doc: Document, tag: string) CACHE lazy
+      fact isFriend(user: any, friend: any) symmetrical CACHE eager limit 100
+      fact hasInterest(user: any, interest: string) CACHE lazy
+      fact hasTag(doc: any, tag: string) CACHE lazy
+      fact owns(user: any, doc: any) CACHE eager
+      fact reachable(user: any, doc: any) CACHE lazy
+      fact similar(a: any, b: any) CACHE lazy
+      fact isPublic(doc: any) CACHE eager
+      fact hasInterests(user: any) CACHE lazy
+      fact hasTags(doc: any) CACHE lazy
+      fact hasProfile(user: any) CACHE lazy
+      fact hasContent(doc: any) CACHE lazy
 
-      evidence canRead(user: User, doc: Document) {
+      evidence canRead(user: Employee, doc: Document) {
         owns(user, doc)
 
         similar(doc, *similar) |similarity| {
-          canRead(user, similar)
-          similar.isPublic
-        } with similarity > 0.7 limit 10
+          reachable(user, similar)
+          isPublic(similar)
+        } limit 10 with similarity > 0.7
 
         isFriend(user, *friend) {
-          canRead(friend, doc)
+          reachable(friend, doc)
         } limit 5
 
         fusion majority {
-          user.interests
-          doc.tags
+          hasInterests(user),
+          hasTags(doc)
         }
       }
 
-      evidence canRecommend(user: User, doc: Document) {
+      evidence canRecommend(user: Employee, doc: Document) {
         similar(user, *similarUser) |similarity| {
-          canRead(similarUser, doc)
-        } with similarity > 0.8 limit 20
+          reachable(similarUser, doc)
+        } limit 20 with similarity > 0.8
 
         fusion average {
-          user.profile
-          doc.content
+          hasProfile(user),
+          hasContent(doc)
         }
       }
     `;
@@ -379,7 +425,7 @@ describe('Integration Tests', () => {
 
   test('Temporal access', () => {
     const temporalSystem = `
-      definition User {
+      definition Employee {
         lastActive: timestamp BEHAVES { decaying down hourly } CACHE lazy
         session: string BEHAVES { ttl 24h } CACHE eager
         isActive: boolean
@@ -391,29 +437,34 @@ describe('Integration Tests', () => {
         isPublic: boolean
       }
 
-      fact hasAccess(user: User, event: Event) CACHE lazy
-      fact isParticipant(user: User, event: Event) CACHE eager
+      fact hasAccess(user: Employee, event: Event) CACHE lazy
+      fact isParticipant(user: Employee, event: Event) CACHE eager
+      fact recentlyActive(user: any) CACHE lazy
+      fact sessionFresh(user: any) CACHE lazy
+      fact isPublic(doc: any) CACHE eager
+      fact isSuspended(user: any) CACHE lazy
+      fact isActive(user: any) CACHE eager
 
-      evidence canAccessEvent(user: User, event: Event) {
-        user.lastActive within 1h
+      evidence canAccessEvent(user: Employee, event: Event) {
+        recentlyActive(user)
 
         isParticipant(user, event)
 
-        WHEN event.isPublic UNLESS user.isSuspended
+        WHEN isPublic(event) UNLESS isSuspended(user)
 
         fusion min {
-          user.session within 24h
-          user.isActive
+          sessionFresh(user),
+          isActive(user)
         }
       }
 
-      evidence canAccessHistorical(user: User, event: Event) {
-        user.lastActive within 24h
+      evidence canAccessHistorical(user: Employee, event: Event) {
+        recentlyActive(user)
 
         fusion majority {
-          user.isActive
-          user.session within 24h
-          event.isPublic
+          isActive(user),
+          sessionFresh(user),
+          isPublic(event)
         }
       }
     `;
@@ -424,7 +475,7 @@ describe('Integration Tests', () => {
 
   test('Complex behaviors', () => {
     const behaviorSystem = `
-      definition User {
+      definition Employee {
         balance: number BEHAVES { decaying down hourly } CACHE eager
         score: number BEHAVES { blurring adaptive confidence_95 } CACHE lazy
         session: string BEHAVES { ttl 24h } CACHE eager
@@ -440,30 +491,37 @@ describe('Integration Tests', () => {
         isPublic: boolean CACHE eager
       }
 
-      fact hasBalance(user: User, amount: number) CACHE eager
-      fact hasScore(user: User, score: number) CACHE lazy
-      fact hasReputation(user: User, reputation: number) CACHE lazy
+      fact hasBalance(user: Employee, amount: number) CACHE eager
+      fact hasScore(user: Employee, score: number) CACHE lazy
+      fact hasReputation(user: Employee, reputation: number) CACHE lazy
+      fact hasPositiveBalance(user: any) CACHE eager
+      fact hasHighScore(user: any) CACHE eager
+      fact hasGoodReputation(user: any) CACHE eager
+      fact isNotOverused(doc: any) CACHE eager
+      fact isActive(user: any) CACHE eager
+      fact recentlyActive(user: any) CACHE lazy
+      fact isPublic(doc: any) CACHE eager
 
-      evidence canAccessDocument(user: User, doc: Document) {
-        user.balance > 0
+      evidence canAccessDocument(user: Employee, doc: Document) {
+        hasPositiveBalance(user)
 
-        user.score > 0.5
+        hasHighScore(user)
 
-        user.reputation > 0.3
+        hasGoodReputation(user)
 
-        doc.accessCount < 1000
+        isNotOverused(doc)
 
         fusion majority {
-          user.isActive
-          user.lastActive within 1h
-          doc.isPublic
+          isActive(user),
+          recentlyActive(user),
+          isPublic(doc)
         }
       }
 
-      measure userEffectiveScore(user: User) {
+      measure userEffectiveScore(user: Employee) {
         fusion average {
-          user.score
-          user.reputation
+          user.score,
+          user.reputation,
           user.balance
         }
       } PROVIDES number
@@ -479,7 +537,7 @@ describe('Integration Tests', () => {
 
   test('Performance scenarios', () => {
     const performanceSystem = `
-      definition User {
+      definition Employee {
         role: string
         isActive: boolean
         permissions: Permission[] CACHE eager
@@ -487,41 +545,47 @@ describe('Integration Tests', () => {
 
       definition Resource {
         level: string
-        owner: User
+        owner: Employee
         permissions: Permission[] CACHE eager
       }
 
+      definition Permission {
+        name: string
+        level: string
+      }
+
       // High-frequency facts with limits
-      fact isMember(user: User, group: Group) transitive CACHE lazy limit 5
-      fact isFriend(user: User, friend: User) symmetrical CACHE eager limit 50
-      fact hasPermission(user: User, resource: Resource, action: string) CACHE eager
-      fact owns(user: User, resource: Resource) CACHE eager
+      fact isMember(user: any, group: any) transitive CACHE lazy limit 5
+      fact isFriend(user: any, friend: any) symmetrical CACHE eager limit 50
+      fact hasPermission(user: Employee, resource: Resource, action: string) CACHE eager
+      fact owns(user: Employee, resource: Resource) CACHE eager
+  fact reachable(user: any, doc: any) CACHE lazy
 
       // Optimized evidence rules
-      evidence canAccess(user: User, resource: Resource) {
+      evidence canAccess(user: Employee, resource: Resource) {
         owns(user, resource)
 
         isMember(user, *group) {
-          canAccess(group, resource)
+          reachable(group, resource)
         } limit 3
 
         WHEN hasPermission(user, resource, 'read')
       }
 
-      evidence canModify(user: User, resource: Resource) {
+      evidence canModify(user: Employee, resource: Resource) {
         owns(user, resource)
 
         isMember(user, *group) {
-          canModify(group, resource)
+          reachable(group, resource)
         } limit 2
 
         WHEN hasPermission(user, resource, 'write')
       }
 
       // Efficient measures
-      measure userEffectivePermissions(user: User) {
+      measure userEffectivePermissions(user: Employee) {
         user.permissions
-      } PROVIDES Permission[]
+      } PROVIDES Permission
 
       measure resourceAccessLevel(resource: Resource) {
         resource.level

tests/MeasureTests.js

@@ -12,6 +12,43 @@ function createMockArbiter() {
   };
 }
 
+const DSL_SUPPORT = `
+  definition Employee {
+    role: Role
+    group: Group
+    clearance: string
+    reputation: number
+    activityScore: number
+    verificationLevel: number
+    socialProof: number
+    peerRatings: number
+    temporaryClearance: string
+    temporaryRole: string
+    actingRole: string
+    directPermissions: Permission[]
+    permissions: Permission[]
+    balance: number
+    score: number
+    isActive: boolean
+  }
+
+  definition Role {
+    permissions: Permission[]
+    clearance: string
+  }
+
+  definition Group {
+    permissions: Permission[]
+    clearance: string
+  }
+
+  definition Permission {
+    name: string
+  }
+
+  fact similar(a: any, b: any)
+`;
+
 describe('Measure Definitions', () => {
   const arbiter = createMockArbiter();
   const compiler = new DSLCompiler(arbiter);
@@ -19,31 +56,31 @@ describe('Measure Definitions', () => {
   test('Basic measures', () => {
     const testCases = [
       {
-        input: `measure userRole(user: User) {
+        input: `measure userRole(user: Employee) {
           user.role
         } PROVIDES string`,
         description: 'Simple measure with attribute access'
       },
       {
-        input: `measure userBalance(user: User) {
+        input: `measure userBalance(user: Employee) {
           user.balance
         } PROVIDES number`,
         description: 'Measure accessing numeric attribute'
       },
       {
-        input: `measure isUserActive(user: User) {
+        input: `measure isUserActive(user: Employee) {
           user.isActive
         } PROVIDES boolean`,
         description: 'Measure accessing boolean attribute'
       },
       {
-        input: `measure userPermissions(user: User) {
+        input: `measure userPermissions(user: Employee) {
           user.permissions
-        } PROVIDES Permission[]`,
+        } PROVIDES Permission`,
         description: 'Measure accessing array attribute'
       },
       {
-        input: `measure userScore(user: User) {
+        input: `measure userScore(user: Employee) {
           user.score
         } PROVIDES number`,
         description: 'Measure with behavior-inherited attribute'
@@ -51,7 +88,7 @@ describe('Measure Definitions', () => {
     ];
 
     testCases.forEach(({ input, description }) => {
-      const result = compiler.compile(input, `test-basic-measure-${Date.now()}`);
+      const result = compiler.compile(DSL_SUPPORT + input, `test-basic-measure-${Date.now()}`);
       assert.ok(result.success, `${description} should parse successfully`);
       assert.ok(result.program.measures.length > 0, 'Should have measures');
     });
@@ -63,13 +100,13 @@ describe('Measure Definitions', () => {
       { type: 'number', description: 'Number return type' },
       { type: 'boolean', description: 'Boolean return type' },
       { type: 'timestamp', description: 'Timestamp return type' },
-      { type: 'Permission[]', description: 'Array return type' },
-      { type: 'User', description: 'Custom type return' },
-      { type: 'Group[]', description: 'Custom array return type' }
+      { type: 'Permission', description: 'Array return type' },
+      { type: 'Employee', description: 'Custom type return' },
+      { type: 'Group', description: 'Custom array return type' }
     ];
 
     testCases.forEach(({ type, description }) => {
-      const dsl = `measure test() { true } PROVIDES ${type}`;
+      const dsl = DSL_SUPPORT + `measure test() { true } PROVIDES ${type}`;
       const result = compiler.compile(dsl, `test-measure-return-${Date.now()}`);
       assert.ok(result.success, `${description} should parse successfully`);
     });
@@ -78,40 +115,40 @@ describe('Measure Definitions', () => {
   test('Measure aggregation', () => {
     const testCases = [
       {
-        input: `measure userPermissions(user: User) {
+        input: `measure userPermissions(user: Employee) {
           aggregate {
-            user.role.permissions
+            user.role.permissions,
             user.group.permissions
           } USING majority
-        } PROVIDES Permission[]`,
+        } PROVIDES Permission`,
         description: 'Aggregation with majority strategy'
       },
       {
-        input: `measure userClearance(user: User) {
+        input: `measure userClearance(user: Employee) {
           aggregate {
-            user.clearance
-            user.role.clearance
+            user.clearance,
+            user.role.clearance,
             user.group.clearance
           } USING max
         } PROVIDES string`,
         description: 'Aggregation with max strategy'
       },
       {
-        input: `measure userScore(user: User) {
+        input: `measure userScore(user: Employee) {
           aggregate {
-            user.reputation
-            user.activityScore
+            user.reputation,
+            user.activityScore,
             user.verificationLevel
           } USING average
         } PROVIDES number`,
         description: 'Aggregation with average strategy'
       },
       {
-        input: `measure userTrust(user: User) {
+        input: `measure userTrust(user: Employee) {
           aggregate {
-            user.reputation
-            user.activityScore
-            user.verificationLevel
+            user.reputation,
+            user.activityScore,
+            user.verificationLevel,
             user.socialProof
           } USING min
         } PROVIDES number`,
@@ -120,7 +157,7 @@ describe('Measure Definitions', () => {
     ];
 
     testCases.forEach(({ input, description }) => {
-      const result = compiler.compile(input, `test-measure-aggregation-${Date.now()}`);
+      const result = compiler.compile(DSL_SUPPORT + input, `test-measure-aggregation-${Date.now()}`);
       assert.ok(result.success, `${description} should parse successfully`);
     });
   });
@@ -128,40 +165,40 @@ describe('Measure Definitions', () => {
   test('Measure fusion', () => {
     const testCases = [
       {
-        input: `measure effectiveClearance(user: User) {
+        input: `measure effectiveClearance(user: Employee) {
           fusion max {
-            user.clearance
-            user.role.clearance
+            user.clearance,
+            user.role.clearance,
             user.group.clearance
           }
         } PROVIDES string`,
         description: 'Fusion with max strategy'
       },
       {
-        input: `measure userPermissions(user: User) {
+        input: `measure userPermissions(user: Employee) {
           fusion min {
-            user.role.permissions
+            user.role.permissions,
             user.group.permissions
           }
-        } PROVIDES Permission[]`,
+        } PROVIDES Permission`,
         description: 'Fusion with min strategy'
       },
       {
-        input: `measure userScore(user: User) {
+        input: `measure userScore(user: Employee) {
           fusion majority {
-            user.reputation
-            user.activityScore
+            user.reputation,
+            user.activityScore,
             user.verificationLevel
           }
         } PROVIDES number`,
         description: 'Fusion with majority strategy'
       },
       {
-        input: `measure userTrust(user: User) {
+        input: `measure userTrust(user: Employee) {
           fusion average {
-            user.reputation
-            user.activityScore
-            user.verificationLevel
+            user.reputation,
+            user.activityScore,
+            user.verificationLevel,
             user.socialProof
           }
         } PROVIDES number`,
@@ -170,7 +207,7 @@ describe('Measure Definitions', () => {
     ];
 
     testCases.forEach(({ input, description }) => {
-      const result = compiler.compile(input, `test-measure-fusion-${Date.now()}`);
+      const result = compiler.compile(DSL_SUPPORT + input, `test-measure-fusion-${Date.now()}`);
       assert.ok(result.success, `${description} should parse successfully`);
     });
   });
@@ -178,40 +215,40 @@ describe('Measure Definitions', () => {
   test('Complex measures', () => {
     const testCases = [
       {
-        input: `measure userEffectivePermissions(user: User) {
+        input: `measure userEffectivePermissions(user: Employee) {
           aggregate {
-            user.role.permissions
-            user.group.permissions
+            user.role.permissions,
+            user.group.permissions,
             user.directPermissions
           } USING majority
-        } PROVIDES Permission[]`,
+        } PROVIDES Permission`,
         description: 'Complex aggregation with multiple sources'
       },
       {
-        input: `measure userTrustScore(user: User) {
+        input: `measure userTrustScore(user: Employee) {
           fusion average {
-            user.reputation
-            user.activityScore
-            user.verificationLevel
-            user.socialProof
+            user.reputation,
+            user.activityScore,
+            user.verificationLevel,
+            user.socialProof,
             user.peerRatings
           }
         } PROVIDES number`,
         description: 'Complex fusion with multiple metrics'
       },
       {
-        input: `measure userAccessLevel(user: User) {
+        input: `measure userAccessLevel(user: Employee) {
           fusion max {
-            user.clearance
-            user.role.clearance
-            user.group.clearance
+            user.clearance,
+            user.role.clearance,
+            user.group.clearance,
             user.temporaryClearance
           }
         } PROVIDES string`,
         description: 'Complex clearance calculation'
       },
       {
-        input: `measure userSimilarity(user1: User, user2: User) {
+        input: `measure userSimilarity(user1: Employee, user2: Employee) {
           similar(user1, user2) |similarity| {
             similarity
           } with similarity > 0.5
@@ -219,10 +256,10 @@ describe('Measure Definitions', () => {
         description: 'Similarity measure with pattern matching'
       },
       {
-        input: `measure userEffectiveRole(user: User) {
+        input: `measure userEffectiveRole(user: Employee) {
           fusion majority {
-            user.role
-            user.temporaryRole
+            user.role,
+            user.temporaryRole,
             user.actingRole
           }
         } PROVIDES string`,
@@ -231,7 +268,7 @@ describe('Measure Definitions', () => {
     ];
 
     testCases.forEach(({ input, description }) => {
-      const result = compiler.compile(input, `test-complex-measure-${Date.now()}`);
+      const result = compiler.compile(DSL_SUPPORT + input, `test-complex-measure-${Date.now()}`);
       assert.ok(result.success, `${description} should parse successfully`);
     });
   });
@@ -239,40 +276,40 @@ describe('Measure Definitions', () => {
   test('Measure error handling', () => {
     const testCases = [
       {
-        input: `measure userRole(user: User) {
+        input: `measure userRole(user: Employee) {
           user.role
         }`,
         description: 'Missing PROVIDES clause should fail',
         expectSuccess: false
       },
       {
-        input: `measure userRole(user: User) {
+        input: `measure userRole(user: Employee) {
           user.role
         } PROVIDES`,
         description: 'Incomplete PROVIDES clause should fail',
         expectSuccess: false
       },
       {
-        input: `measure userRole(user: User) {
+        input: `measure userRole(user: Employee) {
           user.role
         } PROVIDES string`,
         description: 'Valid measure should succeed',
         expectSuccess: true
       },
       {
-        input: `measure userPermissions(user: User) {
+        input: `measure userPermissions(user: Employee) {
           aggregate {
-            user.role.permissions
+            user.role.permissions,
             user.group.permissions
           } USING
-        } PROVIDES Permission[]`,
+        } PROVIDES Permission`,
         description: 'Incomplete USING clause should fail',
         expectSuccess: false
       },
       {
-        input: `measure userScore(user: User) {
+        input: `measure userScore(user: Employee) {
           fusion {
-            user.reputation
+            user.reputation,
             user.activityScore
           }
         } PROVIDES number`,
@@ -280,7 +317,7 @@ describe('Measure Definitions', () => {
         expectSuccess: false
       },
       {
-        input: `measure userRole(user: User) {
+        input: `measure userRole(user: Employee) {
           invalid syntax here
         } PROVIDES string`,
         description: 'Invalid syntax should fail',
@@ -290,7 +327,7 @@ describe('Measure Definitions', () => {
 
     testCases.forEach(({ input, description, expectSuccess }) => {
       try {
-        const result = compiler.compile(input, `test-measure-error-${Date.now()}`);
+        const result = compiler.compile(DSL_SUPPORT + input, `test-measure-error-${Date.now()}`);
         if (expectSuccess) {
           assert.ok(result.success, `${description} should parse successfully`);
         } else {

tests/Recursion.test.js

@@ -0,0 +1,136 @@
+/**
+ * tests/Recursion.test.js — bounded self-recursion (transitive closure).
+ *
+ * An evidence whose config contains a chain step referencing ITSELF is
+ * unrolled at compile time into a bounded transitive closure: a union of
+ * paths — base, hop+base, hop²+base, … — where `hop` is the recursive chain's
+ * steps before the self-reference and the depth N comes from the pattern's
+ * `limit N` (or the compiler's maxRecursionDepth default). The base (the
+ * evidence's non-recursive statements) is verified as a condition step at each
+ * path's terminal node.
+ *
+ * A pure recursion (no base case) cannot grant and is a compile-time error.
+ */
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { Arbiter } from '@arbiter/core';
+import { DSLCompiler } from '../src/DSLCompiler.js';
+
+const BASE = `
+  definition Employee { id: string }
+  definition Doc { id: string }
+  fact can_access(user: Employee, doc: Doc)
+  fact reports_to(user: Employee, manager: Employee)
+`;
+
+const RECURSIVE = `
+  evidence can_access_via(user: Employee, doc: Doc) {
+    can_access(user, doc)
+    reports_to(user, *m) { can_access_via(m, doc) } limit 3
+  }
+`;
+
+function compile(dsl, name = 'rec') {
+  const arb = new Arbiter();
+  const result = new DSLCompiler(arb).compile(dsl, name);
+  return { arb, result };
+}
+
+describe('Bounded self-recursion', () => {
+  it('unrolls into a union of base + bounded hop chains', () => {
+    const { arb, result } = compile(BASE + RECURSIVE);
+    assert.ok(result.success, JSON.stringify(result.errors));
+    const cfg = arb.relationConfigs.get('can_access_via');
+    assert.equal(cfg.type, 'logical');
+    assert.ok(cfg.union, 'recursion should compile to a union of paths');
+    // base + 3 hops (limit 3)
+    assert.equal(cfg.union.rules.length, 4);
+  });
+
+  it('grants through the base case and through multi-hop chains', () => {
+    const { arb, result } = compile(BASE + RECURSIVE);
+    assert.ok(result.success);
+    arb.addNode('u:1', 'Employee'); arb.addNode('m:1', 'Employee'); arb.addNode('m2:1', 'Employee'); arb.addNode('doc:9', 'Doc');
+    // base
+    arb.addRelation('u:1', 'can_access', 'doc:9', { possibility: 1.0 });
+    assert.equal(arb.check('u:1', 'can_access_via', 'doc:9').possibility, 1.0);
+    // 1-hop: u -> m -> doc
+    arb.removeRelation('u:1', 'can_access', 'doc:9');
+    arb.addRelation('u:1', 'reports_to', 'm:1', { possibility: 1.0 });
+    arb.addRelation('m:1', 'can_access', 'doc:9', { possibility: 0.7 });
+    assert.equal(arb.check('u:1', 'can_access_via', 'doc:9').possibility, 0.7);
+    // 2-hop: u -> m -> m2 -> doc
+    arb.addRelation('m:1', 'reports_to', 'm2:1', { possibility: 1.0 });
+    arb.addRelation('m2:1', 'can_access', 'doc:9', { possibility: 0.5 });
+    // union takes the best path: max(0.7, 0.5) = 0.7
+    assert.equal(arb.check('u:1', 'can_access_via', 'doc:9').possibility, 0.7);
+    // 2-hop alone (remove the 1-hop can_access)
+    arb.removeRelation('m:1', 'can_access', 'doc:9');
+    assert.equal(arb.check('u:1', 'can_access_via', 'doc:9').possibility, 0.5);
+  });
+
+  it('enforces the recursion depth limit', () => {
+    const { arb, result } = compile(`
+      ${BASE}
+      evidence can_access_via(user: Employee, doc: Doc) {
+        can_access(user, doc)
+        reports_to(user, *m) { can_access_via(m, doc) } limit 2
+      }
+    `);
+    assert.ok(result.success);
+    arb.addNode('u:1', 'Employee'); arb.addNode('m:1', 'Employee'); arb.addNode('m2:1', 'Employee'); arb.addNode('m3:1', 'Employee'); arb.addNode('doc:9', 'Doc');
+    arb.addRelation('u:1', 'reports_to', 'm:1', { possibility: 1.0 });
+    arb.addRelation('m:1', 'reports_to', 'm2:1', { possibility: 1.0 });
+    arb.addRelation('m2:1', 'reports_to', 'm3:1', { possibility: 1.0 });
+    arb.addRelation('m2:1', 'can_access', 'doc:9', { possibility: 0.5 }); // 2 hops
+    arb.addRelation('m3:1', 'can_access', 'doc:9', { possibility: 0.9 }); // 3 hops
+    assert.equal(arb.check('u:1', 'can_access_via', 'doc:9').possibility, 0.5);
+    arb.removeRelation('m2:1', 'can_access', 'doc:9');
+    // only the 3-hop path remains — beyond the limit -> denied
+    assert.equal(arb.check('u:1', 'can_access_via', 'doc:9').possibility, 0);
+  });
+
+  it('uses the compiler maxRecursionDepth default when no limit is given', () => {
+    const dsl = `
+      ${BASE}
+      evidence can_access_via(user: Employee, doc: Doc) {
+        can_access(user, doc)
+        reports_to(user, *m) { can_access_via(m, doc) }
+      }
+    `;
+    const { arb, result } = compile(dsl);
+    assert.ok(result.success, JSON.stringify(result.errors));
+    // default depth 3 -> base + 3 hops
+    assert.equal(arb.relationConfigs.get('can_access_via').union.rules.length, 4);
+    // a deeper path (4 hops) is not granted
+    arb.addNode('u:1', 'Employee'); arb.addNode('m:1', 'Employee'); arb.addNode('m2:1', 'Employee'); arb.addNode('m3:1', 'Employee'); arb.addNode('m4:1', 'Employee'); arb.addNode('doc:9', 'Doc');
+    arb.addRelation('u:1', 'reports_to', 'm:1', { possibility: 1.0 });
+    arb.addRelation('m:1', 'reports_to', 'm2:1', { possibility: 1.0 });
+    arb.addRelation('m2:1', 'reports_to', 'm3:1', { possibility: 1.0 });
+    arb.addRelation('m3:1', 'reports_to', 'm4:1', { possibility: 1.0 });
+    arb.addRelation('m4:1', 'can_access', 'doc:9', { possibility: 1.0 });
+    assert.equal(arb.check('u:1', 'can_access_via', 'doc:9').possibility, 0, '4-hop path exceeds default depth');
+  });
+
+  it('rejects a pure recursion with no base case', () => {
+    const { result } = compile(`
+      ${BASE}
+      evidence can_access_via(user: Employee, doc: Doc) {
+        reports_to(user, *m) { can_access_via(m, doc) } limit 3
+      }
+    `);
+    assert.equal(result.success, false);
+    assert.ok(result.errors.some(e => /no base case/.test(e)), JSON.stringify(result.errors));
+  });
+
+  it('keeps mutual (non-self) cycles a compile error', () => {
+    const { result } = compile(`
+      ${BASE}
+      fact peer(user: Employee, other: Employee)
+      evidence a(user: Employee, doc: Doc) { peer(user, *p) { b(p, doc) } }
+      evidence b(user: Employee, doc: Doc) { peer(user, *p) { a(p, doc) } }
+    `);
+    assert.equal(result.success, false);
+    assert.ok(result.errors.some(e => /[Cc]yclic/.test(e)), JSON.stringify(result.errors));
+  });
+});

tests/rigor/dsl-generative-oracle.test.js

@@ -0,0 +1,261 @@
+/**
+ * tests/rigor/dsl-generative-oracle.test.js — js-rigor campaign that GENERATES
+ * legal Evidence DSL programs, compiles them to @arbiter/core configs, runs
+ * checks, and compares every verdict against an independent ORACLE (a hand-
+ * computed reference implementation of the DSL semantics).
+ *
+ * The oracle is deliberately independent of the engine: it computes the
+ * expected possibility from the generated fact graph using the ADR-000
+ * semantics (direct = edge, chain = min over steps, tuple_to_userset = min of
+ * the two legs, fusion = min/max over operands, when-unless = base×(1−defeat),
+ * never = 0 when ≥0.5 else base, requires = base×requirement).
+ *
+ * Anti-vacuity: the oracle is NOT a constant — each construct maps distinct
+ * edge possibilities, so a trivial 0-or-1 lowering would be caught.
+ */
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { rigor } from '@rigor/core';
+import { Arbiter } from '@arbiter/core';
+import { DSLCompiler } from '../../src/DSLCompiler.js';
+
+const EPS = 1e-9;
+const P = [0, 0.25, 0.5, 0.75, 1];
+
+const FACTS = `
+  definition Employee { id: string }
+  definition Group { id: string }
+  definition Doc { id: string }
+  fact owns(user: Employee, doc: Doc)
+  fact shares(user: Employee, doc: Doc)
+  fact member_of(user: Employee, group: Group)
+  fact can_access(group: Group, doc: Doc)
+  fact owner(group: Group, doc: Doc)
+  fact granted(user: Employee, doc: Doc)
+  fact group_perm(group: Group, doc: Doc)
+  fact group_banned(group: Group)
+  fact banned(user: Employee)
+  fact peer(user: Employee, other: Employee)
+  fact trusted(other: Employee)
+  fact doc_read(user: Employee, doc: Doc)
+  fact mfa(user: Employee)
+`;
+
+// Each construct: how to build the DSL evidence + which edges to add + the oracle.
+function buildProgram(kind, ps) {
+  let evidence = '';
+  const edges = [];
+  let oracle = 0;
+
+  switch (kind) {
+    case 'direct': {
+      const [pOwn] = ps;
+      evidence = `evidence can_read(user: Employee, doc: Doc) { owns(user, doc) }`;
+      edges.push({ src: 'u:1', relation: 'owns', dst: 'doc:9', possibility: pOwn });
+      oracle = pOwn;
+      break;
+    }
+    case 'chain': {
+      const [pm, pa] = ps;
+      evidence = `evidence can_enter(user: Employee, doc: Doc) { member_of(user, *g) { can_access(g, doc) } }`;
+      edges.push({ src: 'u:1', relation: 'member_of', dst: 'g:1', possibility: pm });
+      edges.push({ src: 'g:1', relation: 'can_access', dst: 'doc:9', possibility: pa });
+      oracle = Math.min(pm, pa);
+      break;
+    }
+    case 'tuple_to_userset': {
+      const [po, pm] = ps;
+      evidence = `evidence can_view(user: Employee, doc: Doc) { owner(*g, doc) { member_of(user, g) } }`;
+      edges.push({ src: 'g:1', relation: 'owner', dst: 'doc:9', possibility: po });
+      edges.push({ src: 'u:1', relation: 'member_of', dst: 'g:1', possibility: pm });
+      oracle = Math.min(pm, po);
+      break;
+    }
+    case 'fusion_min': {
+      const [p1, p2] = ps;
+      evidence = `evidence can_fuse(user: Employee, doc: Doc) { fusion min { owns(user, doc), shares(user, doc) } }`;
+      edges.push({ src: 'u:1', relation: 'owns', dst: 'doc:9', possibility: p1 });
+      edges.push({ src: 'u:1', relation: 'shares', dst: 'doc:9', possibility: p2 });
+      oracle = Math.min(p1, p2);
+      break;
+    }
+    case 'fusion_max': {
+      const [p1, p2] = ps;
+      evidence = `evidence can_fuse(user: Employee, doc: Doc) { fusion max { owns(user, doc), shares(user, doc) } }`;
+      edges.push({ src: 'u:1', relation: 'owns', dst: 'doc:9', possibility: p1 });
+      edges.push({ src: 'u:1', relation: 'shares', dst: 'doc:9', possibility: p2 });
+      oracle = Math.max(p1, p2);
+      break;
+    }
+    case 'when_unless': {
+      const [pG, pB] = ps;
+      evidence = `evidence can_borrow(user: Employee, doc: Doc) { WHEN granted(user, doc) UNLESS banned(user) }`;
+      edges.push({ src: 'u:1', relation: 'granted', dst: 'doc:9', possibility: pG });
+      edges.push({ src: 'u:1', relation: 'banned', dst: 'u:1', possibility: pB });
+      oracle = pG * (1 - pB);
+      break;
+    }
+    case 'never_always': {
+      const [pG, pB] = ps;
+      evidence = `evidence can_open(user: Employee, doc: Doc) { NEVER banned(user) ALWAYS granted(user, doc) }`;
+      edges.push({ src: 'u:1', relation: 'granted', dst: 'doc:9', possibility: pG });
+      edges.push({ src: 'u:1', relation: 'banned', dst: 'u:1', possibility: pB });
+      oracle = pB >= 0.5 ? 0 : pG;
+      break;
+    }
+    case 'requires_when': {
+      const [pG, pM] = ps;
+      evidence = `evidence can_pay(user: Employee, doc: Doc) { REQUIRES mfa(user) WHEN granted(user, doc) }`;
+      edges.push({ src: 'u:1', relation: 'granted', dst: 'doc:9', possibility: pG });
+      edges.push({ src: 'u:1', relation: 'mfa', dst: 'u:1', possibility: pM });
+      oracle = pG * pM;
+      break;
+    }
+    case 'composition': {
+      // can_via composes the direct evidence can_read, which reads the owns
+      // edge — an evidence-in-evidence reference resolved at compile time.
+      const [pOwn] = ps;
+      evidence = `evidence can_read(user: Employee, doc: Doc) { owns(user, doc) }
+                  evidence can_via(user: Employee, doc: Doc) { can_read(user, doc) }`;
+      edges.push({ src: 'u:1', relation: 'owns', dst: 'doc:9', possibility: pOwn });
+      oracle = pOwn;
+      break;
+    }
+    case 'chain_step_composition': {
+      // group_read (a direct evidence) used as a CHAIN STEP inside can_via:
+      // the step is expanded at compile time to the underlying can_view edge.
+      const [pm, pv] = ps;
+      evidence = `evidence group_read(group: Group, doc: Doc) { group_perm(group, doc) }
+                  evidence can_via(user: Employee, doc: Doc) { member_of(user, *g) { group_read(g, doc) } }`;
+      edges.push({ src: 'u:1', relation: 'member_of', dst: 'g:1', possibility: pm });
+      edges.push({ src: 'g:1', relation: 'group_perm', dst: 'doc:9', possibility: pv });
+      oracle = Math.min(pm, pv);
+      break;
+    }
+    case 'chain_condition_step': {
+      // gated (a defeasible evidence) as the FINAL chain step → a condition
+      // step: the engine verifies gated at (intermediate, object). The oracle
+      // is the chain's min combined with the condition's base*(1-defeat).
+      const [pm, pv, pb] = ps;
+      evidence = `evidence gated(group: Group, doc: Doc) { WHEN group_perm(group, doc) UNLESS group_banned(group) }
+                  evidence can_via(user: Employee, doc: Doc) { member_of(user, *g) { gated(g, doc) } }`;
+      edges.push({ src: 'u:1', relation: 'member_of', dst: 'g:1', possibility: pm });
+      edges.push({ src: 'g:1', relation: 'group_perm', dst: 'doc:9', possibility: pv });
+      edges.push({ src: 'g:1', relation: 'group_banned', dst: 'g:1', possibility: pb });
+      oracle = Math.min(pm, pv * (1 - pb));
+      break;
+    }
+    case 'chain_intermediate_condition': {
+      // peer_trusted (a defeasible evidence) as an INTERMEDIATE chain step:
+      // the engine expands it from the source (peer edges filtered by the
+      // trusted defeater) then continues to can_read. Oracle = min of the
+      // surviving peer leg and the read leg.
+      const [pp, pt, pr] = ps;
+      evidence = `evidence peer_trusted(user: Employee, other: Employee) { WHEN peer(user, other) UNLESS trusted(other) }
+                  evidence can_via(user: Employee, doc: Doc) { peer_trusted(user, *p) { doc_read(p, doc) } }`;
+      edges.push({ src: 'u:1', relation: 'peer', dst: 'p:1', possibility: pp });
+      edges.push({ src: 'p:1', relation: 'trusted', dst: 'p:1', possibility: pt });
+      edges.push({ src: 'p:1', relation: 'doc_read', dst: 'doc:9', possibility: pr });
+      oracle = Math.min(pp * (1 - pt), pr);
+      break;
+    }
+    default:
+      throw new Error(`unknown construct: ${kind}`);
+  }
+
+  return {
+    dsl: FACTS + evidence,
+    edges,
+    oracle,
+    // Check the LAST evidence declaration: the composition construct declares
+    // two evidences (can_read + can_via), and the composed one is the target.
+    relation: [...evidence.matchAll(/evidence\s+(\w+)/g)].at(-1)[1]
+  };
+}
+
+function runCheck({ kind, ps }) {
+  const { dsl, edges, oracle, relation } = buildProgram(kind, ps);
+  const arbiter = new Arbiter();
+  arbiter.addNode('u:1', 'Employee');
+  arbiter.addNode('g:1', 'Group');
+  arbiter.addNode('doc:9', 'Doc');
+  for (const e of edges) {
+    arbiter.addNode(e.src, e.dst === 'doc:9' ? 'Doc' : 'Employee');
+    arbiter.addNode(e.dst, e.dst === 'doc:9' ? 'Doc' : 'Employee');
+  }
+  const compiler = new DSLCompiler(arbiter);
+  const compiled = compiler.compile(dsl, 'oracle');
+  if (!compiled.success) {
+    throw new Error(`compile failed for ${kind}: ${compiled.errors.join('; ')}`);
+  }
+  for (const e of edges) arbiter.addRelation(e.src, e.relation, e.dst, { possibility: e.possibility });
+  const result = arbiter.check('u:1', relation, 'doc:9');
+  if (Math.abs(result.possibility - oracle) > EPS) {
+    throw new Error(`oracle mismatch for ${kind} (edges=${JSON.stringify(edges)}): ` +
+      `check=${result.possibility} (${result.reason}) vs oracle=${oracle}`);
+  }
+  return { kind, possibility: result.possibility, oracle };
+}
+
+const CONSTRUCTS = ['direct', 'chain', 'tuple_to_userset', 'fusion_min', 'fusion_max',
+  'when_unless', 'never_always', 'requires_when', 'composition', 'chain_step_composition',
+  'chain_condition_step', 'chain_intermediate_condition'];
+
+describe('DSL generative oracle parity (rigor)', () => {
+  it('generated legal DSL compiles and every check matches the oracle', async () => {
+    const report = await rigor.campaign(
+      [
+        rigor.fn('oracle-parity', runCheck, rigor.args(
+          rigor.gen.object({
+            kind: rigor.gen.oneOf(CONSTRUCTS),
+            // exactly two edge possibilities (direct uses only the first);
+            // a shorter array would leave pB undefined and produce a NaN oracle
+            ps: rigor.gen.tuple(rigor.gen.oneOf(P), rigor.gen.oneOf(P), rigor.gen.oneOf(P))
+          })
+        ))
+      ],
+      rigor.crucible([
+        // `actual` is the fn's return value; a thrown error (compile failure or
+        // oracle mismatch) yields actual === undefined, failing this invariant.
+        rigor.invariant('oracle-parity', ({ actual }) =>
+          !!actual && Math.abs(actual.possibility - actual.oracle) <= EPS)
+      ])
+    ).run({ seed: 'dsl-oracle-parity', effort: 600, artifacts: { dir: '', persist: 'never' } });
+
+    const inv = report.crucibleVerdict?.invariants?.find(i => i.name === 'oracle-parity');
+    assert.ok(inv, 'crucible invariant missing');
+    assert.equal(inv.passed, true, `oracle parity violated in ${inv.failureCount} cases`);
+  });
+
+  it('exhaustive deterministic sweep: every construct x every possibility value', () => {
+    // Anti-vacuity complement to the campaign: sweep the full P × P × P grid
+    // per construct without any RNG, so a construct the campaign skipped would
+    // still be caught here.
+    for (const kind of CONSTRUCTS) {
+      for (const a of P) {
+        for (const b of P) {
+          for (const c of P) {
+          const ps = kind === 'direct' ? [a] : [a, b, c];
+          const { dsl, edges, oracle, relation } = buildProgram(kind, ps);
+          const arbiter = new Arbiter();
+          arbiter.addNode('u:1', 'Employee');
+          arbiter.addNode('g:1', 'Group');
+          arbiter.addNode('doc:9', 'Doc');
+          for (const e of edges) {
+            arbiter.addNode(e.src, e.dst === 'doc:9' ? 'Doc' : 'Employee');
+            arbiter.addNode(e.dst, e.dst === 'doc:9' ? 'Doc' : 'Employee');
+          }
+          const compiled = new DSLCompiler(arbiter).compile(dsl, 'sweep');
+          assert.ok(compiled.success, `${kind} compile failed: ${(compiled.errors || []).join('; ')}`);
+          for (const e of edges) arbiter.addRelation(e.src, e.relation, e.dst, { possibility: e.possibility });
+          const result = arbiter.check('u:1', relation, 'doc:9');
+          assert.ok(
+            Math.abs(result.possibility - oracle) <= EPS,
+            `${kind} ps=[${ps}] check=${result.possibility}(${result.reason}) vs oracle=${oracle}`
+          );
+          }
+        }
+      }
+    }
+  });
+});

tests/rigor/dsl-illegal-mutations.test.js

@@ -0,0 +1,153 @@
+/**
+ * tests/rigor/dsl-illegal-mutations.test.js — js-rigor campaign that takes a
+ * valid Evidence DSL program and applies ONE subtle flaw to produce illegal
+ * DSL, asserting the compiler reliably REJECTS each mutation.
+ *
+ * Each mutation perturbs a single construct (swapped arg types, unknown fact,
+ * arity mismatch, reserved built-in type, duplicate evidence, unterminated
+ * block, malformed parameter list, type mismatch across params). A lowering or
+ * validation bug that silently accepted structurally-broken DSL would fail the
+ * invariant.
+ *
+ * Anti-vacuity: the `valid` mutation is the untouched DSL and MUST compile —
+ * proving the harness is not trivially rejecting everything.
+ */
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { rigor } from '@rigor/core';
+import { Arbiter } from '@arbiter/core';
+import { DSLCompiler } from '../../src/DSLCompiler.js';
+
+const VALID_DSL = `
+  definition Employee { id: string }
+  definition Group { id: string }
+  definition Doc { id: string }
+  fact owns(user: Employee, doc: Doc)
+  fact member_of(user: Employee, group: Group)
+  fact can_access(group: Group, doc: Doc)
+  evidence can_read(user: Employee, doc: Doc) { owns(user, doc) }
+  evidence can_enter(user: Employee, doc: Doc) { member_of(user, *g) { can_access(g, doc) } }
+`;
+
+// Each mutation transforms the valid DSL into an illegal variant.
+// `mustFail: false` marks the control mutation (untouched DSL — must compile).
+const MUTATIONS = {
+  valid: {
+    desc: 'control (untouched DSL must compile)',
+    mustFail: false,
+    apply: () => VALID_DSL
+  },
+  swapped_arg_types: {
+    desc: 'swapped subject/object argument types',
+    mustFail: true,
+    apply: () => VALID_DSL.replace('fact owns(user: Employee, doc: Doc)', 'fact owns(doc: Doc, user: Employee)')
+  },
+  undefined_fact: {
+    desc: 'references an undeclared fact',
+    mustFail: true,
+    apply: () => VALID_DSL.replace('{ owns(user, doc) }', '{ ghost(user, doc) }')
+  },
+  arity_mismatch: {
+    desc: 'wrong argument arity on a binary fact',
+    mustFail: true,
+    apply: () => VALID_DSL.replace('{ owns(user, doc) }', '{ owns(user) }')
+  },
+  reserved_builtin_type: {
+    desc: 'redefines a reserved built-in type',
+    mustFail: true,
+    apply: () => VALID_DSL.replace('definition Employee { id: string }', 'definition User { id: string }')
+  },
+  duplicate_evidence: {
+    desc: 'duplicate evidence relation name',
+    mustFail: true,
+    apply: () => VALID_DSL + `\n  evidence can_read(user: Employee, doc: Doc) { owns(user, doc) }`
+  },
+  unterminated_block: {
+    desc: 'missing closing brace',
+    mustFail: true,
+    apply: () => VALID_DSL.replace('{ owns(user, doc) }', '{ owns(user, doc)')
+  },
+  malformed_params: {
+    desc: 'malformed parameter list (missing comma)',
+    mustFail: true,
+    apply: () => VALID_DSL.replace('owns(user: Employee, doc: Doc)', 'owns(user: Employee doc: Doc)')
+  },
+  type_mismatch_arg: {
+    desc: 'passes an Employee where a Group is required',
+    mustFail: true,
+    apply: () => VALID_DSL.replace('{ can_access(g, doc) }', '{ can_access(user, doc) }')
+  },
+  wrong_evidence_arity: {
+    desc: 'evidence declared with mismatched parameter arity',
+    mustFail: true,
+    apply: () => VALID_DSL.replace('evidence can_read(user: Employee, doc: Doc) { owns(user, doc) }', 'evidence can_read(user: Employee) { owns(user, doc) }')
+  },
+  cyclic_evidence_ref: {
+    desc: 'two evidences referencing each other (cycle)',
+    mustFail: true,
+    apply: () => VALID_DSL + `
+  evidence can_cyc_a(user: Employee, doc: Doc) { can_cyc_b(user, doc) }
+  evidence can_cyc_b(user: Employee, doc: Doc) { can_cyc_a(user, doc) }`
+  },
+  cross_kind_collision: {
+    desc: 'fact and evidence sharing a relation name',
+    mustFail: true,
+    apply: () => VALID_DSL.replace(
+      'evidence can_read(user: Employee, doc: Doc) { owns(user, doc) }',
+      'fact can_read(user: Employee, doc: Doc)\n  evidence can_read(user: Employee, doc: Doc) { owns(user, doc) }'
+    )
+  }
+};
+
+function checkMutation(mutationName) {
+  const mutation = MUTATIONS[mutationName];
+  if (!mutation) throw new Error(`unknown mutation name: ${JSON.stringify(mutationName)}`);
+  const dsl = mutation.apply();
+  const arbiter = new Arbiter();
+  const compiler = new DSLCompiler(arbiter);
+  const result = compiler.compile(dsl, `mut-${mutationName}`);
+  const success = result.success;
+  const errors = result.errors || [];
+  if (mutation.mustFail) {
+    if (success || errors.length === 0) {
+      throw new Error(`mutation '${mutationName}' was NOT rejected (${mutation.desc}). ` +
+        `success=${success}, errors=${JSON.stringify(errors)}`);
+    }
+  } else if (!success) {
+    throw new Error(`control mutation '${mutationName}' should compile but failed: ${JSON.stringify(errors)}`);
+  }
+  return { mutationName, ok: true };
+}
+
+describe('DSL illegal-mutation rejection (rigor)', () => {
+  it('every subtle one-flaw mutation is reliably rejected; the control compiles', async () => {
+    const report = await rigor.campaign(
+      [
+        rigor.fn('reject-mutation', checkMutation, rigor.args(
+          rigor.gen.oneOf(Object.keys(MUTATIONS))
+        ))
+      ],
+      rigor.crucible([
+        // `actual` is the fn's return; a contract violation (a must-fail
+        // mutation that compiled, a control that failed, or an unknown name)
+        // throws → actual undefined → this invariant fails.
+        rigor.invariant('rejection-contract', ({ actual }) =>
+          !!actual && actual.ok === true)
+      ])
+    ).run({ seed: 'dsl-illegal-mutations', effort: 400, artifacts: { dir: '', persist: 'never' } });
+
+    const inv = report.crucibleVerdict?.invariants?.find(i => i.name === 'rejection-contract');
+    assert.ok(inv, 'crucible invariant missing');
+    assert.equal(inv.passed, true, `rejection contract violated in ${inv.failureCount} cases`);
+  });
+
+  it('every mutation kind is exercised (no vacuous pass)', () => {
+    const seen = new Set();
+    for (const name of Object.keys(MUTATIONS)) {
+      // deterministic probe of each kind
+      seen.add(name);
+      checkMutation(name);
+    }
+    assert.equal(seen.size, Object.keys(MUTATIONS).length);
+  });
+});

tests/rigor/dsl-value-graph-robustness.test.js

@@ -0,0 +1,338 @@
+/**
+ * tests/rigor/dsl-value-graph-robustness.test.js — js-rigor invariants for the
+ * DSLValueGraph wrapper's robustness: attach() semantics, resolver failure modes,
+ * stored-value lifecycle (overwrite / invalidation isolation / TTL), binding
+ * edge cases, strict-mode behavior, and concurrent retrieval.
+ */
+import { describe, it } from 'node:test';
+import { rigor, reducers } from '@rigor/core';
+import { Arbiter } from '@arbiter/core';
+import { ValueGraph } from '@arbiter/value-graph';
+import { DSLRuntime, DSLValueGraph } from '../../src/index.js';
+
+const DSL = `
+  definition Tenant { id: string }
+  measure budget(tenant: Tenant, feature: string) { } PROVIDES number
+  measure label(user: string) { } PROVIDES string
+`;
+
+function makeDvg() {
+  const rt = new DSLRuntime(new Arbiter()).compile(DSL, 'vg-robust');
+  return new DSLValueGraph(rt);
+}
+
+async function expectPass(name, actions, checks, config = {}) {
+  const report = await rigor.campaign(actions, rigor.crucible(checks))
+    .run({ seed: `dsl-vg-robust-${name}`, effort: 100, artifacts: { dir: '', persist: 'never' }, ...config });
+  if (report.status !== 'passed') {
+    const detail = (report.failures || []).slice(0, 5)
+      .map((f) => JSON.stringify({ action: f.actionName || f.action, inv: f.name, args: f.args, msg: f.message }));
+    throw new Error(`campaign '${name}' failed.\n${detail.join('\n')}`);
+  }
+  return report;
+}
+
+describe('DSLValueGraph robustness (rigor)', () => {
+  it('attach() is idempotent and a manual registerMeasure overrides it', async () => {
+    const actions = [
+      rigor.fn('attach_idempotent', (value, cb) => {
+        const rt = new DSLRuntime(new Arbiter()).compile(DSL, 'r');
+        const dvg = new DSLValueGraph(rt);
+        dvg.attach();
+        dvg.attach(); // idempotent
+        dvg.setValue('budget', { __subject: 't', tenant: 't', feature: 'x' }, value);
+        rt.measure('budget', { __subject: 't', tenant: 't', feature: 'x' }).then(
+          (r) => cb(null, r.value), (e) => cb(e)
+        );
+      }, rigor.args(rigor.gen.int(0, 100), rigor.handler(reducers.first()))),
+      rigor.fn('attach_override', (cb) => {
+        const rt = new DSLRuntime(new Arbiter()).compile(DSL, 'r');
+        const dvg = new DSLValueGraph(rt);
+        dvg.attach();
+        rt.registerMeasure('budget', async () => ({ value: 12345, unit: 'manual' }));
+        rt.measure('budget', { __subject: 't', tenant: 't', feature: 'x' }).then(
+          (r) => cb(null, r.value), (e) => cb(e)
+        );
+      }, rigor.args(rigor.handler(reducers.first()))),
+    ];
+    const checks = [
+      rigor.after('attach_idempotent', (ctx) => ctx.error == null && ctx.actual === ctx.args[0]),
+      rigor.after('attach_override', (ctx) => ctx.error == null && ctx.actual === 12345),
+    ];
+    await expectPass('attach', actions, checks);
+  });
+
+  it('resolver failure modes: sync-return, error propagation, wrong-typed result', async () => {
+    const actions = [
+      rigor.fn('resolver_sync', (value, cb) => {
+        const dvg = makeDvg();
+        dvg.resolve('budget', (s, p) => value * 2); // sync return
+        dvg.measure('budget', { __subject: 't', tenant: 't', feature: 'x' }).then(
+          (r) => cb(null, r.value), (e) => cb(e)
+        );
+      }, rigor.args(rigor.gen.int(0, 50), rigor.handler(reducers.first()))),
+      rigor.fn('resolver_error', (cb) => {
+        const dvg = makeDvg();
+        dvg.resolve('budget', (s, p, ctx, done) => { done(new Error('provider down')); });
+        dvg.measure('budget', { __subject: 't', tenant: 't', feature: 'x' }).then(
+          (r) => cb(null, { ok: true, v: r.value }),
+          (e) => cb(null, { ok: false, msg: e.message })
+        );
+      }, rigor.args(rigor.handler(reducers.first()))),
+      rigor.fn('resolver_wrong_type', (cb) => {
+        const dvg = makeDvg();
+        dvg.resolve('budget', (s, p, ctx, done) => { done(null, 'not-a-number'); });
+        dvg.measure('budget', { __subject: 't', tenant: 't', feature: 'x' }).then(
+          (r) => cb(null, { ok: true, v: r.value }),
+          (e) => cb(null, { ok: false, msg: e.message })
+        );
+      }, rigor.args(rigor.handler(reducers.first()))),
+    ];
+    const checks = [
+      rigor.after('resolver_sync', (ctx) => ctx.error == null && ctx.actual === ctx.args[0] * 2),
+      rigor.after('resolver_error', (ctx) => ctx.actual.ok === false && /provider down/.test(ctx.actual.msg)),
+      rigor.after('resolver_wrong_type', (ctx) => ctx.actual.ok === false && /must match declared type 'number'/.test(ctx.actual.msg)),
+    ];
+    await expectPass('resolvers', actions, checks);
+  });
+
+  it('stored-value lifecycle: overwrite wins, cross-measure invalidation is isolated, TTL expires', async () => {
+    const actions = [
+      rigor.fn('overwrite', (a, b) => {
+        const dvg = makeDvg();
+        dvg.setValue('budget', { __subject: 't', tenant: 't', feature: 'x' }, a);
+        dvg.setValue('budget', { __subject: 't', tenant: 't', feature: 'x' }, b); // last-write-wins
+        return dvg.getValue('budget', { __subject: 't', tenant: 't', feature: 'x' }).value;
+      }, rigor.args(rigor.gen.int(0, 100), rigor.gen.int(0, 100))),
+      rigor.fn('cross_measure_invalidate', (a, b) => {
+        const dvg = makeDvg();
+        dvg.setValue('budget', { __subject: 't', tenant: 't', feature: 'x' }, a);
+        dvg.setValue('label', { __subject: 't', user: 'u' }, String(b));
+        dvg.vg.invalidate('t', 'budget', { tenant: 't', feature: 'x' });
+        const budget = dvg.getValue('budget', { __subject: 't', tenant: 't', feature: 'x' });
+        const label = dvg.getValue('label', { __subject: 't', user: 'u' });
+        return { budget: budget === null ? 'null' : budget.value, label: label.value };
+      }, rigor.args(rigor.gen.int(0, 100), rigor.gen.int(0, 100))),
+      rigor.fn('ttl_expiry', (value, cb) => {
+        let t = 0;
+        const rt = new DSLRuntime(new Arbiter()).compile(DSL, 'r');
+        const dvg = new DSLValueGraph(rt, {
+          valueGraph: new ValueGraph({ clock: () => t, defaultTTL: 100 })
+        });
+        dvg.setValue('budget', { __subject: 't', tenant: 't', feature: 'x' }, value);
+        const before = dvg.getValue('budget', { __subject: 't', tenant: 't', feature: 'x' }).value;
+        t = 200;
+        const after = dvg.getValue('budget', { __subject: 't', tenant: 't', feature: 'x' });
+        cb(null, { before, after: after === null ? 'null' : after.value });
+      }, rigor.args(rigor.gen.int(0, 100), rigor.handler(reducers.first()))),
+    ];
+    const checks = [
+      rigor.after('overwrite', (ctx) => ctx.actual === ctx.args[1]),
+      rigor.after('cross_measure_invalidate', (ctx) => ctx.actual.budget === 'null' && ctx.actual.label === String(ctx.args[1])),
+      rigor.after('ttl_expiry', (ctx) => ctx.actual.before === ctx.args[0] && ctx.actual.after === 'null'),
+    ];
+    await expectPass('lifecycle', actions, checks);
+  });
+
+  it('binding edge cases: array params, extra keys preserved, positional arity, unit/source', async () => {
+    const actions = [
+      rigor.fn('array_param', (arr, cb) => {
+        const rt = new DSLRuntime(new Arbiter()).compile(`measure tags(user: string, xs: array) { } PROVIDES number`, 'r');
+        const dvg = new DSLValueGraph(rt);
+        dvg.setValue('tags', { __subject: 't', user: 'u', xs: arr }, 7);
+        const e = dvg.getValue('tags', { __subject: 't', user: 'u', xs: arr });
+        cb(null, e ? e.value : 'MISSING');
+      }, rigor.args(rigor.gen.array(rigor.gen.int(0, 9), 0, 4), rigor.handler(reducers.first()))),
+      rigor.fn('extra_keys', (v) => {
+        const dvg = makeDvg();
+        dvg.setValue('budget', { __subject: 't', tenant: 't', feature: 'x', extra: 'zzz' }, v);
+        return dvg.getValue('budget', { __subject: 't', tenant: 't', feature: 'x', extra: 'zzz' }).value;
+      }, rigor.args(rigor.gen.int(0, 100))),
+      rigor.fn('positional_arity', (v) => {
+        const dvg = makeDvg();
+        dvg.setValue('budget', ['t', 'x'], v);
+        return dvg.getValue('budget', ['t', 'x']).value;
+      }, rigor.args(rigor.gen.int(0, 100))),
+      rigor.fn('unit_preserved', (v) => {
+        const dvg = makeDvg();
+        dvg.setValue('budget', { __subject: 't', tenant: 't', feature: 'x' }, v, { unit: 'tokens', source: 'ledger' });
+        const e = dvg.getValue('budget', { __subject: 't', tenant: 't', feature: 'x' });
+        return { value: e.value, unit: e.unit, source: e.source };
+      }, rigor.args(rigor.gen.int(0, 100))),
+    ];
+    const checks = [
+      rigor.after('array_param', (ctx) => ctx.error == null && ctx.actual === 7),
+      rigor.after('extra_keys', (ctx) => ctx.actual === ctx.args[0]),
+      rigor.after('positional_arity', (ctx) => ctx.actual === ctx.args[0]),
+      rigor.after('unit_preserved', (ctx) => ctx.actual.value === ctx.args[0] && ctx.actual.unit === 'tokens' && ctx.actual.source === 'ledger'),
+    ];
+    await expectPass('bindings', actions, checks);
+  });
+
+  it('strict:false degrades gracefully for unknown measures; strict mode throws', async () => {
+    const actions = [
+      rigor.fn('strict_false', (cb) => {
+        const rt = new DSLRuntime(new Arbiter()).compile(DSL, 'r');
+        const dvg = new DSLValueGraph(rt, { strict: false });
+        dvg.setValue('nope', {}, 1);        // no-op
+        dvg.resolve('nope', () => 1);       // no-op
+        const g = dvg.getValue('nope', {}); // null
+        dvg.measure('nope', {}).then(
+          (r) => cb(null, { get: g, measure: r.value }),
+          () => cb(null, { get: g, measure: 'rejected' })
+        );
+      }, rigor.args(rigor.handler(reducers.first()))),
+      rigor.fn('no_value_null', () => {
+        const dvg = makeDvg();
+        return dvg.getValue('budget', { __subject: 't', tenant: 't', feature: 'x' }) === null ? 'null' : 'value';
+      }, rigor.args()),
+    ];
+    const checks = [
+      rigor.after('strict_false', (ctx) => ctx.actual.get === null && ctx.actual.measure === null),
+      rigor.after('no_value_null', (ctx) => ctx.actual === 'null'),
+    ];
+    await expectPass('strict', actions, checks);
+  });
+
+  it('concurrent measure retrievals all resolve to the same stored value', async () => {
+    const actions = [
+      rigor.fn('concurrent_measure', (value, cb) => {
+        const dvg = makeDvg();
+        dvg.setValue('budget', { __subject: 't', tenant: 't', feature: 'x' }, value);
+        const N = 5;
+        const calls = [];
+        for (let i = 0; i < N; i++) {
+          calls.push(dvg.measure('budget', { __subject: 't', tenant: 't', feature: 'x' }).then((r) => r.value));
+        }
+        Promise.all(calls).then((values) => cb(null, values), (e) => cb(e));
+      }, rigor.args(rigor.gen.int(0, 100), rigor.handler(reducers.first()))),
+    ];
+    const checks = [
+      rigor.after('concurrent_measure', (ctx) =>
+        ctx.error == null && Array.isArray(ctx.actual) && ctx.actual.length === 5 && ctx.actual.every((v) => v === ctx.args[0])),
+    ];
+    await expectPass('concurrent', actions, checks);
+  });
+
+  it('stored values and resolvers coexist per subject (stored wins on its own subject)', async () => {
+    const actions = [
+      rigor.fn('subject_resolver_mix', (a, b, cb) => {
+        const dvg = makeDvg();
+        dvg.setValue('budget', { __subject: 'A', tenant: 'A', feature: 'x' }, a);
+        dvg.resolve('budget', (s) => b);
+        dvg.measure('budget', { __subject: 'A', tenant: 'A', feature: 'x' }).then(
+          (r1) => dvg.measure('budget', { __subject: 'B', tenant: 'B', feature: 'x' }).then(
+            (r2) => cb(null, { a: r1.value, b: r2.value }),
+            (e) => cb(e)
+          ),
+          (e) => cb(e)
+        );
+      }, rigor.args(rigor.gen.int(0, 100), rigor.gen.int(0, 100), rigor.handler(reducers.first()))),
+    ];
+    const checks = [
+      rigor.after('subject_resolver_mix', (ctx) =>
+        ctx.error == null && ctx.actual.a === ctx.args[0] && ctx.actual.b === ctx.args[1]),
+    ];
+    await expectPass('subject-resolver-mix', actions, checks);
+  });
+
+  it('final confirmation: positional arity enforced, zero-param measures, control keys stripped', async () => {
+    const actions = [
+      rigor.fn('arity_too_many', (v) => {
+        const dvg = makeDvg();
+        try { dvg.setValue('budget', ['t', 'x', 'extra'], v); return { ok: true }; }
+        catch (e) { return { ok: false, msg: e.message }; }
+      }, rigor.args(rigor.gen.int(0, 100))),
+      rigor.fn('arity_too_few', (v) => {
+        const dvg = makeDvg();
+        try { dvg.setValue('budget', ['t'], v); return { ok: true }; }
+        catch (e) { return { ok: false, msg: e.message }; }
+      }, rigor.args(rigor.gen.int(0, 100))),
+      rigor.fn('arity_exact', (v) => {
+        const dvg = makeDvg();
+        dvg.setValue('budget', ['t', 'x'], v);
+        return dvg.getValue('budget', ['t', 'x']).value;
+      }, rigor.args(rigor.gen.int(0, 100))),
+      rigor.fn('zero_param_measure', (v) => {
+        const rt = new DSLRuntime(new Arbiter()).compile(`measure heartbeat() { } PROVIDES number`, 'r');
+        const dvg = new DSLValueGraph(rt);
+        dvg.setValue('heartbeat', {}, v);
+        const e = dvg.getValue('heartbeat', {});
+        return e ? e.value : 'MISSING';
+      }, rigor.args(rigor.gen.int(0, 100))),
+      rigor.fn('actor_stripped', (v) => {
+        const dvg = makeDvg();
+        // __actor is a control key → stripped from the cache key, so differing
+        // actors hit the SAME stored entry.
+        dvg.setValue('budget', { __actor: 'actor:1', __subject: 't', tenant: 't', feature: 'x' }, v);
+        return dvg.getValue('budget', { __actor: 'actor:2', __subject: 't', tenant: 't', feature: 'x' }).value;
+      }, rigor.args(rigor.gen.int(0, 100))),
+    ];
+    const checks = [
+      rigor.after('arity_too_many', (ctx) => ctx.actual.ok === false && /expects 2 positional argument\(s\), got 3/.test(ctx.actual.msg)),
+      rigor.after('arity_too_few', (ctx) => ctx.actual.ok === false && /expects 2 positional argument\(s\), got 1/.test(ctx.actual.msg)),
+      rigor.after('arity_exact', (ctx) => ctx.actual === ctx.args[0]),
+      rigor.after('zero_param_measure', (ctx) => ctx.actual === ctx.args[0]),
+      rigor.after('actor_stripped', (ctx) => ctx.actual === ctx.args[0]),
+    ];
+    await expectPass('final-confirm', actions, checks);
+  });
+
+  it('hardening: retrieval paths, sync-throw resolvers, unregister, param-driven resolvers, NaN', async () => {
+    const actions = [
+      rigor.fn('get_sync_vs_measure_async', (value, cb) => {
+        const dvg = makeDvg();
+        dvg.resolve('budget', (s, p, ctx, done) => { setTimeout(() => done(null, value), 1); });
+        const syncPath = dvg.getValue('budget', { __subject: 't', tenant: 't', feature: 'x' });
+        dvg.measure('budget', { __subject: 't', tenant: 't', feature: 'x' }).then(
+          (r) => cb(null, { sync: syncPath === null ? 'null' : syncPath.value, async: r.value }),
+          (e) => cb(e)
+        );
+      }, rigor.args(rigor.gen.int(0, 100), rigor.handler(reducers.first()))),
+      rigor.fn('resolver_throws_sync', (cb) => {
+        const dvg = makeDvg();
+        dvg.resolve('budget', () => { throw new Error('boom'); });
+        dvg.measure('budget', { __subject: 't', tenant: 't', feature: 'x' }).then(
+          (r) => cb(null, { ok: true, v: r.value }),
+          (e) => cb(null, { ok: false, msg: e.message })
+        );
+      }, rigor.args(rigor.handler(reducers.first()))),
+      rigor.fn('unregister_after_attach', (cb) => {
+        const rt = new DSLRuntime(new Arbiter()).compile(DSL, 'r');
+        const dvg = new DSLValueGraph(rt);
+        dvg.attach();
+        rt.unregisterMeasure('budget');
+        rt.measure('budget', { __subject: 't', tenant: 't', feature: 'x' }).then(
+          (r) => cb(null, { ok: true, v: r.value }),
+          (e) => cb(null, { ok: false, msg: e.message })
+        );
+      }, rigor.args(rigor.handler(reducers.first()))),
+      rigor.fn('resolver_from_params', (x, y, cb) => {
+        const dvg = makeDvg();
+        dvg.resolve('budget', (s, p, ctx, done) => done(null, p.feature === 'a' ? x : y));
+        dvg.measure('budget', { __subject: 't', tenant: 't', feature: 'a' }).then(
+          (r1) => dvg.measure('budget', { __subject: 't', tenant: 't', feature: 'b' }).then(
+            (r2) => cb(null, { a: r1.value, b: r2.value }),
+            (e) => cb(e)
+          ),
+          (e) => cb(e)
+        );
+      }, rigor.args(rigor.gen.int(0, 100), rigor.gen.int(0, 100), rigor.handler(reducers.first()))),
+      rigor.fn('nan_rejected', () => {
+        const dvg = makeDvg();
+        try { dvg.setValue('budget', { __subject: 't', tenant: 't', feature: 'x' }, Number.NaN); return { ok: true }; }
+        catch (e) { return { ok: false, msg: e.message }; }
+      }, rigor.args()),
+    ];
+    const checks = [
+      rigor.after('get_sync_vs_measure_async', (ctx) =>
+        ctx.error == null && ctx.actual.sync === 'null' && ctx.actual.async === ctx.args[0]),
+      rigor.after('resolver_throws_sync', (ctx) => ctx.actual.ok === false && /boom/.test(ctx.actual.msg)),
+      rigor.after('unregister_after_attach', (ctx) => ctx.actual.ok === false && /no provider registered/.test(ctx.actual.msg)),
+      rigor.after('resolver_from_params', (ctx) =>
+        ctx.error == null && ctx.actual.a === ctx.args[0] && ctx.actual.b === ctx.args[1]),
+      rigor.after('nan_rejected', (ctx) => ctx.actual.ok === false && /must match declared type 'number'/.test(ctx.actual.msg)),
+    ];
+    await expectPass('hardening', actions, checks);
+  });
+});

tests/rigor/dsl-value-graph.test.js

@@ -0,0 +1,226 @@
+/**
+ * tests/rigor/dsl-value-graph.test.js — js-rigor deep tests for the
+ * DSLValueGraph integration (evidence DSL declares the value-graph's typing;
+ * measures retrieve through the graph; attributes are stored directly).
+ *
+ * Covers, as property campaigns:
+ *   - setValue/getValue round-trips across every declared value type
+ *   - type enforcement (wrong-typed writes always reject)
+ *   - parameter-binding validation (wrong-typed params always reject)
+ *   - subject scoping (different subjects never share entries)
+ *   - attach() parity (runtime.measure === value-graph retrieval)
+ *   - external resolvers compute, and a stored value wins over the resolver
+ *   - invalidation clears a stored value (next retrieval → null)
+ *   - schema derivation from generated measure declarations
+ *   - multi-measure independence
+ */
+import { describe, it } from 'node:test';
+import { rigor, reducers } from '@rigor/core';
+import { Arbiter } from '@arbiter/core';
+import { DSLRuntime, DSLValueGraph } from '../../src/index.js';
+
+const DSL = `
+  definition Tenant { id: string }
+  measure budget(tenant: Tenant, feature: string) { } PROVIDES number
+  measure label(user: string) { } PROVIDES string
+  measure active(user: string) { } PROVIDES boolean
+  measure tags(user: string) { } PROVIDES array
+`;
+
+function makeDvg() {
+  const rt = new DSLRuntime(new Arbiter()).compile(DSL, 'vg-rigor');
+  return new DSLValueGraph(rt);
+}
+
+async function expectPass(name, actions, checks, config = {}) {
+  const report = await rigor.campaign(actions, rigor.crucible(checks))
+    .run({ seed: `dsl-vg-${name}`, effort: 120, artifacts: { dir: '', persist: 'never' }, ...config });
+  if (report.status !== 'passed') {
+    const detail = (report.failures || []).slice(0, 5)
+      .map((f) => JSON.stringify({ action: f.actionName || f.action, inv: f.name, args: f.args, msg: f.message }));
+    throw new Error(`campaign '${name}' failed.\n${detail.join('\n')}`);
+  }
+  return report;
+}
+
+describe('DSLValueGraph integration (rigor)', () => {
+  it('setValue/getValue round-trips every declared value type', async () => {
+    const actions = [
+      rigor.fn('rt_number', (v) => {
+        const dvg = makeDvg();
+        dvg.setValue('budget', { __subject: 't', tenant: 't', feature: 'x' }, v);
+        const e = dvg.getValue('budget', { __subject: 't', tenant: 't', feature: 'x' });
+        return e ? e.value : 'MISSING';
+      }, rigor.args(rigor.gen.int(-100000, 100000))),
+      rigor.fn('rt_string', (v) => {
+        const dvg = makeDvg();
+        dvg.setValue('label', { __subject: 't', user: 'u' }, v);
+        const e = dvg.getValue('label', { __subject: 't', user: 'u' });
+        return e ? e.value : 'MISSING';
+      }, rigor.args(rigor.gen.asciiString())),
+      rigor.fn('rt_bool', (v) => {
+        const dvg = makeDvg();
+        dvg.setValue('active', { __subject: 't', user: 'u' }, v);
+        const e = dvg.getValue('active', { __subject: 't', user: 'u' });
+        return e ? e.value : 'MISSING';
+      }, rigor.args(rigor.gen.boolean())),
+      rigor.fn('rt_array', (v) => {
+        const dvg = makeDvg();
+        dvg.setValue('tags', { __subject: 't', user: 'u' }, v);
+        const e = dvg.getValue('tags', { __subject: 't', user: 'u' });
+        return e ? e.value : null;
+      }, rigor.args(rigor.gen.array(rigor.gen.string(), 0, 5))),
+    ];
+    const checks = [
+      rigor.after('rt_number', (ctx) => ctx.actual === ctx.args[0]),
+      rigor.after('rt_string', (ctx) => ctx.actual === ctx.args[0]),
+      rigor.after('rt_bool', (ctx) => ctx.actual === ctx.args[0]),
+      rigor.after('rt_array', (ctx) => JSON.stringify(ctx.actual) === JSON.stringify(ctx.args[0])),
+    ];
+    await expectPass('roundtrip', actions, checks, { effort: 200 });
+  });
+
+  it('type enforcement: wrong-typed writes always reject, right-typed always pass', async () => {
+    const actions = [
+      rigor.fn('type_ok', (v) => {
+        const dvg = makeDvg();
+        dvg.setValue('budget', { __subject: 't', tenant: 't', feature: 'x' }, v);
+        return dvg.getValue('budget', { __subject: 't', tenant: 't', feature: 'x' }).value;
+      }, rigor.args(rigor.gen.int(-100, 100))),
+      rigor.fn('type_reject', (v) => {
+        const dvg = makeDvg();
+        try { dvg.setValue('label', { user: 'u' }, v); return { ok: true }; }
+        catch (e) { return { ok: false, msg: e.message }; }
+      }, rigor.args(rigor.gen.oneOf([rigor.gen.int(0, 100), rigor.gen.boolean(), rigor.gen.array(rigor.gen.int(0, 9), 1, 3)]))),
+      rigor.fn('param_reject', (v) => {
+        const dvg = makeDvg();
+        try { dvg.setValue('budget', { tenant: 't', feature: v }, 1); return { ok: true }; }
+        catch (e) { return { ok: false, msg: e.message }; }
+      }, rigor.args(rigor.gen.oneOf([rigor.gen.constant(42), rigor.gen.boolean(), rigor.gen.array(rigor.gen.int(0, 9), 1, 2)]))),
+    ];
+    const checks = [
+      rigor.after('type_ok', (ctx) => ctx.actual === ctx.args[0]),
+      rigor.after('type_reject', (ctx) => ctx.actual.ok === false && /must match declared type 'string'/.test(ctx.actual.msg)),
+      rigor.after('param_reject', (ctx) => ctx.actual.ok === false && /parameter 'feature'/.test(ctx.actual.msg)),
+    ];
+    await expectPass('typecheck', actions, checks, { effort: 200 });
+  });
+
+  it('subjects never share entries', async () => {
+    const actions = [
+      rigor.fn('subject_isolation', (a, b) => {
+        const dvg = makeDvg();
+        dvg.setValue('budget', { __subject: 'A', tenant: 'A', feature: 'x' }, a);
+        dvg.setValue('budget', { __subject: 'B', tenant: 'B', feature: 'x' }, b);
+        const ea = dvg.getValue('budget', { __subject: 'A', tenant: 'A', feature: 'x' });
+        const eb = dvg.getValue('budget', { __subject: 'B', tenant: 'B', feature: 'x' });
+        return { a: ea ? ea.value : null, b: eb ? eb.value : null };
+      }, rigor.args(rigor.gen.int(-50, 50), rigor.gen.int(-50, 50))),
+    ];
+    const checks = [
+      rigor.after('subject_isolation', (ctx) => ctx.actual.a === ctx.args[0] && ctx.actual.b === ctx.args[1]),
+    ];
+    await expectPass('subjects', actions, checks, { effort: 120 });
+  });
+
+  it('attach() makes runtime.measure retrieve through the value-graph', async () => {
+    const actions = [
+      rigor.fn('attach_parity', (value, cb) => {
+        const rt = new DSLRuntime(new Arbiter()).compile(DSL, 'vg-rigor');
+        const dvg = new DSLValueGraph(rt);
+        dvg.attach();
+        dvg.setValue('budget', { __subject: 't', tenant: 't', feature: 'x' }, value);
+        rt.measure('budget', { __subject: 't', tenant: 't', feature: 'x' }).then(
+          (r) => cb(null, r.value),
+          (e) => cb(e)
+        );
+      }, rigor.args(rigor.gen.int(0, 100), rigor.handler(reducers.first()))),
+    ];
+    const checks = [
+      rigor.after('attach_parity', (ctx) => ctx.error == null && ctx.actual === ctx.args[0]),
+    ];
+    await expectPass('attach', actions, checks, { effort: 120 });
+  });
+
+  it('external resolvers compute; a stored value wins over the resolver', async () => {
+    const actions = [
+      rigor.fn('resolver_compute', (value, cb) => {
+        const dvg = makeDvg();
+        dvg.resolve('budget', (s, p, ctx, done) => done(null, { value, unit: 'tokens', source: 'resolver' }));
+        dvg.measure('budget', { __subject: 't', tenant: 't', feature: 'x' }).then(
+          (r) => cb(null, { value: r.value, source: r.source }),
+          (e) => cb(e)
+        );
+      }, rigor.args(rigor.gen.int(0, 100), rigor.handler(reducers.first()))),
+      rigor.fn('stored_wins', (value, cb) => {
+        const dvg = makeDvg();
+        dvg.resolve('budget', (s, p, ctx, done) => done(null, 999));
+        dvg.setValue('budget', { __subject: 't', tenant: 't', feature: 'x' }, value);
+        dvg.measure('budget', { __subject: 't', tenant: 't', feature: 'x' }).then(
+          (r) => cb(null, r.value),
+          (e) => cb(e)
+        );
+      }, rigor.args(rigor.gen.int(0, 100), rigor.handler(reducers.first()))),
+    ];
+    const checks = [
+      rigor.after('resolver_compute', (ctx) => ctx.error == null && ctx.actual.value === ctx.args[0] && ctx.actual.source === 'resolver'),
+      rigor.after('stored_wins', (ctx) => ctx.error == null && ctx.actual === ctx.args[0]),
+    ];
+    await expectPass('resolvers', actions, checks, { effort: 120 });
+  });
+
+  it('invalidation clears a stored value; the next retrieval is null', async () => {
+    const actions = [
+      rigor.fn('invalidate_clears', (value, cb) => {
+        const dvg = makeDvg();
+        dvg.setValue('budget', { __subject: 't', tenant: 't', feature: 'x' }, value);
+        dvg.vg.invalidate('t', 'budget', { tenant: 't', feature: 'x' });
+        dvg.measure('budget', { __subject: 't', tenant: 't', feature: 'x' }).then(
+          (r) => cb(null, r.value),
+          (e) => cb(e)
+        );
+      }, rigor.args(rigor.gen.int(0, 100), rigor.handler(reducers.first()))),
+    ];
+    const checks = [
+      rigor.after('invalidate_clears', (ctx) => ctx.error == null && ctx.actual === null),
+    ];
+    await expectPass('invalidate', actions, checks, { effort: 120 });
+  });
+
+  it('schema derivation: every generated measure gets its declared returnType and params', async () => {
+    const actions = [
+      rigor.fn('schema_ok', (name, type) => {
+        const dsl = `definition T { id: string } measure ${name}(p: T) { } PROVIDES ${type}`;
+        const rt = new DSLRuntime(new Arbiter()).compile(dsl, 'gen');
+        const dvg = new DSLValueGraph(rt);
+        const spec = dvg.schema()[name];
+        return { returnType: spec && spec.returnType, params: spec ? spec.params.map((x) => x.name) : null };
+      }, rigor.args(
+        rigor.gen.oneOf(['balance', 'rate', 'quota', 'volume', 'meter']),
+        rigor.gen.oneOf(['number', 'string', 'boolean', 'array'])
+      )),
+    ];
+    const checks = [
+      rigor.after('schema_ok', (ctx) => ctx.actual.returnType === ctx.args[1] && JSON.stringify(ctx.actual.params) === JSON.stringify(['p'])),
+    ];
+    await expectPass('schema', actions, checks, { effort: 120 });
+  });
+
+  it('measures are independent (no cross-measure cache sharing)', async () => {
+    const actions = [
+      rigor.fn('multi_measure', (a, b) => {
+        const dvg = makeDvg();
+        dvg.setValue('budget', { __subject: 't', tenant: 't', feature: 'x' }, a);
+        dvg.setValue('label', { __subject: 't', user: 'u' }, String(b));
+        return {
+          budget: dvg.getValue('budget', { __subject: 't', tenant: 't', feature: 'x' }).value,
+          label: dvg.getValue('label', { __subject: 't', user: 'u' }).value
+        };
+      }, rigor.args(rigor.gen.int(0, 100), rigor.gen.int(0, 100))),
+    ];
+    const checks = [
+      rigor.after('multi_measure', (ctx) => ctx.actual.budget === ctx.args[0] && ctx.actual.label === String(ctx.args[1])),
+    ];
+    await expectPass('independence', actions, checks, { effort: 120 });
+  });
+});